downtime – Jupiter Broadcasting

SourceForge’s Downfall | TechSNAP 225

chris — Thu, 30 Jul 2015 17:08:13 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

SourceForge sees downtime, and we examine their infrastructure, a new pervasive hackgroup has been exposed and their track record is fascinating.

Plus a Hacking Team Round up, a wide variety of audience questions, our answers & much, much more!

Thanks to:

Get Paid to Write for DigitalOcean

Direct Download:

RSS Feeds:

Become a supporter on Patreon:

— Show Notes: —

SourceForge Downtime

SourceForge suffered a large data corruption problem and was down for a number of days, slowly restoring services as they could
“The Slashdot Media sites experienced an outage commencing last Thursday. We responded immediately and confirmed the issue was related to filesystem corruption on our storage platform. This incident impacted all block devices on our Ceph cluster. We consulted with our storage vendor when forming our next steps”
As part of this, we learned a bit about the backends of sourceforge and slashdot
Server platform is CentOS Linux.
We use an Open Source virtualization platform and have in recent years achieved a 75%+ reduction in physical server count through widespread virtualization.
We use an Open Source storage platform, Ceph, with spinning disks and SSD.
The storage backing our services is a mix of ext4, XFS and NFS.
Our backup solution is Open Source, backing on to popular cloud storage platforms.
Our sites use Open Source database platforms including MongoDB and flavors of MySQL and PostgreSQL.
We leverage scalable data solutions including Hadoop and ElasticSearch.
Slashdot is backed by Perl. SourceForge is backed by Python. Both language stacks are entirely Open Source.
And the SourceForge developer services are backed by the Apache Allura code base, which we Open Sourced and delivered to the Apache incubation process.
“We’re prioritizing the project web service (used by many projects using custom vhosts), mailing lists, and the ability to upload data to our download service. Downloads (40+ TB of data)”
Most Recent Update – Sourceforge Blog
A Post mortem is expected once everything is restored

Black Vine Group behind Anthem breach

In a report last week Symantec said it was Black Vine that broke into the health insurer “Anthem” system’s and stole more than 80 million patients records.
The group has the resources to customize malware, and uses zero-day vulnerabilities in Microsoft Internet Explorer to launch watering-hole attacks.
Black Vine’s malware Mivast, was used in the Anthem breach, according to Symantec.
Anthem said the hack likely began in May 2014, but that it didn’t realize its systems had been compromised until January. The company, which is one of the largest health insurance providers in the U.S., disclosed the breach in February. Hackers made off with personal data including names, birth dates, member ID numbers and Social Security numbers.
Like other Black Vine attacks, The Mivast malware was signed with a fake digital certificate. (more on that below)
Since 2012 Black Vine has gone after other businesses that deal with sensitive and critical data, including organizations in the aerospace, technology and finance industries, according to Symantec. The majority of the attacks (82 percent) were waged against U.S. businesses.
During its research, Symantec discovered Black Vine began using exploits around the same time as other hacking groups. Each group delivered different malware and went after certain organizations,
The fact that they used the same exploits as other groups suggests the attackers relied on the same distribution network.
One of the group’s first attacks came in December 2012 against gas turbine manufacturer Capstone Turbine, Symantec said.
That hack used the IE exploit CVE-2012-4792 and delivered the Sakurel malware.
Symantec noted that the malware was signed with a digital certificate attributed to a company called Micro Digital, fooling Windows into believing the program was legitimate.
In 2013 and 2014, Black Vine targeted companies in the aviation and aerospace industries. One third-party blog cited by Symantec noted that in 2013 specific employees at a global airline were sent spear phishing emails containing a URL that instructed them to download Hurix.
Symantec claimed some Black Vine members have ties to Topsec, a Chinese IT security company, and the group has access to the Edlerwood framework
PDF

Hacking Team Roundup:

FreeNAS Mini Review by Toms Hardware

Feedback:

Round Up:

The post SourceForge's Downfall | TechSNAP 225 first appeared on Jupiter Broadcasting.

Wire-Shark | TechSNAP 78

chris — Thu, 04 Oct 2012 16:53:15 +0000

We’ve got the details on a critical flaw in the chip and pin credit card system. The future of secure hashing, doing proper backups with rsync, and how squirrels and sharks take down the Internet.

Plus a big batch of your questions, and our answers.

All that and more, on this week’s TechSNAP

Thanks to:

GoDaddy.com

Use our codes TechSNAP10 to save 10% at checkout, or TechSNAP20 to save 20% on hosting!

