wipe – Jupiter Broadcasting

Leaky Pumps | TechSNAP 332

chris — Tue, 15 Aug 2017 23:35:33 +0000

RSS Feeds:

HD Video Feed | MP3 Audio Feed | iTunes Feed | Torrent Feed

Become a supporter on Patreon:

Show Notes:

Gas Pump Skimmer Sends Card Data Via Text

Skimming devices that crooks install inside fuel station gas pumps frequently rely on an embedded Bluetooth component allowing thieves to collect stolen credit card data from the pumps wirelessly with any mobile device. The downside of this approach is that Bluetooth-based skimmers can be detected by anyone else with a mobile device. Now, investigators in the New York say they are starting to see pump skimmers that use cannibalized cell phone components to send stolen card data via text message.
Skimmers that transmit stolen card data wirelessly via GSM text messages and other mobile-based communications methods are not new; they have been present — if not prevalent — in ATM skimming devices for ages.
But this is the first instance KrebsOnSecurity is aware of in which such SMS skimmers have been found inside gas pumps, and that matches the experience of several states hardest hit by pump skimming activity.
see also Gas Theft Gangs Fuel Pump Skimming Scams

Erasing hard drives – dd might be enough – Dan talks about how he erased the drives

I recently upgraded several 3TB drives to 5TB drives and no longer needs the smaller drives. I usually used DBAN, but this time, it failed to run and I have no idea why
I started looking around for upgrades in case my newer hardware didn’t work with this version of DBAN
In September 2012, Blancco of Finland announced its acquisition of DBAN – Windows binary – no use to me
There is an unofficial fork of DBAN that is actively maintained. The dwipe program that DBAN uses has been forked and is available as a standalone program called Nwipe, which is actively maintained.
Appears to be more than one unofficial dban fork
nwipe is included with Parted Magic so I paid my $11 and downloaded UNetbootin and tried to install it
I failed to get my latest version (2017_06_03) of Parted Magic to boot so I resorted to letting UNetbootin download and install Latest_Live and I think that was 2.4
I was told DBAN is drive abuse and that dd is sufficient
Highly recommended NAS configuration – KIds don’t try this at home!
Originally thought to be serial, butlater confirmed to work in parallel
Discussion on: when you power cycle, how long do you want to power on?
Next, tried nwipe but found that that took too long
Going back to Parted Magic, I found the disk erase UI to have a few interesting features
Then, I managed to get my SAS2008 card to work, and started doing 8 drives at a time
dd is always an option, but I found it more convenient to use Parted Magic. Why? I didn’t have to script it and I can use the Secure Erase feature

Feedback

A question about database migrations – apgdiff SQL Manager – SQLFairy – Dan used to use a tool for designing the database, but hasn’t use one lately. Now he constructs the DDL on the fly to amend the database and keeps them aside for upgrading the production database. Dan once kept the DDL for FreshPorts in a repo, but no longer does. Now he just backs up.
ZFS Configuration new System76 Oryx pro
Nigel Brownsey wrote in about Password security all about length
PostgreSQL password hashing & backups

Round Up:

The HDFS Juggernaut – Hadoop Distributed File System
Plans for Partitioning in PostgreSQL v11
debian-policy: Packages should be reproducible
Everything You Always Wanted to Know
About Optical Networking –
But Were Afraid to Ask
slides – Youtube video
Looking at public Puppet servers
Airbnb’s preferred smart lock vendor accidentally bricks 500 door-locks
I Bought a Book About the Internet From 1994 and None of the Links Worked

The post Leaky Pumps | TechSNAP 332 first appeared on Jupiter Broadcasting.

Chris’ Lifestyle Reboot | Tech Talk Today 137

chris — Fri, 20 Feb 2015 11:49:36 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

We round off the week’s tech news & follow up on the big Lenovo story & discuss HP’s push into Linux powered Networking.

Then Chris share’s the start of his lifestyle reboot & then a in depth discussion on getting into the IT job market.

