Show Notes:

Get TechSNAP on your Android:

• Callisto – Android App
• Jupiter Broadcasting – Android App by ShaneQful

Browser Affiliate Extension:

• Jupiter Broadcasting Affiliate Extensions for Chrome and Firefox

Researchers find exploits for popular game engines, putting both clients and servers at risk

• Researchers from ReVuln have found various flaws in a number of different video game engines including the Unreal3 Engine, the Quake4 (IDTech4) Engine and CryEngine3
• These vulnerabilities work against a large array of games because the same or slightly modified engines are used in many different titles
• The exploits vary, some allow the attacker to compromise the game server with remote code execution (see video, latter portion shows the attacker remotely starting windows calc.exe on the game server)
• The exploits also allow the servers to be used in denial of service attacks, or to make the servers attack each other, or the master server (from which clients get a list of game servers to connect to)
• Some exploits also attack the client
• Research PDF

---

Reporters accused of hacking for using wget to download files found via a google search

• Investigative Journalists from the Scripps Howard News Service were investigate TerraCom and YourTel America, specifically their participation in the US government’s ‘lifeline’ service, which provides telephone service to low-income families
• While doing a google search, the journalists found records stored on a server belonging to Call Centers India Inc., which was working under contract with VCare Inc, which had been hired by TerraCom to verify the eligibility of applicants
• A second google search revealed that more than 44,000 applications had been indexed by google, these applications include sensitive personal information and supporting documentation such as:
  • Social Security numbers
• Birth dates
• Home addresses
• Scanned copies of passports and driver’s license
• Financial accounts
• Tax records
• An identity thief would only dream of finding such a treasure trove
• The information appears to have just been dumped into web-accessible directories on a public facing web server, which google eventually found
• The journalists used wget to bulk-download the data
• The journalists then contacted TerraCom to report the exposed data, and were promptly accused of ‘hacking’, and threatened charges under the ‘Computer Fraud and Abuse Act’
• The data was pulled offline within hours
• In a statement on TerraComs website the company claims to have been the victim of a security breach, even though this seem more like a case of negligence
• In a statement, a legal representative for Scripps said “in the process of gathering newsworthy information, the bureau accessed – via a basic Internet search – personal and confidential information that apparently is available to anyone with a computer, an outlet and access to electricity. The search required no special skill and in no way ‘hacked’ or illegally accessed any server or database operated by TerraCom or any other company”

---

Google plans to replace all of their SSL certificate keys with 2048 bit keys by the end of 2013

• As computers get more powerful, the possibility of someone managing to crack a specific cryptographic key grows and it becomes time to increase the strength of those cryptographic systems by using longer keys
• As such, Google plans to replace all of their 1024 bit SSL keys with stronger 2048 bit keys, starting August 1st and finishing before the end of the year
• Most SSL Certificate Authorities has not issued new certificates with keys less than 2048 bits since the CA/Browser forum published “Baseline Requirements for the Issuance and Management of Publicly-Trusted Certificates v1.0” which requires that any certificate issued after 2013–12–31 use a 2048 bit key
• In addition, The US National Institute of Standards and Technology (NIST) issued “NIST Special Publication 800–57, Recommendation for Key Management”. In which they advise that 1024-bit RSA keys are no longer be viable (after 2010) and advises moving to 2048-bit RSA keys. NIST believes that 2048-bit keys should be viable until 2030.
• Google has a number of recommendations to people who implement SSL, to ensure that these changes do not disrupt services or devices, mostly they recommend against using ugly hacks, or assuming anything about the way Google does SSL

---

Feedback

• OAuth is not “single sign-on”!

• Using all TEH Cores?

• How is Bhyve coming along ?
  • There was a talk at BSDCan 2013 about this, in addition to a session at the DevSummit (I was in a different session though)
  • Slides from BSDCan 2013
  • Semi-Official bhyve website
  • Slides from the FreeBSD Developers Summit @ BSDCan 2013 re: behyve
  • Dev Summit Slides re: virtualization in general

• Have you guys hear of this port knocker software?

• Improve Security with an OSS Server but Closed Client?

• pfSense File Server?

