InfoSec Daily Podcast Episode 585 for February 3, 2012. Tonight's podcast is hosted by Rick Hayes, Boris Sverdlik, Karthik Rangarajan, Geordy Rostad, and Dr. Bonez,
Announcements:
Unsung Heros
Have you ever stumbled on a tool and wondered “Why didn’t I know this existed!” or “If only I’d had this last week on that test”… Chris John Riley has started to gather suggestions for your “unsung hero” of the tools world. He is looking specifically to gather a list of tools that aren’t on every penetration testers, or forensic investigators list, but that you have respect for. http://blog.c22.cc/2012/01/13/unsung-heros
Information Security Blogger Awards 2012
Since we were over looked again for the Best Podcast on Security you can email ashimmy@hotmail.com with your name, email address and ISD Podcast as your write-in nominee. Please note, you have to provide your blog or podcast URL so that it can be verified that you are a blogger or podcaster. Vote for your favorite blogs as well on http://www.ashimmy.com.
Brad Smith (theNurse)
We all know and love Brad Smith, aka theNurse. His humor and smiling positivity is a wonderful example for our community. At Hacker Halted he had a massive stroke and has been in the hospital ever since.
Brad and his wife did not ask for this help, but as a community we feel that if we can help we want to. Please feel free to check in for status or to donate. Either way we thank you and I know Brad thanks your for your support, prayers and positive thoughts.
http://www.social-engineer.org/brad-smith-updates/
http://www.social-engineer.org/bradsmithdonation/
Metasploit Framework Unleashed Cincinnati
When: February 11, 2012.
Where: Digitorium in Griffin Hall, the home of Northern Kentucky University’s College of Informatics
https://msfucincy.wordpress.com/
$20 donation for #HFC
Social Engineering Training
When: March 5-9, 2012
Where: Seattle, Washington
When: July 21-24, 2012
Where: Black Hat Vegas
When: August 20-24, 2012
Where: Bristol, UK
When: November 12-16, 2012
Where: Columbia, MD
http://www.social-engineer.com/social-engineer-training
Linuxfest Northwest 2012
When: Saturday, April 28th-29th, 2012
Where: Bellingham Technical College – Bellingham, WA
http://www.linuxfestnorthwest.org/
CFP now open!
AIDE 2012
When: May 21-25, 2012
Where: MU Forensic Science Center
Huntington, West Virginia
http://aide.marshall.edu
CFP now open!
LayerOne 2012
When: May 26-27, 2012
Where: Clarion Hotel – Anaheim, CA
http://www.layerone.org
CFP now open!
DerbyCon 2012 – The “Deuce” Reunion
When: September 27-30, 2012
Where: Louisville, KY
http://www.derbycon.com
Thanks to everyone that has purchased products from Amazon through the affiliate program. If you’re not familiar with the affiliate program, simply go to http://www.isdpodcast.com and locate the Affiliate Program link on the right hand side.
Source: http://googlemobile.blogspot.com/2012/02/android-and-security.html
The last year has been a phenomenal one for the Android ecosystem. Device activations grew 250% year-on-year, and the total number of app downloads from Android Market topped 11 billion. As the platform continues to grow, we’re focused on bringing you the best new features and innovations – including in security.
Today we’re revealing a service we’ve developed, codenamed Bouncer, which provides automated scanning of Android Market for potentially malicious software without disrupting the user experience of Android Market or requiring developers to go through an application approval process.
The service performs a set of analyses on new applications, applications already in Android Market, and developer accounts. Here’s how it works: once an application is uploaded, the service immediately starts analyzing it for known malware, spyware and trojans. It also looks for behaviors that indicate an application might be misbehaving, and compares it against previously analyzed apps to detect possible red flags. We actually run every application on Google’s cloud infrastructure and simulate how it will run on an Android device to look for hidden, malicious behavior. We also analyze new developer accounts to help prevent malicious and repeat-offending developers from coming back.
…
Source: http://www.h-online.com/security/news/item/Critical-PHP-vulnerability-being-fixed-1427316.html
The PHP developers are working to fix a critical security vulnerability in PHP that they introduced with a recent security patch. The current stable release is affected; however, it is not yet clear whether the questionable patch was also applied to older versions.
The cause of the problem is the security update to PHP 5.3.9, which was written to prevent denial of service (DoS) attacks using hash collisions. To do so, the developers limited the maximum possible number of input parameters to 1,000 in php_variables.c using max_input_vars. Because of mistakes in the implementation, hackers can intentionally exceed this limit and inject and execute code. The bug is considered to be critical as code can be remotely injected over the web.
