corruption – Jupiter Broadcasting

Linux Action News 233

Wes Payne — Wed, 23 Mar 2022 17:30:00 +0000

Show Notes: linuxactionnews.com/233

The post Linux Action News 233 first appeared on Jupiter Broadcasting.

Donna’s Closet | Unfilter 258

chris — Wed, 08 Nov 2017 20:00:30 +0000

RSS Feeds:

Video Feed | MP3 Feed | HD Torrent | iTunes

Become an Unfilter supporter on Patreon:

— Show Notes —

Links:

The post Donna's Closet | Unfilter 258 first appeared on Jupiter Broadcasting.

Assange’s October Dud | Unfilter 207

chris — Tue, 04 Oct 2016 21:35:20 +0000

RSS Feeds:

Become an Unfilter supporter on Patreon:

— Show Notes —

Links:

The post Assange's October Dud | Unfilter 207 first appeared on Jupiter Broadcasting.

New York Pressure Cooker | Unfilter 205

chris — Tue, 20 Sep 2016 22:46:24 +0000

RSS Feeds:

Become an Unfilter supporter on Patreon:

— Show Notes —

Links:

The post New York Pressure Cooker | Unfilter 205 first appeared on Jupiter Broadcasting.

Billions for Baghdad | Unfilter 165

chris — Wed, 04 Nov 2015 20:34:02 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

It’s revealed that the US government is sending billions of dollars to Iraq’s central bank, which is winding up in the hands of ISIS. We cover the latest on this story. Then we follow the money on some major defense spending & bust the week’s bogus news.

Why the rest of the 2016 presidential run will be filled with softball questions.

And you won’t believe how bad the TSA failed their latest security test, a frank discussion on media biases & we wrap it all up with a high note.

Direct Download:

Video | MP3 Audio | OGG Audio | Torrent | YouTube

RSS Feeds:

Become an Unfilter supporter on Patreon:

Show Notes:

— Episode Links —

The post Billions for Baghdad | Unfilter 165 first appeared on Jupiter Broadcasting.

EXTenuating Circumstances | TechSNAP 215

chris — Thu, 21 May 2015 15:30:16 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

Researches have uncovered a weakness in almost all Internet encryption. We’ll explain what LogJam is, how to protect yourself & what the cause is.

Plus Linux gets bit by a filesystem corruption bug, passport id thieves, a great batch of questions & much, much more!

Thanks to:

Get Paid to Write for DigitalOcean

Direct Download:

RSS Feeds:

Become a supporter on Patreon:

— Show Notes: —

LogJam: How Diffie-Hellman Fails in Practice

Researches have uncovered several weaknesses in how the Diffie-Hellman key exchange has been deployed.
Diffie-Hellman key exchange is a popular cryptographic algorithm that allows Internet protocols to agree on a shared key and negotiate a secure connection. It is fundamental to many protocols including HTTPS, SSH, IPsec, SMTPS, and protocols that rely on TLS.
The vulnerability affects an estimated 8.4 percent of the top one million websites and a slightly bigger percentage of mail servers populating the IPv4 address space, the researchers said.
The weakness is the result of export restrictions the US government mandated in the 1990s on US developers who wanted their software to be used abroad.
The regime was established by the Clinton administration so the FBI and other agencies could break the encryption used by foreign entities.
Attackers with the ability to monitor the connection between an end user and a Diffie-Hellman-enabled server that supports the export cipher can inject a special payload into the traffic that downgrades encrypted connections to use extremely weak 512-bit key material.
Using precomputed data prepared ahead of time, the attackers can then deduce the encryption key negotiated between the two parties.
Ironically, Diffie-Hellman is supposed to provide an additional layer of protection because it allows the two connected parties to constantly refresh the cryptographic key securing Web or e-mail sessions.
The so-called perfect forward secrecy that Diffie-Hellman makes possible significantly increases the work of eavesdropping because attackers must obtain the key anew each time it changes, as opposed to only once with other encryption schemes, such as those based on RSA keys.
Logjam is significant because it shows that ephemeral Diffie-Hellman—or DHE—can be fatal to TLS when the export-grade ciphers are supported. Logjam is reminiscent of the FREAK attack that also allowed attackers to downgrade HTTPS connections to 512-bit cryptography.
If you have a web or mail server, you should disable support for export cipher suites and generate a unique 2048-bit Diffie-Hellman group. We have published a Guide to Deploying Diffie-Hellman for TLS with step-by-step instructions. If you use SSH, you should upgrade both your server and client installations to the most recent version of OpenSSH, which prefers Elliptic-Curve Diffie-Hellman Key Exchange.
Make sure you have the most recent version of your browser installed, and check for updates frequently. Google Chrome (including Android Browser), Mozilla Firefox, Microsoft Internet Explorer, and Apple Safari are all deploying fixes for the Logjam attack.
Make sure any TLS libraries you use are up-to-date and that you reject Diffie-Hellman Groups smaller than 1024-bit.
PDF Report: Imperfect Forward Secrecy:
How Diffie-Hellman Fails in Practice
Additional Coverage: ArsTechnica
Logjam Attack Proof of Concept Demonstrations
How 1990s Encryption Backdoors Put Today’s Internet In Jeopardy
You can disable all short DH key lengths in Firefox’s about:config

