[00:39.100 --> 00:42.860]  You're watching HNNCast with Space Rogue on the Hacker News Network.
[00:48.220 --> 00:50.320]  HNN is sponsored by...
[00:50.680 --> 00:51.620]  The Starill.
[00:52.340 --> 00:53.620]  Simplifying security.
[00:55.020 --> 00:56.280]  Become a sponsor.
[00:56.860 --> 00:59.500]  Email sales at hackernews.com.
[01:01.320 --> 01:03.520]  This is Space Rogue for the Hacker News Network.
[01:03.720 --> 01:06.760]  This is HNNCast for the third week of December, 2009.
[01:07.860 --> 01:15.000]  This week we have stories on Segvec, RockYou's plain text passwords, decaf for your coffee, and hackers need not apply.
[01:15.380 --> 01:17.180]  But first, our top story.
[01:17.820 --> 01:27.680]  Iraqi and Afghanistan insurgents have reportedly intercepted live video feeds from the U.S. military's Predator drones using a $25.95 copy of SkyGrabber for Windows.
[01:28.260 --> 01:36.220]  The application allows you to track the pilotless aircraft undetected and to see the video feeds the aircraft sit downloading to soldiers on the ground in real time.
[01:37.100 --> 01:41.160]  Soldiers are using Rover, or a Remotely Operated Video Enhanced Receiver.
[01:41.960 --> 01:44.280]  Insurgents just grab an old satellite TV dish.
[01:44.660 --> 01:50.180]  Since the video feeds lack any sort of encryption technology, it's just a simple matter of loading up the software.
[01:50.180 --> 02:04.360]  The problem not only affects Predator drones, but also AC-130 gunships, F-16 and F-A-18 fighters, Harrier jump jets, the B-1B bomber, and my favorite, the tank killer, A-10 Warthog.
[02:05.100 --> 02:12.520]  The Air Force has known about the problem since at least 1999, but has now supposedly addressed the issue, whatever the hell that means.
[02:12.980 --> 02:18.060]  One thing's for sure, if you're using off-the-shelf software, you didn't hack anything.
[02:18.060 --> 02:26.120]  Of course, if you want to build your own Predator drone for a 99% discount, be sure to catch Michael Wiegand's talk at ShmooCon in February.
[02:26.380 --> 02:28.860]  I'm pretty sure you can add encryption if you want.
[02:30.020 --> 02:36.180]  An SQL injection vulnerability discovered on rockyou.com's website has placed 32 million users at risk.
[02:36.440 --> 02:42.200]  The vulnerability, widely publicized by Igigi, exposes users' email addresses and plain text passwords.
[02:42.200 --> 02:48.520]  To make matters worse, the default password for a RockYou account has to be your email account password.
[02:49.440 --> 02:52.720]  Knowledge of the whole has been circulating in threads on various message boards.
[02:52.920 --> 02:55.440]  At the same time, it was being actively exploited.
[02:56.140 --> 03:00.940]  RockYou develops apps for popular social networking sites including Facebook, BeBoo, and MySpace.
[03:01.380 --> 03:05.760]  They should really know better than to leave passwords around sitting in plain text.
[03:08.060 --> 03:15.780]  Despite Microsoft's assertions, a defense against coffee, or Computer Online Forensics Evidence Extractor, has been developed.
[03:16.240 --> 03:22.080]  Coffee was originally only distributed to law enforcement via Interpol, but was recently released to the net accidentally.
[03:22.720 --> 03:38.120]  Now, Decaf, or Detect and Eliminate Computer Assisted Forensics, has been developed which detects the presence of the coffee USB drive and can immediately launch countermeasures such as erasing temporary files, clearing all coffee logs, disabling USB drives,
[03:38.300 --> 03:39.620]  and spoofing MAC addresses.
[03:40.140 --> 03:42.820]  The developers hope to add additional features in the near future.
[03:43.440 --> 03:46.280]  Decaf can be found at decafme.org.
[03:47.520 --> 03:52.620]  Symantec CEO Enrique Salem recently said, You always worry about gray hats.
