[00:09.200 --> 00:18.980]  The Hacker News Network presents HNNCast, with your host, Space Rogue.
[00:24.300 --> 00:30.600]  HNNCast is sponsored by Astaro, simplifying security.
[00:35.220 --> 00:42.070]  And by Trustwave Spider Labs, providing advanced information security services to planet Earth.
[00:43.470 --> 00:44.510]  Become a sponsor.
[00:44.930 --> 00:47.330]  Email sales@hackernews.com.
[00:49.190 --> 00:54.330]  This is Space Rogue for the Hacker News Network, and this is HNNCast for the first week of May, 2011.
[00:54.930 --> 00:57.550]  Our top, top, top, top story this week, Sony.
[00:57.970 --> 00:58.350]  Again.
[00:58.810 --> 01:04.910]  And with an additional 24 million user accounts at risk, on top of the original 77 million, we can see why.
[01:05.470 --> 01:12.730]  This week, Sony announced that the intruders were able to breach Sony Online Entertainment, in addition to the original target of the PlayStation Network.
[01:13.050 --> 01:16.530]  That added an additional 24 million accounts that got leaked.
[01:16.990 --> 01:21.110]  To Sony's credit, they have offered everyone 30 days free of PlayStation Plus.
[01:21.790 --> 01:23.790]  But is that really adequate compensation?
[01:24.050 --> 01:27.690]  Or just a ruse by Sony to garner more subscribers to the premium level?
[01:27.930 --> 01:36.050]  Sony says they have called in the FBI to investigate, and have taken steps to prevent future attacks, including moving resources to a new, more secure data center.
[01:36.050 --> 01:38.770]  That way, no one will be able to sneak in through the window.
[01:39.150 --> 01:46.770]  As for the credit card, Sony says that only about 10 million card numbers may have been exposed, but that those numbers were hashed, but not encrypted.
[01:47.390 --> 01:51.450]  Reports of the list being offered for sale back to Sony appear to be false.
[01:51.950 --> 01:59.670]  One interesting tidbit that may be completely unrelated is that Sony laid off about 200 people about two weeks prior to this external intrusion.
[01:59.930 --> 02:02.090]  Probably coincidence, but maybe not.
[02:02.090 --> 02:09.250]  In a letter to the United States Congress, Sony described the attack as carefully planned, highly technical, and very sophisticated.
[02:09.910 --> 02:13.450]  Which is exactly what I would say, even if I left the door open, but...
[02:13.450 --> 02:16.890]  Looking at Sony's own diagram, it looks like nothing more than a web application vulnerability.
[02:17.590 --> 02:21.490]  Perhaps even an SQLI, which is definitely not very sophisticated.
[02:22.170 --> 02:23.830]  Then there is the anonymous angle.
[02:24.190 --> 02:27.690]  Initially, Sony claimed that anonymous was responsible, and then that they weren't.
[02:28.070 --> 02:31.070]  Anonymous themselves issued two statements saying it wasn't them.
[02:31.070 --> 02:37.810]  However, now, Sony is claiming that they found a file on one of their servers titled anonymous, containing the text, we are legion.
[02:38.310 --> 02:41.070]  Which would be a great trick in order to mislead investigators.
[02:41.690 --> 02:43.230]  But right now, who knows?
[02:43.430 --> 02:45.070]  Your guess is as good as mine.
[02:45.730 --> 02:52.530]  While anonymous may or may not have been involved in the external intrusion perpetrated against Sony, they have been busy in other areas.
[02:53.250 --> 02:57.610]  Operation Blitzkrieg, for one, will target German extremist and right-wing neo-Nazi websites.
[02:57.610 --> 03:06.570]  And Operation Payback continues, and is now targeting New Zealand for their recent copyright infringement law, which makes it legal for the government to monitor citizens' online activities.
[03:07.210 --> 03:13.170]  I guess anonymous thought that earthquakes and tornadoes weren't enough for New Zealand, and, well, that they needed a few DDoS attacks as well.
[03:13.650 --> 03:17.190]  There are dozens and dozens of so-called crime kits out there for Windows.