Direct Download:

RSS Feeds:

Become a supporter on Patreon

Show Notes:

Lenovo To Wipe Superfish Off PCs t

An anonymous reader send news from the Wall Street Journal, where Lenovo CTO Peter Hortensius said in an interview that the company will roll out a software update to remove the Superfish adware from its laptops. “As soon as the programmer is finished, we will provide a tool that removes all traces of the app from people’s laptops; this goes further than simply uninstalling the app. Once the app-wiping software is finished tonight or tomorrow, we’ll issue a press release with information on how to get it.” When asked whether his company vets the software they pre-install on their machines, he said, “Yes, we do. Obviously in this case we didn’t do enough. The intent of loading this tool was to help enhance our users’ shopping experience. The feedback from users was that it wasn’t useful, and that’s why we turned it off. Our reputation is everything and our products are ultimately how we have our reputation.”

HP Targets Cisco and Facebook With New Line of Open-Source Networking Gear

Hewlett-Packard said on Thursday that it would sell a new line of networking switches that are manufactured by a Taiwanese company and depend on Linux-based, open-source software from another company.

Epic Games offers up $5 million in Unreal Dev Grants

Today Epic Games has announced a new initiative — one that could see your game netting between $5,000 and $50,000 in no-strings-attached funding from the engine provider.

HEALTH WATCH: sweatthesweetstuff — Eating healthy doesn’t have to be boring and that working out can be fun!

I want people to understand their bodies. To know that there is a connection between what we put in it and on it, and how that makes us feel. That eating right isn’t just about losing weight, it’s about how good we can feel! On the inside and out. It doesn’t stop at our dress size and energy levels (which are great) but it can help improve other things like your skin, hair & nails, achy joints, headaches, allergies, asthma, your menstrual cycle, IBS, indigestion, several diseases, even cancer. Your body is smart. It knows what to do. You just have to give it the right stuff.

The post Chris' Lifestyle Reboot | Tech Talk Today 137 first appeared on Jupiter Broadcasting.

Brazil Remote Wipes Your Junk | Tech Talk Today 47

chris — Thu, 21 Aug 2014 09:40:34 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

A court injunction demands Apple, Google, and Microsoft remove a “forbidden” app off thousands of users phones, reports claim Verizon is launching its own app store, which they have flat out denied & we acknowledge the sunset of a PC classic.

Direct Download:

RSS Feeds:

MP3 Feed | OGG Feed | iTunes Feed | Video Feed | Torrent Feed

Become a supporter on Patreon:

Show Notes:

Verizon denies plan to launch its own Android app store (update) | The Verge

Verizon is going to launch its own app store in an effort to compete with the Google Play Store on Android devices, claims a report from The Information. The new store will be available globally and is the result of a partnership with other carriers and hardware makers, says the report. In 2010, Verizon Wireless launched a similar app store for Android and BlackBerry smartphones in the US, but it shuttered it in January 2013. The Information says the discussions for a new app store are still in an early stage, and there is not a concrete date for when it would launch.

However, Recode received a statement from Verizon saying that the carrier had no plans to offer a new app store. “We have no plans to do that,” Verizon spokeswoman Debra Lewis said. “Been there. Done that.” Amir Efrati from _The Information _tweeted the following in response: “I and @theinformation stand by this report 100%.” Efrait also said that “Verizon’s comment is misleading.”

The Information claims that this new effort is a response to recent cutbacks from Google in revenue sharing with carriers and hardware makers for apps sold through the Google Play Store. Verizon would be stemming future losses with its own app store, as revenues from app store sales are expected to grow significantly over the next few years. The report says that Verizon would also use data like location, time of day, and social indicators to recommend apps to users.

Brazil Court Issues Injunction Against Secret And Calls For App To Be Remotely Wiped | TechCrunch

A court in Brazil has ruled (via UOL) that Apple and Google must remove Secret, the anonymous social networking app, from their mobile software stores — and also from user devices where it’s already installed. The court has issued a preliminary injunction in the case, pending the results of a final ruling, as a result of a complaints by users harmed by rumors spread via the app, who said that the app was used to share an “intimate photo” of him, which included personal identifying information including his full name and telephone number.

The injunction actually goes so far as to require that the companies remotely wipe the app from existing devices. That’s a tall order, of course, but the court has also applied a fine of around $9,000 per day following a 10-day grace period in case the rules haven’t been followed.

Uber Opens Its API With 11 Launch Partners, Including OpenTable, TripAdvisor, and United Airlines | TechCrunch

Today, the company is announcing its API will become available to app developers, with 11 launch partners already signed up.

For Uber, the introduction of its API is designed to increase reach and get it in front of lots of new potential users. The company is in 150 cities and nearly 50 countries around the world, but there are untold number of users who might not have tried its service. Showing up in other apps that those users already have installed is a simple way to introduce them to getting an Uber on-demand.

