torrent – Jupiter Broadcasting https://www.jupiterbroadcasting.com Open Source Entertainment, on Demand. Wed, 01 Mar 2017 05:37:19 +0000 en-US hourly 1 https://wordpress.org/?v=5.5.3 https://original.jupiterbroadcasting.net/wp-content/uploads/2019/04/cropped-favicon-32x32.png torrent – Jupiter Broadcasting https://www.jupiterbroadcasting.com 32 32 Cloudy with a Chance of Leaks | TechSNAP 308 https://original.jupiterbroadcasting.net/107191/cloudy-with-a-chance-of-leaks-techsnap-308/ Tue, 28 Feb 2017 21:37:19 +0000 https://original.jupiterbroadcasting.net/?p=107191 RSS Feeds: HD Video Feed | Mobile Video Feed | MP3 Audio Feed | Ogg Audio Feed | iTunes Feed | Torrent Feed Become a supporter on Patreon: Show Notes: Announcing the first SHA1 collision Not just Google on this, they worked with CWI SHA1 is a Cryptographic hash function SHA-1 was developed as part […]

The post Cloudy with a Chance of Leaks | TechSNAP 308 first appeared on Jupiter Broadcasting.

]]>
RSS Feeds:

HD Video Feed | Mobile Video Feed | MP3 Audio Feed | Ogg Audio Feed | iTunes Feed | Torrent Feed

Become a supporter on Patreon:

Patreon

Show Notes:

Announcing the first SHA1 collision

CloudBleed


Feedback


Round Up:


The post Cloudy with a Chance of Leaks | TechSNAP 308 first appeared on Jupiter Broadcasting.

]]>
Children of the Chromebook | TTT 225 https://original.jupiterbroadcasting.net/91151/children-of-the-chromebook-ttt-225/ Fri, 04 Dec 2015 12:52:53 +0000 https://original.jupiterbroadcasting.net/?p=91151 We start from a town that has no internet and reflect on how quickly the last 8 years of progress feel very distant, then discuss the recent extreme examples of companies challenging Net Neutrality. Ballmer says Windows Phones should run Android apps & maybe he’s right? Google’s Chromebooks make up half of US classroom devices. […]

The post Children of the Chromebook | TTT 225 first appeared on Jupiter Broadcasting.

]]>

post thumbnail

We start from a town that has no internet and reflect on how quickly the last 8 years of progress feel very distant, then discuss the recent extreme examples of companies challenging Net Neutrality. Ballmer says Windows Phones should run Android apps & maybe he’s right?

Google’s Chromebooks make up half of US classroom devices. As parents, are we comfortable with Google having a lifetime of history on our kids?

Plus some follow up on a previous Kickstarter of the week with a special guest, the likely conclusion to a five year old tech story & the inside scoop on the Jupiter Broadcasting SWAG for the Holidays giveaway!

Direct Download:

MP3 Audio | OGG Audio | Video | HD Video | Torrent | YouTube

RSS Feeds:

MP3 Feed | OGG Feed | iTunes Feed | Video Feed | Video Feed | Torrent Feed

Become a supporter on Patreon

Patreon

Show Notes:

— Episode Links —

The post Children of the Chromebook | TTT 225 first appeared on Jupiter Broadcasting.

]]>
Browser Pirates | Tech Talk Today 173 https://original.jupiterbroadcasting.net/82392/browser-pirates-tech-talk-today-173/ Wed, 20 May 2015 09:30:48 +0000 https://original.jupiterbroadcasting.net/?p=82392 Another major flaw in consumer routers needs patched ASAP, the tech of sending messages via tone comes to Chrome & Popcorn Hour lands in your web browser, but there’s a major catch. Direct Download: MP3 Audio | OGG Audio | Video | HD Video | Torrent | YouTube RSS Feeds: MP3 Feed | OGG Feed […]

The post Browser Pirates | Tech Talk Today 173 first appeared on Jupiter Broadcasting.

]]>

post thumbnail

Another major flaw in consumer routers needs patched ASAP, the tech of sending messages via tone comes to Chrome & Popcorn Hour lands in your web browser, but there’s a major catch.

Direct Download:

MP3 Audio | OGG Audio | Video | HD Video | Torrent | YouTube

RSS Feeds:

MP3 Feed | OGG Feed | iTunes Feed | Video Feed | Video Feed | Torrent Feed

Become a supporter on Patreon

Foo

Show Notes:

Critical vulnerability in NetUSB driver exposes millions of routers to hacking | PCWorld

Millions of routers and other embedded devices are affected by a serious vulnerability that could allow hackers to compromise them.

The vulnerability is located in a service called NetUSB, which lets devices connected over USB to a computer be shared with other machines on a local network or the Internet via IP (Internet Protocol). The shared devices can be printers, webcams, thumb drives, external hard disks and more.

