Show Notes:

Get TechSNAP on your Android:

• Callisto – Android App
• Jupiter Broadcasting – Android App by ShaneQful

Browser Affiliate Extension:

• Jupiter Broadcasting Affiliate Extensions for Chrome and Firefox

BSDCan Live, May 17th and 18th

Cdorked Malware spreads to nginx and lighttpd as well

• ESET has found more than 400 servers infected with Cdorked in the top 100,000 ranked sites on Alexa
• Thanks to information shared with ESET by system administrators of some of the infected sites, ESET has the modified binaries of nginx and lighttpd as well as apache.
• Originally I thought the story may have been incorrect, that it was just infected apache behind nginx, but there are actually modified nginx binaries as well
• It is still unclear how the servers are being compromised to install the infected binaries, but the small footprint suggests that it is not a ‘class break’, and that the servers may be specifically targeted
• ESET has managed to analyze the configuration of the backdoor and find even more ways that Cdorked attempts to evade detection
• The configuration contains a very long blacklist of ips, who are not directed to the exploit kit, this list may be harvested from administrative logins of the compromised servers
• The servers do not attempt to infect anyone with their language localization set to: Japanese, Finnish, Russian and Ukrainian, Kazakh or Belarusian
• ESET says 100,000 of its users have browsed to a page with a Cdorked redirection which was then blocked by their software
• Cdorked only seems to target Internet Explorer 7+ and Firefox on windows XP, Vista, 7 and 8, specifically ignoring Chrome, Opera and all devices running Linux or BSD
• Cdorked seems to have a special redirection for iPhone and iPad devices, instead of delivering windows malware, the mobile devices are redirected to a page with links to pornographic pay sites
• The malware currently being delivered by the infected sites is identified as Win32/Glupteba.G
• SHA1 hashes of known-bad binaries:
• a53a30f8cdf116de1b41224763c243dae16417e4 bad-apache
• a51b1835abee79959e1f8e9293a9dcd8d8e18977 bad-nginx
• dd7846b3ec2e88083cae353c02c559e79124a745 bad-lighthttpd
• ee679661829405d4a57dbea7f39efeb526681a7f bad-apache-x64-with-symbols
• 5b87807b4a1796cfb1843df03b3dca7b17995d20 bad-apache-i386
• 03592b8147e2c84233da47f6e957acd192b3796a bad-apache

---

Cylance compromises Industrial control system as Google HQ in Australia

• Cylance is running a world-wide project to identify vulnerable Industrial Control Systems
• While reviewing the logs of their scans, they stumbled across a particularly interest result
• The Tridium Niagara Building Management Systems (BMS) for Google Wharf 7, exposed on the internet
• They were able to interrogate the device and find out it was running a slightly outdated version of Tridium Niagara, on an embedded QNX machine
• They were also able to extract the config.bog file, which contains the username and ‘encoded’ (just encoded, not hashed) password for every user on the system
• With the administrative password, Cylance could have rooted the device and had persistent access
• The researchers reported the issue to Google, who quickly pulled the ICS system offline
• “At the time of this blog post, this exact issue affects tens of thousands of devices on the Internet and thousands of different organizations”
• Tridium claims on its website that “there are over 245,000 instances of the Niagara Framework deployed worldwide.”
• Cylance scans showed 25,000 similarly vulnerable systems facing the Internet
• “If Google can fall victim to an ICS attack, anyone can.”
• Additional Coverage – ThreatPost

---

Dissecting RSA’s packet capture of the VOHO Watering hole attack

• This story covers some of the interesting information to can get from even just a few packets off of someone elses network
• By analyzing the packet capture RSA releases, a lot of information about RSAs network can be gleaned
• First, the source MAC address in the captured frame starts with 00:50:56, a block assigned to VMWare, this is as you might expect, the researcher at VMWare was testing the exploit in a virtual machine
• Now, the destination MAC address (the router on the local network) is assigned to 2Wire, suggesting a small home-grade router
• The source IP address is 192.168.0.106, what you would expect for a device behind a home router
• The destination IP address is the Command & Control server, 58.64.155.59, in Hong Kong
• Looking at the IP TTL (128), this suggests the source machine (in the VMWare) is Windows, as FreeBSD and Linux use 64 as the default TTL
• Looking at the source port and the fact that it is very low rather than high, suggests that the source OS is Windows XP, rather than a newer version of windows
• Original RSA Story “Lions at the watering hole”

---

Feedback:

• Java & Android = Oh My?

• How do you DO Your Wireless?

• Shane’s algorithm based on Grammatical Evolution to generate different hashing algorithms for different websites.