US Passport Agency contractor stole applicants’ data to steal their identities

Three women from Houston, Texas, stand accused of engaging in an identity theft scheme in which one of them, a contract employee of the Department of State Passport Agency, was in charge of stealing personally identifiable information of persons applying for a passport.
The information was then used to create counterfeit identification documents, which the other two women would use to successfully impersonate the affected individuals in order to fraudulently obtain commercial lines of credit and to purchase iPhones, iPads and other goods online.
This scheme went on for over five years.
No direct details on how the contractors captured the data in question. But we can make a reasonable guess based on recent IT security policy changes.
According to The Washington Post, the US Passport Agency has decided last month to ban both federal employees and private contractors from bringing devices equipped with a camera into the offices where they review and process requests for passports.
Apparently, this decision was influenced by the Houston incident, indicating that McClendon likely took pictures of private information on passports.
Jim Gogolinski, Senior Threats Researcher at Trend Micro, wrote a helpful overview of the malicious insider problem, and offered some advice on how to prevent and mitigate the insider threat:
Jim’s basic premises is, the insider threat can be broken down into three issues: why do people within become threats, what damage can they do, and how these can be prevented.
Insider threats 101: The threat within

New Linux kernel corrupting file systems

It appears that the current Linux 4.0.x kernel is plagued by an EXT4 file-system corruption issue. If there’s any positive note out of the situation, it seems to mostly affect EXT4 Linux RAID users.
There have been several reports of people affected by an ext4 data corruption bug in Linux 4.0.2.
All EXT4 RAID0 users on the Linux 4.0.x kernel or current Linux 4.1 Git code are advised to downgrade until the next 4.1 release candidate or 4.0.x stable release otherwise you stand good chances of hosing your file-system.
It also looks like if dropping the discard mount option you will also avoid being hit by this serious issue. This isn’t a problem for Linux users on distributions like RHEL, Ubuntu, and other fixed-release distributions that don’t tend to update major versions of their kernel post-release.
The issue was caused by an MD commit late into the Linux 4.0 kernel cycle, a.k.a. a commit that was “md/raid0: fix bug with chunksize not a power of 2..”
The commit was by SUSE’s Neil Brown.
Eric Work has devised a small fix to address the corruption problem, but for now it’s only present within the MD Git tree.
kernel/git/torvalds/linux.git – Linux kernel source tree
#785672 – Critical ext4 data corruption bug – Debian Bug report logs

Feedback:

Round-Up:

The post EXTenuating Circumstances | TechSNAP 215 first appeared on Jupiter Broadcasting.

Corrupt Accomplices | Tech Talk Today 174

chris — Thu, 21 May 2015 09:53:39 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

Spy agencies target mobile phones, app stores to implant spyware & the extent of the effort is shocking. Linux 4.0 has a EXT4 corruption bug, YouTube brings the fight to Twitch & Netflix has some big updates.

Then we have a Kickstarter of the week to help you men lucid dream, the penis way.

Direct Download:

RSS Feeds:

Become a supporter on Patreon

Show Notes:

Spy agencies target mobile phones, app stores to implant spyware

Electronic intelligence agencies began targeting UC Browser — a massively popular app in China and India with growing use in North America — in late 2011 after discovering it leaked revealing details about its half-billion users.

