[00:15.840 --> 00:19.980]  You're watching HNNCast with Space Rogue on the Hacker News Network.
[00:27.190 --> 00:30.330]  HNN is sponsored by Astaro.
[00:31.330 --> 00:32.490]  Simplifying security.
[00:34.030 --> 00:35.110]  Become a sponsor.
[00:35.930 --> 00:38.370]  Email sales@hackernews.com.
[00:40.410 --> 00:45.530]  This is Space Rogue for the Hacker News Network, and this is HNNCast for the fourth week of January, 2010.
[00:46.090 --> 00:50.070]  We've got a lot of news this week, including more fallout from the Google China mess.
[00:50.070 --> 00:52.590]  Oil companies have been hit with targeted attacks.
[00:52.870 --> 00:55.390]  DOS attacks against Chinese activist websites.
[00:55.930 --> 00:56.990]  Tor servers compromised.
[00:57.410 --> 01:00.090]  And a special report from Courtnee on the mysterious jester.
[01:00.490 --> 01:01.790]  But first, our top story.
[01:02.350 --> 01:10.870]  While President Obama was promising to make everyone rich with a great job and to live forever with free healthcare, the Red Eye Crew was hard at work defacing websites.
[01:11.270 --> 01:13.050]  Specifically, over 40 U.S.
[01:13.150 --> 01:15.870]  congressional websites and a couple of committee sites as well.
[01:15.870 --> 01:23.190]  The Red Eye Crew works out of Brazil and is listed as having over 45,000 webpage defacements, according to the ZoneH archive.
[01:23.650 --> 01:30.590]  It is currently unknown how the attackers got in, but all of the defaced sites seem to be running the Jumula content management system.
[01:30.810 --> 01:32.850]  And all were managed by GovTrends.
[01:33.150 --> 01:37.690]  This is at least the second time that government websites hosted by GovTrends have been defaced.
[01:37.690 --> 01:43.090]  Back at the beginning of August, 18 sites of members of the house were defaced by a group out of Indonesia.
[01:45.450 --> 01:53.870]  Accusations by Google that they were attacked, along with 33 other companies via a zero-day hole in Internet Explorer by China, is still making headlines.
[01:54.370 --> 02:00.310]  At this point, it has become more of a war of words with China denying all involvement and accusing the U.S.
[02:00.330 --> 02:01.810]  of online warfare itself.
[02:01.810 --> 02:10.490]  Despite the fix released in an out-of-band patch by Microsoft last week, hundreds of websites have already sprung up using drive-by attacks to exploit the hole.
[02:11.110 --> 02:17.330]  The attacks install Trojan Horse programs that are able to bypass security products to give the intruders access to the system.
[02:18.090 --> 02:24.410]  Hundreds of websites have already been found that are hosting the malicious code, waiting for unsuspecting IE6 users.
[02:24.410 --> 02:33.450]  The original code used in the Google attacks has been looked at and dissected every which way, and evidently is not as sophisticated as some researchers first led us to believe.
[02:33.990 --> 02:39.570]  However, several aspects of this attack do show an unusual amount of sophistication and dedication.
[02:40.850 --> 02:48.830]  Evidently, in order to get close to the targeted individuals, the attacks attempted to compromise the computers of friends of the targets listed on various social networking sites.
[02:49.470 --> 02:54.470]  The compromised friends machines were then used to send emails or instant messages to the target.
[02:55.130 --> 02:57.150]  And people wonder why I don't do Facebook.
[02:57.750 --> 03:03.230]  At least three major oil companies have been hit with spear phishing attacks aimed at uncovering critical information.
[03:04.090 --> 03:13.130]  Emails containing malicious links were sent to chief executives at ExxonMobil, ConocoPhillips, and Marathon Oil in an effort to install spyware throughout the corporate networks.
[03:13.130 --> 03:20.450]  The attacks targeted the company's proprietary bid data detailing the quantity, value, and location of petroleum discoveries worldwide.
[03:21.110 --> 03:27.150]  The attacks occurred in 2008, but the companies involved weren't fully aware of the problem until they were notified by the FBI.
[03:27.770 --> 03:33.250]  While at least one of the servers used in the attack was in China, it is unknown who was actually conducting the attack.
[03:35.110 --> 03:40.950]  Five websites run by Chinese human rights activists were attacked by sustained DDoS attacks last weekend.
[03:40.950 --> 03:50.690]  The attack consumed over two gigabytes a second of bandwidth at its peak and lasted for up to 16 hours, according to the ISP The Planet, where the websites were hosted.
[03:51.270 --> 03:56.730]  The Chinese government is a suspect in the attacks, but there is no direct evidence linking them to the DDoS.
[03:57.170 --> 04:04.290]  Finding a smoking gun that points to anyone in any attack like this will be difficult, let alone a nation-state that is trying to cover its tracks.
[04:06.270 --> 04:13.270]  Operators of the Tor privacy network have announced that two of the seven directory authorities and one metrics data server have been compromised.
[04:13.650 --> 04:21.650]  While no user data was at risk due to the compromise, users are encouraged to use the latest versions of Tor software to ensure they have the latest security keys.
