InfoSec Daily Podcast Episode 600 [ 41:28 | 19 MB ] Play Now | Play in Popup | Download (54)

InfoSec Daily Podcast Episode 600 for February 21, 2012.  Tonight's podcast is hosted by Rick Hayes, Boris Sverdlik,  Adrian Crenshaw, Karthik Rangarajan, Themson Mester, Dr. Bonez, and Varun Sharma.
 

Announcements:

Social Engineering Training
When: March 5-9, 2012

Where: Seattle, Washington
When: July 21-24, 2012

Where: Black Hat Vegas
When: August 20-24, 2012
Where:  Bristol, UK
When:  November 12-16, 2012

Where:  Columbia, MD
http://www.social-engineer.com/social-engineer-training

InfoSec Southwest
When: March 30-April 1
Where: Austin, TX
http://www.Infosecsouthwest.com

Linuxfest Northwest 2012
When: Saturday, April 28th-29th, 2012
Where: Bellingham Technical College – Bellingham, WA
http://www.linuxfestnorthwest.org/
CFP now open!

AIDE 2012
When: May 21-25, 2012
Where: MU Forensic Science Center
Huntington, West Virginia
http://aide.marshall.edu
CFP now open!  If you have some Anti-Forensics talks, that would be awesome.

LayerOne 2012
When: May 26-27, 2012
Where: Clarion Hotel – Anaheim, CA
http://www.layerone.org
CFP now open!
 

Security 504: Hacker Techniques, Exploits & Incident Handling – Matt Romanek

When: June 20 – 27, 2012
Where: Courtyard Seattle Federal Way, WA http://www.sans.org/mentor/details.php?nid=28014

Defcon 20
When: July 26-29, 2012
Where: Rio Hotel and Casino – Las Vegas, NV
http://defcon.org/
CFP & Room reservations now open!

DerbyCon 2012 – The “Deuce” Reunion
When:  September 27-30, 2012
Where: Louisville, KY
http://www.derbycon.com

Thanks to everyone that has purchased products from Amazon through the affiliate program.  If you’re not familiar with the affiliate program, simply go to http://www.isdpodcast.com and locate the Affiliate Program link on the right hand side.

Stories

Source: http://net-security.org/secworld.php?id=12434
Survey scammers love targeting Facebook users, because the social nature of the network makes sure that the scam will be propagated far and wide.

The latest of these scams has been hitting the Walls of compromised accounts with posts containing a thumbnail suggesting a link to a sex video, accompanied with the following message: "[Video] WOW.. watch what Happened to his Ex Girlfriend!! [LINK] Omg. I cant believe this actually happened to his Ex-Girlfreind!"

According to Sophos, friends of the user whose compromised account posted the message have also been named in it, assuring that at least some of them will surely check out the message.

Those that follow the link are asked to install a "Divx plugin" in order to see the video – which, by the way, is not even the same video they wanted to see:
….
Source:  http://www.wired.com/threatlevel/2012/02/anonymous-friday-attacks/

Anonymous, a group not known for discipline, is giving itself a weekly deadline, a new attack every Friday.

Following the Tuesday compromise of the website of tear gas maker Combined Systems, Inc., the Antisec wing of Anonymous struck a Federal Trade Commission webserver which hosts three FTC websites, business.ftc.gov, consumer.gov and ncpw.gov, the National Consumer Protection Week partnership website.

Claiming this hack in opposition of the controversial international copyright treaty known as ACTA, which had been widely protested around the world for its potential to curtail freedom of expression on the internet, Anonymous continued the political messaging that has marked much of its recent high-profile actions.

Anons claiming responsibility for the attack spoke to Wired.com in an online chat just as it happened, freely admitting that there was nothing technically remarkable in this hack. As one remarked, “own & rm and move on.” (rm being a unix command to delete data.)

But this week’s attacks came with a promise, first articulated in the defacement of CSI, and restated on the FTC websites: Every Friday will bring a new attack against government and corporate sites under the theme of #FFF, or Fuck the FBI Friday.

“We are already sitting on dozens of unreleased targets,” said an Antisec anon, who went on to describe an inventory of already compromised servers that could fill five months or more of #FFF releases.

“Yes, each and every Friday we will be launching attacks… with the specific purpose of wiping as many corrupt corporate and government systems off our internet,” the anon continued.
The choice of the FTC is an odd one, given the independent agency has no role in ACTA negotiations. Instead, it’s tasked with fighting unfair business practices, sanctioning companies like Google and Facebook for privacy violations, and running the Do-Not-Call list – hardly the stuff of Big Brother stomping on online rights forever.

