InfoSec Daily Podcast Episode 439 [ 41:16 | 18.89 MB ] Play Now | Play in Popup | Download (169)

InfoSec Daily Podcast Episode 439 for July 29, 2011.  Tonight's podcast is hosted by Karthik Rangarajan, Geordy Rostad, Mr Bones and Varun Sharma.

Announcements:

SANS Security 464 – Hacker Detection for Systems Administrators with Continuing Education Program – Russell Eubanks
Where: Atlanta, GA
When:  Tue, Aug 09 to Wed, Aug 10
https://www.sans.org/mentor/details.php?nid=25573

#BruCon
When: Sept 19-22, 2011
Where: Brussels, Belgium
http://blog.brucon.org/2011/02/confirmation-of-brucon-dates.html

@DerbyCon
When: September 30th – October 2, 2011
Where: Louisville, KY
http://www.derbycon.com/

SANS Mentoring: Forensics 408 – Computer Forensic Essentials
When: Wednesday, October 12, 2011 – Wednesday, December 14, 2011
Where: Atlanta, GA
Discount Code: ISDPod15 (15% discount)
http://www.sans.org/mentor/details.php?nid=25504

Hack3rCon 2011
When: October 21st-23rd, 2011
Where: the Charleston House Hotel and Conference Center
http://www.hack3rcon.org/

2011 Fall Information Security Conference
When:  November 8 – 9, 2011
Where: Atlanta, GA (Loudermilk Conference Center)

http://www.gaissa.org

Stories:

Source: https://www.infosecisland.com/blogview/15495-Former-HBGary-Federal-CEO-Withdraws-from-DEFCON-Panel.html

Aaron Barr, the former HBGary Federal CEO, has withdrawn from participation in a panel discussion slated for the DEFCON security conference next week in Las Vegas.

SC Magazine reports Barr's decision was hastened by the threat of legal action by his former employer for a potential breach of his separation agreement with the company.

Barr had resigned from HBGary Federal in the wake of a devastating breach and subsequent criticism regarding some of the company's business practices.

The DEFCON session, titled “‘Whoever Fights Monsters…' Aaron Barr, Anonymous, and Ourselves," will examine the impact hacktivism is having on the security industry.

The session, which is still scheduled to occur, will be moderated by ThreatPost editor Paul Roberts and will include and Attrition.org's 'Jericho' – an Infosec Island contributor – and The 451 Group's Joshua Corman.

"Barr withdrawing from the panel is an obvious disappointment to the other panelists. It is especially unfortunate, as he had worked out issues with speaking on the topics with his new employer, only to get hit with an injunction from his former employer, HBGary," 'Jericho' told Infosec Island via email.

"HBGary's choice to go the legal route to block Aaron from speaking in general about topics that are relevant to our industry is sad, and demonstrates that HBGary is not committed to advancing the information security field."

Organizers indicate that they are contacting other viable candidates for participation in the session. According to SC Magazine's report, HBGary Federal's attorney Tanya Forsheit of The Information Law Group – also Infosec Island contributors – could not be reached for comment,
In January of this year, HBGary Federal's systems were breached in an operation conducted by the rogue movement Anonymous, and the subsequent release of tens-of-thousands of company emails revealed multiple instances of ethically questionable covert operations involving the security company.

The leaked emails showed that HBGary Federal, Palantir Technologies and Berico Technologies were involved in developing WikiLeaks counter-operations strategies for Bank of America and proposed disinformation campaigns, cyber attacks against network systems, and strong-arming journalists.

Other information released in the breach show the companies were engaged in developing strategies to infiltrate other civil activist groups, and plans to use social media for distributing government propaganda. There was also evidence that HBGary Federal was involved in developing an undetectable, full command and control cyber offensive weapon called Magenta.
In April, HBGary, Inc., sister company to HBGary Federal, released an open letter addressed to their customers and the defense marketplace in an effort to set the record straight in the wake of the devastating breach.

While some details in the brief letter correspoded to the information contained in the leaked emails, the letter for the most part came off as a generic attempt to rewrite the record and further distance HBGary Inc. from the activities of Aaron Barr and HBGary Federal.

The letter, which was widely covered in the press, has subsequently been removed from the company's website, although a Google search of the defunct URL (http://www.hbgary.com/open-letter-from-hbgary) reveals it's distribution.

Source: http://www.theregister.co.uk/2011/07/29/facebook_bug_bounties/

Facebook has joined Google and Mozilla in paying cash rewards to researchers who privately report vulnerabilities that could jeopardize the privacy or security of their users.

The social network said Friday it would pay $500 for the disclosure of most website flaws, such as XSS, or cross-site scripting errors. The company may pay more for specific bugs, which weren't elaborated on in Facebook's announcement. To qualify, the researcher must be the first person to privately report the bug and reside in a country not under any current US sanctions.
The move comes as good news to legions of researchers who spend considerable time and expertise finding and reporting serious vulnerabilities in the websites and software they use. More often than not, they receive little more than a public acknowledgement in return. Microsoft, Oracle and virtually every other software manufacturer and website steadfastly refuse to pay for private bug reports, even though their products also benefit from it.

Microsoft recently offered a $250,000 reward for information that leads to the conviction of the operators of Rustock, a recently dismantled botnet that in its heyday was one of the biggest sources of illegal spam. Although the software maker has rebuffed calls to offer cash rewards for bug reports, it has publicly pledged not to sue or press charges against hackers who responsibly find security flaws in its online services.

Mozilla was among the first software makers to offer a bug bounty program when, years ago, when it began offering $500 rewards. Google eventually followed suit. The two outfits have gradually increased the bounties, which Mozilla paying as much as $3,000 and Google paying $3,133.70 for the most serious bugs.

To date, Google has paid $300,000 under the program for bugs found in its its various web properties. That doesn't include bounties paid for vulnerabilities reported in Google's Chromium browser.
“We're very happy with the success of our vulnerability reward program so far,” a Google spokesman said in an email.

To qualify for the Facebook bounties, researchers must privately report them here and give the company's security team a reasonable time to respond before publicly disclosing the flaws. Denial-of-service vulnerabilities, spam and social engineering techniques, and bugs in third-party apps and websites and in Facebook's corporate infrastructure don't qualify.

