Show Notes:

Get TechSNAP on your Android:

• Callisto – Android App
• Jupiter Broadcasting – Android App by ShaneQful

Browser Affiliate Extension:

• Jupiter Broadcasting Affiliate Extensions for Chrome and Firefox

Zero day vulnerability in MoinMoin wiki software takes down many Major Wikis

• wiki.debian.org security breach
• FreeBSD Wiki shutdown to avoid compromise: 503 wiki.FreeBSD.org is offline due to security issue
• wiki.python.org Compromised : techsnap
• If you had an account on any wiki powered by MoinMoin, it is recommended that you change the password on that account, and any other accounts that shared that password (don’t share passwords between sites)

---

Polish researchers hide secret messages in silence

• A group from the Warsaw University of Technology (I was there a few months ago, for EuroBSDCon), have developed a way to communicate in secret using the silences during a skype call
• The new form of steganography takes advantage of the specially formatted packets that the Skype protocol uses to denote silence (to try to suppress background noise and save bandwidth)
• Skype transmits voice data in 130 byte packets, but packets representing silence are only 70 bytes long
• They have created software called SkyDe (SkypeHide), which intercepts some of the silent packets and replaces them with an encrypted message. On the other end, the software decrypts the hidden message, which can contain text, audio or video.
• The hidden messages are indistinguishable from a regular silence packet, and allow data to be transferred at up to 1 kilobit per second (128 bytes per second, not very useful for real time audio/video, but could easily hide text messages or files)
• The researchers will be presenting the details of their system at the 1st ACM Workshop on Information Hiding and Multimedia Security in Montpellier, France, this June

---

Cloud ‘secure ftp’ client Accellion contains password reset bug

• A security researcher investigating Facebook stumbled upon a bug that allowed him to reset the password of any facebook user whose email address he knew
• By using his own account, and then modifying the parameters of an HTTP POST, the researcher was able to reset the password of any other user
• The bug turned out to be in Accellion, a mobile file sharing application
• The bug has since been fixed by Accellion and Facebook, but many private cloud instances are still vulnerable
• The HTTP POST passed the new password and email address as parameters, and was only secured by a cookie containing referrer= base64 encoded email address
• In a secure setup, this cookie should have at least been the MD5 of the email address and a secret key, something that an attacker could not predict/create
• Youtube video demonstrating the attack

---

John McAfee – One man intelligence agency

• John McAfee is a British American computer programmer, and the founder of McAfee Inc. (Acquired by Intel in 2010 for $7.68 billion)
• On April 30, 2012 John McAfee’s home in Belize was raided, but he was never charged with a crime
• After this incident, John McAfee decided to start fighting back
• Below and some highlights from his blog post, detailing what he claims were his activities against the Belize government, and the results
• He purchases 75 inexpensive laptops and infected them with malware that could log keystrokes, activate webcam and microphones, etc and reported the results back to him, and then released the packaging
• He then began giving these laptops as gifts to government employees, police officers, Cabinet Minister’s assistants, girlfriends of powerful men, boyfriends of powerful women, etc
• He also hired ‘social engineers’ to get close to certain people, to infect their computers, to change settings on their cell phones (disable auto-delete of old text messages), etc
• With these key loggers in place, he was able to gain access to the usernames and passwords for email, facebook, and internal government accounts, as well as the content of emails and other correspondence, even if it was later deleted
• With the webcam and microphone malware, he was also able to capture the face and voices of some of his targets
• He also claims to have found evidence that the Belize government was issuing fake passports to lebanese terrorists to allow them to enter the United States

---

War Story:

Ben noted it has been a while since we’ve had a War Story, so he submitted this one:

*
It was the summer of 2005 and I was attending a local University of Wisconsin 2-year community college and working in IT there at the same time. The entire IT department consisted of my boss, who was the “everything admin,” myself, and one other student. That place was jinxed. Every time the boss left for any reason at all, all hell would break loose–whether it be our ISP would have an outage, power outages, fiber patches that would just die, or whatever. Needless to say, I was a bit nervous when my boss announced he was going to be gone fishing somewhere in Canada for 2 weeks with no access to a cellular signal. If anything broke that we couldn’t handle, we were to contact the higher-ups in Madison.

