[podcast]http://isdpodcast.com/podcasts/InfoSec Daily Podcast Episode 264.mp3[/podcast]
ISDPodcast Episode 264 for November 23, 2010.  Tonight’s podcast is hosted by Rick Hayes, Keith Pachulski, and Karthik Rangarajan.

Announcements:

MyHardDriveDied.com Data Recovery Class:
http://www.myharddrivedied.com
Washington, DC – December 6th – 10th
Use the Discount Code: isdpodcast for a $300 discount.

SANS Cyber Defense Initiative 2010
Washington, DC.
Marriott Wardman Park
Dec 10-17, 2010
http://washingtontechnology.com/calendar/2010/12/sans-cyber-defense-initiative-2010.aspx

SANS Community:

Jason Lawrence, Management 414: SANS +S Training Program for the CISSP Certification Exam:  http://www.sans.org/mentor/details.php?nid=23493

Wednesday, February 23, 2011 – Wednesday, April 27, 2011

Use the Discount Code: isdpod15 for a 15% discount.

DojoCon:

13699 Dulles Technology Dr
Herndon, VA 20171

Dec 11-12, 2010

http://www.dojocon.org/

Appalachian Institute of Digital Evidence (AIDE):

AIDE Winter Meeting, Marshall University Forensic Science Center, Huntington, WV

When: February 17 – 18, 2011

CFP Deadline: December 12, 2010

http://aide.marshall.edu/default.htm

CarolinaCon 2011
When: Final weekend of April 2011 (30th? – more info pending)
Where: The venue is Holiday Inn (Crabtree) in Raleigh, NC
Call for Papers is now open: speakers@carolinacon.org
http://carolinacon.org/

Rant: Hospitals
40 bit WEP keys used to secure their wireless, time to crack..7 minutes. Nearly every visible unit was operating in Windows 95 or Windows 98. Applications used to maintain patient information access via a web browser..IE5 or 6.

Seriously..what in the fuck??

Strange: http://www.facebook.com/pages/Secure-Ideas/164377580267351?v=wall

Keith: The advertising is based on your gender, “likes” and viewing of other ads/profiles in facebook. Guess you frequent and/or like hot scantily clad girls..go figure =)

Kevin Johnson PenTesting Scripts: http://www.pentesterscripting.com/

Stories of Interest:
Tools: http://confessor.codeplex.com/
The latest ISSA issue covers Confessor, so we thought we would take a look at it.  Confessor is a Windows Application that utilizes WMI and standard tools to quickly gather forensic information from any number of hosts.  Confessor evolved from MIR-ROR and enables the investigator to gather forensic data from many hosts at once.  Confessor is designed to call binaries remotely, many of those binaries are from Windows Sysinternals.

Tools: http://mole.codeplex.com/
The latest ISSA issue covers MOLE.  MOLE was built to answer the problem of validating many URL’s to see if malware was present.  It does this simply by crawling the site (depth configurable) and determining what file types where returned (pictures, executables, compressed, text, etc). Malware checks are done using http://www.virustotal.com malware scanning system.  A VirusTotal API key is requried, though it is free once you complete the registration.

Tools:  http://code.google.com/p/skipfish/
Skipfish 1.78b is a fully automated, active web application security reconnaissance tool. It is high speed, has a low false positive rate, and is easy to use.
Changes: Substantial bugs in coverage and security checks were fixed. Multiple feature and stability improvements were made. Differential scanning tools were added.

News: http://www.bangkokpost.com/news/sports/204561/disgraced-tour-winner-landis-to-stand-trial-for-hacking
American Floyd Landis, who was stripped of his victory in the 2006 Tour de France for doping, and his coach Arnie Baker have been ordered to stand trial in France for computer hacking. Landis and Baker are subject to an international arrest warrant and stand charged of “fraudulently breaking into a computer system”, according to lawyer Frederik-Karel Canoy, who is acting on the behalf of the Vivendi media company. Both Landis and Baker are suspected of illegally obtaining documentation from the French Anti-Doping Laboratory (LNDD) in a bid to contest the American rider’s positive test results from stage 16 of the 2006 Tour de France.

