[00:08.400 --> 00:12.400]  The, uh, European Space Agency, the ISIS team, so, that's you.
[00:39.240 --> 00:42.840]  You're watching HNNCast with Space Rogue on the Hacker News Network.
[00:47.250 --> 00:49.770]  HNNCast is sponsored by...
[00:50.730 --> 00:51.850]  Immunity Incorporated.
[00:52.310 --> 00:53.590]  Knowing you are secure.
[00:54.910 --> 00:56.010]  Become a sponsor.
[00:56.630 --> 00:59.250]  Email sales at hackernews.com
[01:02.330 --> 01:04.590]  This is Space Rogue for the Hacker News Network.
[01:04.590 --> 01:07.730]  And this is HNNCast for the second week of November, 2009.
[01:08.450 --> 01:14.630]  This week we have stories covering skimming busts in Romania, indictments handed down for the RBS attackers, and free coffee.
[01:14.930 --> 01:16.590]  But first, our top story.
[01:17.050 --> 01:22.130]  Last weekend, CBS aired an episode of 60 Minutes entitled, Sabotaging the System.
[01:22.630 --> 01:36.490]  The story was supposed to be about cyber war, but in pure 60 Minutes fashion, they rambled all over the place, from compromised computer chips made in China, to tricking ATMs to spitting out mounds of cash, totally missing the recent and much more devastating money mule angle.
[01:36.950 --> 01:43.370]  But they also made a fantastic claim that Brazil had suffered not one, but two major blackouts as a result of a cyber attack.
[01:44.630 --> 01:47.130]  First, they cited a speech given by President Obama.
[01:47.450 --> 01:54.750]  It's now clear, this cyber threat is one of the most serious economic and national security challenges we face as a nation.
[01:55.130 --> 02:08.130]  Four months after taking office, President Obama made those concerns part of our national defense policy, declaring the country's digital infrastructure a strategic asset, and confirming that cyber warfare had moved beyond theory.
[02:08.390 --> 02:16.670]  We know that cyber intruders have probed our electrical grid, and that in other countries, cyber attacks have plunged entire cities into darkness.
[02:17.330 --> 02:21.490]  Then they claimed that they verified this with several prominent intelligence sources.
[02:21.950 --> 02:33.830]  President Obama didn't say which country had been plunged into darkness, but a half a dozen sources in the military, intelligence, and private security communities have told us the President was referring to Brazil.
[02:34.510 --> 02:53.850]  Several prominent intelligence sources confirmed that there were a series of cyber attacks in Brazil, one north of Rio de Janeiro in January of 2005, that affected three cities and tens of thousands of people, and another much larger event beginning on September 26,
[02:54.150 --> 03:04.910]  2007, that one, in the state of Espirito Santo, affected more than three million people in dozens of cities over a two-day period, causing major disruptions.
[03:05.410 --> 03:15.310]  Of course, if true, it would be the first publicly documented successful major cyber attack on the critical infrastructure of any country, not to mention how it makes Brazil look.
[03:15.850 --> 03:27.910]  The local energy company, Fernas Centros Electricos, of course quickly denied any such cyber intrusion and blamed the blackouts on high-voltage insulators covered with soot deposits from locally burning fields.
[03:28.470 --> 03:30.070]  So who are you supposed to believe?
[03:30.370 --> 03:35.090]  The half-dozen intelligence analysts cited but not named by 60 Minutes?
[03:35.210 --> 03:37.910]  Who might be out of a job if there was no cyber threat?
[03:38.270 --> 03:41.710]  Or an electrical company who probably has shareholder interest to protect?
[03:42.210 --> 03:44.150]  Oh, but this story isn't over yet.
[03:44.150 --> 03:48.990]  Two days after the 60 Minutes story aired, Brazil suffered another blackout.
[03:49.370 --> 03:52.070]  Was it the cyber attackers proving what they could do?
[03:52.190 --> 03:56.910]  Or was it, as the power company says, damage from a major thunderstorm?
[03:57.570 --> 03:59.910]  I don't know, your guess is as good as mine.
[04:00.150 --> 04:08.250]  But considering the FUD that has come out of 60 Minutes lately, not to mention the homeland security, my money's on Fernas Centros Electricos.
[04:09.650 --> 04:21.010]  In 23 separate coordinated raids, Romanian police have arrested 19 members of an alleged international ring of bank card skimmers that have been active in France, Italy, Switzerland, and the U.S.
[04:21.690 --> 04:29.210]  Police had the gang under surveillance for at least nine months and moved in when they found a package containing numerous circuits used for building handheld skimmers.
[04:31.270 --> 04:44.650]  Four men have been indicted in Georgia on charges that they electronically broke in to the Atlanta-based bank card processing company, RBS WorldPay, back in November 2008, and siphoned off $9.5 million in a matter of hours.