NetUSB is implemented in Linux-based embedded systems, such as routers, as a kernel driver. The driver is developed by Taiwan-based KCodes Technology. Once enabled, it opens a server that listens on TCP port 20005 for connecting clients.

Security researchers from a company called Sec Consult found that if a connecting computer has a name longer than 64 characters, a stack buffer overflow is triggered in the NetUSB service. If exploited, this kind of vulnerability can result in remote code execution or denial of service.

Since the NetUSB service code runs in kernel mode, attackers who exploit the flaw could gain the ability to execute malicious code on the affected devices with the highest possible privilege, the Sec Consult researchers said in a blog post Tuesday.

Many vendors integrate NetUSB into their products, but have different names for it. For example, Netgear calls the feature ReadySHARE, while others simply call it print sharing or USB share port.

Google Is Close to Unveiling New Web Photo Service – Bloomberg Business

The new photo tool, which will let users post images to Facebook Inc. and Twitter Inc., will probably be unveiled at Google’s annual software developers conference in San Francisco later this month, said the people, who asked not to be identified because the matter is private.

Google Tone is a Chrome extension for sharing URLs with nearby computers using sound | VentureBeat | Dev | by Paul Sawers

To try the feature, all computers must first have the Google Tone Chrome extension installed and be within reasonable earshot of each other. Then, when you’re on a webpage you’d like to share, hit the little Google Tone tab in your browser and you’ll hear a little succession of beeps — not too dissimilar to an old ZX Spectrum computer loading a game. Nearby machines receive a notification with the sender’s Google profile and picture embedded within the message, and the user can choose to open the URL on their own PC.

You Can Now Use ‘Netflix for Torrents’ Popcorn Time in Your Browser

The new website, at PopcornInYourBroswer.net, provides much the same service as Popcorn Time always has. Just now it’s in your browser.

The post Browser Pirates | Tech Talk Today 173 first appeared on Jupiter Broadcasting.

]]>
Signed by Sony | TechSNAP 192 https://original.jupiterbroadcasting.net/73732/signed-by-sony-techsnap-192/ Thu, 11 Dec 2014 18:48:06 +0000 https://original.jupiterbroadcasting.net/?p=73732 If we could rebuild the Internet from scratch, what would we change? It’s more than just a thought experiment. We’ll share the details about real world research being done today! Plus we dig through the Sony hack, answer a ton of great question & a rocking roundup! Thanks to: Get Paid to Write for DigitalOcean […]

The post Signed by Sony | TechSNAP 192 first appeared on Jupiter Broadcasting.

]]>

post thumbnail

If we could rebuild the Internet from scratch, what would we change? It’s more than just a thought experiment. We’ll share the details about real world research being done today!

Plus we dig through the Sony hack, answer a ton of great question & a rocking roundup!

Thanks to:


DigitalOcean


Ting


iXsystems

Direct Download:

HD Video | Mobile Video | MP3 Audio | Ogg Audio | YouTube | HD Torrent | Mobile Torrent

RSS Feeds:

HD Video Feed | Mobile Video Feed | MP3 Audio Feed | Ogg Audio Feed | iTunes Feeds | Torrent Feed

Become a supporter on Patreon:

Foo

— Show Notes: —

Reinventing Computers And The Internet From Scratch, For The Sake Of Security

  • DARPA funded research is looking at how we might design the Internet if we had to do it over again
  • Many decisions that were made 30 and 40 years ago when UNIX and TCP/IP were designed, may be done differently today
  • The overall project has a number of sub-projects:
    • CRASH – Clean-Slate Design of Resilient, Adaptive, Secure Hosts
    • MRC – Mission-Oriented Resilient Clouds
    • CTSRD – Clean Slate Trustworthy Secure Research and Development (Custard)
  • BERI: Bluespec Extensible RISC Implementation: a open-source hardware-software research and teaching platform: a 64-bit RISC processor implemented in the high-level Bluespec hardware description language (HDL), along with compiler, operating system, and applications
  • CHERI: capability hardware enhanced RISC instructions: hardware-accelerated in-process memory protection and sandboxing model based on a hybrid capability model
  • TESLA: temporally enforced security logic assertions: compiler-generated runtime instrumentation continuously validating temporal security properties
  • SOAAP: security-oriented analysis of application programs: automated program analysis and transformation techniques to help software authors utilize Capsicum and CHERI features
  • The goal is to design newer secure hosts and networks, without having to maintain backwards compatibility with legacy systems, the biggest problem with changing anything on the Internet
  • This is why there are still things like SSLv3 (instead of just TLS 1.2+), why we have not switched to IPv6, and why spam is still such a large problem
  • I for one would definitely like to replaced SMTP, but no one has yet devised a plan for a system that the world could transition to without breaking legacy email while we wait for the rest of the world to upgrade
  • “Corporations are elevating security experts to senior roles and increasing their budgets. At Facebook, the former mantra “move fast and break things” has been replaced. It is now “move slowly and fix things.””
  • For performance reasons, when hardware and programming languages were designed 30 and 40 years ago, it was decided that security would be left up to the programmer
  • The CHERI project aim to change this, by implementing ‘Capabilities’, a sandboxing and security mechanism into the hardware, allowing the hardware rather than the software to enforce protections, preventing unauthorized access or modification of various regions of memory by malicious or compromised applications.
  • CHERI, and the software side of the project, Capsicum, are based on FreeBSD, but are also being ported to Linux, where Google plans to make extensive use of it in its Chrome and Chromium browsers.
  • Additional Coverage