While it’s trying to appeal to as many app developers as possible, to start Uber is launching with 11 API partners that have already committed to introducing Uber to their users. Those apps include Expensify, Hinge, Hyatt Hotels & Resorts, Momento, OpenTable, Starbucks, Tempo, Time Out, TripAdvisor, TripCase, and United Airlines.

Samsung’s first Nook tablet arrives at Barnes & Noble today for $179 | The Verge

Samsung is becoming Barnes & Noble’s first partner to create a Nook-branded tablet today with the unveiling and release of the Galaxy Tab 4 Nook. The name is a mouthful, but it basically means that the tablet is a rebranded version of Samsung’s existing Galaxy Tab 4 tablet — part of its low-end line — that’s now been customized with some Nook software. The tablet has a 7-inch, 1280 x 800 display and will sell for $179.

Feedback:

Loading poll…

If Distros were super hereos thread

Blizzard Not Expecting Major World Of Warcraft Growth

In a recent interview with MCV, World of Warcraft lead designer Tom Chilton admitted that Blizzard isn’t expecting to see the MMORPG grow like it did prior to the Cataclysm release. That’s likely because the subscription numbers have been on a steady decline since 4Q 2010

As of Q2 2014, World of Warcraft had 6.8 million subscribers. The upcoming fifth expansion pack, Warlords of Draenor, is expected to bring some players back. Previously, Blizzard indicated that it’s not unusual to see customers cancel their subscription until a new expansion arrives. Once that’s consumed, they will cancel again and wait for new content.

Last week, Blizzard announced that the upcoming Warlords of Draenor will be released on November 13, 2014.

The post Brazil Remote Wipes Your Junk | Tech Talk Today 47 first appeared on Jupiter Broadcasting.

Password SecuritIEEE | TechSNAP 77

chris — Thu, 27 Sep 2012 16:30:08 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

A big password leak from a major industry player, mobile security takes a big hit, we cover a couple of the major vulnerabilities affecting our favorite gadgets, and more Java troubles.

Plus moving from Apache to Nginx, and a big batch of your questions.

All that and so much more, on this week’s TechSNAP!

Thanks to:

GoDaddy.com

Use our codes TechSNAP10 to save 10% at checkout, or TechSNAP20 to save 20% on hosting!

BONOUS ROUND PROMO:

Get your .COMs just $5.99 per year up to 3 domains! Additional .COMs just $7.99 per year!
CODE: 599tech

Expires 10/31/12

SPECIAL OFFER! Save 20% off your order!
Code: go20off5

Pick your code and save:
techsnap7: $7.49 .com
techsnap10: 10% off
techsnap11: $1.99 hosting for the first 3 months
techsnap20: 20% off 1, 2, 3 year hosting plans
techsnap40: $10 off $40
techsnap25: 25% off new Virtual DataCenter plans
techsnapx: 20% off .xxx domains

Direct Download:

RSS Feeds:

Support the Show:

Purchase anything at Amazon.com
Purchase anything at Think Geek using this link
Purchase anything at Newegg using this link
Contribute directly on our donation page or check out our advertising options and reach millions of amazing people!
Grab our Chrome Extension and auto-tag your shopping session for us!

Fill out my Wufoo form!

Show Notes:

Get TechSNAP on your Android:

Browser Affiliate Extension:

Jupiter Broadcasting Affiliate Extensions for Chrome and Firefox

Virgin Mobile USA customers may be at risk

Virgin Mobile customers in the USA access their customer portal using their mobile phone number and a 6 digit pin
In addition to the obvious lack of security of using such a limited keyspace, it seems that the Virgin portal does not implement any type of lockout or intrusion detection
Specifically, they do not block an IP after 100s of failed attempts, meaning an attacker can quickly run through the entire 1 million possible passwords and gain access to any account
Kevin Burke, the researcher who discovered the flaw, said that after several phone and email exchanges with parent company Sprint in which he attempted to warn them about the exploit, he was ignored and his concerns were dismissed
Later, a fix was applied to the portal, blocking users after 4 failed attempts, however it relied on a browser cookie to keep track of the number. In additional to how easily this mitigation is evaded, most attack scripts don’t keep cookies anyway
Virgin’s portal now correctly blocks an IP address after 20 failed attempts
Virgin uses a 404 error instead of 503 or another more proper error code
Additional Coverage

