Password – Jupiter Broadcasting

Our best open source alternatives to LastPass. We run down the easy, the straight forward & the totally custom solutions to rolling your password managment. All our picks are totally open source, auditable & ready to use today.

Plus the first reviews of the Steam Machines hit the web, Red Hat’s big buy, GIMP in your browser & more!

Thanks to:

Get Paid to Write for DigitalOcean

Direct Download:

RSS Feeds:

Become a supporter on Patreon:

— Show Notes: —

Brought to you by: System76

LastPass Killers

Yahoo Mail drops passwords and adds third-party email support for new apps

It’s Yahoo Mail‘s 18th birthday this month and to mark the occasion, Yahoo is pulling out all the stops with three major announcements: a brand new mobile app for Android and iOS, the support for multiple third-party email accounts and, perhaps most significantly, the introduction of a completely password-free sign-in experience called Yahoo Account Key.

LastPass Joins the LogMeIn Family

It’s a big day here at LastPass. We’re thrilled to announce that we’re joining LogMeIn. As one of the world’s leading SaaS companies, we can’t imagine a better team to align with our values and product-driven mission. With their experience in growing successful brands like join.me, we’re excited to join LogMeIn in delivering the next generation of identity and access management for individuals, teams and companies, with LastPass at the forefront.

KeePass

KeepassC

KeePassC is a password manager fully compatible to KeePass v.1.x and KeePassX. That is, your
password database is fully encrypted with AES.

KeePassC is written in Python 3 and comes with a curses-interface. It is completely controlled
with the keyboard (vim-like keys are supported).

Some features are:

AES encryption of the database with password and/or keyfile
Included customizable password generator
KeePassX and KeePass v.1.x compatible (KeePass v2.x planned)
Database entries are sorted in alphabetically sorted groups
Subgroups of groups
Entries are identified by a title
Search entries by this title and show matches in an own group
Set expiration dates to remind you that a new password is needed
Unicode support
Copy username and password to clipboard
Auto-locking workspace and self-deleting clipboard with adjustable delays
Options to remember last database and last keyfile
Open URLs directly in your standard browser
Optional use of vim/ranger-like keys
Simple command line interface
Network functionality including multiuser support
The last can be used to omit password entering, too
kpcli – A command line interface for KeePass

A command line interface (interactive shell) to work with KeePass 1.x or 2.x database files. This program was inspired by my use of the CLI of the Ked Password Manager (“kedpm -c”) combined with my need to migrate to KeePass.

Pass

Password management should be simple and follow Unix philosophy. With pass, each password lives inside of a gpg encrypted file whose filename is the title of the website or resource that requires the password. These encrypted files may be organized into meaningful folder hierarchies, copied from computer to computer, and, in general, manipulated using standard command line file management utilities.

pass makes managing these individual password files extremely easy. All passwords live in ~/.password-store, and pass provides some nice commands for adding, editing, generating, and retrieving passwords. It is a very short and simple shell script. It’s capable of temporarily putting passwords on your clipboard and tracking password changes using git.

Pass for Android on F-Droid

How Active is Pass Development?

Migrating your data to Pass

To free password data from the clutches of other (bloated) password managers, various users have come up with different password store organizations that work best for them.

Using Git to Sync Pass

First install and then setup git

1 $ git config --global user.name  "John Doe"
2 $ git config --global user.email "johndoe@foobar.com"
3 $ pass git init

QtPass GUI for pass, the standard UNIX password manager

Using pass or git and gpg2 directly

Cross platform: Linux, BSD, OS X and Windows

Reading pass password stores

Decrypting and displaying the password and related info

Editing and adding of passwords and information

Updating to and from a git repository

Per-folder user selection for multi recipient encryption

Configuration options for backends and executable/folder locations

Copying password to clipboard

Configurable shoulder surfing protection options

Experimental WebDAV support

Planned features

Re-encryption after users-change (optional ofcourse).
Plugins based on key, format is same as password file.
Colour coding folders (possibly disabling folders you can’t decrypt).
WebDAV (configuration) support.
Optional table view of decrypted folder contents.
Opening of (basic auth) urls in default browser? Possibly with helper plugin for filling out forms?
Some other form of remote storage that allows for accountability / auditing (web API to retreive the .gpg files)?
GPG – How to trust an imported key

Encryptr – Powered by Crypton

Encryptr is simple and easy to use. It stores your sensitive data like passwords, credit card data, PINs, or access codes, in the cloud. However, because it was built on the zero-knowledge Crypton framework, Encryptr ensures that only the user has the ability to access or read the confidential information. Not the app’s developers, cloud storage provider, or any third party.

Encryptr only ever encrypts or decrypts your data locally on your device. No plain text is ever sent to the server, not even your passphrase. This is what zero-knowledge means.*

You don’t even need to hand over any personal data to register. Not your name, and not your email address. The app only requires a username and a passphrase.

Encryptr is free, and completely open source. This includes Crypton.

Firefox Password Manager

If you use the same simple password for everything you will be more susceptible to identity theft. The Create secure passwords to keep your identity safe article shows you an easy method for creating secure passwords and using the Password Manager, as described above, will help you remember them all.

Even though the Password Manager stores your usernames and passwords on your hard drive in an encrypted format, someone with access to your computer can still see or use them. The Use a Master Password to protect stored logins and passwords article shows you how to prevent this and keep you protected in the event your computer is lost or stolen.

When paired with Firefox sync feature this effectively emulates LastPass without Yubikey support, and without the password generation feature.

— PICKS —

Runs Linux

Etch-a-sketch RUNS LINUX!

Over on YouTube user devnulling has uploaded a video showing his “Etch-A-SDR” project. This project involved creating an all-in-one SDR device out of an Odroid C1, Teensy 3.1 and an RTL-SDR dongle. The Odroid C1 is an embedded computer, similar to the Raspberry Pi 2 and the Teensy 3.1 is a microcontroller development board. The “Etch-A-SDR” is named as such because of its resemblance to an Etch-A-Sketch toy. It has two knobs that can be used for tuning and several side buttons for changing demodulation modes etc.

Upon boot the Etch-A-SDR opens GQRX and is ready for tuning within seconds of turning it on. In addition to using it as a portable SDR with GQRX the Etch-A-SDR can also be booted into normal Linux mode and into Etch-A-Sketch mode, where it operates as a normal Etch-A-Sketch toy.

The code can be downloaded from https://github.com/devnulling/etch-a-sdr.

Desktop App Pick

FreeMind Mind Mapping Tool

FreeMind is a premier free mind-mapping software written in Java. The recent development has hopefully turned it into high productivity tool. We are proud that the operation and navigation of FreeMind is faster than that of MindManager because of one-click “fold / unfold” and “follow link” operations.

Keeping Track of Projects
Project workplace
Workplace for Internet Research
Essay Writing and Brainstorming
Small Database with structure
Commented Internet Favorites or Bookmarks

Weekly Spotlight

Hangups

hangups is the first third-party instant messaging client for Google
Hangouts. It includes both a Python library and a reference client with a
text-based user interface.

Unlike its predecessor Google Talk, Hangouts uses a proprietary,
non-interoperable protocol. hangups is implemented by reverse-engineering
this protocol, which allows it to support features like group messaging that
aren’t available in clients that connect via XMPP.

hangups is still in an early stage of development. The reference client is
usable for basic chatting, but the API is undocumented and subject to change.
Bug reports and pull requests are welcome!

— NEWS —

GIMP Online – rollApp

Run GIMP and other X11 apps in your web browser.

Red Hat is buying Ansible for more than $100M

Buying Ansible — one of four major providers of at least partly open-source devops tools — makes sense, because it can add to Red Hat’s line of offerings. Plus, Ansible already integrates with Red Hat’s OpenShift, OpenStack, and Red Hat Enterprise Linux software.

Red Hat buys Ansible to bolster its developer toolset – Fortune

As part of the deal, about50 Ansible employees will join Red Hat

Red Hat Is Buying IT Automation Startup Ansible, Reportedly For Around $100M | TechCrunch

Red Hat today also provided a brief update to its earnings as part of the news. It says the acquisition is expected to have no material impact to Red Hat’s revenue for the third and fourth quarters of its fiscal year. Non-GAAP operating expenses for fiscal 2016 will be increased by $2 million, or ($0.01) per share, in Q3 and $4.0 million, or ($0.02) per share, in Q4 as a result of the transaction.

Proxmox VE 4.0 is OUT

This video highlights the new features in Proxmox VE 4.0:

Debian Jessie 8.2 and 4.2 Linux kernel
Linux Containers (LXC)
IPv6 support
Bash completion
New Proxmox VE HA Manager

View all updates: https://pve.proxmox.com/wiki/Roadmap

The Alienware Steam Machine: finally, a gaming PC for the living room

I used to laugh when I saw Linux users scramble to build compatibility layers to play “real” PC games. I chuckled when Valve CEO Gabe Newell lambasted Windows 8 as a “catastrophe for everyone,” proffering Linux and SteamOS as a viable alternative. It seemed so far-fetched, so silly. Truth be told, I’m still laughing — but now it’s because I’m enjoying myself. The Alienware Steam Machine has some growing pains, but it’s fun. Lots of fun.

Steam’s living room hardware blitz gets off to a muddy start | Ars Technica

It’s all very smooth, overall, but there were a few sticking points that seemed a little rough compared to other game consoles. While the system hasn’t frozen on us during a game yet, there have been a handful of times where the whole OS hung when we were closing or opening a title, requiring a system reboot that took 30 to 60 seconds. We ran into occasional problems with webpage scrolling, the on-screen keyboard, and Wi-Fi recognition as well, all of which disappeared with a reboot.

We also found a few SteamOS games that still include an intermediate “launcher” screen that asks players to confirm resolution and other settings. That’s only an annoyance because these screens can’t be navigated with the Steam Controller; you need to plug in a mouse and keyboard to get through to the actual game in these cases. While the SteamOS interface includes large warnings that these games require extra hardware, and Valve isn’t directly responsible for third-party developers’ unfriendly decisions, it still seems like an oversight to have such games be unplayable out of the box.

ARCH steam controller not detected properly

Feedback:

https://slexy.org/view/s2Y836bi9B
https://slexy.org/view/s2sQ9ZkWTx
https://slexy.org/view/s2VwIphEzi
https://www.indiegogo.com/projects/open-foss-training#/

Rover Log Playlist

Watch the adventures, productions, road trips, trails, mistakes, and fun of the Jupiter Broadcasting mobile studio.

Support Jupiter Broadcasting on Patreon

Chris’s Twitter account has changed, you’ll need to follow!

Chris Fisher (@ChrisLAS) | Twitter

— CHRIS’ STASH —

Hang in our chat room:

irc.geekshed.net #jupiterbroadcasting

— NOAH’S STASH —

Noah’s Day Job

Altispeed Technologies

Contact Noah

noah [at] jupiterbroadcasting.com

Find us on Google+

Find us on Twitter

Follow us on Facebook

Catch the show LIVE Friday:

The post Passing On LastPass | LAS 387 first appeared on Jupiter Broadcasting.

LogMeIn to LastPass | TTT 217

chris — Fri, 09 Oct 2015 10:36:51 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

LastPass gets bought, FireFox loves Flash long time, just not your plugins, good iPhone vs bad iPhone & why the rest of the world laughs at the state of the US’ mobile payments.

