[00:08.990 --> 00:12.430]  The, uh, European Space Agency, the ISIS, peace, tell us, that's you.
[00:39.250 --> 00:42.890]  You're watching HNNCast with Space Rogue on the Hacker News Network.
[00:48.380 --> 00:51.520]  HNN is sponsored by Astaro.
[00:52.500 --> 00:53.640]  Simplifying security.
[00:55.200 --> 00:56.340]  Become a sponsor.
[00:57.040 --> 00:59.540]  Email sales at hackernews.com.
[01:01.980 --> 01:06.920]  This is Space Rogue for the Hacker News Network, and this is HNNCast for the first week of December, 2009.
[01:07.940 --> 01:09.460]  Our top story this week.
[01:09.640 --> 01:18.180]  A hackerspace in Malmo, Sweden, with a name that I will not even try to pronounce, but which translates to Research Department, was recently raided by the local police.
[01:18.400 --> 01:23.280]  The official reason for the raid was the suspicion of illegal alcohol sales occurring elsewhere in the building.
[01:23.620 --> 01:28.640]  The raid was conducted by possibly as many as 50 police officers, with many wearing ski masks.
[01:28.640 --> 01:39.200]  The police reportedly spent over six hours in the building, searching through items and confiscating large amounts of equipment, including personal computers, laptops, networking equipment, and digital cameras.
[01:39.640 --> 01:48.620]  Some have theorized that the raid was an exploration into the possible activist planning areas in preparation for the upcoming environmental summit taking place across the river in Copenhagen.
[01:48.620 --> 01:53.000]  The organizers are now asking for donations to help them replace some of their lost equipment.
[01:56.340 --> 02:03.580]  Neil Fallehy of California has pleaded guilty to one count of conspiring to traffic and counterfeit goods to defraud the United States.
[02:04.020 --> 02:08.940]  Federal prosecutors say Fallehy and several co-defendants sold counterfeit computer chips to the U.S.
[02:09.040 --> 02:13.980]  Navy using a number of California companies such as Pentagon Components and Force One Electronics.
[02:13.980 --> 02:26.580]  The government alleges Fallehy and others took trademark branded integrated circuits and other computer components, ground off the original markings, rebranded them with their other trademarks, and passed the devices off as military grade.
[02:27.060 --> 02:31.080]  Fallehy faces up to 51 months in prison and more than 2 million in fines.
[02:31.420 --> 02:33.820]  His sentencing is expected sometime next year.
[02:34.380 --> 02:39.960]  I'm sure this case will now be used as an example for totally unrelated stuff that somehow leads back to China.
[02:42.320 --> 02:49.200]  The Climate Research Unit at the University of East Anglia has had a large volume of emails and other documents posted online.
[02:49.480 --> 02:56.980]  A 61-megabyte zip file appeared on a Russian FTP site last week containing over 1,000 emails and over 3,000 other documents.
[02:57.300 --> 03:00.080]  Some of the emails date back at least 10 years.
[03:00.460 --> 03:04.500]  East Anglia is working with local authorities to discover how the data was leaked.
[03:05.020 --> 03:09.240]  Authorities have already tracked the original uploaders through at least three different proxy servers.
[03:09.840 --> 03:20.540]  Climate change detractors are pointed at the emails and other documents as evidence of a conspiracy to cover up the real data about climate change, while the scientists involved say that the emails have been taken out of context.
[03:20.980 --> 03:22.100]  At least one U.S.
[03:22.420 --> 03:29.500]  Senator has suggested that Congress may need to look closer at the disclosures, although considering that East Anglia is in the UK, that might be a little difficult.
[03:30.140 --> 03:35.660]  Most recently, the director of the CRU will be temporarily stepping down until the investigation finishes.
[03:36.440 --> 03:37.000]  Temporarily?
[03:37.660 --> 03:43.220]  All I know is if you look at my email from 10 years ago, you might find a few inflammatory comments in there.
[03:44.960 --> 03:51.960]  Microsoft has hit Cryptome with a DMCA takedown notice regarding copies of and manuals for its Coffee Forensics Tool.
[03:52.340 --> 04:03.240]  At least a partial version of Microsoft's Computer Online Forensics Evidence Extractor appeared on BitTorrent sites a few weeks ago, which is supposed to be available only to law enforcement.
