[00:15.840 --> 00:20.000]  You're watching HNNCast with Space Rogue on the Hacker News Network.
[00:27.070 --> 00:30.330]  HNN is sponsored by Astaro.
[00:31.210 --> 00:32.490]  Simplifying security.
[00:34.230 --> 00:35.110]  Become a sponsor.
[00:36.010 --> 00:38.350]  Email sales at hackernews.com.
[00:40.450 --> 00:45.870]  This is Space Rogue for the Hacker News Network, and this is HNNCast for the third week of January, 2010.
[00:46.310 --> 00:48.050]  Our top story this week...
[00:48.050 --> 00:54.710]  There continues to be massive fallout surrounding last week's major story of cyber espionage conducted by China against numerous U.S. companies.
[00:55.690 --> 01:01.050]  First, India is claiming that it, too, was a target of what has become to be known as an advanced, persistent threat.
[01:01.590 --> 01:10.530]  China responded by saying they haven't attacked anyone and that they are, in fact, the largest victim of online attacks, with almost 200 government websites attacked in just one week.
[01:11.290 --> 01:18.530]  iDefense, which originally provided much of the background information surrounding the attacks, has now clammed up and is refusing to make any additional comments.
[01:18.850 --> 01:20.030]  No one really knows why.
[01:20.410 --> 01:26.550]  In addition, they have actually retracted their initial statement that blamed the attacks on an Adobe Reader zero-day hole.
[01:27.330 --> 01:32.730]  Germany, France, and Australia have gone so far as to recommend people stop using Internet Explorer completely.
[01:33.390 --> 01:36.710]  Microsoft says that people should upgrade to the latest version of IE.
[01:37.010 --> 01:47.670]  Code exploiting the zero-day hole in Internet Explorer that was used against Google and 34 other companies, presumably by China, has been added to Immunity's Canvas and the Metasploit framework.
[01:48.390 --> 01:53.310]  The hole targets a previously unknown invalid pointer reference bug in IE.
[01:53.850 --> 01:58.270]  Unknown by everybody except Microsoft, who learned about it last September.
[01:59.170 --> 02:03.490]  By the time you watch this, Microsoft should have released an out-of-band patch for Internet Explorer.
[02:05.230 --> 02:08.790]  And Google has started to investigate its own employees as possible threats.
[02:09.590 --> 02:20.670]  Numerous security companies have been releasing detailed analyses of the various pieces of malware used in the attacks, calling them a complex package of programs that used custom protocols and sophisticated infection techniques.
[02:21.310 --> 02:27.590]  As for the other 33 companies that may or may not have been part of this attack, they aren't talking, at least publicly.
[02:28.810 --> 02:36.230]  We told you last week about how a group known as the Iranian Cyber Army redirected the DNS for the Chinese search engine Baidu.com.
[02:36.670 --> 02:44.230]  Well, not sure if it's related or not, but Li Yanan, Baidu.com's CTO, will be leaving the company for, quote, personal reasons.
[02:44.850 --> 02:48.010]  That's not the only fallout from the redirecting the search engine DNS.
[02:48.010 --> 02:53.630]  A Chinese group known as the Hunker Union has started to deface Iranian websites in retaliation.
[02:53.990 --> 03:05.750]  In addition, Baidu.com has filed a lawsuit against Network Solutions, the company that was responsible for the DNS service that the Iranian Cyber Army redirected, and claims that NetSol was responsible for gross negligence.
[03:06.110 --> 03:08.970]  Yeah, Network Solutions and gross in the same sentence.
[03:09.370 --> 03:10.470]  I'll agree with that.
[03:11.290 --> 03:18.450]  And if that wasn't enough bad news for preeminent domain hosting provider Network Solutions, they were also hit with a mass defacement this week.
[03:18.690 --> 03:23.230]  Hundreds of websites hosted on the company's servers were defaced with an anti-Israeli sentiment.
[03:23.630 --> 03:33.530]  Pictures of massed gunmen and the message, Hacked by CW Commando, or Commando, not really sure how to pronounce it, a pro-Palestinian organization based in Turkey.
[03:33.870 --> 03:41.530]  Network Solutions reported to Brian Krebs of KrebsOnSecurity.com that the intruders used a file inclusion vulnerability to gain access to the servers.
[03:41.790 --> 03:43.470]  The FBI is investigating.
[03:44.690 --> 03:47.810]  We'll be back with more HNNCast right after these messages.
[03:53.450 --> 03:54.130]  Fire!
[03:54.490 --> 03:54.710]  Fire!
[03:55.970 --> 03:56.550]  Fire!