News: http://cicentre.net/wordpress/index.php/2010/11/03/taiwan-military-intel-officer-double-agent-detained-for-espionage/
A Taiwanese military intelligence officer and an alleged double agent for China were in custody Tuesday as investigators probe the latest espionage scandal to hit Taiwan’s defense establishment and assess the damage to its intelligence network. The detained officer, identified by local media as Col. Lo Chi-cheng, allegedly transferred classified data over several years to a Taiwanese man linked to Taiwan’s intelligence network and who has business interests in China. The data was then allegedly passed on to Chinese intelligence, media reports said.  The two suspects were arrested Sunday and their homes searched after investigators witnessed the two men allegedly exchanging classified data in a Taipei street.

[podcast]http://isdpodcast.com/podcasts/InfoSec Daily Podcast Episode 263.mp3[/podcast]
ISDPodcast Episode 263 for November 22, 2010.  Tonight’s podcast is hosted by Rick Hayes, Keith Pachulski, and Karthik Rangarajan.

Announcements:

MyHardDriveDied.com Data Recovery Class:
http://www.myharddrivedied.com
Washington, DC – December 6th – 10th
Use the Discount Code: isdpodcast for a $300 discount.

SANS Cyber Defense Initiative 2010
Washington, DC.
Marriott Wardman Park
Dec 10-17, 2010
http://washingtontechnology.com/calendar/2010/12/sans-cyber-defense-initiative-2010.aspx

SANS Community:

Jason Lawrence, Management 414: SANS +S Training Program for the CISSP Certification Exam:  http://www.sans.org/mentor/details.php?nid=23493

Wednesday, February 23, 2011 – Wednesday, April 27, 2011

Use the Discount Code: isdpod15 for a 15% discount.

DojoCon:

13699 Dulles Technology Dr
Herndon, VA 20171

Dec 11-12, 2010

http://www.dojocon.org/

Appalachian Institute of Digital Evidence (AIDE):

AIDE Winter Meeting, Marshall University Forensic Science Center, Huntington, WV

When: February 17 – 18, 2011

CFP Deadline: December 12, 2010

http://aide.marshall.edu/default.htm

CarolinaCon 2011
When: Final weekend of April 2011 (30th? – more info pending)
Where: The venue is Holiday Inn (Crabtree) in Raleigh, NC
Call for Papers is now open: speakers@carolinacon.org
http://carolinacon.org/

Stories of Interest:
Tools: http://www.backtrack-linux.org/backtrack/backtrack-4-r2-download/
Backtrack 4 Release 2

• Kernel 2.6.35.8 – *Much* improved mac80211 stack.
• USB 3.0 support.
• New wireless cards supported.
• All wireless Injection patches applied, maximum support for wireless attacks.
• Even *faster* desktop environment.
• Revamped Fluxbox environment for the KDE challenged.
• Metasploit rebuilt from scratch, MySQL db_drivers working out of the box.
• Updated old packages, added new ones, and removed obsolete ones.
• New BackTrack Wiki with better documentation and support.
• Our most professional, tested and streamlined release ever.

For those wanting to upgrade an older release of BT4, an apt-get update && apt-get dist-upgrade should do the job.

Bank of America

News: http://thehill.com/blogs/hillicon-valley/technology/129879-house-bill-would-give-dhs-authority-over-private-sector-networks
A new bill unveiled Wednesday by House Homeland Security chairman Bennie Thompson (D-Miss.) would give the Department of Homeland Security the authority to enforce federal cybersecurity standards on private sector companies deemed critical to national security.

The Homeland Security Cyber and Physical Infrastructure Protection Act of 2010 authorizes DHS to establish and enforce risk and performance-based cybersecurity standards on federal agencies and private sector companies consider part of the country’s critical infrastructure. Such firms include utilities, communications providers and financial institutions.