Direct Download:

RSS Feeds:

Become a supporter on Patreon

Show Notes:

— Episode Links —

The post LogMeIn to LastPass | TTT 217 first appeared on Jupiter Broadcasting.

Ripping me a new Protocol | TechSNAP 221

chris — Thu, 02 Jul 2015 19:05:26 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

Amazon has a new TLS implementation & the details look great, we’ll share them with you. The technology that powers the NSA’s XKEYSCORE you could have deployed yourself.

Some fantastic questions, a big round up & much, much more!

Thanks to:

Get Paid to Write for DigitalOcean

Direct Download:

RSS Feeds:

Become a supporter on Patreon:

— Show Notes: —

Amazon releases s2n, a new TLS implementation

s2n (signal2noise) is a brand new implementation of the TLS protocol in only ~6000 lines of code
It has been fully audited, and will be re-audited once per year, paid for by Amazon
It does not replace OpenSSL, as it only implements the TLS protocol (libssl) not the crypto primitives and algorithms (libcrypto). s2n can be built against any of the various libcrypto implementations, including: OpenSSL, LibreSSL, BoringSSL, and the Apple Common Crypto framework
The API appears to be very easy to use, and prevent many common errors
The client side of the library is not ready for use yet
Features:
- “s2n encrypts or erases plaintext data as quickly as possible. For example, decrypted data buffers are erased as they are read by the application.”
- “s2n uses operating system features to protect data from being swapped to disk or appearing in core dumps.”
- “s2n avoids implementing rarely used options and extensions, as well as features with a history of triggering protocol-level vulnerabilities. For example there is no support for session renegotiation or DTLS.”
- “s2n is written in C, but makes light use of standard C library functions and wraps all memory handling, string handling, and serialization in systematic boundary-enforcing checks.”
- “The security of TLS and its associated encryption algorithms depends upon secure random number generation. s2n provides every thread with two separate random number generators. One for “public” randomly generated data that may appear in the clear, and one for “private” data that should remain secret. This approach lessens the risk of potential predictability weaknesses in random number generation algorithms from leaking information across contexts. “
One of the main features is that, instead of having to specify which set of crypto algorithms you want to prefer, in what order, as we have discussed doing before for OpenSSL (in apache/nginx, etc), to can either use ‘default’, which will change with the times, or a specific snapshot date, that corresponds to what was the best practise at that time
Github Page
Additional Coverage – ThreatPost
It will be interesting to see how this compares with the new TLS API offered by LibreSSL, and which direction various applications choose to go.

How the NSA’s XKEYSCORE works

“The NSA’s XKEYSCORE program, first revealed by The Guardian, sweeps up countless people’s Internet searches, emails, documents, usernames and passwords, and other private communications. XKEYSCORE is fed a constant flow of Internet traffic from fiber optic cables that make up the backbone of the world’s communication network, among other sources, for processing. As of 2008, the surveillance system boasted approximately 150 field sites in the United States, Mexico, Brazil, United Kingdom, Spain, Russia, Nigeria, Somalia, Pakistan, Japan, Australia, as well as many other countries, consisting of over 700 servers.”
“XKEYSCORE allows for incredibly broad surveillance of people based on perceived patterns of suspicious behavior. It is possible, for instance, to query the system to show the activities of people based on their location, nationality and websites visited. For instance, one slide displays the search “germansinpakistn,” showing an analyst querying XKEYSCORE for all individuals in Pakistan visiting specific German language message boards.”
“The sheer quantity of communications that XKEYSCORE processes, filters and queries is stunning. Around the world, when a person gets online to do anything — write an email, post to a social network, browse the web or play a video game — there’s a decent chance that the Internet traffic her device sends and receives is getting collected and processed by one of XKEYSCORE’s hundreds of servers scattered across the globe.”
“In order to make sense of such a massive and steady flow of information, analysts working for the National Security Agency, as well as partner spy agencies, have written thousands of snippets of code to detect different types of traffic and extract useful information from each type, according to documents dating up to 2013. For example, the system automatically detects if a given piece of traffic is an email. If it is, the system tags if it’s from Yahoo or Gmail, if it contains an airline itinerary, if it’s encrypted with PGP, or if the sender’s language is set to Arabic, along with myriad other details.”
You might expect some kind of highly specialized system to be required to do all of this, but that is not the case:
“XKEYSCORE is a piece of Linux software that is typically deployed on Red Hat servers. It uses the Apache web server and stores collected data in MySQL databases. File systems in a cluster are handled by the NFS distributed file system and the autofs service, and scheduled tasks are handled by the cron scheduling service. Systems administrators who maintain XKEYSCORE servers use SSH to connect to them, and they use tools such as rsync and vim, as well as a comprehensive command-line tool, to manage the software.”
The security of the system is also not as good as than you might imagine:
“Analysts connect to XKEYSCORE over HTTPS using standard web browsers such as Firefox. Internet Explorer is not supported. Analysts can log into the system with either a user ID and password or by using public key authentication.”
“When systems administrators log into XKEYSCORE servers to configure them, they appear to use a shared account, under the name “oper.” Adams notes, “That means that changes made by an administrator cannot be logged.” If one administrator does something malicious on an XKEYSCORE server using the “oper” user, it’s possible that the digital trail of what was done wouldn’t lead back to the administrator, since multiple operators use the account.”
“There appears to be another way an ill-intentioned systems administrator may be able to cover their tracks. Analysts wishing to query XKEYSCORE sign in via a web browser, and their searches are logged. This creates an audit trail, on which the system relies to assure that users aren’t doing overly broad searches that would pull up U.S. citizens’ web traffic. Systems administrators, however, are able to run MySQL queries. The documents indicate that administrators have the ability to directly query the MySQL databases, where the collected data is stored, apparently bypassing the audit trail.”
The system is not well designed, and could likely have been done better with existing open source tools, or commercial software designed to classify web traffic
“When data is collected at an XKEYSCORE field site, it is processed locally and ultimately stored in MySQL databases at that site. XKEYSCORE supports a federated query system, which means that an analyst can conduct a single query from the central XKEYSCORE website, and it will communicate over the Internet to all of the field sites, running the query everywhere at once.”
Your traffic is analyzed and will probably match a number of classifiers. The most specific classifier is added as a tag to your traffic. Eventually (3-5 days), your actual traffic is deleted to make room for newer traffic, but the metadata (those tags) are kept for 30-45 days
“This is done by using dictionaries of rules called appIDs, fingerprints and microplugins that are written in a custom programming language called GENESIS. Each of these can be identified by a unique name that resembles a directory tree, such as “mail/webmail/gmail,” “chat/yahoo,” or “botnet/blackenergybot/command/flood.””
“One document detailing XKEYSCORE appIDs and fingerprints lists several revealing examples. Windows Update requests appear to fall under the “update_service/windows” appID, and normal web requests fall under the “http/get” appID. XKEYSCORE can automatically detect Airblue travel itineraries with the “travel/airblue” fingerprint, and iPhone web browser traffic with the “browser/cellphone/iphone” fingerprint.”
“To tie it all together, when an Arabic speaker logs into a Yahoo email address, XKEYSCORE will store “mail/yahoo/login” as the associated appID. This stream of traffic will match the “mail/arabic” fingerprint (denoting language settings), as well as the “mail/yahoo/ymbm” fingerprint (which detects Yahoo browser cookies).”
“Sometimes the GENESIS programming language, which largely relies on Boolean logic, regular expressions and a set of simple functions, isn’t powerful enough to do the complex pattern-matching required to detect certain types of traffic. In these cases, as one slide puts it, “Power users can drop in to C++ to express themselves.” AppIDs or fingerprints that are written in C++ are called microplugins.”
All of this information is based on the Snowden leaks, and is from any years ago
“If XKEYSCORE development has continued at a similar pace over the last six years, it’s likely considerably more powerful today.”
Part 2 of Article

[SoHo Routers full of fail]

Home Routers that still support RIPv1 used in DDoS reflection attacks

RIPv1 is a routing protocol released in 1988 that was deprecated in 1996
It uses UDP and so an attacker can send a message to a home router with RIP enabled from a spoofed IP address, and that router will send the response to the victim, flooding their internet connection
““Since a majority of these sources sent packets predominantly of the 504-byte size, it’s pretty clear as to why they were leveraged for attack purposes. As attackers discover more sources, it is possible that this vector has the potential to create much larger attacks than what we’ve observed thus far,” the advisory cautions, pointing out that the unused devices could be put to work in larger and more distributed attacks.”
“Researchers at Akamai’s Prolexic Security Engineering and Research Team (PLXsert) today put out an advisory about an attack spotted May 16 that peaked at 12.9 Gbps. Akamai said that of the 53,693 devices that responded to RIPv1 queries in a scan it conducted, only 500 unique sources were identified in the DDoS attack. None of them use authentication, making them easy pickings.”
Akamai identified Netopia 2000 and 3000 series routers as the biggest culprits still running the vulnerable and ancient RIPv1 protocol on devices. Close to 19,000 Netopia routers responded in scans conducted by Akamai, which also noted that more than 5,000 ZET ZXv10 and TP-Link TD-8000 series routers collectively responded as well. Most of the Netopia routers, Akamai said, are issued by AT&T to customers in the U.S. BellSouth and MegaPath also distribute the routers, but to a much lesser extent.

Home Routers used to host Malware

Home routers were found to be hosting the Dyre malware
Symantec Research Paper of Dyre
Affected routers include MikroTik and Ubiquiti’s AirOS, which are higher end routers geared towards “power user” and small businesses
“We have seen literally hundreds of wireless access points, and routers connected in relation to this botnet, usually AirOS,” said Bryan Campbell, lead threat intelligence analyst at Fujitsu. “The consistency in which the botnet is communicating with compromised routers in relation to both distribution and communication leads us to believe known vulnerabilities are being exploited in the firmware which allows this to occur.”
“Campbell said it’s not clear why so many routers appear to be implicated in the botnet. Perhaps the attackers are merely exploiting routers with default credentials (e.g., “ubnt” for both username and password on most Ubiquiti AirOS routers). Fujitsu also found a disturbing number of the systems in the botnet had the port for telnet connections wide open.”

Feedback:

ZFS with 4K drives?
ZFS Replication Between FreeNAS and Linux
Splitting a pool
DNS Transfer Email Downtime Followup
FreeBSD Mastery: ZFS — Not just about ZFS

Round Up:

The post Ripping me a new Protocol | TechSNAP 221 first appeared on Jupiter Broadcasting.

Signed by Sony | TechSNAP 192

chris — Thu, 11 Dec 2014 18:48:06 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

If we could rebuild the Internet from scratch, what would we change? It’s more than just a thought experiment. We’ll share the details about real world research being done today!

Plus we dig through the Sony hack, answer a ton of great question & a rocking roundup!

