[00:09.200 --> 00:18.980]  The Hacker News Network presents HNNCast with your host, Space Rogue.
[00:24.320 --> 00:30.620]  HNNCast is sponsored by Astaro, simplifying security.
[00:35.230 --> 00:42.090]  And by Trustwave Spider Labs, providing advanced information security services to planet Earth.
[00:43.470 --> 00:44.490]  Become a sponsor.
[00:44.930 --> 00:47.310]  Email sales@hackernews.com.
[00:49.150 --> 00:54.370]  This is Space Rogue for the Hacker News Network, and this is HNNCast for the third week of May, 2011.
[00:55.010 --> 00:58.610]  Our top, top, top story this week is, once again, Sony.
[00:59.130 --> 01:02.370]  There is a little bit more information out there about the original Sony breach.
[01:02.950 --> 01:07.270]  Evidently, the attackers launched their attack from Amazon's Web Services EC2 service.
[01:07.730 --> 01:08.190]  What?
[01:08.390 --> 01:10.790]  You didn't think the bad guys would move to the cloud as well?
[01:10.790 --> 01:12.890]  But there's more Sony news.
[01:13.090 --> 01:18.450]  Evidently, when Sony started to turn their services back on, they wanted to force a password reset on accounts.
[01:18.890 --> 01:19.850]  Good idea, right?
[01:20.170 --> 01:22.770]  Well, Sony's system required your username and birthdate.
[01:23.170 --> 01:25.450]  Information that was downloaded during the attack.
[01:25.590 --> 01:25.810]  No!
[01:26.230 --> 01:26.750]  Brilliant.
[01:27.450 --> 01:29.750]  Sony shut the service down again soon after.
[01:30.130 --> 01:32.530]  Which really just has to have you scratching your head.
[01:32.770 --> 01:34.270]  Are they really that stupid?
[01:34.650 --> 01:35.790]  And it's not just Sony.
[01:35.790 --> 01:40.070]  Sony hired some big-name security vendors to advise them after the first breach.
[01:40.430 --> 01:42.890]  So there is plenty of blame to go around for this one.
[01:43.210 --> 01:46.530]  We're looking at you, Protivy, data forte, and guidance.
[01:46.950 --> 01:47.930]  Do you have anything to say?
[01:48.510 --> 01:54.810]  The websites for the computer game company, Eidos Interactive, and its game, Deus Ex, were defaced last week.
[01:55.070 --> 02:02.730]  In addition to the defacement, the attackers made away with a large cache of resumes, and may have even gotten source code for some of Eidos' interactive games.
[02:02.730 --> 02:07.010]  It's not known if the 80,000 user accounts of Deus Ex were also compromised.
[02:07.410 --> 02:10.770]  Last week's checks, Eidos had not made any comments regarding the breach.
[02:11.210 --> 02:13.890]  Guess they're playing by Sony and RSA rules.
[02:15.250 --> 02:30.890]  At 3 p.m. on Wednesday, May 18, almost 11 months after his arrest, for what amounts to basically looking into the security arrangements for the G20 summit, security researcher Byron Sohn was released from pre-tile custody on a $250,000 bond and a long set of conditions.
[02:30.890 --> 02:34.830]  His trial is set for November 7th, and he still needs our support.
[02:35.050 --> 02:39.010]  His legal bills are already over six figures, and he hasn't even made it to trial yet.
[02:39.430 --> 02:41.810]  Go to freebyron.org for more details.
[02:42.150 --> 02:45.850]  Looks like there is finally some really nasty Mac malware on the loose.
[02:46.310 --> 02:53.650]  There have been a few examples in the past, but this one, called Mac Protector, uses the old fake AV trick that has been so popular in Windows.
[02:53.650 --> 03:01.710]  The really bad thing is that Apple is purposely advising its support reps to disavow any knowledge of the malware or assist in removing it.
[03:02.130 --> 03:03.130]  But don't worry.
[03:03.430 --> 03:08.690]  The NSA has just released their updated and easy-to-read guide on hardening macOS 10.6.
[03:08.890 --> 03:11.350]  We have the link for you at HackerNews.com.
