DHS – Jupiter Broadcasting

Russiagate is Bogus | Unfilter 253

chris — Wed, 04 Oct 2017 23:45:33 +0000

RSS Feeds:

Video Feed | MP3 Feed | HD Torrent | iTunes

Become an Unfilter supporter on Patreon:

— Show Notes —

Assange’s October Dud | Unfilter 207

chris — Tue, 04 Oct 2016 21:35:20 +0000

RSS Feeds:

Become an Unfilter supporter on Patreon:

— Show Notes —

Links:

The post Assange's October Dud | Unfilter 207 first appeared on Jupiter Broadcasting.

Pulsed Gun Control | Unfilter 192

chris — Wed, 15 Jun 2016 23:05:18 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

From the Orlando shooting, secret drone emails, to the Brexit this episode of Unfilter covers a lot of ground. We share our thoughts & questions about the shooting, discuss the DNC hack & the latest scandals in the 2016 race.

Direct Download:

Video | MP3 Audio | OGG Audio | Torrent | YouTube

RSS Feeds:

Become an Unfilter supporter on Patreon:

— Show Notes —

Episode Links

The post Pulsed Gun Control | Unfilter 192 first appeared on Jupiter Broadcasting.

SpyFi Barbie | TechSNAP 243

chris — Thu, 03 Dec 2015 18:46:14 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

The US Government is offering free penetration tests, with a catch, we break down the VTech Breakin & the only sure way to protect your credit online.

Plus great questions, a big round up with breaking news & much more!

Thanks to:

Get Paid to Write for DigitalOcean

Direct Download:

RSS Feeds:

Become a supporter on Patreon:

TechSNAP SWAG for the Holidays

— Show Notes: —

Department of Homeland Security giving “critical infrastructure” firms free penetration tests

“The U.S. Department of Homeland Security (DHS) has been quietly launching stealthy cyber attacks against a range of private U.S. companies — mostly banks and energy firms. These digital intrusion attempts, commissioned in advance by the private sector targets themselves, are part of a little-known program at DHS designed to help “critical infrastructure” companies shore up their computer and network defenses against real-world adversaries. And it’s all free of charge (well, on the U.S. taxpayer’s dime).”
It seems like big banks and oil companies could afford to pay for such services, but, at least the penetration tests are happening
“KrebsOnSecurity first learned about DHS’s National Cybersecurity Assessment and Technical Services (NCATS) program after hearing from a risk manager at a small financial institution in the eastern United States. The manager was comparing the free services offered by NCATS with private sector offerings and was seeking my opinion. I asked around to a number of otherwise clueful sources who had no idea this DHS program even existed.”
“DHS declined requests for an interview about NCATS, but the agency has published some information about the program. According to DHS, the NCATS program offers full-scope penetration testing capabilities in the form of two separate programs: a “Risk and Vulnerability Assessment,” (RVA) and a “Cyber Hygiene” evaluation. Both are designed to help the partner organization better understand how external systems and infrastructure appear to potential attackers.”
“The RVA program reportedly scans the target’s operating systems, databases, and Web applications for known vulnerabilities, and then tests to see if any of the weaknesses found can be used to successfully compromise the target’s systems. In addition, RVA program participants receive scans for rogue wireless devices, and their employees are tested with “social engineering” attempts to see how employees respond to targeted phishing attacks.”
“The Cyber Hygiene program — which is currently mandatory for agencies in the federal civilian executive branch but optional for private sector and state, local and tribal stakeholders — includes both internal and external vulnerability and Web application scanning.”
“The reports show detailed information about the organization’s vulnerabilities, including suggested steps to mitigate the flaws. DHS uses the aggregate information from each client and creates a yearly non-attributable report. The FY14 End of Year report created with data from the Cyber Hygiene and RVA program is here (PDF).”
Manual testing was required to identify 67 percent of the RVA vulnerability findings (as opposed to off-the-shelf, automated vulnerability scans)
More than 50 percent of the total 344 vulnerabilities found during the scans last year earned a severity rating of “high” (40 percent) or “critical” (13 percent)
RVA phishing emails resulted in a click rate of 25 percent.
46% of RVAs resulted in an EASILY GUESSABLE CREDENTIALS finding
“I was curious to know how many private sector companies had taken DHS up on its rather generous offers, since these services can be quite expensive if conducted by private companies. In response to questions from this author, DHS said that in Fiscal Year 2015 NCATS provided support to 53 private sector partners. According to data provided by DHS, the majority of the program’s private sector participation come from the energy and financial services industries — with the latter typically at regional or smaller institutions such as credit unions”
Asking the penetration testing industry what it thought about the DHS offering a free service, Dave Aitel is chief technology officer at Immunity Inc., a Miami Beach, Fla. based security firm that offers many of the same services NCATS bundles in its product said: “DHS is a big player in the ‘regulation’ policy area, and the last thing we need is an uninformed DHS that has little technical expertise in the areas that penetration testing covers,” Aitel said. “The more DHS understands about the realities of information security on the ground – the more it treats American companies as their customers – the better and less impactful their policy recommendations will be. We always say that Offense is the professor of Defense, and in this case, without having gone on the offense DHS would be helpless to suggest remedies to critical infrastructure companies”
“Even if the DHS team doing the work is great, part of the value of an expensive penetration test is that companies feel obligated to follow the recommendations and improve their security,” he said. “Does the data found by a DHS testing team affect a company’s SEC liabilities in any way? What if the Government gets access to customer data during a penetration test – what legal ramifications does that have? This is a common event and pre-CISPA it may carry significant liability”
“Aitel, a former research scientist at the National Security Agency (NSA), raised another issue: Any vulnerabilities found anywhere within the government — for example, in a piece of third party software — are supposed to go to the NSA for triage, and sometimes the NSA is later able to use those vulnerabilities in clandestine cyber offensive operations”
But what about previously unknown vulnerabilities found by DHS examiners? “This may be less of an issue when DHS uses a third party team, but if they use a DHS team, and they find a bug in Microsoft IIS (Web server), that’s not going to the customer – that’s going to the NSA,” Aitel said.
Alan Paller, director of research at the SANS Institute sees a potential problem
“The NCATS program could be an excellent service that does a lot of good but it isn’t,” Paller said. “The problem is that it measures only a very limited subset of of the vulnerability space but comes with a gold plated get out of jail free card: ‘The US government came and checked us.’ They say they are doing it only for organizations that cannot afford commercial assessments, but they often go to organizations that have deep enough pockets.”
I can definitely see this being used as an excuse to spend LESS on network security

Break at VTech (toy manufacturer) exposes pictures and chatlogs of millions of children and parents

“The hacked data includes names, email addresses, passwords, and home addresses of 4,833,678 parents who have bought products sold by VTech, which has almost $2 billion in revenue. The dump also includes the first names, genders and birthdays of more than 200,000 kids”
“What’s worse, it’s possible to link the children to their parents, exposing the kids’ full identities and where they live, according to an expert who reviewed the breach for Motherboard”
“This is the fourth largest consumer data breach to date, according to the website Have I Been Pwned, the most well known repository of data breaches online, which allows users to check if their emails and passwords have been compromised in any publicly known hack”
“The hacker who claimed responsibility for the breach provided files containing the sensitive data to Motherboard last week. VTech then confirmed the breach in an email on Thursday, days after Motherboard reached out to the company for comment”
VTech told Motherboard: “We were not aware of this unauthorized access until you alerted us”
“On November 14 [Hong Kong Time] an unauthorized party accessed VTech customer data on our Learning Lodge app store customer database”
“On Friday, I asked the hacker what the plan was for the data, and they simply answered, “nothing.” The hacker claims to have shared the data only with Motherboard, though it could have easily been sold online.”
“When pressed, VTech did not provide any details on the attack. But the hacker, who requested anonymity, told Motherboard that they gained access to the company’s database using a technique known as SQL injection. Also known as SQLi, this is an ancient, yet extremely effective, method of attack where hackers insert malicious commands into a website’s forms, tricking it into returning other data”
Related: Motherboard: The histroy of SQL injection, the hack that will never go away
“The passwords were not stored in plaintext, but “hashed” or protected with an algorithm known as MD5, which is considered trivial to break”
It is not clear if they mean plain MD5 or md5crypt (the former being REALLY bad)
“Moreover, secret questions used for password or account recovery were also stored in plaintext, meaning attackers could potentially use this information to try and reset the passwords to other accounts belonging to users in the breach—for example, Gmail or even an online banking account”
Also, “VTech doesn’t use SSL web encryption anywhere, and transmits data such as passwords completely unprotected”, so breaching the database might not even be strictly necessary to gain access to the information
Additional Coverage: Motherboard followup
Additional Coverage: ZDNet
Additional Coverage: TheRegister
Related: Researcher claims to have hacked “Hello Barbie” toys

Why putting a preemptive freeze on your credit profile is better than credit monitoring

“Krebs has frequently urged readers to place a security freeze on their credit files as a means of proactively preventing identity theft. Now, a major consumer advocacy group is recommending the same: The U.S. Public Interest Research Group (US-PIRG) recently issued a call for all consumers to request credit file freezes before becoming victims of ID theft.”
“Each time news of a major data breach breaks, the hacked organization arranges free credit monitoring for all customers potentially at risk from the intrusion. But as I’ve echoed time and again, credit monitoring services do little if anything to stop thieves from stealing your identity. The best you can hope for from these services is that they will alert you when a thief opens or tries to open a new line of credit in your name.”
“But with a “security freeze” on your credit file at the four major credit bureaus, creditors won’t even be able to look at your file in order to grant that phony new line of credit to ID thieves.”
“These constant breaches reveal what’s wrong with data security and data breach response. Agencies and companies hold too much information for too long and don’t protect it adequately,” the organization wrote in a report (PDF) issued late last month. “Then, they might wait months or even years before informing victims. Then, they make things worse by offering weak, short-term help such as credit monitoring services.”
“Whether your personal information has been stolen or not, your best protection against someone opening new credit accounts in your name is the security freeze (also known as the credit freeze), not the often-offered, under-achieving credit monitoring. Paid credit monitoring services in particular are not necessary because federal law requires each of the three major credit bureaus to provide a free credit report every year to all customers who request one. You can use those free reports as a form of do-it-yourself credit monitoring.”
Related: Krebs: FAQ on Credit File Freezes
Additional Coverage: Krebs: OPM Credit Monitoring vs Freeze
One of the things that stops working once you put a security freeze on your credit file, is credit monitoring
A Krebs reader wrote in: “I just received official notification that I am affected by the OPM data breach. I attempted to sign up for credit monitoring services with the OPM’s contractor ID Experts at opm.myidcare.com, but was denied these services because I have a credit security freeze. I was told by ID Experts that the OPM’s credit monitoring services will not work for accounts with a security freeze.”
“This supports my decision to issue a security freeze for all my credit accounts, and in my assessment completely undermines the utility and value of the OPM’s credit monitoring services when individuals can simply issue a security freeze. This inability to monitor a person’s credit file when a freeze is in place speaks volumes about the effectiveness of a freeze in blocking anyone — ID protection firms or ID thieves included — from viewing your file.”
“Removing a security freeze to enable credit monitoring is foolhardy because the freeze offers more comprehensive protection against ID theft. Credit monitoring services are useful for cleaning up your credit file after you’re victimized by ID thieves, but they generally do nothing to stop thieves from applying for and opening new lines of credit in your name.”
Lifting a freeze to enable credit monitoring is like….
- installing flash to watch a flash video about the evils of flash
- leaving your doors and windows unlocked so that burglars can set off your indoor motion sensors
- taking your gun off safety to check and see if it’s loaded
Additional Coverage: Credit monitoring used to secretly track ex-wife’s financial moves
“Many of these third party credit monitoring services also induce people to provide even more information than was leaked in the original breach. For example, ID Experts — the company that OPM has paid $133 million to offer credit monitoring for the 21.5 million Americans affected by its breach — offers the ability to “monitor thousands of websites, chat rooms, forums and networks, and alerts you if your personal information is being bought or sold online.” But in order to use this service, users are encouraged to provide bank account and credit card data, passport and medical ID numbers, as well as telephone numbers and driver’s license information.”

Feedback:

Round Up:

The post SpyFi Barbie | TechSNAP 243 first appeared on Jupiter Broadcasting.

PLAID Falls Out of Fashion | TechSNAP 239

chris — Thu, 05 Nov 2015 07:53:43 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

CISA provides no solutions, just new excuses. The new Australian smartcard system is a total disaster & why Google’s URLs are so crazy.

Plus some great questions, our answers, a rockin’ round up & much, much more!

Thanks to:

Get Paid to Write for DigitalOcean

Direct Download:

RSS Feeds:

Become a supporter on Patreon:

— Show Notes: —

CISA: “Cybersecurity Information (Over)Sharing Act“

On Tuesday afternoon, the Senate voted 74 to 21 to pass a version of CISA that roughly mirrors legislation passed in the House earlier this year, paving the way for some combined version of the security bill to become law.
CISA is designed to stem the rising tide of corporate data breaches by allowing companies to share cybersecurity threat data with the Department of Homeland Security, who could then pass it on to other agencies like the FBI and NSA.
But privacy advocates and civil liberties groups see CISA as a free pass that allows companies to monitor users and share their information with the government without a warrant, while offering a backdoor that circumvents any laws that might protect users’ privacy.
The version of CISA passed Tuesday, in fact, spells out that any broadly defined “cybersecurity threat” information gathered can be shared “notwithstanding any other provision of law.”
Critics of CISA say the devil is in the details, or rather in the raft of amendments that may be added to the bill before it’s passed. The Center for Democracy & Technology (CDT), a nonprofit technology policy group based in Washington, D.C., has published a comprehensive breakdown of the proposed amendments and their potential impacts.
CDT says despite some changes made to assuage privacy concerns, neither CISA as written nor any of its many proposed amendments address the fundamental weaknesses of the legislation. According to CDT, “the bill requires that any Internet user information volunteered by a company to the Department of Homeland Security for cybersecurity purposes be shared immediately with the National Security Agency (NSA), other elements of the Intelligence Community, with the FBI/DOJ, and many other Federal agencies – a requirement that will discourage company participation in the voluntary information sharing scheme envisioned in the bill.”
On the surface, efforts to increase information sharing about the latest cyber threats seem like a no-brainer.
If only there were an easier way, we are told, for companies to share so-called “indicators of compromise”
In practice, however, there are already plenty of efforts — some public, some subscription-based — to collect and disseminate this threat data.
How Krebs’ Sees it: the biggest impediment to detecting and responding to breaches in a more timely manner comes from a fundamental lack of appreciation.
The most frustrating aspect of a legislative approach to fixing this problem is that it may be virtually impossible to measure whether a bill like CISA will in fact lead to more information sharing that helps companies prevent or quash data breaches.
Rather than encouraging companies to increase their own cybersecurity standards, the professors wrote, “CISA ignores that goal and offloads responsibility to a generalized public-private secret information sharing network.”
CISA Security Bill Passes Senate With Privacy Flaws Unfixed
Additional Coverage: ThreatPost

Australian PLAID Crypto, ISO Conspiracies, and German Tanks

PLAID (Protocol for Lightweight Authentication of ID), the Australian ‘unbreakable’ smart card identification protocol has been recently analyzed in this scientific paper
Technically, the protocol is a disaster. In addition to many questionable design choices, we found ways for tracing user identities and recover card access capabilities. The attacks are efficient (few seconds on ‘home’ hardware in some cases), and involve funny techniques such as RSA moduli fingerprinting and… German tanks. See this entry on Matt Green’s crypto blog for a pleasant-to-read explanation.
PDF: Unpicking PLAID: A Cryptographic Analysis of an ISO-standards-track Authentication Protocol
“when a reader queries the card, the reader initially transmits a set of capabilities that it will support (e.g., ‘hospital’, ‘bank’, ‘social security center’). If the PLAID card has been provisioned with a matching public key, it goes ahead and uses it. If no matching key is found, however, the card does not send an error — since this would reveal user-specific information. Instead, it fakes a response by encrypting junk under a special ‘dummy’ RSA public key (called a ‘shill key’) that’s stored within the card. And herein lies the problem.”
“You see, the ‘shill key’ is unique to each card, which presents a completely new avenue for tracking individual cards. If an attacker can induce an error and subsequently fingerprint the resulting RSA ciphertext — that is, figure out which shill key was used to encipher it — they can potentially identify your card the next time they encounter you.”
“To distinguish the RSA moduli of two different cards, the researchers employed of an old solution to a problem called the German Tank Problem. As the name implies, this is a real statistical problem that the allies ran up against during WWII. The problem can be described as follows: Imagine that a factory is producing tanks, where each tank is printed with a sequential serial number in the ordered sequence 1, 2, …, N. Through battlefield captures you then obtain a small and (presumably) random subset of k tanks. From the recovered serial numbers, your job is to estimate N, the total number of tanks produced by the factory.”
But the story behind PLAID’s standardization is possibly even more disturbing. PLAID was pushed into ISO with a so-called “fast track” procedure. Technical loopholes made it possible to cut off from any discussion the ISO groups responsible for crypto and security analysis. Concerns from tech-savvy experts in the other national panels were dismissed or ignored.
The author of the post contacted ISO and CERT Australia before going public with our paper, but all we got was a questionable and somewhat irate response (PDF) by PLAID’s project editor (our reply here). Despite every possible evidence of bad design, PLAID is now approved as ISO standard, and is coming to you very soon inside security products which will advertise non-existing privacy capabilities.
The detailed story of PLAID in the paper is worth a read, and casts many doubts on the efficacy of the most important standardizing body in the world. It is interesting to see how a “cryptography” product can be approved at ISO without undergoing any real security scrutiny.
A Few Thoughts on Cryptographic Engineering: Attack of the Week: Unpicking PLAID
Bruce Schneier: Amateurs Produce Amateur Cryptography

Unguessable URLs for security and privacy

This post on Bruce Schneier’s blog talks about how Google uses unguessable URLs to protect the photos you post
Additional Coverage — The Verge: Google secures photos using public but unguessable URLs
If you look at some of your private photos in “Google Photos”, you can right click on a photo, and copy the source URL
That is a public URL, that anyone can access, if you share it
The photos are available to anyone who types in the right string of characters
The key is that that string of characters, is very long
“So why is that public URL more secure than it looks? The short answer is that the URL is working as a password. Photos URLs are typically around 40 characters long, so if you wanted to scan all the possible combinations, you’d have to work through 1070 different combinations to get the right one, a problem on an astronomical scale.”
“There are enough combinations that it’s considered unguessable, It’s much harder to guess than your password”
The same applies to facebook photos. If I have access to someone else’s photo, but the person I want to share it with does not (even have a facebook account), I can copy the source URL, rather than the facebook viewer URL, and share it with them
Because traffic to and from Google Photos, and Facebook, is encrypted with HTTPS, someone cannot get the URLs of those photos by sniffing your traffic
They could get the data from your browser history, or in other ways if your machine was compromised, but in those cases they’d have access to the photos anyway
The only real problem here is that it can be hard to ‘revoke’ access to a photo. If you give this unguessable but public URL to someone, they can share it as much as they want, completely outside of your control
Also, because CDNs and caches are used, even if you delete a photo, it might still be accessible by that URL, if someone already knows it
Schneier notes: “It’s a perfectly valid security measure, although unsettling to some”

Feedback:

Complicate FreeNAS box or Combine with Linux?
Encrypting Windows Workstations. Want to use Bitlocker, but some machines don’t have a TPM chip.
Connecting 2 FreeNAS over the internet
PHP-FPM 100% CPU Load
Book Review: “FreeBSD Mastery: ZFS”
Buy your copy at: https://www.zfsbook.com/

Round up:

The post PLAID Falls Out of Fashion | TechSNAP 239 first appeared on Jupiter Broadcasting.

Radicalized and Viral | Unfilter 147

chris — Wed, 10 Jun 2015 22:10:12 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

Over the weekend the media blew the doors off the Cyber propaganda, cranking up the fear machine over ISIS radicalization via one tweet at a time. We’ll give you our analysis on the larger motive behind this media blitz.

Plus the new plan to fight ISIS that’s just like the old plan, the details on that big gov data breach & a high-note that might inspire your next big idea!

Direct Download:

Video | MP3 Audio | OGG Audio | Torrent | YouTube

RSS Feeds:

Become an Unfilter supporter on Patreon:

Show Notes:

The post Radicalized and Viral | Unfilter 147 first appeared on Jupiter Broadcasting.

Insane In The Ukraine | Unfilter 86

chris — Wed, 19 Feb 2014 22:57:34 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

After three months building pressure the Ukraine is exploding this week, as anti-government protests turn more and more violent. Now the United States and Russia find themselves in a pissing match over who is more just to influence the revolution. The propaganda is flying, and we’ll break it down and discuss the real reasons the people are taking to the streets.

New Snowden leaks reveal the NSA tracked WikiLeaks supporters, legal bud gets a money boost from the feds, Syria is heating back up, and much much more.

On this week’s episode of, Unfilter.

Direct Download:

Video | MP3 Audio | OGG Audio | Torrent | YouTube

RSS Feeds:

Become an Unfilter Supporter:

Subscribe With Bitcoin

— Show Notes —

NSA is Crazy

Snowden Documents Reveal Covert Surveillance and Pressure Tactics Aimed at WikiLeaks and Its Supporters – The Intercept

The efforts – detailed in documents provided previously by NSA whistleblower Edward Snowden – included a broad campaign of international pressure aimed not only at WikiLeaks founder Julian Assange, but at****what the U.S. government calls “the human network that supports WikiLeaks.” The documents also contain internal discussions about targeting the file-sharing site Pirate Bay and hacktivist collectives such as Anonymous.

Utah Mulls Measures to Help, Limit NSA Data Center – ABC News

“The end game here is to limit the encroachment on our 4th Amendment rights,” Roberts told the Daily Herald of Provo. “We’d love to see Congress fix that on their own, but I don’t have a lot of faith in that happening. So this is a state effort to take a step in that direction.”

He does have supporters, though, including the Libertas Institute, a libertarian-leaning think tank in Utah.

Libertas Institute of Utah | Individual Liberty, Private Property, Free Enterprise

Advancing the cause of liberty in Utah

– Thanks for Supporting Unfilter –

Thanks to our 335 Unfilter supporters!
Supporter perk: Downloadable Pre and Post show. Extra clips, music, hijinks, and off the cuff comments. The ultimate Unfiltered experience. ‘
Supporter perk: Exclusive BitTorrent Sync share of our production and non-production clips, notes, and more since the NSA scandal broke in episode 54. The ultimate Unfiltered experience, just got more ultimate.
Supporter Perk: Past 5 supporters shows, in a dedicated bittorrent sync folder.

Ukraine mayhem

Kiev drone footage: Aerial view of burning Maidan amid Ukranian riots – YouTube

Ukraine parliament to work on constitution bill

Opposition leaders, backed by protesters in the streets, want a return to a constitution enacted in 2004 that would move substantial powers over the government from the president to parliament – a proposal rejected by President Viktor Yanukovich and his supporters, who have had a majority in the legislature.

Ukraine: Deadly clashes around parliament in Kiev

The proposals would curb the powers of President Viktor Yanukovych, but the opposition say they were blocked from submitting their draft, meaning no debate could take place.

Ukraine Facing Civil War: Lviv Declares Independence from Yanukovich Rule

The development came after clashes between police and protesters left at least 25 people dead in capital Kiev.

Ukrainian police yesterday moved in to clear a protest camp in Kiev’s Independence Square, known as the Maidan, the heart of anti-government demonstrations sparked by President Yanukovich’s rejection of a trade and investment deal with the European Union last November.

Rioters seize over 1,500 guns in Ukraine mayhem – security services

Ukraine’s security service has announced it is launching a counter-terror operation. Radicals have seized over 1,500 firing arms and 100,000 bullets in the last 24 hours, the service said.

Reacting to the “conscious, purposeful use of force by means of arson, killings, kidnapping and terrorizing people,” which Yakimenko treats as “terrorist acts,” the Security Service and Anti-terrorist center of Ukraine have decided to launch a counter-terrorist operation.

Venezuelan opposition leader Lopez due in court after surrendering

The man the government blames for the deaths is opposition leader Leopoldo Lopez, who turned himself in to authorities on Tuesday.

This one map helps explain Ukraine’s protests

What’s happening in Ukraine is complicated and driven by many factors: the country’s history as an unhappy component of the Soviet Union, its deep economic woes, a sense of cultural fondness for the West, wide discontent with government corruption, two decades of divided politics and a sense that Yanukovych caved to Putin.

No single datapoint could capture or explain all of that. But the map below comes perhaps as close as anything could. It shows Ukraine, color-coded by the country’s major ethnic and linguistic divisions. Below, I explain why this map is so important and why it helps to tell Ukraine’s story. The short version: Ukraine’s politics have long been divided into two major factions by the country’s demographics. What’s happening right now is in many ways a product of that division, which has never really been reconciled.

(Wikimedia Commons)

Roughly speaking, about four out of every six people in Ukraine are ethnic Ukrainian and speak the Ukrainian language. Another one in six is ethnic Russian and speaks Russian. The last one-in-six is ethnic Ukrainian but speaks Russian. This map shows where each of those three major groups tend to live. (I’m rounding a bit on the numbers; about five percent of Ukrainians are minorities who don’t fit in any of those three categories.)

Here’s why this matters for what’s happening in Ukraine now: Since it declared independence in 1991, the country has been politically divided along these ethnic-linguistic lines. In national elections, people from districts dominated by that majority group (Ukrainian-speakers who are ethnically Ukrainian) tend to vote for one candidate. And people from districts with lots of ethnic Russians or Russian-speakers tend to vote for the other candidate.

Bonus Round

Obama administration clears banks to accept funds from legal marijuana dealers

The Obama administration on Friday gave the banking industry the green light to finance and do business with legal marijuana sellers, a move that could further legitimize the burgeoning industry.

For the first time, legal distributors will be able to secure loans and set up checking and savings accounts with major banks that have largely steered clear of those businesses. The decision eliminates a key hurdle facing marijuana sellers, who can now legally conduct business in 20 states and the District.

As Syria threat expands, Obama mulls options

They are also are looking at newer, more far-reaching options, including drone strikes on extremists and more forceful action against Assad, whom President Barack Obama told to leave power 30 months ago.

Obama’s top aides plan to meet at the White House before week’s end to examine options, according to administration officials.

Homeland Security is seeking a national license plate tracking system – The Washington Post

The national license-plate recognition database, which would draw data from readers that scan the tags of every vehicle crossing their paths, would help catch fugitive illegal immigrants, according to a DHS solicitation. But the database could easily contain more than 1 billion records and could be shared with other law enforcement agencies,

A spokeswoman for DHS’s Immigration and Customs Enforcement agency (ICE) stressed that the database “could only be accessed in conjunction with ongoing criminal investigations or to locate wanted individuals.”

Top Story in the unfilter Subreddit

Feedback:

If you’re a Supporter check your inbox!

Call us: 1.425.312.1756

Follow the Us:

The post Insane In The Ukraine | Unfilter 86 first appeared on Jupiter Broadcasting.

Then They Fight You | Plan B 8

chris — Tue, 28 May 2013 15:46:04 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

The funding methods around Bitcoin are under attack, and we chat with TheGenesisBlock.com’s managing editor about what this means for the future of Bitcoin, and more.

Plus picking the right wallet for offline cold storage, a look at BitAngels the distributed Bitcoin angel fund, our concerns with Ripple, your emails, and much more!

— Show Notes: —

— Feedback —

Help spread the word on iTunes with a Rating and Review:

iTunes – Plan B by Jupiter Broadcasting

Call or txt the Show:

1 (352) 587-5262

(352) 58-PLANB

— Discussion —

OKPAY takes Bitcoin hiatus

Although OKPAY themselves provided no rationale for their decision, OKPAY’s trust in the viability of bitcoin in their system may have been shaken after an OKPAY user reported on bitcointalk.org that they had successfully double-spent over 211 BTC to OKPAY and a seperate address controlled by the user during the block chain fork of 12 March 2013. The same user also reported that an approximately 65 BTC he had sent separately to OKPAY was not successfully credited to the appropriate account. Somewhat of a standoff ensued, but was resolved with OKPAY refunding the 65 BTC only after the customer returned the double-spent 211 BTC. OKPAY support staff confirmed the situation on a bitcointalk.org forum thread started by the double-spender.

Canada becomes bitcoin-friendly

We now have our first answer from FinTRAC. Generally, it views bitcoin exchanges as entities that do not have to register, identify clients, and report under the money services business rules.

Next Generation Bitcoins with Ripple – YouTube

Primer Interest Producer Bob English and Perianne traveled to the Bitcoin conference in San Jose, California over the weekend. They got a chance to speak to many of the movers and shakers in the up and coming crypto-currency realm. Bob interviewed Chris Larsen, CEO and co-founder of OpenCoin, which is developing Ripple.

60+ Investors Band Together To Form BitAngels, The First Multi-City Angel Network & Incubator For Bitcoin Startups | TechCrunch

BitAngels is launching (what it believes to be) the first multi-city angel network and incubator created to invest exclusively in cryptocurrency startups. Fittingly, in the spirit of Bitcoin, it\’s a distributed network of angels and entrepreneurs and one that was hacked together in a few days after the Bitcoin 2013 Conference.

BitAngels brings together a posse of angel investors who are looking to help entrepreneurs turn their Bitcoin side projects into full-time jobs. To do that, the angel network pooled together about $6.7 million in Bitcoin, which it will invest in approximately $20K chunks.

BitAngels is not a formal fund, so the Bitcoins are soft-circled, not in escrow, but all 60 angels that have joined thus far (the number of angels has almost doubled in the past week) are all accredited investors with extensive experience investing and, naturally, have a lot of Bitcoin.

Why Bitcoin Won’t Probably be a Reserve Currency in our Lifetime

Trace Mayer on Prime Interest May 24, 2013.

— Greg Managing Editor of The Genesis Block.COM —

DHS Inquiry Leads to Lowest USD/Bitcoin Trading Volume In Months
> Bitcoin trading volume has plummeted since news broke that the Department of Homeland Security issued a seizure warrant that stopped all activity between Dwolla and the Mt. Gox exchange. As of today, the 5-Day moving average of USD trading volume is at the lowest level in at least a year and a half (the data is a bit spotty beyond that), other than the last week in December 2012.

In addition to total market volume declining, Mt. Gox is losing footing as the dominant player in the space. As of May 17, Gox was doing roughly 81% of total USD bitcoin volume. Today they did just 59%.

Bitcoin Trading: Are We Primed For A Major Move Higher? – The Genesis Block

Yesterday we wrote about the low volatility after Mt. Gox\’s accounts were seized. The following graph from that article illustrates how we haven\’t seen volatility this low on Mt. Gox since December of 2012.

— Watch Live —

Tuesday 2pm PDT / 5pm EDT / 9pm GMT

JbLive.tv

— Plan B Subreddit —

Plan B Show

— Contact us —

— Music —

Thanks to Ronald Jenkees and his fantastic track 7 Times

The post Then They Fight You | Plan B 8 first appeared on Jupiter Broadcasting.

Amir Taaki & #Bitcoin 2013 | Plan B 7

chris — Tue, 21 May 2013 17:31:35 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

We chat with Amir Taaki about Libbitcoin, and how it could enable a new generation of Bitcoin powered applications and services. And what he see’s as the biggest threat facing Bitcoin, his work with Electrum and more.

Then Ben Morse from the Port Forward Podcast joins us to wrap up the best of this weekend’s #Bitcoin2013 Future of Payments conference.

Plus a big batch of your questions, the news of the week, and more!

MP3 Audio | OGG Audio | Video | Torrent | YouTube

RSS Feeds:

MP3 Feed | Video Feed | Torrent Feed | iTunes Audio | Ogg Feed

— Show Notes: —

— Feedback —

voicemail from may 15
Thoughts on Lost Coins

Help spread the word on iTunes with a Rating and Review:

iTunes – Plan B by Jupiter Broadcasting

Call or txt the Show:

1 (352) 587-5262

(352) 58-PLANB

— Discussion —

Bitcoin 2013: The Future of Payments Wrap Up

Bitcoin 2013 in review – CoinDesk

More than 1,000 Bitcoin enthusiasts who converged on San Jose were an impassioned bunch — some fired with the excitement of getting in on something big the ground floor, others lit up by a more ideological passion for freedom from government or from the existing financial system.

Great interview with BitInstant founder on RT

Producer Bob English and Perianne flew out to San Jose over the weekend and reached out to the 1100 attendees and sponsors of the first major Bitcoin conference. Today, we feature the CEO of BitInstant, Charlie Shrem, who will explain how easy it is to buy Bitcoins.

The Top 3 Things I Learned at the Bitcoin Conference – Reason.com

This past weekend I attended the Bitcoin 2013 conference in San
Jose, where over one thousand enthusiasts, developers,
entrepreneurs, venture capitalists, and, yes, lawyers gathered to
chart the future of the virtual currency. Here are the top three
things I learned at the conference.

With $1.5M Led By Winklevoss Capital, BitInstant Aims To Be The Go-To Site To Buy And Sell Bitcoins

BitInstant, a New York City based startup that operates an online platform for buying and selling Bitcoins, has raised $1.5 million in a seed funding round led by Winklevoss Capital with the participation of other strategic investors including money services veteran David Azar. The investment was closed this past fall, but the Winklevosses are just now publicly announcing it in the lead-up to the Bitcoin Foundation\’s 2013 Conference being held in Silicon Valley this weekend.

BitInstant, which has a full-time staff of 16 led by CEO Charlie Shrem, has emerged as a key player in the nascent Bitcoin market: The company already processes approximately 30 percent of the money going into and out of Bitcoin, and last month alone facilitated 30,000 transactions, the Winklevosses said in a phone call this week. The funding is meant to allow the company to further scale up its staff and product as it angles to become the go-to site for Bitcoin transfers.

Feds Seize Assets From Mt. Gox’s Dwolla Acount, Accuse It Of Violating Money Transfer Regulations

In order to accept funds in dollars, Mt. Gox opened a Wells Fargo business account for Mutum Sigillum LLC (Mt. Gox\’s American subsidiary). The company had to complete a document that states whether it provides money services or not. The warrant reads: \”That document was completed on May 20, 2011, and identified Mutum Sigillum LLC as a business not engaged in money services.\”

In particular, Karpeles answered no to two important questions: “Do you deal in or exchange currency for your customer?” and “Does your business accept funds from customers and send the funds based on customers’ instructions (Money Transmitter)?”

— Amir Taaki —

Amir Taaki – Wikipedia, the free encyclopedia

Amir Taaki is a British video game and computer software developer. Taaki is best known as a Bitcoin project developer and for pioneering many open source projects

libbitcoin is a bitcoin library targeted towards high end use. The library places a heavy focus around asynchronicity. This enables a big scope for future scalability as each component has its own thread pool. By increasing the number of threads for that component the library is able to scale outwards across CPU cores. This will be vital in the future as the demands of the bitcoin network grow.

Another core design principle is libbitcoin is not a framework, but a toolkit. Frameworks hinder development during the latter stages of a development cycle, enforce one style of coding and do not work well with other frameworks. By contrast, we have gone to great pains to make libbitcoin function as an independent set of mutual components with no dependencies between them.

subvertx command line utilities (proof of concept using libbitcoin)

Async Programming by Amir Taaki – YouTube

Amir Taaki giving a talk about Async Programming at Brmlab hackerspace

genjix/query-layer · GitHub

Bitcoin 2013: unSYSTEM Vienna, 1-3 Nov 2013

Bitcoin 2013: unSYSTEM is the biggest event in the world covering
Bitcoin and social change. The event will be held in Austria\’s largest venue,
a building normally used by the United Nations.

— Extended Q&A —

https://slexy.org/view/s20xeTs4sY
https://slexy.org/view/s20Ke1PzyU
https://slexy.org/view/s2lPFSSuFD
https://slexy.org/view/s2140K6HTC

— Over Time —

Max Keiser – Bitcoin, Bernanke & Buffett | London Real – YouTube

Max Keiser of Russia Today drops by to explain the genesis and implications of the digital currency Bitcoin, why The Federal Reserve and the banking system should apologise to the people for manipulating interest rates, how Warren Buffett is complicit in the Mexican drug trade by purchasing Wells Fargo, and Max\’s crazy times in the 1980s as a New York City stockbroker by day and punk-rock party animal by night.

— Watch Live —

Tuesday 2pm PDT / 5pm EDT / 9pm GMT

JbLive.tv

— Plan B Subreddit —

Plan B Show

— Contact us —

— Music —

Thanks to Ronald Jenkees and his fantastic track 7 Times

— Support the Show —

Donate to the network with your worthless fiat or your fancy bitcoins!
Tip address:

1HE36CMdeYCF9N7rmpfa5BwKMGb1PfkNyD

The post Amir Taaki & #Bitcoin 2013 | Plan B 7 first appeared on Jupiter Broadcasting.

Burn it Down | Unfilter 37

chris — Thu, 14 Feb 2013 22:26:35 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

The manhunt for Christopher Dorner has come to an end, we watched the conclusion unfold and have the clips that prove the fire at the cabin was set intentionally by law enforcement, and more.

The 2013 State of the Union is now behind us. President Obama delivered a speech with few surprises, but many calls of action. We’ll look at the issues most likely to move ahead.

Plus North Korea rattled their cage this week, we’ll share the details.

You might be surprised to find out many of us in the United States now live in what the DHS is considering constitution free zones. We’ll tell you all about this outrageous revelation.

Plus your feedback, and much more on this week’s Unfilter.

NOTE: The video feed for this week\’s episode was did not get recorded. But it will be back next week!

Direct Download:

RSS Feeds:

Become an Unfilter Supporter:

Amazon:

Paypal:

Get Unfilter on your Android:

Browser Affiliate Extension:

Jupiter Broadcasting Affiliate Extensions for Chrome and Firefox

–Show Notes–

Third North Korean Nuclear Test

A North Korean nuclear test draws international condemnation, modest U.N. sanctions and expressions of hope in the United States that China will finally rein in its ally.

Dorner Manhunt Comes to an End

Police work to confirm if Dorner\’s remains were found in burned cabin

A lot of people don\’t seem to know what a \”burner\” is. A burner is an incendiary tear gas canister that is specifically made to start a fire. These were used in Waco on the branch Davidians. At the time the FBI claimed the cult member started the fire, but much later the FBI admitted to using incendiary tear gas canisters to burn the Davidians out of hiding.

A tear gas canister ignited a fire at a City Terrace area home surrounded by SWAT officers as part of a standoff the morning Wednesday Jan. 16, 2013, according to sheriff\’s deputies.

Hoping to end the standoff, law enforcement authorities first lobbed “traditional” tear gas into the cabin. When that did not work, they opted to use CS gas canisters, which are known in law enforcement parlance as incendiary tear gas. These canisters have significantly more chance of starting a fire.

Has done some deep thinking on the show
Thanks to our 25 Unfilter supporters!
New supporter perk: Downloadable Pre and Post show. Extra clips, music, hijinks, and off the cuff comments. The ultimate Unfiltered experience.

Obama’s 2013 State of the Union Address

The main difference between the White House executive order and CISPA is that CISPA would allow private companies (like Facebook or Google) to share details about cyber attacks with the government, whereas the executive order is a one-way street, with the feds sharing information with the private sector. CISPA opponents were concerned about immunity clauses that they said would incentivize companies to hand over customer information without hesitation.

DHS engages \’Constitution free\’ zones around US border

According to the US Department of Homeland Security, anyone who is within a 100 mile radius of the US border is subject to the search and seizure of any and all electronic devices for no apparent reason. These zones known as \”Constitution free\” zones have many privacy advocates speaking out against the new policy and fear that this new procedure is a violation of civil liberties for American citizens.

US senators propose assassination court to screen drone targets

The idea was bandied about during Thursday\’s confirmation hearing for CIA director nominee John Brennan, who fueled the talk by saying he thinks the concept is \”worthy of discussion.\” The nominee, as a vocal supporter of the targeted-killing program, has come under scrutiny for what some lawmakers see as the administration\’s unchecked power to kill, even if the target is an American citizen.

Sen. Dianne Feinstein, D-Calif., chairwoman of the Senate Intelligence Committee, said as part of an effort to regulate the killing, she wants to review proposals to create something similar to the Foreign Intelligence Surveillance Court — which reviews requests for wiretaps against suspected foreign agents — for drone strikes.
Sen. Angus King, I-Maine, is pushing the idea the hardest.

According to his vision, the drone court would be an avenue for U.S. officials to argue in secret before a judge why an American citizen should be targeted for death. He said it would be like \”going to a court for a warrant\” and proving probable cause.

US senators propose assassination court to screen drone targets

We want voicemails!

Call us: 1.425.312.1756

Follow the Us:

The post Burn it Down | Unfilter 37 first appeared on Jupiter Broadcasting.

Super Spin Sandy | Unfilter 24

chris — Thu, 01 Nov 2012 23:41:35 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

It’s been called a once in a lifetime super storm, we’ll reflect on the media’s coverage of this major event, and we bust the October Surprise rumors that are spreading like wildfire online.

When you think of the fight for control of the Internet, you probably think of SOPA, CISPA, and Net Neutrality. But an International effort is underway and laying on thick rhetoric in an attempt to undermine the open nature of the web, we’ll share the details with you.

Then in ACT3: Your feedback challenges are assumptions, and we respond.

All that and a heck of a lot more, on this week’s Unfilter!

Direct Download:

RSS Feeds:

Get Unfilter on your Android:

Browser Affiliate Extension:

Jupiter Broadcasting Affiliate Extensions for Chrome and Firefox

Show Notes:

ACT ONE:

ACT TWO: THE SUPER STORM

ACT THREE: FEEDBACK

Officer in the USMC writes in, he works with UAVs and has a few thoughts on our coverage.
Thoughts on Drones
A bunch of Feedback
Regarding the question sent in by a viewer in the episode \”Third Party Hope\” about monarchies

Follow the Team:

Call us: 1.425.312.1756

The post Super Spin Sandy | Unfilter 24 first appeared on Jupiter Broadcasting.

