[00:16.370 --> 00:19.930]  You're watching HNNCast with Space Rogue on the Hacker News Network.
[00:27.200 --> 00:30.280]  HNN is sponsored by Astaro.
[00:31.320 --> 00:32.440]  Simplifying security.
[00:34.020 --> 00:35.080]  Become a sponsor.
[00:36.120 --> 00:38.320]  Email sales at hackernews.com.
[00:40.580 --> 00:45.380]  This is Space Rogue for the Hacker News Network, and this is HNNCast for the second week of February 2010.
[00:45.820 --> 00:55.300]  We have lots of news this week, including a breach at Payroll Processors Ceridian, Google partnering with the NSA, Operation Titstorm, and an interview with Mudge.
[00:55.560 --> 00:56.760]  But first, our top story.
[00:57.800 --> 01:14.520]  Blackhawk Safety Net, located at 3800hk.com, a Chinese-based website that provided Trojan horse software and lessons in cyber-attack techniques, had over 12,000 paid subscribers and another 125,000 free members before Chinese authorities took the site down last November.
[01:15.200 --> 01:17.820]  However, news of the bust was only recently released.
[01:17.820 --> 01:26.540]  Police in Hubei Province arrested three people suspected of running Blackhawk Safety Net and seized nine servers, five computers, and a car during the raid.
[01:26.980 --> 01:34.220]  Chinese officials are now pointing to this takedown as proof they are tough on cybercrime, probably in response to Google's accusations that they weren't.
[01:34.220 --> 01:43.840]  In reality, the takedown of Blackhawk Safety Net was most likely in retaliation for massive DDoS attacks against a Chinese gaming site that occurred in May of last year.
[01:44.080 --> 01:48.500]  The malware used in those attacks was found to have been distributed by Blackhawk Safety Net.
[01:48.940 --> 01:54.180]  So it seems to be that the rule in China is do whatever you want, just don't do it inside China.
[01:58.580 --> 02:07.740]  Former member of L0pht Heavy Industries Mudge, a.k.a. Peter Zatko, who once testified in front of Congress that he and his compatriots could take down the Internet in 30 minutes, has taken a position at the Defense Advanced Research Projects Agency.
[02:07.740 --> 02:13.680]  Mudge will take a position as Program Manager in mid-March within the Strategic Technology Office at DARPA.
[02:14.100 --> 02:21.600]  Mudge will be in charge of seeking out and funding small start-ups and boutiques who are most likely to create revolutionary new technology to help the U.S.
[02:21.700 --> 02:22.900]  defend its cyber borders.
[02:23.740 --> 02:29.680]  HNN was lucky enough to meet up with Mudge at ShmooCon last weekend, and we asked him a few questions about his new position.
[02:30.400 --> 02:33.740]  So I'm here with the famous, famous hacker Mudge.
[02:35.080 --> 02:36.440]  Mudge, you're here at ShmooCon.
[02:36.620 --> 02:43.240]  So if you've ever seen those quotes, you know, a senior DOD official, that might just be me, sir.
[02:43.960 --> 02:45.200]  Senior DOD official.
[02:45.340 --> 02:50.460]  Now, your past would not suggest someone who is a government track as a career choice.
[02:51.240 --> 02:59.680]  How do you think that works, going from the person who, quote, led the law to a senior DOD official?
[02:59.940 --> 03:03.860]  Well, I'm not so sure the past really goes against that.
[03:03.940 --> 03:09.200]  If you recall, back in those L0pht days, we were invited down to testify to the Senate.
[03:09.460 --> 03:13.240]  We did have relations with the National Security Council and the White House.
[03:13.300 --> 03:27.120]  And we were one of the first groups to kind of reach out and say, we will work with you because we wanted to help fix and change and positively influence and kind of wake them up because they just thought that hackers were these evil people who needed to be thrown in jail.
[03:27.320 --> 03:30.200]  And that was kind of the media mystique and misinterpretation.
[03:30.360 --> 03:32.280]  So you don't see it as a sellout then?
[03:33.300 --> 03:34.020]  No, no.
[03:34.040 --> 03:35.540]  Since it's government, there's no money involved.
[03:35.780 --> 03:36.520]  Yeah, pretty much.
[03:36.780 --> 03:39.160]  Yeah, it's definitely a pay cup.
[03:40.660 --> 03:48.440]  So I decided to take the opportunity and I've accepted a position at DARPA as a program manager in the Strategic Technologies Office.
