[00:16.410 --> 00:19.930]  You're watching HNNCast with Space Rogue on the Hacker News Network.
[00:34.220 --> 00:45.560]  This is Space Rogue for the Hacker News Network, and this is HNNCast for the second week of January, 2010.
[00:46.260 --> 00:48.060]  This week's top story is a big one.
[00:48.060 --> 00:53.140]  Google claims that it and at least 34 other top firms have been attacked by the Chinese government.
[00:53.580 --> 00:59.240]  Some of the other attacked companies have been identified as Yahoo, Symantec, Juniper, Northrop Grumman, and Dow Chemical.
[00:59.640 --> 01:03.400]  As a result of these attacks, Google has threatened to completely pull out of China.
[01:03.940 --> 01:07.480]  Google says it has notified the other companies and is currently working with U.S. authorities regarding the attacks.
[01:09.240 --> 01:13.200]  The initial intrusion vector for Google may have been compromised PDF files.
[01:13.200 --> 01:18.580]  They took advantage of zero-day holes at Adobe just recently, and some say delayed, issuing patches for.
[01:19.160 --> 01:27.020]  Once inside the various companies, the attackers dropped the Hydrax Trojan and focused on the email accounts of Chinese activists, as well as proprietary source code.
[01:27.240 --> 01:33.580]  The information was then routed through a compromised server at Rackspace and other ISPs before being sent overseas.
[01:33.580 --> 01:44.820]  A separate attack vector involved a zero-day vulnerability in Internet Explorer, which allows local user privileges and is then used to also drop the Hydrax Trojan among a dozen other pieces of malware.
[01:45.420 --> 01:51.960]  These recent attacks are very similar to targeted attacks using PDF files sent to over 100 companies in July of last year.
[01:52.540 --> 01:57.880]  Researchers have traced these attacks directly to either the Chinese government or proxies acting on orders from the government.
[01:57.880 --> 02:05.440]  It has been very interesting to compare and contrast the amount and frequency of information being released from the various companies that have been affected by this.
[02:05.880 --> 02:14.300]  Even more interesting, in our opinion here at HNN, is the response, or a lack thereof, as it was only three sentences long, from the U.S.
[02:14.420 --> 02:14.960]  State Department.
[02:15.360 --> 02:19.080]  They have released a statement saying the attacks raised very serious concerns.
[02:19.260 --> 02:20.200]  But that's it.
[02:20.660 --> 02:27.180]  Whatever happens with this story, we hope that the 360 million Internet users in China can somehow benefit from all of this.
[02:27.860 --> 02:38.160]  The Iranian Cyber Army, the group that effectively rerouted Twitter's DNS entries last week for a short period of time, have now done the same for Baidao.com, China's largest search engine.
[02:38.460 --> 02:41.380]  The search engine was redirected for a little less than two hours.
[02:41.760 --> 02:52.020]  In response, at least three Chinese groups, the Hacker Union of China, China Eagle, and the Green Army Corps, took credit for several defacements of Iranian websites in retaliation.
[02:52.020 --> 02:59.860]  The affected sites included ones for the Ministry of Defense and Foreign Affairs, as well as one devoted to disseminating diabetes information inside the country.
[03:00.360 --> 03:03.820]  A rogue application has made it onto the Android Marketplace.
[03:04.040 --> 03:13.180]  The rogue Android application posed as a legitimate banking applet, but was actually designed to trick people into handling other bank, handing over bank login details to fraudsters.
[03:13.780 --> 03:25.220]  Approximately 40 different applications targeting everything from the Royal Bank of Canada to the Citibank of Texas were written by the developer 09Droid, and offered for sale in the Android Marketplace for 99 cents each.
[03:25.740 --> 03:30.220]  Of course, this now has people questioning Google's entire security model for the Android phone.
[03:31.120 --> 03:37.720]  Last week, we told you about a presentation at the 26th Chaos Computer Conference in Germany that detailed a crack to GSM encryption.
[03:38.160 --> 03:41.820]  Well, that crack covered a currently used cipher, A5-1.
[03:42.380 --> 03:51.120]  Now, the newer logarithm, A5-3, or the Kasumi cipher, has also fallen victim to a related key attack, or what the researchers have dubbed a sandwich attack.