Their goal, in tapping into UC Browser and also looking for larger app store vulnerabilities, was to collect data on suspected terrorists and other intelligence targets — and, in some cases, implant spyware on targeted smartphones.

The 2012 document shows that the surveillance agencies exploited the weaknesses in certain mobile apps in pursuit of their national security interests, but it appears they didn’t alert the companies or the public to these weaknesses. That potentially put millions of users in danger of their data being accessed by other governments’ agencies, hackers or criminals.

NSA Planned to Hijack Google App Store to Hack Smartphones – The Intercept

Linux 4.0 Has a File-System Corruption Problem, RAID Users Warned

For the past few days kernel developers and Linux users have been investigating an EXT4 file-system corruption issue affecting the latest stable kernel series (Linux 4.0) and the current development code (Linux 4.1). It turns out that Linux users running the EXT4 file-system on a RAID0 configuration can easily destroy their file-system with this newest “stable” kernel. The cause and fix have materialized but it hasn’t yet worked its way out into the mainline kernel, thus users should be warned before quickly upgrading to the new kernel on systems with EXT4 and RAID0.

Apparently this was fixed in the 4.0.3 Kernel. The current release is 4.0.4.

YouTube eyes Twitch user base, adds 60 FPS live streams with HTML5 playback | Ars Technica

The HTML5 player will not only save users from the CPU and batter__y-eating Flash player, but will also enable variable speed playback, allowing users to “skip backward in a stream while it’s live and watch at 1.5x or 2x speed to catch back up.”

Netflix To Roll Out A New, More Immersive Web Interface Starting In June | TechCrunch

Netflix confirms today that it will roll out a new user interface on the web to all users worldwide beginning next month. A number of Netflix customers are already seeing the updated look-and-feel, however, according to various reports. The interface, which was previously demonstrated at CES and Mobile World Congress, brings the design of Netflix’s website more in line with what users today see on mobile phones, tablets, on gaming consoles and on other streaming media players, like Roku.

NPT Lucid Dreamer by NPT Lucid Dreamer — Kickstarter

Men, trigger lucid dreams using nocturnal penile tumescence (NPT). By far the simplest & most reliable method possible.

The post Corrupt Accomplices | Tech Talk Today 174 first appeared on Jupiter Broadcasting.

Nuke Penetration Testing | Unfilter 139

chris — Wed, 01 Apr 2015 21:33:42 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

Up against the clock six world powers are attempting to secure a historic deal with Iran. Whats this deal exactly about & what is at stake? Is there really a last minute big issue holding everything up? We’ll break it all down.

Plus Obama’s executive action against cyber attacks & we dig deep into the government corruption file this week.

Direct Download:

Video | MP3 Audio | OGG Audio | Torrent | YouTube

RSS Feeds:

Become an Unfilter supporter on Patreon:

Show Notes:

Executive Order — “Blocking the Property of Certain Persons Engaging in Significant Malicious Cyber-Enabled Activities” | The White House

U.S. Creates First Sanctions Program Against Cybercriminals : The Two-Way : NPR

The U.S. wants to slap sanctions on cybercriminals. President Obama issued an executive order Wednesday creating the nation’s first sanctions program to combat “malicious” cyberattacks and cyberspying.

President Obama said cyberthreats pose one of “the most serious economic and national security challenge” to the U.S., and that the executive order offers a “targeted tool” for countering that threat.

Obama’s Diplomatic Gamble On Iran Adding Instability In Middle East

Even before he became president, Barack Obama was imagining the possibilities of a diplomatic breakthrough with Iran. His willingness to reverse decades of official U.S. hostility was one of the things that set Obama apart on the campaign trail.

Obama’s Diplomatic Gamble On Iran Adding Instability In Middle East

Even before he became president, Barack Obama was imagining the possibilities of a diplomatic breakthrough with Iran. His willingness to reverse decades of official U.S. hostility was one of the things that set Obama apart on the campaign trail.

The post Nuke Penetration Testing | Unfilter 139 first appeared on Jupiter Broadcasting.

FTP Treasure Trove | TechSNAP 105

chris — Thu, 11 Apr 2013 16:58:17 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

A treasure trove of data was found on an open FTP site, leaving AMI BIOS users open to attack.

Plus a look at PunkSPIDER, a batch of your questions, and so much more!

