Show Notes: extras.show/61

The post Brunch with Brent: Nuritzi Sanchez | Jupiter Extras 61 first appeared on Jupiter Broadcasting.

Show Notes: extras.show/39

The post Makerspace 101: Brian Beck | Jupiter Extras 39 first appeared on Jupiter Broadcasting.

Video Feed | MP3 Feed | OGG Feed | HD Torrent | Mobile Torrent | iTunes

Become an Unfilter supporter on Patreon:

— Show Notes —

— Links —

• Smith–Mundt Act – Wikipedia
• Bears in the Midst: Intrusion into the Democratic National Committee »
• ThreatConnect follows Guccifer 2.0 to Russian VPN Service
• Bear Hunting: Tracking Down COZY BEAR Backdoors
• Shiny Object? Guccifer 2.0 and the DNC Breach
• Hillary Clinton Email Targeted by Threat Group-4127 | SecureWorks
• Washington Post admits article on ‘Russian propaganda’ & ‘fake news’ based on sham research — RT America
• Unpacking the New CIA Leak: Don’t Ignore the Aluminum Tube Footnote – emptywheel
• Secret CIA assessment says Russia was trying to help Trump win White House – The Washington Post
• US Intelligence Officials: Our Warnings To Europe About Russian Hacking Were Too Late – BuzzFeed News
• Hillary Clinton’s Call for Congress to Do Something About Fake News ‘Epidemic’ Is a Reminder of How Bad Her Presidency Would Have Been on Free Speech – Hit & Run : Reason.com
• Hillary Clinton Attacks Fake News, Then Gets Criticized For Her Campaign’s ‘Hypocrisy’
• Hillary Clinton throwing party to thank millionaire donors | Page Six
• Clinton Basically Admits She Learned Nothing From Losing to Trump | Observer
• Anonymous Leaks to the WashPost About the CIA’s Russia Beliefs Are No Substitute for Evidence
• CIA Report Concludes That Russia Tried to Help Trump Win
• President Obama Orders Intel Agencies To Produce Report On Russian Election Influence | Techdirt
• Bear Hunting: Tracking Down COZY BEAR Backdoors
• Shiny Object? Guccifer 2.0 and the DNC Breach
• Hillary Clinton Email Targeted by Threat Group-4127 | SecureWorks
• Trump on Russia meddling in US election: ‘I don’t believe it’
• A house divided: The alarming response to Russian meddling in American democracy | The Economist
• Newslogue Debate
• Are We Seriously Supposed to Buy Mika Brzezinski’s Clinton Campaign Claim? | Mediaite
• Liz Wahl: ‘The Goal of Russian Media is to Undermine Faith in Our Institutions’ | Mediaite
• No, Hillary Clinton did not get more votes than any candidate ever
• WikiLeaks: CIA claim of Russian involvement in DNC leak is false says former UK ambassador
• White House suggests Trump benefited from Russia hacking – CNNPolitics.com
• NYT reporter who sold the world on WMDs, Judith Miller, is now pushing the “Russian election hack” lie [Video]
• Bipartisan group of senators calls for probe of Russian role in 2016 US elections – CNNPolitics.com
• Clinton campaign backs call for intelligence briefing before Electoral College vote – POLITICO
• CONFUSION: WH spokesman claims ‘China’ hacked election – The American MirrorThe American Mirror
• Trump, DNC, RNC Flunk Email Security Test — Krebs on Security
• Next time anyone says “Fake News” tell them to open a fucking Dictionary and use the correct term : Propaganda , and then to stop thinking like an idiot. : WikiLeaks
• Joe Rogan questioning the mainstream Russian Hacks Narrative on his Twitter – Imgur
• As Trumplethinskin lets down his hair for tech, shame on Silicon Valley for climbing the Tower in silence – Recode
• Obama Must Declassify Evidence of Russian Hacking
• Sarah Abdallah on Twitter: “This is what the MSM will never show you: Overjoyed Syrians celebrating the full liberation of #Aleppo from US-backed terrorists. #Syria https://t.co/UM5VtrHjCp”
• Saudi Arabia now employing 14 lobby firms as it fights 9/11 law | TheHill
• The long history of the U.S. interfering with elections elsewhere – The Washington Post
• The Evidence to Prove the Russian Hack – emptywheel
• Sharing National Security Letters with the Public
• WikiLeaks – The Podesta Emails
• Today’s teens are way better behaved than you were – The Washington Post
• Asa Winstanley on Twitter: “Image being shared as showing Aleppo today is actually from 2014 music video. As with Gaza, beware false info https://t.co/2SM4l8RgDF”
• andrew kaczynski on Twitter: “Here’s video of Rex Tillerson getting his “Order of Friendship” medal pinned by Putin https://t.co/oNqx0mHG7l”
• The Perfect Weapon: How Russian Cyberpower Invaded the U.S. – The New York Times
• Glenn Greenwald on Twitter: “Most striking part of NYT article was the primitive nature of Podesta hack & the sheer luck of its success: hardly some masterful invasion https://t.co/uZf3pc7cAP”
• Here’s the Public Evidence Russia Hacked the DNC – It’s Not Enough
• It’s Official: Hillary Ran The Most Incompetent Campaign Ever
• The bogus claim that Obama ‘skips’ his intelligence briefings – The Washington Post
• Where was the media outrage when Obama ignored intelligence briefings on ISIS?
• President Obama Returns to DC Amid ISIS Intelligence Report Investigation – ABC News
• New DEA Rule Says CBD Oil is Really, Truly, No-Joke Illegal | Leafly
• Trump names Elon Musk, Uber CEO to advisory team | TheHill
• U.S. Repeals Propaganda Ban, Spreads Government-Made News to Americans | Foreign Policy
• ‘Anti-Propaganda’ Ban Repealed, Freeing State Dept. To Direct Its Broadcasting Arm At American Citizens | Techdirt
• United States Information and Educational Exchange Act of 1948 (Smith-Mundt Act)
• How Clinton lost Michigan — and blew the election – POLITICO
• Phil Kerpen on Twitter: “Hillary Clinton spent millions in Chicago and New Orleans to win the popular vote instead of the election. https://t.co/cJ3EEB4Pc0 https://t.co/1i2jtHbiqX”
• Clinton’s Closest Advisors Blast Huma For Derailing Campaign | Zero Hedge

The post Russian to Conclusions | Unfilter 217 first appeared on Jupiter Broadcasting.

HD Video Feed | Mobile Video Feed | MP3 Audio Feed | Ogg Audio Feed | iTunes Feed | Torrent Feed

Become a supporter on Patreon:

Show Notes:

FBI Arrests Two Alleged Members of Group That Hacked the CIA Director

• “Two young men from North Carolina have been charged with their alleged connection to the hacking group “Crackas With Attitude.” The group gained notoriety when it hacked into the personal email account of CIA Director John Brennan last year and in the following weeks claimed responsibility for hacking the Department of Justice, email accounts of several senior officials, and other US government systems.”
• “Andrew Otto Boggs, 22, who allegedly used the handle Incursio, or IncursioSubter, and Justin Gray Liverman, who is suspected of using the moniker D3f4ult, were arrested on Thursday, according to a press release by the US State’s Attorney’s Office in the Eastern District of Virginia.”
• “Crackas With Attitude, or CWA, first sprung on the hacking scene when they broke into Brennan’s AOL email account in October 2015. The group distinguished itself for openly bragging about their exploits and for making fun of their victims online. After hacking into Brennan’s account, one of the members of the group, known as “Cubed,” said it was so easy “a 5 year old could do it.” After Brennan, the group targeted and hacked the accounts of Director Of National Intelligence James Clapper, a White House official, and others.”
• “Much of the time, the group would use social engineering to gain access to accounts. In February, one member of the group explained to Motherboard how they broke into a Department of Justice system, by calling up the relevant help desk and pretending to be a new employee. That hack led in the exposure of contact information for 20,000 FBI and 9,000 DHS employees.”
• “The group made heavy use of social media, and in particular Twitter, to spread news of the dumps and mock victims. However, according to the affidavit, Boggs allegedly connected to one of the implicated Twitter accounts (@GenuinelySpooky) from an IP address registered to his father, with whom Boggs lived. Much the same mistake led to Liverman’s identification: an IP address used to access the Twitter handle @_D3F4ULT and another account during the relevant time period was registered to an Edith Liverman. According to the affidavit, publicly available information revealed that Justin Liverman lived with Edith at the time.”
• “The affidavit also includes several sets of Twitter direct messages between members of the group.”
• Which suggests Twitter may have provided the government with that data, probably under a subpoena
• “Liverman seemingly logged his conversations: according to the affidavit, law enforcement found copies of chats on his hard drive, including one where Liverman encouraged Cracka to publish the social security number of a senior US government official. These logs make up a large chunk of the affidavit, laying out the groups alleged crimes in detail, and investigators found other forensics data on Liverman’s computer too.”
• It really goes to show how unsophisticated these attackers were