[04:04.260 --> 04:07.600]  Cryptome hosted the mirror of the software as well as a copy of the manual.
[04:08.040 --> 04:12.340]  After receiving a DMCA takedown notice, Cryptome was forced to remove the files.
[04:12.980 --> 04:16.000]  Now the software and manuals have appeared on WikiLeaks.
[04:16.420 --> 04:19.540]  The zip archive is presumably free of viruses and Trojans.
[04:19.680 --> 04:21.780]  Unlock what you might find at BitTorrent.
[04:21.940 --> 04:25.360]  Again, proving the old maxim that once it's on the Internet, you can't delete it.
[04:26.260 --> 04:35.960]  Several restaurants in the Mississippi and Louisiana area are now suing the installer and the manufacturer of their point-of-sale systems after the systems were breached and credit card data was stolen.
[04:36.800 --> 04:49.660]  HNN has reported on a few of these breaches already, and now Crawfish Town USA, Don's Seafood and Steakhouse, Jones Creek Cafe, Picante's Mexican Restaurant and others are filing suit against Computer World Inc.
[04:49.900 --> 04:54.080]  and Radiant over the non-PCI compliant Aloha point-of-sale system.
[04:54.080 --> 05:07.240]  The lawsuit alleges that not only did the system store credit card numbers in violation of PCI standards, the installers used the default installation of PC Anywhere for remote access, and did not even bother changing the default passwords.
[05:07.620 --> 05:14.620]  The lawsuit hopes to recover millions of dollars in damages resulting from visa fines, chargebacks and other costs associated with the breach.
[05:15.180 --> 05:16.280]  Default passwords?
[05:16.560 --> 05:18.000]  On a POS system?
[05:18.260 --> 05:19.000]  Come on!
[05:21.100 --> 05:26.260]  Before we take a break, we just wanted to take a moment and welcome HNN's newest sponsor, Astaro Corp.
[05:26.500 --> 05:28.100]  You may have heard of Astaro before.
[05:28.100 --> 05:33.300]  They regularly sponsor the ShmooBush and recently donated several security gateways to the Warzone project.
[05:33.840 --> 05:35.060]  Glad you're with us, Astaro.
[05:35.340 --> 05:40.190]  If you want to join Astaro and sponsor HNN, send email to sales at hackernews.com.
[05:41.050 --> 05:44.090]  We'll be back with more HNNCast right after these messages.
[06:02.500 --> 06:04.380]  Welcome back to HNNCast.
[06:05.680 --> 06:06.740]  Unu is back!
[06:06.940 --> 06:17.420]  We previously reported that Unu, the Romanian SQL injection expert, had taken down his website, but we are happy to report that the blog has returned with two new high-profile SQL injections.
[06:17.780 --> 06:21.080]  The first happens to be Symantec's support website in Japan.
[06:21.080 --> 06:29.860]  In this case, the injection appears to reveal the account details of 70,000 Symantec customers, including plain text passwords and software keys for Symantec products.
[06:30.400 --> 06:36.460]  Symantec now joins Kaspersky and F-Secure as security companies who have fallen victim to the SQL attacks by Unu.
[06:37.220 --> 06:40.940]  Symantec has taken the offending site offline pending an internal investigation.
[06:42.060 --> 06:50.460]  The second attack is the Wall Street Journal's CEO Council website, which again exposes clear text passwords and personal information of members of the site.
[06:51.080 --> 06:55.700]  The Wall Street Journal has also taken the CEO Council offline until the problem can be fixed.
[06:57.060 --> 07:01.840]  The International Information Retrieval Guild has returned after a multi-year hiatus.
[07:02.220 --> 07:11.120]  A post to an IIRG website indicates that someone was falsely claiming to be the IIRG, forcing some members to come out of retirement to set the record straight.
[07:11.540 --> 07:14.520]  The main website and several affiliate websites have been resurrected.
[07:14.900 --> 07:19.260]  It's unclear what the future plans are for the group that was first founded in 1982.
[07:20.760 --> 07:25.600]  Hackers for Charity, the non-profit running in Uganda, Africa, has come up with an ambitious plan.
[07:26.140 --> 07:36.340]  In an effort to further computer education among the local populace, they hope to set up an Internet cafe for tourists to use, and then use the money earned at the cafe to set up computer labs for local schools.
