[00:39.050 --> 00:42.810]  You're watching HNNCast with Space Rogue on the Hacker News Network.
[00:47.050 --> 00:49.310]  HNNCast is sponsored by...
[00:50.350 --> 00:51.790]  Immunity Incorporated.
[00:52.270 --> 00:53.570]  Knowing you are secure.
[00:54.730 --> 00:55.970]  Become a sponsor.
[00:56.890 --> 00:59.230]  Email sales at hackernews.com.
[01:01.940 --> 01:04.260]  This is Space Rogue for the Hacker News Network.
[01:04.260 --> 01:07.300]  And this is HNNCast for the last week of October 2009.
[01:08.000 --> 01:09.620]  Our top story this week.
[01:10.080 --> 01:19.720]  Researchers at Columbia University scanned 130 million IP addresses around the globe and found nearly 300,000 devices with admin interfaces open to the world.
[01:19.960 --> 01:22.340]  And 21,000 of those with default passwords.
[01:23.020 --> 01:30.160]  It was found at Linksys routers with the worst offenders with 45% of publicly accessible routers still had default password installed.
[01:30.480 --> 01:35.180]  Why bother with compromising machines when you can have a botnet composed of routers instead?
[01:35.860 --> 01:36.800]  Probably easier.
[01:37.240 --> 01:43.920]  And in a related story, last week we told you about Time Warner Cable and the default passwords on its SMC Wi-Fi cable modems.
[01:44.360 --> 01:52.840]  Well, the company claimed that they had patched the vulnerability, but according to the researcher who originally found the flaw, the problem is still out there on a large number of the routers.
[01:52.840 --> 01:56.160]  Big surprise that a cable company doesn't care about its customers.
[01:57.560 --> 02:06.720]  Unu from Romania has found SQL injection flaws in numerous high-profile websites, including Orange France, ING, HSBC, and the UK Parliament.
[02:07.040 --> 02:12.720]  And recently, he thought he had discovered one at BarackObama.com, the fundraising website for the president.
[02:13.400 --> 02:24.180]  Unu detailed his findings on his blog, but it turns out that he may have been fooled by a misconfiguration of the website that may have sent the request via a proxy forward to the calendar system at Roosevelt University.
[02:25.140 --> 02:35.320]  BarackObama.com was originally designed by a company called Blue State Digital, and it is thought that they either accidentally or unknowingly left the smart proxy in place, allowing for various redirects.
[02:35.600 --> 02:43.980]  So while I wouldn't go so far as to call this a hoax, as some media have done, the problems are not as drastic as first believed, although they are still pretty damn bad.
[02:44.850 --> 02:52.020]  And in a related story, WhiteHouse.gov recently switched from the proprietary CMS to Drupal, evidently for increased security.
[02:53.020 --> 03:00.800]  Several Swedish newspapers and the Swedish police websites were knocked offline Thursday morning after being hit with what appeared to be coordinated DDoS attacks.
[03:01.610 --> 03:05.560]  Most of the sites were back up by midday, and Swedish authorities are investigating.
[03:05.740 --> 03:09.800]  It was not immediately known where the attacks originated from or why the sites were targeted.
[03:09.800 --> 03:13.840]  I guess it's a good thing that two years ago, Sweden made DDoS attacks illegal.
[03:14.280 --> 03:17.340]  Because once you pass a law, everyone stops doing it, right?
[03:18.820 --> 03:21.820]  We will be back with more HNNCast right after these messages.
[03:39.560 --> 03:41.440]  Welcome back to HNNCast.
[03:42.400 --> 03:47.840]  Facebook continues to be a favorite target of online criminals with numerous attacks coming to light this week.
[03:48.380 --> 03:54.880]  First, researchers found numerous Facebook apps have been compromised spewing out malware via iframes embedded into the apps.
[03:55.100 --> 03:59.740]  The unique part of this attack is that the applications were compromised from the developers' own machines.
[04:00.300 --> 04:15.820]  In a different incident, the Harmony Guy found over 9,000 Facebook applications, which were affected by cross-site scripting vulnerabilities, including 19 that had passed Facebook's verified application program, including FarmVille, Causes, Living Social,
[04:16.220 --> 04:18.260]  Movies, FarmTown, and Newville.
[04:19.000 --> 04:23.220]  This week also saw several phishing attempts perpetrated against Facebook users.
[04:23.520 --> 04:32.960]  The Bredolab Trojan comes as an attachment, presumably as a Facebook password reset confirmation email, which says that you can find the new password to your account in the attachment.
[04:33.420 --> 04:41.660]  The second sends a legitimate-looking email asking you to log into Facebook to update your account, but instead installs the Zeus Trojan onto your machine.
[04:41.660 --> 04:46.840]  The Zeus botnet has been observed sending out 30,000 copies of this email every minute.
[04:47.580 --> 04:53.800]  Remember kids, never open an unexpected attachment no matter who it's from, and never click on a link in an email.