[03:52.900 --> 03:58.700]  Symantec has a standing policy that we don't hire anyone to be a part of our company who has done any kind of known hacking.
[03:58.700 --> 04:01.800]  We will not employ hackers." Unquote.
[04:03.000 --> 04:03.300]  Huh.
[04:03.600 --> 04:16.200]  Must be a new policy, because ten years ago they bought a whole bunch of hackers when they acquired the Internet security startup AtStake, which itself had acquired L0pht Heavy Industries, a hacker think tank, a few years earlier.
[04:16.500 --> 04:20.540]  I have to wonder what sort of test Symantec uses to determine if you're a hacker or not.
[04:21.040 --> 04:24.300]  I didn't realize that they had sequenced the hacker gene.
[04:25.260 --> 04:32.200]  The Department of Homeland Security has opened its virtual job fair as it attempts to fill 1,000 cybersecurity positions over the next three years.
[04:32.800 --> 04:35.440]  Positions start at $73,000 a year.
[04:36.140 --> 04:37.500]  Obviously, you must be a U.S. citizen.
[04:38.460 --> 04:39.760]  Interviews will start in January.
[04:40.440 --> 04:44.120]  Looks like they're looking for everything from pen testers to analysts to network engineers.
[04:44.660 --> 04:46.700]  Hey, if you need a job, you might as well apply.
[04:47.060 --> 04:48.940]  Who knows, you could work for Uncle Sam.
[04:50.280 --> 04:54.260]  Oh, and Facebook also has an opening for an information security engineer.
[04:54.680 --> 04:57.780]  The job description reads like some sort of alphabet soup.
[04:58.260 --> 05:01.980]  PCI, SOX, HIPAA, and of course CISSP.
[05:02.780 --> 05:05.880]  We'll be back with more HNNCast right after these messages.
[05:23.640 --> 05:25.080]  Welcome back to HNNCast.
[05:26.260 --> 05:30.320]  Details of Segvek's supposedly sealed plea agreement are starting to emerge.
[05:30.760 --> 05:37.020]  Reporters at Wired.com are able to glean numerous details from an improperly redacted sentencing memo filed by his attorney.
[05:37.320 --> 05:51.180]  The document indicates that Segvek, aka Albert Gonzalez, told prosecutors that he and his accomplices broke into at least four card processing companies, as well as numerous foreign banks, a brokerage house, and several retail chain stores.
[05:51.460 --> 05:57.160]  The document also mentions two Russians, who have now only been known as Hacker One and Hacker Two.
[05:58.240 --> 06:01.520]  They have now been identified as Grig and Annex.
[06:01.940 --> 06:17.060]  The document explains that Segvek cooperated fully with authorities, providing details of weaknesses in corporate security systems, how the data was exported from those companies, how it was stored on foreign servers in the Ukraine and Latvia, how stolen data was decrypted and by who,
[06:17.480 --> 06:23.800]  how profits were received via web currency, who was involved in the flow of that currency, and numerous other details.
[06:24.500 --> 06:30.240]  Segvek's lawyers have been also asked for a delay before sentencing, which has been granted by the judge until March 18.
[06:30.240 --> 06:38.200]  It looks like they want to try the SOLO defense, as initial psychiatric reports indicate that Segvek suffers from Asperger's syndrome.
[06:38.580 --> 06:43.500]  However, they have so far refused the prosecution's request for an alternate psychological evaluation.
[06:45.340 --> 06:52.400]  An actively exploited zero-day attack against Adobe Acrobat Reader has been found that embeds Melissa's JavaScript into PDF files.
[06:52.980 --> 07:06.020]  Adobe has decided to give all the bad guys a huge Christmas present, and doesn't plan to release a patch for the exploit until sometime in the middle of January, In the meantime, the hole has already been added to the Metasploit framework, and is actively being exploited in the wild.
[07:06.840 --> 07:11.860]  Evidently, Adobe had to give all their developers the holidays off, while all their customers continue to get owned.
