[00:09.200 --> 00:19.080]  The Hacker News Network presents HNNCast, with your host, Space Rogue
[00:24.280 --> 00:26.420]  HNNCast is sponsored by...
[00:27.640 --> 00:30.600]  Astaro, simplifying security.
[00:34.800 --> 00:42.080]  And by Trustwave Spider Labs, providing advanced information security services to planet Earth.
[00:43.100 --> 00:44.500]  Become a sponsor.
[00:44.500 --> 00:55.020]  Email sales@hackernews.com This is Space Rogue for the Hacker News Network, and this is HNNCast for the second week of May, 2011.
[00:55.420 --> 00:58.540]  Our top story this week is, yet again, Sony.
[00:58.900 --> 01:00.360]  Not really sure where to start.
[01:00.610 --> 01:07.680]  The latest development seems to be that Sony not only left its servers open for attack, but also left sensitive information available for search engines.
[01:08.110 --> 01:17.340]  A Japanese researcher discovered the names and addresses of over 2,500 entrants left over from a Sony sweepstakes back in 2001, with nothing more than a Google query.
[01:17.970 --> 01:20.460]  Sony, of course, quickly took the data down.
[01:20.860 --> 01:28.880]  As a result, they have also delayed the PlayStation Network restart, which has been offline for several weeks now, while Sony presumably makes security enhancements.
[01:29.300 --> 01:34.780]  In other developments, Sony has been accused of using unpatched Apache servers with no firewalls.
[01:35.120 --> 01:37.240]  Sony has come out and rejected this assumption.
[01:37.840 --> 01:39.020]  Then, there's Anonymous.
[01:44.680 --> 01:46.640]  First, they denied all responsibility.
[01:47.180 --> 01:51.020]  Then, Sony blamed them after a file was found that had been left behind on the servers.
[01:51.440 --> 01:54.720]  Then, Anonymous says that maybe someone in Anonymous did do it.
[01:54.940 --> 01:55.320]  Maybe.
[01:55.940 --> 01:58.140]  But then, Anonymous has had their own problems.
[01:58.420 --> 02:06.800]  One of their former IRC operators, known as Ryan, decided to take down two of the primary IRC servers used by Anonymous to coordinate various operations.
[02:07.200 --> 02:11.940]  Some have said that this indicates a split inside Anonymous in the beginning of its unraveling.
[02:12.600 --> 02:17.640]  Anonymous, of course, flatly denies this and compares the situation to that of a disgruntled employee.
[02:18.360 --> 02:23.120]  Anonymous is working on restoring IRC services so that various operations can continue.
[02:23.540 --> 02:25.900]  That's not the only problems Anonymous has had.
[02:26.040 --> 02:32.010]  They are now just a little less anonymous, after the FBI raided the home of a 14-year-old member of 4chan last month.
[02:32.010 --> 02:41.510]  During the DDoS attacks against KISS member Gene Simmons as part of Operation Payback, the FBI was able to trace at least one of the participating IP addresses.
[02:42.000 --> 02:47.960]  Gene Simmons reportedly lost $20,000 to $25,000 as a result of the downtime caused by the attack.
[02:48.400 --> 02:52.040]  According to his mother, her son is obviously not the mastermind.
[02:52.760 --> 02:59.940]  It's been around for a long time, but now the Electronic Frontier Foundation has released new information on the spyware used by the FBI.
[02:59.940 --> 03:15.880]  Thanks to a Freedom of Information Act request, we now know that the spyware, or Computer and Internet Protocol Address Verifier, or CIPAV, can gather information such as the IP address, the MAC address, open ports, OS type, version and serial number, browser types and versions, and tons of other information.
[03:19.620 --> 03:24.780]  It's not known exactly how or when the FBI uses CIPAV, or if they even need a warrant.
[03:25.260 --> 03:29.580]  There's actually a new term being used to describe this type of software, policeware.
[03:30.000 --> 03:35.220]  As for the antivirus companies, most say that they will detect such software if they know about it.
[03:35.440 --> 03:40.580]  The problem is, without a verified copy of CIPAV, they can't really tell if they've already detected it or not.