….
Source:  http://www.theregister.co.uk/2012/02/21/rim_india_bbn_server/

Research In Motion is finally set to offer the Indian authorities a permanent system for access to its consumer-focused messaging services with the installation of new Mumbai-based servers.

The Times of India was given a government briefing on the matter. It claimed that the servers have been inspected by government officials and that permission would shortly be granted by the BlackBerry maker for lawful interception of messages if the intelligence agencies there suspect terrorist or other serious illegal activity is being conducted via the platform.

It is also believed that RIM was co-operating with the authorities before this on ad hoc requests to access any email or BBM messages sent over its consumer service.

The Indian reports also claim that the government has backed down on its demands to gain access to BlackBerry Enterprise Service (BES) messages. RIM rightly always maintained that it couldn’t provide access to content running on its corporate service because it didn’t hold the encryption keys – they reside with the sponsoring organization or business.

Intelligence Bureau director Nehchal Sandhu admitted to the paper that such corporate communications were not of “high concern” anyway from a security standpoint.

However, RIM has reportedly reached an agreement with the government which effectively pushes responsibility for providing access to BES communications down to the service provider level.

….
Source:  http://www.troyhunt.com/2012/02/scamming-scammers-catching-virus-call.html

[Karthik: I watched the first 30 minutes and last 20 minutes of the video, and in all honesty, its very embarrassing given that the guy on the other end is from my end of the world. He is everything you can define in a stupid defensive scammer, and gives even scammers a bad name, let alone all of the “technical support” people we have back home.”]

A few months back I got a call one evening which was clearly a virus call centre scam; you know, the ones that call you out of the blue, tell you your PC is infected with all sorts of nasties and offer to fix it for you? Or maybe you don’t know, which of course is why these scams have been going on for quite some time and are still very active today.

Fortunately I did know about such things so rather than summarily dismissing them with a level of disdain I normally reserve only for telemarketers, I recorded the audio of the call right up until the point where they were ready to take control of my PC. I published the whole episode in my post titled Anatomy of a virus call centre scam.

But I was left wondering; what exactly were they going to do to my PC once they got remote control? Try and squeeze some cash out of me for “fixing” things? Install their own variant of “antivirus”? Or just plain old enslave my PC into being part of a botnet? So I decided to find out by letting them do whatever they wanted whilst recording the audio and the screen so the entire experience could be shared.

…….

Let give you the abridged version here in case you (quite rightly) didn’t feel like sitting through the entire thing:

1. The operator explains that the PC is infected with malicious files.
2. He directed me to Ammyy which he then used to gain remote control of my PC.
3. He started the Event Viewer then explained that errors and warnings are signs of serious problems with the PC.
4. He then had me go the LogMeIn website and attempted to start a remote support connection without entering a PIN code. Naturally this failed after which he explained it’s the “software loyalty key” for the computer and its expiration is the cause of all the “problems”.
5. Next, I was assured numerous times that there is absolutely no cost involved for him to “fix” the warranty.
6. I was then told the free warranty would cost a one-time payment of $160. Annually.
7. After explicitly prompting him, he confirmed this payment is for the software key for my Windows.
8. A PIN was given to me which I then entered into the LogMeIn website and granted them remote control to my machine. Again (on top of the Ammyy session).
9. The operator then controlled my PC and downloaded Advanced SystemCare 3, a legitimate (albeit twice superseded) product. He explicitly told it not to create a restore point when prompted.
10. SystemCare made numerous findings which the operator leveraged to explain the poor health of my PC, including an explanation that fragmented files indicated “These are all of the hardware problems”.
11. I was directed to a registration form where I registered with false information.
12. I was then forwarded to a payment gateway where credit card information was requested using a service provided by India’s Bank of Baroda.
13. At this stage I came clean and confronted the operator. Numerous excuses were made with the general gist of it being that they are honest, have not misled me and are providing a legitimate service.
14. When reviewing the system the next day whilst disconnected from the internet, the LogMeIn software loads automatically and attempts to re-establish a connection. It appears that there is now a persistent ability for Comantra to take remote control of the machine.

…

Source:  http://thehackernews.com/2012/02/iran-will-develop-their-own-security.html
 

According to latest report, Iran's Information and Communications Technology Minister announce that – Iran has prohibited import of foreign computer security software.

Because International sanctions stopped Iran from obtaining anti-virus software. So, Iran stressed that no foreign software for computer security will be imported into the country, adding that Iran will rely on its own software, made by local developers. The Bonian Daneshpajouhan Institute has about 25 smaller firms that develop domestic security software of various nature, and country will rely on it.