Thanks to:

Get Paid to Write for DigitalOcean

Direct Download:

RSS Feeds:

Become a supporter on Patreon:

— Show Notes: —

Reinventing Computers And The Internet From Scratch, For The Sake Of Security

DARPA funded research is looking at how we might design the Internet if we had to do it over again
Many decisions that were made 30 and 40 years ago when UNIX and TCP/IP were designed, may be done differently today
The overall project has a number of sub-projects:
- CRASH – Clean-Slate Design of Resilient, Adaptive, Secure Hosts
- MRC – Mission-Oriented Resilient Clouds
- CTSRD – Clean Slate Trustworthy Secure Research and Development (Custard)
BERI: Bluespec Extensible RISC Implementation: a open-source hardware-software research and teaching platform: a 64-bit RISC processor implemented in the high-level Bluespec hardware description language (HDL), along with compiler, operating system, and applications
CHERI: capability hardware enhanced RISC instructions: hardware-accelerated in-process memory protection and sandboxing model based on a hybrid capability model
TESLA: temporally enforced security logic assertions: compiler-generated runtime instrumentation continuously validating temporal security properties
SOAAP: security-oriented analysis of application programs: automated program analysis and transformation techniques to help software authors utilize Capsicum and CHERI features
The goal is to design newer secure hosts and networks, without having to maintain backwards compatibility with legacy systems, the biggest problem with changing anything on the Internet
This is why there are still things like SSLv3 (instead of just TLS 1.2+), why we have not switched to IPv6, and why spam is still such a large problem
I for one would definitely like to replaced SMTP, but no one has yet devised a plan for a system that the world could transition to without breaking legacy email while we wait for the rest of the world to upgrade
“Corporations are elevating security experts to senior roles and increasing their budgets. At Facebook, the former mantra “move fast and break things” has been replaced. It is now “move slowly and fix things.””
For performance reasons, when hardware and programming languages were designed 30 and 40 years ago, it was decided that security would be left up to the programmer
The CHERI project aim to change this, by implementing ‘Capabilities’, a sandboxing and security mechanism into the hardware, allowing the hardware rather than the software to enforce protections, preventing unauthorized access or modification of various regions of memory by malicious or compromised applications.
CHERI, and the software side of the project, Capsicum, are based on FreeBSD, but are also being ported to Linux, where Google plans to make extensive use of it in its Chrome and Chromium browsers.
Additional Coverage

Sony Internal Network Hacked

No, this is not Episode 3 of TechSNAP, Sony was hacked, again
Hackers identifying the selves as Guardians of Peace (GOP) claim to have stolen as much as 100TB of data from Sony
One questions how they managed to exfiltrate such a huge amount of data without being noticed. A full 1 GBPS internet connection would have to run at full capacity for 10 days to move that much data. It seems a lot of the data was likely compressible, but unreleased movies etc would not be
At this point, only about 40GB of data has been leaked, mostly internal documents
“The data dump includes employee criminal background checks, salary negotiations, and doctors’ letters explaining the medical rationale for leaves of absence. There are spreadsheets containing the salaries of 6,800 global employees, along with Social Security numbers for 3,500 U.S. staff. And there is extensive documentation of the company’s operations, ranging from the script for an unreleased pilot written by Breaking Bad creator Vince Gilligan to the results of sales meetings with local TV executives.”
When will companies learn that a spread sheet is not a secure place to store sensitive information
In a memo to Employees Sony Pictures Entertainment chiefs Michael Lynton and Amy Pascal said “While we are not yet sure of the full scope of information that the attackers have or might release, we unfortunately have to ask you to assume that information about you in the possession of the company might be in their possession,”
Additional Coverage – CNET – 47,000 Social Security Numbers leaked, Celebrity Data included
Additional Coverage – Sony Employees receive email threats: “your family will be in danger”
Additional Coverage – BuzzFeed – Inside the Sony Data
Additional Coverage – Gizmodo – Sony hack worse than thought
Additional Coverage – Washington Post
Additional Coverage – Edgadget
Additional Coverage – The Verge
George Clooney predicted the Sony Hack in December (in a now leaked email)
Additional Coverage – BitDefender – Take Aways from the Sony Hack
Additional Coverage – ArsTechnica – Attackers also stole certificates to sign malware

Feedback:

Jupiter Dev Summit on Monday the 15th
Remotely activate/disable firewall rules?
AuthPF (works, especially remotely)
FreeNAS/ZFS Filesystem Relationships
Screenshot
Naming software bugs like storms
[ways to use as much bandwidth a possible? ](https://www.reddit.com/r/techsnap/comments/2oftzo/ways_to_use_as_much_bandwidth_a_p
ossible/)
Malware Authorship Language
31C3 – The 31st Chaos Communication Congress Who will be there?

Round Up:

The post Signed by Sony | TechSNAP 192 first appeared on Jupiter Broadcasting.

OpenSUSE Followup | LINUX Unplugged 65

chris — Tue, 04 Nov 2014 19:00:41 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

We follow up on our review of openSUSE 13.2 & discuss how life on the rolling side has been going for some of our LUG members.

Plus the hardware box that promises to replace your password manager & we say goodbye to the Linux Outlaws.

Thanks to:

Get Paid to Write for DigitalOcean

Direct Download:

RSS Feeds:

Become a supporter on Patreon:

Show Notes:

Pre-Show:

Unity 7 Won’t Go Away until Most Agree U8 is Better than U7

In a long list of life’s lessons learned, ‘be gentle pushing people onto your new code’ is high up. So we won’t require U8 for everyone even when it’s first class. It will be opt in till most people agree it’s better than U7

Docker on Google Compute Now

FU:

openSUSE 13.2 Follow Up

openSUSE 13.2 is Released

Dear contributors, friends and fans: openSUSE 13.2 is out! After one year on continuous improvement in the tools and procedures and many hours of developing, packaging, testing and fixing issues a new stable release is here providing the best that Free and Open Source has to offer with our special green touch: stable, innovative and fun!

Facts about Tumbleweed and Factory merging

Installation

openSUSE will always try to install alongside another distro or OS.
Any btrfs partition assigned to root will automatically have subvolumes created.
As stated, the disc prompt will go away if unselected in Software Repositories module of YaST.

Software

gnome-software is good for software discovery and installation.
- openSUSE didn’t have anything like this until now.
Software Management is the YaST module for more advanced software management.
Package Updater runs in the background and prompts via notification if there are updates.
Software Repositories is the YaST module for configuring software repositories.
YMP One-Click Installer extension for Chrome (https://chrome.google.com/webstore/detail/ymp-one-click-installer/chldcpnlaiffaelmcjkeodakmnkomldg?utm_source=chrome-ntp-icon)

Font Rendering

Tumbleweed/Factory

Initial article
Facts about Tumbleweed and Factory Merging
Tumbleweed and Factory are now synonymous under the name Tumbleweed (as of November 4th)
Factory continues to be the name of the development project.
A how-to will be published soon, until then: https://lists.opensuse.org/opensuse-factory/2014-11/msg00073.html
Factory is aliased to Tumbleweed for 6 months, after which Factory repos will no longer exist.
Is truly rolling.
- Tumbleweed was a stable base with rolling packages and kernel.
Snapshot ISOs are available.

Goodbye to Linux Outlaws

The Last Stand

After more than seven years of Linux Outlaws, my co-host Dan and myself have decided to end the show. This decision has been a while in the making and it is with a heavy heart that I am committing to finally announce it.

Mooltipass: Open Source Offline Password Keeper

Our team believes that great security can only be achieved through complete transparency. That’s why we have been publishing everything that goes into making the Mooltipass on our GitHub repository from the project’s start.

Just like Linux-based operating systems, open source allows our product to benefit from many engineers’ expertise. This results in better code quality, more trust from our final users and verified security implementation.

Runs Linux from the people:

Send in a pic/video of your runs Linux.
Please upload videos to YouTube and submit a link via email or the subreddit.

New Shows : Tech Talk Today (Mon – Thur)

Tech Talk Today Today | Jupiter Broadcasting

Support Jupiter Broadcasting on Patreon

Post-Show

tearing with ubuntu mate 14.10 with nvidia titan running 340 drivers.

The post OpenSUSE Followup | LINUX Unplugged 65 first appeared on Jupiter Broadcasting.

The New Payphone | Tech Talk Today 57

chris — Thu, 11 Sep 2014 09:36:21 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

Gmail passwords may have been leaked, but there is some debate as to how bad the damage is. Google Voice gets rolled into Hangouts & we take a look at the results from “Internet Slowdown Day”.

Plus our thoughts on mobile payments, a great deal for Linux users & more!

Direct Download:

RSS Feeds:

MP3 Feed | OGG Feed | iTunes Feed | Video Feed | Torrent Feed

Become a supporter on Patreon:

Show Notes:

5 Million Gmail Usernames and Passwords Leaked

In what appears to be an unknown attack, hackers have dumped over 5,000,000 valid gmail username and passwords on the Internet early Wednesday morning.

Unknown hackers have leaked over five million valid credentials pertaining to Google Mail logins early this morning. The random dump of passwords first appeared on reddit’s netsec section linking to the another website hosting the leaked gmail accounts.

The .txt file of all leaked gmail usernames was found on BitCoin security (forum in Russian), where the leak is believed to be first offloaded. The file of leaked emails does not contain any passwords or other sensitive information, only full gmail email addresses.

As the leak was posted only hours ago, Reddit users are warning each other not to enter any email username or password combinations into any websites “to check if your password is secure.” It appears scams are already appearing or Reddit users are getting ready for the scams to come.

Google Says No Compromise

“The security of our users’ information is a top priority for us,” a Google spokesperson told TNW. “We have no evidence that our systems have been compromised, but whenever we become aware that accounts may have been, we take steps to help those users secure their accounts.”

Next, since the posting, the forum administrators have purged the passwords from the text file in question, leaving only the logins. Furthermore, tvskit, the forum user who published the file, claimed that some 60 percent of the passwords were valid.

Google Voice Integration Is Currently Rolling Out In Hangouts

Google Voice is finally being integrated into Hangouts, because God knows Hangouts needed to be even more confusing. You can enable Voice SMS and voicemail via a popup in the conversation list, so check the app. If you still don’t see it, hang on. It’s still rolling out.

“Internet Slowdown Day” sends over 111,000* new comments on net neutrality to FCC

The effort appears to have made a difference: According to the FCC*, by 6 PM ET the agency saw 111,449 new public comments added to the already record-setting total, with some 41,173 filed into the 14-28 docket of the FCC’s website since and another 70,286 sent to the openinternet@fcc.gov inbox, setting a new high water mark of some 1,515,144 to date, with more yet to come. As reported by Mike Masnick, citing ThinkProgress, the Internet slowdown generated 1000 calls per minute to Congress. *Update: Fight for the Future claims that more than 500,000 comments have been submitted through Battleforthenet.com and that the FCC hasn’t caught up. According to the nonprofit, “this happened during our last big push too when their site crashed. We are storing comments and will deliver all.”

IDG shutters Macworld Magazine, much of the editorial staff let go | 9to5Mac

International Data Group (IDG) is shutting down Macworld Magazine, the long time Apple periodical according to tweets by staff and conversations I’ve had with personnel.

The Macworld.com website will remain open [although as a shell of its former self -ed] with a reduced staff according to Dan Miller (editor), who himself is leaving in a month.