[07:37.200 --> 07:39.420]  The problem, as always, is money.
[07:39.800 --> 07:43.600]  In this case, money for the first six months' rent on the new location for the cafe.
[07:44.200 --> 07:47.900]  They are asking for your help in securing just enough funding for them to get started.
[07:48.280 --> 07:51.580]  You can follow the PayPal link on the Hackers for Charity website.
[07:52.100 --> 07:59.280]  Or, check the comments on HackerNews.com for the links to Hackers for Charities, as well as all the links to all the stories here on H&M.
[07:59.960 --> 08:03.560]  And now Courtnee brings us a story about security product certifications.
[08:03.860 --> 08:04.300]  Courtnee?
[08:07.070 --> 08:08.410]  Thanks, Space Rogue.
[08:09.090 --> 08:17.670]  A recent ICSA Labs product assurance report found that nearly 90% of security products failed to perform as intended when first tested.
[08:18.310 --> 08:24.490]  Additionally, 44% of security products had bugs with the security impact, or what you and I call vulnerabilities.
[08:25.330 --> 08:29.290]  And the main reason criminals can sleep at night was the report's third finding.
[08:29.670 --> 08:32.130]  Vendors find logging to be a nuisance.
[08:32.870 --> 08:38.910]  According to the report, only 27% of antivirus solutions passed functional testing on the first try.
[08:39.570 --> 08:46.970]  One major function of antivirus software, the ability to receive updates, was cited by the report as an area that vendors struggled with.
[08:47.650 --> 09:00.530]  So wait, with this big SSL bug out there, and who knows how long we're gonna be stuck with that, how did 27% of products actually pass the first time, and how did 92% of the remaining vendors eventually pass?
[09:01.250 --> 09:04.530]  Shouldn't that be 0% and 0%?
[09:05.690 --> 09:14.410]  I guess that's what happens when the certification is driven by the marketing departments of the products being tested, rather than someone like the payment card industry, for example.
[09:15.010 --> 09:27.690]  My guess is that ICSA was afraid of losing its SSL testing customers and its antivirus customers by documenting the fact that they all fail due to the now well-known issues with the SSL protocol itself.
[09:28.270 --> 09:34.170]  If the insurance companies were the ones requiring the tests and picking the assessment teams, I doubt you'd see anything passing.
[09:34.790 --> 09:38.630]  Or at least you'd see a pretty big spike in your cyber insurance rates.
[09:39.690 --> 09:41.150]  That's it for me this week.
[09:41.370 --> 09:43.270]  This is Courtnee for the Hacker News Network.
[09:43.630 --> 09:45.010]  Back to you, Space Rogue.
[09:47.310 --> 09:48.170]  Thanks, Courtnee.
[09:48.430 --> 09:55.410]  The author of the original Rick-Rolling iPhone worm has been offered a job by MoGeneration, an iPhone development firm in Australia.
[09:56.130 --> 10:01.030]  Several antivirus firms have publicly announced their displeasure with the firm's decision to hire the worm's author.
[10:01.350 --> 10:09.390]  In the meantime, the Rick Rolling worm's code has been hijacked by a very malicious worm which attempts to steal login information from users of the Dutch bank ING.
[10:09.790 --> 10:14.290]  The worm only affects jailbroken phones with SSH installed and default passwords.
[10:14.550 --> 10:19.550]  It then proceeds to change the default password from ALPINE to OHSHIT.
[10:22.760 --> 10:25.340]  Yet another worm has hit Facebook users recently.
[10:25.580 --> 10:28.920]  This new worm implores users to click the button, baby!
[10:29.280 --> 10:33.460]  The worm uses a cross-site request forgery to post the item to a victim's wall.
[10:34.020 --> 10:39.760]  A Facebook spokesperson claimed that it was really just a click-jacking attack and not the fault of the Facebook website.
[10:40.100 --> 10:40.560]  Whatever.
[10:40.880 --> 10:43.020]  Just be careful where you're putting that mouse pointer, people.
[10:43.240 --> 10:44.980]  You never know what you might catch.
[10:47.320 --> 10:52.480]  UK Home Secretary Alan Johnson has finally made a decision in regards to Solo, a.k.a.
[10:52.600 --> 10:55.380]  Gary McKinnon, who is accused of breaking into numerous U.S.
[10:55.480 --> 10:56.120]  government computers.