[03:56.850 --> 03:57.490]  Fire!
[03:57.710 --> 03:58.210]  Fire!
[03:58.990 --> 03:59.290]  Fire!
[04:13.430 --> 04:15.450]  Welcome back to HNNCast.
[04:15.670 --> 04:25.710]  Members of the Chaos Computer Club in Germany have figured out how to remotely access data stored on employee access key cards used by several German airports and nuclear power stations.
[04:25.990 --> 04:35.510]  This security hole in the prime product line of access cards from Swiss manufacturer Legic could allow people to gain admittance to restricted areas of secure facilities.
[04:35.950 --> 04:43.270]  According to the researchers, the vendor used no encryption on the cards at all and instead resorted to code obfuscation to give the appearance of security.
[04:43.730 --> 04:49.330]  As a result of this lack of security, they found it trivially easy to emulate any card they wished.
[04:51.050 --> 04:58.570]  The MiFi by Novatel Wireless, which is rebranded and sold by numerous vendors such as Sprint and Verizon, has been found to have a few holes.
[04:59.090 --> 05:04.050]  Evidently, the web interface does not require valid authentication credentials to commit changes to the device.
[05:04.050 --> 05:08.270]  This, along with cross-site script forgery attacks, can leave the device wide open.
[05:08.690 --> 05:14.430]  An attacker can enable the GPS, disconnect users, and determine GPS coordinates of the device.
[05:15.550 --> 05:18.430]  So, you think you have your cyber defenses are well in order?
[05:18.690 --> 05:22.750]  Your firewall is locked down, your systems are all patched, and you're feeling pretty safe?
[05:23.130 --> 05:24.710]  Well, how's your physical security?
[05:25.230 --> 05:32.950]  Police in Australia say that this thief broke into his local recruiting company and then spent about three hours inside the office looking for a machine that he could log into.
[05:32.950 --> 05:38.090]  Once he found a system he could access, he installed software to enable the remote access to the system.
[05:38.910 --> 05:42.030]  Remember, cyber threats can come from the inside as well as the outside.
[05:44.510 --> 05:51.650]  Two large roadside video advertising screens near busy Garden Ring Road in Moscow were rigged to show porn last week.
[05:51.930 --> 05:59.710]  The videos ran for upwards of 20 minutes before operators could shut it off, but that was more than enough time for traffic to come to an almost complete standstill.
[06:00.390 --> 06:07.970]  Evidently, intruders broke into the computer system that controls the 9x6 meter screens and replaced one of the commercial advertisements with a little porn.
[06:08.550 --> 06:13.190]  Moscow police say they have received no complaints on the matter and do not plan an investigation.
[06:14.270 --> 06:18.210]  Just because you don't have a Twitter account doesn't mean it can't bite you in the ass.
[06:18.530 --> 06:21.630]  Just ask former 90210 star Brian Austin Green.
[06:21.630 --> 06:27.770]  A Twitter account that claimed to be him started tweeting about his upcoming engagement to Transformers actress Megan Fox.
[06:28.470 --> 06:30.610]  The thing is, they are not currently engaged.
[06:30.790 --> 06:33.230]  And the real Brian doesn't even have a Twitter account.
[06:33.690 --> 06:35.270]  But don't let the facts get in the way.
[06:35.510 --> 06:37.670]  Several media outlets ran with the story anyway.
[06:37.950 --> 06:40.250]  Remember folks, you don't believe everything you hear.
[06:40.250 --> 06:44.090]  We'll be right back with the HNN Quickies right after these messages.
[06:49.000 --> 06:49.620]  Fire!
[06:49.960 --> 06:50.180]  Fire!
[06:51.480 --> 06:52.000]  Fire!
[06:52.320 --> 06:52.940]  Fire!
[06:53.160 --> 06:53.660]  Fire!
[06:54.300 --> 06:54.720]  Fire!
[06:55.080 --> 06:55.260]  Fire!
[06:55.260 --> 06:55.700]  Fire!
[06:56.700 --> 06:56.840]  Fire!
[06:57.660 --> 06:59.260]  Hacker News T-shirts.
[06:59.860 --> 07:05.360]  $25 US dollars at www.hackernews.com Ah!
[07:08.110 --> 07:09.970]  Welcome back to HNNCast.
[07:10.130 --> 07:12.750]  And now for a few quickstores we found on the net this week.
[07:13.570 --> 07:17.810]  Not sure how we missed this last week, but the latest version of Backtrack Linux has been released.