A senior Iranian intelligence official has claimed that an estimated 16,000 computers were infected by the Stuxnet virus, which targeted the country's nuclear facilities and other industrial sites in 2010. The ban is intended to push Iran into the production of its own malware defense instruments.

Whether the Stuxnet virus affected only computers within Iran, or whether the virus has infected computers outside the country as well. The virus, specifically designed to target Iran's nuclear facilities and other industrial sites, was created in 2010. Two more espionage viruses were recently uncovered by Iranian officials, The Stars virus embeds itself in the file systems of government institutions, and the Duqu virus gathers information.

….

InfoSec Daily Podcast Episode 599 [ 42:55 | 19.67 MB ] Play Now | Play in Popup | Download (71)

InfoSec Daily Podcast Episode 599 for February 20, 2012.  Tonight's podcast is hosted by Rick Hayes, Boris Sverdlik, Dr B0n3z, Beau Woods, Adrian Crenshaw, and Karthik Rangarajan.
 

Announcements:

Social Engineering Training
When: March 5-9, 2012

Where: Seattle, Washington
When: July 21-24, 2012

Where: Black Hat Vegas
When: August 20-24, 2012
Where:  Bristol, UK
When:  November 12-16, 2012

Where:  Columbia, MD
http://www.social-engineer.com/social-engineer-training

InfoSec Southwest
When: March 30-April 1
Where: Austin, TX
http://www.Infosecsouthwest.com

Linuxfest Northwest 2012
When: Saturday, April 28th-29th, 2012
Where: Bellingham Technical College – Bellingham, WA
http://www.linuxfestnorthwest.org/
CFP now open!

AIDE 2012
When: May 21-25, 2012
Where: MU Forensic Science Center
Huntington, West Virginia
http://aide.marshall.edu
CFP now open!  If you have some Anti-Forensics talks, that would be awesome.

LayerOne 2012
When: May 26-27, 2012
Where: Clarion Hotel – Anaheim, CA
http://www.layerone.org
CFP now open!

Defcon 20
When: July 26-29, 2012
Where: Rio Hotel and Casino – Las Vegas, NV
http://defcon.org/
CFP & Room reservations now open!

DerbyCon 2012 – The “Deuce” Reunion
When:  September 27-30, 2012
Where: Louisville, KY
http://www.derbycon.com

Thanks to everyone that has purchased products from Amazon through the affiliate program.  If you’re not familiar with the affiliate program, simply go to http://www.isdpodcast.com and locate the Affiliate Program link on the right hand side.

Stories

Source:  http://www.irongeek.com/i.php?page=security/how-i-got-pwned-lessons-in-ghetto-incident-response

Looks like a site I was letting a friend host on my shared hosting provider got hit, and from that a web shell got put on my site, and some skiddy found the web shell with a scanner and defaced my site.