Discovering how Dropbox hacks your mac

• “If you have Dropbox installed, take a look at System Preferences > Security & Privacy > Accessibility tab (see screenshot above). Notice something? Ever wondered how it got in there? Do you think you might have put that in there yourself after Dropbox asked you for permission to control the computer? No, I can assure you that your memory isn’t faulty. You don’t remember doing that because Dropbox never presented this dialog to you, as it should have”
• “That’s the only officially supported way that apps are allowed to appear in that list, but Dropbox never asked you for that permission. I’ll get to why that’s important in a moment, but if you have the time, try this fascinating experiment: try and remove it.”
• “That leaves a couple of questions. First, why does it matter, and second, is there any way to keep using Dropbox but stop it having access to control your computer?”
• “There’s at least three reasons why it matters. It matters first and foremost because Dropbox didn’t ask for permission to take control of your computer. What does ‘take control’ mean here? It means to literally do what you can do in the desktop: click buttons, menus, launch apps, delete files… . There’s a reason why apps in that list have to ask for permission and why it takes a password and explicit user permission to get in there: it’s a security risk.”
• “The list of authorization “rights” used by the system to manage this “policy based system” is held in /var/db/auth.db database, and a backup or default copy is retained in /System/Library/Security/authorization.plist.”
• “The allow-root property specifies whether a right should be allowed automatically if the requesting process is running with uid == 0. This defaults to false if not specified.”
• “In other words, if allow-root isn’t explicitly set, the default is that even a process with root user privileges does not have the right to perform that operation. Since that’s not specified in the default shown above, then even root couldn’t add Dropbox to the list of apps in Accessibility preferences. Is it possible then, that Dropbox had overridden this setting in the auth.db? Let’s go and check!””
• Basically, by using sqlite directly, rather than the OS X tcc utility, you can override the policy, and add any apps you want to the whitelist. Or worse, any app running as root can do this without you even knowing
• “I tested this with several of my own apps and found it worked reliably. It’ll even work while System Preferences is open, which is exactly the behaviour I saw with Dropbox. It remained to prove, though, that this was indeed the hack that Dropbox was using, and so I started to look at what exactly Dropbox did after being given an admin password on installation or launch. Using DetectX, I was able to see that Dropbox added a new folder to my /Library folder after the password was entered”
• “As can be seen, instead of adding something to the PrivilegedHelperTools folder as is standard behaviour for apps on the mac that need elevated privileges for one or two specialist operations, Dropbox installs its own folder containing these interesting items”
• “the deliciously named dbaccessperm file, we finally hit gold and the exact proof I was looking for that Dropbox was using a sql attack on the tcc database to circumvent Apple’s authorization policy”
• “What I do suspect, especially in light of the fact that there just doesn’t seem to be any need for Dropbox to have Accessibility permissions, is that it’s in there just in case they want that access in the future. If that’s right, it suggests that Dropbox simply want to have access to anything and everything on your mac, whether it’s needed or not.”
• “The upshot for me was that I learned a few things about how security and authorisation work on the mac that I didn’t know before investigating what Dropbox was up to. But most of all, I learned that I don’t trust Dropbox at all. Unnecessary privileges and backdooring are what I call untrustworthy behaviour and a clear breach of user trust. With Apple’s recent stance against the FBI and their commitment to privacy in general, I feel moving over to iCloud and dropping Dropbox is a far more sensible way to go for me.”
• “For those of you who are stuck with Dropbox but don’t want to allow it access to Accessibility features, you can thwart Dropbox’s hack by following my procedure here”
• Previous Article

Proprietors of vDoS, the DDoS for hire service, arrested

• “Two young Israeli men alleged to be the co-owners of a popular online attack-for-hire service were reportedly arrested in Israel on Thursday. The pair were arrested around the same time that KrebsOnSecurity published a story naming them as the masterminds behind a service that can be hired to knock Web sites and Internet users offline with powerful blasts of junk data.”
• “The pair were reportedly questioned and released Friday on the equivalent of about USD $10,000 bond each. Israeli authorities also seized their passports, placed them under house arrest for 10 days, and forbade them from using the Internet or telecommunications equipment of any kind for 30 days.”
• “Huri and Bidani are suspected of running an attack service called vDOS. As I described in this week’s story, vDOS is a “booter” service that has earned in excess of $600,000 over the past two years helping customers coordinate more than 150,000 so-called distributed denial-of-service (DDoS) attacks designed to knock Web sites offline.”
• “The two men’s identities were exposed because vDOS got massively hacked, spilling secrets about tens of thousands of paying customers and their targets. A copy of that database was obtained by KrebsOnSecurity.”
• “For most of Friday, KrebsOnSecurity came under a heavy and sustained denial-of-service attack, which spiked at almost 140 Gbps. A single message was buried in each attack packet: “godiefaggot.” For a brief time the site was unavailable, but thankfully it is guarded by DDoS protection firm Prolexic. The attacks against this site are ongoing.”
• “At the end of August 2016, the two authored a technical paper (PDF) on DDoS attack methods which was published in the Israeli security e-zine Digital Whisper. In it, Huri signs his real name and says he is 18 years old and about to be drafted into the Israel Defense Forces. Bidani co-authored the paper under the alias “Raziel.b7@gmail.com,” an email address that I pointed out in my previous reporting was assigned to one of the administrators of vDOS.”
• “Sometime on Friday, vDOS went offline. It is currently unreachable. According to several automated Twitter feeds that track suspicious large-scale changes to the global Internet routing tables, sometime in the last 24 hours vDOS was apparently the victim of what’s known as a BGP hijack.”
• “Reached by phone, Bryant Townsend, founder and CEO of BackConnect Security, confirmed that his company did in fact hijack Verdina/vDOS’s Internet address space. Townsend said the company took the extreme measure in an effort to get out from under a massive attack launched on the company’s network Thursday, and that the company received an email directly from vDOS claiming credit for the attack.”
• ““For about six hours, we were seeing attacks of more than 200 Gbps hitting us,” Townsend explained. “What we were doing was for defensive purposes. We were simply trying to get them to stop and to gather as much information as possible about the botnet they were using and report that to the proper authorities.””
• Krebs also got access to a large log file from the vdos site
• “The file lists the vDOS username that ordered and paid for the attack; the target Internet address; the method of attack; the Internet address of the vDOS user at the time; the date and time the attack was executed; and the browser user agent string of the vDOS user.”

Feedback:

• Site-to-Site VPN Options

• pfSense HA pair upgrading question

• Copying data in ZFS world

• ZFS with USB Hard Drives

• Is TRIM needed for large SSD hardware raid setups?

Round Up:

• Desktop apps make their way into the Windows Store
• Stanford Engineers propose a technology solution to break the net neutrality deadlock
• This Laptop Is Two Computers In One Thanks to Swappable Modules
• A graphics study of Doom 2016 — How a Frame is Rendered
• SwiftKey for Android is now powered by a neural network
• Song made out of only Windows 98 and XP system sound effects
• Why Some Dark Web Dealers Post Photos of Their Drug Labs
• How a 17 year old got free unlimited data from T-Mobile
• Google removing web browsing from free WiFi kiosks in New York, because too many people were hogging them to watch porn

The post OpSec for Script Kiddies | TechSNAP 285 first appeared on Jupiter Broadcasting.

Video Feed | MP3 Feed | OGG Feed | HD Torrent | Mobile Torrent | iTunes

Become an Unfilter supporter on Patreon:

— Show Notes —

Episode Links

• Clinton Foundation hired cyber firm after suspected hacking: sources | Reuters
• Rita Katz on Twitter: “Pro#ISIS media grp attempts to instill fear in #Canada after #AaronDriver incident: “our wolves will come to you” https://t.co/VGqTjXgo2H”
• Wikileaks Says Clinton Was In A Plane Crash In Iran |
• State Dept.: $400M to Iran was contingent on US prisoners’ release | New York Post
• Video Shows Bill Clinton Meeting With AG Loretta Lynch at Airport
• WikiLeaks Has Morphed from Journalism Hotshot to Malware Hub – Backchannel
• The NSA Leak Is Real, Snowden Documents Confirm
• Britain’s top human rights lawyer who represented Julian Assange and worked alongside George Clooney’s wife Amal dies in apparent suicide – The Sun
• Paul Manafort Quits Donald Trump’s Campaign After a Tumultuous Run – NYTimes.com
• Exclusive: U.S. withdraws staff from Saudi Arabia dedicated to Yemen planning | Reuters
• Why Russia has advanced strike fighters at an air base in Iran – The Washington Post
• 41 men targeted but 1,147 people killed: US drone strikes – the facts on the ground | US news | The Guardian
• Seth Rich Disappeared For Almost Two Hours Before He Was Murdered | Nwo Report
• Renowned lawyer who represented Julian Assange died after being struck by train in West Hampstead
• Police find young fugitive on Cape Cod disguised as ‘elderly man’ | Fox News
• Foundation Ties Bedevil Hillary Clinton’s Presidential Campaign – NYTimes.com
• ‘Clinton death list’: 33 spine-tingling cases
• Colin Powell Hillary Clinton Him Email Scandal, ‘She Was Using for Year’ : People.com
• Page not found – Bipartisan Report
• American journalism is collapsing before our eyes | New York Post
• WSJ: “The Clintons Really Do Think They Can Get Away With Anything” | Zero Hedge
• Rita Katz on Twitter: “3) Photos of #ISIS children used as suicide bombers in the last 6 days alone! https://t.co/o9zlsRjBSk”
• Hillary Clinton Told F.B.I. Colin Powell Advised Her to Use Private Email – The New York Times
• Emails reveal Clinton aide gave foundation donors ‘special’ access, group says | Fox News
• The FBI found 15,000 emails Hillary Clinton didn’t turn over. Uh oh. – The Washington Post
• Leaked memo proves George Soros ruled Ukraine in 2014, minutes from “Breakfast with US Ambassador Geoffrey Pyatt”
• NBC’s $12 Billion Olympics Bet Stumbles, Thanks to Millennials – Bloomberg
• 12-year-old running Trump campaign office in Colorado – KMOV.com
• FBI uncovers 14,900 more documents in Clinton email probe – The Washington Post
• Army Opsec Brief Lists Hillary Clinton As Insider Threat | The Daily Caller
• Panic as intruder scales embassy wall where Julian Assange is living | UK | News | Daily Express
• Russia done using Iranian bases to hit Syria – CNN.com
• Germany’s Angela Merkel Calls for More Sharing of Intelligence Information in EU – WSJ
• Did Gary Johnson Just Get Boxed Out of the Debates? – POLITICO Magazine
• Happy 25th birthday, Linux | TechCrunch
• General to testify about burning letters inBergdahl case
• Oregon collects $25.5M in taxes on recreational marijuana through July 31, 2016 | KOMO
• At least 150 dead as quake rocks central Italy
• Syrian rebels backed by Turkey and U.S. claim major victory over Islamic State – LA Times
• The health problem Clinton actually has | Washington Examiner
• Hillary Clinton & Huma Abedin: Many Troubling Questions, Influence Peddling, Corruption | National Review
• Commercial flights are too ‘burdensome’ for Clinton | New York Post
• Syria, Kurds condemn Turkish incursion
• SNL’s Leslie Jones Hacked … Nude Photos Released | TMZ.com
• Putin offers Middle East peace talks | News | The Times & The Sunday Times
• MSNBC tops CNN for third straight week in August | TheHill
• Obama Admin Won’t Tell Congress How It Paid Iran $1.3 Billion
• Many donors to Clinton Foundation met with her at State
• Pentagon decides to officially support Al-Qaeda in Syria. Sets up “exclusion zones” to shoot down Syrian and Russian jets
• Soros Leaks: The Most Important Story You’re Not Hearing
• New York Times’s Moscow Bureau Was Targeted by Hackers – The New York Times
• Obama Visits Louisiana Flood Victims, but Some Are Busy Just Hanging On – The New York Times
• Why “Obama’s Katrina” Never Sticks But Won’t Die | New Republic
• Louisiana Paper to Obama: Call Off Your Vacation and Visit Our Flood-Ravaged State | Mediaite
• Media Horrified By Clinton Health Accusations, Treat Trump Health Accusations as Fair Game | Mediaite
• Gary Johnson: 70% of Americans Don’t Know Me ‘…and That Bodes Well For Me Winning!’ | Mediaite

The post Russia’s Cyber Sneak Attack | Unfilter 201 first appeared on Jupiter Broadcasting.