Why pay with your phone? : techtalktoday

Floppy-Bacon Writes

Is payment the stores in the US really as bad as Apple’s presentation made it look? When I pay with my debit card (or credit card), I don’t hand it to the cashier. I insert it into a small device and enter my 4-digit PIN code; fast and secure. I do not need to identify my self, I do not any detail about my card and I do not have 15 cards in my wallet or however many cards she had in the video. I know that I hate technology, but do you really want to pay with your phone rather than just fix the payment system to how it works elsewhere? For the time being you still need to have your wallet with your for all the other stuff. (And taking my phone with me with just be extra cumbersome.)

Crossover Linux 50% off : linux_gaming

I received an e-mail this morning from CodeWeavers that CrossOver Linux + 12 months of support is 50% off for the next 48 hours.

Promotional Code: FLASHME

For more information: https://www.codeweavers.com/products/crossover-linux

The post The New Payphone | Tech Talk Today 57 first appeared on Jupiter Broadcasting.

The Cloud Exposed | Tech Talk Today 51

chris — Tue, 02 Sep 2014 09:22:01 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

We start with the leaked celebrity photos, cloud storage’s critical flaw, Anand Shimpi leaving AnandTech for Apple, China giving MS 20 days & much more!

Plus the big test of Microsoft’s commitment to user privacy.

Direct Download:

RSS Feeds:

MP3 Feed | OGG Feed | iTunes Feed | Video Feed | Torrent Feed

Become a supporter on Patreon:

Show Notes:

Naked celebrity hack: security experts focus on iCloud backup theory | The Guardian

Over the weekend, hundreds of nude photos of celebrities were leaked on 4chan before spreading to multiple Internet sites, with one of the involved hackers pointing towards iCloud as the source of the material.

One theory gaining ground is that many of the pictures had been accumulated by one hacker over a period of time – and were then “popped” by another hacker who somehow broke into a machine belonging to the first. Lending weight to that was that one of the earliest photos found in a cache released online dated to December 2011, while the most recent was from 14 August.

Some have also pointed to the presence of a Dropbox tutorial file in one hacked account as suggesting that the third-party cloud storage service was a source of some pictures.

Apple said Monday it was “actively investigating” the violation of several of its iCloud accounts, in which revealing photos and videos of prominent Hollywood actresses were taken and posted all over the Web.

FBI investigating alleged iCloud celebrity hack as Reddit ‘suspect’ declares innocence

[The FBI is] aware of the allegations concerning computer intrusions and the unlawful release of material involving high profile individuals, and is addressing the matter. Any further comment would be inappropriate at this time.

Reddit sleuths, meantime, accused Southern Digital Media sysadmin Brian F Hamade of being the man who leaked the photos. This was based on the same drive names appearing on a screenshot posted by the leaker and ones on an old Reddit post by Hamade.

Hamade has this morning denied the claims in an interview with Buzzfeed, claiming that he did post the screenshot but that it was Photoshopped.

4ARww0T.jpg (490×490)

AnandTech Publisher Anand Shimpi Headed to Apple | Re/code

Anand Lal Shimpi, the editor and publisher of the well-regarded AnandTech site, is going to work at Apple.

An Apple rep confirmed that the company was hiring Shimpi, but wouldn’t provide any other details.

Last night, via a post on the site he founded in 1997, Shimpi said he was “officially retiring from the tech publishing world,” but didn’t say what he was doing next. “I won’t stay idle forever. There are a bunch of challenges out there :)”, he wrote.

AnandTech will continue publishing, and would be run by new editor in chief Ryan Smith.

China gives Microsoft 20 days to provide explanation in anti-trust probe | Reuters

A Chinese anti-trust regulator said on Monday it has given Microsoft Corp (MSFT.O) 20 days to reply to queries on the compatibility of its Windows operating system and Office software suite amid a probe into the world’s largest software company.

The State Administration for Industry and Commerce (SAIC) questioned Microsoft Vice President David Chen and gave the company a deadline to make an explanation, the agency said in a short statement on its website.

According to a state media report on Monday, Microsoft’s use of verification codes also spurred complaints from Chinese companies. Their use “may have violated China’s anti-monopoly law”, the official Xinhua news agency said on Monday.

Microsoft refuses to comply after judge revives overseas data search warrant | ZDNet

A US judge has lifted a stay on a ruling, forcing Microsoft to hand over data it stores overseas. But the software giant said it will not comply, pending an appeal.

The government says that the order is not appealable at this stage, and Preska agrees. The Friday order says that the contempt order would be subject to appellate review. This disagreement over the path to appeal is, says the order, “the subject of hot dispute.”

Support Aaron Seigo creating videos about free software

The post The Cloud Exposed | Tech Talk Today 51 first appeared on Jupiter Broadcasting.

Client Side Drama | LINUX Unplugged 37

chris — Tue, 22 Apr 2014 17:02:19 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

The GTK camp is pushing hard for Client Side Decorations, but there are some major drawbacks on non-Gnome desktops. We discuss the pros and cons, and if this is going to lead to a new kind of desktop Linux fragmentation.

Plus our thoughts on the best password managers, your follow up, and more!

Thanks to:

Direct Download:

RSS Feeds:

Show Notes:

F.U.

Client Side Diva

Open Letter: The issues with client-side-window-decorations

That’s why I decided to CC the Ayatana mailinglist and publish this letter as an open letter on my blog. CSD is a topic that is important for every user and nothing we should discuss in a small group.

Consistent window decorations: This in fact is my greatest doubt. The current situation is that all windows have the same window decoration. For CSD to work applications have to be changed to support them. This will render the changed applications using CSD while all other applications are decorated by the window manager. I think it is impossible to have the same behavior for both CSD and wm decos. I think there are lots of legacy applications which cannot be changed, for example Amarok 1.4 which is still used by many users even in GNOME. I doubt you will be able to change Qt 3 to use CSD. My bigger concern is that we will end up with applications shipping their own style and doing their own kind of decorations. So we end up with situations like one window has buttons on left, one on the right, one in order close, maximize, minimize, the other in close, minimize, maximize, etc.

Just look on the Microsoft Windows desktop to see what proprietary applications tend to do when they get the chance to influence the decorations.

The Wayland Reason, he disagrees with:

Get gtk+ working on Wayland: I don’t see how Wayland can be an argument for CSD. Could we consider Wayland as unimportant till it is looking like something is actually going on? I checked the commits in 2010 in the public git repository and well it looks like KWin has more commits per day. It’s nice that you think of the future, but please don’t use it for argumentation. So also not valid.

On the Gnome Wiki they state this about Wayland and Client Side Decorations:

Initiatives/Wayland/GTK+ – GNOME Wiki!

Under Wayland, it is preferred that clients render their own window decorations. Since gnome-shell will need to keep support for decorating X clients, it would be good if GTK+ and gnome-shell could share the css theming.

The comment thread on this post introducing CSD in Gnome 3.10 is quite interesting

CSDs came to stay in GNOME 3.10! | woGue

The post Client Side Drama | LINUX Unplugged 37 first appeared on Jupiter Broadcasting.

Cryptocrystalline | BSD Now 16

chris — Fri, 20 Dec 2013 10:53:55 +0000

We\’ll be showing you how to do a fully-encrypted installation of FreeBSD and OpenBSD. We also have an interview with Damien Miller – one of the lead developers of OpenSSH – about some recent crypto changes in the project. If you\’re into data security, today\’s the show for you. The latest news and all your burning questions answered, right here on BSD Now – the place to B.. SD.

Thanks to:

iXsystems: This is what 80 cores and 1TB of RAM looks like!

Direct Download:

RSS Feeds:

– Show Notes: –

Headlines

Secure communications with OpenBSD and OpenVPN

Starting off today\’s theme of encryption…
A new blog series about combining OpenBSD and OpenVPN to secure your internet traffic
Part 1 covers installing OpenBSD with full disk encryption (which we\’ll be doing later on in the show)
Part 2 covers the initial setup of OpenVPN certificates and keys
Parts 3 and 4 are the OpenVPN server and client configuration
Part 5 is some updates and closing remarks

FreeBSD Foundation Newsletter

The December 2013 semi-annual newsletter was sent out from the foundation
In the newsletter you will find the president\’s letter, articles on the current development projects they sponsor and reports from all the conferences and summits they sponsored
The president\’s letter alone is worth the read, really amazing
Really long, with lots of details and stories from the conferences and projects

Use of NetBSD with Marvell Kirkwood Processors

Article that gives a brief history of NetBSD and how to use it on an IP-Plug computer
The IP-Plug is a \”multi-functional mini-server was developed by Promwad engineers by the order of AK-Systems. It is designed for solving a wide range of tasks in IP networks and can perform the functions of a computer or a server. The IP-Plug is powered from a 220V network and has low power consumption, as well as a small size (which can be compared to the size of a mobile phone charger).\”
Really cool little NetBSD ARM project with lots of graphs, pictures and details

Experimenting with zero-copy network IO

Long blog post from Adrian Chad about zero-copy network IO on FreeBSD
Discusses the different OS\’ implementations and options
He\’s able to get 35 gbit/sec out of 70,000 active TCP sockets, but isn\’t stopping there
Tons of details, check the full post

Interview – Damien Miller – djm@openbsd.org / @damienmiller

Cryptography in OpenBSD and OpenSSH

Full disk encryption in FreeBSD & OpenBSD

Shows how to install both FreeBSD and OpenBSD with full disk encryption
We\’ll be using geli and bioctl and doing it step by step

News Roundup

OpenZFS office hours

Our buddy George Wilson sat down to take some ZFS questions from the community
You can see more info about it here

License summaries in pkgng

A discussion between Justin Sherill and some NYCBUG guys about license frameworks in pkgng
Similar to pkgsrc\’s \”ACCEPTABLE_LICENSES\” setting, pkgng could let the user decide which software licenses he wants to allow
Maybe we could get a \”pkg licenses\” command to display the license of all installed packages
Ok bapt, do it

The post Cryptocrystalline | BSD Now 16 first appeared on Jupiter Broadcasting.

Battle of the Bots | TechSNAP 97

chris — Thu, 14 Feb 2013 17:29:31 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

A researcher stumbles into the middle of a botnet war, and documents what he finds. Plus a Facebook mistake took down countless sites around the web.

Then it’s huge batch of your questions, our answers, and much much more!

Thanks to:

GoDaddy.com

Use our code tech295 to get a .COM for $2.95.

Something else in mind? Use go28off2 to save 28% on your entire order!

Pick your code and save:
techsnap7: $7.49 .com
techsnap10: 10% off
techsnap11: $1.99 hosting for the first 3 months
techsnap20: 20% off 1, 2, 3 year hosting plans
techsnap40: $10 off $40
techsnap25: 25% off new Virtual DataCenter plans
techsnapx: 20% off .xxx domains

Direct Download:

RSS Feeds:

Support the Show:

Purchase anything at Amazon.com
Purchase anything at Think Geek using this link
Purchase anything at Newegg using this link
Contribute directly on our donation page or check out our advertising options and reach millions of amazing people!
Grab our Chrome Extension and auto-tag your shopping session for us!

Fill out my Wufoo form!

Show Notes:

Get TechSNAP on your Android:

Browser Affiliate Extension:

Jupiter Broadcasting Affiliate Extensions for Chrome and Firefox

TechSNAP 100 Limited Edition Shirt:

Limited time left on our limited run TechSNAP 100 T-shirt!