• Our thoughts on the How Secure is Your Password Series

• Why Intel’s “How Strong is Your Password?” site can’t be trusted

• Intel’s Page: How Strong is Your Password?

---

Round Up:

• New tool iSniffGPS released on github allows you to determine where an iPhone owner lives
• FOIA request by MuckRock gets the NSA internal google hacks book released. Untangling the Web – 651 page PDF – Wired Coverage
• Reports: Facebook Is Buying Social Mapping/Traffic App Waze For Up To $1B
• The Onion presents: Tips on how to prevent your major media site being hacked
• Hackers gain access to all .edu domains
• Bruce Schneier – Why Collecting More Data Doesn’t Increase Safety

---

The post Packet Tells A Lot | TechSNAP 109 first appeared on Jupiter Broadcasting.

]]> https://original.jupiterbroadcasting.net/31286/r-i-p-xna-cr-35/ Mon, 04 Feb 2013 12:03:33 +0000 https://original.jupiterbroadcasting.net/?p=31286 Microsoft leaves developers in a lurch with the death of XNA, Blackberry 10’s early results look promising, and the mixed message Surface Pro sends developers.

The post R.I.P. XNA | CR 35 first appeared on Jupiter Broadcasting.

]]>



Microsoft leaves developers in a lurch with the death of XNA, Blackberry 10’s early results look promising, Microsoft won’t admit they\’re an Enterprise company, and the mixed message the Surface Pro sends developers.

Plus the Python vs Ruby debate is finally settled, Mike publicly admits his chicken habit, and we answer audience questions.

Direct Download:

MP3 Audio | OGG Audio | Video | Torrent | YouTube

RSS Feeds:

MP3 Feed | OGG Feed | Video Feed | Torrent Feed | iTunes Audio | iTunes Video

Show Notes:

Feedback

• Mark writes: “In your honest, and sometime brutal opinion, which language should prevail? Which language has the best win32com support/modules? All the machines at my job run Windows 7, while personally, I have a 13\” Macbook Pro with Mountain Lion dual-booting Ubuntu 12.04.”
• Tushar writes: “since neither Apple or Google require you to release the source code of your app when you submit it for approval, you could hide stuff that activate themselves at the customers end. “
• Michael writes in suggesting that the Ubuntu Phone is not targeted at the US market.

Dev World Hoopla

• BB10 is out

• Surface Pro?

• Code Journal for iPhone 3GS, iPhone 4, iPhone 4S, iPhone 5, iPod touch

• RIP XNA

Tool of the Week

• Source Tree

Book of the Week

[asa]B00A22EXL8[/asa]

Follow the show

• Email the show
• Live Monday 9am PST
• Music by: Ronald Jenkees
• Mike on Twitter
• Mike on Google+
• Mike’s website
• Chris on twitter
• Chris on Google+

The post R.I.P. XNA | CR 35 first appeared on Jupiter Broadcasting.

]]> https://original.jupiterbroadcasting.net/5663/show-me-the-tablets-jn-3211/ Wed, 02 Mar 2011 22:14:32 +0000 https://original.jupiterbroadcasting.net/?p=5663 Could tablets replace PCs in the near future? Does Apple deserve the hype surrounding the iPad 2? Do the competitors stack up?

The post Show Me The Tablets | J@N | 3.2.11 first appeared on Jupiter Broadcasting.

]]>



In case you were living beneath the largest rock every invented, you are aware that the iPad TWO was announced today. In addition to covering some of the hot, Hot, HOT features, we’ll also spend some time discussing the announcement itself, and how other tablets (either on the market, or coming soon) stack up to this new offering.

Could tablets replace PCs in the near future? Does Apple deserve the hype surrounding this product? Does any competitor (XOOM, PlayBook, LG G-Slate, etc) have a chance of survival?

Show Feeds:

• HD Video RSS
• Large Video RSS
• iPod Video RSS
• MP3 RSS
• iTunes Feeds

Show Notes:


iPad2 announced today
– Thinner
– Awesome battery life
– Face-Time @ 720p
– AirPlay
– Cost comparison
– The neat cover thing (video)
– iMovie and GarageBand
– It just lapped everyone else — Xoom, Playbook, GalaxyTab, etc

Jobs did the announcing, talked some trash about big companies
– His appearance broke the internet

Tablet Comparison Infographic

iPad 1 vs. iPad 2

XOOM comparison

PlayBook faces rough launch in ~2 months

Download:

The post Show Me The Tablets | J@N | 3.2.11 first appeared on Jupiter Broadcasting.

]]>