The legislation is co-sponsored by Reps. Jane Harman (D-Calif.) and Yvette Clark (D-N.Y.). It will also create a new Cybersecurity Compliance Division within DHS that would make sure organizations comply with the new security regulations. The lawmakers argue DHS has not had sufficient authority or resources to fulfill its mission as the lead federal agency for cyversecurity.

“From a security and good-government standpoint, the way to deliver better cybersecurity is to leverage, modify, and enhance existing structures and efforts, rather than make wholesale bureaucratic changes,” Thompson said in a statement. “This bill will make our Nation more secure and better positions DHS – the ‘focal point for the security of cyberspace’ – to fulfill its critical homeland security mission.”

News: http://news.techworld.com/security/3249585/china-internet-hijack-hugely-exaggerated-says-researcher/
The claimed ‘hijack’ of Internet traffic by China Telecom has been hugely exaggerated in scale and intent, a traffic analysis by Internet security company Arbor Networks has concluded.

A blog by Arbor chief scientist Craig Labovitz picks apart the speculative claim, attributed to McAfee’s VP of threat research, Dmitri
Alperovitch (subsequently clarified here), that the unusual routing diversion through China Telecom at 4am GMT on 8 April 2010 could have
amounted to as much as 15 percent of Internet traffic.

According to Labovitz, this appears to have been calculated by comparing the 40,000 affected BGP routes to the 340,000 in the routing table as a whole, a calculation originally cited by the industry BGPmon website.

Using numbers culled from the Arbor Atlas traffic monitoring system of 80 global ISPs, however, traffic on that day barely increased beyond normal patterns at most it amounted to only a few gigabits per second out of an Internet total between 80 and 100 terabits per second.

News: http://www.computerworld.com/s/article/9197440/Hacked_Federal_Reserve_network_was_test_only
A June 2010 hacking incident that compromised a network at the Federal Reserve Bank of Cleveland happened on a test system and not the bank’s production servers.

On Thursday, Lin Mun Poo was charged with hacking the Fed and other U.S. corporations, including payment processor FedComp and an unnamed federal defense contractor. He was arrested on Oct. 21 following a U.S. Secret Service sting.

The Secret Service says it found more than 400,000 bank card numbers on Poo’s laptop at the time of his arrest. But those numbers apparently did not come from the Fed, which said Friday that none of its sensitive data was compromised during the incident. “We don’t process credit cards or debit card information,” said June Gates, a spokeswoman with the Federal Reserve of Cleveland.

According to Gates, the hacker managed to break into a single Fed test PC that was connected to other test computers. “This is a system that is used to test software and applications with fake data and information,” she said. “The incident did not involve our live production system on which we process our work.”

News: http://news.softpedia.com/news/Only-Five-Percent-of-Users-Have-Non-Letter-Characters-in-Their-Password-165085.shtml
A survey conducted by antivirus vendor BitDefender revealed that only five percent of people use digits or special characters in their passwords and that sixty percent use single-case-only access codes. The conclusions are the result of a questionnaire taken by 1,000 random individuals, half men, half women, from 16 countries, with an average age of 29.5 years.  The questions attempted to determine passwords strength and habits and were individually explained to respondents in a live interview.  Results revealed that 67% of users have more than five password-protected online accounts, with one in four having six accounts and almost one in three having seven or more.  Meanwhile, 73% of respondents said that they reuse the same password, a bad habit that security experts have tried to change for years.

The practice poses serious problems, since some accounts hold more value than others. For example, an online banking account is clearly more sensitive than a social networking one. With password reuse, if one account gets compromised, all of them are fair game. In July, we reported how Turkish hackers broke into the PayPal accounts of Israelis, whose usernames and passwords were stolen from an insecure Pizza Hut website. Furthermore, one in four respondents said that their password was six characters long. This, combined with the fact that 63% of them only use single-case alphabetic characters, means that a large percentage of passwords are trivial to crack via brute force.  And to top it all off, BitDefender also claims that 12% of the respondents showed a willingness to disclose their password to the surveyors, in order to recieve advice about its strength.