Source:  http://www.zdnet.com/blog/networking/first-ipv6-distributed-denial-of-service-internet-attacks-seen/2039
The clock is running out on IPv4 on the Internet, but even so the next generation of Internet traffic protocols, IPv6, is being adopted very slowly. But, it seems IPv6 is finally making it to broad acceptance. Arbor Networks reports that the “latest milestone in IPv6 development: the first observations of IPv6 Distributed Denial of Service (DDoS) attacks.
This can only be happening because the number of IPv6-based end-points have grown large enough that possible injection points for IPv6-based attacks is now large enough for attackers to use it. At the same, time they’re finding targets on the IPv6-enabled Internet worthy of the effort needed to craft and execute attacks.
We could have expected this. Besides human nature, Arbor Network’s Worldwide Infrastructure Security Report had predicted IPv6 DDoS attacks. “This is a significant milestone in the arms race between attackers and defenders,” stated the report. “We believe that the scope and prevalence of IPv6 DDoS attacks will gradually increase over time as IPv6 is more widely deployed.” And, now, they’ve started.
According to Arbor Networks’ Senior Software Quality Assurance Engineer Bill Cerveny, “Gone are the days when a network failure on the IPv6 Internet would be ignored and undetected because, well, no one noticed (or cared). … The same thing that has made the IPv6-enabled Internet ‘valuable’ has also made it an increasingly valuable venue for attacks. While the frequency of attacks is relatively modest on IPv6 today, we expect that accelerated adoption will be followed in-kind by an accelerated pace of attacks.”
….
Source:  http://community.controlglobal.com/content/what-more-important-cyber-vulnerabilities-or-actual-cyber-incidents
The recent S4 Conference has shone a light on the cyber vulnerabilities of many industrial
controllers.  The vulnerabilities identified are generally textbook IT vulnerabilities – use of weak passwords, use of Telnet, cross-site scripting weaknesses, buffer overflows, etc. To at least
some of us in the control systems community these vulnerabilities are not unexpected.  The fact that many of these systems are also connected to the Internet as Eireann Leverett demonstrated is also not new even though the numbers of control system connected to the Internet are striking.
What is unexpected and most disconcerting are the inherent design vulnerabilities of the controllers. As Ralph Langner mentioned, it is the design vulnerabilities that the pros will go after such as Stuxnet.
There are other design vulnerabilities besides Stuxnet that don't seem to be addressed by the researchers, vendors, and end-users. These are not IT vulnerabilities but "security design" vulnerabilities in the controllers or the systems where they are used. These deficiencies were not identified as they were not vulnerabilities in performance or safety. However, when maliciously exploited, they become vulnerabilities in performance and safety. These vulnerabilities include Aurora (as demonstrated by INL in 2007) which is a "design vulnerability" in the grid itself, design issues that affected the San Bruno natural gas pipeline failure, design issues that affected the 2008 Florida outage, etc. These design deficiencies have no IT patches and can be exploited by malicious intruders. With no guidance or fixes, these incidents continue to recur sometimes with devastating results.
These deficiencies are essentially engineering vulnerabilities and therefore must be addressed by both Engineering and IT. To date, getting the two communities together has been difficult. An example was a note on the Cyber Security Forum Initiative on 2/12/12. One individual wrote the following: "There is NOTHING unique about industrial controls, they are just like any other computer system, or network. To think any differently, you have your head in the sand."
….
Source:  http://www.theregister.co.uk/2012/02/20/google_browser_password_generation/
Google is developing a password-generating tool that will bolt into its Chrome browser.
The technology is designed to painlessly create hard-to-guess passwords when users sign up to websites. Whenever a site presents surfers with a field requiring a password, Chrome will display a key icon, giving users the option of allowing the browser to generate the secret for them. This password, provided a user accepts it and it meets the site's security criteria, is reused next time the site is accessed.
Google is positioning the technology as an interim workaround for the well-known shortcomings of asking humans to come up with memorable non-trivial passwords, until more websites support OpenID, which Google views as a long-term solution to the problem.*
The ad brokering giant neatly summarises the pitfalls of password use that makes its tool potentially useful:
Passwords are not a very good form of authentication. They are easy to use but they are trivial to steal, either through phishing, malware, or a malicious/incompetent site owner (Gawker, Sony, etc.) Furthermore, since people are so apt to reuse passwords losing one password leaks a substantial amount of your internet identity.
….
 

InfoSec Daily Podcast Episode 597 [ 33:46 | 15.48 MB ] Play Now | Play in Popup | Download (63)

InfoSec Daily Podcast Episode 597 for February 17, 2012.  Tonight's podcast is hosted by Rick Hayes, Boris Sverdlik, Karthik Rangarajan, Geordy Rostad, Themson Mester, and Dr. Bonez.
 

Announcements:

Brad Smith (theNurse)
We all know and love Brad Smith, aka theNurse.  His humor and smiling positivity is a wonderful example for our community.  At Hacker Halted he had a massive stroke and has been in the hospital ever since.

Brad and his wife did not ask for this help, but as a community we feel that if we can help we want to.  Please feel free to check in for status or to donate.  Either way we thank you and I know Brad thanks your for your support, prayers and positive thoughts.

http://www.social-engineer.org/brad-smith-updates/
http://www.social-engineer.org/bradsmithdonation/

Social Engineering Training
When: March 5-9, 2012

Where: Seattle, Washington
When: July 21-24, 2012

Where: Black Hat Vegas
When: August 20-24, 2012
Where:  Bristol, UK
When:  November 12-16, 2012

Where:  Columbia, MD
http://www.social-engineer.com/social-engineer-training

InfoSec Southwest
When: March 30-April 1
Where: Austin, TX
http://www.Infosecsouthwest.com

Linuxfest Northwest 2012
When: Saturday, April 28th-29th, 2012
Where: Bellingham Technical College – Bellingham, WA
http://www.linuxfestnorthwest.org/
CFP now open!

AIDE 2012
When: May 21-25, 2012
Where: MU Forensic Science Center
Huntington, West Virginia
http://aide.marshall.edu
CFP now open!

LayerOne 2012
When: May 26-27, 2012
Where: Clarion Hotel – Anaheim, CA
http://www.layerone.org
CFP now open!

