[00:09.070 --> 00:13.180]  The Hacker News Network presents...
[00:14.630 --> 00:15.760]  HNNCast.
[00:16.080 --> 00:19.080]  With your host... Space Rogue.
[00:24.090 --> 00:26.250]  HNNCast is sponsored by...
[00:27.450 --> 00:28.570]  Astaro.
[00:29.150 --> 00:30.510]  Simplifying security.
[00:34.800 --> 00:37.900]  And by... Trustwave Spider Labs.
[00:38.320 --> 00:42.020]  Providing advanced information security services to planet Earth.
[00:43.260 --> 00:44.460]  Become a sponsor.
[00:44.860 --> 00:47.280]  Email sales@hackernews.com.
[00:49.020 --> 00:51.340]  This is Space Rogue for the Hacker News Network.
[00:51.480 --> 00:54.100]  This is HNNCast for the second week of February 2011.
[00:54.880 --> 00:57.060]  Our top story this week...
[00:57.060 --> 01:03.060]  There was a lot of FUD this week surrounding reports of an electronic break-in at the NASDAQ Stock Exchange.
[01:03.420 --> 01:12.660]  While the computers that run the trading platforms themselves were not compromised, a web application known as Director's Desk did have some suspicious files inserted into it.
[01:12.860 --> 01:12.960]  Yow!
[01:13.340 --> 01:21.740]  Director's Desk is an online corporate governance portal that allows corporations to host sensitive financial files for sharing with authorized third parties.
[01:22.180 --> 01:25.700]  Basically, it allows for online board meetings of Fortune 500 companies.
[01:25.700 --> 01:30.660]  The Department of Justice had initially asked that news of the story be delayed until next week.
[01:30.980 --> 01:34.600]  But when the story leaked anyway, NASDAQ was forced to issue a statement.
[01:34.860 --> 01:39.420]  There have been several reports that have used the term malware to describe this breach.
[01:39.920 --> 01:47.200]  We aren't sure if this is being used as a more generic term, or if they were infected with a standard run-of-the-mill malware that everyone else gets.
[01:47.200 --> 01:57.520]  If Director's Desk runs on PHP, which I suspect that it does, I wouldn't be surprised if this was the same type of infection that has been hitting WordPress websites across the internet.
[01:57.800 --> 02:11.360]  However, numerous high-profile bloggers, who have little to no actual connection to NASDAQ, are busily peddling the FUD claiming that this was an APT-style directed attack with nation-state sponsorship aimed at destroying the US economy.
[02:11.680 --> 02:15.420]  Oh, and Digital Pearl Harbor, Cyberdyne 11, and the sky is falling.
[02:15.420 --> 02:23.140]  Of course, the folks at Director's Desk want you to believe this scenario, and not believe that the awesome security of their product was breached by run-of-the-mill malware.
[02:23.680 --> 02:26.840]  Which is what I'm believing, until proven otherwise.
[02:27.940 --> 02:33.460]  Sometimes you gotta think there's some big Hollywood mogul that pays to have things happen just so they can make a movie about it.
[02:33.700 --> 02:36.340]  I mean, seriously, someone has to be writing this stuff.
[02:36.540 --> 02:40.240]  So Anonymous has been running around DDoSing websites, right?
[02:40.540 --> 02:42.660]  Basically making a general nuisance of themselves.
[02:43.040 --> 02:43.880]  Nothing new there.
[02:43.880 --> 02:46.940]  A few members have been arrested recently, but that's not new either.
[02:47.220 --> 02:55.020]  But now, a security consulting firm that deals mostly with the government claims to have identified several top leaders within the leaderless group Anonymous.
[02:56.960 --> 03:04.000]  HBGary Federal claims to have unveiled the identities of Owen, Q, Commander X, and several other high-ranking figures within the Anonymous organization.
[03:04.000 --> 03:04.820]  
[03:04.900 --> 03:11.540]  HBGary had planned to reveal most of the information and the tactics used to collect it at the B-Side Security Conference in San Francisco next month.
[03:11.860 --> 03:13.800]  All pretty normal stuff so far.
[03:13.940 --> 03:15.060]  But not so fast.
[03:15.240 --> 03:16.520]  Now, for the Hollywood part.
[03:16.720 --> 03:22.300]  After having learned of the possible infiltration into their ranks, Anonymous struck back.