On this week’s of TechSNAP.

Thanks to:

GoDaddy.com

Use our code hostdeal4 to score economy hosting for $1 a month, for one year.

35% off your ENTIRE order just use our code go35off4 until the end of the month!

Direct Download:

RSS Feeds:

Support the Show:

Purchase anything at Amazon.com
Purchase anything at Think Geek using this link
Purchase anything at Newegg using this link
Contribute directly on our donation page or check out our advertising options and reach millions of amazing people!
Grab our Chrome Extension and auto-tag your shopping session for us!

Fill out my Wufoo form!

Show Notes:

Get TechSNAP on your Android:

Browser Affiliate Extension:

Jupiter Broadcasting Affiliate Extensions for Chrome and Firefox

New distributed web application vulnerability scanner linked to search engine

HyperionGray have announced a new project, where they have connected their open source distributed PunkSCAN webapp scanner to an Apache Hadoop Cluster and set it loose on the Internet
The goal of the project is to highlight the abysmal state of security on the Internet
The scanner finds sites that are vulnerable to SQL Injection, Blind SQL Injection, and Cross-Site Scripting
This information is then stored in a database, and is searching using PunkSPIDER
You can search by keyword in the URL or Title of the site and search by vulnerability types
PunkSPIDER Search Engine
PunkSPIDER is similar to another online search engine we have discussed previously, SHODAN is an online index of banner messages and version info
Additional Coverage

How power failures can corrupt Flash SSDs

Researchers at Ohio State University have conducted extensive testing of Flash SSD drives to determine how they react to unexpected power failures
By creating a worst case scenario that involves many concurrent writes of incompressible data, and a direct loss of power (cutting power between the PSU and the SSD rather than cutting power to the PSU), the researchers were able to enumerate a number of possible failure scenarios
The possible failures they looked for were:
- Bit Corruption – Random bits in the data set incorrectly
- Flying Writes – The correct data written to the wrong block/sector
- Shorn Writes – A write is interrupted while overwriting a sector, leaving the sector with some of the new bits and some of the old bits
- Metadata Corruption – The Flash Translation Layer (FTL, the complex firmware on an SSD that makes the NAND Flash chips appear like a regular hard drive) metadata is corrupted
- Dead Device – The SSD no longer functions at all
- Unserializability – The disk is in a state where writes were completed out of order
Researchers tested 15 different SSDs and 2 regular spinning drives
They did not release the manufacturer names or model numbers
Additional Coverage
Paper
Erretum Insert
A case of a similar problem? SSD suddenly only 34kb

Source code and possibly private keys for AMI BIOS/Firmware leaked

Security researchers Brandan Wilson and Adam Caudill found some interesting things on an open FTP server in Taiwan
On the FTP site they found numerous goodies, including internal emails, system images, high resolution PCB images, and Excel sheets loaded with private data
In addition, they also found a directory named ‘code’, that contained the source code and a private key for the AMI Firmware
According to AMI, the FTP site belongs to one of its customers, and the private key that was exposed is a testing key they use for all of their images, but they instruct all of their customers to generate their own keys and not use that testing key in production
It is not clear if this is the case, one or more manufacturer making use of the AMI Firmware are using that testing key
If that key is trusted in the wild, it means someone with access to this leaked source code could make a malicious firmware update that would be considered valid, it would also mean that the entire UEFI trust system for the affected machines could be invalid
“The worst case is the creation of a persistent, Trojanized update that would allow remote access to the system at the lowest possible level,” Caudill said. “Another possibility would be the creation of an update that would render the system unbootable, requiring replacement of the mainboard.”
“This kind of leak is a dream-come-true for advanced corporate espionage or intelligence operations,” Caudill wrote. “The ability to create a nearly undetectable, permanent hole in a system’s security is an ideal scenario for covert information collection.”

Feedback:

Round-Up:

The post FTP Treasure Trove | TechSNAP 105 first appeared on Jupiter Broadcasting.

Lightworks Preview | LAS | s24e04

chris — Sun, 04 Nov 2012 14:15:57 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

We’ve got an exclusive look at Lightworks, one of the most anticipated software launches in desktop Linux history. We’ll share our first thoughts on how this award winning video editor is shaping up.