[04:54.500 --> 04:56.540]  Just type it in manually into the browser.
[04:57.240 --> 05:03.980]  The online job site for the Guardian newspaper in the UK has been hit with what has been called a sophisticated and deliberate attack.
[05:04.480 --> 05:09.360]  Third-party job board software company Magdex is thought to host the Guardian's online job board.
[05:09.660 --> 05:12.680]  The e-crime unit at Scotland Yard is investigating.
[05:13.260 --> 05:21.920]  It is unclear how the attackers got in, what they took, or how many people were affected, but rest assured the Guardian is taking this with the quote utmost seriousness.
[05:22.560 --> 05:27.820]  Yeah, so serious they won't release any details, but somehow they know it was a sophisticated and deliberate attack.
[05:28.300 --> 05:32.320]  Probably just a simple SQL injection attack, and someone's covering their ass.
[05:33.300 --> 05:46.040]  Solos, aka Gary McKinnon's final, final appeal, evidently wasn't very final, as the UK Home Secretary has decided to delay his extradition to the U.S. to face seven-year-old charges of breaking into NASA computers.
[05:46.700 --> 05:50.460]  Alan Johnson said that he wants to review the new medical evidence very carefully.
[05:51.000 --> 05:56.540]  Yeah, I guess we don't have any doctors here in the U.S., and Alan Johnson is an expert in Asperger's syndrome anyway.
[05:57.180 --> 05:58.000]  Yeah, whatever.
[05:58.600 --> 06:09.600]  The Economic and Financial Crimes Commission of Nigeria has shut down some 800 websites and busted 18 syndicates of 419 email scammers in Project Eagle Claw.
[06:11.960 --> 06:13.280]  The eagle snatching.
[06:13.560 --> 06:15.280]  The next one should be the eagle's tucker.
[06:19.860 --> 06:22.020]  Mine is also the eagle's claw snatching.
[06:22.500 --> 06:23.660]  What do you think of it?
[06:26.300 --> 06:28.340]  I know more about eagle's claw.
[06:29.480 --> 06:40.880]  The EFCC has begun working with Microsoft and has started to use smart technology, as opposed to stupid technology, I guess, in an effort to reduce the amount of scam email that comes out of the country.
[06:41.260 --> 06:46.560]  I hope the esteemed Prince Mumbadi will be able to get his millions of dollars out of the country in time.
[06:56.840 --> 07:03.300]  The latest bank scam involves voice-over IP phone systems, small regional banks, and ATM machines in Romania.
[07:04.260 --> 07:12.320]  First, the cyber criminals break into the asterisk phone system of a small unsuspecting business, and then use that system to call customers of small regional banks.
[07:12.960 --> 07:17.460]  Then they use pre-recorded messages to trick people into giving up their bank account and PIN numbers.
[07:17.860 --> 07:24.900]  The crooks encode this information onto a debit card, walk down the street to their local Romanian ATM, and empty the account.
[07:25.240 --> 07:27.900]  So far, the customers of at least three banks have been hit.
[07:28.160 --> 07:33.820]  Liberty Bank in California, Union State Bank in Alabama, and Solvay Bank in New York.
[07:34.300 --> 07:38.380]  Some people have started calling this sort of fraud vishing, as in voice phishing.
[07:38.840 --> 07:39.780]  Come on, people.
[07:39.960 --> 07:41.720]  What is wrong with just plain old fraud?
[07:41.720 --> 07:44.660]  Don't we have enough stupid crazy words for cybercrime already?
[07:45.540 --> 07:52.780]  The Department of Homeland Security has begun searching for the first 150 out of 1,000 InfoSec professionals for fast-track hiring.
[07:53.160 --> 08:06.440]  Of the jobs that we found listed, 20 have minimum saluting salaries of $100,000 per year or more, including titles such as architect, supervisory program analyst, program manager, and IT specialist InfoSec.
[08:07.000 --> 08:13.020]  Well, if they have a hard time finding people, and I suspect they will, I know where they can advertise to reach the people they need.
[08:13.380 --> 08:13.860]  A wink wink.
[08:15.260 --> 08:19.320]  Courtnee was off this week, but we'll be right back with the HNN Quickies right after these messages.
[08:36.990 --> 08:41.630]  Welcome back to HNNCast, and now for a few quick stories we found on the net this week.
[08:42.550 --> 08:53.070]  A recent report released by the Anti-Phishing Working Group has fingered Avalanche, a highly organized cybercrime group, of conducting 25% of all phishing attacks detected in 2009.
[08:54.010 --> 08:57.850]  UC Sniff was released at Torcon in Toronto, Canada last weekend.
[08:58.210 --> 09:08.810]  Unlike previously released eavesdropping software, UC Sniff has the capability to eavesdrop on unencrypted voice over IP calls in real time, as opposed to having to reassemble the call later.