[03:22.300 --> 03:29.000]  While most people were busy drinking beer and watching a small sporting event on TV, members of Anonymous attacked the HBGary site directly.
[03:30.180 --> 03:38.500]  They got in and maintained control for about 30 hours before they started to deface webpages, delete backups, and grab the mail spool to later post to BitTorrent.
[03:38.500 --> 03:43.620]  Once they had the mail spool, the Twitter and LinkedIn accounts of the company's officers were easily pickings.
[03:43.860 --> 03:49.660]  Then, using a little social engineering, they were able to gain access to Rootkit.com, a site run by HBGary, and RM that as well.
[03:57.540 --> 04:00.880]  However, Anonymous says that the so-called research was all wrong.
[04:00.880 --> 04:02.080]  That the names HBGary collected did not, in fact, identify anyone in Anonymous.
[04:05.320 --> 04:09.260]  And to prove it, they dug up the research from the mail spool and posted it themselves.
[04:09.520 --> 04:10.700]  But it gets even better.
[04:11.000 --> 04:13.820]  The mail spool also contained lots of juicy details.
[04:15.320 --> 04:21.620]  Things like how HBGary was planning to start a war of wards between the group and his company in an effort to generate publicity and therefore new clients.
[04:21.980 --> 04:24.100]  The mail spool also revealed how HBGary was planning on selling its research to the FBI.
[04:26.620 --> 04:30.540]  And how they had pitched their services to Bank of America to take down WikiLeaks.
[04:31.240 --> 04:33.480]  Like I said, someone has to be writing this stuff.
[04:33.960 --> 04:35.360]  I suspect someone at HBGary will be selling the movie rights to this story.
[04:37.620 --> 04:41.900]  They haven't had much to say about the whole thing either, other than cancel their talk at B-Sides.
[04:42.120 --> 04:43.760]  The lessons to be learned from all of this?
[04:43.920 --> 04:44.680]  There are many.
[04:45.060 --> 04:49.580]  One being that before you go around poking angry mobs, make sure your own house is in order.
[04:50.100 --> 04:53.480]  Of course, despite all of this, Anonymous is still out there causing mayhem.
[04:53.640 --> 05:00.180]  Most recently, starting Operation Italy, which was launched when WikiLeaks unveiled a cable describing a new Italian media law.
[05:01.000 --> 05:07.200]  Operation Italy targeted a DDoS attack against governo.it, the main website for the Italian government.
[05:07.420 --> 05:13.060]  And then there is the evidence seized by the FBI a couple of weeks ago after all those DDoS attacks in support of WikiLeaks.
[05:13.240 --> 05:18.320]  The evidence should have appeared in front of a grand jury in San Jose last week, just as we recorded this episode.
[05:18.320 --> 05:21.600]  We'll let you know the outcome, if any, next week.
[05:21.920 --> 05:24.480]  You remember the RBS WorldPay debacle, right?
[05:24.900 --> 05:25.360]  No?
[05:25.700 --> 05:26.820]  Let me refresh your memory.
[05:27.160 --> 05:30.640]  Back in 2008, RBS WorldPay was pwned pretty badly.
[05:31.220 --> 05:41.620]  The bad guys were able to get into the payroll card processing system and withdrew over $9 million from over 2,000 ATMs in almost 300 cities worldwide in less than 12 hours.
[05:42.160 --> 05:43.340]  Yeah, they got caught.
[05:43.640 --> 05:47.980]  At least eight people were indicted for the crime from Russia, Georgia, Estonia, and Moldova.
[05:48.200 --> 05:52.040]  The original indictment also listed an unnamed Hacker 3.
[05:52.780 --> 05:55.680]  Hacker 3 was eventually identified as Eugene Anakin.
[05:56.100 --> 06:00.740]  And last week, he received his sentence, five years suspended and three years probation.
[06:01.520 --> 06:02.180]  That's right.
[06:02.520 --> 06:04.580]  Steal $9 million bucks and get no jail time.
[06:05.200 --> 06:10.060]  And you wonder why the United States prefers to extradite its criminals as opposed to letting them stand local trial?
[06:10.700 --> 06:12.220]  You hear that, Gary McKinnon?
[06:12.460 --> 06:15.680]  And our last story before the break is a short one, but it's important.
[06:16.100 --> 06:21.000]  Google is now offering two-factor authentication with all of its accounts, for free.