[03:51.640 --> 03:59.580]  While the crack is possible, it is unlikely to fall into widespread use, since it requires the accumulation of several million known plaintext before the correct key can be deduced.
[03:59.580 --> 04:02.880]  Oh, and one of the researchers on this was Adi Shamir.
[04:03.140 --> 04:05.220]  You know, the S in RSA.
[04:06.340 --> 04:09.380]  So now we have rogue applications in the Android Marketplace.
[04:09.580 --> 04:12.900]  We told you about the Rick-Rolling iPhone malware a few weeks ago.
[04:13.100 --> 04:16.960]  And earlier this week, there was some proof-of-concept code released for BlackBerry malware.
[04:17.680 --> 04:24.040]  Then there are the new Trojan porn dialers that operate on Java-enabled phones and send out high-cost SMSs without your knowledge.
[04:24.560 --> 04:27.600]  I don't see anything specifically targeting the Palm OS.
[04:27.600 --> 04:29.440]  The market has spoken.
[04:29.840 --> 04:31.440]  I guess no one really cares about pre.
[04:32.640 --> 04:35.560]  We'll be back with more AsianNCast right after these messages.
[04:39.380 --> 04:41.660]  FIRE!
[04:42.100 --> 04:56.100]  SEXY STYLISH IMPRESS YOUR CREW Intimidate blamers FIRE!
[04:56.120 --> 04:56.860]  FIRE!
[04:57.340 --> 04:58.020]  FIRE!
[04:58.160 --> 04:58.940]  FIRE!
[04:59.060 --> 04:59.640]  FIRE!
[05:00.120 --> 05:00.760]  FIRE!
[05:01.260 --> 05:01.700]  FIRE!
[05:02.660 --> 05:02.740]  FIRE!
[05:02.740 --> 05:02.820]  FIRE!
[05:03.710 --> 05:05.140]  Hacker News T-shirts.
[05:06.180 --> 05:10.920]  $25USD at www.hackernews.com
[05:13.980 --> 05:18.200]  The folks over at SourceSec Security have found a major flaw with D-Link routers.
[05:18.400 --> 05:26.820]  The flaw in the Home Network Administration Protocol can allow an attacker to bypass the CAPTCHA security feature and give them full access to the user's internal network.
[05:27.180 --> 05:34.300]  The flaw affects at least the DI-524, the DIR-628, and 655, and probably others.
[05:35.920 --> 05:40.320]  A U.S. Army website that helps military families find housing has succumbed to an SQL injection attack.
[05:40.620 --> 05:47.800]  The security of onestop.army.mil was breached by TinCode, who posted his findings on his blog.
[05:48.120 --> 05:52.160]  The flaw exposed database names, usernames, and plain text passwords.
[05:52.840 --> 05:59.240]  TinCode has taken credit for previous high-profile SQL flaws such as those at Yahoo, Apple, NASA, and Kaspersky, among others.
[05:59.240 --> 06:04.280]  One-stop.army.mil was offline for at least a week following the publication of the flaw.
[06:05.340 --> 06:14.080]  Boulder Police and the FBI have announced they know who defaced the webpages of two Boulder, Colorado area synagogues and the Boulder Rabbinic Council, but they aren't saying.
[06:14.760 --> 06:26.940]  According to the FBI, the perpetrators came from abroad, but that the agency is not releasing the country the messages came from or even what region of the world because, quote, there is no investigative value in releasing that information, unquote.
[06:26.940 --> 06:29.320]  Quote, no investigative value?
[06:29.760 --> 06:33.120]  Maybe to most people, but some of us would find that information very useful.
[06:34.180 --> 06:43.380]  Crap like this makes me wish I had more time to file Freedom of Information Act requests, because now I have to wonder if they actually did any investigation at all or just making stuff up to cover their asses.
[06:43.960 --> 06:49.880]  In a rather embarrassing incident, the website for the Pakistani National Response Center for Cyber Crimes was recently defaced.
[06:50.260 --> 06:56.220]  The main page was changed to include statements mocking the organization and claiming that the email database of the system had been downloaded.
[06:56.820 --> 07:03.340]  A group known as PACBUGS, or at least frequenting the PACBUGS.com forum, claimed responsibility for the attack.
