[00:08.400 --> 00:12.400]  The, uh, European Space Agency, the ISIS team, sir, that's you.
[00:39.200 --> 00:42.840]  You're watching HNNCast with Space Rogue on the Hacker News Network.
[00:47.210 --> 00:49.770]  HNNCast is sponsored by...
[00:50.650 --> 00:51.850]  Immunity Incorporated.
[00:52.270 --> 00:53.590]  Knowing you are secure.
[00:54.870 --> 00:56.010]  Become a sponsor.
[00:56.670 --> 01:07.130]  Email sales at hackernews.com This is Space Rogue for the Hacker News Network, and this is HNNCast for the first week of November, 2009.
[01:07.890 --> 01:18.050]  This week we have stories about a suicide in a German prison, a cable modem modder gets indicted, major holes are found in SSL, and is it a Trojan or is it art?
[01:18.570 --> 01:20.170]  But first, our top story.
[01:20.530 --> 01:30.930]  The former CEO of YouSendIt, Kalid Shaikh, has been indicted by a grand jury on four counts of mail fraud after allegedly launching four DDoS attacks against the company he founded.
[01:30.930 --> 01:40.310]  Evidently, he used the Apache Bench web server testing software to overwhelm the company's servers between December 2008 and June 2009.
[01:40.890 --> 01:45.150]  If convicted, Saikh faces up to five years in jail for each count.
[01:45.890 --> 01:47.910]  Guess he was a little upset about leaving.
[01:49.090 --> 01:59.830]  A YouTube user with the account Matt5644 posted a video of his incursion into the German social online networking site, SchullerVZ, early last month.
[02:00.550 --> 02:07.510]  He used the video to prove that he had broken into the popular German social networking site, and attempted to blackmail them for 80,000 euros.
[02:08.110 --> 02:11.910]  The police were waiting when he showed up at the company's offices to collect his money.
[02:12.670 --> 02:21.070]  However, it is now being reported that Matt5644 committed suicide in the juvenile detention center Plotzinze, where he was being held.
[02:21.510 --> 02:30.490]  Although we can't confirm, some people have indicated that he didn't break into the site at all, and instead used the scraper to collect the publicly available information from the web pages.
[02:31.270 --> 02:33.610]  If true, that makes this all the more tragic.
[02:34.630 --> 02:47.150]  Der Engel, aka Ryan Harris, used to sell a MAC address cloning service to customers of Charter Communications and other cable ISPs that used Motorola surfboard modems, allowing them to surf the Internet for free.
[02:47.590 --> 02:57.250]  The online forum TCNISO.net, based in Oregon, also posted instructions on how to remove bandwidth limits from cable modems and how to surf anonymously.
[02:57.590 --> 03:03.870]  Der Engel even wrote the book, Hacking the Cable Modem, which you can now find in the HNN store on our website.
[03:04.510 --> 03:12.770]  One of the TCNISO.net members was D-Shock, who used the service to carry out DDoS attacks and a few swatting runs.
[03:13.230 --> 03:22.410]  Well, the law has finally caught up with him, and he has been indicted in Boston Federal Court on six felony counts, including conspiracy, computer intrusion, and wire fraud.
[03:22.670 --> 03:28.470]  If convicted on all counts, he faces a maximum of 20 years in prison and $1.5 million in fines.
[03:29.090 --> 03:33.190]  After reading the indictment, Der Engel said, quote, It's complete bullshit.
[03:33.550 --> 03:37.110]  Der Engel has vowed to fight the charges and has promised not to plead guilty.
[03:37.670 --> 03:43.510]  Yeah, I think after they get him in that little room and start applying the thumbscrews, a plea will start to look really, really good.
[03:44.390 --> 03:54.790]  The Internet Engineering Task Force is expecting a draft proposal to be submitted Friday to correct inherent weaknesses in TLS and SSL, the protocols that help secure transactions on the web.
[03:54.790 --> 04:02.650]  The protocol was crafted by a secret group of technology companies who have been meeting since late September to come up with a fix for the deeply embedded flaws.