Sony Internal Network Hacked


Feedback:


Round Up:


The post Signed by Sony | TechSNAP 192 first appeared on Jupiter Broadcasting.

]]>
Distributed Denial of Sony | Tech Talk Today 104 https://original.jupiterbroadcasting.net/73652/distributed-denial-of-sony-tech-talk-today-104/ Thu, 11 Dec 2014 10:51:07 +0000 https://original.jupiterbroadcasting.net/?p=73652 Sony is rumored to be hacking back, a P2P browser is in the works, Microsoft starts accepting Bitcoin & automatically changing your web passwords. Direct Download: MP3 Audio | OGG Audio | Video | HD Video | Torrent | YouTube RSS Feeds: MP3 Feed | OGG Feed | iTunes Feed | Video Feed | Torrent […]

The post Distributed Denial of Sony | Tech Talk Today 104 first appeared on Jupiter Broadcasting.

]]>

post thumbnail

Sony is rumored to be hacking back, a P2P browser is in the works, Microsoft starts accepting Bitcoin & automatically changing your web passwords.

Direct Download:

MP3 Audio | OGG Audio | Video | HD Video | Torrent | YouTube

RSS Feeds:

MP3 Feed | OGG Feed | iTunes Feed | Video Feed | Torrent Feed

Become a supporter on Patreon:

Foo

Show Notes:

Sony hack: Studio Tries to Disrupt Downloads of its Stolen Files | Re/code

The company is using hundreds of computers in Asia to execute what’s known as a denial of service attack on sites where its pilfered data is available, according to two people with direct knowledge of the matter.

Sony is using Amazon Web Services, the Internet retailer’s cloud computing unit, which operates data centers in Tokyo and Singapore, to carry out the counterattack, one of the sources said. The tactic was once commonly employed by media companies to combat Internet movie and music piracy.

BitTorrent Inc Works on P2P Powered Browser | TorrentFreak

BitTorrent Inc, the company behind the popular file-sharing client uTorrent, is working on a P2P powered browser. Dubbed Project Maelstrom, the browser will be able to “keep the Internet open” by serving websites with help from other users.


Project Maelstrom, as it’s called, is in the very early stages of development but BitTorrent Inc. is gearing up to send out invites for a closed Alpha test.


“It works on top of the BitTorrent protocol. Websites are published as torrents and Maelstrom treats them as first class citizens instead of just downloadable content. So if a website is contained within a torrent we treat it just like a normal webpage coming in over HTTP.”

More details are expected to follow during the months to come. Those interested in Project Maelstrom can sign up for an invite to the Alpha test here.

US Navy approves first laser weapon for operation aboard Persian gulf ship | Ars Technica

On Wednesday the Office of Naval Research (ONR) announced that it would approve an experimental laser weapon for use on the USS Ponce in the Persian Gulf. The laser weapon system is part of a $40-million research program to test directed energy weapons, and it is the first to be officially deployed and operated on a naval vessel.


Although the laser weapon system is not as powerful as other weapons aboard the Ponce, Christopher Harmer, Senior Naval Analyst with the Institute for the Study of War told the Wall Street Journal that the directed energy of the laser aimed at a target would “cause a chemical and physical disruption in the structural integrity of that target.” Harmer added that the advantage of the laser weapon system is that it can disable many oncoming targets without needing to reload ammunition: “as long as you’ve got adequate power supply, and adequate cooling supply.”


The laser shot doesn’t look like the photon torpedoes of Star Trek—in fact it looks like nothing at all. The energy beam is invisible (and costs the Navy $0.59 per shot, according to the WSJ). A press release from ONR stated that the laser weapon system was able to hit targets out of the sky and at sea in high winds, heat, and humidity without fail.

LastPass Now Lets You Change Loads of Passwords at Once

Now when you use the password manager, you’ll see an option to change your password automatically below your login info for each site.

Currently, the service supports over 75 accounts, including Facebook, Twitter, Amazon and Dropbox. Rather than going through a cloud network, LastPass says these changes happen locally on your device, so the company never have access to your actual password.

How do I use Bitcoin with my Microsoft account?

You can now use Bitcoin to add money to your Microsoft account. Once you add money to your Microsoft account, you can use it as a payment option to buy apps, games, and other digital content from Windows, Windows Phone, Xbox Games, Xbox Music, or Xbox Video stores.