Defcon 20
When: July 26-29, 2012
Where: Rio Hotel and Casino – Las Vegas, NV
http://defcon.org/
CFP & Room reservations now open!

DerbyCon 2012 – The “Deuce” Reunion
When:  September 27-30, 2012
Where: Louisville, KY
http://www.derbycon.com

Thanks to everyone that has purchased products from Amazon through the affiliate program.  If you’re not familiar with the affiliate program, simply go to http://www.isdpodcast.com and locate the Affiliate Program link on the right hand side.

Stories

Source: https://www.eff.org/deeplinks/2012/02/members-uk-parliament-recommend-censoring-online-extremism
In a report published last week, members of the United Kingdom Parliament concluded that the Internet plays a major role in the radicalization of terrorists and called on the government to pressure Internet Service Providers in Britain and abroad to censor online speech. The Roots of Violent Radicalisation places the Internet ahead of prisons, universities, and religious establishments in propagating radical beliefs and ultimately recommends that the government “develop a code of practice for the removal of material which promotes violent extremism” binding ISPs.

While the Terrorism Act 2006 authorizes British law enforcement agencies to order certain material to be removed from websites, lawmakers on the Home Affairs Committee stated that “service providers themselves should be more active in monitoring the material they host.” Their report raises serious concerns that political and religious speech will be suppressed. Security expert Peter Neumann who testified before the Committee asked why websites like YouTube and Facebook can’t be as “effective at removing . . . extremist Islamist or extremist right-wing content” as they are at removing sexually explicit content or copyrighted material that violates their own terms of service.
…

Source: http://boingboing.net/2012/02/14/fbi-says-paying-cash-for-coffe.html

Using cash for small purchases like a cup of coffee, gum and other items is a good indication that a person is trying to pass for normal without leaving the kind of paper trail created using a debit or credit card for small purchases.

The most recent update asks coffee shop owners, baristas and other customer-service specialists to be on the lookout for the enemy who walks among us (who evidently has been reanimated from the graves of the 1950s Red Scare era of blacklisting and Communist-baiting or the KGB's constant witch hunt for capitalist sympathizers or people who resent being witch-hunted for their political beliefs).
…

Source: http://news.nationalpost.com/2012/02/16/vikileaks-house-of-commons

An IP address connected to the Vikileaks30 Twitter account — which has been burning up the Twittersphere with claims about Public Safety Minister Vic Toews’ personal life — originates within the House of Commons, it has been revealed.

The Vikileaks30 Twitter account surged into public prominence in the wake of the tabling of new legislation that would allow increased police surveillance of the Internet and those that use it.

In a bid to determine the origin of the account, which posted a string of tweets online offering alleged details relating to Toews’s divorce proceedings, the Ottawa Citizen undertook an investigation on Thursday.

An email was sent to the writer of the Vikileaks30 Twitter account, containing a link to a website. The website was monitored by the Citizen and only the author of Vikileaks30 had the address of the website.
….
Source:  http://www.nextgov.com/nextgov/ng_20120213_7454.php
The Homeland Security Department nearly doubled its 2013 funding request for cybersecurity in an otherwise slimmed-down budget.

There is bipartisan support for improving computer network defenses, so the outlook may be positive for obtaining much of the proposed $769 million from Congress. The funding would go toward the National Cyber Security Division for protecting federal networks and coordinating with the private sector on safeguarding critical infrastructure systems such as utility grids.

In 2011, Homeland Security Secretary Janet Napolitano asked for $459 for the division. The Infrastructure Protection and Programs Directorate, which oversees the program and other cyber-related initiatives, also would be boosted from $888.2 million in estimated spending this year to $1.2 billion in fiscal 2013. By comparison, the Pentagon has asked for only a $200 million increase over last year's $3.2 billion cyber request.
…
Source:  http://www.kahusecurity.com/2012/another-chinese-pack/
A Chinese website found by @switchingtoguns appears to be another Chinese exploit pack.
As mentioned in a previous post, Chinese “exploit packs” are straightforward and no-nonsense. It doesn’t use PHP, have a database, nor does it have an administration panel. It’s a collection of HTML files that contain exploit code and minimal Javascript obfuscation. Despite its simplicity, it appears to be quite effective and it seems as though that’s all that really matters to its creators.
The entry page contains iframes that call upon several exploit files in the single folder:

This pack, which we’ll call “Zhi Zhu Pack” (pronounced “jii-juu”), contains five exploits but interestingly there are no Java exploits. The first three exploits were also found in the previously announced pack we called “Yang Pack“.
* IEPeers (CVE-2010-0806)
* Flash 10.3.181.x (CVE-2011-2110)
* Flash 10.3.183.x (CVE-2011-2140)
* IE Time Element Memory Corruption (CVE-2011-1255)
* WMP MIDI (CVE-2012-0003)
Why are we calling it “zhī zhū”? There’s numerous references to the word “spider” in several of its HTML files. “Zhī zhū” in Chinese means spider so this is basically the Spider Exploit Pack.
….
Source:  http://research.zscaler.com/2012/02/dreamhost-hijacked-websites-redirect-to.html
Following the Dreamhost hack, that was revealed this week, many websites hosted by the company have been hijacked to redirect users to a Russian scam page.