Source: http://www.networkworld.com/slideshows/2011/nww-ipv6-survey-ciscosubnet.html

2011 is the year that IPv6 moved among the top priorities for many enterprises. Network World wanted to know where organizations stood in their implementation plans. So we asked and 210 readers, representing businesses of all sizes, responded. We expected people to tell us that they were making progress on IPv6 for their websites, and they are. We were surprised at how far along many are with IPv6 on their internal networks as well. And we were blown away by how many agreed that IPv6 isn't just hype, but fundamentally important to the growth of the Internet and that they didn't want their companies to be left behind.

Source: http://www.networkworld.com/news/2011/072711-war-texting-lets-hackers-unlock.html

Software that lets drivers unlock car doors and even start their vehicles using a mobile phone could let car thieves do the very same things, according to computer security researchers at iSec Partners.

Don Bailey and fellow iSec researcher Mathew Solnik say they've figured out the protocols that some of these software makers use to remote control the cars, and they've produced a video showing how they can unlock a car and turn the engine on via a laptop. According to Bailey, it took them about two hours to figure out how to intercept wireless messages between the car and the network and then recreate them from his laptop.

Bailey will discuss the research at next week's Black Hat conference in Las Vegas, but he isn't going to name the products they've hacked — they've looked at two so far — or provide full technical details of their work until the software makers can patch them.

Probably the best known of this type of product is the OnStar RemoteLink app, which can be used to start up and unlock many late-model General Motors vehicles, but similar software is available for other makes of cars, including Mercedes and BMW.

Bailey calls his technique "war texting," a reference to another hacking technique called "war driving," which involves driving around cities looking for data on wireless networks.

War texting is technically complex. First of all, the researchers have to identify cars that are using these mobile applications. Then they have to find a way to connect with them. With these mobile car apps, the phone connects to a server that then sends secret numerical keys to the car in order to authenticate itself, but the iSec researchers figured out ways to get around this by looking at the messages sent between the server and the car over the mobile network, Bailey said in an interview. "We reverse-engineer the protocol and then we build our own tools to use that protocol to contact that system," he said.

The iSec researchers believe that they are uncovering symptoms of a much more widespread problem. In recent years, mobile networking has been built into an astonishing range of devices — everything from picture frames to cars to smart meters — giving them a cheap and easy way to communicate. According to Bailey, however, security has often been an afterthought, and many of these products can be hacked and misused.

Research in this area has taken off in recent years as open-source tools have given hackers an inexpensive way of setting up their own mobile-phone test networks.

In April, Bailey used similar techniques to hack Zoombak's personal locator devices, and there are hundreds of other similar products that have not been examined. "This architectural flaw expands to so many engineering industries," he said.

Source: http://news.yahoo.com/minnesota-wi-fi-hacker-gets-18-years-prison-032803295.html

Minnesota hacker Barry Ardolf was sentenced to an 18-year term in a federal prison this Tuesday. Ardolf had terrorized a neighboring family for two years through a carefully planned campaign involving a hijacked Wi-Fi network to harass, frame and embarrass the next-door neighbors in every facet of their lives.

Ardolf’s obsessive passive-aggression was apparently ignited in late 2008 when his neighbors, Matt and Bethany Kostolnik, filed a police report against him. The Kostolniks had a 4-year old son who wandered over to their next-door-neighbors property shortly after moving into the Minnesota suburb of Blaine. Ardolf, 46 and a father of two, had reportedly picked the boy up carried him back to the couple and then kissed the child on the lips. Ardolf was offended when the cops were called and vowed his revenge like every good villain.

The man, a Medtronic computer technician, downloaded a Wi-Fi hacking program to tear into his neighbors WEP encryption. Ardolf created a fake Myspace page as well as several fake emails for Matt Kostolnik. The hacker then posted child porn on the Myspace page and emailed the same child porn to co-workers at Kostolnik’s law office.

To top it all off, the Blaine hacker sent death threats to Vice President Joe Biden and other politicians from Kostolnik’s Yahoo account. This granted Kostolnik a visit from the secret service who had traced the emails back to his IP address. One of the emails told Biden, “I swear to God I’m going to kill you!”

Ardolf’s mischief was detected when a frustrated Kostolnik told bosses he had no clue as to what was going on. The law office hired a firm to poke around the Wi-Fi network and install a packet sniffer to figure it all out. Eventually Ardolf’s name and Comcast account were found which gave the FBI a reason to obtain a search warrant for Ardolf’s house. They found massive evidence that led to the Blaine hacker being slapped with charges for identity theft, making threats against Biden, possession of child pornography as well as distribution of kiddie-porn.
The FBI also found evidence that Ardolf had staged a similar attack against in a family in Brooklyn Park for parking their cars in front of his house. Ardolf’s charges will tag him with lifetime-sex-offender registration requirements and after his release he’ll be supervised for 20 years. According to the Pioneer Press, he’ll also be restricted when working with computers by his parole officers.

InfoSec Daily Podcast Episode 438 [ 36:20 | 16.64 MB ] Play Now | Play in Popup | Download (199)

InfoSec Daily Podcast Episode 438 for July 28, 2011.  Tonight's podcast is hosted by Karthik Rangarajan, Matthew Romanek, Geordy Rostad and Varun Sharma.

Announcements:

SANS Security 464 – Hacker Detection for Systems Administrators with Continuing Education Program – Russell Eubanks
Where: Atlanta, GA
When:  Tue, Aug 09 to Wed, Aug 10
https://www.sans.org/mentor/details.php?nid=25573

#BruCon
When: Sept 19-22, 2011
Where: Brussels, Belgium
http://blog.brucon.org/2011/02/confirmation-of-brucon-dates.html

@DerbyCon
When: September 30th – October 2, 2011
Where: Louisville, KY
http://www.derbycon.com/

SANS Mentoring: Forensics 408 – Computer Forensic Essentials
When: Wednesday, October 12, 2011 – Wednesday, December 14, 2011
Where: Atlanta, GA
Discount Code: ISDPod15 (15% discount)
http://www.sans.org/mentor/details.php?nid=25504

Hack3rCon 2011
When: October 21st-23rd, 2011
Where: the Charleston House Hotel and Conference Center
http://www.hack3rcon.org/

2011 Fall Information Security Conference
When:  November 8 – 9, 2011
Where: Atlanta, GA (Loudermilk Conference Center)

http://www.gaissa.org

Stories:

Source: http://gcn.com/articles/2011/08/01/army-soldier-phone-side.aspx

While the Army is leading the way for the Defense Department’s use of commercial smart phones, several security concerns remain unanswered, experts say.

One of the dangers is that compromised smart phones could be used to track soldiers’ movements or spy on meetings via the device’s cameras and microphones. Another risk might be proximity threats — the ability for hackers and other adversaries to remotely compromise a device.

“It’s a pretty scary set of possibilities if you’re an adversary,” said Dmitri Alperovitch, vice president of threat research at McAfee.

Rising threats include rogue applications, dozens of which were recently found in Google’s app store, Alperovitch said. There are also Internet-based threats such as malware and malicious websites.

DOD security concerns center on the government’s limited ability to control unmodified commercial wireless devices. For example, Apple iPhones are a closed system of proprietary software and hardware that cannot be easily modified. Open-source Android-based platforms are somewhat easier to program, but the challenge is that all Android devices are already slightly modified to run on their particular platforms, he said.

Although the government has the option to build its own operating systems, that is expensive, time-consuming and incompatible with the Army’s goal of a flexible, market-based approach, Alperovitch said.

There are techniques that can mitigate outside threats to smart phones. Those include deploying and managing DOD- or government-owned and vetted application stores, using e-mail encryption, and building custom versions of the Android operating system and enforcing them across DOD. The government can also work with vendors such as Google and Apple from the beginning. Alperovitch noted that Google is working with the government to improve the security of its software applications for a number of projects.

Source: http://www.theregister.co.uk/2011/07/28/nuke_scanner_scheme_ditched/

Plans to install nuclear radiation detectors at all US ports of entry have been dropped.
Technical glitches and false alarms with temperamental kit led to a decision to ditch the $1.2bn scheme by Homeland Security officials. Instead of a nationwide rollout, only a few trial deployments of 13 prototypes will now take place: a face-saving move given the millions already ploughed into the programme. Four of the detectors, developed by defence contractor Raytheon, have already been deployed at unspecified locations.

"The [Advanced Spectroscopic Portal] will not proceed as originally envisioned," Warren Stern, director of the Domestic Nuclear Detection Office, told a Congressional Homeland Security technology subcommittee. "We will not seek certification or large-scale deployment of the ASP."
An estimated $230m has been spent over five years to develop equipment capable of detecting radiation in cargo. The project's main aim was to guard against the possibility that terrorists might smuggle nuclear weapons into the US using cargo containers, the sort of scenario that been the staple of shows like 24 for years, and one that US counterterrorism experts still take seriously, despite recent successes in the fight against al Qaeda.

Cargo lorries would have been driven through the portal, which would have detected if anything was amiss, as depicted in a Global Security Newswire story here. However field tests showed that some of the operational requirements set up at the start of the programme were "no longer valid," Stern told Congress.

Doubts about the effectiveness and reliability of the container nuke-detecting kit were first raised in a National Academy of Sciences report released in January. A more recent Government Accountability Office report expressed concerns that the project was running over-budget.
Scaled-back plans call for the use of RadSeeker, a hand-held device, and less sensitive polyvinyl toluene portal monitors.

Source: http://www.theregister.co.uk/2011/07/28/topiary_arrest_rumor/

The 19-year-old Scotsman fingered Wednesday as a central figure of the LulzSec hacking crew is a fall guy who was framed to take the heat off the real culprit, according to unconfirmed claims from a rival group.

“We believe MET Police got the wrong guy and it happens because of lot of disinformation floating on the web,” a Thursday post on the LulzSec Exposed blog said. “LulzSec and Anonymous members are Master trolls and they are good at this.”

According to the post, penned by members of a group calling itself the Web Ninjas, the real LulzSec figure known as Topiary is a 23-year-old Swede, who stole the handle from a low-level member after he ran afoul of its parent group Anonymous. The mistaken identity was part of an elaborate ruse to confuse authorities about Topiary's true identity, the speculation claims.
The post comes a day after the Metropolitan Police said a "pre-planned intelligence-led operation" led them to a residential address in the Shetland Islands, off the North Coast of Scotland. That's where they apprehended an unnamed 19-year-old man and transported him to London for questioning. Police said they also questioned a 17-year-old from Lincolnshire and searched his home.

Thursday's post is devoid of any smoking guns, as is the case with almost all claims made in the shadowy world of anonymous people claiming to be elite hackers. For proof it points to this page purporting to contain information, pictures and videos of the real Topiary. The individual portrayed is almost certainly not that of the Scotsman arrested Wednesday.

Additional evidence comes by way of a chat log published near the bottom of this page purporting to show the real Topiary agonizing over the possibility that police are closing in on him.

“If I go hide then people will assume the dox are right,” he says, referring to the information posted on LulzSec Exposed. “So I'll just act like they failed hard.”

Several lines later, referring to the individual he stole his nick from, Topiary says: “I'm hoping someone will go after him and think it's me, then I'll act all scared etc. ANYTHING to divert attention from that fuckign nameshub.”

Of course, the chat log could have been fabricated by just about anyone, including people who want to generate doubt in the minds of Metropolitan Police investigators. With anonymous figures pursuing multiple levels of subterfuge, separating truth from fiction has become a full-time occupation for those trying to unravel this saga.

InfoSec Daily Podcast Episode 437 [ 41:23 | 18.95 MB ] Play Now | Play in Popup | Download (164)

InfoSec Daily Podcast Episode 437 for July 27, 2011.  Tonight's podcast is hosted by Karthik Rangarajan, Matthew Romanek, Geordy Rostad and Varun Sharma.

Announcements:

SANS Security 464 – Hacker Detection for Systems Administrators with Continuing Education Program – Russell Eubanks
Where: Atlanta, GA
When:  Tue, Aug 09 to Wed, Aug 10
https://www.sans.org/mentor/details.php?nid=25573

#BruCon
When: Sept 19-22, 2011
Where: Brussels, Belgium
http://blog.brucon.org/2011/02/confirmation-of-brucon-dates.html

@DerbyCon
When: September 30th – October 2, 2011
Where: Louisville, KY
http://www.derbycon.com/

SANS Mentoring: Forensics 408 – Computer Forensic Essentials
When: Wednesday, October 12, 2011 – Wednesday, December 14, 2011
Where: Atlanta, GA
Discount Code: ISDPod15 (15% discount)
http://www.sans.org/mentor/details.php?nid=25504

Hack3rCon 2011
When: October 21st-23rd, 2011
Where: the Charleston House Hotel and Conference Center
http://www.hack3rcon.org/

2011 Fall Information Security Conference
When:  November 8 – 9, 2011
Where: Atlanta, GA (Loudermilk Conference Center)

http://www.gaissa.org

Stories:

Source: http://techcrunch.com/2011/07/26/jumio-turns-webcams-into-credit-card-readers-and-why-merchants-will-welcome-netswipers/

If it were up to Jumio, we’re all going to be ‘netswiping’ to purchase books, clothes, travel, FarmVille crops and whatnot online in a couple of years. The startup has been extensively testing its digital payments service in private beta mode since last year, when Jajah founder Daniel Mattes started teasing whatever they were building.