[04:22.330 --> 04:29.850]  Evidently, the intruders either did not realize what they had broken into or did not care, and only seemed interested in a bandwidth to launch other attacks.
[04:31.650 --> 04:34.590]  We will be back with more HNNCast right after these messages.
[04:58.940 --> 05:00.760]  Welcome back to HNNCast.
[05:01.160 --> 05:07.340]  A Nebraska man will be sentenced to a year in jail for his part in a massive cyber attack against the Church of Scientology website.
[05:08.260 --> 05:19.660]  Twenty-year-old Brian Mettenbrink will plead guilty next week to the charge of unauthorized access of a protected computer for his involvement in the denial-of-service attack, which was orchestrated by the online group Anonymous.
[05:20.760 --> 05:24.380]  Mettenbrink is the second successful prosecution connected to the Anonymous attacks.
[05:25.100 --> 05:31.900]  Last year, Dimitri Guzner of Verona, New Jersey, was sentenced to a year and a day in federal prison for attacks on Scientology sites.
[05:32.380 --> 05:34.180]  I guess they aren't so anonymous, are they?
[05:35.020 --> 05:44.000]  Irish internet forum boards.ie has reported an attack on its user database, which it says came from an unauthorized source from outside Ireland.
[05:44.440 --> 05:50.440]  The site's database contained the usernames, email addresses, and obfuscated passwords of over 200,000 users.
[05:50.820 --> 05:54.720]  The attack prompted the site to force a password change on all of its users.
[05:55.060 --> 05:58.360]  The Irish National Police have been notified and are investigating.
[06:00.180 --> 06:05.720]  Retail establishments in South Korea have become the latest target of online crooks looking for credit card information.
[06:06.360 --> 06:11.240]  Several popular but unnamed restaurant chains in the country have reported recent electronic break-ins.
[06:11.580 --> 06:24.980]  According to the Cybercrime Unit of the National Police Agency and local financial authorities, the intruders used the stolen information to manufacture fake credit cards and charged 190 million won, or about 150 grand, in purchases overseas.
[06:26.120 --> 06:28.920]  PCI standards are really going to have to go global to be effective.
[06:29.840 --> 06:36.120]  And now Courtnee brings us a story about the mysterious Jester, who seems to be single-handedly disrupting terrorist websites.
[06:36.420 --> 06:36.860]  Courtnee?
[06:40.250 --> 06:41.490]  Thanks, Space Rogue.
[06:42.270 --> 06:42.290]  Thanks, Space Rogue.
[06:42.430 --> 06:50.790]  Websites and forums have become standard communication outlets for just about everyone, from governments and business to your grandparents and your kids' grade school.
[06:51.390 --> 07:01.210]  Of course, these communications channels are also used by pedophiles and hate groups, and perhaps you've already guessed, those pesky terrorists.
[07:02.610 --> 07:03.490]  But wait!
[07:04.330 --> 07:07.490]  Recently, a mysterious figure has emerged on the inner tubes.
[07:07.870 --> 07:17.010]  He calls himself the Jester, and in a dashing display of his dedication to utter leateness, he of course spells it with threes and fives.
[07:18.110 --> 07:27.090]  Tall, dark, and Jester claims to be an ex-military operative, of which military he hasn't said, and to have spent time in the Middle East physically fighting the war on terror.
[07:27.790 --> 07:32.250]  Now he's busy taking down the websites used by those same terrorists to communicate.
[07:33.130 --> 07:39.150]  The Jester claims to have created a unique tool that can disable most any website for short periods of time.
[07:39.450 --> 07:45.330]  He describes his denial-of-service attack as being a lot like a DDoS, but without the first D.
[07:45.930 --> 07:53.870]  He tends to announce his takedowns on Twitter, and has so far announced the temporary disabling of several dozen sites used by terrorists.
[07:53.870 --> 07:58.550]  Each site remains unreachable for 30 to 45 minutes at a time.
[07:59.050 --> 08:06.370]  The temporary nature of the attack and the clever use of anonymizing proxies make the Jester and his attacks difficult to pin down.
[08:07.550 --> 08:14.850]  Some people have criticized his actions, claiming that by taking the sites down, he's preventing the good guys from gathering intel.
[08:14.850 --> 08:29.370]  His response is that it's imperative to disrupt terrorist communications just enough to make the avenue unreliable, forcing them from their mighty fortresses to use, hopefully, less secure communication.
[08:30.610 --> 08:36.250]  Cyber-vigilantism, such as the Jester's, has a long history, almost as old as the Internet itself.
[08:36.250 --> 08:47.650]  The debate as to whether such actions are good or bad continues, but in the meantime, the Jester continues to disable websites, and we here at HNN will continue to watch.
[08:48.950 --> 08:50.370]  That's it for me this week.
[08:50.790 --> 08:52.970]  This is Courtnee for the Hacker News Network.
[08:53.490 --> 08:54.950]  Back to you, Space Rogue.
[08:59.690 --> 09:00.490]  Thanks, Courtnee.
[09:00.850 --> 09:03.010]  We'll keep watching this Jester guy and see what he does.
