Show Notes:

Get TechSNAP on your Android:

• Callisto – Android App
• Jupiter Broadcasting – Android App by ShaneQful

Browser Affiliate Extension:

• Jupiter Broadcasting Affiliate Extensions for Chrome and Firefox

Satirical online news magazine The Onion has its Twitter account hacked

• On May 6th, The Onion published an article titled “The Onion’s Tips On How To Prevent Your Major Media Site From Being Hacked”
• That article was featured on TechSNAP 109
• As it turns out, starting on May 3rd, the Syrian Electronic Army, had started its operation to infiltrate The Onion
• The attack starting with a very simple Phishing email, with a link that looked like it went to a story at the Washington Post, but actually went to a hacked wordpress site
• The link then automatically forwarded the user to a different site, which asked for the user’s Google Apps credentials
• “These emails were sent from strange, outside addresses, and they were sent to few enough employees to appear as just random noise rather than a targeted attack. At least one Onion employee fell for this phase of the phishing attack”
• Once the attackers had compromised the account of one Onion employee, they used that account to send a much more convincing email to more employees. This email, coming from a trusted address, had a higher success rate
• Two employees entered their Google Apps credentials in to the rogue website, one of those employees had access to all of The Onions social media accounts
• After this attack was discovered, the IT Security group send out an email to all employees telling them to reset their passwords
• The attackers, using an additional compromised account that the security group did not know about, send a nearly identical email to all employees, this one included a link, disguised as a password-reset link
• The attackers purposely removed all members of the Tech and IT Security Group from the distribution list for the fake password reset email, so it went undetected
• This final attack, compromised another employee who had access to The Onion’s twitter account, which resulted in their account falling into the wrong hands a second time
• “In total, the attacker compromised at least 5 accounts”, but seeing as the security group had no way of telling how many other accounts may have been compromised, they forced a password reset on all Google Apps accounts
• The Onion decided to have some fun at the expense of the attackers and published and article about their impending death
• The SEA responded by posting some confidential emails they had gained access to
• The Syrian Electronic Army has also taken credit for compromising numerous other media outlets’ social media accounts:
  • The BBC
  • The Associated Press
  • The Guardian
  • The Financial Times
  • ITV
  • CBS
  • Sky Broadcasting
• The Financial Times also posted a similar post mortem of the attack against them
• The attack appears to have been nearly identical, using a generic phishing attack with a disguised link to compromise one or more Google Apps accounts, then use the access to send a fake password reset email from a trusted inside address

---

Google Security Team changes stance on Responsible Disclosure

• In 2010, the Google Security Team established its guidelines for responsible disclosure which stated that when a researcher finds a vulnerability, the vendor has 60 days from notification to issue a patch or disclose the vulnerability to the public
• If a patch or disclosure were not made after 60 days, the Google Security Team would support the researcher disclosing the details of the vulnerability to the public themselves
• Based on the growing security risk and some vendors taking unreasonable amounts of time to fix vulnerabilities, the Google Security Team has revised their policy
• If a vulnerability is being actively exploited, the Google Security Team will support researchers disclosing the details of the vulnerability after only 7 days
• The Google team believes that after 7 days, while a vulnerability is being actively exploited, the general public, and specifically the people who are being actively exploited, are better served by knowing about the vulnerability and being able to take steps to mitigate the problem, until a patch can be issued
• “Often, we find that zero-day vulnerabilities are used to target a limited subset of people. In many cases, this targeting actually makes the attack more serious than a broader attack, and more urgent to resolve quickly.”
• “companies should fix critical vulnerabilities within 60 days – or, if a fix is not possible, they should notify the public about the risk and offer workarounds”
• Background on Full Disclosure, Essay by Bruce Schneier

---

Feedback:

• Jails vs Containers
  • [An Overview of Security in the FreeBSD Kernel (https://www.bsdcan.org/2013/schedule/events/417.en.html)

• OAuth / ShmoAuth?

• OSS Load Balancer?
  • relayd
  • relayd ported to FreeBSD
  • nginx (HTTP(S) and Mail only)
  • Varnish (HTTP only)
  • pfSense

• LastPass on Mobile

• 2.4 Petabytes!!!!

Round Up:

• FiOS customer discovers the limits of “unlimited” data: 77TB a month
• Contracter targetted in attack attributed to China, ASIO (Australian Security Intelligence Organisation) building blueprints and security system schematics stolen – Video describing the attack
• Log file vulnerability in Apache server
• A closer look at the recent Linux Kernel exploit CVE–2013–2094
• PayPal.com XSS Vulnerability
• Hard coded credentials in ICS systems (FTP) TURCK BL20 and BL67 Programmable Gateways
• Apple pushes update to Quicktime for Windows, fixes 12 vulnerabilities
• Google researchers find 13 new critical flaws in Flash Player:
• CVE–2013–2728
• CVE–2013–3324
• CVE–2013–3325
• CVE–2013–3326
• CVE–2013–3327
• CVE–2013–3328
• CVE–2013–3329
• CVE–2013–3330
• CVE–2013–3331
• CVE–2013–3332
• CVE–2013–3333
• CVE–2013–3334
• CVE–2013–3335
  • Make sure you are using Flash 11.7.700.202 or newer

The post Making the Onion Cry | TechSNAP 112 first appeared on Jupiter Broadcasting.

]]> https://original.jupiterbroadcasting.net/11146/defcon-brings-the-scary-techsnap-18/ Thu, 11 Aug 2011 22:42:08 +0000 https://original.jupiterbroadcasting.net/?p=11146 A Kill switch for social media, eBay upgrades their servers to SSD, and you won’t believe the costs, and we take a peak at Microsoft’s data center in a box!

The post DEFCON Brings the Scary | TechSNAP 18 first appeared on Jupiter Broadcasting.

]]>



This week on TechSNAP:

The UK Prime Minister wants a Kill switch for social media, ebay upgrades their servers to SSD, and you won’t believe the costs, and we take a peak at Microsoft’s data center in a box!

Direct Download Links:

HD Video | Large Video | Mobile Video | WebM Video | MP3 Audio | OGG Audio | YouTube

Subscribe via RSS and iTunes:
Subscribe... --RSS-- TechSNAP HD TechSNAP Large TechSNAP Mobile TechSNAP MP3 TechSNAP OGG --iTunes-- TechSNAP iTunes HD TechSNAP iTunes Mobile TechSNAP iTunes Large TechSNAP iTunes MP3

[ad#shownotes]

Show Notes:

---

UK PM Proposed Social Media Kill Switch

• UK PM David Cameron is proposing that the police, intelligence agencies and telecom industry investigate if it would be right and technically feasible to disable access to social networks during times of civil unrest
• “Everyone watching these horrific actions will be struck by how they were organised via social media”
• This is obviously the wrong way to solve the problem, and it will never work. Even if the telcos block access to facebook and twitter via the Internet and cellular networks, rioters could just use text message trees like those that were used to organize the riots in Egypt.
• Some are even proposing entirely disabling the cellular networks in affected areas, however this would be seriously disruptive considering that many in the UK only have cellular phones. Leaving citizens without access to emergency services would obviously be untenable.
• Even if the UK government was successful in blocking access to the major social networks, protesters could use other networks, there are an infinite number of competing services. Protesters could also use proxies and other techniques to mask their access to social media. This is common place in workplaces that block access to the sites.
• A number of people have already been arrested for posting messages on facebook that were said to be ‘inciting violence’ and ‘public disorder’
• More detailed article from the BBC

---

Denial of Service Attack results in suspended trading on the Hang Seng Stock Exchange

• An attack against a site used to post official announcements about issues on the Hang Seng stock exchange resulting in the site being unreachable
• Trading in stock issues that were to make important price affecting announcements was suspended.
• Trading of shares in HSBC, Cathay Pacific, China Power International and the Hong Kong exchange itself, among others, was suspended
• If the site remains offline, the Hang Seng exchange will find an alternate way to release the announcements and trading will resume
• Earlier this year the US NASDAQ exchange revealed that cyber attackers had planted malicious code on its “Directors Desk” web application