[podcast]http://isdpodcast.com/podcasts/InfoSec Daily Podcast Episode 262.mp3[/podcast]
ISDPodcast Episode 262 for November 19, 2010.  Tonight’s podcast is hosted by Rick Hayes, Keith Pachulski, and Karthik Rangarajan.

Announcements:

MyHardDriveDied.com Data Recovery Class:
http://www.myharddrivedied.com
Washington, DC – December 6th – 10th
Use the Discount Code: isdpodcast for a $300 discount.

SANS Cyber Defense Initiative 2010
Washington, DC.
Marriott Wardman Park
Dec 10-17, 2010
http://washingtontechnology.com/calendar/2010/12/sans-cyber-defense-initiative-2010.aspx

SANS Community:

Jason Lawrence, Management 414: SANS +S Training Program for the CISSP Certification Exam:  http://www.sans.org/mentor/details.php?nid=23493

Wednesday, February 23, 2011 – Wednesday, April 27, 2011

Use the Discount Code: isdpod15 for a 15% discount.

DojoCon:

13699 Dulles Technology Dr
Herndon, VA 20171

Dec 11-12, 2010

http://www.dojocon.org/

Appalachian Institute of Digital Evidence (AIDE):

AIDE Winter Meeting, Marshall University Forensic Science Center, Huntington, WV

When: February 17 – 18, 2011

CFP Deadline: December 12, 2010

http://aide.marshall.edu/default.htm

CarolinaCon 2011
When: Final weekend of April 2011 (30th? – more info pending)
Where: The venue is Holiday Inn (Crabtree) in Raleigh, NC
Call for Papers is now open: speakers@carolinacon.org
http://carolinacon.org/

Stories of Interest:
News: http://www.spamfighter.com/News-15325-France-Germany-and-USA-Host-Most-CC-Servers-for-Botnets.htm

Damballa the anti-botnet specialist recently conducted an analysis according to which, the majority of C&C (command-and-control) servers have their base in France, Germany and USA. Reveals statistics the security company gathered, the percentage of botnets run in USA, Germany and France are 23.9%, 17.9% and 8.6% respectively. Remarking about these discoveries, Vice-President of Research Gunter Ollmann at Damballa stated that 50% of the C&C servers that Internet crooks utilized for regulating their botnets were based inside commercial hosting services in nation states that previously didn’t have any connection with such crime. Theregister.co.uk published this on October 26, 2010. Ollmann added that hosting of a server was generally not related to the places the crooks were really located in as well as the kind of users attempted for compromise.

Moreover, while USA, Germany and France lead in hosting most botnet servers, Russia and China are known as havens for spamming, hacking as also other cyber-crimes although much down the ranking order in Damballa’s list. Indeed, Russia at 4.2% and China at 3.5% rank No.5 and 6 respectively.

Tools: http://www.woany.co.uk/files/downloads/SqlInjector.v.1.0.2.zip

SqlInjector v1.0.2 is a fairly major update to SqlInjector (renamed from BlindSqlInjector). The key change is the addition of true/false inference.

• Added controls to allow different database types
• Added controls to allow different injection types e.g. inference and true/false
• Added schema export option, which produces a short format export file Fixed a bug in the length detection routines for the Text column type

News: http://www.computerworld.com/s/article/9195278/Report_Sprint_rejected_Huawei_ZTE_for_security_concerns
According to the the Wall Street Journal. Sprint Nextel turned down bids from ZTE and Huawei Technologies because of U.S. government concerns over possible dangers to national security from the Chinese vendors building critical infrastructure in the U.S.

Sprint, the nation’s third-largest mobile operator6, rejected ZTE and Huawei’s bids to modernize its network even though they were lower than those of three rival companies, the Journal reported. The other bidders were Ericsson of Sweden, Samsung Electronics of South Korea and Alcatel-Lucent, which is based in Paris and incorporates the former U.S. telecom vendor Lucent. Some U.S. lawmakers have expressed concern over letting Huawei or ZTE participate in major infrastructure projects in the U.S. because of concerns over possible links between those companies and the Chinese government and military. They have worried that the Chinese military could use equipment from the companies to disrupt U.S. communications. The Journal reported that U.S. Secretary of Commerce Gary Locke had called Sprint CEO Dan Hesse this week to voice concerns about possible deals between Sprint and the two companies, though not to ask him to reject the companies’ bids.

News: (these two tie together)

http://www.csoonline.com/article/print/637763

“So many people look at themselves or the companies they work for and think, ‘Why would somebody want something from me? I don’t have any money or anything anyone would want,’?” he said. “While you may not, if I can assume your identity, you can pay my bills. Or I can commit crimes in your name. I always try to get people to understand that no matter who the heck you are, or who you represent, you have a value to a criminal.”

http://www.infosecurity-us.com/view/14090/us-air-force-warns-of-devastating-effects-of-locationaware-services/

“All airmen must understand the implications of using location-based services”, said a message on the internal Air Force network, according to Australian reports.  Applications such as Facebook’s Check-In allow users with smartphones to indicate their location to friends.  “Careless use of these services by Airmen can have devastating operations security and privacy implications”, said the message.

[podcast]http://www.isdpodcast.com/podcasts/InfoSec Daily Podcast Episode 261.mp3[/podcast]

ISDPodcast Episode 261 for November 18, 2010.  Tonight’s podcast is hosted by Rick Hayes, Keith Pachulski, and Karthik Rangarajan.

Announcements:

MyHardDriveDied.com Data Recovery Class:
http://www.myharddrivedied.com
Washington, DC – December 6th – 10th
Use the Discount Code: isdpodcast for a $300 discount.

SANS Cyber Defense Initiative 2010
Washington, DC.
Marriott Wardman Park
Dec 10-17, 2010
http://washingtontechnology.com/calendar/2010/12/sans-cyber-defense-initiative-2010.aspx

SANS Community:

Jason Lawrence, Management 414: SANS +S Training Program for the CISSP Certification Exam:  http://www.sans.org/mentor/details.php?nid=23493

Wednesday, February 23, 2011 – Wednesday, April 27, 2011

Use the Discount Code: isdpod15 for a 15% discount.

DojoCon:

13699 Dulles Technology Dr
Herndon, VA 20171

Dec 11-12, 2010

http://www.dojocon.org/

Appalachian Institute of Digital Evidence (AIDE):

AIDE Winter Meeting, Marshall University Forensic Science Center, Huntington, WV

When: February 17 – 18, 2011

CFP Deadline: December 12, 2010

http://aide.marshall.edu/default.htm

CarolinaCon 2011
When: Final weekend of April 2011 (30th? – more info pending)
Where: The venue is Holiday Inn (Crabtree) in Raleigh, NC
Call for Papers is now open: speakers@carolinacon.org
http://carolinacon.org/

Stories of Interest:
Tools: http://www.darknet.org.uk/2010/11/crunch-password-cracking-wordlist-generator/

Crunch is a wordlist generator where you can specify a standard character set or a character set you specify. crunch can generate all possible combinations and permutations.

Some other options are:

• The Associative Word List Generator (AWLG) – Wordlists for Password Cracking
• CeWL – Custom Word List Generator Tool for Password Cracking
• RSMangler – Keyword Based Wordlist Generator For Bruteforcing
• CUPP – Common User Passwords Profiler – Automated Password Profiling Tool

Features

• Crunch generates wordlists in both combination and permutation ways
• It can breakup output by number of lines or file size
• Now has resume support
• Pattern now supports number and symbols
• Pattern now supports upper and lower case characters separately
• Adds a status report when generating multiple files