[09:09.190 --> 09:11.850]  This works very well with iPhones on Wi-Fi.
[09:13.030 --> 09:16.730]  Gift cards are quickly becoming a convenient and easy target for fraudsters.
[09:16.970 --> 09:23.810]  By scanning the mag stripe of a gift card in the store, and then cloning it, they just need to wait for someone to buy and activate the card.
[09:24.870 --> 09:27.770]  A new eavesdropping tool has been released for Blackberries.
[09:28.270 --> 09:32.130]  Phone Snoop can turn any Blackberry into a silent remote listening device.
[09:32.970 --> 09:36.790]  Software such as Phone Snoop has been around for a while, but now it's free.
[09:37.630 --> 09:47.750]  An Australian pizza delivery driver used the default password information from ATM service manuals he found on the Internet to break into a few ATMs and steal $30,000 Australian.
[09:48.750 --> 09:53.470]  Unfortunately, he kept going back to the same ATMs, and he used his own cards for initial access.
[09:53.970 --> 09:55.830]  Cops didn't have a very hard time finding him.
[09:57.070 --> 10:09.150]  We've been reporting on the likes of online banking Trojans such as Clampy and Zeus for a while now, while the FBI has recently stated that the total losses now exceed $40 million from numerous small and mid-sized companies across the country.
[10:09.650 --> 10:14.550]  About the only way to be safe is to do your banking via a live CD or via pen and paper.
[10:14.750 --> 10:15.590]  That still works.
[10:16.130 --> 10:26.270]  The University of Wisconsin-Madison's Chemistry Department has suffered a network breach compromising at least 40 machines and exposing the personal information of almost 3,000 people on the campus.
[10:26.710 --> 10:30.190]  The incident lasted for at least 18 months before it was discovered.
[10:31.030 --> 10:39.270]  The websites of both the Atheist Foundation of Australia and the Global Atheist Convention were knocked offline in a major DDoS attack earlier this week.
[10:39.490 --> 10:44.730]  And the atheists continue to pray to nobody that the Australian Federal Police catch the bad guys.
[10:45.550 --> 10:54.310]  Gizmodo had to apologize to its readers this week as it joined the New York Times, CNN and other reputable sites in having malware distributed from Banneraz displayed on its site.
[10:55.050 --> 10:59.650]  Gizmodo claims that it took them a while to realize what was going on because they all use Macs.
[11:00.650 --> 11:06.550]  ThoughtCon or 312Con, the area code for Chicago, will be held this April and is looking for sponsors.
[11:06.870 --> 11:09.490]  They have promotional opportunities for as low as 20 bucks.
[11:10.070 --> 11:14.990]  They're also hoping to find someone to write a Wi-Fi enabled Commodore 64 Twitter client.
[11:15.710 --> 11:16.970]  Yeah, good luck with that.
[11:17.950 --> 11:22.110]  Zeus has started to use the FDIC as a cover to trick users into installing itself.
[11:22.550 --> 11:31.710]  An email claiming to be from the FDIC indicates that your bank has failed and offers up a PDF or Word document for download for you to check your account details.
[11:32.050 --> 11:35.510]  The download is, of course, a copy of the bank account sucking Trojan.
[11:36.390 --> 11:46.650]  In a fraud scheme that spanned over 8 years, a computer technician at the Bank of New York has been arrested and charged with over 140 counts ranging from grand larceny to money laundering.
[11:46.890 --> 11:52.190]  He's accused of stealing the identities of his co-workers and using those to set up fake bank accounts.
[11:52.570 --> 11:57.310]  Those accounts were then used to hold the money stolen from the bank accounts of charities and other non-profits.
[11:57.910 --> 11:58.770]  Eight years?
[11:59.150 --> 11:59.850]  What the hell?
[12:01.770 --> 12:06.890]  The computer network of the Swiss Foreign Ministry has been the target of a, quote, very professional attack.
[12:07.350 --> 12:14.930]  The Foreign Ministry characterized the instance as a virus attack, but said the computer systems were targeted with the intent of gathering specific information.
[12:15.410 --> 12:17.190]  The source of the attack is unknown.
[12:18.310 --> 12:20.450]  And now for this week's Stack of Shame.
[12:20.730 --> 12:26.130]  The list of all known open vulnerabilities, 30 days older or older, as catalogued by the Zero Day Initiative.
[13:18.560 --> 13:20.540]  That's it for this week's HNNCast.
[13:20.700 --> 13:24.240]  I've been your host Space Rogue, and you've been watching the Hacker News Network.
[13:27.570 --> 13:32.490]  Remember, if you have any news you think we should report, send it to news at hackernews.com.
[13:36.010 --> 13:38.050]  You have been watching HNNCast.
[13:38.230 --> 13:40.430]  This is Space Rogue for the Hacker News Network.
[13:45.330 --> 13:47.910]  Funny dude, funny dude, funny dude, bad things.