Leaks of DNC emails lead to total chaos at Hillary’s big event. We cover the content of those leaks, the fallout & debunk the spin from the Clinton campaign.

Plus some important world news updates, the FBI restarting the encryption debate & our coverage of the 2016 Democratic National Convention.

Direct Download:

Video | MP3 Audio | OGG Audio | Torrent | YouTube

RSS Feeds:

Video Feed | MP3 Feed | OGG Feed | HD Torrent | Mobile Torrent | iTunes

Become an Unfilter supporter on Patreon:

— Show Notes —

Episode Links:

• Turkey declares three-month state of emergency days after attempted military coup – LA Times
• Heidi Cruz rushed out by security after crowd turns on Ted Cruz
• Wikileaks Releases Nearly 20,000 DNC Emails | The Daily Caller
• Glenn Greenwald on Twitter: “Pro-HRC pundits spent a year harping on tweets from random users. This is rancid bigotry from a *top DNC official https://t.co/ARhTQPyCYn”
• Zaid Jilani on Twitter: “Before primary had concluded, top DNC Comms staff were pitching anti-Bernie stories. https://t.co/UNFCJwCmi1 https://t.co/NNq2behGZW”
• DNC Staffers Mocked the Bernie Sanders Campaign, Leaked Emails Show
• Hillary’s America: The Secret History of the Democratic Party — Dinesh D’Souza on the Clinton Foundation | National Review
• ‘Art Of The Deal’ Ghostwriter On Why Trump Should Not Be President : NPR One
• DNC Email Leak Megathread : politics
• Trump & Putin. Yes, It’s Really a Thing
• Bernie Sanders Campaign Chief Says Someone Must Be ‘Accountable’ for What DNC Emails Show – ABC News
• Dems open convention without Wasserman Schultz – CNNPolitics.com
• Wasserman Schultz booed off stage in Philadelphia | TheHill
• Debbie Wasserman Schultz Booed at Chaotic Florida Delegation Breakfast – ABC News
• The Russia-linked election hack is a sign of things to come | The Verge
• Hillary Clinton Hires Debbie Wasserman Schultz – Christine Rousselle
• WikiLeaks – Search the DNC email database
• DNC Planned To Reward Big Donors With Federal Appointments | The Daily Caller
• All Signs Point to Russia Being Behind the DNC Hack | Motherboard
• A Look At Donald Trump’s Ties To Russia : NPR One
• Twelve DNC Emails Released by WikiLeaks That Stand Out – Washington Wire – WSJ
• FBI is investigating the DNC email hack – CBS News
• Russia denies it was behind the hacking of DNC emails | Daily Mail Online
• France church attack: Priest killed by two ‘IS soldiers’ – BBC News
• Everything’s Not Good
• Clinton makes history, wins Democratic presidential nomination | Fox News
• Bernie Sanders gets emotional at DNC roll call
• ISIS warn London ‘next to be attacked’ as UK churches put on terror alert after French priest murder – Mirror Online
• Hillary Clinton sets internet on fire with DNC appearance that was something out of the ‘1984’ ad – AOL
• Trump invites Russia to meddle in the U.S. presidential race with Clinton’s emails – The Washington Post
• How DNC, Clinton campaign attacks fit into Russia’s cyber-war strategy | Ars Technica
• EXCLUSIVE: IRS Investigates Clinton Foundation’s ‘Pay-to-Play’ Operations | The Daily Caller
• Los Angeles Times on Twitter: “”Russia, if you’re listening…” Donald Trump encourages Russia to hack Hillary Clinton’s emails: https://t.co/UDkOVwN1UA”
• Edward Snowden, the brand – The Washington Post
• The Truth About Marijuana-Contaminated Drinking Water
• Hugo’s town well was breached, but there’s no THC in the H2O | Food Safety News
• False alarm. No THC in Colorado town’s public water supply, officials say. – The Washington Post
• UPDATE: Hugo, Colorado Does NOT Have THC In Their Water | The Daily Caller
• After Hugo water found THC-free, officials say it was better to be safe – The Denver Post
• Exclusive: Suspected Russian hack of DNC widens — includes personal email of staffer researching Manafort
• French media to stop publishing photos and names of terrorists | Media | The Guardian
• DNC Night 2 Ratings: CNN Remains No. 1, NBC Grows Total Audience | TVNewser
• George Soros rises again – POLITICO
• Russia beefs up military on southwestern flank as NATO approaches
• CNN, ABC cut ties with Donna Brazile, freeing her up for DNC job – POLITICO
• DNC Advertises for Actors to Fill Empty Seats at DNC Convention
• Donna Brazile – Wikipedia, the free encyclopedia
• Rita Katz on Twitter: “1)Exclusive vid of #Normandy attackers by #ISIS” Amaq show attackers were in contact w/ individual(s) within #ISIS https://t.co/gpm3JGHSpD”
• Wolf Blitzer on Twitter: “Thanks to these guys and all their colleagues for keeping #DemsInPhilly convention safe. I start anchoring 5PM ET https://t.co/rRoXNWI8pW”
• Rita Katz on Twitter: “3) The problem of #ISIS inspired attacks in the West is increasing due to #ISIS’ outreach on social media. Western govs must adapt quickly”
• Rita Katz on Twitter: “Breaking: #ISIS’ Amaq claims church attack #Normandy #France executed by #ISIS soldiers”,based on”insider source” https://t.co/IeNUWDFwGZ”
• Statement from Jake Sullivan on Donald Trump’s Press Conference Today
• Trump’s comments on Russia denounced as ‘shocking and dangerous’ | US news | The Guardian
• Fox News on Twitter: “Secret Service Code Names. #SpecialReport #DemsInPhilly #DemConvention https://t.co/E5dMOKNpfd”

The post DNC Frenzy | Unfilter 197 first appeared on Jupiter Broadcasting.

We review Linux Mint 18 & our experience turns out to be a roller coaster ride from impressed glee to cautious concern. We’ve never felt more conflicted over a version of Linux Mint.

Plus we discuss the Ubuntu Forum hack, a Fedora bug that’s bricking some laptops & why we just can’t quit FreeNAS.

Thanks to:

• Get Paid to Write for DigitalOcean

Direct Download:

HD Video | Mobile Video | WebM Torrent | MP3 Audio | OGG Audio | YouTube | HD Torrent

RSS Feeds:

HD Video Feed | Large Video Feed | Mobile Video Feed | MP3 Audio Feed | Ogg Audio Feed | iTunes Feed | Torrent Feed

Become a supporter on Patreon:

— Show Notes: —

Brought to you by: Linux Academy

Mint 18 Review

​Linux Mint 18: The best desktop — period

I’ve been using Linux desktops since the leading desktop front-end was Bash. Things have changed in those 25 years. Today, the best Linux desktop is the latest version of Linux Mint: Linux Mint 18 Sarah with the Cinnamon 3.0 interface.

Linux Mint 18 Cinnamon: Quick Screenshot Tour

Linux Mint 18 improves security, but at a cost – TechRepublic

While this is a much-needed improvement, the explanation of this change on the Linux Mint website is baffling. The website claims that kernel updates “aren’t really updates, but the availability of packages for newer kernels.” Aside from the fact that this is literally the definition of an update, this appears to be an attempt at minimizing the importance of kernel updates. In Linux Mint 18, users are only notified of kernel updates, but they are not installed by default.

• How to upgrade to Linux Mint 18

As excited as we are about Linux Mint 18, upgrading blindly for the sake of running the latest version does not make much sense, especially if you’re already happy and everything is working perfectly.

• Bug#830624: ITP: xplayer — Simple media player based on GStreamer.

Given the history of Linux Mint with their weird view on security (Linux
Mint is the very definition of a FrankenDebian [1]) where they withhold
important security updates because their weird mixture of packages would
otherwise break too often or their hijacking of package names (mdm, for
example), I don’t really trust them to come up with a clean design for
desktop agnostic applications. Heck, the first thing they wanted to do
was naming their forked version of Pluma “xedit”.

— PICKS —

Runs Linux

Fors Fusion RUnS LINUX on a Raspberry Pi

Desktop App Pick

recalbox.com

Recalbox allows you to re-play a variety of videogame consoles and platforms in your living room, with ease! RecalboxOS is free, open source and designed to let you create your very own recalbox in no time! Raspberry Pi.

• RecalboxOS v4.0.0-beta4 release | Blog recalbox

Spotlight

Felony: Next Level PGP

Felony is an open-source pgp keychain built on the modern web with Electron, React, and Redux. Felony is the first PGP app that’s easy for anyone to use, without a tutorial. Security++ to the greatest extreme!

Coder Radio Coding Challenge

— NEWS —

Ubuntu Forums Hacked, 2 Million Users’ Details Stolen

Canonical CEO Jane Silber explains: “We were able to confirm there had been an exposure of data and shut down the Forums as a precautionary measure. Deeper investigation revealed that there was a known SQL injection vulnerability in the Forumrunner add-on in the Forums which had not yet been patched.”

The attacker was able to “download portions of the ‘user’ table which contained usernames, email addresses and IPs for 2 million users.”

• Notice of security breach on Ubuntu Forums | Ubuntu Insights

​Early Look at Skype for Linux and Chromebooks

Skype for Linux is no longer an afterthought for Microsoft as the company introduces new versions of Skype for Linux Chromebooks and the Chrome web browser.

GNOME Maps Hits A Dead End, Can No Longer Display Maps

As of this week the nifty desktop navigation app canno longer fetch maps tiles to display.

MapQuest, the application’s tile provider, has amended its usage policy and discontinued direct tile access. GNOME developers have the choice of paying to keep using the service or, ultimately, using a new one.

PSA: Failure to boot after kernel update on Skylake systems

So in the last couple of days a significant issue in all Fedora releases has come to our attention, affecting (so far) several systems that use the Intel ‘Skylake’ hardware platform.

