Chinese – Jupiter Broadcasting https://www.jupiterbroadcasting.com Open Source Entertainment, on Demand. Sat, 10 Feb 2018 05:51:27 +0000 en-US hourly 1 https://wordpress.org/?v=5.5.3 https://original.jupiterbroadcasting.net/wp-content/uploads/2019/04/cropped-favicon-32x32.png Chinese – Jupiter Broadcasting https://www.jupiterbroadcasting.com 32 32 Rockets & Ravens | User Error 45 https://original.jupiterbroadcasting.net/122287/rockets-ravens-user-error-45/ Fri, 09 Feb 2018 21:51:27 +0000 https://original.jupiterbroadcasting.net/?p=122287 RSS Feeds: MP3 Feed | Video Feed | iTunes Feed Become a supporter on Patreon: Links Winamp2-js KDE neon Exclusive: Intel’s new Vaunt smart glasses actually look good – The Verge [ANN] Ravencoin [RVN] PoW | New Algo | CPU/GPU Mining | No PreMine | Fair Launch Ravencoin – A digital peer to peer network […]

The post Rockets & Ravens | User Error 45 first appeared on Jupiter Broadcasting.

]]>

RSS Feeds:

MP3 Feed | Video Feed | iTunes Feed

Become a supporter on Patreon:

Patreon

Links

The post Rockets & Ravens | User Error 45 first appeared on Jupiter Broadcasting.

]]>
Holding Hospitals Hostage | TechSNAP 261 https://original.jupiterbroadcasting.net/98616/holding-hospitals-hostage-techsnap-261/ Thu, 07 Apr 2016 08:44:35 +0000 https://original.jupiterbroadcasting.net/?p=98616 Find out about another hospital that accidentally took advantage of free encryption, researchers turn up a DDoS on the root DNS servers & the password test you never want to take. Plus your batch of networking questions, our answers & a packed round up! Thanks to: Get Paid to Write for DigitalOcean Direct Download: HD […]

The post Holding Hospitals Hostage | TechSNAP 261 first appeared on Jupiter Broadcasting.

]]>

post thumbnail

Find out about another hospital that accidentally took advantage of free encryption, researchers turn up a DDoS on the root DNS servers & the password test you never want to take.

Plus your batch of networking questions, our answers & a packed round up!

Thanks to:


DigitalOcean


Ting


iXsystems

Direct Download:

HD Video | Mobile Video | MP3 Audio | OGG Audio | YouTube | HD Torrent | Mobile Torrent

RSS Feeds:

HD Video Feed | Mobile Video Feed | MP3 Audio Feed | Ogg Audio Feed | iTunes Feed | Torrent Feed

Become a supporter on Patreon:

Patreon

Show Notes:

Researchers at VeriSign investigate DDoS on root DNS servers

  • Researchers from VeriSign, the company that runs the .com and .net registries, and operations 2 of the 13 critically import root DNS servers, will be giving a talk at a conference detailing their investigation into the attack
  • Their findings suggest the attack, which took place in November of 2015, was not directed at the root name servers directly, but was an attempt to down two chinese websites
  • The attack had some interesting patterns, likely caused by design decisions and mistakes made by the programmer of the botnet that was used in the attack
  • The provide a video showing a breakdown of the attack
  • It was interesting to learn that Randall Munroe (of XKCD fame) actually came up with the best way to visualize the distribution of IP addresses, with a grid where sequential numbers are in adjacent squares
  • Only IP addresses in the first 128 /8 netbooks were used. The use of 128/8 specifically suggests an less than or equal, rather than an equal was used during the comparison of IP addresses
  • It is not clear why a larger set of addresses were not used
  • The attack seemed to use 3 or 4 different groups of bots, sending spoofed DNS requests
  • Two of the larger groups of bots sequentially cycled through the 2.0.0.0/8 through 19.0.0.0/8 subnets at different speeds
  • Attacks were not seen from the 10.0.0.0/8 and 127.0.0.0/8 networks, for obvious reasons
  • However, a delay in the attacks sourced from 11.0.0.0/8 suggests that the botnet attempted to use the entire 10 block, but the packets just never left the source networks
  • “The researchers also note that Response Rate Limiting was an effective mitigation in countering up to 60 percent of attack traffic. RRL is a feature in the DNS protocol that mitigates amplifications attacks where spoofed DNS queries are used to target victims in large-scale DDoS attacks.”
  • “In addition to RRL, the researchers said attack traffic was easily filterable and through filtering were able to drop response traffic for the attack queries, leaving normal traffic untouched. One of the limitations with this approach is that it’s a manual process”