Everything ran smoothly Monday and Tuesday. Things were looking up. I arrived at work Wednesday morning and the dean met me at the door. He informed me that there was a power outage overnight and none of the admin staff had access to voicemail. I was not pleased to hear this as I had never so much as touched the voicemail system. The other student employee had never done anything with it either, but we decided to take a peek and see if we could figure it out. To make things even better, my office phone was dead and so were all the other phones in the newer buildings on campus.

The phone system at the campus was made up of two small Nortel DMS–100 switches. The first one was installed sometime in the early 1980s and was mostly full. This one serviced the older buildings on campus. The newer buildings were serviced by a newer DMS–100 that included a voicemail module on one of the line cards. I powered on the serial terminal sitting on top of the newer DMS–100 and found an error message indicating the source of the problem. One of the fans in the chassis failed and the unit would not boot until the fan had been replaced.

Nortel could have used a few lessons in making parts replaceable. It took 10 minutes of tinkering to get the front panel off and find the failed fan. It was completely seized up. A few more minutes with the screwdriver and the fan was removed. It looked like a standard 120mm case fan at first but then my co-worker noticed that it was a 24v fan. So much for that idea. I called down to Madison and talked to one of the admins there. Naturally, this unit hadn’t been covered under a service contract in the past 5 years or so. He told me to see what I could come up with.

I did some googling and found a few fans that might work, but none of them had a speed sensor wire and they would take a few days to arrive. That wasn’t going to work. My next thought was to get a 12v regulator or some resistors to build a regulator and run a standard 120mm fan. The physics lab didn’t have any of the parts I needed and the local Radio Shack was useless (I could do it now but back then I didn’t have the hardware skills to hack one together from the parts RS had…) Meanwhile, my co-worker was fooling around with the dead fan. He grabbed the fan blades and twisted and it came unstuck. It didn’t spin very well but we figured it might not have to. We went back downstairs and re-mounted the fan. I power-cycled the chassis while my co-worker used a can of compressed air to spin the blades of the fan. Success! The switch booted up. We quickly unhooked the fan so it wouldn’t short anything out and put the covers back on the cabinet. Luckily there were no line cards behind the fan so it’s failure wouldn’t affect the switch too much. Everything booted up and was stable. The bosses in Madison were impressed and said they would work on a replacement fan. When I left a year later there was still a can of compressed air on the top of the switch in case the power went out… Thinking back, I wonder what my tuition money got spent on.

Thanks for your continued efforts on TechSnap, LAS, Unfilter, Coder Radio, Sci Byte, and the Faux Show. They keep me company when the dog is running me after work.

A subscriber and serial affiliate user,

Ben

---

Feedback:

• How do I keep from screwing the next guy after I quit ? Give me some feed back so I make it easy for the next poor sap. A question for the show

• Multiple Apache2 Sites on separate servers behind one dynamic IP

• Show Feedback: Upgrading your ‘Ultimate Servers’

• Email Server at Home

• Web App to Generate Great Passwords

• How to become the IT expert that companies throw money at

• SSHARK! – Sent in by rawzone via reddit

• Belgian bank hires mind readers

Round-Up:

• FOLLOWUP: Dutch government takes down DigID system after Ruby vulnerability is found, service since restored
• Second Ruby on Rails vulnerability even more critical, metaploit package already in the wild, patch immediately
• New year, new Java zeroday!
• Remote NTLM Challenge Response is 100% Broken (Yes, this is still relevant)
• Netflix launches ‘Super HD’ and 3D streaming – but only through certain ISPs
• nVidia releases 310.90 driver update to resolve vulnerabilities discovered over Christmas
• Adobe Are Not Giving Photoshop Away Afterall…
• Useful flowchart/mindmap explains the relationship between Risk, Threat, and Vulernability
• Dutch government publishes guidelines for responsible disclosure
• Hospice loses laptop containing data on 441 patients, fined $50,000
• Adobe, Apple and others didn’t test their software against future dates. What other breakages didn’t we hear about?
• Falsehoods about time and even more falsehoods about time

The post Hiding in the Silence | TechSNAP 92 first appeared on Jupiter Broadcasting.