Adobe releases critical flash update APSB13–04

CVE–2013–0633 – A buffer overflow allowing remote code execution – reported by Kaspersky Labs – CVSS 9.3
CVE–2013–0634 – Remote code execution and memory corruption – Reported by Shadowserver Foundation and Lockheed Martin Computer Incident Response Team – CVSS 9.3
Both vulnerabilities were being exploited in the wild during February 2013
Both CVE numbers were allocated December 18th, 2012. “The entry creation date may reflect when the CVE-ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE”
Both vulnerabilities were used in malicious SWF code embedded in Microsoft Word documents that users were tricked into opening
CVE–2013–0634 was also used as a direct attach via SWFs hosted on websites
Reaction to seeing Lockheed Martin in a vulnerability announcement

ShadowServer Foundation Blog reports on script injection in botnet C&C server

While analyzing the commands received by bots that were part of a botnet (ShadowServer runs a large honeypot where it monitors the activities of the bots), they noticed a disturbing pattern
The bot commands included javascript code to inject an iframe causing your browser to load a malicious site that would attempt Java and ActiveX exploits against you
Once the exploit is successful, it drops a password stealer, which attempts to steal saved credentials from apps such as CuteFTP, FlashFXP, FileZilla, SmartFTP, TurboFTP, Firefox and more
It then encrypts that information and sends it to a different C&C server
Researchers at the ShadowServer Foundation originally thought it was a clever attack against researchers, attempting to exploit their scanning and reporting interfaces, which are usually custom built and lack some input sanitization
It also appeared that the malware that was dropped by the exploit had already been submitted to malware analysis sites such as VirusTotal and Malwr.com
Searching further, he found that an earlier version of the malware, with a much better detection ratio (number of virus scanners that detect the malware) had been uploaded by the same person a few days previous
This led to speculation that the author may have been uploading various revisions of his malware and working to make it less detectable
An update posted later suggestions that it appears to be one Botmaster attempting to exploit another Botmaster and take over his botnet
It still suggests an interesting concept, where the Botmaster who is being observed, reverses the roles and begins observing the activities of the watcher

Error at Facebook takes out large number of major sites

Some type of error or mistake in the code for Facebook Connect caused users trying to visit any site with Facebook Connect to be redirected to a Facebook error page that contained nothing but a very generic message “An error occurred. Please try again later.”
The issue only seemed to affect those who were logged in to Facebook
Logging out of Facebook seems to have prevented you from being redirected
The outage caused huge dips in traffic to major sites including:
ABC, BuzzFeed, Capital.fm, CNN, DailyMail, ESPN, Etsy, Fox News, Gawker, Geico, HBO, Hollywood.com, The Huffington Post, Hulu, InfoWorld, MSNBC.com, NBC News, News.com.au, NFL, OKCupid, People, Pinterest, Reddit, Slate, Smallworlds, SwagBucks, The Sydney-Melbourne Herald, TED, The Los Angeles Times, The New Zealand Herald, The Washington Post, Vulture, Weather.com, WikiAnswers, WordPress, XOJane, Yahoo, and YugaTech
Additional Coverage
It just goes to show the risk involved in relying on 3rd party services for basic mechanisms like authentication, and the risk of embedding 3rd party code that can change without notice

Vulnerability in libcurl POP3 and SMTP protocll handlers

libcURL is a library for handling HTTP URLs and many other web protocols
It is very commonly found on web servers and in php scripts where it is used to access remote sites via protocols such as HTTP(S), FTP(S), SSH, SCP/SFTP, POP3/SMTP, IMAP, RTSP, RTMP
The problem stems from the way cURL handles certain headers in the POP3 protocol while negotiating SASL DIGEST-MD5 authentication
cURL reads the response into a fixed length buffer, assuming that the response will be no longer than 128 bytes, however a malicious server could return a longer response, allowing it to overwrite memory outside of the buffer, possibly leading to remote code execution
The most common vector for the attack is that by default cURL follows HTTP redirects, so when cURL attempts to load a URL (possibly provided by the user/attacker), it receives an HTTP redirect to pop3://username:password@evil.pop3-server.com/. and then gets exploited
If you don’t expect to ever receive a redirect, you can tell cURL or libcURL not to follow redirects, or you can tell it to follow follow redirects for a list of protocols via CURLOPT_REDIR_PROTOCOLS
An updated version of cURL/libcURL has been released to resolve this vulnerability
Vulnerability Announcement
Affected versions: < 7.26.0 and >= 7.29.0

Feedback:

How Redhat hires people
- Redhat is looking to hire almost 1000 more software engineers, technical support engineers, and salespeople this year
SSL @ home
- OpenSSL comes with a perl script for managing your own CA
“Correct horse battery staple” really a strong password?
Whiteboard Wednesday – Password Security
Bought a domain for us!
Backing up Gmail?
NoPriv.py – Easy IMAP email backup to HTML archive. – Raymii.org
A few questions…
FreeBSD 9.1 bsdinstall hardware issues
Getting started with OwnCloud
Zero to ownCloud in Minutes!
Download | ownCloud
OwnCloud Webdav on GoDaddy shared Linux hosting

Round-Up:

The post Battle of the Bots | TechSNAP 97 first appeared on Jupiter Broadcasting.

GitHub Calls You Stupid | CR 34

chris — Mon, 28 Jan 2013 12:10:35 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

The guys attempt to answer when to sunset a project, Github calls you stupid, and is depending on other software that can’t last forever simply kicking the can down the road?

Plus taking on too many projects at once, your feedback, Mike’s pick of the week, and more!

Direct Download:

MP3 Audio | OGG Audio | Video | Torrent | YouTube

RSS Feeds:

Show Notes:

Feedback

Notbryant is taking “Intro to Software Engineering” and is learning about project management and asks for “any advice on not being an evil PM”
Jimmy has a problem:

“I tend to get too serious about too many projects at the same time.
Any advice would be greatly appreciated. I was already working on porting an application, almost at completion, but now my Raspberry Pi has arrived. Sigh.”

Also wants to share his blog

The End

Software doesn’t last forever.
1 Year, 2 Years, 3 Years
“Sun-setting” a project

Book of the Week

[asa]078214327X[/asa]

Tool of The Week

SmartGitHg

Follow the show

The post GitHub Calls You Stupid | CR 34 first appeared on Jupiter Broadcasting.

Barricade Your Barracuda | TechSNAP 94

chris — Thu, 24 Jan 2013 17:22:45 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

If you have a Barracuda device, it’s time to put it behind a real firewall. We’ll blow your minds with the horrible state of security on many popular Barracuda products.

Plus why a long password is not necessarily mean a more secure password, a big batch of your questions, and a great roundup!

All that and a lot more, on this week’s TechSNAP!

Thanks to:

GoDaddy.com

Use our code tech295 to get a .COM for $2.95.

Something else in mind? Use go20off5 to save 20% on your entire order!

Pick your code and save:
techsnap7: $7.49 .com
techsnap10: 10% off
techsnap11: $1.99 hosting for the first 3 months
techsnap20: 20% off 1, 2, 3 year hosting plans
techsnap40: $10 off $40
techsnap25: 25% off new Virtual DataCenter plans
techsnapx: 20% off .xxx domains

Direct Download:

RSS Feeds:

Support the Show:

Purchase anything at Amazon.com
Purchase anything at Think Geek using this link
Purchase anything at Newegg using this link
Contribute directly on our donation page or check out our advertising options and reach millions of amazing people!
Grab our Chrome Extension and auto-tag your shopping session for us!

Fill out my Wufoo form!

Show Notes:

Get TechSNAP on your Android:

Browser Affiliate Extension:

Jupiter Broadcasting Affiliate Extensions for Chrome and Firefox

Barracuda Networks devices contain multiple undocumented SSH users

Vulnerable products include:
Barracuda Spam and Virus Firewall
- Barracuda Web Filter
- Barracuda Message Archiver
- Barracuda Web Application Firewall
- Barracuda Link Balancer
- Barracuda Load Balancer
- Barracuda SSL VPN
The issue was fixed in Security Definitions 2.0.5, it is highly recommended that all devices be upgraded
These devices contain undocumented backdoor accounts with static passwords including:
- root*
- build* (uid 0)
- shutdown
- product
- ca
- support
- websupport
- qa_test*
Only Items marked with a * were not able to be cracked with a short wordlist
These users and their easily cracked passwords can be used to login at the terminal, the user ‘product’ is given a full bash shell
Some additional users were also set up no password but with authorized ssh keys to allow remote access:
- remote (uid 0)
- cluster
Both of these users also have full bash shells
Once a user has a shell, they are able to access the local MySQL database (root@localhost with no password) and can add new users with administrative privileges
A shell also could allow the user to enable debugging that could allow them to compromise the device
The Barracuda devices use iptables to restrict access via SSH, however in addition to allowing SSH via the internal network, they also allow incoming SSH connections from two remote /24s on the internet
Timestamps on the iptables rules file suggests they ips have been allowed in to every device since 2003
These ranges belong to two different ISPs, Layer42.net which appears to host the colocation for Barracuda networks, and XO.net, which does not appear to be used by Barracuda Networks (it may have been in the past) and the IPs appear to belong to a number of unrelated parties, including a small IT firm that offers remote management, some voip servers, and a number of poorly maintainted websites (some not updated since 2007)
If any of these sites or servers were compromised, they could be used to gain access to all public facing Barracuda Networks devices
Most of these devices are public facing, because they are firewalls, web filter and spam filters
A user may be able to spoof their ip via the local network to appear to be coming from one of the two internet ranges that have been whitelisted
As part of the 2.0.5 update, Barracuda has disabled the product user, and all other users except for ‘cluster’ (ssh key only), ‘remote’ (uid 0, ssh key only, key is possessed by Barracuda Networks) and ‘root’ (password, likely crackable)
According to Barracuda Networks, these accounts are critical for customer support and will not be removed
Barracuda has done nothing to address the statically defined whitelisted ranges of IPs
Because of the risk, it is recommended to place the Barracuda Networks devices behind a proper firewall
Customers can contact Barracuda Networks Support for instructions on enabling ‘expert mode’ in order to disable the SSH daemon
Barracuda Networks – Tech Alerts

Barracuda Networks SSL-VPN devices vulnerable to authentication bypass

Unauthenticated users are able to set arbitrary Java system properties to arbitrary values, allowing an attacker to perform a Denial of Service attack against the device, or allowing them to break the applications security mechanisms
By using the above vulnerability, an attacker is able to access the API functionality of the appliance, and is then able to download the device configuration, dump the SQL database (including passwords), reset the passwords of all superusers, disclose local files on the appliance (possibly secret keys), and restart or shutdown the device entirely.
Barracuda Networks has issued ‘Security Definition 2.0.5’ that resolves these issues

Just because your password is long, does not mean it cannot be cracked

A researcher from Carnagie Mellon University has developed a new password cracking tool that considers grammatical correctness to reduce the search space
Based on a survey of 1434 user selected passwords of 16 characters or more, 18% of users voluntarily chose passwords that were grammatically correct (such as “abiggerbetterpassword” or “longestpasswordever”)
The survey also found other structions, including postal addresses, URLs, and email addresses
The password search space is significantly reduced when you move away from considering random combinations of characters, and instead consider dictionary words, and reduced further when you consider words only in combinations that are grammatically correct
If a password consists of 3 words, applying the rules of grammar reduces the search space to 96.90%. However, if the password consists of 5 words, the search space is reduced to 46.95%, and 8 words lowers the search space to 0.99% of its original size
Consider this when you are selecting passwords XKCD style
Full Paper

Feedback:

New viewer with some troubles!
Pen Testing
Some First Time ZFS Questions
Removable ZIL
- Removing a ZIL has only been available in ZFS Zpool v19+, which is only FreeBSD 8.3 and 9.0, FreeNAS before November 2012 does not support ZIL removal
Setting up an Internet Radio
Google Caching akismet password change page
ZFS Problems Solved!
Hall of Shame – Match.com
How to Secure SSH with Google Authenticator’s Two-Factor Authentication – Submited by techsnapp

Round-Up:

The post Barricade Your Barracuda | TechSNAP 94 first appeared on Jupiter Broadcasting.