• Virtualization Revelation | Linux Action Show 418

• Bug #1569479 “Graphics glitches with Skylake Intel HD Graphics 5…”

• Intel Skylake Graphics: Windows 10 vs. Ubuntu Linux Performance
• Well Known Linux Kernel Developer Recommends Against Buying Skylake Systems
• Early Intel Skylake Linux Users May Run Into A Silly Issue
• Screen flickering on Ubuntu 16.04 LTS

CrossOver For Android Now Running On Chromebooks

CodeWeavers confirmed today that it’s possible to run CrossOver on Chromebooks now via the Android support. CodeWeavers was even able to install Steam for Windows on the Chromebooks via the CrossOver support.

Mail Bag

• https://pastebin.com/jMJPAeXY

• https://pastebin.com/s9NWc85s

Call Box

• Chris’ call out for the community to help him with his background

Catch the show LIVE SUNDAY:

• Noon Pacific
• https://jblive.tv
• Network Calendar

— CHRIS’ STASH —

Chris’s Twitter account has changed, you’ll need to follow!

Chris Fisher (@ChrisLAS) | Twitter

Hang in our chat room:

irc.geekshed.net #jupiterbroadcasting

— NOAH’S STASH —

Noah’s Day Job

Altispeed Technologies

Contact Noah

noah [at] jupiterbroadcasting.com

Find us on Google+

• Chris
• Noah J. Chelliah
• Jupiter Broadcasting’s Page

Find us on Twitter

• Chris – ChrisLAS
• Noah – Kernellinux

Follow us on Facebook

• Jupiter Broadcasting on Facebook
• Noah – Kernellinux

The post Mint 18: Convenience Over Security | LAS 426 first appeared on Jupiter Broadcasting.

Has Spotify been hacked? And our different approaches for preparing to reload an important personal computer. Plus piracy skyrockets, hacks go for a premium & one of our coolest Kickstarters of the week yet!

Direct Download:

MP3 Audio | OGG Audio | Video | HD Video | Torrent | YouTube

RSS Feeds:

MP3 Feed | OGG Feed | iTunes Feed | Video Feed | Video Feed | Torrent Feed

Become a supporter on Patreon

Show Notes:

• Hundreds of Spotify credentials appear online – users report accounts hacked, emails changed | TechCrunch
• This bicycle has 4GB of RAM | The Verge
• Spy Chief Complains That Edward Snowden Sped Up Spread of Encryption by 7 Years
• Google, Ford, and Uber just created a giant lobbying group for self-driving cars | The Verge
• The FBI paid over $1 million for the hack that broke the San Bernardino iPhone | The Verge
• Logitech turned 160 gaming keyboards into a massive pixelated display | The Verge
• Game Of Thrones Season 6 Premiere Triggers Piracy Craze – TorrentFreak
• QNAP Releases QTS 4.2.1, Adding Network & Virtual Switch, Proxy Server, Qsirch, Virtualization Station 2.1, and More Powerful Features
• QNAP SS-839-PRO-US Diskless System Turbo NAS with Advanced Security & iSCSI for Business Users – Newegg.com
• PolySmooth & Polysher: 3D Prints Without Layers by Polymaker — Kickstarter

The post Encryption gets the Clap | TTT 241 first appeared on Jupiter Broadcasting.

The FBI’s case turns rotten as they admit a third party can hack the iPhone 5C in their positions, SoundCloud has a new premium feature they want you to buy & malware that uses your GPS to send you fake traffic tickets.

Plus our Kickstarter of the week & more!

Direct Download:

MP3 Audio | OGG Audio | Video | HD Video | Torrent | YouTube

RSS Feeds:

MP3 Feed | OGG Feed | iTunes Feed | Video Feed | Video Feed | Torrent Feed

Become a supporter on Patreon

Show Notes:

Episode Links:

• Apple’s San Bernardino fight is officially over as government confirms working attack | The Verge
• FBI unlocks iPhone of San Bernardino shooter – YouTube
• Read Apple’s response to the FBI’s San Bernardino iPhone hack | The Verge
• Apple likely can’t force FBI to disclose how it got data from seized iPhone | Ars Technica
• It’s Go time for SoundCloud: $9.99 tier aims to rival Spotify with millions of premium music tracks | TechCrunch
• Malware scam appears to use GPS data to catch speeding Pennsylvania drivers | The Verge

Kickstarter of the Week

• Triton, Worlds First Artificial Gills Re-breather | Indiegogo
• Underwater Breathing Device Has $820,000 Of Funding Despite Being Scientifically Impossible | IFLScience

The post FBI’s Fruit Basket | TTT 238 first appeared on Jupiter Broadcasting.

We’ll tell you about the real world pirates that hacked a shipping company, the open source libraries from Mars Rover found being used in malware & Microsoft’s solution for that after-hack hangover.

Plus great questions, a packed round up & much more!

Thanks to:

• Get Paid to Write for DigitalOcean

Direct Download:

HD Video | Mobile Video | MP3 Audio | OGG Audio | YouTube | HD Torrent | Mobile Torrent

RSS Feeds:

HD Video Feed | Mobile Video Feed | MP3 Audio Feed | Ogg Audio Feed | iTunes Feed | Torrent Feed

Become a supporter on Patreon:

Show Notes:

Pirates hacked Shipping Company to find valuable cargo

• As described in Verizon’s most recent Data Breach Digest, a collection of cyber-security case studies the company’s RISK Team helped investigate and solve sometime in the past year, a reputable global shipping conglomerate started having peculiar problems with sea pirates.
• The shipping company was telling Verizon that pirates were boarding their vessels at regular intervals.
• Equipped with a barcode reader (and weapons, of course), searching specific crates, emptying all the high-value cargo, and making off with the loot within minutes of launching their attacks.
• All of this made the shipping company think there was something strange and hired the RISK Team to track down the source of a possible leak.
• The RISK Team quickly narrowed down the problem to the firm’s outdated custom-built CMS, which featured an insecure upload script.
• As the Verizon team explained, a hacker, either part of the sea pirates group or hired by them, had uploaded a Web shell via this insecure form. In turn, this shell was uploaded inside a Web-accessible directory.
• To make things worse, that particular folder also had “execute” permissions.
• Using this access to the shipping firm’s database, the hacker pulled down BoLs (bills of lading), future shipment schedules, and ship routes so the pirates could plan their attack and identify crates holding valuable content.
• Fortunately, the hacker wasn’t that skilled. Verizon says that the attacker used a Web shell that didn’t support SSL, meaning that all executed commands were recorded in the Web server’s log.
• The RISK Team was able to recreate a historic timeline of all the hacker’s actions and identify exactly what he looked at and where he sent the files.
• Verizon’s RISK Team states:

“These threat actors, while given points for creativity, were clearly not highly skilled,” the RISK Team explains. “For instance, we found numerous mistyped commands and observed that the threat actors constantly struggled to interact with the compromised servers.”

• Additionally, as a sign of their lack of skills, the attacker also didn’t use a proxy or VPN and exposed their home IP address.
• The rest of the Verizon threat digest report
• Direct PDF Download

Open source libraries from Mars Rover found being used in malware

• According to Palo Alto Networks, on December 24, 2015, India’s Ambassador to Afghanistan received a spear-phishing email that contained a new malware variant, which, if downloaded and installed, would have opened a backdoor on the official’s computer.
• India has been a trustworthy business partner for Afghanistan, helping the latter build its new Parliament complex, the Salma Dam, along with smaller transportation, energy, and infrastructure projects.
• Because of this tight collaboration between the two, it is normal that other nations or interest groups may want to know what the two countries are planning together.
• The Ambassador’s email was spoofed and made to look like it was coming from India’s Defense Minister, Manohar Parrikar. Attached to the email was an RTF file.
• Palo Alto researchers say that this file contained malicious code to exploit the CVE-2010-3333 Office XP vulnerability, resulting in the download of a file named “file.exe” from the newsumbrealla[.]net domain.
• This file was automatically launched into execution and was a simple malware payload dropper that was tasked with downloading the real threat, a new trojan that the researchers christened Rover.
• This malware was given the “Rover” name because it relied on the OpenCV and OpenAL open source libraries, both used in the software deployed with the famous Mars Rover exploration robot.
• OpenCV is a library used in computer vision applications and image processing while OpenAL is a cross-platform library for working with multichannel audio data.
• Its capabilities included the ability to take screenshots of the desktop in BMP format and send them to the C&C server every 60 minutes, logging keystrokes and uploading the data to the C&C server every 10 seconds, and scanning for Office files and uploading them to the C&C server every 60 minutes.
• Additionally, there was also a backdoor component that allowed attackers to send commands from the C&C server and tell Rover to take screenshots or start recording video (via webcam) and audio (via microphone) whenever the attacker wanted to.
• “Though ‘Rover’ is an unsophisticated malware lacking modern malware features, it seems to be successful in bypassing traditional security systems and fulfilling the objectives of the threat actor behind the campaign in exfiltrating information from the targeted victim,” Palo Alto researchers explain.
• Rover is largely undetected by today’s antivirus engines, and despite not coming with that many features, it is successful at keeping a low profile, exactly what cyber-espionage groups need from their malware to begin with.
• New Malware ‘Rover’ Targets Indian Ambassador to Afghanistan – Palo Alto Networks Blog

Microsoft brings post-breach detection features to Windows

• Microsoft announced its new post-breach enterprise security service called Windows Defender Advanced Threat Protection, which will respond to these advanced attacks on companies’ networks.
• The company found that it currently takes an enterprise more than 200 days to detect a security breach, and 80 days to contain it. When there is such a breach, the attackers can steal company data, find private information, and damage the brand and customer trust in the company.
• For example, a social engineering attack might encourage a victim to run a program that was attached to an e-mail or execute a suspicious-looking PowerShell command. The Advanced Persistent Threat (APT) software that’s typically used in such attacks may scan ports, connect to network shares to look for data to steal, or connect to remote systems to seek new instructions and exfiltrate data. Windows Defender Advanced Threat Protection can monitor this behavior and see how it deviates from normal, expected system behavior. The baseline is the aggregate behavior collected anonymously from more than 1 billion Windows systems. If systems on your network start doing something that the “average Windows machine” doesn’t, WDATP will alert you.
• The whole thing is cloud-based with no need for any on-premises server. A client on each endpoint is needed, which would presumably be an extended version of the Windows Defender client.
• Windows Defender Advanced Threat Protection is under development, though it is currently available to some early-adopter customers.
• This service will help enterprises to detect, investigate and respond to advanced attacks on their networks.
• Microsoft said that it is building on the existing security defenses Windows 10 offers today, and the new service will provide a post-breach layer of protection to the Windows 10 security stack.
• With the client technology built into Windows 10 along with the cloud service, it will help detect threats that have made it past other defenses, provide enterprises with information to investigate the breach across endpoints, and offer response recommendations.
• To avoid Windows 7 becoming “the new Windows XP,” the company is being rather more aggressive in applying pressure on users to upgrade to Windows 10 sooner rather than later.
• WDATP is going to be part of that same push to Windows 10, and it won’t be available for older operating systems.
• Windows Defender Advanced Threat Protection uses cloud power to figure out you’ve been pwned | Ars Technica

Feedback:

• The main difference between a router and a switch.