[03:11.610 --> 03:15.170]  We'll be back with more HNNCast right after these messages.
[03:31.510 --> 03:36.050]  Hello, we are Anonymous, and you are watching Hacker News Network.
[03:45.890 --> 03:50.430]  Bye, bye, bye, bye, bye, bye, bye, bye.
[04:00.310 --> 04:02.250]  Welcome back to HNNCast.
[04:02.710 --> 04:05.210]  There's a rather weird story out of Australia this week.
[04:05.710 --> 04:15.670]  Evidently, at the B-Sides conference, there was one security researcher, Christian Heinrich, who gave a talk about how to access privacy-protected photos of people on Facebook without being their friend.
[04:16.170 --> 04:24.950]  For an example, during the talk, the researcher chose to look at the picture of the wife of security researcher Chris Gatford, which, if you know these two, they don't really see eye to eye.
[04:25.550 --> 04:30.490]  Well, this has raised some questions as to the ethicalness of the demo, the story gets even weirder.
[04:31.030 --> 04:38.230]  Somehow, the Australian police found out what happened and went and arrested the reporter who covered the story and confiscated his laptop and iPad.
[04:38.810 --> 04:46.050]  The Australian police then stated that receiving photos unlawfully from Facebook was the same exact thing as receiving stolen TVs.
[04:46.990 --> 04:50.290]  Can't tell if they truly believe that, or if they're just covering their ass.
[04:50.710 --> 04:54.510]  So last week, we told you about the new cybersecurity plan released by the White House.
[04:54.510 --> 05:05.910]  There is, of course, the call for the National Data Breach Notification Law, which we think is something that should have been done a long, long time ago, not to just protect users, but to force companies to come clean about their poor security.
[05:06.230 --> 05:13.630]  However, the plan also calls for a minimum three-year sentence for anyone convicted of an electronic break-in of a critical infrastructure system.
[05:14.870 --> 05:20.370]  Hopefully, critical infrastructure will be clearly defined, where you can look for the scope of that law to increase dramatically.
[05:20.370 --> 05:27.830]  And the third big thing in this new plan is the reservation by the United States to respond to a cyberattack with military force.
[05:28.210 --> 05:35.270]  In other words, if you throw some ones and zeros at the U.S., you might very well find a SEAL team landing a helicopter in your backyard.
[05:40.950 --> 05:43.690]  Can't say we agree with that provision very much.
[05:44.270 --> 05:54.230]  Evidently, not everyone agrees with the plan, as one of the nation's top cybersecurity officials, Phil Reitner, has resigned his position at DHS, just days after the plan was released.
[05:55.030 --> 06:08.610]  Personal information of over 200,000 unemployed Massachusetts residents may have been copied from the Massachusetts Executive Office of Labor and Workforce Development after 1,500 of the agency's computers were infected with the QuakeBot Trojan.
[06:09.410 --> 06:16.190]  Evidently, the semantic AV they had installed didn't actually clean up the infection the first time, allowing it to continue to spread.
[06:16.750 --> 06:17.570]  Imagine that.
[06:18.370 --> 06:20.480]  France's Secretary General of Internet Piracy...
[06:21.070 --> 06:22.870]  Wow, France has a pirate general?
[06:23.050 --> 06:23.390]  Cool!
[06:23.910 --> 06:34.350]  Anyway, he announced that his organization, Hadobe, was going to take control of Trident Media Guard, which had been responsible for monitoring peer-to-peer networks under France's Three Strikes Anti-Piracy Law.
[06:34.690 --> 06:39.510]  This came after it was discovered that Trident was leaking data like a sieve and was woefully insecure.
[06:40.370 --> 06:45.310]  TMG, of course, denied everything, said it was a test server, and no real information was released at all.
[06:45.310 --> 06:47.770]  Sounds like three strikes for TMG to me.
[06:48.310 --> 06:53.090]  Blue boxes may be dead and PBXs will soon follow, but freaking hasn't gone anywhere.
[06:53.730 --> 06:59.310]  New research shows numerous IP-based telephones susceptible to similar style fraud as the old systems.