I've identified hundreds of websites hosted by DreamHost that contained a PHP page redirecting to hxxp://www.otvetvam.com/. Here are a few examples:

• http://www.lciva.com/wp-content/plugins/extended-comment-options/gyrewnv.php
• http://honorboundphoto.net/photos/10007-mankato_habitat_for_humanity_golf_tournament/agtruje.php
• http://ryanmasters.ca/wp-content/gallery/our-kingdom/thumbs/tyiueg.php
• http://treatmentofpanicattacks.com/wp-content/cache/supercache/www.treatmentofpanicattacks.com/category/anxiety-support/polzin.php
• http://r4theband.co.uk/content/wp-content/themes/agregado/includes/cache/gyrewnv.php
• http://dedehaluk.com/cache/hakkinda/fgjke.php
• http://www.agustindondo.co.uk/yellowbrick/wp-content/files_flutter/modules/fgjke.php
• http://dcstavclub.org/wp-content/themes/newzen_2.0_build_105/images/fgndnju.php
• http://camtarn.org/gizmoblog/content/06/03/entry060305-180312/comments/fgjke.php
• http://derek.hinchy.org/MT-5.031-en/mt-static/support/theme_static/professional_website/themes/professional-green/polzin.php
• http://ojosdelmundo.dreamhosters.com/images/comprofiler/gallery/tghreig.php

InfoSec Daily Podcast Episode 596 [ 57:12 | 26.21 MB ] Play Now | Play in Popup | Download (155)

InfoSec Daily Podcast Episode 596 for February 16, 2012.  Tonight's podcast is hosted by Rick Hayes, Boris Sverdlik, Adrian Crenshaw, and Karthik Rangarajan.
 

Announcements:

Brad Smith (theNurse)
We all know and love Brad Smith, aka theNurse.  His humor and smiling positivity is a wonderful example for our community.  At Hacker Halted he had a massive stroke and has been in the hospital ever since.

Brad and his wife did not ask for this help, but as a community we feel that if we can help we want to.  Please feel free to check in for status or to donate.  Either way we thank you and I know Brad thanks your for your support, prayers and positive thoughts.

http://www.social-engineer.org/brad-smith-updates/
http://www.social-engineer.org/bradsmithdonation/

Social Engineering Training
When: March 5-9, 2012

Where: Seattle, Washington
When: July 21-24, 2012

Where: Black Hat Vegas
When: August 20-24, 2012
Where:  Bristol, UK
When:  November 12-16, 2012

Where:  Columbia, MD
http://www.social-engineer.com/social-engineer-training

InfoSec Southwest
When: March 30-April 1
Where: Austin, TX
http://www.Infosecsouthwest.com

Linuxfest Northwest 2012
When: Saturday, April 28th-29th, 2012
Where: Bellingham Technical College – Bellingham, WA
http://www.linuxfestnorthwest.org/
CFP now open!

AIDE 2012
When: May 21-25, 2012
Where: MU Forensic Science Center
Huntington, West Virginia
http://aide.marshall.edu
CFP now open!

LayerOne 2012
When: May 26-27, 2012
Where: Clarion Hotel – Anaheim, CA
http://www.layerone.org
CFP now open!

DerbyCon 2012 – The “Deuce” Reunion
When:  September 27-30, 2012
Where: Louisville, KY
http://www.derbycon.com

Thanks to everyone that has purchased products from Amazon through the affiliate program.  If you’re not familiar with the affiliate program, simply go to http://www.isdpodcast.com and locate the Affiliate Program link on the right hand side.

Links:
http://www.i2p2.de
https://twitter.com/#!/i2p
https://twitter.com/#!/lancejssc (protected Twitter)
http://www.irongeek.com/i.php?page=security/i2p-tor-workshop-notes
http://irongeeks.i2p

InfoSec Daily Podcast Episode 595 [ 40:06 | 18.38 MB ] Play Now | Play in Popup | Download (81)

InfoSec Daily Podcast Episode 595 for February 15, 2012.  Tonight's podcast is hosted by Rick Hayes, Boris Sverdlik, Karthik Rangarajan, and Varun Sharma.
 