• Penetration Testing

• Expanding 4 drive zed pool

• Allan’s Internet

Round Up:

• SSD reliability in the real world: Google’s experience
• Google suggests new “tall” hard drive form factor
• Comcast’s “Home Security System” product defeated by simple tape recorder and battery
• The story of some aweful IoT lightbulbs
• Samsung ships the world’s highest capacity SSD, with 15TB of storage
• ITU gives first-stage approval to 40Gbps FTTH standard
• Thieves Nab IRS PINs to Hijack Tax Refunds
• Cyber Criminals face same talent shortages that security firms do
• IBM researcher finds PDF library used by Microsoft Edge has serious exploits
• Abusing a wifi chip to micro-broadcast color TV signals

The post Fixing the Barn Door | TechSNAP 257 first appeared on Jupiter Broadcasting.

Entroware’s Apollo laptop has arrived, and we share our first hands on impressions of their ultra Linux laptop, how does it compare to the Purism, and a quick chat with Entroware’s co-founder.

Plus we discuss the Mint hack, and solutions we could create as a community to solve the bigger problems, updates from some of our favorite open source projects, and chat about Beep Beep Yarr, and more!

• Get Paid to Write for DigitalOcean

Direct Download:

MP3 Audio | OGG Audio | Video | HD Video | Torrent | YouTube

RSS Feeds:

MP3 Feed | OGG Feed | iTunes Feed | Video Feed | Torrent Feed | WebM Torrent Feed

Become a supporter on Patreon:

Show Notes:

Follow Up / Catch Up

Beep Beep Yarr! by Linux Voice

<< Silk Guardian >> is an anti-forensic kill-switch

Silk Guardian is an anti-forensic LKM kill-switch that waits for a change on your usb ports and then wipes your ram and turns off your computer.

MUTINY! — Ubuntu MATE 16.04 Adds Unity-Style Desktop Layout

“There’s a Mutiny coming!,” the Ubuntu MATE team teases. “Yes, that is a top menu. Yes, this is Ubuntu MATE. See you Thursday for the Beta 1 release!”.

Cnchi v0.14 Moves Into Stable Branch

The most notable change in Cnchi 0.14 is beta support for ZFS (in Automatic Installation Mode). It is now possible to install Antergos with ZFS as your chosen filesystem. You simply tell Cnchi which drive to use and it will take care of formatting the drive and configuring ZFS for you.

TING

• Ting – mobile that makes sense

The most powerful Ubuntu phone is still not good enough

The Meizu Pro 5 has the Galaxy S6’s processor, but not its performance

100,000,000 Monthly Active Users

Now Telegram has more than 100,000,000 monthly active users. 350,000 new users sign up each day. We’re delivering 15 billion messages daily.

• Telegram: Contact @itsecalert

DigitalOcean

• DigitalOcean: SSD Cloud Server, VPS Server, Simple Cloud Hosting

“The Mint Hack”

Hacker explains how he put “backdoor” in hundreds of Linux Mint downloads | ZDNet

The hacker responsible, who goes by the name “Peace,” told me in an encrypted chat on Sunday that a “few hundred” Linux Mint installs were under their control — a significant portion of the thousand-plus downloads during the day.

• How can a server that hosts a high-profile website like linuxmint.com be so low on security

Backdoored Linux Mint, and the Perils of Checksums

But it’s also important to note that comparing the checksum of a file you downloaded with what you see on the website you downloaded it from isn’t secure either, even if you are using SHA256. If a hacker can hack the website to modify the download link, they can modify the checksum at the same time to match their malicious download.

The only solution to this problem is to use public key cryptography.

Linux Academy

• Linux Academy | Linux and AWS Online Training

Apollo by Entroware

• Pictures of the Apollo

Support Jupiter Broadcasting on Patreon

The post Apollo Has Landed | LINUX Unplugged 133 first appeared on Jupiter Broadcasting.

We take a look back at some of the big stories of 2015, at least, as we see it.

Plus the round up & more!

Thanks to:

• Get Paid to Write for DigitalOcean

Direct Download:

HD Video | Mobile Video | MP3 Audio | OGG Audio | YouTube | HD Torrent | Mobile Torrent

RSS Feeds:

HD Video Feed | Mobile Video Feed | MP3 Audio Feed | Ogg Audio Feed | iTunes Feed | Torrent Feed

Become a supporter on Patreon:

— Show Notes: —

Episode 227: Oracle’s EULAgy #oraclefanfic

• Oracle Chief Security Officer, Mary Ann Davidson, makes a blog post railing against reverse engineering and security research
• Claims Oracle is pretty good at finding bugs in their own code, and doesn’t need anyone else’s help, and that is violates their EULA
• The blog post was quickly taken down, but this is the Internet, it doesn’t work like that

Episode 196: Sony’s Hard Lessons

• Bruce Schneier walks us through what we can learn from the hack of Sony’s corporate network

Episode 217: An Encryptioner’s Conscience

• A recurring theme: firmware is terrible
• Replace your router with something that runs a real OS
• Luckily, more and more routers finally have enough hardware to run a minimal Linux or BSD install
• Smaller APU and Atom machines can run full OS or appliance software like pfSense

Episode 211: The French Disconnection

• Episodes recorded live in the studio always have a different feel to them, especially when it happens to be the 4th anniversary of the show
• The top story in this episode was about how to detect when your network has been breached
• Some great detail, and discussion of the Target and Sony hacks as examples of what to do, and what not to do

Episode 212: Dormant Docker Disasters

• The man who broke the music business
• Detailing the infinalside story of how some of the most popular music albums made it onto the internet before they were even in stores
• Again, in person episodes are always special

Episode 237: A Rip in NTP

• Recap of my visit to the OpenZFS

Round Up:

• Maltrail, a new MIT licensed open source malicious traffic detection system
• Making malware that is harder to detect, breaks some disassemblers
• “Firestorm”, a new vulnerability in “next generation” firewalls
• CryptoWall 4 – The Evolution Continues
• McAfee Enterprise Security Manager failed to manage own security. Authentication bypass vulnerability found
• Tutorial: How to reverse unknown protocols using Netzob
• Don’t be a victim of Tax Refund Fraud in 2016, Krebs has tips to protect yourself
• Tutorial: Fake WiFi Access Point, create a rough AP or an “Evil Twin”

The post Snappy New Year! | TechSNAP 247 first appeared on Jupiter Broadcasting.

TalkTalk gets compromised, Hackers make cars safer & Google plays hardball with Symantec.

Plus a great batch of your questions, a rocking round up & much, much more!

Thanks to:

• Get Paid to Write for DigitalOcean

Direct Download:

HD Video | Mobile Video | MP3 Audio | OGG Audio | YouTube | HD Torrent | Mobile Torrent

RSS Feeds:

HD Video Feed | Mobile Video Feed | MP3 Audio Feed | Ogg Audio Feed | iTunes Feed | Torrent Feed

Become a supporter on Patreon:

— Show Notes: —

TalkTalk compromise and ransom

• “TalkTalk, a British phone and broadband provider with more than four million customers, disclosed Friday that intruders had hacked its Web site and may have stolen personal and financial data. Sources close to the investigation say the company has received a ransom demand of approximately £80,000 (~USD $122,000), with the attackers threatening to publish the TalkTalk’s customer data unless they are paid the amount in Bitcoin.”
• “In a statement on its Web site, TalkTalk said a criminal investigation was launched by the Metropolitan Police Cyber Crime Unit following “a significant and sustained cyberattack on our website.””
• That sounds more like a DDoS, but those same words could be used to describe a persistent compromise, where the attackers were inside the TalkTalk network for a long time
• Possibly compromised information includes: names, addresses, date of birth, phone numbers, email addresses, TalkTalk account information, credit card details and/or bank details
• “We are continuing to work with leading cyber crime specialists and the Metropolitan Police to establish exactly what happened and the extent of any information accessed.”
• So it sounds like they have no way of telling how much data was taken, and are hoping forensic analysis after the fact will tell them. Obviously they didn’t have good audit controls in place
• “A source close to the investigation who spoke on condition of anonymity told KrebsOnSecurity that the hacker group who demanded the £80,000 ransom provided TalkTalk with copies of the tables from its user database as evidence of the breach. The database in question, the source said, appears related to at least 400,000 people who have recently undergone credit checks for new service with the company. However, TalkTalk’s statement says it’s too early to say exactly how many customers were impacted. “Identifying the extent of information accessed is part of the investigation that’s underway,” the company said.”
• “It appears that multiple hacker collectives have since claimed responsibility for the hack, including one that the BBC described as a “Russian Islamist group” — although sources say there is absolutely no evidence to support that claim at this time.”
• With the way things are today, lots of people will try to take credit for an attack. That is why the group demanding the ransom provided a sample of the data as proof that they actually had it
• Of course, the real attackers could have posted the data to an underground forum, and multiple groups could have the data
• “Separately, promises to post the stolen data have appeared on AlphaBay, a Deep Web black market that specialized in selling stolen goods and illicit drugs. The posting was made by someone using the nickname “Courvoisier.” This member, whose signature describes him as “Level 6 Fraud and Drugs seller,” appears to be an active participant in the AlphaBay market with many vouches from happy customers who’ve turned to him for illegal drugs and stolen credit cards, among other goods and services.”
• “It seems likely that Courvoisier is not bluffing, at least about posting some subset of TalkTalk customer data. According to a discussion thread on Reddit.com dedicated to explaining AlphaBay’s new Levels system, an AlphaBay seller who has reached the status of Level 6 has successfully consummated at least 500 sales worth a total of at least $75,000, and achieved a 90% positive feedback rating or better from previous customers.”
• Additional Coverage — The Independant
• Additional Coverage — ArsTechnica: TalkTalk hit by cyberattack
• Additional Coverage — The Register: TalkTalk: Our cybersecurity is head and shoulders above our competitors
• Additional Coverage — ArsTechnica: TalkTalk says it was not legally required to encrypt customer data
• Additional Coverage — ArsTechnica: 15 year old boy arrested in connection with talktalk breach
• Video from TalkTalk CEO
• If you do end up having money stolen from your account, TalkTalk, “on a case-by-case basis”, will wait the termination fee if you decide you no longer want to be a TalkTalk customer
• New rule: if you are hacked via OWASP Top 10, you’re not allowed to call it “advanced” or “sophisticated”
• “Significant and sustained cyber attack” “sophisticated”… arrest 15 yr old kid as the hacker