[03:40.860 --> 03:43.260]  They don't detect much else, so I doubt it.
[03:43.940 --> 03:45.940]  So, is the FBI watching your computer?
[03:46.300 --> 03:49.040]  Probably at some level, but there's no way to know for sure.
[03:49.860 --> 03:53.340]  Of course, the FBI doesn't limit itself by just spying on your computer.
[03:53.340 --> 03:59.220]  Wired Magazine somehow got a hold of a physical FBI GPS tracker, and took it apart to take a look.
[03:59.540 --> 04:01.140]  Not much more than you would expect.
[04:01.400 --> 04:03.480]  A GPS, a cell phone, and some batteries.
[04:04.360 --> 04:12.300]  Michaels Stores, the national arts and crafts chain, has reported that at least 90 pin pads, scattered throughout its 964 stores, have been compromised.
[04:12.980 --> 04:19.560]  It's not clear if the devices themselves were tampered with in place, or if they were secretly replaced with pre-compromised look-alike pads.
[04:19.560 --> 04:24.600]  As a precaution, Michaels has replaced over 7,000 similar pads throughout its stores.
[04:25.160 --> 04:30.420]  Michaels first learned of the attack after law enforcement traced fraudulent card activity back to Michaels' stores.
[04:31.080 --> 04:33.800]  If you've shopped there, be sure to look closely at your statements.
[04:34.480 --> 04:37.400]  We'll be back with more HNNCast, right after these messages.
[04:38.760 --> 04:39.960]  Hey, this is Widget.
[04:40.060 --> 04:42.440]  You're watching Hacker News and Hacker News and Hacker News Network.
[04:53.050 --> 04:58.470]  Bye, bye, bye, bye, bye, bye, bye, bye, bye,
[05:06.440 --> 05:08.880]  bye, bye, bye, bye, bye, Welcome back to HNNCast.
[05:09.060 --> 05:15.920]  A lot of people have been congratulating LastPass for their reaction after they discovered some traffic anomalies in their database that they couldn't explain.
[05:16.620 --> 05:24.200]  If you don't know, LastPass is a hosted solution that claims to securely store all your passwords for you so that you don't have to actually remember them.
[05:24.760 --> 05:30.160]  Well, after they noticed the weird traffic, they announced that all users should change their master password just in case.
[05:30.780 --> 05:34.880]  However, while LastPass's actions are outside the norm, they shouldn't be.
[05:34.880 --> 05:38.440]  And they should not need to be congratulated for taking proactive action.
[05:38.940 --> 05:42.760]  Instead, we should vilify those who aren't proactive even more.
[05:43.280 --> 05:45.320]  Sony, RSA.
[05:50.000 --> 06:05.180]  Klops, a.k.a. Crazy J, a.k.a. Jason Neff, a former member of the defacement group Global Hell, which wreaked havoc on numerous poorly secured government websites back in the 90s, has been arrested for his role in various swatting activities or calling the cops on your enemies and getting them to send out the SWAT team to bust down your door.
[06:05.960 --> 06:10.220]  Crazy J now faces conspiracy charges and could be sentenced to several years in jail.
[06:11.040 --> 06:15.000]  After pleading guilty in January, Thor Morris from North Carolina...
[06:15.000 --> 06:15.700]  Wait, Thor?
[06:16.180 --> 06:17.140]  Yep, Thor.
[06:17.500 --> 06:27.000]  ...has been sentenced to three years in jail after he planned to break into numerous Dallas-area ATM machines and reprogram them to change the denomination of $20 bills to $1 bills.
[06:27.420 --> 06:32.680]  Thor was caught after he attempted to recruit an ex-con into a scheme, who then turned him into authorities.
[06:33.400 --> 06:35.060]  Sheesh, you can't trust anyone these days.
[06:35.060 --> 06:42.740]  Fox has canceled the TV comedy Breaking In, which starred Christian Slater, and focuses on the shenanigans that occur in a penetration company.
[06:43.240 --> 06:47.680]  Can't say I'm disappointed, as I never really watched it, which is probably why it was canceled.