…
Source: http://news.softpedia.com/news/Anonymous-Leaks-Passwords-from-Ireland-s-Foreign-Affairs-Site-250514.shtml
Anonymous hackers managed to gain access to the official website of the Irish government’s Department of Foreign Affairs, obtaining passwords used by employees and officials. Some of the passwords were used to administrate the website Irish Aid, an overseas development program.
According to The Journal, members of Anonymous Sweden led to believe that these attacks, part of OpIreland, were launched as a protest against the plans to introduce a new SOPA-like legislation.
Of the 19 credential sets leaked, 17 were used by the Department of Foreign Affairs to edit the Irish Aid website, while the other 2 were utilized by the staffers of the company that developed the site.
“We are aware of website user login information being posted online. The website server has been taken offline as a precautionary measure and the matter is being investigated by our IT specialists,” said a Department of Foreign Affairs spokeswoman.
“This is an external service and is separate to the internal Department servers; these have not been affected.”
It seems that Seán Sherlock, the junior minister behind the new law, is one of the main targets, Anonymous revealing that it plans on targeting the Labour Party’s website next, part of which Sherlock is a member.Source: http://news.cnet.com/8301-27080_3-57370710-245/how-to-identify-fake-facebook-accounts
Hello, Facebook friends, I am male, straight, often ridiculously good-looking, and this is a real message: she's not that into you.
And by she, I mean one of those hot girls on Facebook who always seems too desperate and overzealous in trying to connect to you and everyone on your friend list.
Apparently, of some 850 million active Facebook users, a lot are fake profiles created to spread spam and viruses. These are often categorized as spammers or attackers. Security firm Barracuda Networks released today the findings from its most recent study that helps distinguish attackers from real users. Here are the study's four key findings.
….
Anonymous hackers managed to gain access to the official website of the Irish government’s Department of Foreign Affairs, obtaining passwords used by employees and officials. Some of the passwords were used to administrate the website Irish Aid, an overseas development program.
According to The Journal, members of Anonymous Sweden led to believe that these attacks, part of OpIreland, were launched as a protest against the plans to introduce a new SOPA-like legislation.
Of the 19 credential sets leaked, 17 were used by the Department of Foreign Affairs to edit the Irish Aid website, while the other 2 were utilized by the staffers of the company that developed the site.
“We are aware of website user login information being posted online. The website server has been taken offline as a precautionary measure and the matter is being investigated by our IT specialists,” said a Department of Foreign Affairs spokeswoman.
“This is an external service and is separate to the internal Department servers; these have not been affected.”
It seems that Seán Sherlock, the junior minister behind the new law, is one of the main targets, Anonymous revealing that it plans on targeting the Labour Party’s website next, part of which Sherlock is a member.
At press time, the website of the Department of Foreign Affairs in back online, but Irish Aid displays a message that reveals they’re currently “undergoing essential maintenance.”
Source:
Last week, Google announced a new, simplified privacy policy. They did a great job of informing users that the privacy policy had been changed through emails and notifications, and several experts (including Ontario’s Privacy Commissioner Dr. Ann Cavoukian) have praised the shift toward a simpler, more unified policy. Unfortunately, while the policy might be easier to understand, Google did a less impressive job of publicly explaining what in the policy had actually been changed. In fact, it took a letter from eight Representatives to persuade them to provide straightforward answers to the public about their new policy.
…
Source:
A Paris court earlier this week ordered Google France and its parent company Google to pay plaintiff Bottin Cartographes 500,000 euros (about $660,000) for providing its free mapping services to businesses across the country. The court also required Google to pay a 15,000 euro fine for its practice.
"We proved the illegality of (Google's) strategy to remove its competitors," Jean-David Scemmama, attorney for Bottin Cartographes, a company that provides mapping services to businesses, told the AFP in an interview earlier this week. "The court recognized the unfair and abusive character of the methods used, and allocated Bottin Cartographes all it claimed. This is the first time Google has been convicted for its Google Maps application."
According to Scemmama, Bottin has been arguing its case against Google for two years, claiming the search giant was engaging in anticompetitive practices by using its free service to take control over the online-mapping industry.
In a statement to the AFP, Google said that it will appeal the court's decision, adding that Google Maps is still facing competition in that market.
…