Plus some good news for those of you not running Ubuntu but still want some Steam, and some highlight clips from the Ubuntu Developer Summit that just wrapped up.

You’ll hear straight from the horse’s mouth why Valve is supporting Linux, how closely Canonical is working with Valve, and why Ubuntu is dropping Alpha’s and a beta!

Then we top that off with some gaming news, Fedora’s challenges, and the climax of the EXT4 corruption drama.

AND SO MUCH MORE!

All this week on, The Linux Action Show!

Thanks to:

GoDaddy.com

Limited time offer:
SPECIAL OFFER! SPECIAL OFFER! .COMs just $5.99* per year up to 3 domains! Additional .COMs just $7.99* per year! – code: 599linux

BONOUS ROUND PROMO:

Save 20% off your order!
Code: go20off6

Download:

RSS Feeds:

Support the Show:

Purchase anything at Amazon.com
Purchase anything at Think Geek using this link
Purchase anything at Newegg using this link
Contribute directly on our donation page or check out our advertising options and reach millions of amazing people!
Grab our Chrome Extension and auto-tag your shopping session for us!

Show Notes:

Lightworks for Linux Preview:

Brought to you by: System76

Editshare Admit ‘Communication Issues’ Over Lightworks Linux Alpha

Runs Linux:

The UbiCast, Runs Linux

Android Pick:

AndroVid Video Trimmer
Android Picks so far thanks to Madjo in the IRC Chat room!

Desktop App Pick:

Distro Of The Day

Pear Linux 6

Search our past picks:

Linux Action Show Lookup
Thanks to sakuramboo!

Git yours hands all over our STUFF:

News:

Valve Talk ‘Steam for Linux’, Give Beta Access to Attendees
Steam Linux Beta will have Portal, Team Fortress 2 and Serious Sam 3: BFE
Valve: Linux More Viable Than Windows 8 for Gaming
Valve’s Drew Bliss at UDS-R: “Ubuntu was the very obvious choice”
Drew Bliss from Valve:
- Status of Steam: https://youtu.be/vNrrpnPlBrk?t=17m2s – 17:18
- Why Linux & Why Ubuntu: https://youtu.be/vNrrpnPlBrk?t=17m46s – 19:16
- Valve will not block other distros: https://youtu.be/vNrrpnPlBrk?t=28m35s – 29:18
Jason Warner Ubuntu Desktop Manager:
- How is the Ubuntu Desktop team working with Valve? https://youtu.be/Sp4E5iuGJl4?t=2m55s – 4:22
Jupiter Broadcasting Steam Group
Ubuntu To Drop Alpha Releases, Promises More Stable Development
The Reason Ubuntu is Droping Betas: https://youtu.be/iQl6qR9yJzk?t=12m9s
Ubuntu Contributor Channel – YouTube
Ext4 bug patched
Re: Apparent serious progressive ext4 data corruption bug in 3.6.3 and other stable branches?
Theodore Ts’o – Google+ – UPDATE: See update below; it now looks like this was caused…
Theodore Ts’o – “Phoronix, alas, has perpetrated another example of irresponsible journalism.”

+Fedora 18 Is Challenged By Yet Another Delay
+ he Top Features Of Fedora 18 “Spherical Cow”

Feedback:

Proxmox or Ubuntu on the Nexus 7 next week?

Chris’ Stash:

Unfilter is looking for foreign correspondents!

What’s Matt Doin?

Find us on Google+

Find us on Twitter:

Follow the network on Facebook:

Jupiter Broadcasting on Facebook

Catch the show LIVE Sunday 10am Pacific / 1pm Eastern / 6pm UTC:

The post Lightworks Preview | LAS | s24e04 first appeared on Jupiter Broadcasting.

Breaking DKIM | TechSNAP 81

chris — Thu, 25 Oct 2012 19:41:52 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

How an aviation blogger unlocked the secrets of the TSA’s barcode, if you’re a Barnes and Noble shopper we’ve got a story you need to hear, and a serious bug in the Linux Kernel.

Plus a batch of your questions, and our answers.

All that and so much more, in this week’s TechSNAP.

Thanks to:

GoDaddy.com

Use our codes TechSNAP10 to save 10% at checkout, or TechSNAP20 to save 20% on hosting!