Meme Spotting | Unfilter 21

chris — Thu, 11 Oct 2012 23:06:17 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

It’s been a big week for Drones, in ACT1 we’ll tell you the latest on this growing new type of warfare. Plus the gift the courts gave to the telcos, and the latest in new cyber laws.

In ACT2: We go meme spotting this week, and unfilter the subtle ways the Industrial Media Complex applies pressure to public opinion.

In ACT3: After hitting the episode 20 mark, we\’ve reflected a bit on the show and have a few thoughts, and a few questions for you. If you\’ve enjoyed this show, please stay tuned.

All that and a heck of a lot more, on this week’s Unfilter!

Direct Download:

RSS Feeds:

Get Unfilter on your Android:

Browser Affiliate Extension:

Jupiter Broadcasting Affiliate Extensions for Chrome and Firefox

Show Notes:

ACT ONE:

Drone Update:

ACT TWO: MEME SPOTTING

ACT THREE:

If you have a perspective from outside the US, and can contribute regularly on our voicemail line, PLEASE DO. We want to improve our coverage of events outside our bubble. Please be our boots on the ground.

Call us: 1.425.312.1756

What kind of coverage do you want of the Pres election/race? Do you want us to cover big stories in the race that happen between now and the election?
What would you like to hear from our debate coverage?
Send in your thoughts on the tweaked host format. Good and bad.

Follow the guys:

The post Meme Spotting | Unfilter 21 first appeared on Jupiter Broadcasting.

Security Theater Critics | Unfilter 2

chris — Sat, 26 May 2012 07:48:33 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

The TSA is one of the stars in the US Government\’s security theater that keeps the public always fearing attack. In this week’s episode we’ll demonstrate how the media is used to manipulate public support for sweeping security changes.

Plus – We’ll unfilter some headlines, and cover your feedback from our first episode.

Direct Download:

HD Video | Mobile Video | MP3 Audio | OGG Audio | YouTube

RSS Feeds:

HD Video Feed | Mobile Video Feed | MP3 Audio Feed | OGG Audio Feed | iTunes Feeds

ACT ONE: NEWS

ACT TWO: TSA Security Theater

How much is being spend on the TSA’s?
- According to the U.S. Department of Homeland Security Budget-in-Brief for Fiscal Year 2013 The 2013 President’s Budget for the Transportation Security Administration (TSA) is $7,644,585,000
- The TSA accounts for 13% of the Department of Homeland Security\’s annual budget.
- Down from The TSA\’s Fiscal Year 2012 President\’s Budget was $8,115,259,000 and the TSA accounted for 14% of the DHS annual budget
TSA screeners are only being paid between $9.88 – $16.38 an hour according to payscale.com
TSA Behavioral Detection Statistics: officers sidetracked 50,000 passengers in 2010 and arrested 300 passengers – none turned out to be terrorists
TSA Scanners Might Not Catch Underwear Bombs & ID Thief Becomes a TSA \”Officer\”
TSA Creator Says Dismantle, Privatize the Agency\”
EDITORIAL: TSA’s \”power grope\”
TSA Trials Expanding to Busses
TSA Bus Trial Backfires
Famed Hacker Arrested for Pot Possession En Route To SXSW by TSA Stop
TSA’s “VIPER” program stumbles again\”

ACT THREE: Feedback

Ubiquity Writes…

Was hoping for a video show, LAS and SNAP are great because of that.
Jim Writes…

If you are going to be doing shows on political issues, you at least have to make some kind of attempt at balance. You are going to have to present arguments from all sides of the issue and you need guests on the show to argue the opposing sides.
Ubiquity Writes.. (again)

I think it\’s about time more people did discuss issues that do really matter. While not everyone may agree with topics that are political or religious, its discussion that needs to happen. I would suggest sticking to the facts as much as possible, and unfortunately there are many facts that challenge popular beliefs. One advantage of the IT industry is that most \”wise\” decisions are based on facts and statistics. I think of this content as educational, better for the greater good of people.

Unfilter on Reddit

Link List:

Song pick of the week: SONG: Mr. TSA: a Response to Having My Pants Pulled Down by the TSA Which was released under a Creative Commons License

The post Security Theater Critics | Unfilter 2 first appeared on Jupiter Broadcasting.

Sage IT Wisdom | TechSNAP 57

chris — Thu, 10 May 2012 07:22:17 +0000

Apple’s latest version of OS X has a major bug that can store your passwords in clear text, an 8 year old vulnerability has been found in PHP, and why the DHS is hoping for attacks on Gas pipelines.

Plus – We’ve got some sage advice for Adam, who’s just taken on the role of the company Sysadmin, and we share some of the essential lessons we’ve learned over the years.

All that and more, on this week’s TechSNAP!

Thanks to:

GoDaddy.com Use our codes TechSNAP10 to save 10% at checkout, or TechSNAP20 to save 20% on hosting!

Limited time offer:

New customers 25% off your entire order, code: 25MAY7
Expires: May 31, 2012

Direct Download:

RSS Feeds:

Support the Show:

Purchase anything at Amazon.com
Purchase anything at Think Geek using this link
Purchase anything at Newegg using this link
Contribute directly on our donation page or check out our advertising options and reach millions of amazing people!
Grab our Chrome Extension and auto-tag your shopping session for us!

Show Notes:

Apple security blunder exposes Lion passwords in plain text

Apparently by accident, an Apple programmer left some debugging options turned on in the final release version of Apple’s OS 10.7.3 Lion
These debugging options cause the plaintext password for every users that logs in to the machine to be stored in a system wide log file
“Anyone who used FileVault encryption on their Mac prior to Lion, upgraded to Lion, but kept the folders encrypted using the legacy version of FileVault is vulnerable”
Vulnerability Discovery Announcement
As you will recall from last week’s episode of TechSNAP, we discussed how you could compromise encrypted partitions by installing spyware on the machine to access the partition once it was mounted
The other option is to attempt to use some kind of keylogger to learn the password to decrypt the partition
This flaw in Apple OS X allows an attacker to boot into the recovery console, mount the unencrypted system partition, read the log file, and learn the password to login as the user and decrypt the partition
Apple users who use the newer FileVault2 whole disk encryption, are not as vulnerable, since the partition where the log file is stored is also encrypted, however it is unclear if users who share a system could learn each other’s passwords
The researcher that discovered this vulnerability also points out that the log file would also be backed up unencrypted, so even if you change your password now and resolve the issue, anyone able to gain access to your backups (which you assume store your encrypted partitions in an encrypted state), would be able to read the plaintext log file and access the backed up version of your encrypted partition
The information disclosure vulnerability has existed since early February 2012 and has not yet been resolved
“In my opinion, it should be impossible to turn such a feature on without patching code, and ideally shipped binaries should not contain even a disabled code path to log passwords in plain text.” – David Emery (Researcher who discovered the vulnerability)
Does Apple have a QA problem?

DHS asked energy industry to not stop cyber attackers

Starting in December 2011, a highly targeted spear-phishing campaign was launched against a number of companies that operate natural gas pipelines
The emails were very well crafted to appear as if they were coming from trusted sources
Analysis of the malware and other evidence left behind by the attacks confirms that the phishing attacks were successful, something that should have been prevented by standard security practices and proper training
This threat underscores the need for cryptographically secure email, using PGP/GPG or S/MIME to authenticate the sender and the integrity of the message
It seems the DHS asks the companies to avoid disrupting the attacks unless they began to threaten critical infrastructure, in order to collect more evidence and learn more about the attackers
This is especially risky because an attack such as this can escalate extremely rapidly, if suddenly the attackers were able to escalate their privileges within the system, they could start doing serious harm immediately
As we have seen with attacks like Duqu, the first phase of the attack is often about intelligence gathering, before the actual attack begins
Additional Coverage
CERT Monthly Monitor Alert from April 2012

Serious PHP flaw goes unnoticed for 8 years

The flaw in PHP, with the way it implements section 7 of the CGI standard allowed an attacker to pass arbitrary command line parameters to PHP
Specifically, an attack could pass the -s flag, which causes PHP to display the source code of the file
If this were done on a configuration file, such as wordpress’ wp-config.php, it would disclose the MySQL username and password. It could also disclose other secret keys and the source code for proprietary applications
The original fix released by the PHP group on May 3rd did not properly resolve the issue, a trivial work around allowed the attack to continue to be successful
Later an additional attack vector was also discovered, and a newer fix for PHP was released on May 8th
The vulnerability only affected servers that use PHP in CGI mode, and did not affect servers that use the standard Apache mod_php, or PHP-FPM (what ScaleEngine uses)
Many large scale shared hosting providers such as DreamHost and BlueHost use PHP in CGI mode to allow each individual users’ PHP code to be executed as that user
CGI mode has performance disadvantages, as PHP must be loaded separately from each request, resulting in a slower response
FastCGI is a technique where a pool of CGI processors that have already been loaded listen on a TCP port or UNIX Socket and accept and process requests, removing the latency from the typical CGI configuration
Details on the attack and mitigation strategies
Additional Coverage
Try exploiting Facebook