[07:12.320 --> 07:17.860]  Be sure to protect yourself and turn off JavaScript in your copy of Acrobat Reader, or just delete it completely.
[07:19.900 --> 07:28.000]  The U.S. Senate Select Committee on Intelligence has established a cybersecurity task force to evaluate cyber threats to the United States, and issue recommendations to the U.S. intelligence community as appropriate.
[07:30.380 --> 07:31.360]  Yeah, great.
[07:31.620 --> 07:43.240]  Another government task force that will just spend tax dollars, waste time with stupid hearings and town halls, and will then print up a nicely formatted report telling us what I and some other folks told the government a dozen years ago.
[07:43.680 --> 07:48.620]  Well, at least one of the task force members is Senator Snow, so maybe it won't be a total waste.
[07:49.940 --> 07:54.620]  It only took a couple of weeks, but the Barnes & Noble e-book reader, the Nook, has been rooted.
[07:55.100 --> 07:56.240]  Big deal, you say?
[07:56.500 --> 08:07.580]  Well, once you have Root on a Nook, you have a $250 portable Android OS running computer with a built-in free cellular connection to the Internet with a battery that lasts for days.
[08:07.940 --> 08:11.060]  The pen testing possibilities alone are mind-boggling.
[08:11.360 --> 08:14.120]  The question now is what will Barnes & Noble's response be?
[08:16.200 --> 08:19.400]  We'll be right back with the HNN Quickies right after these messages.
[08:36.900 --> 08:38.680]  Welcome back to HNNCast.
[08:38.840 --> 08:41.660]  And now for a few quick stories we found on the net this week.
[08:42.500 --> 08:45.500]  Solo's mom, Janice Sharp, hasn't given up yet.
[08:45.800 --> 08:52.460]  While awaiting the decision of the recently filed judicial review of the Home Office's decision to extradite her son, Solo, a.k.a.
[08:52.640 --> 08:55.260]  Gary McKinnon, she has appealed directly to the Queen.
[08:55.680 --> 08:59.060]  The judicial review is expected to be completed by the end of the month.
[08:59.060 --> 09:07.560]  No word from the Queen yet, but seeing as there may soon be precedent for an Asperger's defense from the SegVec case, Solo might just want to try his luck here in the U.S. after all.
[09:08.720 --> 09:16.580]  The district court in Shangzhou City of Shenzhen Province in China has found five junior high graduates guilty of sabotaging computer networks.
[09:16.940 --> 09:27.000]  The group ran an illegal gaming server and attempted to attack and disconnect competing servers last May, accidentally causing a blackout at DnsPod, a major DNS provider in China.
[09:27.620 --> 09:32.320]  The resulting mess disabled Internet access in six provinces for several hours.
[09:32.820 --> 09:36.680]  Each member of the group received between eight and fifteen months in jail.
[09:38.060 --> 09:47.760]  Also in China, a court handed down jail terms of up to three years for eleven people involved in writing and distributed viruses designed to steal usernames and passwords from online games.
[09:47.760 --> 09:52.520]  The group would then use the passwords to steal virtual goods and money to sell to other players.
[09:53.180 --> 09:56.220]  Dozens more people involved in the scheme are still waiting sentencing.
[09:57.300 --> 10:06.420]  Police in South Korea have arrested two German college students for allegedly blackmailing a South Korean company after the pair broke into the company's network and attempted to hold it for ransom.
[10:06.420 --> 10:09.060]  The pair was arrested when they went to pick up the money.
[10:10.200 --> 10:14.860]  A recent report released by Verizon Business showed that some malware is getting more sophisticated.
[10:15.580 --> 10:24.200]  In response to new regulations requiring encryption of credit card data, this new malware sits on the point-of-sale machine and grabs the credit card information before it can be encrypted.
[10:25.180 --> 10:29.140]  Verizon says that this new feature made up four percent of the data breaches it investigated.
[10:30.460 --> 10:39.680]  With all the talk of botnets using Twitter and Facebook and even Amazon's EC2 service for command and control, sometimes it's the old-school botnets that work the best.
[10:40.000 --> 10:47.480]  The SD botnet, originally discovered five years ago, is still spreading fake AV and other nastiness via good ol' IRC.
[10:48.140 --> 10:58.660]  And speaking of botnets, a report recently released by Project Honeypot indicates that the number of botnet-controlled systems has quadrupled every year for the last four years.
[10:58.660 --> 11:00.780]  Wow, that's a lot of botnet.
[11:01.340 --> 11:05.060]  According to WebRoot, the KubeFace worm has learned at least one new trick.
[11:05.220 --> 11:14.520]  By prompting infected users to solve Google's reCAPTCHA system, KubeFace is able to automatically create infected Google reader pages to further spread itself.
[11:15.000 --> 11:16.660]  Pretty neat trick, if you ask me.
[11:18.140 --> 11:35.240]  WPA Cracker, an online service using the Amazon Cloud to crack Wi-Fi-protected access keys, which we reported on last week, has already been updated and now includes a German dictionary, an extended English dictionary of 284 million words, and zip-cracking support.
[11:35.780 --> 11:42.240]  If you happen to be using Google Chrome with Tor to surf all those naughty websites you visit, you may want to switch to something else.
[11:42.500 --> 11:51.000]  A bug in Google's Chrome web browser caused it to use the local DNS settings instead of the Tor projects possibly leaving a digital trail of websites that you've been visiting.
[11:52.340 --> 11:58.080]  BrewCon, a security conference held in Brussels, has announced its 2010 dates as September 24th and 25th.
[11:58.380 --> 11:59.600]  Mark those calendars.
[12:00.620 --> 12:04.480]  Unu, the Romanian SQL injection expert, has been added again.
[12:04.800 --> 12:12.400]  Finding SQL injection vulnerabilities in Kaspersky.com.sg and .my, or Singapore and Malaysia.
[12:12.880 --> 12:16.060]  The injection revealed account names and product serial numbers.
[12:16.720 --> 12:18.240]  Kaspersky has since fixed the issues.
[12:18.720 --> 12:22.420]  This is the second time in less than a year that Unu has hit a Kaspersky site.
[12:23.860 --> 12:28.000]  Last week we told you about the new attrition.org mascot, Lazlo the Squirrel.
[12:28.660 --> 12:30.820]  Well, now he has his own flask.
[12:31.100 --> 12:32.620]  If you want one, it's up on eBay.
[12:33.680 --> 12:35.580]  And now for this week's Stack of Shame.
[12:35.820 --> 12:39.580]  The list of all known open vulnerabilities as cataloged by the Zero Day Initiative.
[13:28.120 --> 13:30.000]  Welcome to the reading world.
[13:31.340 --> 13:33.320]  That's it for this week's HNNCast.
[13:33.540 --> 13:42.040]  We will be off for the next few weeks for the holidays, but we will triumphantly return on 01-11-10 for the official HNN launch.
[13:42.600 --> 13:48.920]  We hope to have a lot of goodies for you then, including these styling t-shirts, only available in black.
[13:49.120 --> 13:49.540]  Sorry.
[13:49.840 --> 13:54.360]  If you want to join us for the official launch in January, contact sales at HackerNews.com.
[13:54.680 --> 13:58.180]  I've been your host, Space Rogue, and you've been watching the Hacker News Network.
[13:59.660 --> 14:00.700]  Happy Holidays.
[14:03.300 --> 14:04.340]  Happy Holidays.
[14:06.620 --> 14:09.640]  May the calendar keep ringing.
[14:11.240 --> 14:14.320]  Happy Holidays to you.
[14:19.400 --> 14:24.320]  Remember, if you have any news you think we should report, send it to news at HackerNews.com.
[14:27.840 --> 14:29.880]  You have been watching HNNCast.
[14:30.100 --> 14:32.220]  This is Space Rogue for the Hacker News Network.
[14:37.180 --> 14:39.760]  Funny dude, funny dude, funny dude, bad things.