[04:03.210 --> 04:07.670]  The man in the middle attack places at risk every credit card transaction on the Internet.
[04:08.170 --> 04:22.590]  However, even after the proposal is submitted and the various patches created, it will be quite a while before every server and every browser in the world are patched, leaving things like encrypted email and credit card transactions totally open to whoever wants to snip them.
[04:23.210 --> 04:24.490]  Somebody's going to have a field day.
[04:26.390 --> 04:34.950]  The creator of the Mac Space Invaders style game that was recently categorized as a Trojan by some anti-virus vendors, has claimed that the game is not, in fact, a Trojan.
[04:35.470 --> 04:44.410]  Zach Gage, the creator of Lose Lose, admits that the game does, in fact, delete users' files, but that it does so on purpose, and only after warning the user.
[04:45.190 --> 04:50.170]  Gage claimed that he created the software as an art project, as part of his MFA thesis.
[04:50.170 --> 04:53.330]  Huh, an art project that deletes my files?
[04:53.650 --> 04:54.850]  I don't think I get it.
[04:54.990 --> 04:56.490]  But then, what do I know about art?
[04:57.210 --> 05:11.150]  And in a related story, Storm 8, an iPhone software development company, has been accused of automatically accessing, collecting, and transmitting the wireless telephone number of each iPhone user who downloads any Storm 8 game, in violation of Apple guidelines.
[05:11.610 --> 05:15.730]  Storm 8 makes popular multiplayer games, such as Ninjas Live and Vampires Live.
[05:17.790 --> 05:20.810]  We'll be back with more HNNCast, right after these messages.
[05:37.980 --> 05:39.920]  Welcome back to HNNCast.
[05:41.280 --> 05:51.760]  South Korea's intelligence agency has officially named North Korea's telecommunications ministry, as the source of the July 4th DDoS attacks, launched against numerous website properties in the country.
[05:52.360 --> 06:03.640]  While North Korea has long been suspected in the attacks, this is the first time that it has been officially stated that the IPs used in the attack, were indeed traced back through China to the North Korean Ministry of Post and Telecommunications.
[06:04.260 --> 06:06.960]  Sounds to me like what we used to call Recon by Fire.
[06:07.640 --> 06:09.940]  Want to know what your enemies' capabilities are?
[06:10.220 --> 06:11.820]  Shoot at them and see what they do.
[06:14.180 --> 06:22.980]  Swedish authorities have few leads in their investigation of last week's massive denial of service attack, that downed about 40 websites, including those belonging to police and media outlets.
[06:22.980 --> 06:30.580]  At the height of the attacks, officials reported that they received over 40,000 requests per second, up from the normal 800 requests per second.
[06:30.940 --> 06:33.940]  The authorities have speculated that the attacks originated in China.
[06:34.400 --> 06:46.040]  One possible motive for the attacks is a new law giving Sweden legal permission to tap all Internet traffic passing through Swedish national borders, which would include a majority of Russian international Internet traffic.
[06:46.900 --> 06:53.880]  There's been a lot of talk lately about a theoretical evil maid attack, and now there is at least one documented case of it actually happening.
[06:54.280 --> 07:02.520]  According to the German magazine Der Spiegel, in 2006, a Syrian official staying at a hotel in London left his laptop in his hotel room.
[07:03.220 --> 07:08.380]  Israeli Mossad intelligence agents then broke into the room and planted a Trojan onto the official's laptop.
[07:09.180 --> 07:18.080]  The Trojan enabled the Mossad to have access to hundreds of documents regarding construction plans for Al-Kabir, an illicit nuclear facility in eastern Syria.
[07:18.600 --> 07:22.700]  Of course, in September of 2007, Israeli fighter jets bombed the complex.
[07:23.080 --> 07:30.320]  So remember, if you happen to have construction plans for an illicit nuclear plant on your laptop, don't leave your laptop alone in your hotel room.
[07:30.880 --> 07:31.900]  Sounds like good advice.
[07:32.600 --> 07:34.940]  And now Courtnee brings us a story about lockpicking.
[07:35.320 --> 07:35.580]  Courtnee?