The startup has since assembled an impressive advisory board, including former Google exec Zain Khan, former Amazon exec Mark Britto and Maarten Linthorst, CEO of CSI Communication Systems. And we recently learned that Facebook co-founder Eduardo Saverin and other investors pumped $6.5 million into the startup.

Today, Jumio is finally unveiling Netswipe, a technology solution that enables e-commerce site owners and Internet retailers to process online and mobile payments by having customers ‘swipe’ their credit cards using virtually any webcam. Think of it as Square for the Web, without the need to purchase and install additional hardware. Watch the video below to see how it works, in a nutshell.

Jumio is introducing three products for online merchants: Netswipe Start, Netswipe Scanning and Netswipe Processing. Additional products, including a mobile solution, will be released later this year.

The idea of processing digital payments by scanning credit card information isn’t entirely new, we should note. Last month, for example, saw the launch of Card.io, a startup that is developing mobile applications also capable of scanning credit cards using smartphone cameras, and some other applications like AisleBuyer include similar features.

Netswipe will, howevever, allow merchants to securely process payments both on the Web and mobile – and like Card.io, Jumio intends to enable third-party developers to integrate the technology into their own apps and services. It’s also worth noting that Jumio claims its technology is patented.

Jumio says credit cards that are used to pay for goods and services via Netswipe are not ‘photographed’ – rather, the scans are made using videostreaming technology, which enables the company to recognize and verify the card details without storing any data on the client side.
The main benefits for merchants to implement such a solution are: reducing the time between a customer’s decision to purchase something online and effectively making a transaction, minimize the friction (entering credit card information by typing can be tedious and distracting) and reducing fraud.

Jumio CEO Daniel Mattes says that, during the pilot phase, a survey with a focus group showed a decrease in churn rate from 52% to 21%. This may well have been more of an exception than the rule, but for most businesses even a 5 percent decrease would have a big impact on the bottom line.

Mattes posits that online retailers and e-commerce site owners can quickly and easily implement Netswipe on their websites, and that the solution doesn’t rival but instead complements existing payment solutions that have usually already been deployed (PayPal etc.).
If all this is true, the Netswipe technology solution is one hell of a unique selling proposition for everyone involved – little or no downside and a lot of upsides for sellers and an additional, convenient method of payment for buyers.

The proof of the pudding is of course in the eating, as they say, so I’d be very interested to learn from online merchants and e-commerce business owners what their thoughts on the new service are.

Source: http://www.theregister.co.uk/2011/07/27/beware_of_stuxnet_clones/

Officials with the US Department of Homeland Security warned that hackers could attack the country's power generation plants, water treatment facilities, and other critical infrastructure with clones of the Stuxnet computer worm, which was used to disrupt Iran's nuclear-enrichment operations.

Stuxnet was first detected last July as a self-replicating piece of malware that spread virally through SCADA, or supervisory control and data acquisition, systems used to control valves, gears, and other physical processes in industrial plants and factories. It was eventually identified as a highly sophisticated worm that exploited previously unknown vulnerabilities in Microsoft Windows and Siemens software that actively sought to sabotage several uranium enrichment facilities in Iran.

Speculation has abounded that it was the covert work of Israel, the US, or both.
At a hearing Tuesday before a subcommittee of the US House of Representatives Committee on Energy and Commerce, DHS officials said they are worried the wealth of technical details and code samples from Stuxnet could lead to clones that similarly target critical infrastructure in the US.

"Looking ahead, the Department is concerned that attackers could use the increasingly public information about the code to develop variants targeted at broader installations of programmable equipment in control systems," Roberta Stempfley and Sean P. McGurk warned in written comments posted on Wired.com, which reported on the warning earlier. "Copies of the Stuxnet code, in various different iterations, have been publicly available for some time now."
The ICS-CERT, short for the Industrial Control Systems Cyber Emergency Response Team, and the National Cybersecurity and Communications Integration Center "remain vigilant and continue analysis and mitigation efforts of any derivative malware," they added.

Stempfley and McGurk are the DHS assistant secretary for the DHS Office of Cybersecurity and Communications and director of the National Cybersecurity and Communications Integration Center Office, respectively. Their comments before the US House's Subcommittee on Oversight and Investigations warned that various nation states, terrorist networks, organized crime groups, and individuals on US soil "are capable of targeting elements of the US information infrastructure to disrupt, or destroy systems upon which we depend."

ICS-CERT recently warned that SCADA software originating from China and used by some customers in Europe, the Americas, and elsewhere contain security holes that could leave them open to Stuxnet-style attacks. The worm attacked five industrial plants inside Iran in 12,000 separate infections over a 10-month period, causing centrifuge arrays to malfunction.

Source: https://www.nytimes.com/2011/07/26/technology/for-suspected-hackers-a-sense-of-social-protest.html?_r=1

The F.B.I.’s arrests of 14 people last week were the most ambitious crackdown yet on a loose-knit group of hackers called Anonymous that has attacked a string of government agencies and private companies over the last eight months.

But at least some of the suspects are not your typical hard-core hackers, judging from interviews with two of them and the online traces of others. Some did not bother to cover their digital tracks as they participated in what they saw as an online protest. And some say they were unaware that their feverish clicks on a home computer may have been against the law.
The suspects, mostly in their 20s and living unremarkable lives in small towns and suburbs across the country, now face up to 15 years in prison. Among them are a college student, an ex-Marine, a couple of self-taught computer programmers, even a young man whose only celebrity before last week’s arrest was that he dressed up as Harry Potter for a movie premiere.
While federal law enforcement officials are clearly keen to quash the notion that online attacks are a form of social protest, the arrests highlight a far bigger challenge facing the authorities as they try to stop digital raids carried out by a large and ideologically motivated group of people scattered across the globe.

The Justice Department has accused the suspects of being part of a criminal conspiracy to damage the Web site of PayPal, the online payment company owned by eBay, which announced last December that it would stop processing donations for WikiLeaks after it exposed classified government information.