BONOUS ROUND PROMO:

Get your .COMs just $5.99 per year up to 3 domains! Additional .COMs just $7.99 per year!
CODE: 599tech

Expires 10/31/12

SPECIAL OFFER! Save 20% off your order!
Code: go20off5

Pick your code and save:
techsnap7: $7.49 .com
techsnap10: 10% off
techsnap11: $1.99 hosting for the first 3 months
techsnap20: 20% off 1, 2, 3 year hosting plans
techsnap40: $10 off $40
techsnap25: 25% off new Virtual DataCenter plans
techsnapx: 20% off .xxx domains

Direct Download:

RSS Feeds:

Support the Show:

Purchase anything at Amazon.com
Purchase anything at Think Geek using this link
Purchase anything at Newegg using this link
Contribute directly on our donation page or check out our advertising options and reach millions of amazing people!
Grab our Chrome Extension and auto-tag your shopping session for us!

Fill out my Wufoo form!

Show Notes:

Get TechSNAP on your Android:

Browser Affiliate Extension:

Jupiter Broadcasting Affiliate Extensions for Chrome and Firefox

Barnes and Noble POS Terminals compromised, debit card pin numbers stolen

Barnes and Noble discovered on Sept 14th that a number of the PIN Pads for its Point of Sales system had been compromised
Barnes and Noble did not go public with the information until this week at the request of investigators
Tampered PIN Pads were found in 63 stores all over the country, including California, Connecticut, Florida, Illinois, Massachusetts, New Jersey, New York, Pennsylvania, and Rhode Island
The retailer reported that only about 1% of their PIN pads had been tampered with, but when the compromise was discovered on Sept 14th, they disconnected all PIN pads at their 700 stores
It appears that a coordinated criminal enterprise infected PIN pads with malware that would record credit/debit card numbers and PIN numbers
B&N recommends that you change your debit card PIN number and watch your debit and credit accounts for unauthorized transactions
Online purchases were not affected
Official Announcement from Barnes and Noble

Avaition Blogger finds that he can determine what security screening he will get from this boarding pass

Frequent Flyer John Butler wrote a blog post this week, after he was able to determine what level of security screening he was going to be subjected to at the airport by reading the unencrypted barcode on his boarding pass
This raises the possibility that terrorist or smuggling groups could buy multiple tickets, then check each and use the ones that subjects them to the less intense screening process
The barcodes also appear to lack any form of MAC (Message Authentication Code), to protect them from unauthorized modification
It is unclear if a modified barcode would work, or if it is checked against a central database
It is illegal under US law to tamper or alter a boarding pass
The vulnerability appears to be confirmed by reading the specifications for the system published by the IATA (International Air Transport Association)
Every airport I’ve been through (YYZ, YHM, YYC, CDG, WAW, AMS) has not had any way to avoid the screening process, it appears that only the TSA allows you to pass through security without the basic screening. I have been randomly selected for additional screening (chemical residue test) twice

Serious bug in Linux kernel results in EXT4 data corruption

A bug was accidently introduced in Linux Kernel version 3.6.2, and then backported into 3.4 and 3.5
The bug has to do with the way the superblock and journal are updated, and can result in extensive data corruption, especially if a filesystem is unmounted shorted after it was mounted
A patch was posted, but was found to not fully solve the problem, so a second patch was posted later
Kernel 3.4.x is reaching end of life, and may not get an official patch

Dreamhost decides to change its SSH keys without notifying customers

DreamHost, a large shared web hosting provider, generated new SSH keys for all of its servers on Wednesday
DreamHost claims it is the “result of a security maintenance which we are performing to prevent exploitation of weak or outdated keys”
It seems like an excessive step, unless one or more of the SSH host private keys were compromised, in which case that is huge security news
If the keys were compromised, this means that someone could impersonate the DH server and log the login attempts, capturing valid username and password combinations
DreamHost made a number of mistakes:
Not giving users a heads up about the change before it happened, no email was sent, just a blog post that users were directed two when they contacted support about the error message
The blog post encourages users to just delete the old SSH key from their known_hosts and accept the new one, without verifying its authenticity
DreamHost did not publish a list of the fingerprints of the new keys, so that customers could verify the authenticity of the new keys they are presented with when they connect
The purpose of SSH fingerprints is to verify the identity of the remote host, they work in much the same way as SSL certificates except that there is no central certificate authority, it is up to the user to verify the identity of the key the first time. The main goal is to notify the user if the key suddenly changes, suggesting that you are not infact connecting to the intended server, but to some other server that may be trying to get your credentials or perform a man-in-the-middle attack on you
An attacker that is able to perform a man-in-the-middle attack during a time when a user is willing to just ignore the security warning (or even, take the additional steps OpenSSH requires before allowing you to accept a new key), could be very successful