Security Explorations finds another Java 0-day, for Java SE 5, 6 and 7

Security Explorations, the Polish research firm that found the previous Java exploits, has now topped 50 different vulnerabilities reported to Oracle, and the 50th one is the worst to date
The flaw affects fully patched Windows 7 machine, using all major browsers
Oracle has produced a comprehensive status report regarding upcoming Java Critical Patch Update. The company claims to have fixes for all, except two issues (29 and 50) integrated and undergoing testing for release in the October 2012 Java SE CPU. Oracle is still evaluating fixes for Issue 50 and will provide further update on whether a fix for it will be also included in the October 2012 Java SE CPU
Additional Coverage

IEEE passwords exposed via FTP site

A researcher found a log file on a publically accessible IEEE FTP site
The file contained logs from 01/Aug/2012:20:46:28 +0000 to 18/Sep/2012:08:47:17 +0000
The log contained around 375 million lines, 400,000 of which contained plain text passwords, 17k of which were password reset requests
A total of 99,979 unique usernames were found
7 of the top 10 passwords were all numeric, variations of 123 – 1234567890
Other popular passwords included ieee2012, IEEE2012, password, library and ADMIN123
38% of users use gmail, 7.6% use yahoo
It does not appear that the IEEE actually stores usernames and passwords in plaintext in its authentication database, but it is unclear why or how the passwords were included in the access logs
The IEEE acknowledged the breach
And issues a notice to its members, encouraging them to use strong passwords when they are forced to reset thier password
Additional Coverage

Your Android phone could be remotely erased by a malicious website

Security Researcher Ravi Borgaonkar revealed the exploit at ekoparty 2012
An apparent bug in the Samsung TouchWiz UI makes it possible for a malicious website or remote attacker to reset your Android device
The vulnerability can be exploited via NFC, QR code, SMS, or a web link
Remote wipe attack not limited to Samsung phones, Android dialer may be to blame
The vulnerability may actually be in the Android dialer, which would mean all devices are vulnerable
As a temporary fix you can get the TelStop app, which publishes a URL handler for tel: URLs and prevents the exploit from being used via websites
Additional Coverage:
Major Samsung Galaxy TouchWiz exploit hard resets a device by just visiting a website
Critical vulnerability in Samsung Galaxy S3, possibly other smartphones. – Spiceworks
Samsung has released new firmware that resolves the issue
- Samsung applies quick patch to dailer vulnerability

Feedback:

spleeeem submitted something handy for a common theme on our show, secure passwords: Password Storage Cheat Sheet
Best Way to Migrate a lot of Sites from Apache to NGINX
How to benchmark nginx?
Why can’t you just send the “finished” hash?
Mail Server with Blocked Port 25?
I wonder if I could get your thoughts on https://www.sendfilessecurely.com
Followup: rikai found an SSH SVR record wrapper script

Book: Nginx HTTP Server

It provides a step-by-step tutorial to replace your existing web server with Nginx. With commented configuration sections and in-depth module descriptions

Have some fun:

What will be in the news the week in October when Allan is at Euro BSD Con? Let make a prediction on the head lines or just make up funny stuff to read

What I wish the new hires “knew”

Round-Up:

Adobe Announces Rapid Release Cycle for Flash Player
Compromised phpMyAdmin download reinforces importance of verifying checksums . SourceForge is investigating how the copy of the file on a Korean mirror was compromised and downloaded by over 400 users
Android 4.0.4 NFC vulnerability exposed at Pwn2Own contest
How to build a passive ethernet tap, to spy on traffic as it crosses the wire
Microsoft may have known about IE 0-day flaw for months, credit goes to “TippingPoint Zero Day Initiative” on July 24th, not to researcher who disclosed the flaw in September
Bruce Schneier doesn’t want his algorithm, or any other, to win the SHA–3 competition
Guild Wars 2’s Mike O’Brien on Account Security

HALL of SHAME: Secret Microsoft policy limited Hotmail passwords to 16 characters

The post Password SecuritIEEE | TechSNAP 77 first appeared on Jupiter Broadcasting.

Not So Secret Answers | TechSNAP 70

chris — Thu, 09 Aug 2012 16:02:55 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

A Gawker Reporter’s entire online presence is hacked, and all his devices wiped. We’ll walk you through the details of this attack, and why it suggests we might be facing some fundamental challenges.