Virus hits Medstar hospital network, Hospital forced to shutdown systems

  • “The health system took down some its computers to prevent the virus from spreading, but it’s not clear how many computers — or hospitals — are affected”
  • “A statement by the health system said that all facilities remain open, and that there was “no evidence of compromised information.””
  • “The not-for-profit healthcare system operates ten hospitals across the Washington and Baltimore region, with more than a hundred outpatient health facilities. According to the system’s website, it has more than 31,000 employees and serves hundreds of thousands of patients annually.”
  • “One visitor to the hospital told ZDNet that staff switched the computers off after learning about the virus. The person, who was visiting a patient in one of the healthcare system’s Washington DC hospital, said the computers were powered off for more than an hour, with all patient orders lost, the person said.”
  • “It’s not clear exactly what kind of malware was used in Monday’s cyberattack. A spokesperson for MedStar Health did not immediately respond to a request for comment.”
  • An FBI spokesperson confirmed that it was “aware of the incident and is looking into the nature and scope of the matter.”
  • Additional Coverage: Threat Post
  • After a few days, the medical network was recovering
  • “The healthcare provider said the attack forced it to shut down its three main clinical information systems, prevented staff from reviewing patient medical records, and barred patients from making medical appointments. In a statement issued Wednesday, it said that no patient data had been compromised and systems were slowly coming back online.”
  • “Clinicians are now able to review medical records and submit orders via our electronic health records. Restoration of additional clinical systems continues with priority given to those related directly to patient care”
  • “While the hospital still won’t officially confirm the attacks were ransomware related, The Washington Post along with other news outlets are reporting that employees at the hospital received pop-up messages on their computer screens seeking payment of 45 Bitcoins ($19,000) in exchange for a digital key that would decrypt data”
  • “The MedStar cyberattack is one of many hospitals in recent months targeted by hackers. Last week, Kentucky-based Methodist Hospital paid ransomware attackers to unlock its hospital system after crypto-ransomware brought the hospital’s operations to a grinding halt. Earlier this year Los Angeles-based Hollywood Presbyterian Medical Center paid 40 Bitcoin ($17,000) to attackers that locked down access to the hospital’s electronic medical records system and other computer systems using crypto-ransomware.”
  • As long as hospitals continue to pay out, this will only grow to be a worse problem
  • “Medical facilities don’t give security the same type of attention that other verticals do,” said Craig Williams, senior technical leader for Cisco Talos. “They are there to heal people and cure the sick. Their first priority is not to take care of an IT environment. As a result it’s likely the hackers have been out there for quite some time and realized that there are a lot (healthcare) sites that have a lot of base vulnerabilities.”
  • As you might expect: 1400 vulnerabilities to remain unpatched in medical supply system
  • Additional Coverage
  • In related news:
  • Canadian hospital website compromised serves up the Angler malware kit to visitors
  • The site is for a hospital in a small city that serves a mostly rural area. Happens to be where I grew up, and the hospital I was born in
  • The hospital site is run on Joomla, and is running version 2.5.6, which has many known vulnerabilities. The latest version of Joomla is 3.4.8
  • “Like many site hacks, this injection is conditional and will appear only once for a particular IP address. For instance, the site administrator who often visits the page will only see a clean version of it, while first timers will get served the exploit and malware.”
  • The obvious targets are “staff, patients and their families and visitors, as well as students”
  • The hospital became a teaching facility for McMaster University’s Faculty of Health Sciences in 2009
  • “The particular strain of ransomware dropped here is TeslaCrypt which demands $500 to recover your personal files it has encrypted. That payment doubles after a week.”