Round Up

• Netflix @ BSDCan 2013 – slides
• Google engineer publicizes Windows zero-day bug, claims Microsoft is ‘difficult to work with’
• Charges filed in cyber bank heist, attackers compromised bank computers and increased account balances on prepaid cards, then cashed out $45 million from ATMs in 24 countries
• Hackers Who Breached Google in 2010 Accessed Company’s Surveillance Database
• Exploit for local Linux kernel bug in circulation, introduced in a patch in 2010, backported to older Linux kernels by Redhat. Exploit seems to have existed since 2010
• IE8 bug used in targetted attack against Korean military sites
• Investigating a DDoS for hire service
• Hire DDoS attack service ‘legal’ and connected to FBI
• Order your Internet Password Minder Protector Minder today

The post BSDCan 2013 Recap | TechSNAP 111 first appeared on Jupiter Broadcasting.

]]> https://original.jupiterbroadcasting.net/34346/time-to-git-zfs-techsnap-103/ Thu, 28 Mar 2013 16:38:51 +0000 https://original.jupiterbroadcasting.net/?p=34346 How the KDE project avoided a git disaster, the root problem with Java, and the researcher who found many S3 buckets exposed to the public.

The post Time to Git ZFS | TechSNAP 103 first appeared on Jupiter Broadcasting.

]]>



Is your bucket exposed to the public? A security researcher has recently discovered many S3 buckets are publicly available, we’ll share the details.

Plus how the KDE project avoided a git disaster, the root problem with Java, a big batch of your questions, and much much more!

Thanks to:

GoDaddy.com Use our code hostdeal4 to score economy hosting for $1 a month, for one year. 35% off your ENTIRE order just use our code go35off4 until the end of the month!
Ting.com Visit techsnap.ting.com to save $25 off your device or service credits.

Direct Download: HD Video | Mobile Video | MP3 Audio | Ogg Audio | YouTube | HD Torrent | Mobile Torrent RSS Feeds: HD Video Feed | Mobile Video Feed | MP3 Audio Feed | Ogg Audio Feed | iTunes Feeds | Torrent Feed

 

Support the Show:

Purchase anything at Amazon.com Purchase anything at Think Geek using this link Purchase anything at Newegg using this link Contribute directly on our donation page or check out our advertising options and reach millions of amazing people! Grab our Chrome Extension and auto-tag your shopping session for us!

   


Show Notes:

Get TechSNAP on your Android:

• Callisto – Android App
• Jupiter Broadcasting – Android App by ShaneQful

Browser Affiliate Extension:

• Jupiter Broadcasting Affiliate Extensions for Chrome and Firefox

Amazon S3 buckets unknowingly exposed?

• Security researcher Digininja was watching an old Hak5 episode about Amazon S3 and decided to give the free trial from Amazon a try
• All S3 buckets are accessed as: bucketname.s3-region.amazonaws.com
• An S3 bucket can be marked as Public or Private
• If you access the root of a Public bucket, you are given a list of the files inside that bucket
• Public S3 buckets can contain files that are marked as either Public, or Private
• Attempting to access a file marked private without an access key will return a HTTP 403 error
• While experimenting, he found that if you try to access a bucket that is assigned to a different region, amazon gives you a helpful redirect message
• Based on this, Digininja decided to try a wordlist against the Amazon S3 subdomain, and see what he could find in other peoples’ buckets
• Digininja was surprised to find that many buckets were marked public, rather than private
• While scraping through the results, he found a number of documents that should have been marked private but were not, including a Ministry of Defence training requisition form (containing personal information including SSN), a spreadsheet containing the accounts of a company, and many personal photos and videos
• It seems a lot of people are unknowingly making the contents of the S3 buckets public
• A number of people also appear to be trying to use S3 as a CDN, using it to host the images for their website (S3 is not a CDN, it can be rather slow, Amazon has a separate service to serve the contents of S3 via a CDN, called CloudFront)
• Researcher’s Blog Post
• Researcher’s Findings Post