Hackers make cars safer

• “Virtually every new car sold today has some sort of network connection. Most of us are aware of these connections because of the remarkable capabilities they place at our fingertips—things like hands-free communication, streaming music, advanced safety features, and navigation. Today’s cars are a rolling network of small computers that control the drivetrain, braking, and other systems. And just like the entertainment and navigation systems, these computers are “connected,” too.”
• “This connectivity within—and between—vehicles will allow transformative innovations like self-driving cars. But it also will make our cars targets for hackers. The security research community can play a valuable role in helping the auto industry stay ahead of these threats. But rather than encouraging collaboration, Congress is discussing legislation that would make illegal the kind of research that already has helped improve the industry’s approach to security.”
• Last week, “the House Energy and Commerce Committee begins a hearing on a bill to reform the National Highway Traffic Safety Administration. However, tucked into a section concerning the cybersecurity and data collection of automobiles is language that unintentionally could create greater risks for American drivers.”
• “Now the industry has established an Intelligence Sharing and Analysis Center (ISAC) to exchange cyber threat information. This initiative is a good start. It would provide a central point of contact and collaboration about what threats are out there and how automakers can respond to them. If done well, the ISAC also could improve security standards among auto manufacturers, benefiting all consumers. (More on that here and here.)”
• “The auto industry is taking promising steps toward better security, but the bill before the Energy and Commerce Committee would be a setback. It would make it illegal for security researchers to examine the code written into today’s cars and identify security vulnerabilities or manipulations designed to thwart environmental regulations. This will make our cars more vulnerable by discouraging responsible research and chilling innovation in car security at a critical time. Moreover, tying the hands of white hat researchers will do nothing to prevent bad actors from finding the same vulnerabilities and exploiting them in potentially harmful ways.”
• “The auto industry would be better served by following the lead of information technology industry which has developed ways to work with responsible security researchers instead of against them. For years technology companies fought a losing battle on security by threatening hackers, and now many firms have established bounty programs and conferences where researchers are invited to find and report flaws in programs and products. They recognize that bringing researchers to the table and crowd sourcing solutions can be effective in staying ahead of cyber threats. Stopping research before it can start sets a terrible precedent. Rather than make it illegal, Congress should try to spur collaboration between the automakers and the increasingly valuable research community.”
• US Regulators grant DMCA exemption to legalize vehicle software tinkering
• Additional Coverage: NPR
• The ruling uses the terms “good faith security research” and “lawful modification.”
• “The government defined good-faith security research as means of “accessing a computer program solely for purposes of good-faith testing, investigation and/or correction of a security flaw or vulnerability, where such activity is carried out in a controlled environment designed to avoid any harm to individuals or the public, and where the information derived from the activity is used primarily to promote the security or safety of the class of devices or machines on which the computer program operates, or those who use such devices or machines, and is not used or maintained in a manner that facilitates copyright infringement.””
• “The “lawful modification” of vehicle software was authorized “when circumvention is a necessary step undertaken by the authorized owner of the vehicle to allow the diagnosis, repair or lawful modification of a vehicle function; and where such circumvention does not constitute a violation of applicable law, including without limitation regulations promulgated by the Department of Transportation or the Environmental Protection Agency; and provided, however, that such circumvention is initiated no earlier than 12 months after the effective date of this regulation.””
• Under the ruling, both exemptions don’t become law for at least a year

Google plays hardball with Symantec over TLS certificates

• “Google has given Symantec an offer it can’t refuse: give a thorough accounting of its ailing certificate authority process or risk having the world’s most popular browser—Chrome—issue scary warnings when end users visit HTTPS-protected websites that use Symantec credentials. The ultimatum, made in a blog post published Wednesday afternoon, came five weeks after Symantec fired an undisclosed number of employees caught issuing unauthorized TLS certificates. The mis-issued certificates made it possible for the holders to impersonate HTTPS-protected Google web pages.”
• Google’s Blog Post
• Symantec Report
• “Following our notification, Symantec published a report in response to our inquiries and disclosed that 23 test certificates had been issued without the domain owner’s knowledge covering five organizations, including Google and Opera. However, we were still able to find several more questionable certificates using only the Certificate Transparency logs and a few minutes of work. We shared these results with other root store operators on October 6th, to allow them to independently assess and verify our research.”
• It seems like Symantec was trying to downplay the incident, and gloss over its failings
• “Symantec performed another audit and, on October 12th, announced that they had found an additional 164 certificates over 76 domains and 2,458 certificates issued for domains that were never registered.”
• “The mis-issued certificates represented a potentially critical threat to virtually the entire Internet population because they made it possible for the holders to cryptographically impersonate the affected sites and monitor communications sent to and from the legitimate servers.”
• This brings up serious questions about the management and oversight of the Symantec certificate authority
• “It’s obviously concerning that a CA would have such a long-running issue and that they would be unable to assess its scope after being alerted to it and conducting an audit. Therefore we are firstly going to require that as of June 1st, 2016, all certificates issued by Symantec itself will be required to support Certificate Transparency. In this case, logging of non-EV certificates would have provided significantly greater insight into the problem and may have allowed the problem to be detected sooner. After this date, certificates newly issued by Symantec that do not conform to the Chromium Certificate Transparency policy may result in interstitials or other problems when used in Google products”
• “More immediately, we are requesting of Symantec that they further update their public incident report with:”
• A post-mortem analysis that details why they did not detect the additional certificates that we found.
• Details of each of the failures to uphold the relevant Baseline Requirements and EV Guidelines and what they believe the individual root cause was for each failure.
• “We are also requesting that Symantec provide us with a detailed set of steps they will take to correct and prevent each of the identified failures, as well as a timeline for when they expect to complete such work. Symantec may consider this latter information to be confidential and so we are not requesting that this be made public.”
• “Following the implementation of these corrective steps, we expect Symantec to undergo a Point-in-time Readiness Assessment and a third-party security audit.”
• It is good to see Google using its muscle to make the CA industry smarten up and fly right

Feedback:

• Running a file server on Debian

• ZFS repairing capabilities

• Episode 237 comments and suggestions

Round up:

• 13 million plaintext passwords belonging to webhost users leaked online
• New banking trojan steals 20 million British Pounds from online bank accounts
• DOJ: Apple owns your iPhone’s software, so it should have a backdoor
• IBM tops the list of worst offenders for hosting spam, as it acquires Softlayer, which had previously acquired ThePlanet, which was known for being especially bad
• Joomla bug puts millions of websites at risk of remote takeover
• EFF Finds over 100 license plate readers that are accessible on the public internet
• Wall Street Journal subscriber base information may have been compromised
• WWII CIA (OSS) Simple Sabotage Field Manual (Field Manual #3)
• NSA issues warning about quantum cryptography, sparks concerns of secret advance in technology
• Debate over the depreciation of the leap second at the World Radiocommunication Conference Full ACM Article by Poul-Henning Kamp
  

The post Certifiable Authority | TechSNAP 238 first appeared on Jupiter Broadcasting.

CISA is working its way through the system, we highlight some reasons to be concerned & the role Facebook might be playing. Plus the European Parliament rejects amendments protecting net neutrality & some TalkTalk hack follow up.

Direct Download:

MP3 Audio | OGG Audio | Video | HD Video | Torrent | YouTube

RSS Feeds:

MP3 Feed | OGG Feed | iTunes Feed | Video Feed | Video Feed | Torrent Feed

Become a supporter on Patreon

Show Notes:

— Episode Links —

• Despite Concerns, Cybersecurity Bill Heads to Vote | Al Jazeera America
• Senior Former Intelligence Official Admits That ‘The Point’ Of CISA Is Surveillance | Techdirt
• Petition: Facebook betrayed us by secretly lobbying for cyber-surveillance bill / Boing Boing
• Ex-NSA Chief’s Cybersecurity Startup Draws Funding – WSJ
• TalkTalk hack: Police arrest teenager (15) in Northern Ireland – BelfastTelegraph.co.uk
• TalkTalk says it was “not legally required” to encrypt leaked customer data | Ars Technica UK
• European Parliament rejects amendments protecting net neutrality | The Verge
• Exclusive: Wal-Mart seeks to test drones for home delivery, pickup | Reuters

The post Drone Shipping Wars | TTT 221 first appeared on Jupiter Broadcasting.

Amazon tries to hide the bad news, Apple has a few big announcements & Chris and the crew have some crow to eat!

Direct Download:

MP3 Audio | OGG Audio | Video | HD Video | Torrent | YouTube

RSS Feeds:

MP3 Feed | OGG Feed | iTunes Feed | Video Feed | Video Feed | Torrent Feed

Become a supporter on Patreon

Show Notes:

— Episode Links —

• Amazon finally stops selling the Fire Phone, as company adjusts its hardware strategy – GeekWire
• Apple Launching A9X-Based 12.9″ iPad Pro in November for $799+ – Mac Rumors
• iOS 9 includes ‘Hey Siri’ voice training to help Siri better recognize your voice | 9to5Mac
• GM Took 5 Years to Fix a Full-Takeover Hack in Millions of OnStar Cars | WIRED
• Porn app took secret photos of users – BBC News

The post iPad Crow | TTT 211 first appeared on Jupiter Broadcasting.

A new touchscreen display goes ons ale for the Raspberry Pi that nearly makes it a complete computer, researchers hack the sensors of self driving cars & we speculate rampantly about the iPad Pro, but definitely not the iPhone 6s!

Direct Download:

MP3 Audio | OGG Audio | Video | HD Video | Torrent | YouTube

RSS Feeds:

MP3 Feed | OGG Feed | iTunes Feed | Video Feed | Video Feed | Torrent Feed

Become a supporter on Patreon

Show Notes:

— Episode Links —

• Raspberry Pi’s official 7″ touchscreen display goes on sale today for $60 | VentureBeat | Dev | by Paul Sawers
• Researcher Hacks Self-driving Car Sensors – IEEE Spectrum
• Time to patch your firmware! Backdoor discovered into Seagate NAS drives

The post Speculated Apples | TTT 210 first appeared on Jupiter Broadcasting.