[03:48.700 --> 03:50.100]  Now, are they still going to call you Mudge?
[03:50.620 --> 03:52.980]  Well, I'm lobbying for Mudge at DARPA.mil.
[03:53.680 --> 03:55.460]  Do you really have Mudge on the business card?
[03:56.180 --> 04:02.920]  No, I have it on my current business card because I'm still over at BBN as the Technical Director of National Intelligence Research and Applications.
[04:03.600 --> 04:05.140]  DARPA was always kind of like this.
[04:05.240 --> 04:06.540]  It was kind of like what the L0phtt was.
[04:06.540 --> 04:10.520]  I mean, it's this, we want to do research in areas that are going to pay off down the road.
[04:10.700 --> 04:12.040]  We want to do far-fetched research.
[04:12.400 --> 04:14.500]  We want to really make a difference and impact things.
[04:14.600 --> 04:18.900]  And we're willing to go down technologically risky areas that might not pay off.
[04:18.980 --> 04:22.340]  But if they do, it can be game-changing down the road.
[04:22.500 --> 04:23.420]  So that's my question.
[04:23.520 --> 04:26.320]  So you guys actually see this as sort of an extension of the original L0pht mission?
[04:26.480 --> 04:26.600]  Yeah.
[04:26.900 --> 04:31.680]  Of sort of researching cool underground things and bringing them to light and letting everybody see them.
[04:31.820 --> 04:37.640]  Yeah, giving everybody a chance to really capitalize and really exploit and take advantage of breakthroughs.
[04:37.640 --> 04:39.860]  Some of the reverse engineering stuff that's going on.
[04:40.000 --> 04:41.760]  Some of the defensive tactics.
[04:42.000 --> 04:44.360]  I mean, you look in this community, we've got a lot of really bright folks.
[04:44.520 --> 04:46.000]  Many of which working in small businesses.
[04:46.460 --> 04:48.940]  So it's basically, it's the same as L0pht but with money.
[04:49.340 --> 04:49.420]  Yeah.
[04:49.760 --> 04:50.180]  That's cool.
[04:50.900 --> 04:51.580]  Alright, well, great.
[04:51.580 --> 04:57.160]  This has been Space Rogue and Mudge at ShmooCon as Mudge goes on to working at the government.
[04:57.360 --> 04:57.900]  Happy hacking.
[04:58.880 --> 05:06.900]  Watch for the rest of our interview with Mudge in an upcoming episode of Behind the Firewall when we talk not only with Mudge but several other ShmooCon attendees as well.
[05:07.800 --> 05:18.120]  After being apprehended in Mexico last year and once appearing on America's Most Wanted, Edwin Andrew Pena has pleaded guilty to wire fraud and unauthorized access to a protected computer.
[05:18.120 --> 05:25.800]  The charges claim that Pena defrauded long distance telephone companies out of $1.4 million in an elaborate voice over IP scam.
[05:26.220 --> 05:38.540]  Pena was arrested in 2006 with his partner in crime, Robert Moore after the pair would sell wholesale voice over IP services at extremely discounted rates and then would route the traffic over compromised telephone company networks.
[05:38.860 --> 05:44.140]  The pair would gain access to the networks usually by misconfigured Cisco routers with default passwords.
[05:44.700 --> 05:48.200]  Moore once claimed that it was so easy, a caveman could do it.
[05:49.440 --> 05:53.880]  Moore was sentenced to 18 months back in 2006 and has already served his time.
[05:54.180 --> 05:57.500]  He claims that Pena paid him only $20,000 to do the break-ins.
[05:58.180 --> 06:07.560]  Pena, on the other hand, used much of his ill-gotten gains on Miami real estate, a Sea Raymer cruiser boat, and collecting BMWs like this pimp-delt yellow M3.
[06:09.040 --> 06:09.520]  Sweet!
[06:10.540 --> 06:15.540]  Pena faces a maximum of 25 years in federal prison and fines of at least $500,000.
[06:16.100 --> 06:17.700]  His sentencing is scheduled for May.
[06:18.120 --> 06:22.480]  The telephone companies that were so easy to breach were, unfortunately, not named in the complaint.
[06:23.840 --> 06:33.280]  Payroll processing firm Ceridian Corp has admitted in letters to customers that its payroll processing product PowerPay was breached by unknown attackers back at the end of December.