Plus: Your questions, our answers, and so much more.

On this week’s TechSNAP!

Thanks to:

GoDaddy.com

Use our codes TechSNAP10 to save 10% at checkout, or TechSNAP20 to save 20% on hosting!

SPECIAL OFFER! Save 20% off your order!
Code: go20off5

Pick your code and save:
techsnap7: $7.49 .com
techsnap10: 10% off
techsnap11: $1.99 hosting for the first 3 months
techsnap20: 20% off 1, 2, 3 year hosting plans
techsnap40: $10 off $40
techsnap25: 25% off new Virtual DataCenter plans
techsnapx: 20% off .xxx domains

Direct Download:

RSS Feeds:

Support the Show:

Purchase anything at Amazon.com
Purchase anything at Think Geek using this link
Purchase anything at Newegg using this link
Contribute directly on our donation page or check out our advertising options and reach millions of amazing people!
Grab our Chrome Extension and auto-tag your shopping session for us!

Fill out my Wufoo form!

Show Notes:

Gawker Reporter gets entire online presense hacked

Gawker Reporter and formed Wired editor Mat Honan had his entire digital life destroyed in a matter of minutes last week
A hacker going by the pseudonym Phobia, originally targeted Mat’s twitter account because of its 3 character username
The @mat twitter account linked to Mat’s personal website, which listed his gmail address
The attacker then started the password recovery process to reset the password of the gmail account
Since the gmail account had not been configured for two-factor authentication, the reset option was to send a new password to the alternate account configured in gmail
The address of this account is obscured and displayed so you know which email to go check, but when the alternate address for mhonan@gmail.com is displayed as m*****n@me.com it is pretty easy to guess the email address
Now, in order to reset the password of the AppleID, the attackers would normally need the answers to the account’s “Secret Questions”, however, there is a fallback method, when these cannot be provided by the customer
Apple only requires that you provide the billing address and last for digits of the credit card on file for the account
The billing address is fairly easy to come by (phone book, domain whois, people search, blog posts, etc), but the last four digits of the credit card number are less so
Since the hacker knew the victims email address, the next target of the attack was Amazon.com
The attacker had an associate call Amazon and claim to be the victim, wanting to add a new credit card to the account. This process only requires knowing the account holders name, billing address, and the new credit card (Adding a new credit card to your account does not seem like a high security operation, and it would seem to make sense for companies to make this process as easy as possible)
The trick is, you then call Amazon back, and now you are able to provide the account holders name, billing address, and current credit card number. With this information to verify your identity, you are able to change the email address on the account, to one that you control
Now that you control the Amazon account, you simply login, and look at the other cards on file, you don’t get to see the entire credit card number, but the first and last 4 digits are displayed, so that customers can identify which card is which
With that information in hand, it now time to call AppleCare, and reset the password on the AppleID, gaining you access to the iCloud account and @me.com email address of your victim
Next you can reset the password of the gmail account, and then once you control that, reset the password of the twitter account
Now, if you want to prevent your victim from interfering with your actions, you need to disable their ability to fight back. This is where iCloud’s ‘Find My’ service comes into play
The attacker used the service to initiate a remote wipe of the victim’s iPhone, iPad and MacBook, as part of this process, the devices are also locked with a PIN code, which only the attacker has
The next step was to delete the gmail account, so it couldn’t be used to regain control of the twitter account. Normally you are able to undelete a gmail account, however it requires external verification, in this case via a text message to the cell phone tied to the gmail account, which the victim had not yet regained control of
All of this points out that the serious weak link in most all security systems, are the people, and the ways around the security systems we put in place, for when people forget their passwords
As we have seen in other cases like this, with some basic personal information that is pretty easy to acquire, and attacker could have transferred the phone service from the victim’s cell phone to another device in order to intercept verification text messages from services such as gmail or the victim’s online banking
Mat Honan admits that a number of the security problems that made this attack possible were his own fault, not having recent backups of his devices, not using two-factor authentication for gmail and other services and having only a 7 character password for his AppleID (although this didn’t factor into this attack as originally believed, it is still a security failure)
Wired did its own tests using the methodology that the attacker claimed to have used, and was able to completely compromise two other Wired employees
Apple and Amazon have both since stopped doing password resets over the phone