Anonymous encouraged retaliation against PayPal, rallying supporters on Twitter. Untold numbers of people — probably hundreds — jumped into the Anonymous-affiliated chat rooms. Some of them began lobbing large packets of data aimed at overwhelming PayPal’s system, using a program called Low Orbit Ion Cannon. The site was hampered for several hours.
Drew Phillips, a wry, serious 26-year-old programmer with a paunch that testifies to hours spent hunched over a computer, admits to joining one of those chat rooms when the attack was being discussed, and to tinkering with the program used in the attack. He said he could have obscured his Internet Protocol address, which can be used to identify a computer, had he thought that anyone was interested in what he was doing.

“I didn’t have anything to hide. I didn’t feel I had to mask my I.P. address,” he said over a caffe mocha at a coffee shop not far from Santa Rosa, his placid middle-class hometown north of San Francisco. “What would anyone want with me?”

Mr. Phillips admits he was sympathetic to the strike against PayPal, but he maintains he did not actually participate.

It took federal officials only a few weeks to catch up with Mr. Phillips. Police and federal agents with a search warrant, arrived at his home early one morning in January.

“What, did I download one too many movies?” he remembers asking facetiously. Federal agents were interested in what he was doing with the Low Orbit Ion Cannon software. Mr. Phillips, who works for a solar energy company, said he used it to test the endurance of his employer’s computer systems. They left with all his equipment: a server he had built himself, a desktop, two laptops and several flash drives. Federal agents returned last week to arrest him, charging him with causing damage to a protected computer and a related conspiracy charge. He says wryly that he suspects the government needed to make an example out of him.

Eugene H. Spafford, a computer security professor at Purdue University, was not convinced that the arrests last week would serve as a deterrent. Rather, he said, it could prompt others to be more careful in the future and even prompt retaliatory strikes.

“A whole bunch of people were angry, they didn’t really think about whether it was legal or not. It never entered their minds,” Professor Spafford said. “This was kind of the equivalent of a spontaneous street protest, where they may have been throwing rocks through windows but never thought that was against the law or hurting anybody.”

A federal law enforcement official, who would not be named because he was not authorized to speak about an active case, argued that denial-of-service attacks like the one against PayPal were costly and illegal: “These things are costing companies millions of dollars.”

The official acknowledged that some of those arrested “used unsophisticated techniques.” But when asked if the authorities were overreacting, he said, “No, it’s never heavy-handed to address violations of law, particularly in this arena of cybersecurity, where the threat is so pervasive.”

Source: http://www.prnewswire.com/news-releases/passware-proves-mac-os-lion-insecure-revealing-login-passwords-in-minutes-126166663.html

Passware Inc., a provider of password recovery, decryption, and electronic evidence discovery software for computer forensics, law enforcement organizations, government agencies and private investigators, announces that Passware Kit Forensic v11 – a new version of its flagship product – recovers Mac OS user login passwords from computer memory in a matter of minutes.                                                                                                            As Apple's operating system has increased in popularity in recent years, so have security threats for users. Passware President Dmitry Sumin notes, "Long touted as a stable and secure operating system, Mac users are cautioned that the newest operating system has a potential vulnerability that enables password extraction from devices running Mac OS Lion."

The Mac OS vulnerability relates to user login passwords that are stored in the system memory even if the computer is locked or put into a sleep mode. Passware Kit Forensic v11 captures live Mac computer memory over FireWire and analyzes it, extracting these passwords. The process takes a few minutes, regardless of the password strength and use of a FileVault encryption. The vulnerability is present in all modern versions of Mac OS, including Mac OS X 10.6 Snow Leopard and the latest Mac OS X 10.7 Lion, released last week.

Passware previously implemented the same technique to decrypt hard disks encrypted with BitLocker and TrueCrypt (see press release: http://prn.to/pw-bt).

The security risk is easy to overcome by simply turning off the computer instead of putting it to sleep, and disabling the "Automatic Login" setting. This way, passwords will not be present in memory and cannot be recovered.

Sumin continues, "I am a Mac user myself, but it's important to understand the limitations of your computer's security, even if you are not a computer forensics expert. If data stored is confidential, it is important to ensure physical security of the computer. One might also consider using additional encryption software."

Source: http://www.infowars.com/tsa-agent-poses-as-cop-to-harass-woman/

A TSA agent in Connecticut was charged with harassment after he posed as a cop by flashing his badge at a woman in an attempt to intimidate her into driving faster, an incident that highlights concerns about the TSA becoming a domestic security force.

The woman called police after off-duty TSA worker Donald Eichler, 63, began aggressively tailing her vehicle before flashing his TSA badge at her at around 9:30am yesterday in South Windsor.

“He told police he was upset that the woman was driving slightly below the speed limit on Sullivan Avenue, honked his horn a few times and showed her his TSA badge to try to get her to speed up, according to a release from police,” reports NBC Conneticut.

The woman said she felt scared and intimidated by Eichler’s behavior, who was subsequently arrested and charged with driving a vehicle to harass or intimidate. His case is set to be heard on August 8 at Manchester Superior Court.

Considered in isolation, the incident appears to be little more than a petty power trip, but when you factor in the documented epidemic of harassment, criminality and abuse that TSA agents have been caught engaging in both on the job and off-duty, it’s not surprising that the rollout of an army of TSA agents to provide “security” at every level of American society, from train stations to bus terminals, from highways to high school proms, is stoking concerns that the federal agency is set to become the de facto “civilian national security force” that Barack Obama promised in his pre-election speech.

As we have documented, TSA grope downs and body scans are now being rolled out ubiquitously as part of the VIPR (Visible Intermodal Prevention and Response) takeover of the country.

The TSA has also announced its intention to expand the VIPR program to include roadside inspections of commercial vehicles, setting up a network of internal checkpoints and rolling out security procedures already active in airports, bus terminals and subway stations to roads and highways across the United States.