[06:21.600 --> 06:29.800]  It takes a few minutes to set up, but allows you to use your cell phone as your token generator, either via a phone call, an SMS text message, or an app.
[06:29.800 --> 06:32.500]  We recommend everyone do this now.
[06:32.880 --> 06:34.960]  Well, at least wait until HNNCast is over.
[06:35.680 --> 06:40.140]  Two-factor isn't the promised land by any means, but two is way better than one.
[06:41.200 --> 06:43.940]  We'll be back with more HNNCast right after these messages.
[06:47.410 --> 06:48.930]  You're watching Hacker News.
[06:49.550 --> 06:51.270]  Hacker media that hasn't been owned.
[07:16.220 --> 07:19.420]  HNNCast Welcome back to HNNCast.
[07:19.640 --> 07:30.340]  McAfee recently released a very scary report about how Chinese spies had infiltrated at least five multinational oil and gas companies to steal bidding plans and other critical proprietary information.
[07:30.340 --> 07:36.780]  The report failed to name the five companies and said that at least seven other unidentified companies had also been victimized.
[07:37.280 --> 07:42.460]  McAfee blamed targeted phishing attacks and lacks website security as vectors for the intrusions.
[07:42.960 --> 07:49.640]  McAfee was quick to mention that they did not believe the attacks were state-sponsored, but that they had been ongoing for between two and four years.
[07:49.640 --> 07:52.740]  Then they give the whole thing a cool, marketable name.
[07:53.140 --> 07:55.580]  McAfee calls it Operation Night Dragon.
[07:55.980 --> 07:56.940]  Ooh, scary.
[07:57.280 --> 07:58.940]  Okay, I need to say something here.
[07:59.060 --> 08:03.300]  If companies are going to release these tell-all reports, then they need to tell a little bit more.
[08:03.560 --> 08:05.060]  They need to name names.
[08:05.220 --> 08:06.580]  They need to attributable quotes.
[08:06.720 --> 08:09.960]  They need to get specific with attack vectors and types of software used.
[08:10.280 --> 08:15.380]  Otherwise, it just sounds like you're fear-mongering, attempting to scare other companies and governments into giving you money.
[08:15.380 --> 08:20.080]  Now, I have no doubt that energy companies have malware running around inside their networks.
[08:20.220 --> 08:23.380]  But just about every other company in the world has the same problem.
[08:23.700 --> 08:31.940]  But to suggest that simple spam-sending, data-stealing, botnet member malware is out to steal and sell your corporate secrets is just creating panic.
[08:32.200 --> 08:34.280]  Panic that's going to do no one any good.
[08:34.440 --> 08:38.440]  It doesn't make anyone more secure and causes politicians to overreact.
[08:38.620 --> 08:39.380]  Cut it out.
[08:39.760 --> 08:51.880]  Numerous posts on Russian underground web forums last year suggested that Slavic, or Monster, the author of the popular banking fraud trojan Zeus, was going to retire and give the Zeus source code to the creator of the SpyEye Trojan.
[08:52.140 --> 08:55.560]  Now it appears that the first version of this merger has been spotted in the wild.
[08:55.980 --> 09:07.480]  SpyEye version 1.3.05 beta has several features previously unique to Zeus, including the Zeus admin panel and code used to evade Tristere Rapport bank transaction security software.
[09:07.620 --> 09:11.300]  Tristere says it is confident that its software will be able to defend against the malware.
[09:11.620 --> 09:12.500]  Of course they do.
[09:12.600 --> 09:13.840]  I mean, what else are they going to say?
[09:13.840 --> 09:17.680]  And in a related story, someone is selling the source code for the Zeus Trojan.
[09:18.280 --> 09:25.140]  Discovered in an underground forum, a user known as NEM has offered up the full source code for version 2.0.8.9.
[09:25.340 --> 09:30.540]  No idea if it's legit or not, or where NEM got it from, and well, we aren't going to pay up to find out either.
[09:30.540 --> 09:37.560]  The OAuth security summit happened this week, and by all accounts some real progress was made in the name of application security.
[09:38.480 --> 09:41.920]  Unfortunately, the organization's wiki site suffered some serious damage.
[09:42.320 --> 09:47.560]  A legitimate user by the name of Frank Alexander went in and erased large portions of the site.
[09:47.920 --> 09:49.200]  So much for openness.
[09:49.800 --> 09:51.700]  This is why we can't have nice things.