Rooting your Android device might be more dangerous than you realize, why the insurance industry will take over InfoSec & the NSA prepares for Quantum encryption.

Plus some great questions, a fantastic roundup & more!

Thanks to:

• Get Paid to Write for DigitalOcean

Direct Download:

HD Video | Mobile Video | MP3 Audio | OGG Audio | YouTube | HD Torrent | Mobile Torrent

RSS Feeds:

HD Video Feed | Mobile Video Feed | MP3 Audio Feed | Ogg Audio Feed | iTunes Feed | Torrent Feed

Become a supporter on Patreon:

— Show Notes: —

Taking Root – Malware on Mobile Devices

• Since June 2015, we have seen a steady growth in the number of mobile malware attacks that use superuser privileges (root access) on the device to achieve their goals.
• Root access is incompatible with the operating system’s security model because it violates the principle that applications should be isolated from each other and from the system. It gives an application using root access a virtually unlimited control of the device, which is completely unacceptable in the case of a malicious application.
• Malicious use of superuser privileges is not new in itself: in regions where smartphones are sold with privilege escalation tools preinstalled on them, malware writers have long been using this technique. There are also known cases of Trojans gaining such privileges after the user ‘rooted’ the device, i.e. used vulnerabilities to install applications that give superuser privileges on the phone.
• They analyzed the statistics collected from May to August 2015 and identified “Trojan families” that use root privileges without the user’s knowledge: Trojan.AndroidOS.Ztorg, Trojan-Dropper.AndroidOS.Gorpo (which operates in conjunction with Trojan.AndroidOS.Fadeb) and Trojan-Downloader.AndroidOS.Leech. All these mobile malware families can install programs; their functionality is in effect limited to providing the capability to download and install any applications on the phone without the user’s knowledge.
• A distinctive feature of these mobile Trojans is that they are packages built into legitimate applications but not in any way connected with these applications’ original purpose. Cybercriminals simply take popular legit apps and add malicious code without affecting the main functionality.

• After launching, the Trojan attempts to exploit Android OS vulnerabilities known to it one after another in order to gain superuser privileges. In case of success, a standalone version of the malware is installed in the system application folder (/system/app). It regularly connects to the cybercriminals’ server, waiting for commands to download and install other applications.

• There are popular “families” of Android malware.

• Leech Family

• This malware family is the most advanced of those described.
• Some of its versions can bypass dynamic checks performed by Google before applications can appear in the official Google Play Store. Malware from this family can obtain (based on device IP address, using a resource called ipinfo.io) a range of data, including country of registration, address, and domain names matching the IP address. Next, the Trojan checks whether the IP address is in the IP ranges used by Google.

• The malware also uses a dynamic code loading technique, which involves downloading all critically important modules and loading them into its context at run time. This makes static analysis of the application difficult. As a result of using all the techniques described above, the Trojan made it to the official Google Play app store as part of an application named “How Old Camera” – a service that attempts to guess people’s ages from their photos.

• Ztorg family

• On the whole, Trojans belonging to this family have the same functionality as the previous described.
• The distribution techniques used also match those employed to spread Trojans from the Gorpo (plus Fadeb) and Leech families – malicious code packages are embedded in legitimate applications. The only significant difference is that the latest versions of this malware use a protection technique that enables them to completely hide code from static analysis.
• The attackers use a protector that replaces the application’s executable file with a dummy, decrypting the original executable file and loading it into the process’s address space when the application is launched.

• Additionally, string obfuscation is used to make the task of analyzing these files, which is quite complicated as it is, even more difficult.

• It is not very common for malicious applications to be able to gain superuser privileges on their own. Such techniques have mainly been used in sophisticated malware designed for targeted attacks.

Will the insurance industry take over InfoSec?

• “Insurance is a maturity indicator“
• When insurance comes, full scale, to the InfoSec industry, maybe that means we have finally gotten to the point where we understand the risks enough to start putting money on it
• While I can definitely see the argument that insurance companies are in a position to force their clients into certain minimum security practises, either to qualify for insurance, or for a reduced rate
• At the same time, I foresee a bunch of useless certifications, extra bureaucracy, and more things like PCI-DSS audits that miss the point entirely
• “People see insurance entering into security as a bad thing, and maybe it is, but it should not be unexpected. If something involves both risk and significant quantities of money, there are likely people trying to buy or sell insurance around it. The car industry is informative here. As is healthcare, and countless other industries.”
• The article points points out the three basic requirements for insurance companies to be interested:
• Significant risk associated with the space, e.g., dying in surgery, getting into a car wreck, etc.
• Adequate money in the form of a population able to pay premiums.
• Sufficient actuarial data on which to base the pricing and payout models.
• I don’t know that that last measure can be met yet. Unlike with car insurance, it is much harder to predict what a company’s chances of getting breached are.
• Considering factors like how high profile they are (fancier cars get stolen more), what infrastructure they use (newer cars are safer), how often they patch (this can be hard to measure, like how often you service your car, it might not work), doesn’t really give you enough information in order to price the insurance
• In the end, pretty much every company has a 100% change to be breached, it can come down to how quickly it will be detected, and how much damage will be done
• At this point, I don’t think the insurance industry is qualified, and we’ll either see them making so many payouts that they are losing money, or writing loopholes into insurance with vague sentiments like “industry standard security practises”, to weasel out of paying up
• Predictions from the article:
• Insurance companies will have strict InfoSec standards that will be used to determine how much insurance, of what type, they will extend to a customer, as well as how much they will charge for it
  • As you would expect, companies who are deemed to be in poor security health will either pay exorbitant premiums or will be ineligible for coverage altogether
  • In this world, auditors become the center of the InfoSec universe. Either working for the insurance companies themselves, or being private contractors that are hired by the insurance companies, these auditors will be paid to thoroughly assess companies’ security posture in order to determine what coverage they’ll be eligible for, and how much it will cost
  • Insurance companies become, in other words, a dedicated entity that uses evidence-based decision making to incentivize improved security
  • For both internal and audit companies, those certifications will have to be maintained the same way medical professionals have to maintain their knowledge. Not like a CISSP where you lose a credential if you don’t renew it, but where you’re just instantly fired if it lapses
• “When you think about it, it’s not really insurance that’s making this happen, it’s industry maturity as a whole. It’s InfoSec becoming just like every other serious profession.”
• “Think about a hospital, or an architecture firm. You can’t hire nurses who have an aptitude for caring, and who helped this guy this one time. Nope—have a credential or you can’t work there. Same with accountants, and architects, and electricians, and civil engineers.”
• Insurance won’t fix everything (or anything?)
• “We also need to accept that the standardization and insurance agencies won’t fix everything. Auditors make mistakes, companies can and will successfully lie about their controls, certifications only get you so far, and the insurance companies have their own interests that are often in conflict with the goal of increased security.”

The NSA books crypto recommendations

• The NSA, in its role as the organization that sets cryptography standards used by the entire government, has updated its recommendations on what algorithms and key sizes to use
• Currently, Suite B cryptographic algorithms are specified by the National Institute of Standards and Technology (NIST) and are used by NSA’s Information Assurance Directorate in solutions approved for protecting classified and unclassified National Security Systems (NSS).
• A look at the site from a few months ago highlights some of the differences
  • AES 128 was dropped. Former used for ‘SECRET’ with AES 256 for ‘TOP Secret’, AES 256 is recommended for both now
  • ECDH and ECDSA P-256 were also dropped for ‘less’ secret information in favour of P-384
  • SHA256 was also dropped. Surprisingly, SHA-384 remained the recommendation over SHA-512
  • Additionally, new requirements that were not specified before were added
  • Diffie-Hellman Key Exchange requires at least 3072-bit keys
  • RSA for Key Establishment and Digital Signatures also now requires 3072 bit keys
• IAD will initiate a transition to quantum resistant algorithms in the not too distant future. Based on experience in deploying Suite B, we have determined to start planning and communicating early about the upcoming transition to quantum resistant algorithms.
• We are working with partners across the USG, vendors, and standards bodies to ensure there is a clear plan for getting a new suite of algorithms that are developed in an open and transparent manner that will form the foundation of our next Suite of cryptographic algorithms.
• Until this new suite is developed and products are available implementing the quantum resistant suite, we will rely on current algorithms.
• With respect to IAD customers using large, unclassified PKI systems, remaining at 112 bits of security (i.e. 2048-bit RSA) may be preferable (or sometimes necessary due to budget constraints) for the near-term in anticipation of deploying quantum resistant asymmetric algorithms upon their first availability.

Feedback

• Flexible NAS storage

• sound problems

• Something I’ve always wondered….

• VPN and Tails

• LG made a foldable keyboard

Round Up:

• The Way GCHQ Obliterated The Guardian’s Laptops May Have Revealed More Than It Intended
• Two years later, researchers finally allowed to publish paper on fauly immobilizer chip in volkswagen products
• Reflective satellites may be the future of high-end encryption
• Cisco to develop new royalty free video codec, “Thor”
• ‘We Should Put A Metal Detector On The Other Side’: The Laughable Waste Of TSA Body Scanners
• Frontier’s password reset system is a guy named Shawn
• Survey Shows 81% of Healthcare Organizations Suffered Cyberattacks
• Single unprivileged instruction can hang a Raspberry Pi, requiring a power cycle

The post Trojan Family Ties | TechSNAP 230 first appeared on Jupiter Broadcasting.

The stories of Apple’s Netflix competitor leave us impressed, the real outrageous fraud of Ashley Madison has been revealed, Google brings Android Wear to iPhones & the malware problem that impacts jailbroken devices.

Direct Download:

MP3 Audio | OGG Audio | Video | HD Video | Torrent | YouTube

RSS Feeds:

MP3 Feed | OGG Feed | iTunes Feed | Video Feed | Video Feed | Torrent Feed

Become a supporter on Patreon

Show Notes:

— Episode Links —

• Apple Exploring Original Programming Move, Could Compete with Netflix | Variety
• Apple TV 4: Gaming and Siri will be major focuses, expect Bluetooth game controllers + enhanced wireless | 9to5Mac
• Ashley Madison Code Shows More Women, and More Bots
• Android Wear Smartwatches Will Now Work With iPhone Too
• Yes, the Moto 360 does work with the iPhone | The Verge
• Malware infecting jailbroken iPhones stole 225,000 Apple account logins | Ars Technica
• Particle (formerly Spark) | Build your connected product
• Patreon August Update

JB Road Trip Wishlist

The post The Madison Bot | TTT 209 first appeared on Jupiter Broadcasting.