---

The narrowly avoided Great KDE Disaster of 2013

• On March 22nd, the server that hosts git.kde.org was shut down for security updates, when it restarted there was evidence of file system corruption
• The original cause of the problem was not determined
• The real problem came, when the anongit mirrors of the 1500 KDE repositories mirrored the corrupt data, and there were no uncorrupt mirrors left
• The problem stems from the fact that in the replication strategy, git.kde.org was always considered to be correct
• The system they had in placed relied on the ability to sync an anongit mirror back upstream if there was a problem with the master
• It seems that git –mirror just copies data from the master, without the usual verification and safety measures that happen in git clone
• Luckily, KDE was in the process of replacing the projects.kde.org server, and it happened to have a mirror of the git repo from before the corruption, and they were able to restore git.kde.org from that
• The article goes on to discuss a number of the steps they are taking to make their system more robust in the future
• Update with more information to responses to common comments
• The update addresses the sysops 101 adage “mirrors are not backups”
• It talks about the problems they have with traditional backup systems
• tar: how do you take a tar archive of a live system? keeping .tar files going back 30+ days would take too much space (or cost to much to use S3 etc)
• rsync: same problem with a live system and rsync creates a mirror, which is not a backup
• Any answer? ZFS
• ZFS RAID Z, and ZFS snapshots are STILL not a backup
• But a ZFS snapshot can allow you to take a tar archive of a consistent version of the repo (no files will change with the tar is being made, since snapshots are read only
• Or better yet, you could store the actual ZFS snapshots (via ZFS send), so that you are basically getting ‘incremental’ backups, only the changed blocks are stored in each snapshot (requires that you keep and initial full snapshot and all incremental snapshots since then). Managing this can be difficult
• Backup software such as Bacula, running off the snapshots, would be the best solution

---

The root of the Java problem

• According to research by Websense, 93.77% of all installs of Java that were surveyed are vulnerable to at least one known exploit
• 75% of devices run a version that is at least 6 months old, 50% more than 2 years old
• 79% of devices are using some version of Java 6, which has now reached its End-Of-Live

---

Feedback:

• How can I go about telling my university that it has a vulnerability?

• pfSense question

• Getting started with KDE on FreeBSD?

• Nginx best-practice user setup

• Dump of username attempts for SSH login

• How I feel, as a Linux user, when Allan mentions ZFS.

---

Round Up:

• Apple finally enabled Two-Factor authentication for My Apple ID
• Mastercard hits PayPal and other Intermediaries with new higher per-transaction fee this June, because they do not disclose what you bought
• DHS to start scanning more internet traffic, moving from just Defense Contractors to ‘Infrastructure’ including banks and some transportation companies
• FBI’s top priority in 2013? Real-time spying on Gmail, Dropbox and Skype
• Server Room Cabling Hell: 15 of the Worst Server Wiring Jobs Ever!
• Paypal To Drop VMware From 80,000 Servers and Replace It With OpenStack
• “Perfect storm” pushes Bitcoin to $1b Market Cap Closer Toward the $100 per-coin mark
• Canadian Supreme Court rules that police need a warrent to read your text messages
• Egyptian navy arrests 3 attempting to sabotage undersea internet cable

---

The post Time to Git ZFS | TechSNAP 103 first appeared on Jupiter Broadcasting.

]]> https://original.jupiterbroadcasting.net/18476/jbs-xonotic-server-in-depth-look/ Fri, 30 Mar 2012 18:59:22 +0000 https://original.jupiterbroadcasting.net/?p=18476 Jupiter Broadcasting has a new public Xonotic server! Free to play and free to join!

The post JB's Xonotic server | In Depth Look first appeared on Jupiter Broadcasting.

]]>



Have some frustrations you need to work out? Then might I suggest shooting your fellow viewer in the virtual face! Jupiter Broadcasting has a new public Xonotic server! Free to play and free to join!

I\’ll tell you all about it, plus a few details about the free open source first person shooter, Xonotic. In this week\’s episode of an In Depth Look.

Direct Download:

HD Download | Mobile Download | MP3 Download | Ogg Download | YouTube

RSS Feeds:

HD Feed | Mobile Feed | MP3 Feed | Ogg Feed | iTunes HD Feed

Support the Show:

Purchase anything at Amazon.com Purchase anything at Think Geek using this link Purchase anything at Newegg using this link Contribute directly on our donation page or check out our advertising options and reach millions of amazing people! Grab our Chrome Extension and auto-tag your shopping session for us!

Show Notes

• It was developed as a fork of Nexuiz
• The game is running on a heavily modified version of the Quake engine known as \”DarkPlaces\”
• US people are more likely to pronounce it : zone + otic
• European people are more likely to pronounce it : kso + notic
• 0.6 Released March 8th includes new weapon models, new maps, massive new features, and a ton of bugs fixes.
• XonStat: Player Statistics for Jupiter Colony

Server info:

xonotic.jupitercolony.com

Jupiter Colony Xonotic Forum

We also have a TeamSpeak 3 channel which is open to anyone, and is a great way to get to know the people you\’re playing with.

TS3 IP: ts.jupitercolony.com:9990

xonotic@jupitercolony.com If anyone has questions/ideas.

The post JB's Xonotic server | In Depth Look first appeared on Jupiter Broadcasting.

]]>