[07:38.080 --> 07:39.160]  Thanks, Space Rogue.
[07:40.160 --> 07:45.440]  Officials often beg the question, why would anyone want to pick locks if not for some kind of sinister evildoing?
[07:45.820 --> 07:50.820]  But assuming lockpicking is only for bank robbers is sort of like assuming a Rubik's Cube is only for mad scientist.
[07:52.060 --> 07:56.420]  Practitioners of lock sports see it as an exploration of the unknown, solving a puzzle, or just plain old fun.
[07:56.580 --> 07:59.120]  And the link between lockpicking and hacking is pretty strong.
[07:59.720 --> 08:10.420]  One of the first lockpicking guidelines came out of MIT in the late 80s and was often used as a way not only to perpetuate physical hacks on the campus, but to also gain access to the large computers that were often locked up.
[08:11.020 --> 08:18.160]  Now, there are lockpicking competitions at many hacker cons, including the Chaos Computer Congress in Germany and Defcon in Las Vegas.
[08:18.500 --> 08:28.180]  And in Europe, the sport is much more organized with groups such as Tool, the open organization of lockpickers in the Netherlands, and the sports enthusiasts of lockpicking based in Hamburg.
[08:28.640 --> 08:34.300]  The clubs hold monthly meetings, yearly competitions, and adhere to strict ethics including not damaging the locks.
[08:34.600 --> 08:39.500]  If you're jonesing to try it yourself, most people start out with a few simple tools and try picking a padlock.
[08:39.960 --> 08:43.860]  There are a lot of guides online, not just for lockpicking, but also how to make your own picks.
[08:44.460 --> 08:47.580]  Even better, you can buy a set of lockpicks at the HNN store.
[08:48.020 --> 08:48.660]  Good luck!
[08:49.640 --> 08:50.800]  That's it for me this week.
[08:50.980 --> 08:52.720]  This is Courtnee for the Hacker News Network.
[08:53.060 --> 08:54.220]  Back to you, Space Rogue.
[08:57.420 --> 08:58.280]  Thanks, Courtnee.
[08:59.000 --> 09:03.600]  If you have jailbroken your iPhone, make sure you remember to change the default root password.
[09:04.420 --> 09:11.600]  Jailbreaking an iPhone usually involves enabling SSH, and few people change the default root password from ILPINE after they do.
[09:12.100 --> 09:16.540]  This, of course, makes it exceedingly trivial to scan for vulnerable iPhones on the network.
[09:16.980 --> 09:23.620]  One enterprising person in the Netherlands who uses the email PureInfinity did just that on the T-Mobile network.
[09:24.040 --> 09:29.100]  He then sent the users an SMS from their own phone and demanded 5 euros from each user.
[09:29.980 --> 09:35.480]  PureInfinity has since had a change of heart and returned the money collected and told users how to secure their phones.
[09:36.220 --> 09:40.260]  Yeah, that's kind of clever, but I can think of at least one better use for something like that.
[09:41.140 --> 09:42.280]  Alleen maar mooie vrouwen.
[09:42.420 --> 09:43.260]  Kijk dan, daar aan de bar.
[09:43.520 --> 09:44.800]  Achter, achter, achter, achter.
[09:44.840 --> 09:48.200]  We gaan ze allemaal een SMS sturen via Cell Broadcasting.
[09:48.400 --> 09:52.180]  In een bereik van 25 meter, krijgt u de meisje hier een berichtje van mij.
[09:52.640 --> 09:53.480]  Heel lekker ding.
[09:53.880 --> 09:53.920]  Ja.
[09:53.980 --> 09:55.780]  Je bent zeker de mooiste van vanavond.
[09:56.120 --> 09:57.040]  Een drankje.
[09:57.140 --> 09:57.780]  Een zwart.
[09:58.200 --> 09:58.780]  En een keller.
[09:58.940 --> 09:59.260]  Een munt.
[10:01.400 --> 10:02.320]  Heb je hem opgestuurd?
[10:02.460 --> 10:02.840]  Heb je hem opgestuurd?