]]> https://original.jupiterbroadcasting.net/27536/toked-the-vote-unfitler-26/ Thu, 15 Nov 2012 22:55:14 +0000 https://original.jupiterbroadcasting.net/?p=27536 Is the will of the people in Colorado and WA be strong enough to end over 70 years of prohibition? We examine what lies ahead on the path of legalization.

The post Toked the Vote | Unfilter 26 first appeared on Jupiter Broadcasting.

]]>



Is the will of the people in Colorado and Washington enough to end over 70 years of prohibition? Now that this historic vote has been cast, we examine what lies ahead on the path of Cannabis legalization.

Plus: We sift through the fallout surrounding the flash resignation of General Petraeus, the head of the CIA, the others pulled down with him, how cyber surveillance was played a key role, and the big story the media is ignoring.

Then in ACT3: It\’s your feedback, our follow up and a heck of alot more in this week\’s episode of… Unfilter!

Direct Download:

HD Video | Mobile Video | MP3 Audio | OGG Audio | Torrent | YouTube

RSS Feeds:

HD Feed | Mobile Feed | MP3 Feed | OGG Feed | HD Torrent | Mobile Torrent | iTunes

Get Unfilter on your Android:

• Callisto – Android App
• Jupiter Broadcasting – Android App by ShaneQful

Browser Affiliate Extension:

• Jupiter Broadcasting Affiliate Extensions for Chrome and Firefox

Show Notes:

ACT ONE:

• John McAfee says he won\’t turn himself in for questioning over neighbor\’s murder in Belize

• Victim Had Confronted John McAfee Over Dogs

• Gmail probe led FBI to CIA chief David Petraeus\’s affair

• Email Location Data Led FBI to Uncover Top Spy\’s Affair

• Frederick Humphries, F.B.I. Agent in Petraeus Case

• Silencing General Petraeus

• Who Is Jill Kelley? Brian Ross Investigates

• Petraeus, Allen supported Florida woman\’s sister in child custody spat

• Gen. Allen\’s emails to Jill Kelly were like \’phone sex,\’ sources say

• David Petraeus To Testify Before Senate Intelligence Committee

• The Petraeus Legacy: A Paramilitary CIA?

• General demoted for lavish travel, spending

• Obama signs secret directive to help thwart cyberattacks

ACT TWO: Toked the Vote

• David has questions about WA\’s Legal Weed

• Two states legalize pot– but is it really legal?

• 220 marijuana cases dismissed in King, Pierce counties

• What Obama and the Feds Will Do About Washington and Colorado Legalization – Expert Analysis

• Study says marijuana no gateway drug

• Is Marijuana Addictive?

ACT THREE: FEEDBACK

• Loved the Election Coverag

• Drone Spotting

• Gary Johnson runs most successful Libertarian campaign in party’s history

Follow the Team:

Call us: 1.425.312.1756

• Unfilter on Reddit
• Chris on Twitter
• Chase’s Geek and Gaming Network
• Chase on Twitter

The post Toked the Vote | Unfilter 26 first appeared on Jupiter Broadcasting.

]]> https://original.jupiterbroadcasting.net/12623/ultimate-backups-techsnap-26/ Thu, 06 Oct 2011 19:52:13 +0000 https://original.jupiterbroadcasting.net/?p=12623 We delve into backups, from the fundamentals to the very best tools! Plus FireFox goes to battle with McAfee and is Bank of America Under attack?

The post Ultimate Backups | TechSNAP 26 first appeared on Jupiter Broadcasting.

]]>



We’ll tell you about AT&T leaving Android open to a hack so easy, my two year old son could pull it off. Plus FireFox goes to battle with McAfee and is Bank of America Under attack?

Then – We delve into backups, from the fundamentals to the very best tools!

All that and more, in this week’s TechSNAP!