[06:59.530 --> 07:08.590]  The research specifically calls out Cisco-branded phones, but turning phones into remote bugging devices or forcing phones to dial premium numbers can affect many vendors.
[07:09.330 --> 07:15.030]  Cisco says that if you follow the manual and turn services off before installation, you will be safe.
[07:15.590 --> 07:19.630]  Hey, Cisco, how about shipping stuff so that it's secure out of the box instead?
[07:20.170 --> 07:21.310]  That's it for big news.
[07:21.310 --> 07:22.270]  We'll have the quickies later.
[07:22.450 --> 07:23.650]  But first, it's Tool Time.
[07:23.890 --> 07:27.410]  We'll be right back with Tool Time in the HNN Quickies right after these messages.
[07:34.300 --> 07:36.100]  Copying is not theft.
[07:36.660 --> 07:39.200]  Stealing a thing leaves one less left.
[07:39.380 --> 07:41.620]  Copying it makes one thing more.
[07:41.840 --> 07:43.600]  That's what copying's for.
[07:44.220 --> 07:46.060]  Copying is not theft.
[07:46.380 --> 07:48.820]  If I copy yours, you have it too.
[07:49.140 --> 07:51.380]  One for me and one for you.
[07:51.680 --> 07:53.480]  That's what copies can do.
[07:53.480 --> 07:58.260]  If I steal your bicycle, you have to take the bus.
[07:58.920 --> 08:03.400]  But if I just copy it, there's one for each of us.
[08:03.780 --> 08:05.840]  Making more of a thing.
[08:06.320 --> 08:08.420]  That is what we call copying.
[08:09.060 --> 08:11.080]  Sharing ideas with everyone.
[08:11.520 --> 08:14.540]  That's why copying is fun.
[08:28.710 --> 08:31.310]  Does everybody know what time it is?
[08:31.570 --> 08:32.970]  Tool time!
[08:32.970 --> 08:36.670]  That's right, Binford Tools is proud to present...
[08:36.670 --> 08:37.750]  Space Rogue.
[08:40.290 --> 08:42.150]  That's right, it's Tool Time again.
[08:42.630 --> 08:44.890]  First, as always, the updates.
[08:45.730 --> 08:48.390]  Metasploit is up to version 3.7.1.
[08:49.010 --> 08:51.550]  Skipfish is now at version 1.8.8.
[08:52.150 --> 08:55.270]  The Nessus DB is up to version 1.4.2.
[08:56.670 --> 08:59.510]  OpenDLP is now at version 0.3.1.
[09:00.630 --> 09:04.850]  NetSparker is at version 1.9.0.5.0.
[09:06.490 --> 09:09.450]  And Microsoft's EMT is now at version 2.1.
[09:09.630 --> 09:13.430]  And a week without Sysinternals updates is like a week without tool time.
[09:13.650 --> 09:17.890]  This week, it was VMMap, RAMMap, Handle, and Process Explorer.
[09:18.210 --> 09:20.870]  So, check your sources and go update already.
[09:20.870 --> 09:23.710]  And now, into the fresh.
[09:24.490 --> 09:27.990]  NotFuzzier is a powerful browser fuzzier based on Mangle.me.
[09:28.250 --> 09:32.330]  It fuzzes HTML, CSS tags, JavaScript, and DOM objects.
[09:33.310 --> 09:40.010]  Safe3 SQL Injector is a powerful and easy-to-use tool to automate detection and exploitation of SQL injection flaws.
[09:40.270 --> 09:46.870]  It includes support for HTTPS, various auth schemes, POST, and has full support for just about everything BugDB2.
[09:48.170 --> 09:56.490]  Malbox, Malware Analysis System, is a behavior analysis system that considers both network and local behaviors when generating a report on the program you pointed at.
[09:56.830 --> 10:02.810]  So, if you're firing off 20 Sysinternals utilities to see what something is doing, you might want to have a look-see at this.
[10:03.690 --> 10:07.070]  PityBull is an intrusion detection framework for Snort and suricata.
[10:07.430 --> 10:12.970]  It's basically like the old stick program in that you can use it to test the detection and blocking of either one.
[10:12.970 --> 10:20.290]  It will send non-RFC-compliant packets, fragmented packets, shell codes, and reverse shells, and can employ various evasion techniques.