The post Distributed Denial of Sony | Tech Talk Today 104 first appeared on Jupiter Broadcasting.

]]>
OwnCloud Your Chromebook | LAS 329 https://original.jupiterbroadcasting.net/66142/owncloud-your-chromebook-las-329/ Sun, 07 Sep 2014 15:30:26 +0000 https://original.jupiterbroadcasting.net/?p=66142 Linux is the ultimate productivity OS. This week we’ll show you how to divorce your Chromebook from Google, sync all your Linux desktops with free software and improve your workflow at the same time. Plus the new tool from Red Hat you’ll be using soon, Ubuntu shows developers some love & the big game coming […]

The post OwnCloud Your Chromebook | LAS 329 first appeared on Jupiter Broadcasting.

]]>

post thumbnail

Linux is the ultimate productivity OS. This week we’ll show you how to divorce your Chromebook from Google, sync all your Linux desktops with free software and improve your workflow at the same time.

Plus the new tool from Red Hat you’ll be using soon, Ubuntu shows developers some love & the big game coming to Linux we’re excited about!

Thanks to:


DigitalOcean


Ting

Download:

HD Video | Mobile Video | WebM Torrent | MP3 Audio | Ogg Audio | YouTube | HD Torrent

RSS Feeds:

HD Video Feed | Large Video Feed | Mobile Video Feed | MP3 Feed | Ogg Feed | iTunes Feeds | Torrent Feed

Become a supporter on Patreon:

Foo

— Show Notes: —

Because you asked…


System76

Brought to you by: System76

Howto Install Linux on Chromebook

Suggest: ‘Linux on Chromebook how to’ LAS episode

The Acer C720 Chromebook (and newer Chromebooks in general) features a “legacy boot” mode that makes it easy to boot Linux and other operating systems. The legacy boot mode is provided by the SeaBIOS payload of coreboot. SeaBIOS behaves like a traditional BIOS that boots into the MBR of a disk, and from there into your standard bootloaders like Syslinux and GRUB.

Accessing the superuser shell with Chrome OS installed

If you have configured Chrome OS already:

  • Open a crosh window with Ctrl + Alt + T.
  • Open a bash shell with the shell command.
  • Become superuser with sudo bash

Enabling the pre-installed version of SeaBIOS

This method will allow you to access the pre-installed version of SeaBIOS through the Developer Mode screen in coreboot.

  • Inside your superuser shell enter:

    crossystem dev_boot_usb=1 dev_boot_legacy=1

  • Reboot the machine.

You can now start SeaBIOS by pressing Ctrl + L at the white boot splash screen.

Remove the write-protect screw to Perma-Disable the boot message warning

By removing the bottom panel of the laptop by removing the 12 visible screws and another one underneath the warranty sticker, then separating the plastic starting at the back

Finally completely remove the write-protect screw from the motherboard, which is labelled as #7 in this picture

ChromeeOS will install elementary OS (with ChrUbuntu) and apply automatically all the necessary fixes to run elementary OS on Chromebooks. You will be able to boot in ChromeOS or elementary OS on your Chromebook.

Troubleshooting

Legacy Boot Doesn’t Work

Sometimes it’s possible to break the SeaBIOS install in the flash (sometimes doing innocuous things like tweaking the GBB flags). If you do get into such a situation:

  • Check that dev_boot_legacy is set to 1 when you run crossystem
    • If it isn’t, then see the normal Legacy Boot section above
    • if it is, then see below
You can safely reset the copy of SeaBIOS in your flash by running (as root):

# chromeos-firmwareupdate --sb_extract /tmp
# flashrom -w /tmp/bios.bin -i RW_LEGACY

OwnCloud 7 Digital Ocean Tutorial?

For xUbuntu 14.04 run the following:

sudo sh -c "echo 'deb https://download.opensuse.org/repositories/isv:/ownCloud:/community/xUbuntu_14.04/ /' >> /etc/apt/sources.list.d/owncloud.list"

sudo apt-get update
sudo apt-get install owncloud

You can add the repository key to apt. Keep in mind that the owner of the key may distribute updates, packages and repositories that your system will trust (more information). To add the key, run:

wget https://download.opensuse.org/repositories/isv:ownCloud:community/xUbuntu_14.04/Release.key
sudo apt-key add - < Release.key  

Navigate to your ownCloud instance.

  • If you are installing ownCloud on the same machine as you are accessing the
    install wizard from, the url will be https://localhost/owncloud

Which is better files synchronizer – ownCloud or BitTorrent Sync?

BitTorrent Sync

Share directly from device to device. No cloud. No limits.

Syncthing

Syncthing replaces proprietary sync and cloud services with something open, trustworthy and decentralized. Your data is your data alone and you deserve to choose where it is stored, if it is shared with some third party and how it’s transmitted
over the Internet.