[07:18.570 --> 07:24.410]  Backtrack Linux 4, designed specifically for the pen tester, features a new kernel, more tools, and of course, a ton of bug fixes.
[07:25.870 --> 07:31.370]  Last week we told you about a flaw in some D-Link wireless routers that could give an attacker access to the administrative settings.
[07:31.850 --> 07:37.450]  Well, despite no advance notice from the people who found the flaw, D-Link has already issued a firmware fix.
[07:37.690 --> 07:38.990]  That was pretty damn quick.
[07:39.250 --> 07:40.130]  Good job, D-Link.
[07:40.130 --> 07:45.290]  The first stable release of Nmap since July 2009 is now available.
[07:45.690 --> 07:54.730]  Version 5.2 contains 30 plus new scripts, enhanced performance, massive OS and version detection, database updates, and a hell of a lot more.
[07:55.510 --> 08:03.750]  The Honeynet project has announced their first forensic challenge of 2010, which consists of 11 questions about some provided attack data and network traces.
[08:04.130 --> 08:06.590]  The deadline for submissions is February 1st.
[08:07.470 --> 08:14.110]  Exeter University in the UK recently took its entire campus network offline in an attempt to eradicate a pesky virus.
[08:14.110 --> 08:17.810]  Their website says they are back online now, so I guess they got rid of it.
[08:18.790 --> 08:27.150]  Solo, aka Gary McKinnon, who is awaiting appeals on his extradition to the U.S. to face charges of breaking into NASA computer systems, has begun receiving death threats.
[08:27.410 --> 08:29.290]  His mom is obviously upset.
[08:30.390 --> 08:38.330]  If you happen to be in the Boston area, the Berkman Center for the Internet and Society at Harvard University is looking for a part-time intern to help with some DDoS research.
[08:38.750 --> 08:40.430]  Sounds like a good way to pad the resume.
[08:42.050 --> 08:45.510]  NullCon, taking place in Goa, India next month, has announced their hacking challenge.
[08:45.910 --> 08:48.870]  The top prize is free admission to the con and a two-night stay.
[08:50.710 --> 08:55.350]  AthCon, a new con taking place in Athens, Greece in June, has opened its call for papers.
[08:56.670 --> 08:58.110]  ShmooCon is just around the corner.
[08:58.310 --> 08:59.250]  Hope you got your tickets.
[08:59.610 --> 09:02.090]  And oh, the ShmooCon FireTalks are looking for sponsors.
[09:02.430 --> 09:04.810]  Great way to get your company in front of a targeted audience.
[09:05.710 --> 09:15.950]  And the con that always says that it's the last one but never seems to be, the next hope, taking place in New York this summer for the 8th time in 16 years, has opened its call for papers as well.
[09:16.510 --> 09:18.530]  Yes, we will probably be going to that one as well.
[09:18.850 --> 09:22.010]  And oh, we just passed the 10 year anniversary of Kevin Mitnick's freedom.
[09:22.430 --> 09:24.770]  Huh, wonder where Shimomura is these days.
[09:25.550 --> 09:27.230]  And now for the stack of shame.
[09:27.530 --> 09:30.150]  There's been some big changes to the stack of shame this week.
[09:30.150 --> 09:37.670]  A patch just released by Real Networks has removed six vulnerabilities, two of which were bottom dwellers, and had been on the list for over 800 days.
[09:38.590 --> 09:40.410]  Does anyone even use RealPlayer anymore?
[09:41.090 --> 09:47.770]  So anyway, this leaves IBM with three bottom dwellers, and HP still, after almost three years, is at the bottom of the stack.
[09:48.310 --> 09:49.090]  Come on, HP.
[09:49.330 --> 09:50.950]  You've gotten rid of the other bottom dwellers.
[09:51.050 --> 09:51.730]  Get rid of this one.
[09:51.950 --> 09:53.110]  I know you can do it.
[09:53.630 --> 09:58.070]  So here's the list of all known open vulnerabilities as catalogued by the Zero Day Initiative.
[10:47.380 --> 10:49.280]  Welcome to the real world.
[10:51.060 --> 10:52.940]  That's it for this week's HNNCast.
[10:52.940 --> 10:56.340]  I've been your host, Space Rogue, and you've been watching the Hacker News Network.
[10:59.830 --> 11:04.750]  Remember, if you have any news you think we should report, send it to news at HackerNews.com.
[11:08.410 --> 11:10.390]  You have been watching HNNCast.
[11:10.530 --> 11:12.730]  This is Space Rogue for the Hacker News Network.
[11:17.650 --> 11:20.150]  Fun to do, fun to do, fun to do bad things.