Secret Questions Don’t Work

The problem with Secret Questions is that in order for a question to be general enough that it will apply to most people and static enough that the answer won’t change by time you need to use the questions to recover your password, the answers end up being very generic and can usually be found with a bit of research
You also have to consider who may be attacking your secret questions, if the question is “What was the name of your first Teacher”, what if the attacker is someone you went to school with?
Another problem is how strictly the answers are verified, a common security question when calling your credit card company is your mother’s maiden name. In a great deal of cases, if you just mumble something this will be accepted and you will be able to make changes to the account
A good security question must maximize these four criteria:
Definitive: there should only be one correct answer which does not change over time.
Applicable: the question should be possible to answer for as large a portion of users as possible (ideally, universal).
Memorable: the user should have little difficulty remembering it
Safe: it should be difficult to guess or find through research
Feedback: Send in your ideas for good secret questions, and we’ll critique some of the suggestions next week
Bruce Schneier on Secret Questions

Feedback:

Round-Up:

The post Not So Secret Answers | TechSNAP 70 first appeared on Jupiter Broadcasting.

How Malware Makes Money | TechSNAP 31

chris — Thu, 10 Nov 2011 18:18:24 +0000

The FBI shuts down a cyber crime syndicate, and we’ll tell you just how much profit they were bring in.

Plus we’ll cover how to securely erase your hard drive, Xbox Live’s minor password leak, how researches remotely opened prison cell doors, in my own state!

All that and more, on this week’s episode of TechSNAP!

Thanks to:

GoDaddy.com Use our codes TechSNAP10 to save 10% at checkout, or TechSNAP20 to save 20% on hosting!

Pick your code and save:

techsnap7: $7.49 .com
techsnap10: 10% off
techsnap20: 20% off 1, 2, 3 year hosting plans
techsnap40: $10 off $40
techsnap25: 25% off new Virtual DataCenter plans

Direct Download Links:

Subscribe via RSS and iTunes:

Fill out my Wufoo form!

Show Notes:

FBI takes out malware operation that illicitly made 14 million dollars

The malware was said to have infected as many as 4 million computers in 100 countries
Atleast 500,000 infected machines in the USA alone
Operation Ghost Click resulted in indictments against six Estonian and one Russian national. The Estonians were taken in to custody by local authorities and the US is seeking to extradite them.
The malware, called DNSChanger, changed the users DNS servers, to use rogue servers run by the botnet operators, and allowed the attackers to basically perform man-in-the-middle attacks against any site they wished.
The attackers redirected all traffic related to Apple and iTunes to a site that sold fake apple software and pirated music.
The attackers also stole traffic from legitimate advertising networks and replaced it with their own network, charging advertisers for their ill gotten traffic.
The malware also blocked windows update and most known virus scanners and help sites.

Pastebin of XBox Live IDs and passwords published

The pastebin contained 90 game tags, passwords and possibly email addresses
Microsoft says that they do not believe their network was compromised, and that this list is the result of a small scale phishing attack
The size of the credential dump seems to support that conclusion
Regardless, it is recommended that you change your XBox Live password, and the password on any other service that shared the same password, especially the email address used for your XBox Live.

Researchers Uncover ‘Massive Security Flaws’ In Amazon Cloud

The vulnerability (since fixed) allowed an attacker to completely take over administrative rights on another AWS account, including starting new EC2 and S3 instances, and deleting instances and storage
An attacker could have run up a huge bill very quickly, and it would appear legitimate.
Using EC2 to crack passwords becomes even more effective when someone else is paying for your instances
The vulnerability was exploited using an XML signature wrapping attack, allowing them to modify the signed message while still having it verify as unmodified.
Amazon said “customers fully implementing the AWS security best practices were not susceptible to these vulnerabilities”
Previous Article about Amazon AWS Security
The previous article mostly covers vulnerabilities created by users of AWS, including people publicly publishing AMIs with their SSH keys still in them.

Prison SCADA systems vulnerable to compromise

Researchers have been able to compromised the SCADA systems and open/close cell doors, overload door mechanisms so they cannot be open/closed, and disable the internal communications systems.
The researches worked in one of their basements, spent less than $2,500 and had no previous experience in dealing with these technologies.
Washington Times Article confirms that the research was delivered to state and prison authorities, and that Homeland Security has verified the research
Researchers were called in after an incident where all of the cell doors on death row at once prison opened spontaneously
While the SCADA systems are not supposed to be connected to the Internet, it was found that many of them were.
Some were used by prison staff to browse the Internet, leaving them open to malware and other such attacks.
While others had been connected to the Internet so they could be remotely managed by consultants and software vendors
Even without the Internet, researchers found that the system could be compromised by an infected USB drive, connected to the
SCADA system either via social engineering or bribery of prison employees.