  • Private. None of your data is ever stored anywhere else than on your computers. There is no central server that might be compromised, legally or illegally.
  • Encrypted. All communication is secured using TLS. The encryption used includes perfect forward secrecy to prevent any eavesdropper from ever gaining access to your data.
  • Authenticated. Every node is identified by a strong cryptographic certificate. Only nodes you have explicitly allowed can connect to your cluster.

  • Syncthing in the official Arch Linux [community] repository – Syncthing Forum

Open Development

  • Open Discourse. Development and usage is always open for discussion.

Syncthing Discussion Forum
* Open Source. All source code is available on GitHub — what you see is what you get, there is no hidden funny business.

Syncthing Source Code
* Open Protocol. The protocol is a documented standard — no hidden magic.

Syncthing Protocol Definition
* Open Development. Any bugs found are immediately visible for anyone to browse — no hidden flaws.

Syncthing Issue Tracker

MEGAsync For Linux Desktops MEGA.co.nz Linux Sync Client

MEGAsync for Linux comes with most features available for other similar tools (like Dropbox): the tray icon displays the sync status (and if you use the Nautilus extension, the files have emblems which show their sync status), it supports selective sync, you can use proxies, you can copy a public link for a file via the Nautilus context menu and so on.

There are also some extra features: you can upload a link to MEGA directly from the tray/appindicator app and import links to your MEGA account

MEGA currently provides a multi-platform software development kit, and we have plans to release the source code to MEGAsync under an open-source license.


— PICKS —

Runs Linux

Hackers Run Linux, Acording to NBC

Desktop App Pick

slap

slap is a Sublime-like terminal-based text editor that strives to make editing
from the terminal easier. It has:

  • first-class mouse support
  • GUI editor-like keybindings*
  • copying/pasting with OS clipboard support
  • undo/redo
  • syntax highlighting for many languages
  • a Sublime-like file sidebar
  • select word to highlight other occurrences; double-click to select word
  • easy-to-use finding with regex support
  • bracket matching
  • … many other features that will make you leave nano, vim, and emacs behind

Weekly Spotlight

Simplicity Linux 14.10 Netbook and Desktop Alphas now available

David Purse has announced the availability of the alpha release of Simplicity Linux 14.10, a lightweight Puppy-based distribution with LXDE as the preferred desktop environment: “After a bit of a delay, the Simplicity Linux 14.10 Netbook and Desktop alphas are now available for download. All versions of Simplicity Linux 14.10 alpha are using the 3.15.4 kernel and are based on Puppy Slacko 5.9.3. As usual, Netbook is aimed at users who tend to do things online, but still want a pretty and professional looking desktop. It runs LXDE as the window manager, has Wbar as a dock, and comes complete with Firefox and TOR browser. Desktop 14.10 alpha is aimed at users who want a full-featured desktop Linux. It comes complete with LibreOffice, WINE, Java, VLC and a host of other applications. As with Netbook, it also comes with Firefox and TOR browser built in.” Here is the brief release announcement. Download (MD5): Desktop1410Alpha.iso (580MB), Netbook1410Alpha.iso (324MB).


— NEWS —

Red Hat Developers Introduce New Tool For Linux Storage Management

blivet-gui, a new open-source storage tool designed by Red Hat for configuring disks and file-systems.


This tool replaces the deprecated system-config-lvm storage management tool.

Open WebOS reborn in new LuneOS release

imgurlArea 06-09-14  15_55_24.png

The Open WebOS mobile Linux operating system has been renamed “LuneOS,” and is available in an “Affogato” release supporting HP’s TouchPad and LG’s Nexus 4.

Canonical Releases Ubuntu Developer Tools Center, Makes It Easy To Install Android Studio And Android SDK In Ubuntu

The Ubuntu Developer Tools Center was created, a project to enable quick and easy setup of common developers needs on Ubuntu. For now, Canonical is focusing on Android developers, but more will follow, like Go developers, web developers, Dart and more.

Linux Gaming Round-Up: Borderlands 2, Wasteland 2 & Sanctum 2

In fact, it’s so good that we’re a little swamped by the latest bout of releases, teases and rumours! To help us (and you) get back on top of things, we’ll rattle off the biggest gaming stories of the past fortnight or so in one swoop.

cool-old-term is dead, long live cool-retro-term | Swordfish’s Labs

But why?… Well, cool-old-term was a sort of boilerplate name I chose at the beginning of the project and it stuck when the project became more popular. cool-retro-term keeps familiarity and has a very cool acronym so we can talk nerdy: “Have you tried CRT. It’s really great!”.


— FEEDBACK —

— CHRIS’ STASH —

Hang in our chat room:

irc.geekshed.net #jupiterbroadcasting

— MATT’S STASH —

Find us on Google+

Find us on Twitter

Follow the network on Facebook

Catch the show LIVE Sunday 10am Pacific / 1pm Eastern / 6pm UTC:

The post OwnCloud Your Chromebook | LAS 329 first appeared on Jupiter Broadcasting.