[06:48.160 --> 07:05.220]  Although I suppose someone did watch it, and possibly in retaliation, or possibly in congratulations, a group calling itself LulzSec breached Fox.com website and posted over 300 names and passwords online and then proceeded to use those passwords to deface numerous LinkedIn and Twitter accounts.
[07:05.700 --> 07:12.780]  LulzSec has also taken credit for the breach of Simon Cowell's systems and the posting of information from X-Factor Entrance we told you about last week.
[07:13.060 --> 07:14.180]  That's it for big news.
[07:14.180 --> 07:16.500]  We'll have the quickies later, but first, it's tool time.
[07:16.800 --> 07:20.320]  We'll be right back with tool time and HNN Quickies right after these messages.
[07:22.760 --> 07:28.920]  Stalkers, burglars, employers, parents, strangers, hackers, lawyers.
[07:29.340 --> 07:36.140]  What you post on social networking sites is an advertisement of who you are, where you are, and how you can be targeted.
[07:36.500 --> 07:44.340]  Set your profile to private, only accept friends you know, never reveal your whereabouts, and don't give away personal information.
[07:44.720 --> 07:46.860]  Otherwise, anyone can read it.
[07:49.580 --> 07:51.720]  Everyone can see it.
[07:52.180 --> 07:54.500]  Does everybody know what time it is?
[07:54.800 --> 07:56.080]  Tool Time!
[07:56.780 --> 07:59.660]  That's right, Binford Tools is proud to present...
[07:59.660 --> 08:00.920]  Space Rogue.
[08:03.140 --> 08:05.180]  That's right, it's Tool Time again.
[08:05.520 --> 08:06.500]  First, the updates.
[08:06.760 --> 08:16.140]  Backtrack Linux, the Linux Security Distro, BurpSuite Pro, the Web Scanner Proxy, and the Enterprise Security API from OWASP have all been updated.
[08:16.860 --> 08:18.380]  And with that, into the fresh.
[08:18.740 --> 08:21.860]  Pulled Pork is a rule manager for Snort and Suricata.
[08:22.080 --> 08:28.440]  It will help automating the processes of updating your VRT Snort rules, shared object rules, or emerging threat rules.
[08:29.100 --> 08:32.620]  Network Security Toolkit is yet another specialized Linux distro.
[08:32.780 --> 08:35.380]  This one's specific to network security apps.
[08:35.840 --> 08:40.400]  Explico is an open source network analysis tool for analyzing data from PCAP files.
[08:40.400 --> 08:42.780]  It's meant primarily for forensics.
[08:43.100 --> 08:47.840]  Not quite Net Witness, but it's free rather than costing an arm, a leg, and your firstborn child.
[08:48.940 --> 08:51.460]  RegExtract is another utility from WoWanware.
[08:51.780 --> 08:54.020]  This version will export the registry to CSV.
[08:55.000 --> 09:03.200]  SW Fret Tools are a collection of tools built for vulnerability analysis of the Adobe Flash Player and for malware analysis of malicious SWF files.
[09:03.200 --> 09:17.700]  The tools are partly written in Java and partly in Python and include Flash Dissector, a binary viewer for SWF files, SWF Parser for building your own tools based on the parser, FP Debugger for dynamic tracing of Flash Player, and more.
[09:18.340 --> 09:26.120]  The Harvester is a tool for gathering email accounts, usernames, and hostnames, subdomains from different public sources like search engines and PGP servers.
[09:26.120 --> 09:33.060]  The sources supported are Google, Google Profiles, Bing, PGP servers, LinkedIn, and Exceled.
[09:33.760 --> 09:40.620]  GG Google Scan is a Google scraper which performs automated searches and returns results of search queries in the form of URLs or hostnames.
[09:41.080 --> 09:45.900]  Google tries to prevent this, so GG Google Scan tries to act human in going about it.
[09:46.460 --> 09:51.240]  And finally, CryptoNark is a Perl script for examining an SSL server's configuration.
[09:51.240 --> 09:56.560]  Check protocol and cipher suites, but nothing about client-initiated renegotiation.
[09:56.680 --> 10:02.340]  So it's limited, but can be useful for those remediating weak cipher or protocol-related pen test findings.
[10:03.100 --> 10:04.640]  That's it for this week's Tool Time.