[10:20.670 --> 10:22.770]  So, yeah, it's quite a bit more than stick.
[10:23.930 --> 10:25.630]  Yeti is a network fingerprinting tool.
[10:25.890 --> 10:33.290]  It will do domain discovery, forward lookup brooding, reverse lookups, Bing searching, cert scraping, and integrates with Nmap and SQLite.
[10:33.810 --> 10:38.430]  Not sure I would send a Yeti in to do my recon, but this Yeti looks pretty useful for that.
[10:38.430 --> 10:42.850]  If you're into malware analysis, then check out Cuckoo from the Honeynet project.
[10:43.390 --> 10:47.950]  Cuckoo is another project from the Google Summer of Code, and it has hit 0.2 beta.
[10:48.430 --> 10:54.690]  Cuckoo is a lightweight malware analysis sandbox that performs automated dynamic analysis of provided Windows binaries.
[10:54.970 --> 10:59.430]  It's able to return comprehensive reports on key API calls and network activity.
[10:59.870 --> 11:06.850]  And then we have Dominator, which is a Firefox-based software for analysis and identification of DOM-based XSS.
[11:06.850 --> 11:16.330]  It uses dynamic runtime tainting model on strings and can trace back taint propagation operations in order to understand if a DOM-XSS vulnerability is actually exploitable.
[11:16.890 --> 11:22.970]  And on a final note, most of us have already recompiled Netcat out of annoyances at AV's insistence that it is a virus.
[11:23.410 --> 11:26.290]  Well, someone finally put up another distro for the rest of you.
[11:26.530 --> 11:29.650]  It's for Windows, and for some reason it's now called RCat.
[11:30.030 --> 11:31.630]  Anyway, it's up at Packetstorm.
[11:32.110 --> 11:33.670]  That's it for this week's Tool Time.
[11:33.830 --> 11:36.270]  Join us next week for our salute to Tool Time.
[11:36.850 --> 11:41.110]  And now for a few quick stories that Hedopi saw us looking at on the net this week.
[11:41.530 --> 11:50.350]  A new report by the Government Accounting Office blames the Veteran Administration for not fixing security issues for over a decade, resulting in numerous security breaches.
[11:50.550 --> 11:52.630]  Our veterans really deserve a little bit better.
[11:53.050 --> 11:54.690]  For over a decade.
[11:55.690 --> 12:05.030]  India has become the latest country to join the cyber cold war, and have announced that they, too, will create a cyber command and control authority.
[12:05.450 --> 12:11.670]  While the authority primary mission is stated to be defensive, offensive capabilities will surely be part of its repertoire.
[12:12.410 --> 12:20.330]  Two more sentences have been handed down to people involved in the Ghost Market carding website, bringing the total to six people convicted in relation to the site.
[12:21.110 --> 12:29.130]  Colonel Root, aka Zachary Woodham, received a suspended sentence of 18 months in jail, and Louis Tobin House got 200 hours of community service.
[12:29.590 --> 12:33.430]  And another popular website has had its pages infected with drive-by downloads.
[12:33.990 --> 12:42.850]  Geek.com has suffered a malicious iframe attack that exploited numerous JavaScript vulnerabilities, proving once again that Geek.com is not very geeky.
[12:43.470 --> 12:47.850]  Prolific SQL attacker TinCode has found a hole in yet another high-profile site.
[12:48.090 --> 12:53.630]  A server at NASA's Goddard Space Flight Center has had its FTP directory contents posted to the internet.
[12:53.630 --> 12:58.790]  You'd think NASA would have learned after Solo rampaged through their servers a decade ago, but I guess not.
[12:59.130 --> 13:01.010]  I guess they're taking tips from the VA.
[13:01.610 --> 13:15.570]  In another case of hardware-containing malware, TomTom has recalled a small number of TomTom Go 910 satellite navigation devices that were manufactured back in 2006, after finding out that they were infected with not one, but two pieces of malware.
[13:15.650 --> 13:17.150]  You have reached your destination.
[13:17.210 --> 13:20.050]  Well, we finally have proof that it is truly just all about the lols.