]]>
Man In the Browser Attack | TechSNAP 59 https://original.jupiterbroadcasting.net/19902/man-in-the-browser-attack-techsnap-59/ Thu, 24 May 2012 16:48:35 +0000 https://original.jupiterbroadcasting.net/?p=19902 Yahoo has made a mistake so big, you have to hear it to believe it. And Blizzard's huge security blunder hitting Diablo III customers.

The post Man In the Browser Attack | TechSNAP 59 first appeared on Jupiter Broadcasting.

]]>

post thumbnail

Yahoo has made a mistake so big, you have to hear it to believe it. A common feature in firewalls could actually make you more susceptible attack, Blizzard huge security blunder.

PLUS: Separating traffic out between your network cards, and so much more on this week’s TechSNAP.

Thanks to:

GoDaddy.com Use our codes TechSNAP10 to save 10% at checkout, or TechSNAP20 to save 20% on hosting!

Limited time offer:

New customers 25% off your entire order, code: 25MAY7
Expires: May 31, 2012

 

Direct Download:

HD Video | Mobile Video | MP3 Audio | Ogg Audio | YouTube | Torrent File

RSS Feeds:

HD Video Feed | Mobile Video Feed | MP3 Audio Feed | Ogg Audio Feed | iTunes Feeds | Torrent Feed

Support the Show:

Show Notes:

Yahoo accidentily released the private certificate key for thier new browser extension

  • Yahoo released their new browser extension, a ‘search browser’ called Axis
  • Yahoo accidentally included the private half of their certificate key in the files for the extension
  • This allows anyone with a copy of this key, to sign a new extension and have it appear as if it was legitimately created by Yahoo
  • This could be exploited further, using DNS Spoofing or various other techniques, an attacker could issue an updated version of the Axis plugin, appearing to be signed by Yahoo, but actually containing malware including a key logger and a cookie stealer
  • Yahoo has since released a new version of Axis without the private key
  • It is unclear if Yahoo has taken additional steps beyond publishing the new extension archive without the private key
  • It is imperative that the Yahoo certificate be revoked from trust, meaning Yahoo will need to get a new certificate and resign all of their extensions so they again appear as legitimate
  • Yahoo should probably be using an HSM (Hardware Security Module) to store the private key, rather than having it laying around in a plaintext file
  • Original Discovery
  • Proof of Concept Exploit
  • ThreatPost Coverage
  • Additional Coverage

Researchers find that a common firewall feature makes you more vulnerable

  • Most firewalls include a feature that checks the validity of the TCP initial sequence number (ISN)
  • The ISN is purposely randomized, to prevent spoofed packets from being injected into a TCP stream and prevent TCP session hijacking
  • The main goal of the firewall feature is to conserve bandwidth and other network resources by immediately dropping spoofed or suspicious packets
  • However, if the attacker has malware installed on the target machine behind said firewall, they will be able to determine which packets are being blocked for invalid ISNs and which are not, thus allowing them to determine what are infact valid ISNs
  • Once the attackers has the valid ISN, they can inject data into the TCP stream, and may be able to hijack a connection and present a phishing style login page for services such as facebook
  • Researchers managed to successfully execute a number of different attacks, including the phished facebook login page, injecting javascript to cause users to send tweets and follow people on twitter, injecting malicious links into MSN Messenger conversations between trusted users, and executing DDoS attacks against offsite targets
  • The research focused on mobile devices such as smart phones
  • The researchers found that 31.5% of the 149 mobile network nodes of major US national carriers that they surveyed had firewalls with the ISN tracking feature
  • Research Paper
  • Was presented at the IEEE Symposium on Security and Privacy 2012

New MitB (Man in the Browser) attack targets mobile banking

  • A new trojan called tatanga, uses rootkit type techniques to compromise almost all popular browsers on the windows platform, including: Internet Explorer, Firefox, Chrome, Opera, Safari and Konqueror
  • The trojan also includes elements to remove competing trojans such as the Zeus botnet, and defeat antivirus applications
  • The trojan specifically targets banks in Spain, the United Kingdom, Germany and Portugal
  • The trojan modifies the page inside the browser, so bypasses the encryption of SSL/TLS and even multi-factor login requirements
  • This type of MitB attack is hard to prevent
  • One such way to mitigate these attacks is an out-of-band transaction verification, confirming money transfers with the user outside of their online banking session
  • The tatanga trojan keeps this in mind, and uses social engineering to defeat it
  • When the user logs in to their online banking, passing the multi-factor authentication, the trojan injects a new page in to the user’s browser prompting them to enter a TAN (Transaction Authorization Number) that they will receive via SMS, to verify their login
  • The TAN that the user receives, is actually for the transfer of a large sum of money from their account to that of a mule
  • The trojan instructs users to ignore the specifics on the TAN provided in the SMS, stating that it is experimental, or a test message
  • The effectiveness of the social engineering attack is degraded by the weak writing skills of the author, a future variation of this attack could be far more effective
  • Background on Tatanga
  • Additional Coverage