---

eBay begins migration to pure SSDs in its datacenters

• Approximately half of eBay’s 4000 VMs are now backed purely by SSD storage
• The average time to deploy a VM has dropped from 45 minutes to 5
• Previously, eBay had been using 15k RPM drives via Fibre Channel
• One rack full of SSDs is equivalent in performance to eight or nine racks of the previous drives
• After replacing 100TB of storage, a 50% reduction in rack space, a 78% drop in power consumption and a five-fold boost in I/O performance were realized
• The appliance eBay is using does not use traditional hard drive form factor SSDs, but rather 2U modules of pure flash storage via a 6 Gbit/sec SAS interface.
• Storage is priced at $10,000 per Terabyte, and comes in 2.5TB, 5TB, and 10TB modules

---

Radios used by US Federal Law Enforcement suffer Security Flaws

• The P25 Radios used by many Federal Law Enforcement Agencies support encryption, but not always use it. Many messages are sent in the clear, even when the users believe they are communicating securely
• This vulnerability results in trivial passive attacks, where the supposedly secure communications can be eaves dropped on
• The P25 Radios are also subject to active attacks. An attacker with very modest resources is able to jam specific types of communication to and from the P25. This would allow an attacker to block LEOs in the area from sending or receiving encrypted messages.
• The available symmetric encryption systems are DES, 3DES and AES. Obviously the first two options have not been considered secure for many years.
• Because the radios are based on a best-effort protocol, and do not have the ability to retransmit garbled frames, advanced encryption mechanisms like CBC (Cipher Block Chaining) cannot be used. This also means that MAC (Message Authentication Code) cannot be used to verify that the incoming transmissions have not been altered.
• Because of this, it is possible for an attacker to impersonate a legitimate user, inject voice and data traffic, and replay captured traffic resulting in false signals, even when the messages are encrypted
• PDF of the official University of Pennsylvania study

---

Defcon presentation claims MITM attack on 4G and CDMA mobile phones

• Reports indicate that a successful Man-in-the-Middle attack was executed against devices in and around the Defcon venue.
• The attackers were able to gain permanent kernel-level root access in some Android and PC devices by using rootkits and non-persistent user space access in some other devices. In both cases, whoever launched this attack against both CDMA and 4G devices was able to steal data and monitor conversations.
• It is speculated that the attacker was able to inject specially crafted packets in to the data streams, possibly displaying prompts to the user, that if accepted would install the rootkit
• Once the device is compromised, it is trivial to monitor ongoing communications or steal the 4G encryption key

---

A tour of Microsoft’s cloud data centers

• Microsoft’s newest data center designs are modular and containerized
• The new design allows them to bring new data centers online much more quickly
• The new designs allow the contains to be ‘plug and play’, and results in far less packing materials being required

---

Round Up

• Syrian hackers deface Anonymous’ social network, apparently retaliation for Anonymous’ attacks against the Syrian governments’ websites
• Some apparent members of Anonymous claim they will attempt to take down facebook on November 5th
• 8 ways to circumvent the PROTECT-IP Act
• DEFCON presentation defeats card and code locks used by Governments in seconds
• How a trivia CompSci decision 40 years ago has haunted us ever since
• How to succeed at working remotely
• Court claims Domain Seizures do not violate your free speech rights
• Landlord leaves 1000s of tenants personal details, and some banking details on an unencrypted USB drive at the pub
• Surprising number of US ISPs hijack their customers’ google searches

Bitcoin Blaster

• Bitcoins were back above $10 USD but have started to slide again
• MyBitcoin Incident Report – August 5th 2011
• Bitcoins hit 7 million total in circulation!
• Mining Factor Chart – Revenue per 100 MHash/s

The post DEFCON Brings the Scary | TechSNAP 18 first appeared on Jupiter Broadcasting.

]]>