Tales from the BCrypt | TechSNAP 85

chris — Thu, 22 Nov 2012 00:08:38 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

How Allan saved PayPal from an embarrassing leak and a bunch of cash, details on the FreeBSD project’s compromise, and the latest advances in password hashing.

Plus the bug in iOS 6 that could cost you money, and a batch of your questions and our answers!

All that and a lot more in this week’s TechSNAP!

Thanks to:

GoDaddy.com

Use our code tech495 to get a .COM for $4.95, or go20off5 to save 20% on your entire order!

$4.99 SSL certificates, just use our code 499ssl2. Expires 12-31-12!

Pick your code and save:
techsnap7: $7.49 .com
techsnap10: 10% off
techsnap11: $1.99 hosting for the first 3 months
techsnap20: 20% off 1, 2, 3 year hosting plans
techsnap40: $10 off $40
techsnap25: 25% off new Virtual DataCenter plans
techsnapx: 20% off .xxx domains

Direct Download:

RSS Feeds:

Support the Show:

Purchase anything at Amazon.com
Purchase anything at Think Geek using this link
Purchase anything at Newegg using this link
Contribute directly on our donation page or check out our advertising options and reach millions of amazing people!
Grab our Chrome Extension and auto-tag your shopping session for us!

Fill out my Wufoo form!

Show Notes:

Get TechSNAP on your Android:

Browser Affiliate Extension:

Jupiter Broadcasting Affiliate Extensions for Chrome and Firefox

Researcher finds flaw in PayPal that may expose sensitive data

PayPal’s new bug bounty program opened on June 21st 2012
On June 29th, the security researcher in this story decided to take a look at PayPal and see if he could make some money
He started his quest with a search on SHODAN (search engine for service information, like version numbers etc) for ‘admin paypal’
He found a number of publically accessible ‘staging’ servers for PayPal (such as stage2mb106.paypal.com)
He started by trying to do an authentication bypass by using SQL injection using the randomly selected username ‘lsmith’
This returned an error message, but also the string ‘You are logged in as Lori Smith’
After some more testing, he found jsmith was Janine Smith
He wasn’t sure what this staging admin area did yet, but after some googing he found examples of court documents dumping the details of a paypal account that are generated by the tool at admin.paypal.com
This is where the researcher found the first problem with PayPal’s bug bounty program. PayPal asks that all submissions be encrypted with PGP to ensure privacy, however the PGP key posted on the bug bounty program website had expired
On July 5th he finally got a proper PGP key and sent his report
July 19th – automated report that submission was received
August 7th – submission closed as ‘invalid’
August 8th – submission recategorized and reopened
August 21st – A hand written reply to another bug report, says the current report is still open and payment will be sent when it is fixed
August 29th – received payment for a ‘XSS Vulnerability’, which seems like a miscategorization, asks if this is a mistake, never gets a reply
Researcher’s Writeup

Allan has also participated in the PayPal Bug Bounty program, after finding a cache of stolen paypal accounts totaling millions of dollars (a story to be covered in depth when I get time)
My own disclosure to the program started on September 15th and was finally concluded today, November 21st
The first automated reply saying they had received the report was September 17th
September 20th they replied asking for some additional information
October 26th, Paypal apologized for the delay and notified me that while my submission did not qualify under the Bug Bounty program, due to the nature of the information they were still going to award me $1000, I should expect payment in 3 weeks
November 21st, I received my payment and clearance to talk about the incident

Two FreeBSD project servers compromised by leaked SSH key

On November 17th the FreeBSD security officer announced that intrusions into two servers operated by the FreeBSD project had been detected on November 11th
The affected machines were taken offline for analysis
A large portion of the remaining infrastructure machines were also taken offline as a precaution
The two machines that were compromised were part of the legacy third-party package building infrastructure
It is believed that the compromise may have occurred as early as the 19th September 2012
The compromise is believed to have occurred due to the leak of an SSH key from a developer who legitimately had access to the machines in question, and was not due to any vulnerability or code exploit within FreeBSD
At no time did this attack place the core FreeBSD operating system (kernel, userland, contributed apps (ssh/sshd, bind, etc)) at risk
However, the attacker had access sufficient to potentially allow the compromise of third-party packages. No evidence of this has been found during in-depth analysis, however the FreeBSD Project is not taking any risks, and has thrown out all of the packages it was building for the release of FreeBSD 9.1 and building them from scratch
If you are running a system that has had no third-party packages installed or updated on it between the 19th September and 11th November 2012, you have no reason to worry
The Source, Ports and Documentation Subversion repositories have been audited, and the project is confident that no changes have been made to them. Any users relying on them for updates have no reason to worry
The project cannot guarantee the integrity of any packages available for installation between 19th September 2012 and 11th November 2012, or of any ports compiled from trees obtained via any means other than through svn.freebsd.org or one of its mirrors. Although there is no evidence to suggest any tampering took place and such interference is unlikely, the FreeBSD Project recommends you consider reinstalling any such machines from scratch, using trusted sources
Additional Source

PHP 5.5 to introduce new password hashing API

Official PHP RFC Wiki
Why do we need password hashing: to store passwords in a way such that we can verify the a user is entering the correct password, but if our database is compromised, the attacker cannot easily determine the users password
Why do we need strong cryptographic password hashing: Using regular hashing functions such as MD5 or even SHA512 is not sufficient. Regular hashing algorithms are designed to be fast and that is undesirable. Additionally, a straight hash is subject to attack by rainbow tables (precalculated hashes). Cryptographic hashes add a salt, to make each hash unique (even if multiple users use the same password, because the salt will be different, the hash will be different). Cryptographic hashes also usually include a stretching or slowing algorithm, that makes the hash take longer to calculate, sha512crypt uses a loop count, doing the hash 10000 times. Some algorithms like bcrypt are resistant to acceleration by a GPU, and other algorithms such as scrypt are designed to be memory intensive to resist acceleration for ASIC or FPGAs.
The new PHP password hashing API makes the process of generating and validating hashes much easier, and includes a system for upgrading hashes
The new API allows you to optionally specify the hash to use, and if not defaults to bcrypt (the old crypt() defaulted to DES). This also means that in the future, if PHP changes the default password hash, all new hashes will be made using the new algorithm
The API introduces a function that checks if a password hash needs to be upgraded. So when a user attempts to login, you check that they have entered the correct password (your database contains a hash from the old algorithm, but the hashes contain a marker at the front that identifies the hashing algorithm), if it is correct, you then use the attempted password (which you have in plain text, since you require that to generate a hash to check against the hash in your database) and hash it with the new algorithm, and overwrite the copy in your database. With this system, the first time a user with an old hash logs in, their hash is upgraded to the new algorithm
PHP 5.5 is just coming out in beta, and will likely not see production use for a while, but you do not have to wait, there is a pure-PHP implementation for PHP 5.3

iOS 6 streaming bug causes excessive data user

The issue has been detailed in a blog post at PRX.org
They looked into it after being approached by folks at This American Life about extremely high bills from their CDN for the month of October.
Chris has heard from other podcasters about this issue, and for some less prepared networks/shows it’s caused a semi-DDoS effect for many hours after an episode release.
PRX.org was able to reproduce the issue with several podcasts in the Podcast app, including podcasts using Limelight and Akamai CDNs.
PRX.org was unable to reproduce the issue using iOS 5 or using iOS 6.0.1, but there are still many people using iOS 6.0.0. We believe that this issue, combined with the bug causing the phone to behave as though it is connected to WiFi even when it is not, could account for the significant data overages reported with the release of iOS 6.
Others have reported the issue remains in iOS 6.0.1, but is perhaps alleviated by the resolution of the wifi bug.
When the file has completed downloading, it begins downloading again from the beginning of the file and continues for as long as one is streaming the file.
As long as one is listening to audio being streamed with iOS 6, it is using significant amounts of data.
There appears to be a system-wide problem with the AV Foundation framework in iOS 6.0.0, impacting any App in the app store that uses that backend.
Apple does not appear to have acknowledged the specific issue.
Original PRX Labs post
More Coverage at Ars Technica and The Next Web

Openwall gives talk at YaC2012 about password hashing

Openwall are the developers behind John the Ripper
Talk covers the challenges of securing against online and offline attacks
Covers the Pros and Cons of the YubiHSM, a USB hardware security module for servers from the makers of the YubiKey
Covers the future vulnerabilities of PBKDF2 and bcrypt
Talks about the advantages of scrypt
scrypt was invented by Colin Percival (former FreeBSD Security Officer), for his tarsnap secure online backup product
scrypt is designed to be much more secure against hardware brute-force attacks (using ASICs and FPGAs etc), it uses a time-memory trade off, requiring a large amount of ram to lower the required amount of CPU cycles, making dedicated hardware attacks much more expensive to carry out
“if 5 seconds are spent computing a derived key, the cost of a hardware brute-force attack against scrypt is roughly 4000 times greater than the cost of a similar attack against bcrypt (to find the same password), and 20000 times greater than a similar attack against PBKDF2”
When used for file encryption, the cost of cracking the password is 100 billion times more than the cost of cracking the same password on a file encrypted by openssl enc
scrypt is now an IETF internet draft

Feedback:

Round Up:

The post Tales from the BCrypt | TechSNAP 85 first appeared on Jupiter Broadcasting.

Not So Secret Answers | TechSNAP 70

chris — Thu, 09 Aug 2012 16:02:55 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

A Gawker Reporter’s entire online presence is hacked, and all his devices wiped. We’ll walk you through the details of this attack, and why it suggests we might be facing some fundamental challenges.

Plus: Your questions, our answers, and so much more.

On this week’s TechSNAP!

Thanks to:

GoDaddy.com

Use our codes TechSNAP10 to save 10% at checkout, or TechSNAP20 to save 20% on hosting!

SPECIAL OFFER! Save 20% off your order!
Code: go20off5

Pick your code and save:
techsnap7: $7.49 .com
techsnap10: 10% off
techsnap11: $1.99 hosting for the first 3 months
techsnap20: 20% off 1, 2, 3 year hosting plans
techsnap40: $10 off $40
techsnap25: 25% off new Virtual DataCenter plans
techsnapx: 20% off .xxx domains

Direct Download:

RSS Feeds:

Support the Show:

Purchase anything at Amazon.com
Purchase anything at Think Geek using this link
Purchase anything at Newegg using this link
Contribute directly on our donation page or check out our advertising options and reach millions of amazing people!
Grab our Chrome Extension and auto-tag your shopping session for us!