News: http://www.bankinfosecurity.com/articles.php?art_id=3096
The ATM and online banking outage that allegedly struck several of the nation’s top financial institutions, including Bank of America, Chase, U.S. Bank, Wells Fargo, Compass, USAA, SunTrust, Chase, Fairwinds Credit Union, American Express, BB&T on the East Coast and PNC, over the weekend of Nov. 6, may have been more hype than reality. Tara Burke, a spokeswoman for BofA, the country’s largest bank, with $2.36 trillion in assets, says none of the bank’s systems were affected by malware, as was suggested as a possible reason for the outage, and that only “very minor systems issues” adversely affected deposits and withdrawals for a few customers. Charlie Lai, chief information officer of Fairwinds Credit Union, a $1.5 billion institution serving central Florida, calls reports of the massive ATM and online outage “ridiculous.” “Nothing happened here,” he says. “This is complete fiction, and I’m trying to figure out where it started.”

News: http://www.theregister.co.uk/2010/1 1/15/amd_secret_debugger/
A hardware hacker has discovered a secret debugging feature hidden in all AMD chips made in the past decade. The password-protected debugger came as a shock to reverse-engineers who have hungered for an on-chip mechanism for performing conditional and direct-hardware breakpoint operations. Although AMD has built the firmware-controlled feature into all chips since the Athlon XP, the company kept it a closely guarded secret that was only disclosed late last week by a hacker who goes by the name Czernobyl. AMD processors (Athlon XP and better) have included firmware-based debugging features that expand greatly over standard, architecturally defined capabilities of x86, the hacker wrote. For some reason, though, AMD has been tightly secretive about these features; hint of their existence was gained by glancing at CBID’s page. To put a chip into developer mode, a user must first enter what amounts to a password — 9C5A203A — into the CPU’s EDI register. Czernobyl was able to deduce the secret setting by brute forcing the key.

News: http://www.wtsp.com/news/mostpop/story.aspx?storyid=156762

A woman has filed suit, the first of its kind, to get a debt collector to stop harassing her, her friends, and her family through Facebook and other social networking sites.

Thanks to the social networking tools, debt collectors don’t even need to pay for skip tracing services to track down you and everyone you know. In this case, the collector started sending all her friends and family Facebook messages about her debt. Not exactly the thing you want to have show up on everyone’s walls! “OMG Debbie pay this stupid guy so he stops spamming me.” Then it’s got +7 likes, and 4 comments, one of them from your Dad and one from your ex-boyfriend…

“Now Facebook does a debt collectors work for them. Now it’s not only family members, it’s all of your associates. It’s a very powerful tool for debt collectors to use,” consumer attorney Billy Howard told WTSP.

That’s why it’s important to not just accept the default privacy settings Facebook gives you. Take time to familiarize yourself with the options, listed under account settings, to limit who has access to various parts of your profile. Sometimes being quickly connectable to everyone in your life has its downsides.

News: http://www.theregister.co.uk/2010/11/17/google_facebook_wiretapping/

Top officials from the FBI traveled to Silicon Valley on Tuesday to persuade Facebook and Google executives to support a proposal that would make it easier for law enforcement to wiretap the companies’ users.

FBI Director Robert Mueller III and General Counsel Valerie Caproni were scheduled to meet with “managers of several major companies” including Facebook and Google, according to The New York Times. It wasn’t clear how the companies responded.

The proposal first came to light in September, when the FBI warned that much of its information-gathering ability was under threat by the move to VoIP and other encrypted communications. Legislation under consideration would require cellphone carriers, websites, and other types of service providers to have a way to unscramble encrypted communications traveling over their networks, according to the NYT.

The Communications Assistance to Law Enforcement Act requires phone and broadband providers to have the means to make sure they can immediately comply with court wiretap orders. The FBI wants to extend that requirement to communication service providers, including those that offer strong end-to-end encryption services that make it infeasible to intercept and read traffic as it travels over their networks. The proposed legislation mentions Skype and Research in Motion by name.