[06:33.280 --> 06:38.320]  The breach affects 27,000 employees working at 1,900 companies nationwide.
[06:38.860 --> 06:42.180]  This is the second security breach at Ceridian in the last three years.
[06:42.420 --> 06:46.640]  In 2007, an ex-employee walked out with valuable financial information.
[06:47.260 --> 06:56.780]  Ceridian has called in the FBI to investigate this attack and has only just now, a month after the attack, mailed out rather long-winded and confusing letters to notify the affected people.
[06:57.320 --> 07:02.020]  The law says they have to notify people, but it doesn't say anything about making the letters easy to understand.
[07:03.140 --> 07:07.160]  ShmooCon was last weekend during the snowpocalypse that was Washington, D.C.
[07:07.460 --> 07:10.200]  But despite the snow, there were some very interesting talks.
[07:10.540 --> 07:14.800]  Tyler Shields from Veracode talked about just how insecure the BlackBerrys really are.
[07:15.320 --> 07:18.180]  Trevor Hawthorne talked about tracking iPhones through GPS.
[07:18.540 --> 07:22.300]  And Cadet Weigand showed us how to build your own UAV on the cheap.
[07:22.960 --> 07:27.880]  HNN was there and grabbed a lot of footage, including an interview with Cadet Weigand and his home-built UAV.
[07:27.880 --> 07:33.140]  Watch for it in an upcoming episode of Behind the Firewall, right here on the Hacker News Network.
[07:34.520 --> 07:37.800]  We'll be back with more HNNCast right after these messages.
[07:38.380 --> 07:41.360]  Hi, I'm SecBarbie and you're watching the Hacker News Network.
[07:45.920 --> 07:46.520]  Fire!
[07:46.900 --> 07:47.120]  Fire!
[07:48.780 --> 07:48.940]  Fire!
[07:49.480 --> 07:49.860]  Fire!
[07:50.480 --> 07:50.580]  Fire!
[07:51.560 --> 07:51.640]  Fire!
[07:52.000 --> 07:52.600]  Fire!
[07:54.380 --> 07:54.980]  Fire!
[07:56.420 --> 07:57.020]  Fire!
[08:06.700 --> 08:14.880]  Google has decided to call out the big guns and has created a partnership with the NSA to help investigate the recent attacks that it feels originated in China.
[08:15.400 --> 08:25.060]  According to an anonymous source who spoke to the Washington Post, the partnership will not allow the NSA access to user emails, search history, or other data and will be very limited in scope.
[08:25.720 --> 08:29.700]  Supposedly, the NSA will help Google analyze the major corporate espionage attack.
[08:30.160 --> 08:36.600]  The Electronic Privacy Information Center has filed a Freedom of Information Act request seeking more information about the partnership.
[08:37.320 --> 08:44.880]  In a related story, security researchers say that attacks that hit Google are still ongoing and are continuing to hit additional companies.
[08:45.680 --> 08:50.720]  Analysis of the code used in the attacks is being used to actively track the author of the malware involved.
[08:52.360 --> 08:57.780]  Staccato, aka Philip Peterson, will be tried in Sweden and not extradited to the U.S.
[08:58.220 --> 09:03.580]  He was indicted last May and accused of electronically breaking into Cisco and stealing source code related to iOS.
[09:04.280 --> 09:09.620]  He has also been accused of breaking into at least two NASA systems back in 2004 when he was only 16.
[09:10.400 --> 09:18.360]  This, of course, is in stark contrast to Gary McKinnon, who also broke into NASA systems, but who the U.S. is vigorously pursuing for extradition.
[09:18.360 --> 09:25.780]  It would be interesting to know why the one with what appears to be worse crimes gets to stay home, while the other gets forcibly extradited.
[09:26.640 --> 09:34.620]  A targeted phishing attack against employees of numerous companies in Europe, New Zealand, and Japan appeared to come from the German Emissions Trading Authority.
[09:35.160 --> 09:41.520]  Employees were told that their companies needed to re-register their accounts with the authority, where carbon credits and transactions are recorded.
[09:41.520 --> 09:46.680]  Of course, the linked two sites were frauds and allowed the attackers to steal the workers' credentials.
[09:47.160 --> 09:51.940]  The attackers then logged in and stole the carbon credits certificates which they then re-sold.
[09:52.660 --> 10:00.500]  It is estimated the attackers stole at least 250,000 carbon credits permits from six different companies worth more than $4 million.