[03:17.190 --> 03:20.290]  And now, there's at least one that we know about for OS X.
[03:20.570 --> 03:26.070]  Called the Yutani bot, this crimeware kit has a builder, an admin panel, and supports encryption.
[03:26.610 --> 03:31.770]  It would be used mostly to grab the contents of web forms, things like name, email address, and credit card numbers.
[03:32.370 --> 03:37.490]  Yutani currently supports Firefox, but you can be sure that at least Safari, if not Opera, will be added soon.
[03:37.490 --> 03:41.390]  That's not the only popular Windows exploit making its way to OS X.
[03:41.870 --> 03:47.230]  Fake antivirus is big business in the Windows world, and there is now at least one version for OS X.
[03:47.590 --> 03:52.630]  A fake copy of Mac Defender can even install itself via a drive-by download in Safari.
[03:53.130 --> 03:57.210]  Some users are reporting poisoned Google image searches as the infection vector.
[03:57.610 --> 04:00.610]  Which is just great, how do you think I get these graphics for HNN every week?
[04:01.210 --> 04:04.230]  We'll be back with more HNNCast right after these messages.
[04:05.330 --> 04:07.850]  So this is Dark Tangent coming at you live from DEFCON 18.
[04:08.710 --> 04:10.550]  Check me out on Hacker News Network.
[04:10.730 --> 04:12.370]  Get all your good zero-day info there.
[04:12.670 --> 04:14.310]  Space Rogue's the man!
[04:19.620 --> 04:20.700]  Five oceans.
[04:26.480 --> 04:27.480]  Seven continents.
[04:30.200 --> 04:31.620]  Whatever it takes.
[04:33.760 --> 04:35.480]  Wherever it takes us.
[04:37.260 --> 04:38.200]  America's Navy.
[04:38.600 --> 04:40.880]  A global force for good.
[04:43.020 --> 04:45.180]  Welcome back to HNNCast.
[04:45.330 --> 04:59.320]  Lawyers from Max AG, a German software company, have decided to pursue legal action against AcidGen after he found a stack buffer overflow vulnerability in the company's Music Maker 16 software, which can cause arbitrary code execution.
[05:00.200 --> 05:09.530]  AcidGen says he tried to work with the company prior to releasing his vulnerability, but after they accused him of extortion and threatened legal charges, AcidGen went ahead and released his exploit anyway.
[05:10.000 --> 05:15.240]  This isn't the first time strong German computer security laws have been used to stifle legitimate security research.
[05:15.460 --> 05:21.830]  In fact, the law has probably been used more times to prevent valid research from getting out than to prevent any criminal activity.
[05:21.830 --> 05:28.820]  We've all seen those grainy dashboard videos from cop cars on TV, but how would you like to see them live on your home computer?
[05:29.340 --> 05:38.860]  Well, one security researcher found you could probably do just that, as many cop car mounted cameras are streamed over cellular networks back to the precinct office with little to no security.
[05:39.460 --> 05:45.080]  While the camera and the DVR are mounted inside the car, the audio and video is sent live over the net.
[05:45.080 --> 05:49.920]  According to the manufacturer, the problem is a configuration issue of the implementer.
[05:50.140 --> 05:57.720]  The researcher has not identified which police district he targeted, but my guess is, if one of them set him up this way, then they probably all did.
[05:58.140 --> 06:00.520]  If you use a rent-to-own place such as Aaron's Inc.
[06:00.660 --> 06:04.020]  or possibly other national chains, you may be renting more than you think.
[06:04.420 --> 06:14.200]  According to a recently filed lawsuit, Aaron's uses a product called PC Rental Agent, which can surreptitiously access, monitor, intercept, and or transmit electronic communications.
[06:15.440 --> 06:18.860]  Aaron's evidently uses the software as a way to lock out non-paying customers.
[06:19.440 --> 06:25.100]  Considering the fact that you don't actually own the machine when you rent it, it will be interesting to see where the court rules on this.
[06:27.480 --> 06:33.560]  And Solo, a.k.a. Gary McKinnon, who has been waiting for his day in court for several years now, may in fact finally get one, in Britain.