[13:20.050 --> 13:23.810]  Anonymous has launched a new campaign, OpUFO.
[13:24.290 --> 13:29.370]  The idea is to flood UFO reporting sites with fake UFO sightings all at the same time.
[13:29.790 --> 13:30.350]  Why?
[13:30.650 --> 13:32.170]  I guess they think it would be funny.
[13:32.610 --> 13:44.690]  And lastly, in business news this week, the shakeup in the security industry continues, as CA has sold its antivirus division to venture capital firm Updata Partners, which will use it to form a new company called Total Defense.
[13:45.370 --> 13:51.230]  And Rambus has agreed to purchase cryptographic research, which should make for some interesting RAM modules in the next few years.
[13:51.830 --> 13:55.110]  And that's all the quick stories that Hadobe saw me looking at this week.
[13:55.370 --> 13:56.690]  That means it's time for your...
[13:57.330 --> 13:57.630]  Con...
[14:14.480 --> 14:17.360]  There's a brand new con in Michigan to tell you about this week.
[14:18.060 --> 14:21.080]  GurrCon will be held in Grand Rapids on September 16th.
[14:21.800 --> 14:24.400]  Registration is already open, and they still have sponsor slots open.
[14:24.840 --> 14:27.820]  The call for papers is open until the end of June.
[14:27.820 --> 14:33.260]  The call for papers for Rexcon 2011, which will be held in Australia, is now open.
[14:33.520 --> 14:36.680]  The 7th annual con will take place in Melbourne at the end of November.
[14:37.160 --> 14:40.060]  And we almost missed Phreaknik in Nashville in November.
[14:40.320 --> 14:44.400]  This will mark Phreaknik's 15th year, covering a lot more than just computer security.
[14:44.860 --> 14:49.620]  Just a reminder that the call for papers for the DEFCON Sky Talks is open until the end of the month.
[14:50.200 --> 14:54.520]  No, the Sky Talks won't actually be in a skybox this year, but never mind that.
[14:54.520 --> 14:59.800]  Sky Talks are for ultra-sensitive talks, stuff that could get you fired or arrested or worse.
[14:59.960 --> 15:06.060]  So if you have info that you think the world needs to know, but are afraid of where to release it, Sky Talks are for you.
[15:06.320 --> 15:07.480]  You have about a week left.
[15:07.900 --> 15:14.980]  Oh, and speaking of DEFCON, if you're looking to get your company name out there, the folks who organize the Wall of Sheep each year are looking for sponsors.
[15:15.200 --> 15:24.280]  In case you've been too drunk to notice, the Wall of Sheep actively searches the DEF CON networks for passwords sent in the clear, and then projects them on a big screen for all to see.
[15:24.680 --> 15:35.160]  We told you before that Kingpin, aka Joe Grand, was not going to be designing this year's DEFCON badge after designing it for the last five years with ever-increasingly complicated circuit boards.
[15:35.960 --> 15:39.100]  Speculation has been rampant as to who would be designing this year's badge.
[15:39.280 --> 15:40.740]  But now, it's official.
[15:40.980 --> 15:43.620]  This year's badge will not be electronic at all.
[15:44.000 --> 15:46.400]  Still no idea who will actually do the design, though.
[15:46.560 --> 15:48.440]  Hmm, maybe it'll be steampunk.
[15:49.220 --> 15:54.620]  And now, for the Stack of Shame, the list of all known open vulnerabilities as catalogued by the Zero Day Initiative.
[16:50.860 --> 16:53.060]  That's it for this week's HNNCast.
[16:53.220 --> 16:56.420]  I've been your host, Space Rogue, Space Rogue, Space Rogue.
[16:56.640 --> 16:59.480]  And you've been watching the Hacker News, the Hacker News, the Hacker News Network.
[17:00.380 --> 17:05.280]  Remember, if you have any news you think we should report, send it to news@hackernews.com.
[17:05.620 --> 17:07.540]  You have been watching HNNCast.
[17:07.940 --> 17:10.540]  This is Space Rogue for the Hacker News Network.
[17:11.760 --> 17:14.240]  Funny dude, funny dude, funny dude, bad things.