[10:04.860 --> 10:07.040]  Join us next week for our salute to Tool Time.
[10:07.460 --> 10:11.720]  And now for a few quick stories the FBI's police ware observed me reading this week.
[10:12.240 --> 10:18.380]  It used to cost several thousand bucks, but now you can find the source code for the Zeus malware available online for absolutely nothing.
[10:18.940 --> 10:26.020]  Some reports indicate that this was done by the owners of the SpyEye Trojan as a way to increase the value of SpyEye and discredit their competitor.
[10:26.560 --> 10:28.340]  Others say it's filled with backdoors.
[10:28.960 --> 10:31.880]  Either way, look for more online banking attacks coming soon.
[10:32.620 --> 10:37.900]  The poker training site CardRunners.com has announced that they have suffered a quote, illegal intrusion.
[10:38.260 --> 10:44.500]  They say no financial data was accessed during the illegal intrusion, but are advising all users to change their passwords.
[10:45.260 --> 10:57.560]  CC Avenue, a credit card processor in Southeast Asia, has had its website breached by a simple SQL injection, which caused it to barf out its complete database structure and passwords, which were, of course, stored in plain text.
[10:58.020 --> 10:58.300]  Nice.
[10:59.100 --> 11:05.240]  Finnish police have closed an investigation into a banking Trojan scam perpetrated against Nordia Bank in Finland.
[11:05.580 --> 11:08.700]  They arrested 17 people in connection with the case last week.
[11:09.140 --> 11:10.100]  I guess they're finished.
[11:10.380 --> 11:15.660]  You might have heard about a security company called ViewPen, who claims they could bust out of the Google Chrome Sandbox.
[11:16.200 --> 11:17.800]  Turns out it was just a flash bug.
[11:18.600 --> 11:19.380]  Nothing to see here.
[11:19.680 --> 11:20.160]  Move along.
[11:21.240 --> 11:23.620]  The White House has released just what we need.
[11:23.760 --> 11:24.400]  A plan.
[11:24.640 --> 11:27.060]  A plan to enhance the nation's cyber security.
[11:27.660 --> 11:28.540]  Oh, goody.
[11:28.980 --> 11:32.880]  One good part of this plan is a possible national breach data notification law.
[11:33.160 --> 11:35.040]  And to that I say about damn time.
[11:35.400 --> 11:37.540]  Haven't they been trying to pass that for like five years now?
[11:38.480 --> 11:45.260]  Android had to remove at least another 11 apps from the Android marketplace last week after it was found they all contained SMS Trojans.
[11:45.800 --> 11:48.360]  No word on how many people actually downloaded the apps.
[11:48.880 --> 11:52.500]  This one is just too stupid, funny, and sad not to share.
[11:52.740 --> 11:58.020]  A laptop was stolen from a marked police cruiser that was at a local dealership for service in Newington, New Hampshire.
[11:58.460 --> 12:00.180]  The stupid, funny, and sad part?
[12:00.480 --> 12:09.240]  Well, the police chief said that the large number of records on the computer were safe because the battery on the laptop barely worked and the thief forgot to grab the power cord.
[12:09.660 --> 12:12.320]  So yeah, stupid, funny, or sad?
[12:12.640 --> 12:13.440]  You decide.
[12:13.700 --> 12:14.680]  I'm going with sad.
[12:15.280 --> 12:18.640]  If you're using Skype for Mac, be sure to update and apply the patch.
[12:18.920 --> 12:23.680]  The older, unpatched version has a massive zero day in it, allowing remote code execution.
[12:24.220 --> 12:24.820]  Not good.
[12:25.200 --> 12:30.940]  The patch has been out for about a month, but since no one was actively exploiting the whole, Skype decided not to announce the patch very loudly.
[12:31.320 --> 12:32.600]  Well, that was nice of them.
[12:32.600 --> 12:40.020]  And finally, in mergers and acquisitions this week, Tripwire dropped its IPO plans and was promptly purchased by private equity firm Toma Bravo.
[12:40.740 --> 12:43.360]  And Sophos bought HNN sponsor Astaro.
[12:43.780 --> 12:46.020]  This sounds like a great move for both companies.