Feedback:

Q. Adam hits the ground running

Helpful Tips/Links:

VMware vCenter Converter, Convert Physical Machines to Virtual Machines
Backup everything. If there are not at least 3 copies of it, it doesn’t actually exist
Don’t be tempted to always roll-your-own solution. Pay for things that have support. That support contract can be your lifeboat, your scapegoat, your ability to ever leave/vacation, and management loves to see an employee doing a great job with a vendor relationship
Linux lives in its conf files. Back those up, keep revisions. You mess something up, restore the original
Make one change at a time, that way when it breaks, you know which change caused the problem
Keep benchmarks and performance graphs, the only way to know if the server is performance as it should, is to compare it to how it was before. Nagios+NagiosGraph is great for this
Keep notes. Helps you back out, but it also is a log of your worth. Your non-sysadmin colleagues have no idea the amount of work you do, it’s hard for them to visualize it. Your log is your proof of your accomplishment. Having this will help you quantity to your boss why you are valuable to the company.
Take it slow, and triage like a doctor in the ER. What does the business have to do every day to make money? Make sure that works, its redundant, backed up, and scalable. Then workout form there.

Round-Up:

The post Sage IT Wisdom | TechSNAP 57 first appeared on Jupiter Broadcasting.

Server Room Fire | TechSNAP 44

chris — Thu, 09 Feb 2012 19:08:08 +0000

It’s a worst case scenario, when a server room catches fire in this week’s war story!

Plus: We’ll share a story that might make you re-think taking advantage of your hard drive warranty, the secrets to reliable SQL replication.

All that and more, in this episode of TechSNAP!

Thanks to:

GoDaddy.com Use our codes TechSNAP10 to save 10% at checkout, or TechSNAP20 to save 20% on hosting!

Super special savings for TechSNAP viewers only. Get a .co domain for only $7.99 (regular $29.99, previously $17.99). Use the GoDaddy Promo Code cofeb8 before February 29, 2012 to secure your own .co domain name for the same price as a .com.

Pick your code and save:
cofeb8: .co domain for $7.99
techsnap7: $7.99 .com
techsnap10: 10% off
techsnap20: 20% off 1, 2, 3 year hosting plans
techsnap40: $10 off $40
techsnap25: 25% off new Virtual DataCenter plans
Deluxe Hosting for the Price of Economy (12+ mo plans)
Code: hostfeb8
Dates: Feb 1-29

Direct Download Links:

Subscribe via RSS and iTunes:

Fill out my Wufoo form!

Show Notes:

Crypto crack makes satellite phones vulnerable to eavesdropping

Researchers at the Ruhr University Bochum in Germany have reverse engineered the GMR–1 and GMR–2 encryption systems used by satellite phones and found serious weaknesses
Both algorithms rely on security by obscurity, but by downloading and disassembling the firmware, researchers were able to isolate the cryptographic algorithms
“Unlike standard algorithms such as AES and Blowfish—which have been subjected to decades of scrutiny from some of the world’s foremost cryptographers—these secret encryption schemes often rely more on obscurity than mathematical soundness and peer review to rebuff attacks”
The GMR–1 encryption system uses an algorithm that closely resembles the proprietary A5/2 encryption system that former protected GSM phone networks, before it was phased out in 2006 due to weaknesses that allowed attackers to decrypt calls in real time
The attack against GMR–1 allows anyone with a modest PC and some open source software to decrypt a call in less than an hour. With a cluster of more powerful machines, it is possible to decrypt a call in real time
GMR–2 phones are also vulnerable to cracking when there is known plaintext. This is a particularly glaring issue because the datagrams contains predictable headers and other content that can be known by the attacker, making such attacks possible
Researchers have not yet reverse engineered the audio codec that is used for voice calls, so a call can be decrypted, but not played back (yet). However other data types that do not use the audio codec (fax, SMS, data), have successfully been intercepted
Researchers are only able to intercept communications between the satellite and the user, not communications in the other direction, so only one side of the call can be eavesdropped. This is likely a limitation of the way satellite signals work, to intercept the signal from the phone to the satellite, you would need line of sight, usually requiring an EL-INT aircraft or satellite.

Customer buys refurbished drive from newegg, finds existing partitions and data

This story raises a number of questions about used and refurbished drives
Everyone knows that they should securely erase their drive before they resell it, we covered some of the techniques on TechSNAP 31 – How Malware Makes Money
However, how do you securely erase a drive when it has failed in some way?
You send the drive back to the store or the manufacturer in order to receive a replacement drive, however, you must trust to them to securely erase your data, since the drive was not usable when it left you
In this case it would seem that the drives we repaired, turned around and sold to another customer, without the data being properly erased
It would seem the only option that customers have is to not return the failed drive, which means not taking advantage of their warranty and having to pay full price for the replacement drive

Feedback:

Nehemiah sends in a story related to last weeks war story about DHCP

Q: chocamo from the chatroom asks about MySQL Replication

A: MySQL has a few different replication modes built in, the main one being asynchronous replication, where a slave server constantly reads from the binary log of all changes made to the database. So you start with your two servers in a converged state (meaning they have exactly the same data), then then each time an UPDATE or INSERT command is run on the master, the slave runs the same commands, in the same order, and should continue to have the same data.

However, the slave is read only. If you want to do load balancing of more than just reads, you need to do what is called ‘multi-master replication’, In this setup, you have 2 or more servers that are all masters, and each is also the slave of the server in front of it. Something like: A -> B -> C -> A. So when an INSERT is done on server B, server C then executes that same INSERT statement, and then A, and when the query gets back to B, B notices that the query originated at B, and so skips it, preventing a loop. If you attempt an approach such as this, you will also need to adjust the auto_increment settings in MySQL, you will want the auto_increment_increment to be at least as many servers as you have, and then each server should have a different auto_increment_offset. This is to prevent primary key collisions, so that if an INSERT is done on each of the three servers at the same time, each row ends up with a unique key, otherwise replications stops until you solve the primary key collision. In the ScaleEngine setup, we also have 2 real-only slaves, one from server A and one from server C, the first offers read-only access to customers, to be used by applications that support using a read-only slave, and the other is used for taking backups (we pause replication to get a perfectly consistent copy of the entire database, then resume replication to catch back up to real-time data)

MySQL 5.5 also introduces ‘semi-synchronous replication’. In this mode, the MySQL client does not return from the query until the data has been written to not only the master, but at least X of the N slaves. This allows you to ensure that the data has actually been replicated and is safe from the failure of the master server. Normal replication in MySQL is asynchronous, meaning that when you make a change, the client returns a successful result as soon as the data has been written to the server you are connected to, and then replications happens later, this is normally the desired behaviour because it provides the greatest speed, however if the server you wrote to fails before any other servers replicate the change, that change could be lost. Semi-Synchronous replication attempts to solve this issue by allowing you to wait until there is at least 1 or more additional replicas of the data before returning a successful write. Fully synchronous replication is normally undesirable due to the performance impact.

If a table is too large, you can use ‘partitioning’ to break it in to smaller tables. You can also use the MySQL ‘Federation’ feature, to make databases from more than one server appear to be local to a single server, allowing you to move different databases to different physical machines.

War Story:

This week’s features another war story from our good friend Irish_Darkshadow (the other other Alan)

Setting:
IBM has essentially two “faces”, one is the commercial side that deals with all of the clients and the other is a completely internal organisation called the IGA (IBM Global Account) that provides IT infrastructure and support to all parts of IBM engaged with commercial business.

The IBM email system uses Lotus Domino as the server component and Lotus Notes as the client side application. The Domino servers handle the email for the company but also serve as database hosts and applications hosts. At the point in time when this war story took place, each country had their own server farm for these email / database / application servers. Each individual EMEA (Europe / Middle East / Africa) country then routed email from their in-country servers to the two “hubs”, those being Portsmouth (North Harbour) in the UK and Ehningen in Germany.

The events described below took place in the summer of 2004.

War Story:

Well, there I was once more with the 24×7 on-call phone and bouncing through my weekend without a care in the world. Well, sort of I suppose, if you don’t count a German girlfriend with shopping addiction and two kids with the inability to be quiet and give daddy some quality time with his computers. It was a Sunday afternoon and we were at the cinema which I figured was a safer option than what I chose to do for my last was story (getting very drunk).