Fill out my Wufoo form!

Show Notes:

Gawker Reporter gets entire online presense hacked

Gawker Reporter and formed Wired editor Mat Honan had his entire digital life destroyed in a matter of minutes last week
A hacker going by the pseudonym Phobia, originally targeted Mat’s twitter account because of its 3 character username
The @mat twitter account linked to Mat’s personal website, which listed his gmail address
The attacker then started the password recovery process to reset the password of the gmail account
Since the gmail account had not been configured for two-factor authentication, the reset option was to send a new password to the alternate account configured in gmail
The address of this account is obscured and displayed so you know which email to go check, but when the alternate address for mhonan@gmail.com is displayed as m*****n@me.com it is pretty easy to guess the email address
Now, in order to reset the password of the AppleID, the attackers would normally need the answers to the account’s “Secret Questions”, however, there is a fallback method, when these cannot be provided by the customer
Apple only requires that you provide the billing address and last for digits of the credit card on file for the account
The billing address is fairly easy to come by (phone book, domain whois, people search, blog posts, etc), but the last four digits of the credit card number are less so
Since the hacker knew the victims email address, the next target of the attack was Amazon.com
The attacker had an associate call Amazon and claim to be the victim, wanting to add a new credit card to the account. This process only requires knowing the account holders name, billing address, and the new credit card (Adding a new credit card to your account does not seem like a high security operation, and it would seem to make sense for companies to make this process as easy as possible)
The trick is, you then call Amazon back, and now you are able to provide the account holders name, billing address, and current credit card number. With this information to verify your identity, you are able to change the email address on the account, to one that you control
Now that you control the Amazon account, you simply login, and look at the other cards on file, you don’t get to see the entire credit card number, but the first and last 4 digits are displayed, so that customers can identify which card is which
With that information in hand, it now time to call AppleCare, and reset the password on the AppleID, gaining you access to the iCloud account and @me.com email address of your victim
Next you can reset the password of the gmail account, and then once you control that, reset the password of the twitter account
Now, if you want to prevent your victim from interfering with your actions, you need to disable their ability to fight back. This is where iCloud’s ‘Find My’ service comes into play
The attacker used the service to initiate a remote wipe of the victim’s iPhone, iPad and MacBook, as part of this process, the devices are also locked with a PIN code, which only the attacker has
The next step was to delete the gmail account, so it couldn’t be used to regain control of the twitter account. Normally you are able to undelete a gmail account, however it requires external verification, in this case via a text message to the cell phone tied to the gmail account, which the victim had not yet regained control of
All of this points out that the serious weak link in most all security systems, are the people, and the ways around the security systems we put in place, for when people forget their passwords
As we have seen in other cases like this, with some basic personal information that is pretty easy to acquire, and attacker could have transferred the phone service from the victim’s cell phone to another device in order to intercept verification text messages from services such as gmail or the victim’s online banking
Mat Honan admits that a number of the security problems that made this attack possible were his own fault, not having recent backups of his devices, not using two-factor authentication for gmail and other services and having only a 7 character password for his AppleID (although this didn’t factor into this attack as originally believed, it is still a security failure)
Wired did its own tests using the methodology that the attacker claimed to have used, and was able to completely compromise two other Wired employees
Apple and Amazon have both since stopped doing password resets over the phone

Secret Questions Don’t Work

The problem with Secret Questions is that in order for a question to be general enough that it will apply to most people and static enough that the answer won’t change by time you need to use the questions to recover your password, the answers end up being very generic and can usually be found with a bit of research
You also have to consider who may be attacking your secret questions, if the question is “What was the name of your first Teacher”, what if the attacker is someone you went to school with?
Another problem is how strictly the answers are verified, a common security question when calling your credit card company is your mother’s maiden name. In a great deal of cases, if you just mumble something this will be accepted and you will be able to make changes to the account
A good security question must maximize these four criteria:
Definitive: there should only be one correct answer which does not change over time.
Applicable: the question should be possible to answer for as large a portion of users as possible (ideally, universal).
Memorable: the user should have little difficulty remembering it
Safe: it should be difficult to guess or find through research
Feedback: Send in your ideas for good secret questions, and we’ll critique some of the suggestions next week
Bruce Schneier on Secret Questions

Feedback:

Round-Up:

The post Not So Secret Answers | TechSNAP 70 first appeared on Jupiter Broadcasting.

Network Benchmarking | TechSNAP 66

chris — Thu, 12 Jul 2012 16:18:57 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

Our tools to benchmark and monitor your network.

Plus: Formspring leaks your password, Microsoft finally kills off old certificates and how to steal a BMW in a few seconds!

All that and more, in this week’s TechSNAP!

Thanks to:

GoDaddy.com

Use our codes TechSNAP10 to save 10% at checkout, or TechSNAP20 to save 20% on hosting!

Limited time offers:

$1.99/mo economy hosting for 3 months – special offer!
Code: 199tech
Expires: June 30, 2012

$3.99 .US domain!
Code: 399us4

Direct Download:

RSS Feeds:

Support the Show:

Purchase anything at Amazon.com
Purchase anything at Think Geek using this link
Purchase anything at Newegg using this link
Contribute directly on our donation page or check out our advertising options and reach millions of amazing people!
Grab our Chrome Extension and auto-tag your shopping session for us!

Fill out my Wufoo form!

Show Notes:

Formspring detects intrusion – 420,000 hashed passwords leaked

Formspring was alerted when password hashes were posted on a hacking forum
After determining that the hashes were in fact from their site, administrators shut the service down
The attackers managed to compromise a development server at FormSpring, and then was able to access the production database, and gain access to customer information
Formspring used SHA256 hashes with a random salt
While this is better than a plain SHA256 without a salt, it is still not very strong
SHA hashes are designed to be calculated very quickly, because that is what you want in a hashing algorithm
Cryptographic hashing algorithms, like SHA256crypt on the other hand, is ‘adaptive’, it use a variable number of ‘rounds’ of the hashing algorithm to slow the process down, to make cracking the passwords more expensive. SHA256crypt defaults to 5000 rounds (hash of the hash of the hash…), and this value can be adjusted over time, to keep pace with faster CPUs and GPUs
So while the random salts make the Formspring passwords immune to rainbow tables (thus making even the more trivial passwords require brute forcing, unlike the LinkedIn passwords), they can still be cracked with tools such as John the Ripper, and the cracking can be accelerated with GPUs
Formspring came to this same realization and as part of the mandatory password reset for all users, new passwords will be stored using the adaptive cryptographic hashing algorithm bcrypt
There have been no reports of any accounts being compromised, although the news has triggered a wave of trend-jacking phishing attacks, malicious emails to users directing them to the wrong place to reset their formspring password

Microsoft revokes 28 of its own certificates because they are insecure

In the wake of the Flame malware, which used a forged Microsoft certificate for code signing and to impersonate Windows Update, Microsoft has revoked other certificates that may be susceptible
In order to prevent this from happening again, Microsoft is revoking trust in all certificates that do not meet their current security standards
We assume this means revoking certificates with insufficient key strength and certificates generated with MD5 hashes
Microsoft also released its Certificate Updater application, which was released previously as an optional update to help mitigate the Flame malware, but with this update is not marked as ‘Critical’, which will see it be installed on the majority of updated Windows machines

One of Stuxnet’s spreading mechanisms hits kill switch

Three years after Stuxnet was originally seeded, one of the main spreading mechanisms has shut itself off
Spreading of the malware via Windows .lnk files spread via USB sticks has stopped after reaching the cutoff date specified in the Stuxnet source code
The three known variants of Stuxnet were seeded on 2009–06–23, 2009–06–28 and 2009–07–07
This is not the first time Stuxnet has expired some of its capabilities, spread via the MS10–061 exploit stopped on 2011–06–01, and the MS08–067 exploit checks for dates before January 2030

Court case reveals inner workings of IPP International IP Tracker, a BitTorrent tracking software

Web exploit figures out what OS victim is using, customizes payload

The exploit uses ‘TrustedSec’s Social Engineering Toolkit’ to generate a signed .jar file that is embedded in compromised websites via the applet tag
If the user allows the .jar file to run, it detects the OS of the machine, and performs a different action
The Social Engineering Toolkit is open source software
In this case, the attackers used the toolkit as a basis for their malware downloader, it downloads and runs a different exploit depending on the OS of the victim
This exploit targets Windows, Mac and Linux users, with a custom malware payload for each
All three exploits appear to be targeted at giving the attacker a shell on the machine, so they can perform whatever actions they wish
Additional Link

Feedback:

Félim loves his new pfSense rig
What is the best way to measure a firewall’s throughput?
Depends what you want to measure (bytes/sec, packets/sec, dropped packets, etc)
It is important to be able to tell what is ‘normal’, so some type of historical information is very useful
Live throughput: nload
Live Source/Destination: iftop
Traffic patterns / by interface: routers2 / mrtg / rrdtool
Bandwidth Benchmarking: iperf
Other tools: ntop rtg darkstat

Round Up:

The post Network Benchmarking | TechSNAP 66 first appeared on Jupiter Broadcasting.

Bypassing Authentication | TechSNAP 62

chris — Thu, 14 Jun 2012 17:04:57 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

A MySQL flaw so awful, I simply had to laugh. And how a simple SSH config mistake, lead to a really bad day.

Plus we answer some great audience questions, all that and much more on this week’s TechSNAP.

Thanks to:

GoDaddy.com

Use our codes TechSNAP10 to save 10% at checkout, or TechSNAP20 to save 20% on hosting!

Limited time offers:

$1.99/mo economy hosting for 3 months – special offer!
Code: 199tech
Expires: June 30, 2012

$3.99 .US domain!
Code: 399us4

Direct Download:

RSS Feeds:

Support the Show:

Purchase anything at Amazon.com
Purchase anything at Think Geek using this link
Purchase anything at Newegg using this link
Contribute directly on our donation page or check out our advertising options and reach millions of amazing people!
Grab our Chrome Extension and auto-tag your shopping session for us!