[10:02.900 --> 10:03.560]  Komt ie, komt ie.
[10:03.980 --> 10:04.380]  Gratis.
[10:04.560 --> 10:04.960]  Gratis.
[10:06.120 --> 10:07.460]  Hoor hem, hoor hem, hoor hem.
[10:08.840 --> 10:09.380]  Kijk dan.
[10:11.000 --> 10:11.900]  Het bedacht.
[10:12.620 --> 10:13.260]  Het bedacht.
[10:13.320 --> 10:13.660]  Het bedacht.
[10:13.860 --> 10:15.760]  Komt ie, komt ie, komt ie.
[10:15.960 --> 10:18.200]  Komt ie, komt ie.
[10:18.580 --> 10:20.200]  Komt ie, komt ie.
[10:20.200 --> 10:20.320]  Komt ie.
[10:21.340 --> 10:23.080]  Komt ie, komt ie.
[10:23.480 --> 10:24.440]  See what I mean?
[10:24.660 --> 10:27.420]  Gives a whole new meaning to the term FISHING.
[10:28.520 --> 10:31.380]  It's been a busy week on the frontlines of the copyright wars.
[10:31.380 --> 10:42.660]  First, a massive secret DMCA-style international treaty has been leaked online which would drastically change the Internet as we know it if it ever becomes law, including things like the dreaded three strikes rule.
[10:43.400 --> 10:51.820]  Second, Dutch courts forced the Pirate Bay offline causing 300% surge in other trackers going online attempting to meet the BitTorrent demand.
[10:52.320 --> 10:56.460]  The Pirate Bay returned a few days later, at least they were accessible when we went to press.
[10:56.760 --> 11:05.280]  And third, due to the Lisbon Treaty being signed by all European Union member states, the Pirate Party has gained another seat in the European Parliament.
[11:05.600 --> 11:13.560]  The second Pirate Party seat will be occupied by the 22-year-old Amelia Andersdotter who will become the youngest member of the European Parliament.
[11:15.240 --> 11:24.040]  The FDIC has issued a special alert to banks about the recent rise in money mules in conjunction with Trojans and keyloggers to siphon money out of online banking accounts.
[11:24.480 --> 11:31.300]  In addition, the FBI has increased its total of attempted thefts to $100 million, up from $40 million just last week.
[11:32.040 --> 11:37.480]  Evidently, the bad guys have resorted to de-dossing the banks to prevent them from recalling the electronic funds transfers.
[11:38.020 --> 11:42.100]  They have also started to use shadow accounts in an attempt to protect their mules from detection.
[11:42.640 --> 11:49.660]  The mules tend to be the unfortunate people out of work who've been duped into accepting an online job as a, quote, money manager.
[11:51.140 --> 11:54.380]  We'll be right back with the HNN Quickies, right after these messages.
[12:10.260 --> 12:12.040]  Welcome back to HNNCast.
[12:12.900 --> 12:16.000]  And now for a few quick stories we found on the net this week.
[12:17.200 --> 12:22.880]  The news of the death of the maintainer of the popular security site Milw0rm was evidently a bit premature.
[12:23.340 --> 12:27.640]  A blog post earlier this week claimed that stroke had died from a heart complications.
[12:28.160 --> 12:30.620]  All untrue, and stroke is alive and well.
[12:30.820 --> 12:33.660]  The Department of Homeland Security has announced that the U.S.
[12:34.020 --> 12:42.060]  Computer Emergency Readiness Team, or CERT, will move in with the National Coordinating Center for Telecommunications and the National Cyber Security Center.
[12:42.440 --> 12:49.340]  The groups will live at the National Cyber Security and Communications Integration Center in Arlington, Virginia, which opened this week.
[12:49.920 --> 12:51.160]  Are you confused yet?
[12:51.520 --> 12:52.040]  Good.
[12:53.320 --> 12:58.080]  The first group of tickets for the popular ShmooCon went on sale on Saturday and quickly sold out.
[12:58.460 --> 13:01.320]  The next batch are scheduled to be available on December 1st.
[13:01.500 --> 13:03.160]  Get those F5 keys ready.