[09:51.700 --> 09:54.640]  Bug bounties seem to be full of controversy recently.
[09:55.020 --> 09:59.680]  Some companies have very generous programs, but others refuse to pay a dime for independent research.
[09:59.960 --> 10:09.900]  In one case, a researcher in Japan has submitted 22 bugs to Google from various web apps, two of them critical, and has earned over $13,000 for their efforts.
[10:10.540 --> 10:15.360]  Not really sure why some companies, like Microsoft, are so opposed to bug bounties.
[10:15.720 --> 10:21.720]  It seems a hell of a lot cheaper than hiring an employee to find bugs full-time, and you get more and better bugs found.
[10:22.020 --> 10:23.640]  So, what's the problem, Microsoft?
[10:24.480 --> 10:27.300]  Barracuda opened its own bug bounty program a few weeks ago.
[10:27.580 --> 10:29.420]  It hasn't been without problems, though.
[10:29.760 --> 10:35.800]  They have found that researchers tend to not follow directions, and have submitted bugs that were outside the bounds of the program.
[10:36.080 --> 10:38.960]  They also underestimated the number of bugs that would be found.
[10:38.960 --> 10:43.320]  Despite the problems, Barracuda plans to make changes and push forward with its program.
[10:43.900 --> 10:44.720]  Good for them.
[10:44.960 --> 10:46.900]  We'd like to see more companies follow suit.
[10:47.860 --> 10:51.700]  We'll be right back with the Tool Time and the HNN Quickies, right after these messages.
[11:00.020 --> 11:03.680]  Can we get an image or a license agreement attorney at register 3?
[11:07.200 --> 11:12.640]  I need you to sign here and here to read the book according to the terms of this agreement.
[11:12.880 --> 11:14.220]  But I just want to buy the book.
[11:14.440 --> 11:16.100]  Why do I need to sign anything?
[11:22.710 --> 11:25.150]  Does everybody know what time it is?
[11:25.550 --> 11:26.710]  Tool Time!
[11:27.430 --> 11:30.250]  That's right, Binford Tools is proud to present...
[11:30.250 --> 11:31.550]  Space Rogue.
[11:34.230 --> 11:36.050]  That's right, it's Tool Time again.
[11:36.330 --> 11:38.670]  Another quick hardware tool to tell you about this week.
[11:38.670 --> 11:44.950]  You may remember last year when Key Carry Key was released at CanSecWest and was used to sniff the traffic of wireless keyboards.
[11:45.390 --> 11:52.790]  Well, the research has been expanded on by Tavis Goodspeed, who has hacked an old Next HOPE badge to do the similar duty as a wireless keyboard simpher.
[11:53.370 --> 11:56.150]  If you are interested, we have the links at HackerNews.com.
[11:56.150 --> 11:57.650]  That's it for hardware.
[11:58.050 --> 11:59.490]  Now for the softwares.
[11:59.730 --> 12:10.930]  We have updates of GreenPoison, ClamAV, OpenDLP, 8SQL, Secubus, Snort, the Metasploit framework, Beef, and MaviTuna's NetSparker.
[12:11.210 --> 12:13.390]  If you run those, get your updates.
[12:13.750 --> 12:19.850]  As a side note, there is a fix out for Armitage, which broke with the 3.5.2 update to Metasploit.
[12:19.850 --> 12:27.750]  And it's sort of an update, but Veracode has expanded its free online code examination to not only include JavaScript, but also iOS and Android.
[12:28.030 --> 12:29.510]  At least for a limited time.
[12:29.810 --> 12:32.110]  So hey, no excuses for crappy code.
[12:32.710 --> 12:40.930]  Also, nmap 5.5 is now out for Android.
[12:41.610 --> 12:48.750]  According to a tweet by DDZ, you can install it or any app remotely onto the Android of anyone whose Gmail password you have.
[12:48.750 --> 12:54.050]  Not exactly nmap specific, but since we're talking about the Android, we figured we'd throw that in there.
[12:54.450 --> 12:56.710]  And now, into the fresh, with some new tools.
[12:57.530 --> 13:01.530]  NetworkMiner is a network forensic analysis tool, NFAT, for Windows.
[13:02.330 --> 13:10.070]  NetworkMiner can be used as a passive network sniffer packet capturing tool in order to detect operating systems, sessions, host names, open ports, etc.
[13:10.450 --> 13:12.550]  without putting any traffic on the network.