Show Notes:

MySQL authentication Bypass

The Developers of MariaDB (a fork of MySQL) recently found a major flaw in MySQL (and MariaDB) that gives an attacker a 1 in 256 chance to login to your MySQL server with an incorrect password
All MariaDB and MySQL versions up to 5.1.61, 5.2.11, 5.3.5, 5.5.22 are vulnerable.
This exploit is even worse than it sounds, because once an attacker gains access to the MySQL server, they can dump the MySQL users table, which contains the hashed passwords of all other users
This would allow the attacker to then do an offline attack against those hashes (with a brute force password cracking program such as John the Ripper)
In this way, even if the administrator patches their MySQL server, preventing further access by the attacker via the exploit, the attacker can then use the actual passwords for real user accounts once they are cracked
The error is an incorrect assumption about the return value of memcmp(), a C function that compares to memory addresses
Due to the fact that memcmp() is implemented differently by different OSs and compilers, only some systems are known to be vulnerable
Vulnerable:
- Ubuntu Linux 64-bit ( 10.04, 10.10, 11.04, 11.10, 12.04 )
OpenSuSE 12.1 64-bit
Debian Unstable 64-bit (maybe others)
Fedora (unspecified versions)
Arch Linux (unspecified versions)
Not Vulnerable:
- Official builds from MySQL.com (including Windows)
Red Hat Enterprise Linux 4, 5, and 6 (confirmed by Red Hat)
CentOS using official RHEL rpms
Ubuntu Linux 32-bit (10.04, 11.10, 12.04, likely all)
- FreeBSD (all versions)
Vulnerable/Not Vulnerable list source, more details, mitigation steps
Part of the reason for the vulnerability of 64bit based OSs seems to be the different behavior of memcmp() with SSE4 optimizations (which results in a 3–5x performance increase)
The following shell one-liner will grant you root access to a vulnerable MySQL server: for i in seq 1 1000; do mysql -u root –password=techsnap -h 127.0.0.1 2>/dev/null; done
memcmp() man pages
- Ubuntu 11.10 memcmp()
- Ubuntu 12.04 memcmp()
- FreeBSD memcmp()

F5 SSH Root login keys leaked

F5 makes high end IP load balancers, designed to distribute traffic among web servers, handle SSL offloading, and more
Fixed in a recently released patch, it seems that all F5s came out of the box authorized for root login over SSH with an RSA public key
The issue being that the corresponding RSA private key, was also included on every F5 device
This means that anyone that owns an F5, or has access to that key file (everyone now, we have to assume it was posted online) can now login as root on your F5
Why is login as root over SSH even permitted?
Vulnerability Announcement
Official Advisory

AMD/ATI Windows Video drivers insecure, cause BSOD when security features in windows enabled

Microsoft has a toolkit, called EMET (Enhanced Mitigation Experience Toolkit) that works to reduce the chance that unknown vulnerabilities in windows can be successfully exploited
EMET relies on DEP (Data Execution Prevention) and ASLR (Address Space Layout Randomization), which are designed to prevent buffer overflow and remote code execution attacks
EMET includes an option to force DEP and ASLR system wide, rather than on a per-application basis, where only applications that opt-in to DEP/ASLR are protected
Enabling ASLR causes AMD/ATI video drivers to blue screen the system
This means that any system with an AMD/ATI graphics adapter cannot be secured as strongly as a system with an Intel or nVidia graphics adapter
CERT Vulnerability Notice VU#458153
Download Microsoft Enhanced Mitigation Experience Toolkit

Feedback:

Q: Jason asks about using CNAMEs for customer domains

A:
The problem with what you are proposing is that any resource record that is a CNAME cannot have any other record types defined. This means that if you set the root of the domain example.com to CNAME to server1.scaleengine.com, you then cannot define an MX record, and therefore you cannot host email addresses @example.com

Q: Mario asks about blocking possibly malicious ad networks on his network

Eivind writes in about a game company handling a security breech correctly

Note: from their findings that 10,000 users shared the same password, it is obvious that they are doing regular hashing (ala LinkedIn), rather than salted cryptographic hashes. When will people learn.

Round-Up:

The post Bypassing Authentication | TechSNAP 62 first appeared on Jupiter Broadcasting.

I Know Your Password | TechSNAP 61

chris — Thu, 07 Jun 2012 17:50:30 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

It’s a simple thing but everyone keeps messing it up, bad password storage practices many popular sites had their password databases leaked online this week, we’ve got the details!

Plus how the Flame malware impersonated Windows Update, and another batch of audience questions!

All that and more, on this week’s TechSNAP.

All that and so much more, in this week’s episode of, TechSNAP.

Thanks to:

GoDaddy.com

Use our codes TechSNAP10 to save 10% at checkout, or TechSNAP20 to save 20% on hosting!

Limited time offer:

$1.99/mo economy hosting for 3 months – special offer!
Code: 199tech
Expires: June 30, 2012

Direct Download:

RSS Feeds:

Support the Show:

Purchase anything at Amazon.com
Purchase anything at Think Geek using this link
Purchase anything at Newegg using this link
Contribute directly on our donation page or check out our advertising options and reach millions of amazing people!
Grab our Chrome Extension and auto-tag your shopping session for us!

Show Notes:

Fill out my Wufoo form!

Flame Took Advantage of Windows Update

Iran has sustained 185 Flame virus infections, followed by 95 in Israel and the Palestinian Territories, 32 in Sudan and 29 in Syria
A Flame module called Gadget possesses man-in-the-middle functionality which enabled it pass crafted update packages to other computers on the same network
One specific package was called WuSetupV.exe and was signed with a certificate issued by the “Microsoft Enforced Licensing Registration Authority CA”, a sub-CA of Microsoft’s root authority
The malware, which is 20 megabytes when all of its modules are installed, contains multiple libraries, SQLite3 databases, various levels of encryption — some strong, some weak — and 20 plug-ins that can be swapped in and out to provide various functionality for the attackers. It even contains some code that is written in the LUA programming language
Most victims were running 32-bit editions of Windows 7, with a sizeable 45 per cent running XP. Flame does not work on the 64-bit edition of Windows 7
The Flame malware used a cryptographic collision attack in combination with the terminal server licensing service certificates to sign code as if it came from Microsoft
Microsoft still uses MD5 fingerprints on its certificates, according to the Baseline Requirements for the Issuance and Management of Publicly-Trusted Certificates | TechSNAP 37 MD5 was Deprecated for Root and Subordinate CAs in Dec 2010, SHA256 or better is required for all certificates issued after Dec 31, 2013. SHA1 is only allowed until more browsers support SHA256 or better
Microsoft has already confirmed that Flame developers were able to issue valid Microsoft certificates
Flame’s operators used a number of fake identities to register their domains. According to Kaspersky, server locations included Germany, the Netherlands, the UK, Switzerland, Hong Kong and Turkey
Although the Flame toolkit does not appear to have been written by the same programmers who wrote Stuxnet and DuQu, it does share a few interesting things with Stuxnet
Stuxnet is believed to have been written through a partnership between Israel and the United States, and was first launched in June 2009
Researchers say the compilation date of modules in Flame appear to have been manipulated by the attackers, perhaps in an attempt to thwart researchers from determining when they were created

“Whoever created it was careful to mess up the compilation dates in every single module,” Gostev said. “The modules appear to have been compiled in 1994 and 1995, but they’re using code that was only released in 2010.”
+ Iran’s Computer Emergency Response Team announced on Monday that it had developed a detector to uncover what it calls the “Flamer” malware on infected machines and delivered it to select organizations at the beginning of May

Links

LinkedIn leaks 6.4 million password hashes

A list of 6.4 million SHA–1 hashes, proported to be passwords from the popular business social networking site Linkedin.com was posted on a Russian password cracking forum
The list is deduplicated, meaning each hash is listed only once, meaning more than 6.4 million passwords were compromised
The list that I managed to download had a lot of the hashes prefixed with 5 or 6 0s, apparently marking them as already having been brute forced
An analysis of a number of permutations of the word linkedin, shows that almost every obfuscation was present on the list
Research has shown that the name of the site is one of the most common passwords, so this suggests that the list is actually from LinkedIn
A number of users at hackernews found their obscure/random passwords on the list of hashes, further suggesting that the list is legitimate
Using plain SHA–1 hashes to store passwords is extremely insecure, a cryptographic hashing algorithm with a salt should be used
I managed to download a 10GB rainbow table of SHA1 hashes, and check every 1–7 character mixed case alpha numeric password using my nVidia GTX 560 Ti, in only 220 seconds
A rainbow table for longer passwords is impractical due to the amount of storage required
Salted hashes cannot be attacked by rainbow tables because the salt basically extends the length of the password, and because crypt() based hashing algorithms run the hash multiple times
MD5-crypt uses an 8 character salt and loops 100 times, SHA256/SHA512-crypt uses a 16 character salt and by default loops 5000 times (adjustable between 1000 and 100 million), and Bcrypt uses a 22 character salt and 16 loops (adjustable as powers of two between 4 and 31)
Consider the following key spaces, and assume you had access to the cracking power of the ENTIRE bitcoin mining network (10 Terahashes per second) (Disclaimer: these numbers are probably wrong, just an example for reference)
- 8 character password, mixed case alpha numberic: (26+26+10)^8 = 218,340,105,584,896 = 21.8 seconds to try every possible password
- 8 character password, all 7-bit ascii characters: 127^8 = 67,675,234,241,018,881 = 6767 seconds to try every possible password (less than 2 hours)
- 8–12 character password, alphabetical only: 26^8 + 26^9 + 26^10 + 26^11 + 26^12 = 99,246,106,575,066,880 = 9924 seconds (less than 3 hours)
- 8 character mixed case alpha numberic password, with 8 character salt, 100 rounds = 62^16 * 100 = 4,767,240,170,682,353,345,026,333,081,600 = 15,116,819,414 years
Official LinkedIn Response
LinkedIn claims that they now salt passwords, so if you change your password, it will be updated and stored more securely
LinkedIn would be able to update to the stronger hashing algorithm without requiring users to change their password, by computing the new hash the next time each user logs in
LastPass – LinkedIn Password Checker

Cloudflare hacked via its voicemail

Cloudflare is a cloud based WAF (Web Application Firewall) and Global Load Balancer
An Attacker found four separate security vulnerabilities and chained them together in order to take over the account of a single Cloudflare user
The attacker was basically in control of the entire cloudflair infrastructure approximately 30 minutes
The attacker first exploited weak security at AT&T to redirect voicemail from the Cloudflare CEO to a mailbox setup by the attacker
The attacker next took over the CEOs personal Gmail account by tricking Google’s password reset system in to leaving the pin number in the voicemail box by a specially crafted voicemail greeting
A flaw (since fixed) in Google’s Enterprise Apps system, allowed the attacker to by-pass the two-factor authentication system when resetting the password for the CEOs Corporate Gmail, having the password send to the CEOs Personal Gmail compromised earlier.
An internal policy at Cloudflare had all password reset emails BCCed to administrators (ironically, this was done for debugging and to watch for suspicious password reset requests)
Once the attacker had compromised a Google Enterprise Apps admin account, he reset the passwords for the other admins, and initiated a Cloudflare password reset for the targetted customer
A copy of the password reset was sent to the administrator email, which the attacker now controlled, giving them access to the target users Cloudflare account
The attacker redirected all traffic to the target site to twitter
Official Incident Report w/ Updates
Official Followup

MD5-Crypt no longer considered secure

Poul-Henning Kamp (also known as PHK), who wrote the MD5-crypt implementation used in most all devices since 1995, says that it should no longer be considered secure
Commercial off-the-shelf video cards can crack MD5 hashes are rates in excess of 1 million hashes per second
PHK says he will not write a new password hashing algorithm, because he is not a cryptographer
His recommendation is to actually mix a number of algorithms, rather than using just a single algorithm
He also recommends that each site implement their own variation of the algorithm, to ensure against ‘class breaks’
FreeBSD 9 already supports Bcrypt, and SHA256/512 based password hashing
Arch Linux and a few others uses SHA256 by default now

Feedback:

ProjectMorris writes in disapointed with LinkedIn
Matthias writes… SID Cloning is Not a Problem
David writes in with… Another idea on local passwords
Slight correction to Thursday’s great episode over Firefox password saving

Round up:

The post I Know Your Password | TechSNAP 61 first appeared on Jupiter Broadcasting.