[13:04.680 --> 13:09.740]  A member of the International Virus Writing Group, Moop, has pleaded not guilty in London this week.
[13:10.060 --> 13:13.580]  Moop was a prolific virus writing gang most active in 2006.
[13:15.560 --> 13:24.020]  Numerous worms and botnets have been seen increasing their activity lately, including the Grumblar botnet, which uses iframes to redirect visitors to poison sites.
[13:24.540 --> 13:30.500]  The Taterfworm has infected over 4 million machines by targeting online role-playing games such as World of Warcraft.
[13:31.100 --> 13:35.200]  And our good friend Konficker has now reached 7 million infected hosts worldwide.
[13:35.740 --> 13:41.020]  And if you find yourself infected with the Zeus Trojan, try getting infected with the Opachi Trojan.
[13:41.220 --> 13:44.740]  It will remove Zeus for you and also hijack all your web links.
[13:45.160 --> 13:45.660]  How thoughtful.
[13:46.580 --> 13:50.560]  KiwiCon 3 in New Zealand at the end of the month has announced its speaker list.
[13:50.780 --> 13:55.840]  Looks like some good talks, including the keynote by Australian journalist and risky business podcaster Patrick Gray.
[13:56.660 --> 14:02.320]  Security B-Sides has opened its call for papers for the San Francisco version, which will take place during the RSA conference.
[14:02.760 --> 14:07.300]  In addition, there will be a B-Sides Boston held the weekend after Source Boston.
[14:08.160 --> 14:13.520]  The first QuahogCon will be held at the end of April in Providence, Rhode Island and has opened its call for papers.
[14:14.000 --> 14:20.920]  On November 13th, that's next Friday, NYU will be holding its Cybersecurity Awareness Week awards ceremony.
[14:21.280 --> 14:29.820]  The finals for five different contests run from 8.30 to noon and the entire event is done by 5pm, so get there early.
[14:29.920 --> 14:39.080]  The Open Source Vulnerability Database has posted an open request to security vendors to open up their archives of old reported vulnerabilities 10 years old or older.
[14:39.680 --> 14:43.840]  Often these vulnerabilities were quietly patched or otherwise not even disclosed.
[14:44.200 --> 14:48.740]  Valuable information could be learned about today's products by looking at the problems of the old ones.
[14:49.760 --> 14:52.400]  Security TubeCon is scheduled to happen this weekend.
[14:52.760 --> 14:56.740]  The website hasn't been updated in a while, so we're not sure of its actual status.
[14:57.060 --> 14:59.060]  But just in case, check it out anyway.
[14:59.980 --> 15:08.960]  The Windows binary from the Capture the Flag Weapons of Mass Destruction game at Hack in the Box Security Conference 2009 in Malaysia, were released this week.
[15:09.580 --> 15:12.000]  Definitely some pretty difficult binaries this year.
[15:12.920 --> 15:23.820]  A recent report released by Panda Labs indicates that Spain, of all places, has the highest rate of infected machines with over 44% of all systems in the country, part of various botnets.
[15:24.520 --> 15:27.560]  Second was the U.S., but with only 14% infected.
[15:28.140 --> 15:28.360]  Wow.
[15:28.660 --> 15:29.080]  Spain.
[15:29.460 --> 15:30.160]  Who'da thunk it?
[15:31.040 --> 15:33.300]  And now for this week's Stack of Shame.
[15:33.560 --> 15:37.740]  The list of all known open vulnerabilities as catalogued by the Zero Day Initiative.
[16:30.600 --> 16:32.880]  That's it for this week's HNNCast.
[16:33.040 --> 16:36.660]  I've been your host Space Rogue, and you've been watching the Hacker News Network.
[16:40.390 --> 16:45.310]  Remember, if you have any news you think we should report, send it to news at HackerNews.com.
[16:48.850 --> 16:50.910]  You have been watching HNNCast.
[16:51.090 --> 16:53.250]  This is Space Rogue for the Hacker News Network.
[16:58.170 --> 17:00.710]  Funny dude, funny dude, funny dude bad things.