CNBC Password Tester — How not to do it

  • CNBC has a post about constructing secure passwords
  • The basic idea was that you submit your password, and it tells you how strong it is
  • There are obvious problems with this idea. Why are you giving out your password anyway?
  • Of course, the CNBC site is served in plain text (which is fine for a news site), but it means your password is sent to them in the clear
  • Worse, they had the site adding all of the submitted passwords to a google spreadsheet, also in the clear
  • Because the password was submitted as a GET variable, and was in the URL, it was also included in the referral information sent to all of the advertising networks in the CNBC site, including DoubleClick, ScoreCardResearch, something hosted at Amazon AWS, and any other widgets on the site (Facebook, Gigya)
  • If you actually did want to build a tool like this, at least use javascript to perform the calculations on the users’ device and never transmit their passwords
  • Of course, users should never type the password into another website. This is the definition if a phishing attack
  • The page has since been removed
  • Additional Coverage

Feedback:


Round Up:


The post Holding Hospitals Hostage | TechSNAP 261 first appeared on Jupiter Broadcasting.

]]>
Microsoft Patents Exposed | Tech Talk Today 9 https://original.jupiterbroadcasting.net/60007/microsoft-patents-exposed-tech-talk-today-9/ Mon, 16 Jun 2014 09:29:53 +0000 https://original.jupiterbroadcasting.net/?p=60007 Finally Microsoft’s patent war chest against Android has been revealed, and we dig in. Plus Apple, Cisco, and AT&T join Microsoft in a pushback against US government overreach, Steam summer sale rumors, and more! Direct Download: MP3 Audio | OGG Audio | Video | HD Video | Torrent | YouTube RSS Feeds: MP3 Feed | […]

The post Microsoft Patents Exposed | Tech Talk Today 9 first appeared on Jupiter Broadcasting.

]]>

post thumbnail

Finally Microsoft’s patent war chest against Android has been revealed, and we dig in.

Plus Apple, Cisco, and AT&T join Microsoft in a pushback against US government overreach, Steam summer sale rumors, and more!

Direct Download:

MP3 Audio | OGG Audio | Video | HD Video | Torrent | YouTube

RSS Feeds:

MP3 Feed | OGG Feed | iTunes Feed | Video Feed | Torrent Feed

Become a Tech Talk Today supporter on Patreon:

Foo

Show Notes:

— Headlines —

Apple, Cisco, AT&T join Microsoft in fight against global search warrant

Apple, Cisco and AT&T all filed amicus curiae briefs on Friday supporting Microsoft in its appeal of a decision requiring it to hand over data about an Irish customer to U.S. law enforcement officials. Verizon filed an amicus brief on Microsoft’s behalf on Tuesday.

In this case, U.S. magistrate judge James Francis IV decided that pursuant to the Stored Communication Act, Microsoft must provide law enforcement officials with the contents of an Irish customer’s email, which is stored on servers located in Dublin, Ireland. Microsoft and its peers argue the warrant defies both the Stored Communications Act and numerous international law constructs, including treaties the United States has in place with other countries — Ireland among them — regarding how to handle requests for data about each others’ citizens.

Chinese gov’t reveals Microsoft’s secret list of Android-killer patents

Microsoft has held to the line that it has loads of patents that are infringed by Google’s Android operating system. “Licensing is the solution,” wrote the company’s head IP honcho in 2011, explaining Microsoft’s decision to sue Barnes & Noble’s Android-powered Nook reader.

For the most part, they’ve remained secret. That’s led to a kind of parlor game where industry observers have speculated about what patents Microsoft might be holding over Android.

A list of hundreds of patents that Microsoft believes entitle it to royalties over Android phones, and perhaps smartphones in general, has been published on a Chinese language website.