The on-call phone started to ring almost immediately after we got out of the movie and it was the duty manager telling me that she had been “summoned” to the office to some of the higher ups for the EMEA geography. My first instinct was “and this is my problem, why?” but I resisted the urge to expose my inner bastard and played nice instead. I suspected that she had simply guessed that being called in to the office without any details was likely not a good sign and it might be useful to have some insurance (or a scape goat) beside her for the upcoming call. Apparently as I was the Crit Sit Manager for that week, I was the aforementioned insurance.

Being the devious little git that I am, I decided to bring the kids with me to the office. That would then allow me to counter any requirements on my time there with a need to get the kids home to feed them / wash them / imprison them…whatever fitted best. Essentially they would be my passport to get out of the office and buy myself some time if I needed it.

The Duty Manager that day was one of those people who had graduated to the position despite having absolutely no technical skill or capability but had an uncanny knack of lunching with the right people and “networking” with the right higher ups. Upon arrival in the office I sat in her office with her to chat about any details she had left out during her call to me. I had the kids running up and down the aisles of the call centre with one of the agents I trusted keeping an eye on them.

Nothing new was divulged prior to the big conference call kicking off and even when they started to expain the purpose of the call, details were being kept very very vague. The driver on the call was a guy from Italian Service Management which completely threw me as I had never seen a high level call originate from that part of the organisation.

The key part of the call went something like this :

Italian Guy: We are, eh, here today to eh, discuss a situation in the Vimercate (vim err kaa tay) site. Eh, perhaps we should proceed on that basis.

Duty Manager: Hello there, xxx here. I’m the duty manager for the EMEA CSC this weekend. I’m not sure what the Vimercate site is. Could you please explain ?

Me : *presses mute on the phone
Vimercate is the server farm location for Italy, all of the email and Lotus Notes database / applications for the country are run from there. If that site is down then IBM Italy will be unable to do ANY business for the duration of the outage.
*unmutes the phone

Italian Guy: It is one of our locations here in Italy that is responsible for some servers.

Duty Manager: Ah ok, thanks for the explanation.

Italian Guy: Well about two hours ago eh….we a, received a call from the cleaning contractors that there was a, some cigarette coming out of the server room. We immediately alerted the rest of Service Management and started dealing with the crisis as a critical situation.

Me: ** rolls about laughing then thinks to telnet to some email servers in that site and nothing was connecting…….the urgency of the call started to dawn on me at this point.

Duty Manager: I’m sorry but I don’t understand what you mean when you say that there was a cigarette coming out of the server room. Did I mishear you?

Italian Guy: Sorry, not cigarette, I mean to say smoke. There was smoke coming out of the server room.

Duty Manager: Oh lord, has anyone been hurt? Is there any emergency service personnel at the site?

Italian Guy: Yes, the fire service were alerted almost immediately and nobody other than the cleaning staff was in the site when the alarm was raised. The fire has spread to other parts of the building and the firemen have been unable to get to the server room yet.

Me: Hi, I’m the crit sit manager here today. Could you please give me a current status on the server room itself? If those servers are not recoverable then we will need to activate the business continuity location and get the backup tapes couriered there. We could be up and running within 12 hours that way.

Italian Guy: Yes, yes, we know all of that. We are service management. We have already started to deal with those things. We invited you onto this call so that you are aware of the issue and can place voice messages on your incoming call lines and have your agents prepared to explain things to our users if they call your help desk. Nothing more.

Me: I have no doubt that you are on top of the situation but in such circumstances the in-country Service Management report in to the EMEA Critical Situations team who then coordinate all actions until there is a satisfactory resolution as per the EOP (Enterprise Operating Procedures). I will be taking point on this for you and liaising with EMEA Service Management for the duration of this situation.

**lots of back and forward, territorial pissing contest arguing took place until it was agree to have a followup call every hour. The second call went something like this :

Me: Good evening folks, how are things progressing on the site now?

Italian Guy: The emergency services are having difficulty due to the age of the building and they have not been able to get to the server room yet. There is nothing else new to say.

Duty Manager: So does that mean the servers are destroyed now or is there still some chance?

Italian Guy: The fire suppression system in the server room activated, that is all that we know right now.

** we adjourned the call and the next two were more of the same until the fifth call :

Italian Guy: The firemen have made it to the server room and have reported that the fire suppression system has not worked correctly. The servers themselves have been fire damaged.

Duty Manager: That’s very unfortunate, how are your efforts to get the backup tapes to the secondary site going?

Italian Guy: Eh, there is a problem with that too. The tape libraries are in the same room as the servers in an enclosure. The firemen have not retrieved them for us yet.

Me: Whoa, hold on a minute. The tapes that we’ve been trying to get into play for the last four hours are actually in the same room with the fire? Why didn’t you tell us that earlier ? If both the servers AND the backup tapes are destroyed then IBM Italy will be offline for days while a secondary site is configured. This completely changes the severity of this situation.

Italian Guy: yes, we believe that both the servers and the tapes have been damaged at this time.

**at this point I resisted the urge to reach my arm through the phone line and throttle this guy.

Duty Manager: So what can we do at this point?

Me: We need to get EMEA Service Management to start prepping a completely fresh site to take over for the ruined server farm. The problem is now that we’ve lost four hours waiting for tapes that were never going to arrive, we could have had the new servers being readied all that time.

So this all continued for a few more calls, I had my girlfriend pick up the kids between the calls and take them home and I just dived in and tried to maintain some momentum in the resolution efforts. Rather than drag it out and bore you to tears, here were the remaining revelations :
Servers were burnt to a crisp.
Backup tapes (which were in the same room) were partially burned but all were smoke damaged.
The fire suppression system simply failed to work
The firemen had to use water due to the composition of the building…WATER…on a room full of electronics.
It took 2 full days to build the new server environment which essentially meant that IBM Italy were unable to do business electronically for that duration.
Nobody ever explained why the tapes were in the server room other than to say – it was an oversight by the IT Manager. Really? an oversight?!?!!
The only bright spot in the entire debacle was that some of the data on the tapes was salvaged and shortened the duration of the outage significantly for some people.

I’m not sure there is a moral to the story or a catchy tag line like “patch your shit” but I suppose that my overriding memory of the whole situation was when I wondered how anyone thought it would be a good idea to put backup tapes in the same physical location as the servers and then neglected to do regular maintenance on an old building that was clearly a fire trap.

Round-Up:

The post Server Room Fire | TechSNAP 44 first appeared on Jupiter Broadcasting.

DHS – Jupiter Broadcasting

Russiagate is Bogus | Unfilter 253

RSS Feeds:

Become an Unfilter supporter on Patreon:

— Show Notes —

Links

Assange’s October Dud | Unfilter 207

RSS Feeds:

Become an Unfilter supporter on Patreon:

— Show Notes —

Links:

Pulsed Gun Control | Unfilter 192

Direct Download:

RSS Feeds:

Become an Unfilter supporter on Patreon:

— Show Notes —

Episode Links

SpyFi Barbie | TechSNAP 243

Direct Download:

RSS Feeds:

Become a supporter on Patreon:

— Show Notes: —

Feedback:

Round Up:

PLAID Falls Out of Fashion | TechSNAP 239

Direct Download:

RSS Feeds:

Become a supporter on Patreon:

— Show Notes: —

Feedback:

Round up:

Radicalized and Viral | Unfilter 147

Direct Download:

RSS Feeds:

Become an Unfilter supporter on Patreon:

Show Notes:

Insane In The Ukraine | Unfilter 86

Direct Download:

RSS Feeds:

Become an Unfilter Supporter:

— Show Notes —

If you’re a Supporter check your inbox!

Then They Fight You | Plan B 8

Downloads:

RSS Feeds:

— Support the Show —

— Show Notes: —

— Feedback —

Call or txt the Show:

— Discussion —

— Greg Managing Editor of The Genesis Block.COM —

— Watch Live —

— Plan B Subreddit —

— Contact us —

— Music —

Amir Taaki & #Bitcoin 2013 | Plan B 7

RSS Feeds:

— Show Notes: —

— Feedback —

Call or txt the Show:

— Discussion —

— Amir Taaki —

— Extended Q&A —

— Over Time —

— Watch Live —

— Plan B Subreddit —

— Contact us —

— Music —

— Support the Show —

Burn it Down | Unfilter 37

Direct Download:

RSS Feeds:

Become an Unfilter Supporter:

Get Unfilter on your Android:

Browser Affiliate Extension:

–Show Notes–

We want voicemails!

Super Spin Sandy | Unfilter 24

Direct Download:

RSS Feeds: