Show Notes: extras.show/47

The post Infrastructure Engineer: Seth McCombs | Jupiter Extras 47 first appeared on Jupiter Broadcasting.

A batch of Dropbox usernames and passwords hit the web, Court document reveal Apple’s $50 Million for product leak fine & Newsweek comes under fire.

Plus our thoughts on the return of PC market growth & much more!

Direct Download:

MP3 Audio | OGG Audio | Video | HD Video | Torrent | YouTube

RSS Feeds:

MP3 Feed | OGG Feed | iTunes Feed | Video Feed | Torrent Feed

Become a supporter on Patreon:

Show Notes:

Change Your Password: Hackers Are Leaking Dropbox User Info

After first surfacing Reddit, several Pastebin files have been found to contain hundreds of Dropbox users’ usernames and passwords—and the anonymous poster claims that there are millions more to come.

• According to the Next Web, the leaked lists are meant to entice users to donate Bitcoin, at which point the purported hacker will release more users’ info. The message atop the list reads:
  

  Here is another batch of Hacked Dropbox accounts from the massive hack of 7,000,000 accounts

  To see plenty more, just search on [redacted] for the term Dropbox hack.

  More to come, keep showing your support

• To put it another way: You need to change your password. Now. And then make sure that two-factor authentication is turned on.

Update 11:29pm:

• A spokesperson from Dropbox has provided us with the following statement:
  

  Dropbox has not been hacked. These usernames and passwords were unfortunately stolen from other services and used in attempts to log in to Dropbox accounts. We’d previously detected these attacks and the vast majority of the passwords posted have been expired for some time now. All other remaining passwords have been expired as well.

• DROPBOX.COM HACKED First Teaser – Pastebin.com

• Two Factor Auth List

Court document reveals that Apple could fine sapphire glass manufacturer $50 Million for product leaks

GT Advanced Technologies filed for Chapter 11 bankruptcy protection last week and the court documents have revealed an interesting agreement with Apple. GT Advanced, who was contracted to make sapphire glass displays for Apple, stated that there was a clause in its contract that would see them fined upward of a $50 million (USD) penalty for any leaked products.

Man Pegged By Newsweek as Satoshi Nakamoto Plans Legal Action | NEWSBTC

Dorian Prentice Satoshi Nakamoto’s name became public — very public — in a highly sensationalized exposé entitled The Face Behind Bitcoin _written by journalist Leah McGrath Goodman, employed by _Newsweek.

Legal defense fund

Nakamoto, along with the Kirschner & Associates law firm, have started a website at NewsweekLied.com to ask for donations to help establish a defense fund in an ultimate lawsuit against Newsweek.

Yes. Bitcoin accepted.

You can read all the reasons that Dorian is angry here on the site’s background page, and it’s perfectly understandable where he’s coming from.

“Newsweek must be held accountable for its reckless reporting,” the site reads.

• Background — The Dorian Nakamoto Legal Defense Fund

With This Tiny Box, You Can Anonymize Everything You Do Online | WIRED

Today a group of privacy-focused developers plans to launch a Kickstarter campaign for Anonabox. The $45 open-source router automatically directs all data that connects to it by ethernet or Wifi through the Tor network, hiding the user’s IP address and skirting censorship. It’s also small enough to hide two in a pack of cigarettes.

Decline in PC Sales Starts to Slow; Largest Makers See Growth – NYTimes.com

IDC and Gartner on Wednesday released numbers on the worldwide demand for PCs that showed only a slight drop in demand, a distinct contrast to the trend of the last three years. This likely means, analysts said, that consumers may not be choosing tablets and smartphones over PCs to the same degree they had in the past. Soon, they said, the industry might see growth again.

It has come already for the biggest manufacturers. Companies like Lenovo, Hewlett- Packard and Dell all had good growth, particularly in a strong U.S. market.

In the United States, IDC said 17.3 million PCs were shipped, an increase of 4.3 percent from a year ago. Gartner put the number at 16.9 million, a rise of 4.2 percent. The top five companies were HP, Dell, Apple, Lenovo and Toshiba, both IDC and Gartner said.

• Stocks Benefiting From Increasing PC Sales Include Hewlett-Packard (NYSE: HPQ), Seagate Technology (NASDAQ: STX) – 24/7 Wall St.

The post Dropbox Those Passwords | Tech Talk Today 75 first appeared on Jupiter Broadcasting.

That Adobe breach we told you about? It’s about 10x worse than originally reported, we’ll share the details.

Plus PHP.net gets compromised, howto future proof your storage, and much much more!

On this week’s TechSNAP!

Thanks to:

Adobe breach worse than originally thought, number of impacted customers now atleast 38 million

• Adobe is continuing its flurry of password resets, which now extend to more than 38 million customers
• Adobe has also revised its original list of applications for which the source code was leaked to include the entire photoshop family of programs
• “This past weekend, AnonNews.org posted a huge file called “users.tar.gz” that appears to include more than 150 million username and hashed password pairs taken from Adobe” – This number apparently includes inactive and test accounts, the 38 million number mentioned earlier are those considered ‘Active’
• A company spokesperson said Adobe has no indication that there has been any unauthorized activity on any Adobe ID involved in the incident
• As part of its resolution of the breach, Adobe is offering customers a years worth of free credit monitoring… from Experian (See last weeks story about how Experian was caught selling personal data to identity thieves)
• Additional Coverage

PHP.net compromised, serves malware and is blocked by Google Safe Browsing

• On 24 Oct 2013 06:15:39 +0000 Google started saying www.php.net was hosting malware. The Google Webmaster Tools were initially quite delayed in showing the reason why and when they did it looked a lot like a false positive because we had some minified/obfuscated javascript being dynamically injected into userprefs.js.
• To summarise, the situation right now is that:
• JavaScript malware was served to a small percentage of php.net users from the 22nd to the 24th of October 2013.
• Neither the source tarball downloads nor the Git repository were modified or compromised.
• Two php.net servers were compromised, and have been removed from service. All services have been migrated to new, secure servers.
• SSL access to php.net Web sites is temporarily unavailable until a new SSL certificate is issued and installed on the servers that need it.
• Over the next few days: php.net users will have their passwords reset. Note that users of PHP are unaffected by this: this is solely for people committing code to projects hosted on svn.php.net or git.php.net.
• As part of this, the php.net systems team have audited every server operated by php.net, and have found that two servers were compromised: the server which hosted the www.php.net, static.php.net and git.php.net domains, and was previously suspected based on the JavaScript malware, and the server hosting bugs.php.net.
• All affected services have been migrated off those servers. We have verified that our Git repository was not compromised, and it remains in read only mode as services are brought back up in full.
• As it\’s possible that the attackers may have accessed the private key of the php.net SSL certificate, we have revoked it immediately.

Researchers at Vicarious software claim to be able to defeat 90% of Captchas

• “Vicarious is developing machine learning software based on the computational principles of the human brain. Our first technology is a visual perception system that interprets the contents of photographs and videos in a manner similar to humans.“
• The claim that using this technology, they can defeat 0% of common anti-bot technology used to defect websites from automated usage
• While no paper or code has been shared, they provide a demonstration video that appears fairly compelling
• If their claim is true, this could be a huge setback for the internet
• Captchas are often used to prevent automated signups for services, to defend login systems from brute force attempts, and to moderate spam in online discussion and comment forums
• CAPTCHA creator Luis von Ahn of Carnegie Mellon University says “This is the 50th time somebody claims this. I don\’t really get how they think this is news :)”
• The writing from ScienceMag jumped on a skype call with the company and send them 4 sample captchas, a recaptcha and a paypal captcha were both solved, however another containing cyrillic characters was not (the company says they have not trained their system on non-latin characters yet), and one containing a checkerboard pattern was also not solved immediately.
• If this research got into the wrong hands, it could be used to defeat protection systems across the internet, flooding websites with spam, evading brute force protection systems and otherwise wreaking havoc

Feedback:

• ZFS Choices

  • iXsystems Amazon Store – buy a FreeNAS Mini and support JB at the same time

• freenas/zfs with raid many enclosures

• Software RAID vs LVM

Round Up:

• Announcing The Dark Mail Alliance – Founded by Silent Circle & Lavabit
• Keynote: Tradeoffs in Cyber Security – Cyber Security Symposium, University of North Carolina
• NSA infiltrates links to Yahoo, Google data centers worldwide, Snowden documents say
• ShellCheck – a “Static” analyzer for shell script, finds many common flaws and mistakes
• How the NSA is infiltrating private networks
• Researcher exposes issues with online music charts like Spotify, how to make money with fake music + amazon EC2 instances, and how to get your rival’s account suspended
• Why you shouldn’t interupt a programmer
• FAA develops new guidelines for the use of Personal Electronic Devices during all phases of flight – Airlines must test each airframe and pass a safety approval process
• Bluecoat security blog Roundup of recent news
• HP sues seven optical drive manufacturers over alleged price fixing
• De-anonymizing users of french political forums
• Cyber Dialog 2013 – Canada Centre for Global Security Studies, University of Toronto
• Doing Strong Cryptography in the Browser

The post TrekSNAP | TechSNAP 134 first appeared on Jupiter Broadcasting.