[10:01.180 --> 10:05.900]  The German Emissions Trading Authority has closed the database while an investigation is underway.
[10:07.160 --> 10:12.180]  The group Anonymous, which has targeted the Church of Scientology in the past, has found a new target.
[10:12.940 --> 10:23.420]  Upset over Australia's proposal for a government-mandated Internet filter, the group has launched a massive distributed denial-of-service attacks against several Australian government websites, rendering many of them inaccessible.
[10:23.420 --> 10:31.140]  The group has labeled the action, Operation Tit Storm, and has also included harassing telephone calls and a few webpage defacements into the mix.
[10:31.560 --> 10:34.980]  The group promises to continue the attacks for months if necessary.
[10:35.600 --> 10:39.060]  Some of the local media is describing this as supporting pornography.
[10:39.060 --> 10:54.800]  Which, given the name, Operation Tit Storm, we can sort of see why, but we would think that media outlets in particular would realize that an Internet filter is more about freedom of the people and of information, and who decides what is or is not unwanted content.
[10:55.220 --> 10:56.600]  It's not about pornography.
[10:57.760 --> 11:05.000]  Brian Krebs at KrebsOnSecurity.com continues to document the growing trend of online bank fraud conducted via Trojan horse software.
[11:05.000 --> 11:12.780]  The most recent victim was the United Way chapter of Massachusetts, who almost lost $150,000 sucked right out of their bank account.
[11:13.260 --> 11:18.400]  Luckily, the wire transfers were noticed in time and were all blocked or reversed before the crooks could collect any money.
[11:19.780 --> 11:20.980]  Unfortunately, Experimental Inc.
[11:21.440 --> 11:22.860]  in Michigan wasn't so lucky.
[11:23.600 --> 11:33.520]  They've sued its bank, Comerica, accusing it of not providing adequate security after Experimental fell victim to a phishing attack that cost it more than a half million bucks.
[11:34.160 --> 11:40.880]  This despite the fact that Comerica was using two-factor authentication, which is really kind of useless in these types of attacks anyway.
[11:41.680 --> 11:48.500]  In addition, the town of Poughkeepsie, New York had almost $400,000 transferred out of its bank account at TD Bank to sites in the Ukraine.
[11:48.900 --> 11:51.620]  They were able to recover about one-fourth of the lost money.
[11:52.040 --> 11:53.980]  The Secret Service is investigating.
[11:54.680 --> 11:58.720]  But siphoning money out of bank accounts is not the only thing the Zeus botnet has been up to.
[11:58.720 --> 12:05.760]  Lately, it has started to spam .mail and .gov addresses, attempting to trick people into installing it via a spoofed email from the NSA.
[12:07.380 --> 12:15.820]  Zeus also has some direct competition out there in the wild from SpyEye, a malware kit offered on Russian websites for the paltry sum of $500.
[12:16.980 --> 12:26.640]  SpyEye toolkit comes with the usual items such as a keylogger, credit card info stealer, FTP and POP3 email accounts, and of course a graphical control panel for managing your large botnet.
[12:27.240 --> 12:34.260]  However, SpyEye also claims to be a Zeus killer and is supposedly designed to remove Zeus from already infected machines.
[12:35.720 --> 12:40.420]  Before we break for the quickies, just a reminder to keep an eye out for upcoming episodes of Behind the Firewall.
[12:40.720 --> 12:45.980]  When we talk about the shmoo bus, shmoo con, and we finish talking with Mudge about his new positions at DARPA.
[12:45.980 --> 12:47.560]  But first, these messages.
[13:12.010 --> 13:13.750]  Welcome back to HNNCast.
[13:13.890 --> 13:16.530]  And now for a few quick stories we found on the net this week.
[13:17.170 --> 13:23.630]  Last week, Mozilla issued a warning that two add-ons available from addons.mozilla.org were infected by malicious code.
[13:24.130 --> 13:26.490]  It turns out, however, that only one of them was malicious.
[13:27.090 --> 13:32.230]  So think web video downloader version 4.0 was actually fine and turned out to be a false alarm.
[13:32.870 --> 13:40.670]  Master Filer, however, was infected with the LD Pinch password-stealing Trojan and was downloaded by about 700 people before it was noticed and removed.
[13:42.150 --> 13:48.190]  Jayshankar Maramuthu from India has pleaded guilty to charges stemming from his role in an international pump-and-dump scam.