Source: http://www.infowars.com/nsa-admits-it-tracks-americans-via-cell-phones/
The general counsel of the National Security Agency testified to a Senate hearing yesterday that he believes the agency has the authority to track Americans via cell phones.
“There are certain circumstances where that authority may exist,” said Matthew Olsen the current nominee to head up the National Counterterrorism Center.
Olsen made the comments to the Senate Select Committee on Intelligence as Sen. Ron Wyden (D., Ore.) repeatedly asked if the government has the authority to “use cell site data to track the location of Americans inside the country.”
Olsen added that the reason his answer was not definitive was that “it is a very complicated question”, assuring the committee that the NSA would provide more information in a future memo.
Sen. Wyden recently wrote (full letter below) to the Director of National Intelligence demanding to know whether the CIA and the NSA “have the authority to collect the geolocation information of American citizens for intelligence purposes.”
“If yes, please explain the specific statutory basis for this authority,” the letter, co signed by Sen. Mark Udall (D., Colo.) states.
The Senators also requested information on how many Americans have been monitored under authority granted by 2008 legislation amending the Foreign Intelligence Surveillance Act. “Have any apparently law-abiding Americans had their communications collected by the government?” the letter asks.
Two months ago Wyden expressed concern that the law relating to surveillance is unclear. “The law is being secretly interpreted by the executive branch” Wyden noted.
Along with Congressman Jason Chaffetz (R., Utah), Wyden has introduced a joint bill that would force any government agency to secure a search warrant and show probable cause before tracking the location of any American.

InfoSec Daily Podcast Episode 436 [ 36:42 | 16.8 MB ] Play Now | Play in Popup | Download (163)

InfoSec Daily Podcast Episode 436 for July 26, 2011.  Tonight's podcast is hosted by Karthik Rangarajan, Beau Woods, and Varun Sharma.

Announcements:

SANS Security 464 – Hacker Detection for Systems Administrators with Continuing Education Program – Russell Eubanks
Where: Atlanta, GA
When:  Tue, Aug 09 to Wed, Aug 10
https://www.sans.org/mentor/details.php?nid=25573

#BruCon
When: Sept 19-22, 2011
Where: Brussels, Belgium
http://blog.brucon.org/2011/02/confirmation-of-brucon-dates.html

@DerbyCon
When: September 30th – October 2, 2011
Where: Louisville, KY
http://www.derbycon.com/

SANS Mentoring: Forensics 408 – Computer Forensic Essentials
When: Wednesday, October 12, 2011 – Wednesday, December 14, 2011
Where: Atlanta, GA
Discount Code: ISDPod15 (15% discount)
http://www.sans.org/mentor/details.php?nid=25504

Hack3rCon 2011
When: October 21st-23rd, 2011
Where: the Charleston House Hotel and Conference Center
http://www.hack3rcon.org/

2011 Fall Information Security Conference
When:  November 8 – 9, 2011
Where: Atlanta, GA (Loudermilk Conference Center)

http://www.gaissa.org

Stories:

Source: http://blog.thoughtcrime.org/sslsniff-anniversary-edition

In one week it will have been 9 years since I first published sslsniff — way back in 2002!  While sslsniff has evolved to be a general-purpose MITM tool for SSL connections, I originally published it as a proof of concept exploit for the BasicConstraints vulnerability that I released along with it.

The vulnerability was that, back then, nobody really validated certificate chains correctly.  Webkit browsers, as well as the Microsoft CryptoAPI (and by extension Internet Explorer, Outlook ,etc…), validated all the signatures in a certificate chain, but failed to check whether the intermediate certificates had a valid CA BasicConstraints extension set. This meant that you could take any old CA-signed certificate and use it to sign any other certificate.

In other words, if you bought a valid certificate for your website, what you got was the equivalent of a CA certificate. You could use it to create a valid signature for any other website, and (naturally) intercept SSL traffic.

Today, Gregor Kopf and Paul Kehrer released an advisory for iOS, announcing that it is also vulnerable to the BasicConstraints attack. Since this is the anniversary of the bug that prompted the release of sslsniff to begin with, I've updated it to add iOS fingerprinting support.  To intercept traffic from vulnerable iPhones, simply run:

sslsniff -a -c <path/to/your/certificate> -f ios -h <httpPort> -s <sslPort> -w iphone.log
Enjoy!

Source: http://www.yomiuri.co.jp/dy/national/T110721005341.htm

Police have arrested a man on suspicion of storing a computer virus on his personal computer without legitimate reasons, the Metropolitan Police Department announced Thursday.

The MPD arrested 38-year-old Yasuhiro Kawaguchi of Ogaki, Gifu Prefecture, at his home Sunday immediately after investigators confirmed he was storing the virus in question on his personal computer.

The revised Penal Code, which was enforced July 14, bans storage of a computer virus for the purpose of infecting other computers. Violators can be sentenced to a maximum of two years in prison or fined up to 300,000 yen.

The virus found on Kawaguchi's computer works by repeatedly copying vast amounts of graphic elements and files on a computer, causing it to freeze or malfunction, according to the MPD.

The MPD suspects about 2,000 users of file-sharing software have been infected with the virus.

According to the MPD, it was the first case in the country after the revised Penal Code, which also prohibits the creation and distribution of viruses, was put into force this month.

Kawaguchi uploaded a file containing the virus, which was titled to suggest child pornography, to the Internet via the file-sharing software Share. People who downloaded the file and opened it on their computers, or activated a DVD onto which the file was saved, would cause their computers to be infected, according to the MPD.

Kawaguchi, unemployed, admitted storing the virus and told the MPD that he did it to punish people who use file-sharing software, according to the MPD.

Source: http://www.pcpro.co.uk/news/security/368851/foreign-spy-masters-could-infiltrate-hacker-groups

Foreign powers could try to infiltrate hacktivist networks in order to manipulate their actions, according to a security expert who advises governments and businesses on internet issues.
The warning comes as governments and corporations - including defence manufacturers – come under widespread attack from hacker groups such as LulzSec and Anonymous, and amid growing fears about cyber espionage from sovereign powers, especially China.
Likening the emergence of the hacktivist movement to the arrival of militant groups such as the Red Brigade during the 1970s, government advisor and chair of the International E-crime Congress, Simon Moores, said that hacker groups could eventually be swayed by outside influences.

“If you have a LulzSec or an Anonymous that is perhaps being manipulated by a foreign actor, it takes us back to the days of the Stasi and the KGB, which were manipulating [anti-nuclear campaign group] CND quite easily from Moscow,” he said, referring to reports that the anti-nuclear peace movement was unwittingly compromised and manipulated by Kremlin
machinations.

According to Moores, mustering popular support for an issue through online hacktivist groups and forums could be used as a tool to drive policy to perform actions that furthered a country's interests.