Announcements:

Brad Smith (theNurse)
We all know and love Brad Smith, aka theNurse.  His humor and smiling positivity is a wonderful example for our community.  At Hacker Halted he had a massive stroke and has been in the hospital ever since.

Brad and his wife did not ask for this help, but as a community we feel that if we can help we want to.  Please feel free to check in for status or to donate.  Either way we thank you and I know Brad thanks your for your support, prayers and positive thoughts.

http://www.social-engineer.org/brad-smith-updates/
http://www.social-engineer.org/bradsmithdonation/

Social Engineering Training
When: March 5-9, 2012

Where: Seattle, Washington
When: July 21-24, 2012

Where: Black Hat Vegas
When: August 20-24, 2012
Where:  Bristol, UK
When:  November 12-16, 2012

Where:  Columbia, MD
http://www.social-engineer.com/social-engineer-training

InfoSec Southwest
When: March 30-April 1
Where: Austin, TX
http://www.Infosecsouthwest.com

Linuxfest Northwest 2012
When: Saturday, April 28th-29th, 2012
Where: Bellingham Technical College – Bellingham, WA
http://www.linuxfestnorthwest.org/
CFP now open!

AIDE 2012
When: May 21-25, 2012
Where: MU Forensic Science Center
Huntington, West Virginia
http://aide.marshall.edu
CFP now open!

LayerOne 2012
When: May 26-27, 2012
Where: Clarion Hotel – Anaheim, CA
http://www.layerone.org
CFP now open!

DerbyCon 2012 – The “Deuce” Reunion
When:  September 27-30, 2012
Where: Louisville, KY
http://www.derbycon.com

Thanks to everyone that has purchased products from Amazon through the affiliate program.  If you’re not familiar with the affiliate program, simply go to http://www.isdpodcast.com and locate the Affiliate Program link on the right hand side.

Pentest Lessons
1. When writing the report take the time to think about your target audience (who is paying your bill) Some pro-tips for reporting:

• Don’t ever start a report with “As had been expected, an extensive set of gaps exist”.
• Don’t ever  include items in the report that you have not tested against and/or collected evidence of
• Don’t ever provide a report that hasn’t been formatted properly, including a draft
• Don’t ever merge findings with recommendations in the same statement
• Don’t ever make comments such as “Clearly this server isn’t being maintained”

• Don’t ever submit a draft without checking grammar and spelling
• Don’t ever forget version control

2. In keeping with getting to know you’re audience, you might want to research at least the points of contact at your client. Although it doesn’t happen often, on occasion you might run into a client who has significantly more experience than you do. Don’t make statements expecting them to be taken at face value, especially if you are wrong. If for some reason the PoC challenges a statement with a cash wager, asking you to prove it. Either accept the challenge, or move on. Don’t challenge them in return as this effectively lowers their perception of your expertise.
 

Stories

Source:  https://threatpost.com/en_us/blogs/researchers-dump-trove-0days-popular-android-applications-020812
Researchers in China published a trove of information on previously unknown (zero day) vulnerabilities in popular applications for Google's Android mobile operating system on Wednesday, including mobile browsers and at least one mobile wallet application.
The vulnerabilities were found in a wide range of Android applications and components, including Webkit, which is used to render Web pages on Android and iOS devices, mobile versions of the Firefox and Opera Web browsers, applications for posting to Twitter and more. The vulnerabilities vary in severity, but many would allow a malicious hacker to access personal data on the device including sms messages and personal contacts, and manipulate or take control of social networking- and other third party services accessed from the vulnerable application.
Research on 6 zero day vulnerabilities was published on Wednesday by a group calling itself 80vul Quality Assurance Group. Little is known about 80vul, which describes itself as "a group of dedicated young people" on their Web page. Those vulnerabilities include cross site scripting, cross domain and cross protocol vulnerabilities in Webkit – a common component in Android, iOS and Mac OSX devices. The researchers also found a cross site scripting vulnerability on a version of the Google Reader application for HTC Mobile devices that could allow a malformed ("evil") RSS feed to access data on the device.
….
Source:  http://blog.webroot.com/2012/02/08/researchers-intercept-two-client-side-exploits-serving-malware-campaigns/
Security researchers from Webroot have intercepted two currently live client-side exploits serving malware campaigns that have already managed to infect over 20,000 PCs across the globe, primarily in the United States. Based upon detailed analysis, it can be concluded that both campaigns are launched by the same cybercriminal.