The real fallout from the Ashley Madison hack gets personal. The Android StageFright patch that doesn’t cover all of the holes, and turning a KVM into a spying appliance.

Plus a great batch of questions, our answers, and a rocking round up.

All that and a heck of a lot more on this week’s TechSNAP!

Thanks to:

• Get Paid to Write for DigitalOcean

Direct Download:

HD Video | Mobile Video | MP3 Audio | OGG Audio | YouTube | HD Torrent | Mobile Torrent

RSS Feeds:

HD Video Feed | Mobile Video Feed | MP3 Audio Feed | Ogg Audio Feed | iTunes Feed | Torrent Feed

Become a supporter on Patreon:

— Show Notes: —

Ashley Madison Fallout

• According to security firms and to a review of several emails shared with this author, extortionists already see easy pickings in the leaked AshleyMadison user database.
• Earlier today Krebs heard from Rick Romero, the information technology manager at VF IT Services, an email provider based in Milwaukee. Romero said he’s been building spam filters to block outgoing extortion attempts against others from rogue users of his email service.
• The individual “Mac” who received that extortion attempt — an AshleyMadison user who agreed to speak about the attack on condition that only his first name be used — said he’s “loosely concerned” about future extortion attacks, but not especially this one in particular.
• Mac says he’s more worried about targeted extortion attacks. A few years ago, he met a woman via AshleyMadison and connected both physically and emotionally with the woman, who is married and has children. A father of several children who’s been married for more than 10 years, Mac said his life would be “incredibly disrupted” if extortionists made good on their threats.
• Mac said he used a prepaid card to pay for his subscription at AshleyMadison.com, but that the billing address for the prepaid ties back to his home address.
• Unfortunately, the extortion attempts like the one against Mac are likely to increase in number, sophistication and targeting, says Tom Kellerman, chief cybersecurity officer at Trend Micro.
• The leaked AshleyMadison data could also be useful for extorting U.S. military personnel and potentially stealing U.S. government secrets, experts fear. Some 15,000 email addresses ending in dot-mil (the top-level domain for the U.S. military) were included in the leaked AshleyMadison database, and this has top military officials just a tad concerned.
• According to The Hill, the U.S. Defense Secretary Ash Carter said in his daily briefing Thursday that the DoD is investigating the leak.
• Almost None of the Women in the Ashley Madison Database Ever Used the Site
• A light-weight forensic analysis of the AshleyMadison Hack
• City employees among emails listed in Ashley Madison hack
  
• John McAfee thinks he knows who hacked Ashley Madison
• Leaked AshleyMadison Emails Suggest Execs Hacked Competitors
• The only thing potentially interesting or useful in AshMad CEO’s inbox…

Android StageFright patch doesn’t cover all of the holes

• Google released to the open source Android project a new patch for the Stagefright vulnerability found in 950 million Android devices after researchers at Exodus Intelligence discovered the original patch was incomplete and Android devices remain exposed to attack.
• “We’ve already sent the fix to our partners to protect users, and Nexus 4/5/6/7/9/10 and Nexus Player will get the OTA update in the September monthly security update,” a Google spokesperson told Threatpost. Last week at Black Hat, Google announced that it would begin
• The original four-line code fix for CVE-2015-3824, one of several patches submitted by researcher Joshua Drake of Zimperium Mobile Security’s zLabs who discovered the flaw in Stagefright, still leads to a crash and device takeover. Jordan Gruskovnjak, a security researcher at Exodus, found the problem with the patch, and Exodus founder Aaron Portnoy today hinted that there could be similar problems in all the patches.
• “They failed to account for an integer discrepancy between 32- and 64 bit,” Portnoy told Threatpost this morning. “They’re not accounting for specific integer types, and [Gruskovnjak] was able to bypass the patch with specific values that cause a heap buffer allocated to overflow.”
• “According to public sources, many more issues have been discovered since they reported the bugs in MPEG4 processing on Android. I expect we will see continuing fixes to the Stagefright code base for the coming months,” Drake said in an email to Threatpost. “The story is long from over.”
• Exodus Intelligence notified Google on Aug. 7, the first day of DEF CON in Las Vegas and two days after Drake’s Stagefright presentation at the Black Hat conference. Google has assigned CVE-2015-3864 to the issue.
• In addition to Nexus devices, Google said it sent the original patches to other mobile providers, including: Samsung for its Galaxy and Note devices; HTC for the HTC One; LG for the G2, G3 and G4; Sony for its Xperia devices; and Android One.
• The vulnerabilities affect Android devices going back to version 2.2; newer versions of Android have built-in mitigations such as ASLR that lessen the effects of Stagefright exploits. Google said last week that 90 percent of Android devices have ASLR enabled, and that the next release of its Messenger SMS app also contains a mitigation requiring users to click on videos in order to play them.
• Additional Coverage: Forbes
• The news is compounded by yet more Android vulnerabilities
• Checkpoint Security: Certifigate
• Major Android remote-access vulnerability is now being exploited

Turning a KVM into a spying appliance

• Researchers presented their work at BlackHat on how to teach a keyboard switch to spy on its users
• “When it comes to large systems, there are a lot more computers than there are people maintaining them. That’s not a big deal since you can simply use a KVM to connect one Keyboard/Video/Mouse terminal up to all of them, switching between each box simply and seamlessly. The side effect is that now the KVM has just as much access to all of those systems as the human who caresses the keyboard. [Yaniv Balmas] and [Lior Oppenheim] spent some time reverse engineering the firmware for one of these devices and demonstrated how shady firmware can pwn these systems, even when some of the systems themselves are air-gapped from the Internet.”
• Early KVM switches were just physical hardware switches that allowed more than one computer to be controlled by a single Keyboard, Video (Monitor), and Mouse
• By the year 2000, we had Matrix KVMs that could be chained together and used to control more than 1000 computers from a single keyboard
• USB Stacks, Video Transcoding, Virtual Media (mount an ISO from your workstation as if it was a usb cdrom drive) drove KVMs towards being entire computers in and of themselves, with an operating system, that could be hacked
• The firmware shipped with the device was obfuscated, and at the start, the researchers were unable to find anything useful. Not a single string in the firmware
• By comparing a number of different firmware versions, they were able to figure out which part of the firmware image was the version number. This gave them a starting point
• Looking at the circuit board of the KVM they found some common ASICs, which provided more clues
• Once they cracked the obfuscation, they now had code they could analyze
• “Of course reading the firmware is only the first step, you need to show that something useful (insidious) can be done with it. During the talk the pair demonstrated their custom firmware switching to a different system, “typing” in the password (which would have been logged earlier when a human typed it in), and echoing out a binary file which was then executed to load malware onto the system.”
• “Yes, you need physical access to perform this attack with the KVM used during the talk. But some KVMs allow firmware updates over IP, and many of them have web interfaces for configuration. There are many vectors available here and knowing that, the discussion turns to prevention. Keystroke statistics are one way to prevent this kind of attack. By logging how fast characters are being typed, how tight the cadence is, and other human traits like use of backspace, the effectiveness of this type of attack can be greatly reduced.”
• This is interesting research, and makes me even more suspicious of the 16 port, 2 user, IP-KVM I use to manage some of my servers.

Feedback

• Get your BSDNow 2 year anniversary t-shirt before time runs out

• Corporate email being hacked?

• PfSense vs cheap off-the-shelf router for home network

• Self-Hosted RMM Software

• Allan and Chris: Your personal SSH key management methodologies?
  • Allow storage of SSH private keys in LastPass, and use lpass CLI to retrieve and load into ssh-agent. The general idea is to store the private key armored ASCII in an “SSH Key” Secure Note, in a specific folder (i.e.: “Secure Notes\SSH” ). · GitHub
  • SSH Authentication with YubiKey | LAS 373 | Jupiter Broadcasting
• FUDO

Round Up:

• Microsoft has no plans to tell us what’s in Windows patches
• DNSSEC – Fighting the FUD
• Researcher catches AT&T injecting ads on free airport Wi-Fi hotspot
• OpenSSH privilege separation accidently disabled on pkgsrc platforms, for the last 9 years
• A data center of liquid cooled servers
• GitHub attacked again as Chinese developers forced by police to pull code
• UK Police investigate first instance of “Cyber Flashing”, iOS AirDrop
• The security content of the latest OS X update

The post Extortion Startups | TechSNAP 229 first appeared on Jupiter Broadcasting.

The Iran deal is getting the hard sell this week from both sides, and we’ll cut through all the hype and discuss the real issues with the nuke deal & what our best alternatives are. Another Cyber attack, this time on the pentagon is behind pinned on Russia & we cover a few moments of the first 2016 debate.

Plus an update on all those rebels the US has trained in Syria, Hillary turns in her email server, a very high-class high-note & much more!

Direct Download:

Video | MP3 Audio | OGG Audio | Torrent | YouTube

RSS Feeds:

Video Feed | MP3 Feed | OGG Feed | HD Torrent | Mobile Torrent | iTunes

Become an Unfilter supporter on Patreon:

Show Notes:

— Episode Links —

• Hillary Clinton holds private meeting with Black Lives Matter activists | US news | The Guardian
• The Spy Satellite Secrets in Hillary’s Emails – The Daily Beast
• Readers School Politico Writer on Real Reason for Sanders BLM ‘Problem’
• Russia and Nato ‘actively preparing for war’ – Telegraph
• Clinton aides vow not to destroy emails – POLITICO
• George Soros spent $33MILLION bankrolling Ferguson protesters
• George Soros funds Ferguson protests, hopes to spur civil action
• Donald Trump Interview Boosts Ratings for Fox News Channel’s ‘Hannity’ | Variety
• EPA chief: Colorado river hit by mine waste back to pre-spill quality – Yahoo News Canada
• EPA chief: Colorado river hit by mine waste back to pre-spill quality – Yahoo News Canada
• EPA chief: Colorado river hit by mine waste back to pre-spill quality – Yahoo News Canada
• Drone hovers outside Hawaii Kai woman’s bedroom, but no crime wa – Hawaii News Now – KGMB and KHNL
• jon stewart is now free to run for democratic presidental nomination : unfilter

The post Trumping the Iran Deal | Unfilter 154 first appeared on Jupiter Broadcasting.