News: http://wdbo.com/localnews/2010/11/sanford-airport-to-opt-out-of.html

The backlash continues over those new TSA screening measures, and now one Central Florida airport has decided to go with a private security screening firm. Orlando Sanford International Airport has decided to opt out from TSA screening. “All of our due diligence shows it’s the way to go,” said Larry Dale, the director of the Sanford Airport Authority. “You’re going to get better service at a better price and more accountability and better customer service.” Dale says he will be sending a letter requesting to opt out from TSA screening, and instead the airport will choose one of the five approved private screening companies to take over. Congressman John Mica, who’s expected to lead the powerful Transportation Committee next year, says the TSA is crying out for reform. “I think TSA is overstepping its bounds,” said Mica.

[podcast]http://www.isdpodcast.com/podcasts/InfoSec Daily Podcast Episode 260.mp3[/podcast]

ISDPodcast Episode 260 for November 17, 2010.  Tonight’s podcast is hosted by Rick Hayes, Keith Pachulski, and Karthik Rangarajan.

Announcements:

Center for Applied Cybersecurity Research

Malicious USB Talk
November 18, 2010, Noon
Location: Law 335 at IU in Bloomington Indiana

Lunch is provided!

MyHardDriveDied.com Data Recovery Class:
http://www.myharddrivedied.com
Washington, DC – December 6th – 10th
Use the Discount Code: isdpodcast for a $300 discount.

SANS Cyber Defense Initiative 2010
Washington, DC.
Marriott Wardman Park
Dec 10-17, 2010
http://washingtontechnology.com/calendar/2010/12/sans-cyber-defense-initiative-2010.aspx

SANS Community:

Jason Lawrence, Management 414: SANS +S Training Program for the CISSP Certification Exam:  http://www.sans.org/mentor/details.php?nid=23493

Wednesday, February 23, 2011 – Wednesday, April 27, 2011

Use the Discount Code: isdpod15 for a 15% discount.

DojoCon:

13699 Dulles Technology Dr
Herndon, VA 20171

Dec 11-12, 2010

http://www.dojocon.org/

Appalachian Institute of Digital Evidence (AIDE):

AIDE Winter Meeting, Marshall University Forensic Science Center, Huntington, WV

When: February 17 – 18, 2011

CFP Deadline: December 12, 2010

http://aide.marshall.edu/default.htm

Stories of Interest:
Tools: http://packetstormsecurity.org/files/view/95882/R-U-Dead-Yet.tar.gz
R-U-Dead-Yet is a universal DoS attack tool written in Python. It will attack all and any web applications / servers. Runs either in unattended mode using configuration file or in an interactive auto-discover-web-forms mode.

News: http://newsfeed.time.com/2010/11/17/everybody-panic-china-hijacked-15-of-the-internet-for-18-minutes-in-april/
China Hijacked 15% Of The Internet For 18 Minutes In April, carry on!

According to Dmitri Alperovitch, vice president of threat research for McAfee, for a short amount of time this April 15% of Internet traffic was routed through China. Most troubling about the incident is the apparent lack of motive — as well as the fact that there were no obvious adverse side effects.

The hijacking was made possible because of the way the global telecommunications grid operates: on trust. Data flows on the Internet through whatever pathways report that they are the quickest and most efficient for traffic. On April 8, China Telecom told the world’s Internet Service Providers that channels were the best for traffic, resulting in terrabytes of data being sent through the Chinese network, even if both sender and receiver were in the United States.

As National Defense explains:

This happens accidentally a few times per year, Alperovitch said. What set this incident apart from other such mishaps was the fact that China Telecom could manage to absorb this large amount of data and send it back out again without anyone noticing a disruption in service. In previous incidents, the data would have reached a dead end, and users would not have been able to connect.

Though some of the data that was hijacked came from American, Japanese and Australian military networks, the U.S. government has said that the situation was not cause for alarm. All classified information sent over U.S. military networks is encrypted.