[13:13.390 --> 13:20.870]  NetworkMiner can also parse PCAP files for offline analysis and to regenerate, reassemble transmitted files and certificates from PCAP files.
[13:21.250 --> 13:29.210]  If, for some reason, you don't trust Foundstone or have problems getting their SLD digger to run on your system, there is now a noteworthy alternative.
[13:29.770 --> 13:32.490]  SSL Diagnose is up at the vulnerability database.
[13:32.490 --> 13:40.910]  It analyzes and rates ciphers and works against POP3S, CIP, SMTP, and FTPS, as well as HTTPS.
[13:41.170 --> 13:48.050]  SSL Digger and SSL Diagnose would probably both be obsolete if Nessus would just report on SSL ciphers in a friendlier way.
[13:48.450 --> 13:52.850]  Until then, use either to inventory and risk rank your SSL server's cipher suites.
[13:53.790 --> 13:56.090]  CoreLogic has released a nice collection of word lists.
[13:56.470 --> 13:58.270]  That's always a nice research to know about.
[13:58.750 --> 14:02.210]  Check them out at thecontest.corelogic.com That's with a K.
[14:02.750 --> 14:08.030]  And finally, out on the horizon, EI is promising to release a zero-day scanner this March.
[14:08.230 --> 14:12.730]  I guess they realize that they've lost some notable security talent that earned them their original reputation.
[14:12.730 --> 14:15.430]  Perhaps this is their effort to prove themselves again.
[14:15.770 --> 14:23.890]  Not only will this tool be of potential use to security testers, it may just be an indicator of just how cutting-edge EI is or is not these days.
[14:24.270 --> 14:26.150]  We'll keep an eye on you, EI.
[14:27.010 --> 14:28.550]  That's it for this week's Tool Time.
[14:28.770 --> 14:31.590]  Join us next week for our salute to Tool Time.
[14:32.670 --> 14:35.590]  And now for a few quick stories we found on the net this week.
[14:35.910 --> 14:40.690]  No celebrities to tell you about this week, but there have been some issues with lawmakers in the state of Missouri.
[14:40.690 --> 14:44.510]  Five staffers within the capital have had their Facebook accounts breached.
[14:44.890 --> 14:45.530]  The connection?
[14:46.050 --> 14:50.210]  All five have used the open Wi-Fi in the capital provided for visitors.
[14:50.470 --> 14:53.330]  Looks like someone in Missouri has been having a little fun with fire sheep.
[14:53.730 --> 14:56.450]  Wait, wasn't Facebook going to turn on SSL for everyone?
[14:56.810 --> 14:59.950]  The protests in Egypt have not just been happening in Tahir Square.
[15:00.350 --> 15:02.250]  They have been happening online as well.
[15:02.670 --> 15:12.070]  A banner ad on the website for the broadcaster Al Jazeera was replaced with a slogan saying, together for the collapse of Egypt, which linked to a page criticizing the broadcaster.
[15:12.290 --> 15:18.750]  And of course, after the tyrants in Egypt turned off their internet, the lawmakers in the United States want the ability to do the same thing.
[15:19.490 --> 15:25.570]  Evidently, they have been going around saying that if they can't turn off the net, then bad guys will be able to open the floodgates at Hoover Dam.
[15:26.310 --> 15:28.090]  Uh, no, no they can't.
[15:28.550 --> 15:33.610]  Thankfully, the Bureau of Reclamation, which runs the dam, is trying to get the word out that that can't actually happen.
[15:33.610 --> 15:35.150]  Hopefully, people listen.
[15:35.530 --> 15:39.450]  The Cybersecurity Challenge in the UK has completed its third and final stage.
[15:39.690 --> 15:44.510]  The three stages consisted of a treasure hunt, a network defense competition, and a forensics challenge.
[15:45.090 --> 15:51.170]  The top three finishers of all three stages will compete in the final stage to be held in Bristol at the HP Labs on March 5th.
[15:51.350 --> 16:05.050]  I had no idea that a site like this existed, but an online RPG known as Jail Lords allows you to play the role of a prison inmate, exchanging cigarettes, bribing guards, joining gangs, and, yes, even, uh, um, other stuff.
[16:05.470 --> 16:10.250]  Anyway, Jail Lords.com was breached, and its password list posted online.
[16:10.770 --> 16:14.910]  If you're still using the same password on multiple sites, you really haven't been paying attention.