And because the hacker groups are distributed, anonymous and at least in part consist of ideologists – as shown with hacks against financial institutions when they blocked payments to WikiLeaks – Moores believed they were especially vulnerable to interference from outside sources.

“So you could have the teenaged hacker who thinks they’re doing something for the greater good by revealing information or attacking greedy billionaires, but in fact they are being manipulated for more sinister purposes by someone who has infiltrated their network,” he said. “If you were a spy master wouldn’t you be doing that?”

Comment from boboon:

“This misses a basic point, which is that in order to infiltrate agents would have to profess and act on the ideals, values and public goals of the organisations they're infiltrating, so they'd make no effective difference.

The CND example is telling in that regard – whether it was infiltrated or not, it did what it said on the tin – campaigned for nuclear disarmament.

The national security expert's fears of foreign interference amount to a bizarre fear of pollution or contamination – 'omg, there's a gru agent in Lulzsec, ergo they are a tool of the russian state'.

This is magical thinking, arguing that the hacker groups are contaminated on and by contact as such.

They could be steered of course, but only if agents intervened in the internal discourse of the organisation, and with any ideological group you'd find there are core organising principles that prove remarkably sticky. Infiltrating agents end up acting for those ends, often more diligently and competently than ordinary members.

Of course there's the possibility of agent provocateur type actions, but those would be to destroy the group, not use it as a foreign policy tool. And groups can police and defend themselves from such internal sabotage, albeit imperfectly.

This is more about attempting to negate radical, ideological groups by conceptually reducing them to cynical instruments of foreign puppetmasters in the shadows – hardly a new tactic, the idea that Lenin worked for the Kaiser is still trotted out – which as a rhetorical strategy veers dangerously close to the paranoid style.

It's also to get a hold some of the national security funding pie by constructing a new vector for geopolitical threats (no different from endless pentagon satellite thinktanks spinning tales about space militarisation).”

Source: http://debka.com/article/21133/

Intelligence sources report that the Stuxnet malworm which played havoc with Iran's nuclear program for eleven months was not purged after all. Tehran never did overcome the disruptions caused by Stuxnet or restore its centrifuges to smooth and normal operation as was claimed. Indeed, Iran finally resorted to the only sure-fire cure, scrapping all the tainted machines and replacing them with new ones.

Iran provided confirmation of this Tuesday, July 19 in an announcement that improved and faster centrifuge models were being installed.

Iran would clearly not have undertaken the major and costly project of replacing all its 5,000-6,000 centrifuges with new ones if they were indeed functioning smoothly. The announcement was made by the Iranian Foreign Ministry spokesman at a press briefing although no one present had raised the nuclear issue. He said: "The installation of new centrifuges with better quality and speed is ongoing… this is another confirmation of the Islamic republic's successful strides in its nuclear activities."

Britain and France immediately condemned the announcement. It proved, official spokesmen commented, that Iran plans to triple the amount of uranium it enriches in contravention of six UN Security Council Resolutions and defiance of ten International Atomic Energy Agency decisions in Vienna. The announcement also "confirmed suspicions that the Iranian nuclear program had no credible civilian application."

Stories: http://news.cnet.com/8301-17938_105-20081527-1/cast-off-gadgets-peek-into-new-owners-lives/?tag=mncol;1n

There is an afterlife–for electronics, anyway. Ever wonder what it's like? Researchers at MIT tracked used computers to find out. The project gives you a glimpse of where cast-off laptops and smartphones end up.

Rather than simply providing statistics about the global flows of secondhand electronics and e-waste, the MIT Senseable City Lab researchers produced a series of images of the gadgets' new owners and their surroundings. The images hail from Indonesia, South Asia, and Africa.

For the project, dubbed Backtalk, researchers sent refurbished Netbooks to developing countries via nonprofit organizations. They set up the computers to record location and pictures, and send the data home to MIT–with their new owners' consent. The Netbooks carried stickers explaining the project in the local language.

The researchers captured the data using the open-source antitheft software Prey, which records a computer's GPS coordinates and takes a picture with the computer's camera every 20 minutes.

The MIT team used the data to build visual narratives about the computers' new lives. Here's a summary from the project Web site:
“The information [the Netbooks] report back offers firsthand perspectives–glimpses into e-waste recycling villages, local thrift stores, public schools, and libraries–that prompt a reflection on our society's relationship with our electronic devices.”

The images are random windows into the everyday lives of people in developing countries. At once dreamlike and voyeuristic, they introduce an exotic remoteness to otherwise mundane scenes: a home in India, a classroom in Ghana, a shop in Nepal.

InfoSec Daily Podcast Episode 435 [ 33:11 | 15.24 MB ] Play Now | Play in Popup | Download (153)

InfoSec Daily Podcast Episode 435 for July 25, 2011.  Tonight's podcast is hosted by Rick Hayes, Beau Woods, Adrian Crenshaw, Karthik Rangarajan, Geordy Rostad and Varun Sharma.

Announcements:

SANS Security 464 – Hacker Detection for Systems Administrators with Continuing Education Program – Russell Eubanks
Where: Atlanta, GA
When:  Tue, Aug 09 to Wed, Aug 10
https://www.sans.org/mentor/details.php?nid=25573

#BruCon
When: Sept 19-22, 2011
Where: Brussels, Belgium
http://blog.brucon.org/2011/02/confirmation-of-brucon-dates.html

@DerbyCon
When: September 30th – October 2, 2011
Where: Louisville, KY
http://www.derbycon.com/

SANS Mentoring: Forensics 408 – Computer Forensic Essentials
When: Wednesday, October 12, 2011 – Wednesday, December 14, 2011
Where: Atlanta, GA
Discount Code: ISDPod15 (15% discount)
http://www.sans.org/mentor/details.php?nid=25504

Hack3rCon 2011
When: October 21st-23rd, 2011
Where: the Charleston House Hotel and Conference Center
http://www.hack3rcon.org/

2011 Fall Information Security Conference
When:  November 8 – 9, 2011
Where: Atlanta, GA (Loudermilk Conference Center)

http://www.gaissa.org

Stories:

Source: http://www.theregister.co.uk/2011/07/22/mac_battery_hack/

Now that Apple has endowed the Mac operating system with state-of-the-art security protections, a researcher has devised new attacks that target the machine's battery.

Charlie Miller, well known for his numerous attacks on iPhones and Macs, may not have achieved his ultimate objective of making a Mac spontaneously combust, but he has figured out how to permanently disable the battery. And in time, he said, it also may be possible to remotely hijack a machine by manipulating the firmware on one of the stored power supply's chips.