[04:45.170 --> 04:53.870]  The group allegedly reverse-engineered PIN numbers of payroll debit cards and then raised the funds available limit on the cards in some cases to a half million dollars.
[04:53.870 --> 05:06.250]  The men, from Russia, Moldova, and Estonia, dispatched cashiers in 280 cities worldwide to withdraw money from over 2,000 ATMs in under 12 hours and then wire the money back to them.
[05:06.670 --> 05:10.390]  One of the men is currently under arrest in Estonia, awaiting extradition.
[05:10.670 --> 05:12.790]  The status of two others is unknown.
[05:13.070 --> 05:16.550]  And the last is simply listed as Hacker 3 in the indictment.
[05:18.090 --> 05:29.070]  Coffee, or Computer Online Forensic Evidence Extractor, a Microsoft application only available to law enforcement agencies, was accidentally leaked to BitTorrent sites around the world this past week.
[05:29.430 --> 05:32.450]  In addition, a user guide was seen posted to Cryptome.
[05:32.990 --> 05:40.550]  Coffee is designed to run directly from a USB drive on a live system and to bypass any security installed on the system to extract evidence.
[05:40.550 --> 05:49.430]  However, it appears that this version of coffee was not complete, as it only contains 45 commands instead of the 150 commands it is supposed to have.
[05:49.930 --> 05:55.590]  The fear is that now that the tool is out there, the bad guys will make defenses to protect themselves against it.
[05:56.010 --> 05:58.050]  But coffee doesn't really do anything special.
[05:58.350 --> 06:02.410]  And if you are a serious bad guy, you are already employing safe computing practices anyway.
[06:02.810 --> 06:10.650]  It's more likely that pen testers and red teams will add coffee to their arsenal of tools as yet another way through a company's defenses.
[06:12.150 --> 06:15.190]  We'll be back with more HNNCast right after these messages.
[06:31.020 --> 06:33.000]  Welcome back to HNNCast.
[06:33.720 --> 06:36.360]  So it's been a year since McColo was shut down.
[06:36.620 --> 06:37.700]  Are things any better?
[06:38.000 --> 06:46.020]  You remember McColo, the ISP that was accused of spewing spam, acting as botnet command and control, and otherwise allowing criminals to do their thing?
[06:46.580 --> 06:50.900]  Well, immediately after they were shut down a year ago, spam levels dropped dramatically.
[06:51.600 --> 06:52.140]  Temporarily.
[06:52.400 --> 06:56.300]  And their Srisby, Mega-D, and Rustock botnets were pretty much disabled.
[06:56.620 --> 06:59.320]  But the bad guys have changed their tactics since McColo.
[06:59.820 --> 07:05.300]  Spam is now at an all-time high, and botnets are designed to protect themselves against a single ISP shutdown.
[07:05.880 --> 07:17.160]  Other ISPs besides McColo have also been taken down, including Intercage Atrivo and 3FN, forcing the bad guys into using Facebook, Twitter, and even Google Wave for command and control.
[07:18.860 --> 07:26.900]  Researchers are set to present a paper at the ACM Conference in Chicago this week, detailing methods to circumvent the networking technology used by law enforcement wiretaps.
[07:27.180 --> 07:36.120]  It turns out that the phone companies develop a standard to comply with CALEA, the 1994 law that requires phone companies to provide wiretap capability to digital switches.
[07:36.120 --> 07:44.540]  The standard, ANSI standard JSTD025, only sets aside 64K as the call data channel.
[07:45.440 --> 07:51.420]  64K is fine under normal circumstances, but can be easily overwhelmed with a few dozen voice-over IP calls.
[07:51.740 --> 07:58.000]  Of course, the researchers weren't really able to test this method in the real world, since as far as they knew, they weren't being wiretapped.
[07:59.660 --> 08:05.220]  And now Courtnee brings us a story about the dangers of outsourcing and the possible impending legal ramifications.
[08:05.540 --> 08:05.880]  Courtnee?
[08:06.680 --> 08:07.840]  Thanks, Space Rogue.
[08:08.660 --> 08:13.200]  I've got a story that should, but probably won't, deal a significant blow to offshore IT.
[08:13.200 --> 08:19.120]  Let's just say all that money you save by outsourcing your operations to India might come in handy in the lawsuits that come of it.
[08:19.520 --> 08:28.620]  First, Host Exploit reported that within a British TV investigation, presenter Chris Rogers contacted two Indian salesmen through a chatroom posing as a marketing executive.
[08:29.300 --> 08:34.480]  Rogers successfully purchased 116 medical files with detailed records of British patients.
[08:34.840 --> 08:44.180]  The two salesmen, let's just call them D and Bags, reportedly said the files came from an Indian transcription center, where medical records are computerized.