[16:15.390 --> 16:17.550]  A few notable defacements to tell you about.
[16:17.710 --> 16:27.430]  The Gaza Hackers team, based in Palestine, took credit for defacing the website of the Jewish People's Policy Institute, and ClassicCars.com was defaced by a group out of Indonesia.
[16:27.430 --> 16:33.390]  The French website for WordPress was recently redirected to a site auto-downloading fake antivirus software.
[16:33.830 --> 16:43.830]  And the Jordanian Security Service had to issue a statement denying any involvement in taking offline the Amman News website, after the chief editor of the site accused the government of forcing it offline.
[16:43.830 --> 16:46.190]  Okay, who remembers Captain Midnight?
[16:46.350 --> 16:47.230]  Yeah, yeah, that guy.
[16:47.410 --> 16:50.850]  The guy who took over the HBO signal for four and a half minutes back in 1986.
[16:51.730 --> 16:53.530]  Well, some things never change.
[16:53.930 --> 17:01.730]  The FBI has just recently arrested a Tucson man for doing the same thing to the Tucson area Comcast broadcast of the Super Bowl last year.
[17:02.010 --> 17:09.170]  He's been charged with fraud and computer tampering after he interrupted last year's Super Bowl with 37 seconds of good old-fashioned porn.
[17:09.170 --> 17:14.910]  If you have an iPhone and you depend on your passcode to keep all your corporate secrets safe, well, shame on you.
[17:15.310 --> 17:23.310]  If someone steals your phone or otherwise gets physical access to it, they can easily jailbreak the phone, suck down all your data, and find all of your passwords.
[17:23.530 --> 17:25.470]  The whole process takes about six minutes.
[17:25.930 --> 17:29.010]  Not really sure why this is news to anyone, but there you have it.
[17:29.010 --> 17:39.450]  Foreign Secretary William Haig of the UK is claiming that a few Zeus malware infestations and phishing attempts equals a sustained and targeted attack against the UK defense establishment.
[17:39.650 --> 17:43.770]  If that's the case, then my grandmother is also under a sustained and targeted attack.
[17:44.090 --> 17:47.190]  Quick, let's spend some tax money to beef up her cyber defenses.
[17:47.670 --> 17:49.690]  And Microsoft has finally seen the light.
[17:49.690 --> 17:58.830]  After years and years of viruses, worms, and Trojan horses taking advantage of the auto-run feature in Windows XP, Microsoft has finally decided to disable it.
[17:59.210 --> 18:04.250]  An important non-security update will be pushed out via Windows Update to all Windows XP users.
[18:04.610 --> 18:11.190]  The feature has already been disabled in Vista and Windows 7, but considering the installed base of XP, it's about damn time.
[18:11.190 --> 18:17.630]  If you're using Comcast Internet for your business, you might want to make sure you have the latest updates applied to your cable modem.
[18:18.330 --> 18:27.590]  Trustwave Spider Labs, an HNN sponsor, has not only found cross-site request forgeries in the admin interface for the modems, but also a hard-coded root password.
[18:28.390 --> 18:30.510]  I swear, companies never learn.
[18:30.850 --> 18:32.810]  Oh, and don't forget to turn off Telnet.
[18:33.210 --> 18:38.830]  According to a report released by Akamai, 10% of all cyber attacks are targeted at port 23.
[18:39.770 --> 18:40.330]  Akamai?
[18:40.330 --> 18:42.770]  Since when did they start issuing security advice?
[18:43.370 --> 18:45.110]  Oh, well, good advice, anyway.
[18:45.390 --> 18:47.830]  And that's all the quick stories we found on the net this week.
[18:48.510 --> 18:50.030]  That means it's time for your...
[18:56.170 --> 19:08.770]  Confu is sponsored by Source Conference, a global security, technology and business forum I really think that BrewCon should think about changing its name to BeerCon.
[19:09.230 --> 19:11.710]  I think it would be a more accurate description of the event.
[19:12.370 --> 19:19.030]  Despite the vast quantities of fermented hops that will be consumed during the conference, there is usually very good talks presented as well.
[19:19.710 --> 19:25.010]  This year, BrewCon is September the 19th and 20th, but they have already opened their call for papers.
[19:25.090 --> 19:31.190]  You might remember HackkidCon, which had its inaugural event last fall in Boston.