The patents Microsoft plans to wield against Android describe a range of technologies.

They include lots of technologies developed at Microsoft, as well as patents that Microsoft acquired by participating in the Rockstar Consortium, which spent $4.5 billion on patents that were auctioned off after the Nortel bankruptcy.

The Chinese agency published two lists on a Chinese-language webpage

The longer list is divided into three sections: 73 patents that are said to be “standard-essential patents,” or SEPs, implemented in smartphones generally, followed by 127 patents that Microsoft says are implemented in Android. The final section includes another section of “non-SEP” assets, which includes 68 patent applications and 42 issued patents.

Many newer and previously unrevealed patents, like 8,255,379 “Customer Local Search,” 5,813,013 “Representing Recurring Events,” and 6,999,047 “Locating and tracking a user in a wireless network through environmentally profiled data.”

Steam Summer Sale – Start Date Leaked!

According to a leaked listing posted on “Neogaf” this year’s Steam Summer Sale will begin on June 19th and end on June 30th leaving most Steam users no more than a week.

Now none of these dates or listings have been confirmed however they do appear to coincide with recent posts on both the Stream’s Developer Network and also fit in with Valve’s International DOTA 2 Championship Schedule, not only that but other Game Sale sites such as “GreenManGaming” and “GOG (Good Old Games)” have started to have massive clear-out sales and bundles

— Security Update —

Massive security flaws allowed for Stratfor hack, leaked report reveals

In December 2011, a group of skilled hackers broke into the network of Strategic Forecasting, Inc. (Stratfor), compromising the personal data of some 860,000 customers, including a former U.S. vice president, CIA director, and secretary of state, among others.
The hackers, known collectively as AntiSec, exfiltrated approximately 60,000 credit card numbers and associated data, resulting in a reported $700,000 in fraudulent charges. Roughly 5 million internal emails were obtained by the hackers and later released by the whistleblower organization WikiLeaks as the “Global Intelligence Files.”

Based on confidential internal documents obtained by the Daily Dot and Motherboard, Stratfor employed substandard cybersecurity prior to the infiltration that left thousands of customers vulnerable to potential identity theft.

According to the documents, Stratfor engaged Verizon Business/Cybertrust to “conduct a forensic investigation” into the breach on Dec. 30, 2011
In a 66-page report filed Feb. 15, 2012, Verizon concludes in painful detail that Stratfor had insufficient control over remote access to vital systems, and that those systems were not protected by a firewall and lacked proper file integrity-monitoring.

For starters, at the time of the attack, no password management policy existed within Stratfor. Passwords were at times shared between employees, and nothing prevented the same passwords from being used on multiple devices.

“Users commonly use the same password to access email as the password to remotely access a system containing sensitive information,” the report states.

According to Verizon, no anti-virus software had been deployed on any of the examined systems, which left Stratfor “wide open to not only the more sophisticated and customized hacker attempts, but also to other viruses.”

Another “significant factor” in the breach was the design of Stratfor’s e-commerce environment, which facilitated the electronic transfer of payments by its customers. According to the report, this system was accessible, needlessly, from anywhere within the company’s network, “as well as the Internet directly.”

UglyGorilla Hack of U.S. Utility Exposes Cyberwar Threat

Somewhere in China, a man typed his user name, “ghost,” and password, “hijack,” and proceeded to rifle the computers of a utility in the Northeastern U.S.

He plucked schematics of its pipelines. He copied security-guard patrol memos. He sought access to systems that regulate the flow of natural gas. He cruised channels where keystrokes could cut off a city’s heat, or make a pipeline explode.

That didn’t appear to be his intention, and neither was economic espionage. While he was one of the Chinese officers the U.S. charged last month with infiltrating computers to steal corporate secrets, this raid was different. The hacker called UglyGorilla invaded the utility on what was probably a scouting mission, looking for information China could use to wage war.

