Risky Business #142 -- Special guest H D Moore talks fun with NTP
"Mostly pointless" research yields interesting results...Risky Business is hosted by the team at Virtual.Offis in Sydney but sponsored, this week, by Tenable Network Security.
Risky Business is hosted by the team at Virtual.Offis in Sydney but sponsored, this week, by Tenable Network Security.
This is a sponsored podcast. Symantec sponsors the RB2 podcast so once a month we get one of their staff on the line to talk about industry trends, malware... whatever, really!
In this podcast we chat to a solicitor who specialises in IT. His name is Erhan Karabardak and he's with the firm Cooper Mills in Melbourne.
This week's edition of Risky Business is brought to you by Kaspersky and hosted by Virtual.Offis.
In this instalment of RB2 we'll be hearing from Australian Federal Police Assistant Commissioner Neil Gaughan, who heads up High Tech and Child Protection Operations, for the AFP.
On this week's show we're joined by a very special guest -- Brian Snow.
On this week's show we'll be checking the news with Adam Boileau, as we always do, then we're going to have a chat with Brett Moore of Insomnia Security.
Risky Business is back for 2010!
This week's edition of Risky Business is brought to you by Check Point Software.
This week's episode of Risky Business is the second last for the year!
In this sponsored podcast, Symantec's VP of security response joins RB2 to talk about some novel new approaches to the malware problem.
In this edition of RB2 you'll hear Paul Craig's Kiwicon 3 presentation, Hacking Scientists. As you'll hear, Paul has developed some fuzzing methodologies that he's applied to scientific software.
This week's show is brought to you by the fine folks at Sophos.
This week's show is a bit different -- we're giving you a double dose of our regular guest Adam Boileau.
This edition of RB2 features Ben Hawkes' recent talk at Kiwicon. It was called A History Of Corruption, and it really is a historical recap of memory corruption bugs. It doesn't exactly sound thrilling from that description, but it's a great talk and it's really well delivered.
This week's show is brought to you by Microsoft.
"Unu's blog" is back online and has claimed the high-profile scalp of a Symantec website.
The anonymous blogger, who goes by the pseudonym Unu, successfully extracted customer data including license keys, usernames and passwords from a Symantec website that "facilitates customer support for users of Symantec’s Norton-branded products in Japan and South Korea," the company acknowledged in a statement.
He or she published their findings overnight on the resurrected blog.
Overnight, Risky.Biz received an e-mail from someone claiming to be Unu. "My blog is back on Baywords," the e-mail reads. "With [a] new address and with a big article: Symantec, the creator of the famous Norton hacked with SQL injection."
Unu's blog has developed a cult following among security professionals, some of whom admire his brazen attacks and others who loathe his tactics.
The site mostly consists of a series of screen captures showing Web applications allegedly compromised by Unu.
The blog's victims have so far included bank and other high profile websites, including the Royal Bank of Scotland, HSBC France, the Italian Postal Service, Facebook and more.
Unu has already claimed the scalp of another computer security software maker, Kaspersky, publishing details of vulnerabilities in its websites.
In his or her latest posting, Unu praised Kasperky's reaction to his attack. "They quickly secured [the] vulnerable parameter, and even if at first they were very angry at me, [they] finally understood that I... saved nothing," Unu writes. "I have not abused in any way... the data found. My goal was, [and] is still, to warn. To call attention."
In the latest attack Unu says Symantec was storing user passwords in clear text.
"I was outraged when I saw... these users passwords are stored in CLEAR TEXT," the blog posting reads. "It seems quite strange how a company like Symantec, which sells software and security solutions... is not able to protect its own database."
A statement issued by Symantec says the company is "currently in the process of ensuring that the Web site is appropriately secured and will bring it back online as soon as possible".
The company did not offer further comment.
DISCLOSURE: Symantec is a sponsor of the RB2 podcast on Risky.Biz and Kaspersky has signed on as a sponsor of the Risky Business podcast, commencing in 2010.
Follow Risky Business on Twitter here.
Sign up for our weekly newsletter here.
RSS/iTunes podcast feeds are here.
This podcast features excerpts from Jose Nazario's session at the GovCERT Symposium in Rotterdam. The recording isn't fantastic, but you can understand what he's saying -- it's clear enough.
We've got two feature interviews in this week's show. We'll be chatting with Security-Assessment.com's Carl Purvis, who's found a way to man-in-the-middle ADSL connections by spending only $1,000 on kit. Want to own a branch office of a major corporation? No problem!
In this podcast you'll hear a Q&A with Bruce Schneier of BT Counterpane, as moderated by Risky Business host Patrick Gray at the recent GovCERT Symposium in Rotterdam, Netherlands.