Feedback:

Q: James asks about routing traffic out different network cards

A:
+ Policy Based Routing on Linux (based on Source Address)
+ Linux Advanced Routing & Traffic Control HOWTO
+ Cross platform policy based routing
+ FreeBSD Example using multiple FIBs
*

Q: Danny asks about Version Control and Auditing

A:

  • Subversion Manual
  • TortoiseSVN Shell Extension for Windows
  • Tortoise and many other SVN clients support a number of different protocols, including https:// and https:// (via WebDAV), svn:// (running an SVN daemon), svn+ssh:// (running the SVN CLI over SSH) and file:/// (directly accessing the repository, possible over windows file sharing or NFS)

Round Up:

The post Man In the Browser Attack | TechSNAP 59 first appeared on Jupiter Broadcasting.

]]> Sick Beard Review | In Depth Look https://original.jupiterbroadcasting.net/15456/sick-beard-review-in-depth-look/ Fri, 06 Jan 2012 19:19:56 +0000 https://original.jupiterbroadcasting.net/?p=15456 A PVR for the Internet? Find out how this open source tool can be used to download TV off the net, or just a good clean organizational tool!

The post Sick Beard Review | In Depth Look first appeared on Jupiter Broadcasting.

]]>

post thumbnail

A PVR for the Internet? Find out how this open source tool can be used to download TV off the net, or just a good clean organizational tool!

What is sick beard? It\’s a server-side application that can be used to to automate downloading of TV episode releases from USENET or Torrents. Or at the very least, to organize your media collection better.

I don\’t support piracy. But lets be honest, the failing traditional media companies continue to restrict how consumers use content. They model was outdated years ago, and today just feels draconian.

So lets start by chatting about how you can use Sick Beard just for good, clean, organization fun! Then after that, I\’ll arm you with the info you need, if you want to take things further.

Direct Download:

HD Download | Mobile Download | MP3 Download | Ogg Download | YouTube

RSS Feeds:

HD Feed | Mobile Feed | MP3 Feed | Ogg Feed | iTunes HD Feed

Support Jupiter Broadcasting with your Purchase:

[asa default]B0038JE07O[/asa]

Guides:

Note: When you\’re first configuring Sick Beard it may be more convenient to use Sickbeard-console.exe which will allow you to monitor the console while it\’s running.

DOUBLE Note: Sick Beard does not actually download TV episodes! It has no download functionality at all, it simply watches RSS feeds and integrates with your existing download applications if possible.

What is USENET?

The post Sick Beard Review | In Depth Look first appeared on Jupiter Broadcasting.

]]>
Skype Exposes Pirates | TechSNAP 29 https://original.jupiterbroadcasting.net/13262/skype-exposes-pirates-techsnap-29/ Thu, 27 Oct 2011 18:43:12 +0000 https://original.jupiterbroadcasting.net/?p=13262 Researches have developed a way to tie your file sharing to your Skype account. We’ll share the details on how this works, and what you can do to prevent it!

The post Skype Exposes Pirates | TechSNAP 29 first appeared on Jupiter Broadcasting.

]]>

post thumbnail

Coming up on this week’s TechSNAP…

Researches have developed a way to tie your file sharing to your Skype account. We’ll share the details on how this works, and what you can do to prevent being tracked!

Plus we cover the Ultimate way to host your own email, and what happened when Chinese hackers took control of US Satellites!

All that and more, on this week’s episode of TechSNAP!

Direct Download Links:

HD Video | Large Video | Mobile Video | MP3 Audio | OGG Audio | YouTube

Subscribe via RSS and iTunes:


[ad#shownotes]

Show Notes:

Audible.com:

Suspected Chinese Military Hackers take control of US Satellites

  • On four separate occasions during 2007 and 2008 US satellites were hijacked by way of their ground control stations.
  • The effected satellites were Landsat–7 (Terrain Mapping and Satellite Photography, example 1 example 2) and Terra AM–1 (Climate and Environmental Monitoring, 2010 Hurricane Karl)
  • While the US does not directly accuse the Chinese government in writing, these types of actions are consistent with known war plans that involve disabling communications, command and control, and GPS satellites as a precursor to war.
  • In one incident with NASA’s Terra AM–1, “the responsible party achieved all steps required to command the satellite,” however the attackers never actually took control of the satellite.
  • It was not until the 2008 investigation that the previous compromises in 2007 were detected
  • This raises an important question, are the US military and other NATO members, too reliant of satellite communications and GPS?
  • In a recent NATO exercise called ‘Joint Warrior’, it was planned to jam GPS satellite signals, however the jamming was suspended after pressure on the governments over civilian safety concerns. Story