Direct Download Links:

HD Video | Large Video | Mobile Video | WebM | MP3 Audio | OGG Audio | YouTube

Subscribe via RSS and iTunes:
Subscribe... --RSS-- TechSNAP HD TechSNAP Large TechSNAP Mobile TechSNAP MP3 TechSNAP OGG --iTunes-- TechSNAP iTunes HD TechSNAP iTunes Mobile TechSNAP iTunes Large TechSNAP iTunes MP3

[ad#shownotes]

Show Notes:

Security hole in AT&T Samsung Galaxy S II

• Bug allows someone to bypass the security lockout screen, accessing the phone without the password
• The flaw does not exist on the Sprint version of the Samsung Galaxy S , or the Epic Touch 4G
• By pressing the lock button to wake the phone, and you will be prompted with the unlock screen. Allow the phone to go back to sleep, and immediately tap the lock button again, and you will have access to the phone
• This feature is likely designed for the situation where you are waiting for some interaction on the phone and it falls asleep, if you press a button to wake it within a few seconds, it doesn’t prompt you to reunlock the phone. This is a useful feature, however, it should be predicated on the fact that you just recently unlocked the phone (don’t make me unlock the phone twice within 90 seconds, or something similar)
• The flaw only effects phones that have been unlocked once since boot
• Since the flaw only effects the AT&T version of the phone, it would seem it is based on software added to the phone by AT&T, which appears to cache your response to the unlock screen, and use it to bypass the screen when you re-wake the phone immediately after it goes to sleep.
• Another example of the vendors messing with the core google product.
• Users with Microsoft Exchange security policies don’t seem to be affected
• Users can adjust the settings on their phone by accessing: Settings ->Location and Security->Screen unlock settings->Timeout and setting the value to Immediately, disabling the ‘feature’ that presents the vulnerablity.

---

Firefox advises users to disable McAfee Plugin

• Firefox says the McAfee ScanScript plugin causes Stability and Security problems
• The problem only seems to effect the new Firefox 7, it is likely caused by a compatibility problem with versions of ScanScript designed for older versions of Firefox
• Firefox has started generating popup warnings to users using versions of McAfee older than 14.4.0 due to an incredibly high volume of crash reports
• McAfee says it is working with Firefox to solve the issue for the next version of the software
• McAfee is very popular in corporate environments and is often enforced with a Active Directory Group Policy that makes it nearly impossible for the end user to disable the virus scanner

---

Bank of America – Unexplained Outages – Is it an attack?

• The Bank of America website has been degraded, slow, returning errors or down for more than 6 days
• Bank of America (BofA) said its Web and mobile services have not been hit by hacking or denial-of-service attacks, however they would not disclose what has been causing the online problems.
• Quote: “I just want to be really clear. Every indication [is that] recent performance issues have not been the result of hacking, malware or denial of service,” said BofA spokeswoman Tara Burke. “We’ve had some intermittent or sporadic slowness. We don’t break out the root cause.”
• The problems began Friday morning, a day after BofA announced it would charge a $5 monthly fee for account holders using their debit cards
• Additional Coverage

---

Feedback:

Continuing our Home Server Segment – This week we are covering backups.
Before we cover some of the solutions, we should look at some of the concepts and obstacles to creating proper backups. There are a number of different ways to back things up, but the most popular involves using multiple ‘levels’ of backup.

• Full backup

• This is a backup of every file (or a specific subset, or without specific exclusions) on a system.

• This is the base of higher level backups, and is also known as a level 0 backup

• Full backups are the biggest and take the slowest

• Differential Backup

• A differential backup is one that includes every file that has changed since the last full backup was started (this is important).

• >It is very important the higher level backups always be based on the START time of the lower level backup, rather than the last modified, or finish time. During the last backup, if the file changed after it was backed up, but before that backup completed, we want to be sure to include it in the next backup

• Differential backups require only the most recent full backup to restore

• Incremental Backup

• An incremental backup consists of every file that has changed since the start of the last backup of any level

• Incremental backups are the smallest and fastest

• Incremental backups can take the longest to restore, and can require access to each of the previous differential backups since last full backup, and that most recent full backup

• Incremental backups offer the trade off, they take less time and less storage, however they slow the recovery process.

• Incremental backups, due to their smaller size, make it easier to have ‘point of time’ backups of files, rather than just the most recent.