[13:49.110 --> 13:54.810]  Maramuthu and his associates would break into U.S.-based brokerage houses to buy thinly-traded securities for cheap money.
[13:55.190 --> 13:58.070]  They would then pump them via spam before selling at a profit.
[13:58.710 --> 14:01.850]  Maramuthu was arrested in Hong Kong and extradited to the U.S.
[14:02.230 --> 14:05.850]  He faces up to seven years in prison and a fine of half a million bucks.
[14:06.910 --> 14:19.930]  The digital-enhanced cordless telecommunication standard, which encrypts radio signals between cordless phones and base stations, has been cracked using nitric acid to partially dissolve the chip and an electron microscope to discover that the encryption algorithm isn't random enough.
[14:20.130 --> 14:25.670]  An attacker would only need about four hours of transmissions to be able to determine the key to unscramble the signals.
[14:26.530 --> 14:38.530]  Big Level, aka Christopher Kennedy, author of cookie-stuffing program Sauce Kit, has been charged with fraud after it was found his program planted fake cookies into people's browsers in order to fool the eBay affiliate program.
[14:38.890 --> 14:42.630]  He faces five years in jail and a $250,000 fine.
[14:43.530 --> 14:51.710]  Michael Lee has been sentenced to two and a half years in jail and fined $800,000 for importing and selling counterfeit Cisco routers.
[14:53.010 --> 15:05.210]  Tata Consultancy Services Limited, India's largest software company, has regained control of its domain name, tcs.com, after its DNS was hijacked to point at a site that was offering the domain for sale.
[15:05.630 --> 15:08.070]  Tata was hosting its DNS at Network Solutions.
[15:08.590 --> 15:10.370]  Wow, NetSol was breached.
[15:10.590 --> 15:11.330]  Who'd have thunk it?
[15:12.230 --> 15:17.830]  IDHack has claimed responsibility for discovering an SQL hole in the orange website for the Ivory Coast.
[15:17.830 --> 15:20.590]  However, it looks like Evil Boy was there first.
[15:20.790 --> 15:23.550]  It is not known if any customer information was at risk.
[15:24.390 --> 15:26.450]  Last week, it was the Manchester Police Department.
[15:26.650 --> 15:33.630]  And this week, it is NHS Leeds, a hospital in the UK, to be the latest victim of the now 15-month-old worm, Conficker.
[15:34.010 --> 15:36.690]  The worm infected several servers, but was quickly contained.
[15:37.290 --> 15:42.210]  Oh, not sure if you noticed, but February 9th was the official worldwide Safer Internet Day.
[15:42.770 --> 15:44.050]  Yeah, we didn't notice either.
[15:44.770 --> 15:50.650]  Bill Cosby is the latest celebrity to have to claim that they weren't dead, after rumors of their demise appeared on Twitter.
[15:51.250 --> 15:59.730]  It would appear that this is a ploy by malware spreaders to get people to search for information about Bill Cosby, and then click on websites with infected links.
[16:00.410 --> 16:03.290]  Cosby posted on his website that he was, in fact, not dead.
[16:07.290 --> 16:12.270]  QuahogCon has issued a pre-release photo of its hackable badge to be used during its badge hacking contest.
[16:13.070 --> 16:16.650]  There are a limited number of these badges, so if you want one, register early.
[16:18.050 --> 16:30.070]  CarolinaCon 6 has announced that it had so many great talks submitted this year, that instead of denying some people, they have added an extra day to the con, which is now scheduled to run from the 19th to the 21st of March in Raleigh, North Carolina.
[16:31.410 --> 16:37.870]  Oh, if you happen to be in Brussels, the organizers of BrewCon have put out the call for volunteers to help with the con happening in September.
[16:38.850 --> 16:45.290]  And now for this week's Stack of Shame, the list of all known open vulnerabilities as cataloged by the Zero Day Initiative.
[17:38.750 --> 17:40.610]  That's it for this week's HNNCast.
[17:40.790 --> 17:44.030]  I've been your host, Space Rogue, and you've been watching the Hacker News Network.
[17:47.960 --> 17:52.780]  Remember, if you have any news you think we should report, send it to news at Hackernews.com.
[17:56.400 --> 17:58.380]  You have been watching HNNCast.
[17:58.580 --> 18:00.760]  This is Space Rogue for the Hacker News Network.
[18:05.620 --> 18:08.160]  Fun to do, fun to do, fun to do bad things.