[12:46.500 --> 12:49.040]  No idea what it will do to HNN's sponsorship, though.
[12:49.260 --> 12:50.300]  We would hate to lose them.
[12:50.560 --> 12:52.200]  Maybe you could let them know how you feel.
[12:52.540 --> 12:56.700]  And that's all the quick stories the FBI police were saw me reading on the net this week.
[12:56.700 --> 12:58.880]  That means it's time for your...
[13:03.530 --> 13:10.050]  ConFu is sponsored by SOURCE Conference, a global security technology and business forum.
[13:10.570 --> 13:15.510]  And by Hack in Paris, an international IT security conference.
[13:15.750 --> 13:20.910]  LASCON, or the Lone Star Application Security Conference, will happen in Austin, Texas at the end of October.
[13:21.410 --> 13:24.210]  They usually draw a pretty impressive speaker list, so check them out.
[13:24.750 --> 13:29.130]  They're also the only security conference I know of to have a mechanical bull during the happy hour.
[13:29.130 --> 13:31.630]  Are you a part of a non-profit hackerspace?
[13:31.850 --> 13:34.390]  Want to get in on the donation action at Mohawk Con?
[13:34.570 --> 13:35.390]  Of course you do.
[13:36.010 --> 13:42.250]  Mohawk Con is the annual event held in the contest floor at DEFCON to raise money for various charities by shaving people's heads.
[13:42.750 --> 13:45.170]  This year, they are extending the love to hackerspaces.
[13:45.630 --> 13:49.350]  Design an outrageous donation box and get some of the Mohawk Con donations.
[13:49.790 --> 13:55.490]  Check out mohawk.me for more info, or we have the link in the comments@hackernews.com.
[13:55.850 --> 13:58.750]  The speaker lineup for Summer Con is starting to take shape.
[13:59.130 --> 14:02.250]  Happening in a bar, naturally, somewhere in Brooklyn.
[14:02.390 --> 14:04.030]  No sleep time!
[14:09.420 --> 14:10.160]  At the end of June.
[14:11.000 --> 14:12.820]  Ah, that's less than a month away, people.
[14:13.100 --> 14:18.640]  You can look forward to hearing Alex Sotarov, or Dino Diazovi, or John Larimer, and several others.
[14:18.820 --> 14:20.780]  Some pretty big names for such a small con.
[14:21.180 --> 14:22.820]  Tickets are already on sale.
[14:23.500 --> 14:30.940]  Yet another Hackers on a Plane trip has been scheduled, this time for the Chaos Computer Camp happening in August in a field just outside Berlin.
[14:31.360 --> 14:36.080]  The plane leaves from San Francisco and New York includes food and a tent at the camp.
[14:36.320 --> 14:44.820]  If you're going to the Chaos Camp on your own and don't have a tent, or don't want to sleep on the ground, you can rent a tent that has a floor and tables and chairs.
[14:44.820 --> 14:45.180]  Huh.
[14:45.640 --> 14:47.520]  Kind of defeats the purpose of camping, doesn't it?
[14:47.820 --> 14:54.300]  The schedule for Hack in Paris, taking place in Paris, of course, next month, has been posted with a lot of interesting talks.
[14:54.720 --> 14:56.320]  Also check out their training classes.
[14:56.560 --> 14:57.960]  Some really juicy stuff in there.
[14:58.120 --> 15:03.400]  And now for the Stack of Shame, the list of all known open vulnerabilities as cataloged by the Zero Day Initiative.
[15:58.730 --> 16:00.510]  That's it for this week's HNNCast.
[16:00.570 --> 16:04.810]  I've been your host, Space Rogue, and you've been watching the Hacker News H-H-H-Hacker News H-H-H-H-Hacker News Network.
[16:06.810 --> 16:11.570]  Remember, if you have any news you think we should report, send it to news@hackernews.com.
[16:12.030 --> 16:13.910]  You have been watching HNNCast.
[16:14.150 --> 16:16.810]  This is-this is-this is Space Rogue for the Hacker News Network.
[16:18.050 --> 16:20.510]  Fun to do-fun to do-fun to do-bad things.