ISDPodcast Episode 317 for February 7, 2011. Tonight’s podcast is hosted by Rick Hayes, Keith Pachulski, Dave Shackleford and Varun Sharma.
Announcements:
Appalachian Institute of Digital Evidence (AIDE)
When: February 17 – 18, 2011
Where: Marshall University Forensic Science Center, Huntington, WV
http://aide.marshall.edu/default.htm
SANS Community
Jason Lawrence, Management 414: SANS +S Training Program for the CISSP Certification Exam
When: Wednesday, February 23, 2011 – Wednesday, April 27, 2011
http://www.sans.org/mentor/details.php?nid=23493
Use the Discount Code: isdpod15 for a 15% discount.
My Hard Drive Died
Data Recovery Expert Certification
When: March 7-11,2011
Where: Washington, DC
Data Recovery Expert Certification
When: April 11-15, 2011
Where: Atlanta, GA
http://www.myharddrivedied.com/data-recovery-training
@BSidesAustin
When: March 11-12, 2011
Where: The Walton-Joseph Building, 706-708 6th Street
http://www.securitybsides.com/w/page/33728032/BSidesAustin2011
Outerz0ne:
When: March 18-19, 2011
Where: Atlanta, GA
CFP open now!
http://bit.ly/dJoIM9
Indiana Linux Fest
When: March 25-27, 2011
Where: Wyndham Indianapolis West Hotel Indianapolis, IN
http://www.indianalinux.org/cms/
@DerbyConWhen: September 30th – October 2, 2011
Where: Louisville, KY
http://www.derbycon.com/
Intro/Outro Music provided by JimmyZ (http://soundcloud.com/jimmyz)
Stories:
News: http://www.dailyfinance.com/story/investing/the-nasdaq-hacking-case-raises-big-red-flags-for-exchanges/19830853/
Revelations over the past few days that hackers had penetrated certain systems at the Nasdaq stock exchange are reverberating throughout the financial world. Indeed, the case is shaking some bedrock assumptions of a digitized, high-speed, globally connected stock market run essentially by computers with minimal human interaction. Nasdaq officials say the computer systems that actually execute buy and sell orders for the Nasdaq OMX Group (NDAQ) were not compromised.
Instead, they say the hacking allegedly affected Nasdaq’s Directors Desk service, a subsidiary that offers Web-based tools to make it easier for boards of directors to prepare for, participate in and follow up on board meetings. Part of the service includes document-sharing tools for things like preliminary drafts of earnings reports and other key data and documents.
Directors Desk’s roughly 10,000 clients include a Who’s Who of top publicly traded companies. The concern is that enterprising hackers could have gleaned key details from board meetings if they gained full access to the service, allowing them to possibly trade on nonpublic material information. On the Directors Desk website Nasdaq says the service offers “The highest level of security available to protect confidential board communications.”
News: http://timesofindia.indiatimes.com/city/patna/Cybersecurity-a-sham-in-India-Ethical-hacker/articleshow/7432529.cms
Comment: The show notes contain a direct reprint of the India Times article. It is our opinion that the noted charlatan Ankit Fadia is most certainly NOT “a renowned ethical hacker” in India or anywhere else for that matter. We also would highly recommend that anyone interested in reading more about his dubious activities and past check out the following: http://attrition.org/errata/charlatan/ankit_fadia.
India may be IT capital of the world, but it is lagging far behind other countries in cybersecurity, said Ankit Fadia, a renowned ethical hacker here. “Not only are Internet users – individuals, companies and governments – unaware of various risks of cybercrime and fraud, the law enforcing agencies are ill-equipped and ill-trained to tackle them,” the 24-year-old Fadia said, who was here to give lecture at an IIT-Patna fest.
“With high growth in computer users and networks, the scale and sophistication of cybercrimes have increased,” he said. An independent computer security and digital intelligence consultant, Fadia has authored 14 internationally best-selling books on topics related to computersecurity. Talking to TOI about ethical hacking, he said: “The job of an ethical hacker is to get into the minds of computer criminals, think like them and come up with innovative methods to protect computers, networks and data.”
News: http://www.theregister.co.uk/2011/02/04/cyberwar_rules_of_engagement/
Rules of engagement for the deployment of cyber-weapons need to be developed, an international security conference is due to be told later today. The influential EastWest Institute is due to present proposals for the cyberspace equivalent of the Geneva convention at the Munich Security Conference, which has included a debate on cyber-security on its agenda for the first time this year. Delegates to the conference include UK Prime Minister David Cameron, German Chancellor Angela Merkel, US Secretary of State Hillary Clinton and Russian Foreign Minister Sergei Lavrov.
The discussion on rules for cyber-conflict follows months after the infamous Stuxnet worm was blamed for infecting industrial control systems and sabotaging centrifuges at controversial Iranian nuclear facilities. Some have described the malware as the world’s first cyber-weapon though cyber-espionage in many guises has undoubtedly been practiced by intelligence agencies across the world for many years.
Computer systems underpin the delivery of essential services, including utilities and telecoms and well as banking and government services. Critical national infrastructure systems are most commonly privately held, at least in the US and Europe. Although attacks against various critical systems are commonplace they tend to be low level information-stealing or denial of service exploits. Many independent
experts in cyber-security dismiss talk of cyberwar as hype – driven more by the marketing departments of US security contractor giants seeking a new market in cyberspace than by reality on the ground.
News: http://www.herald.ie/national-news/intrigue-builds-as-bank-chiefs-laptop-stolen-with-imf-data-2525596.html
INTRIGUE grew today as it emerged another laptop containing sensitive financial information has been stolen. News that a computer was taken from the home of Anglo Irish Bank chief Mike Aynsley comes days after the Herald revealed that a number of laptop stolen from the offices of the Revenue Commissioners also contained highly sensitive data. They contained the records of Fianna Fail-linked developers under investigation for alleged tax evasion. The device taken from Mr Aynsley’s home in Glenageary, Co Dublin also contained personal information. It’s believed that information sent to the European Commission to allow Anglo receive multi-billion euro state aid payments was contained in the laptop’s files.
News: http://krebsonsecurity.com/2011/02/hbgary-federal-hacked-by-anonymous/
A company that is helping the federal government track down cyberactivists who have been attacking business which refused to support Wikileaks has itself been hacked by the very same activists. At the center of the storm is a leaderless and anarchic Internet group called Anonymous, which more recently has been coordinating attacks against Egyptian government Web sites. Late last month, authorities in the U.K. and the U.S. moved against at least 45 suspected Anonymous activists. Then, on Saturday, the Financial Times ran a story quoting Aaron Barr, the head of security services firm HBGary Federal, saying he had uncovered the identities of Anonymous’ leaders using social networking sites. Barr said he planned to release his findings at a security conference in San Francisco next week.
Anonymous responded by hacking into HBGary’s networks and posting archives of company executive emails on file-trading networks. The group also hacked the firm’s Web site and replaced it with a message saying it was releasing Barr’s findings on its own because the group was confident Barr’s conclusions were wrong.
“We’ve seen your internal documents, all of them, and do you know what we did? We laughed. Most of the information you’ve ‘extracted’ is publicly available via our IRC networks,” the statement reads. “The personal details of Anonymous ‘members’ you think you’ve acquired are, quite simply, nonsense. So why can’t you sell this information to the FBI like you intended? Because we’re going to give it to them for free.”