• Some backup systems do away with the name designations, and allow even more granularity

• A level 0 backup is a full backup

• A level 1 is everything that has changed since the level 0

• A level n is everything that has changed since the last level n–1 or higher

• Systems such as the unix ‘dump’ utility, allow up level 9 backups

• Some backup systems, such as Bacula, support ‘synthetic full backups’

• A synthetic backup is when you use a full backup, plus more recent differential and incremental backups to create a new, more recent full backup.

• This can be especially advantageous in remote and off site backup systems, where transferring the full data set over the network can be very slow and costly.

• rsync

• Not actually a backup tool, it just creates and synchronizes a copy of the files

• Copies only the changes to the files, so is faster

• snapshots

• A point in time copy of the files in a filesystem (supported by LVM, UFS, ZFS, etc)

• A good place to take a backup from, resolves issues with open files

• bacula

• Designed to backup a large number of machines

• Quite a bit of setup (Directory, Storage Daemon, SQL Database, File Daemons (Clients))

• Cross platform

• Powerful deduplication system, and ‘base backups’

• Support for Windows Volume Shadow Copy (snapshots of open files)

• flexbackup

• simple perl script that creates archives (tar, cpio, etc) with optional compression (gzip, bzip2, etc).

• Uses the ‘find’ command to create multi-level backups based on modified date

• backupmypc

• rsync based

• Supports FTP, SCP, RCP, & SMB for Windows

• s very smart about how it handles portable devices that miss backups.

• It’s magic is it’s de-dupe hard-link mojo that saves tons of space

• Bit of a nerd project to get going, but is bullet proof once its in

• TarSnap – BSD Encrypted Cloud Backup

• Mondo Rescue – GPL disaster recovery solution

• CrashPlan – Online Backup Software, Disaster Recovery

• Allan’s AppFail.com article about backups

Round Up:

• WiFi jamming via deauthentication packets
• 0day Full disclosure: American Express
• Telecomix releases Syrian Censorship Proxy Logs
• OpenStack Cloud on a USB Stick
• Hitachi-LG Fined for price fixing optical drives sold to OEMs
• Air traffic control data found on eBayed network gear • The Register
• This is how Windows get infected with malware

Jupiter Broadcasting stats

1. Firefox 42.66%
2. Chrome 29.73%
3. Internet Explorer 14.43%

The post Ultimate Backups | TechSNAP 26 first appeared on Jupiter Broadcasting.

]]> https://original.jupiterbroadcasting.net/2660/inside-steve-jobs-abandoned-mansion-jupiternite-82310/ Mon, 23 Aug 2010 21:52:56 +0000 https://original.jupiterbroadcasting.net/?p=2660 we take a look at the interesting tech news stories from today and the weekend. Steve Jobs got the OK to tare down a mansion he’s not lived in for 14 years, Intel-McAfee deal baffles security analysts, a comparative look at the largest online communities, an update to the iPhone App epic win and much more!

The post Inside Steve Jobs' Abandoned Mansion | Jupiter@Nite | 8.23.10 first appeared on Jupiter Broadcasting.

]]>



With tonight’s Jupiter@Nite we take a look at the interesting tech news stories from today and the weekend. Steve Jobs got the OK to tare down a mansion he’s not lived in for 14 years, Intel-McAfee deal baffles security analysts, a comparative look at the largest online communities, an update to the iPhone App epic win and much more!

Show Feeds:

• HD Video RSS
• Large Video RSS
• iPod Video RSS
• MP3 RSS
• iTunes Feeds

Tonight’s Links:

Infographic: The Geosocial Universe

Intel-McAfee deal baffles security analysts
Why the World Is Running Out of Helium

Inside Steve Jobs’ abandoned Jackling mansion (photos)

FOLLOW UP:

EpicWin for the iPhone is out.

• A Todo list manager with a levels and rewards system.
• Suppose to make daily tasks more of a game, more fun.

Download:

The post Inside Steve Jobs' Abandoned Mansion | Jupiter@Nite | 8.23.10 first appeared on Jupiter Broadcasting.

]]>