[07:03.800 --> 07:10.140]  According to ZoneH.org, PACBUGS was responsible for defacing over 1,700 websites in last year.
[07:11.040 --> 07:19.100]  After five government websites were defaced over the last month, one of which was hit twice in the same day, the Philippines government has decided to act.
[07:19.600 --> 07:27.960]  President Obama has tasked the Commission on Information and Communications Technology, as well as the National Bureau of Investigation, to, well, investigate.
[07:28.700 --> 07:29.060]  Huh?
[07:29.220 --> 07:32.500]  No mention of updating security policies or applying software patches.
[07:32.780 --> 07:34.340]  No, they're just going to investigate.
[07:34.660 --> 07:35.760]  Well, good for them.
[07:36.220 --> 07:41.520]  These recent defacements have led many people to question the security of the upcoming automated elections in the Philippines.
[07:41.520 --> 07:47.660]  The head of the Commission on Elections has said that if anyone messes with the election systems, they will face life imprisonment.
[07:48.060 --> 07:51.940]  Of course, that would rely on the previous investigation being successful.
[07:53.200 --> 07:55.560]  And my favorite story on HNN...
[07:57.760 --> 07:58.440]  Solo, a.k.a. Gary McKinnon.
[07:58.840 --> 08:07.100]  Arrested in 2002 for breaking into numerous NASA systems and fighting extradition from the UK since 2005, has won yet another appeal.
[08:07.620 --> 08:14.280]  The High Court has granted a further judicial review of the Home Secretary's decision to allow extradition proceedings against Solo to proceed.
[08:15.100 --> 08:17.880]  This means that the earliest he could possibly see U.S. soil is sometime in April.
[08:19.780 --> 08:24.360]  Most likely May or June, as he'll probably get another appeal and then another one and another one.
[08:24.880 --> 08:27.020]  You know, if he had his trial here in the U.S. back in 2005, he'd probably be out on bail already.
[08:31.440 --> 08:35.660]  Courtnee was off this week, but we'll be right back with the HNN Quickies right after these messages.
[08:40.340 --> 08:41.380]  Fire!
[08:42.320 --> 08:42.440]  Fire!
[08:42.440 --> 08:42.780]  Sexy.
[08:45.380 --> 08:46.420]  Stylish.
[08:47.900 --> 08:49.440]  Impress your crew.
[08:52.220 --> 08:53.820]  Intimidate lamers.
[08:55.780 --> 08:55.940]  Fire!
[08:56.260 --> 08:56.680]  Fire!
[08:57.700 --> 08:58.740]  Fire!
[08:59.160 --> 08:59.480]  Fire!
[09:00.060 --> 09:00.540]  Fire!
[09:01.060 --> 09:01.480]  Fire!
[09:01.940 --> 09:02.480]  Fire!
[09:03.600 --> 09:05.080]  Hacker News T-Shirts.
[09:06.500 --> 09:10.840]  $25 at www.hackernews.com
[09:14.170 --> 09:15.950]  Welcome back to HNNCast.
[09:16.130 --> 09:19.030]  And now for a few quick stories we found on the net this week.
[09:19.690 --> 09:25.630]  Before we get to the quickies though, don't forget you can order your very own HNN T-Shirt at hackernews.com.
[09:25.790 --> 09:27.470]  Of course, yours would be in black.
[09:27.470 --> 09:30.270]  And it looks like another botnet has bitten the dust.
[09:30.770 --> 09:39.350]  Quickly following the disassembly of the Mega D botnet, thanks to the hard work of Newstar and other ISPs, the Lethic botnet is no longer sending spam.
[09:40.310 --> 09:43.710]  Lethic was thought to be responsible for up to 10% of all spam.
[09:43.710 --> 09:44.970]  Good work, guys.
[09:46.590 --> 09:55.730]  Jilsi, aka Renuktha Sambrimian, sorry, has pled guilty in the London court for his role in running the online carding forum Dark Market.
[09:56.030 --> 09:59.090]  The former pizza delivery man faces 10 years in jail.
[10:00.250 --> 10:10.910]  The law firm representing Cybersitter in the lawsuit against China over copying code for the country's filtering software, Green Dam Youth Escort, has said that it too has come under cyber attack from China.