[09:03.710 --> 09:08.330]  Something that hasn't been seen in the wild for a while has surfaced again, an actual destructive worm.
[09:08.790 --> 09:16.950]  This new worm, known as Zymoos, overwrites your MBR or master boot record on your hard drive, effectively preventing you from accessing any of your data.
[09:17.390 --> 09:26.070]  The worm has been spreading via an IQ testing program or as a self-extracting zip file embedded into websites, or via infected USB drives.
[09:26.070 --> 09:35.350]  It is thought that the worm was originally designed to target a motorcycle club in Central Slovakia, but has spread much further, with the United States now being one of the primary sources of the worm.
[09:36.570 --> 09:43.870]  A fake CNN webpage, actually hosted at Angelfire.com, purported to reveal the news of the death of preeminent actor Johnny Depp.
[09:44.210 --> 09:48.190]  The so-called news had Depp crashing his SUV after a drunken binge.
[09:48.490 --> 09:54.730]  The page URL was then sent out via Twitter, where it quickly spread, fooling numerous people, causing it to become a trending topic.
[09:54.730 --> 09:56.430]  The really funny part?
[09:56.690 --> 09:59.130]  The fake page was actually six years old.
[10:00.590 --> 10:03.770]  We'll be right back with the HNN Quickies, right after these messages.
[10:23.740 --> 10:25.140]  STOMING
[10:28.540 --> 10:30.340]  Welcome back to HNNCast.
[10:30.640 --> 10:33.600]  And now for a few quick stories we found on the net this week.
[10:35.240 --> 10:38.800]  TechCrunch, the popular technology blog, was defaced twice in as many days.
[10:39.180 --> 10:45.060]  The perpetrator was evidently not very fond of the site's founder, Michael Arrington, based on the comments left on the defaced pages.
[10:45.460 --> 10:47.860]  It is unknown how the attackers gained access.
[10:49.660 --> 10:55.700]  E107 recently released a new version of its open-source content management system to patch a nasty PHP bug.
[10:55.700 --> 11:00.760]  But not before the bad guys were able to use the same bug to upload their own version of the full install.
[11:01.160 --> 11:05.740]  If you recently downloaded the full version of E107, you might want to download it again.
[11:06.700 --> 11:14.780]  New emails have been circulating purportedly offering updates to a new version of AOL Instant Messenger, but instead install a new version of the Zeus botnet.
[11:15.740 --> 11:22.360]  Recent updates to Kaspersky Antivirus mistakenly flagged Google AdWords and bit.ly URLs as malicious.
[11:23.140 --> 11:25.760]  Kaspersky quickly pushed out an update to correct the problem.
[11:26.100 --> 11:28.520]  I guess that's what it means to be packing the K.
[11:34.320 --> 11:40.360]  Not to be outdone, Symantec decided in its latest update that music sharing software Spotify was a Trojan.
[11:40.680 --> 11:42.900]  They of course quickly pushed out some new updates.
[11:43.440 --> 11:46.760]  Unfortunately, Symantec doesn't have a cool music video like Kaspersky.
[11:46.760 --> 12:00.440]  Eugain Kaspersky Who's the key?
[12:01.220 --> 12:01.740]  Kaspersky!
[12:01.900 --> 12:03.140]  K is the key.
[12:03.660 --> 12:04.180]  Kaspersky!
[12:04.700 --> 12:09.020]  Registration is open for QuahogCon taking place in Providence, Rhode Island toward the end of April.
[12:13.320 --> 12:22.000]  If you're looking to spend some of your company's advertising dollars and want to get access to a very targeted audience, the ShmooCon Podcasters Meetup is looking for sponsors.
[12:22.260 --> 12:23.860]  And so is HNN, actually.
[12:24.420 --> 12:26.780]  Here's your opportunity to influence the influencers.
[12:27.660 --> 12:32.920]  And the ShmooCon ShmooBall Cannon Competition has found some sponsors in the form of WikiD and Woot.
[12:33.520 --> 12:42.040]  WikiD has offered a 1-year, 10-user license, and Woot has sent not 1, not 2, but 13 bags of crap to be used as prizes for ShmooCon.
[12:42.460 --> 12:42.920]  Huh.
[12:43.300 --> 12:45.440]  I'm going to have to build me my own ShmooBall Cannon.
[12:46.020 --> 12:50.120]  Based on some of the entries from previous years, though, the competition will be pretty stiff.
[12:50.540 --> 12:53.060]  Get ready for your ShmooBall fight next weekend.
[12:55.320 --> 13:01.560]  And now for this week's Stack of Shame, the list of all known open vulnerabilities as catalogued by the Zero Day Initiative.
[14:09.670 --> 14:11.490]  That's it for this week's HNNCast.
[14:11.710 --> 14:15.070]  I've been your host, Space Rogue, and you've been watching the Hacker News Network.
[14:19.260 --> 14:24.220]  Remember, if you have any news you think we should report, send it to news at hackernews.com.
[14:27.680 --> 14:29.760]  You have been watching HNNCast.
[14:30.020 --> 14:32.140]  This is Space Rogue for the Hacker News Network.
[14:36.990 --> 14:39.590]  Funny dude, funny dude, funny dude, bad things.