As with previous Chinese cyber-security breaches such as GhostNet, it is unclear whether the hijacking was the work of the Chinese government, or independent nationalist sources inside China. The Chinese Embassy in Washington said the news was based on “unfounded, groundless information.”
News: http://iwilloptout.org/2010/11/16/calling-a-spade-a-spade-time-to-end-tsa-theatre-and-corporate-profiteering/ Thanks for Geordy for this one!
If you are planning to fly over the Thankgiving holiday, be sure to figure out if yours are part of the 70-or-so airports that have whole body imaging (WBI) machines.   Back in March, TSA began deploying 450 advanced imaging technology units which were purchased with American Recovery and Reinvestment Act (ARRA) funds; they expect to have 1,000 deployed by the end of next year. FYI: TSA has 10,000 employees with “secret” clearances

.

Despite Department of Homeland Security assurances that its airport screening methods are “risk based”, Jim Harper at the Cato Institute quotes a March 2010 GAO report in making his case that risk assessment is sorely missing from DHS/TSA procedures (emphasis added):

[I]t remains unclear whether the AIT would have detected the weapon used in the December 2009 incident based on the preliminary information GAO has received. . . . In October 2009, GAO also recommended that TSA complete cost-benefit analyses for new passenger screening technologies. While TSA conducted a life-cycle cost estimate and an alternatives analysis for the AIT, it reported that it has not conducted a cost-benefit analysis of the original deployment strategy or the revised AIT deployment strategy, which proposes a more than twofold increase in the number of machines to be procured.

The Electronic Privacy Information Center (EPIC) has petitioned the D.C. Court of Appeals to review three DHS/TSA actions— one failure to act, one agency Order, and one agency Rule. EPIC called for a 90-day formal rulemaking process on WBI technology in May 2009; the Agency ignored them. EPIC believes that the body scanner program violates Fourth Amendment rights.

DHS/TSA has not performed a risk assessment or a comprehensive privacy assessment on WBI technology; the later is required by law. According to EPIC:

Courts have required that airport security searches be ;minimally intrusive, well-tailored to protect personal privacy, and neither more extensive nor more intensive than necessary under the circumstances to rule out the presence of weapons or explosives.

In spite of clear Fourth Amendment implications, DHS/TSA has invested millions on technology that they sold to Congress as being for “secondary” scanning of passengers who had aroused suspicion. Now they are sending passengers through WBI machines willy-nilly and are using an invasive pat-down as disincentive to the opt-out process.

[S]tarting tomorrow (30 October 2010), we’re going to start searching your crotchal area” — this is the word he used, “crotchal” — and you’re not going to like it.”

“What am I not going to like?” I asked.

“We have to search up your thighs and between your legs until we meet resistance,” he explained.

“Resistance?” I asked.

“Your testicles,” he explained.

‘That’s funny,” I said, “because ‘The Resistance’ is the actual name I’ve given to my testicles.”

He answered, “Like ‘The Situation,’ that guy from ‘Jersey Shore?’”

Yes, exactly, I said. (I used to call my testicles “The Insurgency,” but those assholes in Iraq ruined the term.)

I pointed out to the security officer that 50 percent of the American population has no balls (90 percent in Washington, D.C., where I live), so what is going to happen when the pat-down officer meets no resistance in the crotchal area of women? “If there’s no resistance, then there’s nothing there.”

“But what about people who hide weapons in their cavities? I asked. I actually said “vagina” again, just to see him blush. “We’re just not going there,” he reiterated.

I asked him if he was looking forward to conducting the full-on pat-downs. “Nobody’s going to do it,” he said, “once they find out that we’re going to do.”

In other words, people, when faced with a choice, will inevitably choose the Dick-Measuring Device over molestation? “That’s what we’re hoping for. We’re trying to get everyone into the machine.” He called over a colleague. “Tell him what you call the back-scatter,” he said. “The Dick-Measuring Device,” I said. “That’s the truth,” the other officer responded.