Researchers develop a procedure to link Skype users to their Bittorrent downloads

  • The tools developed by the researchers at New York University allow any to determine a strong correlation between bittorrent downloads and a specific skype user.
  • Importantly, unlike RIAA/MPAA law suites, the researchers consider the possibility of false positives because of multiple users behind NAT.
  • The researchers resolve this issue by probing both the skype and bittorrent clients after a correlation is suspected. By generating a response from both clients at nearly the same time and comparing the IP ID (similar to a sequence number) of the packets, if the ID numbers are close together, than it is extremely likely that the response was generated by the same physical machine. If the IDs are very different, then it is likely that the Skype and BitTorrent users are on different machines, and there is no correlation between them.
  • This same technique could be made to work with other VoIP and P2P applications, and could be used to gather enough evidence to conclusively prove a bittorrent user’s identity.
  • This situation can be mitigated by using the feature of some OS’s that randomizes the IP ID to prevent such tracking. (net.inet.ip.random_id in FreeBSD, separate ‘scrub random-id’ feature in the BSD PF firewall)
  • The discovery could also be prevented by fixing the skype client such that it will not reply with its IP address if the privacy settings do not allow calls from that user. The current system employed by the researches does not actually place a call to the user, just tricks skype into thinking that a call will be placed, and skype then leaks the sensitive information by returning its IP address or initiating a connection to the attacker.
  • Read the full research paper

NASDAQ web application Directors Desk hacked

  • Directors Desk is a web application designed to allow executives to share documents and other sensitive information
  • When NASDAQ was hacked in February, they did not believe that any customer data was stolen
  • The attackers implanted spyware into the Directors Desk application and were able to spy on the sensitive documents of publicly traded companies as they were passed back and forth through the system
  • This is another example of the Advanced Persistent Threat (APT) as we saw with the RSA and South Korea Telecom hacks, where the attackers went after a service provider (in his case NASDAQ) to compromise the ultimate targets, the publicly traded companies and their sensitive documents.
  • It is not known what if any protection or encryption systems were part of Directors Desk, but it seems that the application was obviously lacking some important security measures, including an Intrusion Detection System that would have detected the modifications to the application.

SEC says companies may need to disclose cyber attacks in regulatory filings

  • The new guidance from the SEC spells out some of the things that companies may need to disclose to investors and others, depending upon their situation.
  • Some of the potential items companies may need to disclose include:
  • Discussion of aspects of the registrant’s business or operations that give rise to material cybersecurity risks and the potential costs and consequences
  • To the extent the registrant outsources functions that have material cyber security risks, description of those functions and how the registrant addresses those risks
  • Description of cyber incidents experienced by the registrant that are individually, or in the aggregate, material, including a description of the costs and other consequences
  • Risks related to cyber incidents that may remain undetected for an extended period
  • “For example, if material intellectual property is stolen in a cyber attack, and the effects of the theft are reasonably likely to be material, the registrant should describe the property that was stolen and the effect of the attack on its results of operations, liquidity, and financial condition and whether the attack would cause reported financial information not to be indicative of future operating results or financial condition,” the statement says.
  • From the SEC guidance: The federal securities laws, in part, are designed to elicit disclosure of timely, comprehensive, and accurate information about risks and events that a reasonable investor would consider important to an investment decision”
  • CF Disclosure Guidance: Topic No. 2 – Cybersecurity

Feedback:

It is definitely advantageous to own the domain that your email address is on. On top of looking more professional than a hotmail, or even gmail address, it also allows you to choose your host and have full control over everything. There are some caveats though, of course you must remember to renew your domain name, else your email stops working (just ask Chris about that one), you also have to be careful about picking where to host your domain, having your site or email hosted by a less reputable service can result in your domain being included on blacklists and stopping delivery of your mail to some users. The biggest problem with hosting your own email, from your home, is that you must keep the server up 24/7, and it must have a reasonable static IP address. If you are going to host from your home, I recommend you get a ‘backup mx’ service, a backup mail server that will collect mail sent to you while you are offline, and then forward it to your server when it is back up. Even if you are using a dedicated server or VPS, this is important, because email is usually the most critical service on your server. The other major issue with hosting your email from home, is that most ISPs block port 25 inbound and outbound, to prevent infected computers from sending spam. This means that you will not be able to send or receive email to other servers. Usually your ISP will require you to have a more expensive business class connection with a dedicated static IP address in order to allow traffic on port 25. Also, a great many spam filtering systems, such as spamassassin, use blacklists that contain the IP ranges of all consumer/home Internet providers, designed to stop spam from virus infected machines, because email should not be send from individual client machines, but through the ISP or Domain email server.

Round Up:

The post Skype Exposes Pirates | TechSNAP 29 first appeared on Jupiter Broadcasting.

]]>