Feedback:

Simon asks about destroying your data before recycling/selling your used hard drives

There are a number of tools that will overwrite the contents of your hard drive a number of times in various patterns. The goal here is to ensure that any data that was on the drive can not be recovered. There is never a guarantee that the data will not be recoverable.
Allan Recommends: DBAN – Darik’s Boot And Nuke
It is still a very good idea to overwrite the data on your disks before you recycle/sell them. The methods are slightly different now, specifically, some methods such as the ‘Gutmann Wipe’ which was designed for a specific type of disk encoding that is no longer users in modern hard drives are no longer effective.
DBAN supports a number of methods:
PRNG Stream (recommend) – literally overwrites the entire drive with a stream of data from the Pseudo Random Number Generator. It is recommended that you use 4 passes for medium security, and 8 or more passes for high security.
DoD 5220.22-M – The US Department of Defence 7 pass standard. The default is DBAN is the DoD Short, which consists of passes 1, 2 and 7 from the full DoD wipe.
RCMP TSSIT OPS-II – The Canadian governments “Technical Security Standard for Information Technology”: Media Sanitization procedure. (8 passes)
Quick Erase (Not recommended) – Overwrite the entire drive from 0s, only 1 pass. This is designed for when you are going to reuse the drive internally, and is not considered secure at all
DBAN also verifies that the data was overwritten properly, by reading back the data from the drive and verifying that the correct pattern is found.
I am not certain about the answer to your question concerning SD cards and other flash storage not in the form of a hard disk. A file erasure utility may be the only option if the device does not actually accept ATA/SCSI commands (careful, some USB devices pretend to accept the commands but just ignore ones they do not understand)
Simon’s method of using the shred utility (designed to overwrite an individual file) on the block device, is not recommended. a proper utility like DBAN uses ATA/SCSI commands to tell the disk to securely erase it self, which involves disabling write caching, and erasing unaddressable storage such as those that have been relocated due to bad sectors.
Special consideration should be given to SSDs, as they usually contain more storage than advertised, and as the flash media wears out, it is replaced from this additional storage. You want to be sure your overwrite utility overwrites the no-longer-used sectors as they will still contain your data. This is why a utility that uses the proper ATA/SCSI commands is so important.
A utility like DBAN is also required if the disk contained business or customer data. Under legislation such as PIPEDA (Personal Information Protection and Electronic Documents Act, Canada), HIPAA and Sorbanes-Oxley (USA), the information must be properly destroyed.

Round UP:

ZFS Server Build Progress:

Finalized Parts List
Parts Summary:
Supermicro CSE–829TQ-R920UB Chassis
- 8 hot swapable SAS bays
- dual redundant 920 watt high-efficiency PSUs
Supermicro X8DTU–6F+ motherboard
- Dual Socket LGA 1366
- 18x 240pin DDR3 1333 slots (max 288GB ram)
- Intel 5520 Tylersburg Chipset, ICH10R
- LSI 6Gb/s SAS Hardware RAID controller
- Intel ICH10R SATA 3Gb/s SATA Controller
- IPMI 2.0 with Virtual Media and KVM over LAN
- Dual Intel 82576 Gigabit Ethernet Controller
Dual Intel Xeon E5620 Processors (4×2.4Ghz, HT, 12MB Cache, 80W)
48GB DDR3 1333mhz ECC Registered RAM
2x Seagate Barracuda XT 2TB SATA 6Gb/s 7200rpm Drives (for OS)
9x Seagate Consellsation ES 2TB SAS 6Gb/s 7200rpm Drives (8x for RAID Z2, 1x cold spare)
Adaptec RAID 6805 Controller (8 Internal drives, supports up to 256 drives, 512mb DDR2 667 cache)
Adaptec AFM 600 Flash Module (Alternative to BBU, provides 4GB NAND flash power by super capacitor to provide zero maintenance battery backup)

The post How Malware Makes Money | TechSNAP 31 first appeared on Jupiter Broadcasting.