UglyGorilla is one of many hackers the FBI has watched. Agents have recorded raids by other operatives in China and in Russia and Iran, all apparently looking for security weaknesses that could be employed to disrupt the delivery of water and electricity and impede other functions critical to the economy, according to former intelligence officials with knowledge of the investigation.

UglyGorilla’s surveillance sortie was one of dozens conducted on natural gas pipelines and electric utilities by People’s Liberation Army Unit 61398 over at least 14 months in 2012 and 2013, according to documents obtained by Bloomberg News and people involved in the investigations but who asked not to be named because they weren’t authorized to speak publicly.

Support Tech Talk Today creating DAILY PODCASTS

Hosts:

Chris:

The post Microsoft Patents Exposed | Tech Talk Today 9 first appeared on Jupiter Broadcasting.

]]>
Dick’s War | Unfilter 42 https://original.jupiterbroadcasting.net/33946/dicks-war-unfilter-42/ Wed, 20 Mar 2013 22:31:46 +0000 https://original.jupiterbroadcasting.net/?p=33946 Armed with a new study, and a revealing documentary of Dick Cheney we’ll look back at the scandals and lies that led the the 2003 invasion of Iraq.

The post Dick’s War | Unfilter 42 first appeared on Jupiter Broadcasting.

]]>

post thumbnail

Its been 10 years since the invasion of Iraq, armed with a new study, and a revealing documentary of Dick Cheney we’ll look back at the scandals and lies that led the the 2003 invasion of Iraq.

We’ll look back at the individuals, the scandals, and the lies that led the United Stated into the 2003 invasion of Iraq.

Plus why you should care about the outrageous situation in Cyprus, the good news for bitcoin investors, details South Korea’s purported Cyber attack, your feedback, and much much more.

On this week’s episode of, Unfilter.

Direct Download:

HD Video | Mobile Video | MP3 Audio | OGG Audio | Torrent | YouTube

RSS Feeds:

HD Feed | Mobile Feed | MP3 Feed | OGG Feed | HD Torrent | Mobile Torrent | iTunes

Become an Unfilter Supporter:

— Show Notes —


Cybersecurity Maintains the Headlines

Kristie Lu Stout talks to Seoul resident and KBS employee Luke Cleary about the massive computer outage in South Korea

Mr. Lew pressed his Chinese counterparts on what is a new agenda item: U.S. claims that Chinese state-sponsored entities are hacking into the computer systems of U.S. companies to steal corporate secrets.


Koch Brothers Mulling L.A. Times Bid, other Tribune newspapers

Charles and David Koch, two of the world’s richest men, are interested in Tribune’s newspaper assets, which include the Los Angeles Times and the Chicago Tribune, according to sources familiar with situation.


Thanks for Supporting Unfilter:

  • David B @ 13.33
  • Walter P @ 13.33
  • Christopher A @ 13.33
  • Randall K @ 13.33
  • Dustin S. @ 13.33
  • Jouko V @ 13.33
  • Matthew C @ 13.33
  • Jose F
  • Supercarrot
  • Luigi
  • Sacha D
  • Evan
  • Daniel R
  • Lee R
  • James L – Using a PayPal specific addy, be sure to check it for the Supporters Show
  • Justin E
  • Mr D Ford
  • Daniel G
  • Nicholas S

James Wrote:

I appreciate your “special offer” lower rate subscription, but I joined with the 13.33 one anyway because when I think about it, I can obviously afford it, and I think the show is really valuable.

It’s hard to reconcile the cost with what other “mass media” supplies, but as you say when it’s a very small audience, the economies of scale just don’t apply…. so while I’m subscribing because of Unfilter, I support all of your shows.

As for Unfilter, obviously I am not in the US… and as much as I would like it I don’t think you can really do world news on the show, but a slightly more international perspective would be interesting. If I can help with clips from the UK or access to media that’s IP blocked, let me know.

James

  • Thanks to our 55 Unfilter supporters!

  • Supporter perk: Downloadable Pre and Post show. Extra clips, music, hijinks, and off the cuff comments. The ultimate Unfiltered experience.


Iraq 10 years Later

Stunning new statistics from the Watson Institute at Brown University’s ‘Costs of War’ report show that the decade-long War in Iraq has resulted in at least 189,000 deaths and cost more than $2 trillion. Expenses, including interest, could top $6 trillion through 2053.

The 10-year anniversary of the US-led invasion of Iraq marks a striking failure of accountability on the part of the United States, the United Kingdom and Iraq itself, Human Rights Watch said today.

After the film’s whirlwind exploration of Cheney’s 40 long years of public service, what lingers in the air is this same spooky realization that despite everything – the Iraq War, the absence of WMD’s, the warrantless surveillance, the discoveries at Abu Ghraib – Cheney regrets nothing. “If I had to do it over again,” Cheney says at the end of the film. “I’d do it over in a minute.”

Dick Cheney, in a 1994 interview, lists countless reasons for America not to have invaded Baghdad. Funny how every reason still bears heavy relevance to our position there now.


Cyprus’ Bad Week

That panic forced Cyprus to declare a bank holiday. Then it killed the plan to tax bank deposits, with parliament voting it down. Global stock markets, which had dipped on the initial news of the bailout plan, leveled out as if the whole thing was a false alarm.

At first blush, it seems only fair that the Russians pony up. After all, the tens of billions of euros that Russians have parked in Cypriot bank accounts helped trigger the island’s financial crisis. And Moscow protested loudly when some European leaders wanted to levy stiff taxes on Cypriot bank accounts, a plan that now has been scuppered. Cyprus now is almost €6 billion ($7.7 billion) short of the money it needs to cut a deal with the so-called troika of European creditors and the International Monetary Fund.

But counting on aid from Russia is a bad idea for Cyprus—and for the rest of Europe. Cyprus has already gotten a €2.5 billion ($3.2 billion) loan from Moscow, and it can’t borrow more without greatly increasing its debt ceiling, something the troika won’t permit. Instead of offering a loan, Russia might ask for rights to natural gas fields in the Mediterranean south of Cyprus. Europe already depends heavily on Russia for natural gas, and extending Russia’s control over future supplies would almost certainly boost gas prices across the region, Athanios Orphanides, a former governor of the Central Bank of Cyprus, told Bloomberg Television this morning. “It would be a huge economic cost,” he said.

Email from Glibby

Bitcoin BOOMS this Week

One of the side effects of the Eurozone crisis could be that some people turn to the deregulated, decentralised currency when they otherwise may not have even considered it. The events in Cyprus this past week – where it looked like the government, in desperate need of money, had planned to impose a levy on savings – seemed to have coincided with a slight spike in downloads of Bitcoin mobile apps in Spain, a country with its own wobbly economic situation.

  • Al Gore stirs a rally on Twitter after comments at PYMNTS Innovation Project 2013.

Al Gore:“ I am a big fan of Bitcoin” @algore #ip2013

Al Gore brilliant on virtual currencies “what could go wrong?” Also impressed that he can speak intelligently about Bitcoin. #ip2013

Al Gore: “Regulation of money supply needs to be depoliticized…. especially as it applies to virtual currencies”.


U.N. investigator: U.S. drone strikes violate Pakistan sovereignty

After days of meeting with Pakistani officials, the United Nations official investigating Washington’s global campaign of drone strikes attacked the legal and strategic basis for the robotic war in its biggest battlefield. And he raised doubts over whether Americans operating the drones can actually distinguish terrorists from average Pakistanis.

+ Not about Changing US Policy

Though Emmerson’s findings likely won’t change U.S. policy, Imtiaz Gul, a Pakistani security analyst who provided Emmerson with case studies of civilian victims of drone strikes, said the U.N. investigator’s research does shed light on civilian victims of the U.S. drone program and highlights the risky precedent set by carrying out missile strikes on foreign territory without that government’s consent.

“It’s not about forcing the U.S. to change its policy,” Gul said. “It’s more about educating on an issue that could create dangerous precedence for other countries.”