BONOUS ROUND PROMO:

Get your .COMs just $5.99 per year up to 3 domains! Additional .COMs just $7.99 per year!
CODE: 599tech

Expires 10/31/12

SPECIAL OFFER! Save 20% off your order!
Code: go20off5

Pick your code and save:
techsnap7: $7.49 .com
techsnap10: 10% off
techsnap11: $1.99 hosting for the first 3 months
techsnap20: 20% off 1, 2, 3 year hosting plans
techsnap40: $10 off $40
techsnap25: 25% off new Virtual DataCenter plans
techsnapx: 20% off .xxx domains

Direct Download:

RSS Feeds:

Support the Show:

Purchase anything at Amazon.com
Purchase anything at Think Geek using this link
Purchase anything at Newegg using this link
Contribute directly on our donation page or check out our advertising options and reach millions of amazing people!
Grab our Chrome Extension and auto-tag your shopping session for us!

Fill out my Wufoo form!

Show Notes:

Get TechSNAP on your Android:

Browser Affiliate Extension:

Jupiter Broadcasting Affiliate Extensions for Chrome and Firefox

Chip and Pin security flaw exposed by Cambridge Researchers

Chip and Pin technology replaces the traditional magnetic strip and signature method of authorizing a Credit Card or Debit Card transaction
The technology uses the chip embedded in the card to authenticate itself to the PoS (Point of Sale) terminal, once the PIN is entered, proving that it is not a forged or cloned card
This provides stronger authentication of the card holder, using the secret PIN rather than comparing signatures
The original idea behind this concept was to shift liability for fraudulent transactions to the card holder, since the transaction could only go through if the PIN was provided, the transaction must have been authorized by the card holder, or the card holder was careless with their PIN number
This liability shift was never enacted, due to various flaws found in the system, including one where a blank card, connected to a stolen card, could be used to access the funds on the stolen card with an arbitrary pin number
The most recent flaw takes the form of a pre-play attack, which allows the attacker to determine the information required to authorize a transaction without the PIN number
The authentication protocol used between the PoS and the Chip requires the PoS terminate to generate a nonce , referred to in the documentation as an ‘unpredictable number’. The purpose of the nonce is to ensure that the authentication is fresh, preventing an attacker from using an old authentication response
The problem is in the implementation, many PoS terminates do not generate a random (or even pseudo-random) number for the nonce, but rather use a timestamp or counter
This allows an attack, that from the logs at your bank, appears as if your card was cloned, which is supposed to be nearly impossible due to the chip embedded in your card
The researchers discovered this vulnerability while investigating the case of an HSBC customer who was refused a refund from his bank, who stated that he must have entered his PIN at the ATM where his cash was withdrawn, in a different country
At the behest of the researchers, he demanded the banks logs of the transaction
Date Time UN
2011–06–29 10:37:24 F1246E04
2011–06–29 10:37:59 F1241354
2011–06–29 10:38:34 F1244328
2011–06–29 10:39:08 F1247348
As you can see, the ‘unpredictable number’s do not seem very random at all, infact they appear to be a 17 bit fixed value, followed by a 15 bit counter that is incremented every few milliseconds, and rolls over every 3 or so minutes
The research discusses how this weakness could use used to execute a ‘pre-play’ attack
An employee working at a restaurant or retail store, could run your card through a device that would provide the authentication code required to access the card during some specific window of time in the future, allowing them to withdraw funds from your account at an ATM without knowing your PIN number. This attack could also be executed by malware built in to a PoS terminal or vending machine
The researchers built their own special card that could extract the unpredictable number from each transaction they performed, and by doing a number of ‘balance check’ transactions, where we able to assess the randomness of the UNs
Research Paper
Blog post by Reseacher

NIST chooses keccak as new SHA–3 hashing algorithm

Pronounced catch-ack
The algorithm was designed by Guido Bertoni, Joan Daemen and Gilles Van Assche of STMicroelectronics and Michaël Peeters of NXP Semiconductors, and was one of 63 entrants to the NIST competition
The competition started in 2007 when it looked like there may be issues with SHA–2
Those issues never surfaced and SHA–2 is still considered secure
Because keccak is not derivative of SHA–2, but entire different, it means that an attack against SHA–2 will be very unlikely to also be effective against SHA–3

Feedback:

Jupiter Broadcasting on Stitcher

Have some fun:

What will be in the news the week in October when Allan is at Euro BSD Con? Let make a prediction on the head lines or just make up funny stuff to read

What I wish the new hires “knew”

Round-Up:

The post Wire-Shark | TechSNAP 78 first appeared on Jupiter Broadcasting.