[00:15.790 --> 00:19.930]  You're watching HnNCast with Space Rogue on the Hacker News Network.
[00:27.070 --> 00:30.270]  HNN is sponsored by Astaro.
[00:31.190 --> 00:32.430]  Simplifying security.
[00:34.210 --> 00:35.070]  Become a sponsor.
[00:35.810 --> 00:38.310]  Email sales at hackernews.com.
[00:40.350 --> 00:45.730]  This is Space Rogue for the Hacker News Network, and this is HNNCast for the first week of January, 2010.
[00:46.250 --> 00:48.910]  This is also our first official launch episode.
[00:48.910 --> 00:59.950]  Coming up, we have stories on Kodak picture frames, CyberSitter sues all of China, and we have last year's news review by Courtney, and information how you can order your very own HNN t-shirt.
[01:00.310 --> 01:01.570]  But first, the news.
[01:01.830 --> 01:03.470]  Our top story this week.
[01:04.010 --> 01:06.910]  Supposedly secure USB drives evidently aren't.
[01:07.090 --> 01:15.350]  As a newly discovered flaw in USB vendor SanDisk, secure USB technology leaves devices from multiple vendors vulnerable to attack.
[01:15.350 --> 01:23.110]  A flaw residing in the password handling process of SanDisk application software puts data placed on these devices at risk.
[01:23.370 --> 01:32.530]  In an alert issued by the company, the USB vendor emphasized that the flaw was not in the device hardware or firmware, but actually in the application that runs on the host system.
[01:33.210 --> 01:44.750]  Meanwhile, secure USB vendors Kingston and Verbatim, which both use SanDisk software in their products, have either issued updates for their devices or actually gone so far as to recall the affected USB drives.
[01:45.170 --> 01:50.710]  It's interesting to note that all of these effective drives pass the FIPS 104-2 Level 2 certification.
[01:51.450 --> 01:54.790]  For whatever that's worth, which is obviously not a whole hell of a lot.
[01:54.790 --> 02:00.290]  And of course, IronKey has gone out of their way to mention that they are not affected by this vulnerability.
[02:02.530 --> 02:07.530]  IronKey security analysts have researched this information and studied the vulnerabilities.
[02:08.270 --> 02:12.170]  I'm happy to report that IronKey customers are safe.
[02:13.310 --> 02:14.890]  Well, good for you, IronKey.
[02:15.130 --> 02:15.790]  Face it.
[02:15.930 --> 02:19.050]  Once you have physical access to the device, all security is suspect.
[02:20.390 --> 02:33.650]  The Financial Services Information Sharing and Analysis Center has invited financial institutions, retailers, card processors, and businesses of all sizes to participate in the upcoming Cyber Attack Against Payment Processes, or CAP exercise.
[02:34.130 --> 02:41.470]  The three-day exercise to take place next month will simulate a cyber attack against financial services and will highlight a different attack each day.
[02:41.750 --> 02:47.970]  It is hoped the simulated attack will test members' emergency response, notification, and communication procedures.
[02:47.970 --> 02:54.210]  Oh, and just to make their OP4 experience more fun, Immunity is proclaiming January, the month of zero-day.
[02:55.050 --> 03:00.750]  With a week each devoted to directory server bugs, web server bugs, and directory server bugs.
[03:00.930 --> 03:02.550]  That should keep things pretty interesting.
[03:03.370 --> 03:06.090]  Did you get a Kodak EasyShare picture frame for Christmas?
[03:06.750 --> 03:11.850]  Evidently, each Kodak picture frame publishes its own RSS feed based on its MAC address to the Internet.
[03:11.850 --> 03:18.870]  This makes it trivially easy for anyone to grab copies of your private photos, or worse, upload photos to your picture frame.
[03:19.610 --> 03:26.790]  Framechannel.com, the company providing this service for Kodak, also provides this service through several other manufacturers of picture frames.
[03:27.310 --> 03:30.070]  It is not known if any of them are also vulnerable.
[03:30.570 --> 03:37.130]  Framechannel.com has begun filtering the RSS feeds based on user agent because, evidently, user agents can't be faked.
[03:38.290 --> 03:55.290]  CyberSitter has filed a $2.2 billion lawsuit against the People's Republic of China, two Chinese software companies, and seven computer makers, alleging that China's filtering software, Green Dam Youth Escort, copied more than 3,000 lines of code directly from CyberSitter's Internet filtering software.
[03:55.650 --> 04:01.130]  The Chinese government had mandated that all PCs sold within the country must ship with the software installed.
[04:01.130 --> 04:09.170]  When it was discovered that Green Dam was riddled with security holes and would essentially turn the whole country into one big botnet, the government quickly backed down.
[04:09.830 --> 04:18.490]  Over three days last month, about $3 million was drained from the bank account of the Duanesburg Central School District in upstate New York and deposited into overseas accounts.
[04:19.170 --> 04:22.890]  NBT Bank was able to reverse all but about half a million dollars worth of the charges.
[04:22.890 --> 04:27.930]  While reports don't specifically mention it, this is a classic Zeus botnet Trojan attack.
[04:28.310 --> 04:38.250]  In a somewhat related story, the Eugene, Oregon School District had a server breach that possibly exposed the personal information of current and former school employees.
[04:38.850 --> 04:41.990]  We'll be back with more HNNCast right after these messages.
[04:45.690 --> 04:48.090]  FIRE!
[04:48.530 --> 05:00.730]  SEXY STYLISH IMPRESS YOUR CREW INTIMIDATE LAMORS
[05:09.290 --> 05:13.330]  HACKER NEWS T-SHIRTS $25 U.S.
[05:13.450 --> 05:17.830]  DOLLARS AT WWW.HACKERNEWS.COM UGH!
[05:20.390 --> 05:21.130]  Thanks, Courtnee.
[05:21.430 --> 05:25.230]  It was a hell of a year, but now that HNN is back, 2010 will be even better.
[05:25.630 --> 05:28.370]  And now for a few follow-up to stories from 2009.
[05:28.950 --> 05:39.870]  Over the holidays, the Wall Street Journal reported on a major online breach of Citibank that took the company for tens of millions of dollars, was linked to a Russian cybercrime gang, and that was being investigated by the FBI.
[05:40.590 --> 05:43.310]  Only problem was, no one could corroborate the story.
[05:44.030 --> 05:47.750]  Citibank flat-out denied it, and the FBI said there was no such investigation.
[05:48.390 --> 05:53.790]  So did the journal make it all up for a sensationalist headline, or was there some big massive cover-up going on here?
[05:54.190 --> 05:55.030]  Who knows?
[05:56.530 --> 05:59.050]  A U.S. defense official has said that the security hole with the U.S. drone airplanes allowing insurgents to monitor their video feed has been fixed.
[06:04.070 --> 06:04.770]  That's it.
[06:05.030 --> 06:05.850]  Just fixed.
[06:06.150 --> 06:10.630]  No information about how it was fixed or what the original problem was, just that it's now fixed.
[06:11.410 --> 06:12.890]  Well, that's a big relief.
[06:13.330 --> 06:17.710]  However, other reports have indicated that it won't be completely fixed until 2014.
[06:18.430 --> 06:25.770]  One other tidbit to this story, the original Wall Street Journal article pointed to SkyGrabber software as the culprit in downloading the Predator video.
[06:26.010 --> 06:33.270]  However, this software is more for grabbing free satellite TV and porn and can't really be used to grab a live stream from a plane.
[06:33.850 --> 06:36.190]  Now, this doesn't mean that the whole story is false.
[06:36.470 --> 06:38.510]  No, they probably just got the name of the software wrong.
[06:39.370 --> 06:44.790]  The 26th Chaos Communication Congress, or 26C3, occurred in Germany over the holidays.
[06:45.270 --> 06:51.850]  One of the biggest stories to come out of the con was news of the breaking of GSM encryption standards used by most of the world's cellular phones.
[06:52.430 --> 07:01.350]  The attack involves the use of computer-controlled radios to follow the frequency-hopping methods that GSM employs, coupled with a set of rainbow tables to break the actual encryption.
[07:01.950 --> 07:05.530]  The rainbow tables have already been uploaded to Cryptome and BitTorrent.
[07:06.010 --> 07:11.090]  Also on BitTorrent are videos of most, if not all, of the talks at the Congress, including the one on GSM.
[07:11.710 --> 07:14.950]  Check the comments of this story on HackerNews.com for the links.
[07:15.910 --> 07:18.990]  Twitter.com had its DNS redirected over the holidays.
[07:19.310 --> 07:24.390]  The redirect only lasted about an hour and 15 minutes and affected about 80% of the site's users.
[07:24.810 --> 07:29.670]  The redirect was very embarrassing for the company that has been trying to increase its security profile recently.
[07:29.670 --> 07:36.750]  It's thought that a Twitter employee had his email account breached, which allowed the attacker access to alter the DNS records.
[07:37.250 --> 07:42.070]  Twitter traffic was redirected to a page listing the Iranian Cyber Army as the culprit.
[07:42.490 --> 07:53.790]  This caused several mainstream media sources to start running around screaming about cyber warfare and falling skies and whatnot, even though it was fairly obvious, to us anyway, that no such threat actually existed.
[07:54.150 --> 08:00.710]  In another Twitter story, the service has hard-coded a list of almost 400 passwords that it will not allow you to use on the site.
[08:01.330 --> 08:06.030]  Words like password, naked, hooters, and butthead are banned as passwords.
[08:06.290 --> 08:07.510]  They took all the fun words!
[08:07.510 --> 08:15.990]  It's not clear whether Twitter got its banned password list, but evidently it wasn't from the built-in list of Conficker, as the two only have 29 words in common.
[08:16.670 --> 08:36.710]  While accused TJX Breach Kingpin Segvek, aka Albert Gonzalez, awaits a possible sentence of 17 years or more in prison after pleading guilty in the third case against him, one of his best friends, Unix Terrorist, aka Jim Jones, aka Steven Watt, a 25-year-old former Morgan Stanley software engineer,
[08:36.990 --> 08:42.630]  has been sentenced to two years in jail in order to pay restitution of over $171 million.
[08:43.610 --> 08:45.330]  Damn, that's a lot of license plates.
[08:46.470 --> 08:53.690]  Romanian SQL expert Unu had an exciting holiday, which he spent exploring the SQL databases of Intel channel partner websites.
[08:54.030 --> 08:59.590]  The SQL injection exposed plain text passwords, credit card information, and other assorted details.
[09:00.190 --> 09:02.330]  Huh, I guess it was Unu inside.
[09:03.090 --> 09:08.490]  Last month, we told you about Coffee, Microsoft's digital forensics tool that was accidentally released to the Internet.
[09:08.490 --> 09:12.650]  That was quickly followed up by Decaf, which supposedly countered the threat.
[09:13.150 --> 09:21.170]  Then, for some weird, incomprehensible reasons, the group behind Decaf disabled all versions of the software remotely, saying they did it for Jesus or something.
[09:22.010 --> 09:30.490]  Anyway, now the folks over at SoldierX.com claim that they have re-enabled the software, prevented it from phoning home again, and have re-released it to better BitTorrent sites everywhere.
[09:31.290 --> 09:34.490]  We'll be right back with the H&M quickies right after these messages.
[09:39.560 --> 09:40.300]  FIRE!
[09:40.900 --> 09:48.340]  SEXY STYLISH IMPRESS YOUR CREW
[09:52.020 --> 09:54.000]  INTIMIDATE LAMORS FIRE!
[09:54.940 --> 09:55.310]  FIRE!
[09:56.460 --> 09:56.540]  FIRE!
[09:56.540 --> 09:56.680]  FIRE!
[09:57.000 --> 09:57.460]  FIRE!
[09:57.460 --> 09:57.600]  FIRE!
[09:57.940 --> 09:58.680]  FIRE!
[09:58.900 --> 09:59.060]  FIRE!
[09:59.060 --> 09:59.420]  FIRE!
[09:59.940 --> 10:00.360]  FIRE!
[10:00.950 --> 10:01.500]  FIRE!
[10:02.070 --> 10:02.620]  FIRE!
[10:02.620 --> 10:09.620]  Hacker News t-shirts, $25 at www.hackernews.com
[10:12.880 --> 10:14.700]  Welcome back to HNNCast.
[10:14.960 --> 10:20.080]  Before we get to this week's quickies, here are a few quick follow-ups to stories we reported on before the holidays.
[10:20.360 --> 10:29.460]  Two days before Christmas last month, a massive DDoS attack against UltraDNS caused Amazon, Walmart, Expedia, and other major sites to become unreachable.
[10:29.460 --> 10:33.720]  The attack affected users in Northern California and lasted for about an hour.
[10:34.060 --> 10:41.200]  The group behind the notorious Facebook worm, Kubeface, left researchers a little holiday greeting embedded deep within the code.
[10:41.680 --> 10:47.740]  The greeting specifically thanked several researchers for their tireless efforts in pointing out bugs in the worm that they were then able to fix.
[10:48.020 --> 10:56.060]  A security hole in Adobe Acrobat that has been actively exploited since November is expected to finally be patched tomorrow, January 12th.
[10:56.060 --> 11:00.960]  In an explanation for the delay, Adobe said that it did not want to disrupt its quarterly patch schedule.
[11:01.300 --> 11:02.120]  How nice.
[11:02.460 --> 11:08.140]  It's not known if the January 12th update will also cover the other newer JavaScript exploits currently circulating.
[11:08.140 --> 11:22.200]  In a related story, Ain'tItCool.com, King Features Syndicate, and others had their OpenX advertising installations compromised so that the ads they served would point to a maliciously crafted PDF file that took advantage of the open exploit.
[11:22.580 --> 11:26.260]  It is unknown how many people may have downloaded the infected PDF files.
[11:26.260 --> 11:37.380]  The Little Italy restaurant in Anchorage, Alaska is the latest victim of a point-of-sale compromise after malware installed on the POS system grabbed up to 1,000 credit card numbers from diners at the restaurant.
[11:37.660 --> 11:39.660]  The FBI is investigating.
[11:40.220 --> 11:51.780]  Italian police have arrested Fabrizio Iannelli after he was deported from Thailand for allegedly breaking into the computer systems of numerous companies to pilfer credit card information at the behest of the Italian Mafia.
[11:51.780 --> 11:59.280]  The veteran rock and roll star, Van Morrison, has blamed the defacement of his webpage for the recent false rumors of his upcoming fatherhood.
[11:59.540 --> 12:02.700]  It is thought that the site was compromised via SQL injection.
[12:03.080 --> 12:06.000]  This was the second breach of the site in the last three months.
[12:06.600 --> 12:09.820]  We have told you about Francis Frank Janosko before.
[12:10.180 --> 12:20.700]  He was charged with using a prison-provided computer system at the Plymouth County Correctional Facility in Massachusetts to access other parts of the prison network and collect personal data on over 1,100 prison guards.
[12:20.700 --> 12:23.980]  Well, he just got an additional 18 months tacked onto his sentence.
[12:24.980 --> 12:32.880]  About 30,000 customers of British ISP VISPA were forced offline for almost 12 hours by a DDoS attack traced to the Baltic state of Latvia.
[12:33.400 --> 12:38.060]  The website for the President of the country of Iran was recently defaced with a message to God.
[12:38.440 --> 12:42.500]  The message attempted to remind God of all the people he had taken in 2009.
[12:42.500 --> 12:46.180]  Michael Jackson, Farrah Fawcett, Nida, etc.
[12:46.580 --> 12:49.460]  And not to forget to take the Iranian President as well.
[12:49.700 --> 12:50.720]  Well, his hoping.
[12:51.760 --> 13:01.720]  The website for the Rhode Island Department of Human Services was down for most of December after HP Enterprise Services, which host the website, discovered that the site had been compromised and took it offline.
[13:02.300 --> 13:09.740]  In a statement, HP Enterprise Services stated that no personal health information was at risk, but failed to mention any details about the attack.
[13:10.400 --> 13:17.280]  Penn State University lost control over 30,000 social security numbers after a system on the campus became infected with malware.
[13:18.380 --> 13:26.540]  Random Storm, a vulnerability management company, has announced the acquisition of the open-source vulnerability testing application, Dam Vulnerable Web App.
[13:27.020 --> 13:30.120]  Hopefully, this won't bring any unwanted changes to the application.
[13:30.980 --> 13:39.000]  The Washington Post has lost one of its most prolific security writers, as Brian Krebs has moved and now has his own blog, KrebsOnSecurity.com.
[13:39.780 --> 13:41.120]  Definitely worth reading.
[13:42.480 --> 13:46.260]  PlumberCon in Austria has announced its 2010 dates for the 10th Annual Con.
[13:46.580 --> 13:52.000]  They haven't updated their website yet, but their Twitter feed lists July 9th through the 11th as the dates to reserve.
[13:53.060 --> 13:59.060]  CarolinaCon, taking place in Raleigh, North Carolina on March 19th to the 21st, has opened its call for papers.
[14:00.940 --> 14:11.340]  ShmooCon, taking place next month in Washington, D.C., has released its speaker list with a keynote by Taylor Banks and Adam Bregenzer on how to get and stay anonymous.
[14:11.680 --> 14:12.700]  Looking forward to that one.
[14:13.980 --> 14:20.540]  And now for this week's Stack of Shame, the list of all known open vulnerabilities as cataloged by the Zero Day Initiative.
[14:20.540 --> 14:31.740]  But before we run the list, I want to let you know that HP has made some major changes affecting the list, fixing five of their open vulnerabilities, including the bottom dweller of the list that was over three years old.
[14:32.120 --> 14:33.120]  Good work, HP.
[14:33.440 --> 14:36.700]  You still have the bottom dweller spot, but with a different vulnerability.
[14:36.980 --> 14:38.360]  But at least it's a little younger.
[14:38.860 --> 14:39.720]  Here's the list.
[15:29.070 --> 15:30.890]  Welcome to the real world.
[15:33.870 --> 15:35.710]  That's it for this week's HNNCast.
[15:35.870 --> 15:39.250]  I've been your host, Space Rogue, and you've been watching the Hacker News Network.
[15:43.550 --> 15:48.410]  Remember, if you have any news you think we should report, send it to news at HackerNews.com.
[15:52.010 --> 15:54.010]  You have been watching HNNCast.
[15:54.210 --> 15:56.310]  This is Space Rogue for the Hacker News Network.
[16:01.400 --> 16:03.820]  Fun to do, fun to do, fun to do, fun to do bad things.