[06:34.120 --> 06:42.100]  Solo has been fighting his extradition to the United States over his role for breaking into the NASA computers and threatening to, quote, disrupt at the highest levels, unquote.
[06:42.620 --> 06:50.240]  Now, rumors seem to indicate that a deal may have been worked out between President Obama and Britain's Home Secretary to give Solo his trial in the U.K.  instead of extraditing him to the U.S.
[06:53.140 --> 06:57.240]  It is thought that such a deal may be announced later this month during Obama's visit to the U.K.
[06:58.140 --> 07:00.080]  Whatever happens, I hope it happens soon.
[07:00.300 --> 07:01.600]  I'm really tired of this story.
[07:02.240 --> 07:03.480]  That's it for big news.
[07:03.680 --> 07:04.580]  We'll have the quickies later.
[07:04.720 --> 07:05.940]  But first, it's tool time.
[07:06.220 --> 07:09.620]  We'll be right back with tool time and the H&M quickies right after these messages.
[07:13.100 --> 07:17.000]  Some of our bugs have been, well, real bugs.
[07:20.770 --> 07:28.370]  At the CIA, our scientists and engineers create and apply innovative technology to meet intelligence needs.
[07:30.590 --> 07:31.970]  Care to join them?
[07:33.850 --> 07:36.750]  Technology so advanced, it's classified.
[07:38.510 --> 07:39.010]  U.S. citizenship required.
[07:40.210 --> 07:42.870]  Does everybody know what time it is?
[07:43.130 --> 07:44.330]  Tool Time!
[07:45.150 --> 07:45.730]  That's right!
[07:45.870 --> 07:48.130]  Binford Tools is proud to present...
[07:48.130 --> 07:49.210]  Space Rogue.
[07:51.730 --> 08:04.030]  First, for anyone who recognizes the real, original tool time from the Home Improvement Show, you just know that at a time like this, Tim the Tool Man Taylor would have to start the show with a big shout out to SEAL Team 6.
[08:07.050 --> 08:08.470]  Okay, the updates.
[08:09.170 --> 08:11.550]  THC's Hydra online password cracker.
[08:11.870 --> 08:14.070]  Moss Crack, the parallel web cracker.
[08:14.710 --> 08:17.270]  John the Ripper, the distributed offline cracker.
[08:18.570 --> 08:20.930]  Ncrack, the online password cracker.
[08:21.510 --> 08:23.890]  Sam Hain, the file integrity hids.
[08:24.870 --> 08:27.150]  Secubus, the Nessus automation framework.
[08:28.790 --> 08:31.770]  Mod Security, OWASP web app firewall.
[08:33.010 --> 08:34.330]  Rpon, the network monitor.
[08:35.050 --> 08:37.370]  Packet Fence, the free open source firewall.
[08:38.630 --> 08:45.370]  And a few more Sysinternals utilities, including Zoomit, ProdDump, and Process Explorer, have all been updated.
[08:45.370 --> 08:48.710]  So check your sources, and then go update.
[08:49.130 --> 08:50.810]  And a few general updates for you.
[08:51.270 --> 08:53.810]  jQuery is a widely used JavaScript library.
[08:53.810 --> 08:55.830]  It's been updated to version 1.6.
[08:56.030 --> 08:59.310]  And Java is now up to Java 6 update 25.
[08:59.930 --> 09:01.910]  Rip out the old, then install the new.
[09:02.250 --> 09:04.870]  And a few operating systems were also updated.
[09:05.690 --> 09:11.090]  Backbox Linux is an Ubuntu release full of hag, hag, hag research tools.
[09:11.810 --> 09:14.170]  And OpenBSD is up to 4.9.
[09:14.450 --> 09:21.270]  There's a huge list of changes, but NTF support by default and a newly assessed IP sec stack stick out among them.
[09:21.730 --> 09:22.130]  Check it.
[09:22.130 --> 09:25.090]  There have been some other very significant updates as well.
[09:25.490 --> 09:27.990]  Metasploit is now up to version 3.7.0.
[09:28.190 --> 09:31.670]  Say hello to a new session tracking framework and better performance.
[09:32.470 --> 09:37.770]  And finally, Whisper Systems has updated Whisper Core and extended it to include egress filtering via Whisper Monitor.
[09:37.770 --> 09:40.330]  And now, into the fresh.
[09:41.070 --> 09:49.490]  Anti-XSS is an anti-cross-site scripting library from Microsoft, designed to help developers protect their ASP.NET web apps from cross-site scripting attacks.
[09:49.930 --> 09:55.170]  Well, actually, to protect the users from attackers abusing XSS holes in your web apps.
[09:55.350 --> 09:56.650]  But you get the idea.
[09:57.410 --> 10:01.110]  PHP Vulnerability Hunter is a tool that's been used to fuzz PHP web apps.
[10:01.510 --> 10:03.250]  Point it at a host and go.
[10:04.010 --> 10:06.390]  Malware Analyzer 3.0 has been released.
[10:06.390 --> 10:11.730]  Seems like a nice little bundle of features including standard PE examination, disassembly, and tracing.
[10:13.190 --> 10:16.850]  Nexposay, the Rapid7 vulnerability scanner, now has a Ruby API.
[10:17.410 --> 10:19.330]  This version is based on Metasploits.
[10:19.850 --> 10:22.510]  And yet another specialized SQL injector has hit the net.
[10:23.130 --> 10:26.970]  Dumper is designed to leverage threading on the client to pull down more, faster.
[10:27.290 --> 10:33.570]  The author cites one use is when Pangolin or Hajiv take 2-3 hours to pull down a database through an injection hole.
[10:33.570 --> 10:36.590]  Dumper claims it can do the same thing in under two minutes.
[10:37.190 --> 10:38.590]  That's it for Tools this week.
[10:38.750 --> 10:41.030]  Join us next week for our salute to Tool Time.
[10:41.470 --> 10:47.130]  And now for a few quick stories the Pakistani intelligence services could not find on the net this week.
[10:47.130 --> 10:56.910]  In celebrity news this week, it looks like Simon Cowell has had his, quote, computer networks breached and lost the personal details of over 250,000 entrants to the X Factor.
[10:58.670 --> 11:04.910]  The Dutch bank Repoba Bank has been hit with a large denial of service attack, which has taken its internet and mobile banking offline.
[11:05.470 --> 11:08.350]  This is the second DDoS attack to hit the bank this year.
[11:08.990 --> 11:15.790]  It looks like Austria has decided to join the Cyber Cold War and has created a cyber defense unit manned by 1600 cyber warriors.
[11:16.210 --> 11:17.650]  Hey, welcome to the party.
[11:18.230 --> 11:26.010]  Best Buy, which was among the hundred or so companies hit in the recent Epsilon breach, is now responding to a second consecutive breach at the hands of one of its vendors.
[11:26.490 --> 11:29.390]  They aren't naming the vendor or how many customers are affected.
[11:29.950 --> 11:35.470]  Eleven years ago this month, the Love Bug email worm filled inboxes and email servers worldwide.
[11:36.270 --> 11:42.870]  Now, a new movie based on the worm called Subject I Love You will get its first screening at the Newport Beach Film Festival.
[11:43.530 --> 11:47.490]  The movie is a romantic drama and has little to nothing to do with the actual malware.
[11:48.030 --> 11:51.710]  You don't hear much about freaking these days, but that doesn't mean it's still not out there.
[11:52.150 --> 11:58.810]  Little St. Clair Township on Ontario, Canada found that out the hard way when they got their $130,000 phone bill.
[11:58.810 --> 12:05.710]  The FBI is the lead agency for the National Cyber Investigative Joint Task Force, which investigates cyber attacks against the U.S. government and cyber espionage directed against U.S. corporations.
[12:10.890 --> 12:15.550]  However, the U.S. Justice Department says that most FBI field agents lack the necessary skills required to do the job.
[12:16.210 --> 12:19.910]  Not sure if they're just bucking for a bigger budget or if there really is a problem there.
[12:20.630 --> 12:24.810]  Seattle school districts are investigating recent unauthorized grade changes.
[12:24.810 --> 12:27.990]  They suspect someone used the keylogger to get teacher passwords.
[12:28.430 --> 12:29.630]  But they aren't really sure.
[12:30.230 --> 12:35.370]  And that's all the quick stories that Pakistani intelligence services did not find on the net this week.
[12:35.870 --> 12:37.670]  That means it's time for your...
[12:41.310 --> 12:47.430]  ConFu is sponsored by SOURCE Conference, a global security technology and business forum.
[12:47.990 --> 12:52.910]  And by Hacking Paris, an international IT security conference.
[12:53.410 --> 12:55.570]  Brewcon had to change its location this year.
[12:55.730 --> 12:57.890]  It's still in Brussels, and it's still in September.
[12:58.130 --> 13:01.410]  But if you're going, be sure to double-check where to tell the taxi driver to take you.
[13:01.410 --> 13:06.050]  Speaking of Brewcon, registration and the call for papers is still open.
[13:06.330 --> 13:08.830]  And I think there might still be some early bird tickets available.
[13:09.730 --> 13:12.670]  The videos from this year's Source Boston are now online.
[13:13.030 --> 13:16.770]  The call for papers for Source Barcelona is now open.
[13:16.970 --> 13:19.630]  And the speaker list for Source Seattle has been released.
[13:20.430 --> 13:23.330]  Want a free trip to Canada and a nice hotel room when you get there?
[13:23.590 --> 13:26.910]  Then submit a talk to Sektor, happening in Toronto in October.
[13:27.350 --> 13:29.110]  The call for papers is open.
[13:29.110 --> 13:35.350]  If you're going to be in Anaheim at the end of May, check out Layer 1, a security conference for the Los Angeles area.
[13:35.710 --> 13:42.790]  There will be two days of talks, as well as a Hardware Village, a Lockpick Village, a Badge Hacking Contest, and a Tapper Evident Contest.
[13:43.270 --> 13:45.510]  Be good for practice before DEFCON, at least.
[13:46.350 --> 13:47.570]  SummerCon is back.
[13:47.910 --> 13:51.010]  They have moved the venue across the river this year to Brooklyn.
[13:51.230 --> 13:52.450]  Now sleep in hell!
[13:53.070 --> 13:55.070]  They've even set up an advanced ticket sales.
[13:55.070 --> 14:00.870]  But don't fear, the usual last minute disorganized mania will continue as will the entertainment by the Sugar Shack Burlesque.
[14:01.330 --> 14:02.630]  Not sure if SummerCon is for you?
[14:02.870 --> 14:05.990]  Check out HNN's Behind the Firewall episode from last year.
[14:07.770 --> 14:11.430]  The EFF DEFCON Getaway Contest is back for its second year.
[14:11.730 --> 14:13.630]  It works pretty much the same as last year.
[14:13.810 --> 14:16.710]  Raise the most money for the EFF and get lots of cool prizes.
[14:16.710 --> 14:24.550]  This year you could win two DEFCON 19 human badges, a suite at the Rio, two tickets to the Summit, and two badges to the Ninja Networks party.
[14:24.770 --> 14:26.210]  So, what are you waiting for?
[14:26.450 --> 14:27.370]  Start raising money!
[14:27.730 --> 14:32.970]  And now for the stack of shame, the list of all known open vulnerabilities as cataloged by the Zero Day Initiative.
[15:24.910 --> 15:26.230]  To the real world.
[15:28.910 --> 15:30.790]  That's it for this week's HNNCast.
[15:31.010 --> 15:35.590]  I've been your host Space Rogue, and you've been watching the Hacker News, the Hacker News, the Hacker News.
[15:42.500 --> 15:44.440]  The Hacker News at HackerNews.com.
[15:44.820 --> 15:46.740]  You have been watching HNNCast.
[15:46.940 --> 15:49.640]  This is, this is, this is Space Rogue for the Hacker News Network.
[15:50.940 --> 15:53.380]  Fun to do, fun to do, fun to do bad things.