Washington state names “pot czar” after legalizing marijuana

Prominent policy analyst and UCLA professor Mark Kleiman has won Washington State’s consulting contract on I–502 implementation.

Reformers have had a “love/hate” relationship with Kleiman over the years. He supports some of our issues, like marijuana legalization — sort of.

He acknowledges the impact of prohibition in increasing the harmfulness of addictive drugs to their users, but states as nearly a fact the assumption that overall harm would go up with legalization nonetheless — while admonishing the rest of us not to make assumptions about the positive effects of even just marijuana legalization.

But Kleiman harshed the CNN host’s giggly buzz by not laughing back, and then taking a serious tone: “No, because I think whether the people on our team have used cannabis at one point or another … is irrelevant to the job we’ve been chosen to do.”


Feedback:

If you’re a Supporter check your inbox, here’s a taste of what we covered:

Leave us a Voicemail:

1.425.312.1756

Follow the Us:

The post Dick’s War | Unfilter 42 first appeared on Jupiter Broadcasting.

]]>
Skype Exposes Pirates | TechSNAP 29 https://original.jupiterbroadcasting.net/13262/skype-exposes-pirates-techsnap-29/ Thu, 27 Oct 2011 18:43:12 +0000 https://original.jupiterbroadcasting.net/?p=13262 Researches have developed a way to tie your file sharing to your Skype account. We’ll share the details on how this works, and what you can do to prevent it!

The post Skype Exposes Pirates | TechSNAP 29 first appeared on Jupiter Broadcasting.

]]>

post thumbnail

Coming up on this week’s TechSNAP…

Researches have developed a way to tie your file sharing to your Skype account. We’ll share the details on how this works, and what you can do to prevent being tracked!

Plus we cover the Ultimate way to host your own email, and what happened when Chinese hackers took control of US Satellites!

All that and more, on this week’s episode of TechSNAP!

Direct Download Links:

HD Video | Large Video | Mobile Video | MP3 Audio | OGG Audio | YouTube

Subscribe via RSS and iTunes:


[ad#shownotes]

Show Notes:

Audible.com:

Suspected Chinese Military Hackers take control of US Satellites

  • On four separate occasions during 2007 and 2008 US satellites were hijacked by way of their ground control stations.
  • The effected satellites were Landsat–7 (Terrain Mapping and Satellite Photography, example 1 example 2) and Terra AM–1 (Climate and Environmental Monitoring, 2010 Hurricane Karl)
  • While the US does not directly accuse the Chinese government in writing, these types of actions are consistent with known war plans that involve disabling communications, command and control, and GPS satellites as a precursor to war.
  • In one incident with NASA’s Terra AM–1, “the responsible party achieved all steps required to command the satellite,” however the attackers never actually took control of the satellite.
  • It was not until the 2008 investigation that the previous compromises in 2007 were detected
  • This raises an important question, are the US military and other NATO members, too reliant of satellite communications and GPS?
  • In a recent NATO exercise called ‘Joint Warrior’, it was planned to jam GPS satellite signals, however the jamming was suspended after pressure on the governments over civilian safety concerns. Story

Researchers develop a procedure to link Skype users to their Bittorrent downloads

  • The tools developed by the researchers at New York University allow any to determine a strong correlation between bittorrent downloads and a specific skype user.
  • Importantly, unlike RIAA/MPAA law suites, the researchers consider the possibility of false positives because of multiple users behind NAT.
  • The researchers resolve this issue by probing both the skype and bittorrent clients after a correlation is suspected. By generating a response from both clients at nearly the same time and comparing the IP ID (similar to a sequence number) of the packets, if the ID numbers are close together, than it is extremely likely that the response was generated by the same physical machine. If the IDs are very different, then it is likely that the Skype and BitTorrent users are on different machines, and there is no correlation between them.
  • This same technique could be made to work with other VoIP and P2P applications, and could be used to gather enough evidence to conclusively prove a bittorrent user’s identity.
  • This situation can be mitigated by using the feature of some OS’s that randomizes the IP ID to prevent such tracking. (net.inet.ip.random_id in FreeBSD, separate ‘scrub random-id’ feature in the BSD PF firewall)
  • The discovery could also be prevented by fixing the skype client such that it will not reply with its IP address if the privacy settings do not allow calls from that user. The current system employed by the researches does not actually place a call to the user, just tricks skype into thinking that a call will be placed, and skype then leaks the sensitive information by returning its IP address or initiating a connection to the attacker.
  • Read the full research paper