[19:31.430 --> 19:38.250]  Well, they are starting to expand their framework, and are hoping to get other events started in Atlanta, San Francisco, Australia, and even the Netherlands.
[19:38.250 --> 19:42.570]  If you're interested in helping out, we have the link for you at HackerNews.com.
[19:43.450 --> 19:46.070]  B-Side's New Delhi, that's right, India,
[19:49.350 --> 19:55.990]  has finally announced a date as October 22nd and 23rd to coincide with the holidays of Dusera and Diwali.
[19:56.290 --> 19:58.350]  And they've also announced at least one speaker.
[19:58.610 --> 20:01.910]  Johnny Long from Hackers for Charities will be presenting there.
[20:02.630 --> 20:08.090]  And if you're watching this episode as soon as we released it, then you still have time to submit a talk for B-Side London.
[20:08.090 --> 20:11.250]  They are out of tickets, so speaking is the only way to get in.
[20:11.890 --> 20:14.350]  So this is where we normally air the stack of shame.
[20:14.530 --> 20:19.090]  But we are now one week into the Zero Day Initiative's new error of vulnerability disclosure.
[20:19.350 --> 20:27.210]  Up till last week, GDI has kept details of the vulnerabilities they catalog private, at least until the vendor has a patch ready for a coordinated release.
[20:27.930 --> 20:30.550]  Sometimes that has been enough, from a consumer point of view.
[20:30.910 --> 20:32.990]  Often enough, however, it has not been enough.
[20:33.330 --> 20:36.370]  And vendors simply ignore the faults they're shipping out to their customers.
[20:36.370 --> 20:39.350]  Until last Friday, there has been no downside to doing that.
[20:39.530 --> 20:46.690]  And vendors like Real Networks, HP, IBM, and Microsoft have left their customers exposed to high-risk vulnerabilities for years.
[20:47.170 --> 20:53.470]  You've seen the birthdays right here on HNN for one, two, and even three-year-old vulnerabilities that were never fixed.
[20:53.470 --> 20:56.010]  So how did Day Zero really stack up?
[20:56.250 --> 20:58.910]  Some naysayers said ZDI would never drop the bomb.
[20:59.310 --> 21:07.450]  Surely, well-funded legal departments of those on the stack of shame would scare off ZDI's corporate parent, HP, who themselves had several vulnerabilities on the list.
[21:07.610 --> 21:12.210]  We here at HNN expected the opposite, that there would be no vulnerabilities that did not drop.
[21:12.730 --> 21:18.330]  We've been saying for six months straight now that there was no excuse for anyone not having a fix by Day Zero.
[21:19.210 --> 21:27.110]  Vulnerabilities that were open for two years were given a final six-month warning that the details of their vulnerabilities would be made public, fix or no fix.
[21:27.330 --> 21:29.150]  Well, it wasn't so black and white.
[21:29.510 --> 21:33.770]  Fourteen vulnerabilities generated no vendor commitment for a fix by February 4th.
[21:33.910 --> 21:40.930]  As of the 7th, when ZDI started releasing, there are still twelve vulnerabilities that are more than six months old and are not disclosed.
[21:40.930 --> 21:41.770]  It doesn't look good.
[21:41.930 --> 21:49.610]  But ZDI has assured us here at HNN that every vendor still on that February 4th release schedule now has a specific and timely date.
[21:49.830 --> 21:57.150]  The excuses vary from last minute, they sold the code, but we now have a commitment from the new guys, to it's scheduled for the next Patch Tuesday.
[21:57.350 --> 21:59.810]  We're keeping an eye on you and your people, Marcus.
[22:00.050 --> 22:04.730]  Don't let these relics see March, or you lose ours and many other people's respect.
[22:04.730 --> 22:07.990]  And now, without further ado, the stack of shame.
[23:05.280 --> 23:06.980]  Welcome to the real world.
[23:08.760 --> 23:10.600]  That's it for this week's HNNCast.
[23:10.760 --> 23:13.860]  I've been your host Space Rogue, and you've been watching the Hacker News Network.
[23:14.840 --> 23:19.700]  Remember, if you have any news you think we should report, send it to news at HackerNews.com.
[23:19.700 --> 23:22.100]  You have been watching HNNCast.
[23:22.300 --> 23:25.000]  This is Space Rogue for the Hacker News Network.
[23:26.060 --> 23:28.640]  Fun to do, fun to do, fun to do bad things.