[10:10.910 --> 10:15.990]  It is not known yet if the attacks are related to the ones reported by Google, but they probably are.
[10:17.230 --> 10:22.950]  Brian Krebs at KrebsOnSecurity.com has another very interesting write-up in his continuing series on money mules.
[10:23.350 --> 10:28.350]  The twist this time is that it seems as though the criminals may have compromised a system inside the bank.
[10:28.710 --> 10:31.490]  West Virginia-based First Century Bank, to be exact.
[10:31.870 --> 10:34.270]  It is unclear exactly how much money may have been lost.
[10:36.150 --> 10:50.150]  The DSS guy, aka Veracity, aka Robert Ward, has been hit with a $51 million judgment after being found guilty of distributing over 250,000 copies of software that would allow the piracy of Dish Network TV signals.
[10:51.410 --> 10:57.770]  Suffolk County National Bank, located in Long Island, New York, found that it had suffered a security breach after an internal audit.
[10:57.770 --> 11:02.870]  The audit showed that the intruders had accessed over 8,000 customer usernames and passwords.
[11:03.910 --> 11:11.470]  Officials in South Korea have announced that they will launch a Cyber Warfare Command Center next week to fend off attacks on government and military IT networks.
[11:12.030 --> 11:16.250]  On February 3rd, Hurricane Labs will once again hold its annual hacking challenge.
[11:16.430 --> 11:20.770]  The Capture the Flag-style contest will be held at the Hurricane Labs offices in Ohio.
[11:21.370 --> 11:23.050]  Pre-registration is required.
[11:23.650 --> 11:26.550]  The website for the city of Detroit was recently defaced.
[11:26.730 --> 11:31.470]  This after it was recently pointed out that Saddam Hussein had once been awarded the key to the city.
[11:31.890 --> 11:35.290]  It's thought the attackers got in via an old front-page exploit.
[11:36.350 --> 11:40.490]  NullCon, 2010, to take place in Goa, India next month, has opened its registration.
[11:41.810 --> 11:46.170]  DEFCON will be raising prices this year to a whopping $140 bucks.
[11:46.590 --> 11:49.330]  They've also announced something called the No Drama Badge.
[11:49.330 --> 11:51.050]  No idea what that is.
[11:51.370 --> 11:53.170]  I wonder if Kingpin will be designing it.
[11:53.950 --> 11:58.550]  Security B-Sides Austin, taking place during South by Southwest, has opened its call for papers.
[11:59.690 --> 12:02.130]  ShmooCon, taking place next month, has released its schedule.
[12:02.450 --> 12:04.430]  And there is a lot of interesting stuff in there.
[12:04.710 --> 12:08.130]  They've also announced that they will be streaming the con live via Ustream.
[12:08.570 --> 12:12.030]  Oh, and the fire talks for Shmoo2010 are all filled up as well.
[12:12.450 --> 12:13.530]  Should be a good con.
[12:13.810 --> 12:14.610]  Hope to see you there.
[12:15.690 --> 12:19.890]  Hack in the Box has released Issue 1 Volume 1 of their new Hack in the Box magazine.
[12:20.270 --> 12:25.710]  The new e-zine has articles on LDAP injection, DLL injection, and malware obfuscation.
[12:26.850 --> 12:31.770]  Twitter has a few job openings, one of which is a manager of network and infrastructure security.
[12:32.230 --> 12:34.490]  Huh, definitely not a job for the faint of heart.
[12:35.470 --> 12:41.430]  And now for this week's Stack of Shame, the list of all known open vulnerabilities as cataloged by the Zero Day Initiative.
[13:36.280 --> 13:38.100]  Welcome to the real world.
[13:41.210 --> 13:43.030]  That's it for this week's HNNCast.
[13:43.210 --> 13:46.470]  I've been your host, Space Rogue, and you've been watching the Hacker News Network.
[13:50.860 --> 13:55.760]  Remember, if you have any news you think we should report, send it to news at Hackernews.com.
[13:59.330 --> 14:01.350]  You have been watching HNNCast.
[14:01.510 --> 14:03.630]  This is Space Rogue for the Hacker News Network.
[14:08.750 --> 14:11.110]  Find to do, find to do, find to do, find to do bad things.