NASDAQ web application Directors Desk hacked

  • Directors Desk is a web application designed to allow executives to share documents and other sensitive information
  • When NASDAQ was hacked in February, they did not believe that any customer data was stolen
  • The attackers implanted spyware into the Directors Desk application and were able to spy on the sensitive documents of publicly traded companies as they were passed back and forth through the system
  • This is another example of the Advanced Persistent Threat (APT) as we saw with the RSA and South Korea Telecom hacks, where the attackers went after a service provider (in his case NASDAQ) to compromise the ultimate targets, the publicly traded companies and their sensitive documents.
  • It is not known what if any protection or encryption systems were part of Directors Desk, but it seems that the application was obviously lacking some important security measures, including an Intrusion Detection System that would have detected the modifications to the application.

SEC says companies may need to disclose cyber attacks in regulatory filings

  • The new guidance from the SEC spells out some of the things that companies may need to disclose to investors and others, depending upon their situation.
  • Some of the potential items companies may need to disclose include:
  • Discussion of aspects of the registrant’s business or operations that give rise to material cybersecurity risks and the potential costs and consequences
  • To the extent the registrant outsources functions that have material cyber security risks, description of those functions and how the registrant addresses those risks
  • Description of cyber incidents experienced by the registrant that are individually, or in the aggregate, material, including a description of the costs and other consequences
  • Risks related to cyber incidents that may remain undetected for an extended period
  • “For example, if material intellectual property is stolen in a cyber attack, and the effects of the theft are reasonably likely to be material, the registrant should describe the property that was stolen and the effect of the attack on its results of operations, liquidity, and financial condition and whether the attack would cause reported financial information not to be indicative of future operating results or financial condition,” the statement says.
  • From the SEC guidance: The federal securities laws, in part, are designed to elicit disclosure of timely, comprehensive, and accurate information about risks and events that a reasonable investor would consider important to an investment decision”
  • CF Disclosure Guidance: Topic No. 2 – Cybersecurity

Feedback:

It is definitely advantageous to own the domain that your email address is on. On top of looking more professional than a hotmail, or even gmail address, it also allows you to choose your host and have full control over everything. There are some caveats though, of course you must remember to renew your domain name, else your email stops working (just ask Chris about that one), you also have to be careful about picking where to host your domain, having your site or email hosted by a less reputable service can result in your domain being included on blacklists and stopping delivery of your mail to some users. The biggest problem with hosting your own email, from your home, is that you must keep the server up 24/7, and it must have a reasonable static IP address. If you are going to host from your home, I recommend you get a ‘backup mx’ service, a backup mail server that will collect mail sent to you while you are offline, and then forward it to your server when it is back up. Even if you are using a dedicated server or VPS, this is important, because email is usually the most critical service on your server. The other major issue with hosting your email from home, is that most ISPs block port 25 inbound and outbound, to prevent infected computers from sending spam. This means that you will not be able to send or receive email to other servers. Usually your ISP will require you to have a more expensive business class connection with a dedicated static IP address in order to allow traffic on port 25. Also, a great many spam filtering systems, such as spamassassin, use blacklists that contain the IP ranges of all consumer/home Internet providers, designed to stop spam from virus infected machines, because email should not be send from individual client machines, but through the ISP or Domain email server.

Round Up:

The post Skype Exposes Pirates | TechSNAP 29 first appeared on Jupiter Broadcasting.

]]>