[08:44.720 --> 08:53.400]  Now Wired News is reporting that Obama's stimulus package includes incentives for healthcare providers to translate paper health records into digital ones, which isn't a bad thing.
[08:53.580 --> 08:59.960]  I know firsthand how helpful an EMR can be, but rightfully they went on to cite the cautionary aforementioned incident as well.
[09:00.660 --> 09:14.880]  A while back, Fox News reported that sysadmins at a World Bank data center that had been outsourced to Satyam Computer Systems, one of India's largest IT companies, were found by forensic investigators at Mandiant to have installed keystroke loggers on crucial systems.
[09:15.340 --> 09:16.300]  Guess what?
[09:16.620 --> 09:29.760]  This allowed some unknown outsiders, trace-routed only as far as China, to pillage one of the largest repositories of sensitive data about the economies of every nation repeatedly for more than a year.
[09:34.920 --> 09:37.860]  It's clear why actual production data was compromised.
[09:38.180 --> 09:44.620]  The custodians of the sensitive data entrusted that data to someone outside the jurisdiction of their own laws, or any form of supervision.
[09:45.180 --> 09:48.960]  I wonder if their customers, or a jury, care how much money that saved them.
[09:48.960 --> 09:52.440]  The data center is not the same as the call center, people.
[09:52.820 --> 09:58.120]  If you can't see and act upon the difference, you shouldn't be allowed to play in businesses that give you access to sensitive data.
[09:58.400 --> 10:00.440]  Or any data, for that matter.
[10:01.380 --> 10:02.620]  That's it for me this week.
[10:02.900 --> 10:04.780]  This is Courtnee for the Hacker News Network.
[10:05.300 --> 10:06.640]  Back to you, Space Rogue.
[10:12.280 --> 10:13.180]  Thanks Courtnee.
[10:14.600 --> 10:22.840]  Wiresoft, a network security company, has turned to an often used gimmick to get some free publicity and an inaccurate beta test for their new Firegate firewall product.
[10:23.240 --> 10:24.600]  The Hacker Challenge.
[10:25.420 --> 10:33.900]  Wiresoft is offering up a whopping $24,000 to anyone who can break into their quote, unbreakable firewall within 24 hours.
[10:34.400 --> 10:36.560]  The challenge starts on November 16th.
[10:36.940 --> 10:40.160]  These sorts of gimmicks always sound good on the surface, but 24K?
[10:40.540 --> 10:44.240]  I know security researchers that won't get out of bed for that kind of chump change.
[10:44.520 --> 10:52.420]  So Wiresoft ends up with tons of free publicity, like we're giving them right now, and a false sense of security when no one with any skill decides to show up.
[10:54.080 --> 11:03.600]  Last week we told you about a user in the Netherlands who goes by PureInfinity, who used a default password on jailbroken iPhones in a half-hearted attempt to extort money from iPhone users.
[11:03.600 --> 11:09.160]  Well now, users of jailbroken iPhones in Australia have suffered a fate almost as bad.
[11:09.340 --> 11:10.520]  They've been Rickrolled.
[11:10.900 --> 11:19.620]  An iPhone worm written by iKee, aka Ashley Towns, travels from iPhone to iPhone via the default SSH password of Alpine.
[11:19.620 --> 11:26.600]  The worm then changes the background wallpaper to one of Rick Ashley with the words, iKee is never going to give you up.
[11:27.240 --> 11:29.500]  Hopefully the next version will actually play the video.
[11:31.560 --> 11:33.840]  Remember people, change your damn passwords.
[11:55.320 --> 11:58.720]  We'll be right back with the HNN Quickies right after these messages.
[12:14.720 --> 12:16.460]  Welcome back to HNNCast.
[12:16.460 --> 12:19.480]  And now for a few quick stories we found on the net this week.
[12:20.740 --> 12:26.600]  Last week we told you about a new massive hole recently found in SSL, the protocol that pretty much secures the Internet.
[12:26.980 --> 12:31.920]  Well OpenSSL has released a new version, OpenSSL 0.9.8.
[12:32.400 --> 12:39.880]  Note that this update doesn't actually fix anything, it just simply removes the TLS SSL re-negotiation from the package by default.
[12:41.420 --> 12:50.400]  WordPress 2.8.6 has been released to address two security issues, the cross-site scripting vulnerability and the sanitation of uploaded file names.
[12:50.760 --> 12:51.720]  Ah, WordPress.
[12:52.060 --> 12:53.480]  Patch, patch and patch again.
[12:54.360 --> 12:57.240]  Researchers have found a new botnet and dubbed it Festi.
[12:57.600 --> 13:05.000]  Festi has quickly grown and now accounts for 3-6% of daily spam, or about 1.5-3 billion emails a day.
[13:05.860 --> 13:13.120]  You may have read the story by the Associated Press about child porn infecting viruses, that supposedly deposit child porn on random computers.