[10:57.000 --> 11:01.340]  Solo's extradition has been on hold while the Home Secretary reviewed Solo's medical records.
[11:01.340 --> 11:08.940]  Johnson has decided that the extradition would not contravene McKinnon's human rights and that he had no general discretion to intervene in the case.
[11:09.740 --> 11:16.840]  Solo's mom has said she is devastated by the decision, but is pressing ahead with the hopes that a judicial review could stay the extradition.
[11:17.640 --> 11:22.760]  Solo has been given a small extension in time to apply for the judicial review until December 10th.
[11:23.220 --> 11:25.920]  You know, I thought there were a lot of appeals in the U.S.
[11:26.080 --> 11:26.800]  judicial system.
[11:28.000 --> 11:31.720]  There have been a few high-profile website defacement and compromises recently.
[11:32.060 --> 11:37.040]  The Iowa City website was recently spewing malware and was blocked by Google until it was cleaned up.
[11:37.340 --> 11:44.460]  The website for a lieutenant governor candidate in South Carolina, VoteConnor.com, was defaced by someone with the handle Dr. Haid.
[11:44.940 --> 11:54.400]  And the website for the controversial host of MTV India's What The Hack program, Ankit Bhatia, was found to host a whole lot of links to various Viagra outlets.
[11:54.940 --> 11:57.180]  Ankit has since taken his website offline.
[11:57.920 --> 12:00.860]  We'll be right back with the HNN Quickies right after these messages.
[12:17.560 --> 12:19.320]  Welcome back to HNNCast.
[12:19.700 --> 12:27.460]  Since there was no HNNCast last week due to Turkey Day here in the U.S., we have an extra-large helping of Quickies with gravy for you this week.
[12:30.160 --> 12:45.860]  Max Vision, a.k.a. Iceman, a.k.a. Max Butler, an ex-Internet security consultant who pleaded guilty earlier this year to charges arising from the theft of 2 million credit card numbers and once ran the online forum Carter's Planet, has had the sentencing for his plea agreement delayed until February due to some disputed issues.
[12:46.220 --> 12:48.620]  I'd still like to know what the plea agreement was sealed.
[12:50.460 --> 13:01.720]  Dimitri Gunzer of New Jersey, and a member of the group Anonymous, has been sentenced to one year in prison and two years of probation after launching DDoS attacks against the Church of Scientology in January of 2008.
[13:03.160 --> 13:08.880]  It would appear that the efforts of FireEye Security to take down the Mega-D botnet has been successful.
[13:09.220 --> 13:16.540]  By pre-registering the necessary command and control servers before the bot herders, they have been able to reduce the Mega-D spam load to almost nothing.
[13:16.540 --> 13:24.280]  Mega-D is now under the control of the Shadow Server Group, which hopes to notify individual machine owners whose machines are infected with Mega-D.
[13:25.280 --> 13:30.400]  South Korea's Ministry of National Defense will open a Cyber Warfare Command next month.
[13:30.580 --> 13:36.740]  The command will conduct both defensive and offensive operations and will be manned by up to 200 personnel.
[13:37.220 --> 13:39.660]  More fuel for the new Cyber Cold War.
[13:40.660 --> 13:46.780]  The U.S.-China Economic and Security Review Commission released a 367-page report last month.
[13:47.020 --> 13:48.840]  I'll give you one guess as to what it said.
[13:49.480 --> 13:51.220]  Yep, we're under cyber-attack!
[13:51.460 --> 13:52.280]  Run for the hills!
[13:52.780 --> 13:58.820]  The report claims that the Department of Defense Systems were hit with over 43,000 cyber-attacks in the first half of 2009.
[13:59.660 --> 14:02.140]  And, of course, they pointed the fingers squarely at China.
[14:03.000 --> 14:09.060]  China issued a responding statement that claimed the report disregarded the facts, was full of bias, and had ulterior motives.
[14:09.380 --> 14:10.720]  Well, of course it did!
[14:11.900 --> 14:16.100]  Several prominent people have had their Twitter accounts compromised due to weak passwords lately.
[14:16.100 --> 14:22.220]  Most recently, it was Kevin Mitnick, who admitted to using a weak password for, quote, junk accounts.
[14:22.920 --> 14:23.680]  Yeah, Twitter.