"What I found was you can make any change you want to the software that runs on the battery," Miller, who is principal research consultant at security firm Accuvant and the other coauthor of The Mac Hacker's Handbook, told The Reg. "I also saw that you can mess up the chip so it won't function anymore. You can't recover from that. You couldn't even take it to the genius bar."
The flaw making all of this possible is the result of Apple's decision to ship MacBook batteries without changing the passwords needed to run updates or make low-level changes to their embedded controllers. By reverse-engineering past updates, he had no trouble deducing the pass codes.

With these, Miller was able to make changes to the battery firmware that bricked the battery. The hack doesn't sound all that interesting until you consider that any changes will survive a complete reinstallation of the MacBook’s operating system. Miller theorized that if there's a way to cause the firmware to exploit a vulnerability in Mac OS X, his battery hack could open the door to system compromises that persist even after disinfection or reinstallation.

Miller will be presenting his findings at next month's Black Hat security conference in Las Vegas. At his talk, he will also release a software tool that patches the vulnerability by changing the default passwords that ship with MacBooks.

Source: http://hackertarget.com/tor-exit-node-visualization/

The torproject is an anonymization project that is very dependent on a diverse and wide range of exit nodes. These visualizations are an attempt to display the exit nodes diversity in an easy to read manner. Use of the Tor Project by Human Rights Organizations and others can be a great help in avoiding surveillance however you should always have a good understanding of the risks and keep your traffic encrypted end to end, as any of these exit nodes could be watching your traffic flows.

Source: http://www.theregister.co.uk/2011/07/23/cellular_hijacking/

Following the success of hijacked network Free Libyana, we took the opportunity to talk to some engineers about the complexity of lifting someone else's infrastructure, and discovered there isn't much.

In April this year, Ousama Abushagur hacked into the infrastructure built by the Libyana network in Libya.

He cut the connections to the head office in Tripoli to create his own operator, Free Libyana, connecting 750,000 people without putting up a single transmitter mast and funded entirely from donations. It was certainly an admirable achievement, but not one that's as technically complicated as it first appears – if you have local knowledge, and an army, on your side.
We spoke to network engineers at three of the UK's operators, to see how difficult they thought it would be to hijack their own infrastructure, and were uniformly told that it wasn't very hard at all.

The key requirement is knowledge of the existing topology, ideally with passwords and key phrases, but it seems that with the minimum of knowledge one can subvert great chunks of someone else's network infrastructure, and even take the customers too, as long as you're not hoping to run a 3G network and don't mind forsaking much of the security inherent in the GSM standard.

Not that one can just waltz up to a base station and take control – at least not without being noticed, as the networks are highly monitored. Disconnecting any base station will "light up [the office] like a bloody Christmas tree" as one engineer eloquently put it, which is fine if you're behind your own lines, with a battle front between you and the network engineers dispatched to see what's going on. Try it in other circumstances and you'll have a white van parked beside you within the hour.

But we're assuming you do have a popular uprising on your side, or that the engineers have more important things to do than monitor the outlying regions of their own network. Networks try to have a decentralised topology, but still generally end up with one location from where everything is controlled (though they'll generally have a fallback location too). If that location is disconnected, destroyed or otherwise engaged, then the field is open for a rogue network to set up operations.

Setting up a mobile network isn't particularly difficult – several companies make backpack-sized mobile networks that can be up and running within a few minutes. Such devices generally have a range of a few hundred yards, and their own backhaul via satellite dish.

The pack shown is from Altobridge and includes the MSC (Mobile Switching Centre), HLR (Home Location Registry), and BTS (Base Transceiver Station – the actual radio on 2G systems) as well as a suitable antenna, and satellite dish to haul the calls somewhere useful. You need to negotiate a downlink and some satellite time, and issue SIM chips to everyone making us of it, but as the range is only a few hundred yards that shouldn't present a problem.
Such solutions are eminently portable, but won't connect up the existing population, so taking over what's already there makes more sense if it can be done.

Initially one can take the portable rig and strap the antenna to a nearby mast, but it would be more sensible to plug the portable kit into an existing BTS to make use of the controller, radio and antenna which someone has thoughtfully abandoned. That should just be a matter of plugging everything in, with reasonably standard connections and communications it will give you one working base station for your new network.

Even better is to find a local BSC (base station controller). This rack-mounted kit will control a handful of BTS locations all of which can be recruited from a single BSC. The older models of BSC have no security at all, our engineers reckoned you could plug in your portable network, hit the reset switch, and be up and running in moments – though that is when the Christmas tree effect kicks in.

Now you've got a BSC, but you'll want to know where the nearby base station controllers are so you can get them powered up too, which is where knowledge of the local topology is so important.

Source: http://www.allfacebook.com/facebook-hacks-jail-2011-07

A man in California who was caught not only hacking into women’s Facebook accounts, but storing and sharing folders with nude or semi-nude images of the women was sentenced to four years in jail on Friday by a state judge.

George Bronk was able to use clues on Facebook to guess the security questions to user’s profiles. Once he got into an account he would search for nude pictures or videos women sent their husbands or boyfriends, and then distribute the images to all those women’s friends.
(Warning: It doesn’t matter how difficult your password is to guess if you make your security question something obvious. For example, if you choose “what was the name of your highschool?” for your security question, but you display the name of your highschool on Facebook, you can probably easily get hacked).

Bronk would send emails of the photos to the woman’s families, friends, and coworkers in more than 17 different states, the District of Columbia, and England, according to Associated Press.
“This case serves as a stark example of what occurs in so-called cyberspace. It has very real consequences,” Sacramento County Superior Court Judge Lawrence Brown said. “The intrusion of one’s profile is no different than intruding one’s home.”

Bronk received eight more months for charges related to child pornography. His attorney, Monica Lynch, had sought a sentence of one year in local jail followed by probation, or two years in state prison with no probation. The judge rejected her plea for a lighter sentence, saying Bronk was no different from a peeping Tom.

At a hearing earlier this year, his mother, Joyce Bronk, said her son told her he needed help for a drinking problem. He was allegedly attending Alcoholics Anonymous meetings and taking classes to be trained as an emergency medical technician, according to reports.
His mom told AP, “This was an Internet persona he created when he was a drunk.”

His dreams to be a paramedic will never be able to come to fruition, as he’ll have to register as a sex offender once he gets out of the slammer, his attorney said.