[13:13.740 --> 13:20.440]  Unfortunately, the story only contained anecdotal stories, no mention of actual viruses, no code samples or other hard evidence.
[13:20.760 --> 13:26.000]  While I'm sure such nastiness exists, it'd be nice to be able to conclusively identify it on a victim's computer.
[13:27.140 --> 13:31.720]  It looks like UNU's blog has been taken offline, we assume on purpose.
[13:32.240 --> 13:43.980]  UNU, a Romanian who often pointed out SQL injection flaws in high profile websites, such as RBS, HSBC France, and most recently Barack Obama dot com, would detail the SQL issues on his blog.
[13:44.360 --> 13:46.200]  We hope that the blog returns soon.
[13:46.460 --> 13:47.360]  We enjoyed reading it.
[13:48.480 --> 13:53.780]  The Zeus botnet appears to be an equal opportunity botnet, and doesn't just target Twitter and Facebook users.
[13:54.220 --> 13:57.040]  Zeus has now begun going after MySpace users as well.
[13:57.380 --> 13:58.840]  You remember MySpace, right?
[13:59.340 --> 14:06.320]  This attack starts with a phishing email which leads to a fake MySpace login page, which then prompts the user to download and install new software.
[14:08.300 --> 14:13.540]  Malware writers aren't resting on their laurels, and are constantly adding the latest and greatest technologies to their creations.
[14:14.240 --> 14:18.440]  The newest seems to be using the Google App Engine as a command and control function.
[14:19.440 --> 14:23.280]  Researchers have found at least one piece of malware using this new channel for CNC.
[14:24.120 --> 14:28.260]  Club Hack, to be held in Poon, India in December, has opened its registration.
[14:28.520 --> 14:30.660]  Remember, register early and often.
[14:31.200 --> 14:34.580]  The DEFCON.org website has a snappy new look and feel.
[14:34.860 --> 14:40.060]  They also plan to post the videos from DEFCON 17 real soon now, if they haven't done so already.
[14:41.300 --> 14:45.060]  For at least a third time, Britney Spears' Twitter account has been compromised.
[14:45.500 --> 14:49.420]  This time, tweets about how much the pop stars Love Satan were posted.
[14:49.780 --> 14:51.640]  I guess Lucifer's honor radar.
[14:52.280 --> 15:02.180]  Gordon Mayer has updated his master's thesis, The Social Organization of the Computer Underground, originally released 20 years ago with a new introduction, background, and additional commentary.
[15:02.760 --> 15:08.620]  Of course, you can find the original for free online, but all proceeds from this new version will be donated to the EFF.
[15:09.300 --> 15:12.140]  If you've never read it, I highly recommend picking up a copy.
[15:12.740 --> 15:20.120]  Awards for the Cybersecurity Awareness Week were given out at New York University's Polytechnic Institute this weekend, and HNN was there.
[15:21.020 --> 15:25.680]  Participants included students from across the country, and celebrity judges such as Dino, a.k.a.
[15:25.940 --> 15:27.440]  DDZ, of Karma fame.
[15:28.100 --> 15:31.140]  We will bring you all the exciting results in an upcoming release.
[15:31.760 --> 15:33.900]  Oh, and now you can check us out on Roku.
[15:34.280 --> 15:35.260]  Don't have a Roku?
[15:35.500 --> 15:39.220]  You can pick one up through Amazon or in the HNN store on our website.
[15:39.920 --> 15:46.560]  And now for this week's Stack of Shame, the list of all known open vulnerabilities as cataloged by the Zero Day Initiative.
[16:34.780 --> 16:36.720]  Welcome to the real world.
[16:38.100 --> 16:40.220]  Yep, HP is still the bottom dweller.
[16:40.440 --> 16:42.040]  Over 1100 days and counting.
[16:42.760 --> 16:45.260]  Oh, you probably heard that HP is going to buy 3Com.
[16:45.720 --> 16:48.920]  Well, 3Com owns Tipping Point, which runs the Zero Day Initiative.
[16:49.500 --> 16:51.800]  I guess that's one way to get yourself off the list.
[16:52.360 --> 16:56.860]  Of course, we hope that they don't really mess with the list, other than fixing their vulnerabilities, of course.
[16:58.180 --> 17:00.040]  That's it for this week's HNNCast.
[17:00.040 --> 17:03.540]  I've been your host, Space Rogue, and you've been watching the Hacker News Network.
[17:07.250 --> 17:12.160]  Remember, if you have any news you think we should report, send it to news at HackerNews.com.
[17:15.700 --> 17:17.740]  You have been watching HNNCast.
[17:17.950 --> 17:20.080]  This is Space Rogue for the Hacker News Network.
[17:25.050 --> 17:27.570]  Funny dude, funny dude, funny dude, bad things.