[14:23.880 --> 14:26.900]  Someplace where somebody can say something as you is a junk account.
[14:27.900 --> 14:28.800]  Smart one, Kevin.
[14:29.400 --> 14:34.440]  The call for papers for the Hack in the Box Security Conference in Dubai of April next year has been opened.
[14:34.860 --> 14:42.600]  And, to fill the void DEFCON created when it moved from Amsterdam to Barcelona, Hack in the Box will hold a security conference in Amsterdam this summer.
[14:43.720 --> 14:53.660]  After the NSA admitted that it helped Microsoft with security features of Windows 7, the software giant is now fighting off allegations that it installed a backdoor into the software at the NSA's request.
[14:54.160 --> 14:55.020]  Listen, people.
[14:55.280 --> 14:57.000]  The NSA doesn't need a backdoor.
[14:57.200 --> 14:58.900]  They probably have a copy of the source code.
[14:59.880 --> 15:08.620]  UK-based web host Daily was recently hit with a web defacement that replaced several web pages with hear-see-speak-no-evil penguins.
[15:09.400 --> 15:17.460]  Evidently, the hat tab took credit for defacement, who has been credited with over 442 defacements according to the Zone-H archive.
[15:18.060 --> 15:18.880]  Listen, people.
[15:19.000 --> 15:22.860]  If you want credit for your defacements, come up with a handle that somebody can pronounce.
[15:24.540 --> 15:31.520]  Mininova, a popular BitTorrent site, has recently complied with a court order and has removed all copyright torrent files from its servers.
[15:31.940 --> 15:36.020]  The site is still active, but now only serves files with permissions of the copyright owners.
[15:37.020 --> 15:41.740]  Hack This Zine number 8 has been released with articles on IP tables and shellcode writing.
[15:42.960 --> 15:47.760]  You shot the Sheriff 4 to take place in Brazil in May has opened its call for papers.
[15:48.780 --> 15:55.160]  Early bird tickets for ThoughtCon or 312Con to be held in Chicago in April are now available.
[15:55.460 --> 15:56.600]  But not for everyone.
[15:56.880 --> 16:01.700]  Only smart people who can hack the system will be able to figure out how to order the early bird tickets.
[16:03.260 --> 16:08.500]  The Next Hope, occurring in New York in July next year, has opened a limited-time, early registration.
[16:08.960 --> 16:16.040]  There are absolutely no details about the con yet, but if you know you're going to hope, or the Next Hope, this might be a way to save a few bucks.
[16:16.640 --> 16:19.340]  Yeah, I know it's an old logo, but they haven't made a new one yet.
[16:21.260 --> 16:24.780]  Videos from Notacon 6, held back in April, have finally been posted.
[16:24.780 --> 16:27.660]  Yeah, I know the graphic says Not A Con 7.
[16:27.920 --> 16:28.480]  Sue me.
[16:30.260 --> 16:34.900]  The second round of ShmooCon tickets went on sale this past Wednesday, and promptly sold out.
[16:35.520 --> 16:36.360]  Didn't get one?
[16:36.500 --> 16:38.240]  You'll have one more chance on New Year's Day.
[16:38.580 --> 16:39.060]  Don't forget.
[16:40.560 --> 16:43.580]  And finally, attrition.org has finally named its mascot.
[16:43.880 --> 16:45.280]  The new name is Lazlo.
[16:45.780 --> 16:48.040]  Yeah, stupid name for a stupid-looking squirrel.
[16:48.660 --> 16:50.240]  Hey, take it easy, attrition.
[16:50.460 --> 16:51.240]  You know we love ya.
[16:51.980 --> 16:53.820]  And now for this week's Stack of Shame.
[16:54.120 --> 16:58.880]  The list of all known open vulnerabilities, as cataloged by the Zero Day Initiative.
[17:51.090 --> 17:53.050]  That's it for this week's HNNCast.
[17:53.190 --> 17:56.270]  I've been your host, Space Rogue, and you've been watching the Hacker News Network.
[18:00.680 --> 18:05.520]  Remember, if you have any news you think we should report, send it to news at hackernews.com.
[18:09.060 --> 18:10.500]  You have been watching HNNCast.
[18:11.280 --> 18:13.500]  This is Space Rogue, for the Hacker News Network.
[18:18.380 --> 18:20.920]  Funny dude, funny dude, funny dude, bad things.