Mathematician finds that Google and others were using weak keys for DKIM

Mathematician Zachary Harris got an email from a Google headhunter for a job as a Site Reliability Engineer
Seeing as he is not an expert in that field, he assumed that the email was a phishing scam
He examined the headers, and determined that it was signed with the proper DKIM keys, appearing to actually be from Google
DKIM (DomainKeys Identified Mail), is a process where all outbound email is cryptographically signed with a private key, that can then be verified against a public key published in DNS, such that only emails that are actually from the domain can be signed with the key, it is a common anti-spam and anti-phishing mechanism
He noticed that Google was only using 512bit keys for DKIM,
Harris explored other sites and found the same problem with the keys used by Amazon, Apple, Dell, eBay, HP, HSBC, LinkedIn, Match.com, PayPal, SBCGlobal, Twitter, US Bank and Yahoo
He found keys in 384, 512 and 768 bits, despite the fact that the DKIM standard calls for a minimum of 1024 bit keys
A 384-bit key can factor on a laptop in 24 hours, while a 512-bit keys can be factored in about 72 hours using Amazon EC2 for around $75
In 1998 it was an academic breakthrough of great concerted effort to crack a 512 bit key. Today anyone can do it by myself in 72 hours on AWS

Feedback:

While having lunch at EuroBSDCon, a FreeBSD developer recognized me from the Linux Action Show. He just so happened to be one of the main USB developers, and proceeded to correct (yell at) me. He recently expended a great deal of effort to improve support for webcams and other USB devices under FreeBSD 9.1 (and therefore PC-BSD as well). As further evidence of this, once we were done talking, someone walked up and handed him a USB ethernet adapter that was not supported, a hardware donation to drive development.

Allan and Stefan speaking at EuroBSDCon 2012 another
Shots of the conference: 1 2 3 4

Roundup

The post Breaking DKIM | TechSNAP 81 first appeared on Jupiter Broadcasting.

New Show! Part 2 | In Depth look

chris — Fri, 23 Mar 2012 20:11:24 +0000

One thing everyone around the world now shares is common, is the universal truth that a giant industry exists to filter out our lives make sure we only hear and see what they want us to.

For many of us there have been watershed events that force us to really see this in it\’s entire scope.

Once faced with this hard truth, I was left with only one thing to do. To start a new show, and unfilter our lives. And I\’m going to tell you all about it – In this week\’s episode of an In Depth Look!

Direct Download:

HD Download | Mobile Download | MP3 Download | Ogg Download | YouTube

RSS Feeds:

HD Feed | Mobile Feed | MP3 Feed | Ogg Feed | iTunes HD Feed

Support the Show:

Purchase anything at Amazon.com
Purchase anything at Think Geek using this link
Purchase anything at Newegg using this link
Contribute directly on our donation page or check out our advertising options and reach millions of amazing people!
Grab our Chrome Extension and auto-tag your shopping session for us!

Show Notes

Topics

There is a lot of really interesting things happening in the world, and 2012 is sure to keep that trend going.

We\’ll keep our focus on the technology angle whenever we can, and watch for your feedback to fine tune the topics you like the most.

Special Format

Twice a week. Mini, with headlines and tease for the big show later in the week.
And we want your input.
Open Skype/Google+ during core live segments.

Host

Metalfreak, from the JBLIVE chatroom and an active member in our subreddits will join me, and frequent JB hosts will stop by to share something from their corner of the world.

And maybe a few surprises!

Fundamentals

LIVE.

Pre-recorded segments played live, so live stream experiences the entire show live. And this is recorded, saving editing.

Audio only, with visuals ala SciByte.

When?

When it\’s ready! After we get TORked launched, its the next show out of the gate. We\’re still putting some of the final bits in place, but expect to hear more soon!

The post New Show! Part 2 | In Depth look first appeared on Jupiter Broadcasting.