More details:
Using the BlackHole web malware exploitation kit, the malicious attackers are currently serving explots to tens of thousands of unsuspecting end users.
As you can seen in the screenshot, they have already managed to infect 20,976 hosts. 17530 hosts were successfully exploited using the Jave Rhino exploit, 3163 hosts were exploited using the PDF LIBTIFF exploit, 375 hosts were exploited using the PDF ALL exploit, 70 hosts were exploited using the FLASH exploit, 29 hosts were exploited using the HCP exploit, 26 hosts were exploited using the MDAC exploit, and 23 hosts were exploited using the Jave OBE exploit.
….
Source:  
http://www.gfi.com/page/113933/cybercriminals-cast-a-wide-net-in-january-targeting-a-broad-range-of-victims
GFI Software today released its VIPRE® Report for January 2012, a collection of the 10 most prevalent threat detections encountered during the month. Last month saw malware attacks targeting a wide range of potential victims, including gamers looking for a Pro Evolution Soccer 2012 game crack, small business owners concerned about the reputation of their business, and government organizations receiving spoofed messages from the United States Computer Emergency Readiness Team(US-CERT).
“Anyone who goes on the internet is a potential target for cybercriminals looking to infect systems and scam users,” said Chris Boyd, senior threat researcher at GFI Software. “Malware writers and phishers do not discriminate. They purposefully cast a wide net when picking their methods of attack in order to reach as many targets as possible. Whether you are a young gamer, a successful business owner or a government employee, you need to be wary when clicking on links that appear to pertain to your interests, especially when asked to submit personal information online.”
In addition to malware writers installing rootkits on the systems of gamers who were looking for a pirated release of Pro Evolution Soccer 2012, developed by Konami Digital Entertainment, Inc., scammers also latched onto the buzz surrounding the upcoming fourth installment of the Halo® video game series, developed by 343 Industries, by offering bogus beta invites in return for filling out surveys and recommending links on Facebook and Google+. These attacks leverage the popularity of these titles among the gaming community and are meant to take advantage of the mistakes some users might make when acting out of excitement about a favorite game franchise.
….
Source:  http://www.wired.com/epicenter/2012/02/perpetual-window-into-gmail/
The other day, I tried out Unroll.me, a clever new service that reads your inbox to let you unsubscribe from mailing lists and other unwanted e-mail flotsam with a single click.
As I was about to connect my Gmail account, my finger hovered over the “Grant access” button.
Wait a second. Who am I giving access to my Gmail account, anyway? There was no identifying information on their site — no company address, no team page listing the names of its team members, and broken links to their privacy policy or terms of service.
For all I knew, it could be run by unscrupulous spammers or an Anonymous troll looking for lulz. And I was about to give them unfettered access to eight years of my e-mail history and, with password resets, the ability to access any of my online accounts?
I had to dig around online to find out who’s behind it, and fortunately, Unroll.me is a totally legit NYC-based startup providing a useful service. I spoke to Perri Blake Gorman, Unroll.me’s cofounder and CMO, who assured me they’ll add all the company information as they roll out their public beta.
….
Source: http://online.wsj.com/article_email/SB10001424052970203363504577187502201577054-lMyQjAxMTAyMDEwMzExNDMyWj.html
For nearly a decade, hackers enjoyed widespread access to the corporate computer network of Nortel Networks Ltd., a once-giant telecommunications firm now fallen on hard times.

Using seven passwords stolen from top Nortel executives, including the chief executive, the hackers—who appeared to be working in China—penetrated Nortel's computers at least as far back as 2000 and over the years downloaded technical papers, research-and-development reports, business plans, employee emails and other documents, according to Brian Shields, a former 19-year Nortel veteran who led an internal investigation.

The hackers also hid spying software so deeply within some employees' computers that it took investigators years to realize the pervasiveness of the problem, according to Mr. Shields and Nortel documents reviewed by The Wall Street Journal. They "had access to everything," Mr. Shields said of the hackers. "They had plenty of time. All they had to do was figure out what they wanted."

According to an internal report, Nortel "did nothing from a security standpoint" to keep out the hackers, other than resetting the seven passwords.

Nortel's breach offers a rare level of detail about a type of international corporate espionage that is of growing concern to U.S. officials. A U.S. intelligence report released in November concluded that hackers operating from China—both government-affiliated and private-sector—are the world's most "active and persistent" perpetrators of industrial spying. The report cited a number of Chinese attacks, including one targeting Google; the theft of data from global energy companies; and theft of proprietary data such as client lists and acquisition plans at other companies.
….