Risky Business #275 -- Patch Tuesday, Indicator Wednesday?

What to do with all dem hashes and IPs!

This week's show is brought to you by our longest term sponsor, Tenable Network Security, thanks guys. In this week's sponsor interview we chat with the CEO and co-founder of Tenable, industry stalwart Ron Gula. We're chatting to him about a funny idea -- that the release of indicators of compromise might become so regular that they'll have to be handled in regular info sec team workflow. So we'll have Patch Tuesday and "which IPs owned us" Wednesday.

Risky Business #274 -- Is "active defence" legal?

Stanford law's Jennifer Granick joins the show...

In this week's feature interview we chat with Jennifer Granick, the Head of Civil Liberties at Stanford University's Centre for Internet and Society. Jennifer has extensive experience with cyberlaw -- she has acted for clients as diverse as Aaron Swartz and HBGary! She's done it all! And she joins the show to talk about a few things -- is active defence ever legal? And what the hell is going on with the Computer Abuse and Fraud Act over there in the USA?

Risky Business #273 -- The birth of the online Pinkertons?

C&C-destroying, greyhat, mercenary berserkers could be just around the corner!

In this week's feature interview we're chatting to industry legend and In-Q-Tel CSO Dan Geer about the idea of offence as defence. If someone's attacking you do you have the moral right to attack them back? Dan actually thinks you do.

EXCLUSIVE: Hacked ABC website likely breached by crooks in 2011

Leaked data points to previous compromise...

The ABC Website compromised by anonymous attackers overnight was likely already breached by cyber-criminals active on Russian forums as far back as 2011.

The user database of the Making Australia Happy television program was published overnight with the emails and hashed passwords of its 50,000 users dumped on paste websites.

The pastes were released under the tag "#OpWilders"; the breach ostensibly a revenge attack over the ABC's decision to air an interview with controversial anti-Muslim Dutch politician Geert Wilders, who visited Australia last week.

But strong circumstantial evidence has emerged that suggests the site had already been compromised by criminals. The first two password hashes in the compromised database appeared on a Russian cybercrime website, in sequence, in 2011.

Forum user "prevedma1" posted a thread in October 2011 titled "Need crack hashes" before pasting in two SHA1 hashes. The hashes are identical to the first two contained in the leaked user database. One of them corresponds to an ABC user account with moderator privileges.

You can see a screen capture here.

If this database was indeed obtained by cybercrooks back then it's likely it was used in phishing and malware campaigns. It is unclear why the supposed attacker was seeking to crack those hashes, but the ABC moderator account would have presumably afforded simple and privileged access to the site's content management system.

It's also possible the attacker was hoping the ABC admin account password was re-used elsewhere. Cracking it would be an excellent way to further propagate an attack deeper into the ABC network.

Opinion seems divided as to whether the latest hack, or "operation" in Anonspeak, was met with approval from the Anonymous community. An attack against a media organisation by a protest "brand" that supports free speech seems to run contrary to the anti-censorship ideals of the Anonymous movement.

Follow Patrick Gray on Twitter here.

Check out the Risky Business podcast here.

Risky Business #270 -- Red teaming your law firm for fun and profit

Secondary targeting all the rage...

On this week's show we're taking a look at the issue of secondary targeting. These days it's borderline likely that attackers who want information on your company's upcoming mergers and acquisition activity won't even bother attacking you to get the intel. They'll go for your law firm instead... or your accountants... or another partner.

Risky Business #267 -- 2012 in review

A look back on 2012 in infosec, as reported by Risky Business...

This week's show takes a look back at some of the big issues and stories of 2012: The arrest of the Lulzsec crew, the release of Stratfor's email by Wikileaks and the Australian government ban on Huawei participating in the NBN rollout.

Risky Business #264 -- Three Guys With Ponytails Talk About Security

PLUS: How your iPad kicks your mainframe's ass...

On this week's show I'll being playing an excerpt from a panel discussion that took place at Kiwicon -- the session was called Three Guys with Ponytails Talk Security. The three guys are PGP Corporation co-founder Jon Callas, nCipher co-founder Nicko van Someren and the University of Auckland's Peter Gutmann.

Risky Business #261 -- Divide by zero, destroy power grid

GPS receiver bugs have some unexpected consequences...

We've got a great feature interview in this week's show with a computer science undergrad in the US who worked on a paper dealing with GPS security. You'll find out how you can melt down power lines with GPS haxx! Fun for the whole family!

INTERVIEW: Sniffing USB firmware with FaceDancer

Travis Goodspeed on his new gizmo...

This podcast is an interview I did at the Breakpoint security conference with security researcher Travis Goodspeed. He's come up with a hardware device called FaceDancer that allows him to capture USB device firmware by emulating the devices. What can you do with that? Well, you can start messing with those devices, loading up custom firmware, and even use modified USB devices to attack hosts.

Risky Business #260 -- News, Ducklin, Arkin and more!

Mixed bag this week...

This week's show is brought to you by our benevolent overlords at Adobe! And this week's sponsor interview is a must listen. Adobe's director of product security and privacy Brad Arkin joins us to discuss the breach at Adobe HQ that lead to malicious binaries being signed as valid by their code signing boxes.


SUBSCRIBE NOW:
Risky Business main podcast feed:
Listen on Apple Podcasts Listen on Overcast Listen on Pocket Casts Listen on Spotify Subscribe with RSS
Our extra podcasts feed:
Listen on Apple Podcasts Listen on Overcast Listen on Pocket Casts Listen on Spotify Subscribe with RSS
Subscribe to our newsletters: