Podcasts

As many readers would no doubt already be aware, the FBI has just arrested 16 "members" of Anonymous in relation to DDoS attacks and intrusions.

The US Department of Justice swiftly issued a press release with the catchy, ALL CAPS title of "SIXTEEN INDIVIDUALS ARRESTED IN THE UNITED STATES FOR ALLEGED ROLES IN CYBER ATTACKS".

So this is a massive blow to "Anonymous" and its sophisticated campaign of mayhem, right?

Wrong.

One of the complaints details charges to be laid against Scott Matthew Arciszewski, 22. He's alleged to have somehow created an account on Infragard Tampa's Website and successfully uploaded a couple of files.

By the looks of things he made no attempt to hide his actions -- using his own IP address to conduct the "attack" -- then Tweeted about it and directed his followers toward his Website.

How stealthy.

What a criminal mastermind. I'll sure sleep better tonight knowing this criminal genius has been taken off the streets.

Another complaint alleges former AT&T contractor Lance Moore uploaded a bunch of commercially sensitive material to Fileape. That information was subsequently "redistributed" by LulzSec.

This guy isn't even alleged to be sailing aboard the Lulz Boat, but hey, at least the DoJ got to use the word "LulzSec" in an indictment. What a win!

The remaining 14 arrests deal with a DDoS attack against PayPal, apparently in retribution for that company's decision to suspend payment processing for Wikileaks. They were using LOIC. How 1337.

So what does this all amount to? A leaker with internal access (AT&T), a young guy who was able to pwn Infragard in about five minutes (great security, guys) and a bunch of LOIC users.

And yet the coverage I'm seeing still persists with this ridiculous idea that the arrests will be some sort of strike against Anonymous, the "group".

So here, let's try to get something straight, once and for all: Anonymous is not a group. It's not a hydra. It's not a "loose collective". Anonymous is just a designation. Why is that so hard to understand?

Let's try an analogy.

17th century pirates liked to steal booty. They sailed the high seas and pillaged. They had a common flag. But they WERE NOT A GROUP.

Sure, there were groups of pirates that sailed on ships together. There was a common outlook -- that plundering booty was a worthwhile activity, ho ho and a bottle of rum, all of that. But they were not a group.

There were pirate hangouts like pirate taverns, so there was congregation, but no leadership. Pirates were not a collective.

So let's clear it all up. The anons are the pirates, IRC channels and imageboards like 4chan are their pirate taverns, and the various Anonymous outfits like @AnonymousIRC and @AnonOPS are pirate ships with multiple pirates aboard. They're groups of pirates! Simple! See?

So when the Spanish, Turkish, British or whichever police force claims to have arrested "key members" of Anonymous I wonder if they're deliberately misleading the public and their masters, or if they genuinely just don't get it.

This current batch of arrests will "bring to justice" a bunch of people who made no attempt to conceal their actions because they're either technically useless or just didn't care.

They're "low hanging anons".

But that won't stop the mainstream media from portraying this as the establishment striking back at online troublemakers.

Sigh.

TL;DR: Feds arrest dummies, MSM hails capture of anon masterminds.

This week's show is all about the news -- a 30 minute dose of Metl!

With Anons being arrested, parties unknown pwning defence contractors in the name of #antisec, Sony doing (even more) dumb stuff, Zeus-grade viruses smashing Android devices, India trying to wiretap Skype, support for XP running out in less than three years, Microsoft Security Centre dishing out porn and Morgan Stanley losing customer info on unencrypted disks, we just didn't have time for a feature interview this week!

In this week's sponsor interview Astaro founder Markus Hennig joins us to discuss Sony's curious statement that its brand is recovering from all the negative press surrounding its security woes. Are they dreaming?

This week's edition of the show is brought to you by Tenable Network Security, thanks guys.

In this episode we're taking an in depth look at BitCoins. Most listeners would have heard of the fledgling online currency by now, but there are a number of things that make BitCoins extremely interesting. It's the world's first popular virtual, cryptographically supported commodity, and once you wrap your head around it, it's very cool stuff, regardless of whether or not you think it has a future.

I'll be joined by regular guest Paul Ducklin to talk about BitCoin, after the news.

In this week's sponsor interview we're joined by Tenable Network Security's Brian "Jericho" Martin. He's stopping by to discuss the trojaning of vsftpd. Some wise-ass modified the source so using a username against vsftpd that contains a smilie spawns a shell on 6200. Subtle.

Brian chats about that and his work with Attrition.org, tracking Sony's woes. The Sownage! That's all coming up after this week's feature interview. Before all of that we check the week's news with our very own beardy guy Adam Boileau!

AusCERT has broken an embargo, accidentally and prematurely broadcasting a security bulletin pertaining to multiple vulnerabilities in the BIND DNS server earlier today.

The accidental disclosure comes as the United States celebrates the evening of July 4, its independence day. The bulletin was supposed to be issued on the morning of July 6, US time. Instead, it was mailed to AusCERT's subscribers a short time ago.

The bugs themselves aren't Earth-shattering; two remote DoS conditions, including a packet-of-death-style attack. But operators of "important" BIND installations will likely be annoyed by the holiday-destroying timing of the release.

"We made a mistake, we weren't supposed to issue them," AusCERT's general manager Graham Ingram told Risky.Biz. "We've apologised to group involved, we didn't quite understand the embargo, we missed it, and we accidentally released it."

AusCERT sent a bulletin recall a short time ago. In part, it reads: "We apologise if the premature announcement has caused you to initiate any action for which you are unprepared and which must now be interrupted. Please do not distribute the AusCERT bulletin. Please delete it from your system immediately and permanently."

The extra two days lead time would-be attackers may have up their sleeve due to the disclosure is unlikely to be sufficient for the bug to be weaponised before ISC2 releases the relevant patches, said a security professional who declined to be named.

"It looks like the new code/version isn't up yet, but given the statement says there's no known workarounds, it would still be of concern to an admin," our uber-sekr3t source says. "But it's an unauthenticated remote DoS. If it was a remote code execution issue, the information in the bulletin would be more useful to an attacker."

TL;DR: AusCERT make boo boo. Drunk/hungover/angry BIND admins work holiday.

Check out the latest Risky Business podcast here.

Episode 200 FTW!

In this week's feature interview we'll be chatting with Daniel Grzelak. Dan's the founder of shouldichangemypassword.com -- and interesting little website that pulls together compromised information and lets you see if you've been affected.

Dan was searching Google for .sql files that had inadvertently been made accessible online and indexed... aaaaand he found the entire database for Groupon India including plaintext passwords FOR THE LOSE!!! He'll be telling us all about that after the news.

Adam Boileau, of course, joins the show to discuss the week's security news.

NOTE: CONTAINS EXPLICIT LANGUAGE. NO NAUGHTY WORD EDITS THIS WEEK.

The database includes the e-mail addresses and clear-text passwords of the site's 300,000 users. It was discovered by Australian security consultant Daniel Grzelak as he searched for publicly accessible databases containing e-mail address and password pairs.

Grzelak used Google to search for SQL database files that were web accessible and contained keywords like "password" and "gmail".

"A few hours and tweaks later, this database came up," he said. "I started scrolling, and scrolling and I couldn't get to the bottom of the file. Then I realised how big it actually was."

Since leaving a security consulting position with Australian information security company Stratsec, Grzelak has been working on a start-up gaming media company with two friends.

As a side project, he created shouldichangemypassword.com, a website that allows any Internet user to search a database of known-compromised e-mail address and password pairs to see if their password has been compromised.

Grzelak was searching for more compromised accounts to add to the website's database when he stumbled across the Sosasta database.

The shouldichangemypassword.com database includes leaked or stolen account information from 17 recent high-profile breaches. "There are now... 1.3 million records on the site," he said. "All the LulzSec releases are included as well as data from other high profile incidents such as the Mt. Gox Bitcoin exchange hack and the Gawker breach from a year ago."

Grzelak contacted Risky.Biz after the Sosasta discovery to seek advice on disclosure. This website contacted the CEO of Groupon, Andrew Mason, who called back personally within 24 hours of initial contact.

The database was removed immediately and the company has launched an internal investigation to find out how it wound up publicly accessible in the first place.

Groupon is notifying all its Sosasta users of the incident and is advising them that the passwords they used on the website are now compromised and cannot be relied upon to secure other accounts.

Grzelak, meanwhile, says this type of accidental disclosure is actually quite common. "There are thousands of these databases indexed by Google," he said. "This just happened to be by far the biggest I found."

Groupon's statement is below:

On Friday morning India time (Thursday night Central US time), Groupon was alerted to a security issue potentially affecting subscribers of Sosasta, a website acquired by Groupon in January 2011.

After being alerted to this issue by an information security expert, we corrected the problem immediately. We have begun notifying our subscribers and advising them to change their Sosasta passwords as soon as possible. We will keep our Indian subscribers fully informed as we learn more.

Sosasta runs on its own platform and servers, and is not connected to Groupon sites in other countries.

We are thoroughly reviewing our security procedures for Sosasta and are implementing measures designed to prevent this kind of issue from recurring.

This issue does not affect data from any other country or region.

Groupon takes security and privacy very seriously. Our users' trust is of paramount importance to us and we deeply regret this incident. We will provide more information as soon as possible.

Ed: Some of the search string in the Google search screen capture has been redacted. It brought up more exposed databases...

Click here for the latest Risky Business podcast.

Put on your Hypercolor t-shirts and Swatch watches, because this week's show features an interview with Jason Scott, the founder of Textfiles.com.

If you don't remember the BBS scene in the late 80s or early nineties, well, that doesn't matter; Jason has archived all of the quirky stuff that made the BBS scene what it was back then.

[ED NOTE: CONTAINS EXPLICIT LANGUAGE (MISSED SOME EDITS)]

Textfiles.com is a culture bearer for the pre-Internet hacking scene. It's a massive archive of textfiles on everything from early hacking, phreaking and all sorts of other illicit stuff like bombmaking. w00t w00t!

Those were the days!

In this week's sponsor interview we're chatting with NetWitness security researcher Alex Cox about operational security. How concerned should you be with the operational security of your vendors? How critical is it?

We also chat with him about the opsec of those on the other side of the law. Is it possible groups like LulzSec can operate for a long period without being caught? If they're careful do the authorities stand a chance?

Adam Boileau, as usual, joins us for this week's show. Be nice to Adam. He's a sad panda at the moment because there's a bug he can't trigger. :'(

A documentary crew are looking to interview people who remember the Melbourne BBS and hacking scene in the late 1980s, early 1990s.

They're coming to Melbourne in a few weeks to film.

I've seen one of their documentaries before: Enron: The Smartest Guys in the Room, and it was pretty good. I've had a chat with the producers and it seems unlikely to me that the docco will be a hatchet job.

That said, I don't know these guys from a bar of soap, I can't make any guarantees as to their professionalism or ethical conduct.

They've asked me to assist them in finding some sources who can talk about the Melbourne "scene" in the early 90s.

I agreed to post a direct message from producer Alexis Bloom (below) on this blog because, as a journalist, I think it's important for producers of documentaries like these to have access to sources that can provide them with accurate information and context.

If you feel you can contribute or you'd like a bit more info, get in touch with me for the producer's contact details. Patrick at risky dot biz.

MESSAGE:

I'm a documentary film producer at Jigsaw Productions in New York. We’ve made films like Academy Award-winning "Taxi to the Dark Side," and "Enron: The Smartest Guys in the Room."

In essence, we're a small, independent production company that tries to call truth to power -- that takes a stand against corporate greed, military overstep, and bad governance.

You can read more about our films here: http://www.jigsawprods.com/
(Apologies for website, which is being updated.)

We've been commissioned by Universal Studios to make a documentary featuring WikiLeaks, and the ideas connected to it. I know many of you probably think this subject’s been done to death -- and so did we, at least initially. Then we started to realize that the coverage out there has been pretty thin -- the big picture is missing. And some of the reporting's been mystifyingly wrong.

We want to use WikiLeaks as a springboard to explore key issues such as information security, digital privacy, and government transparency in the 21st century. It's not a Julian Assange biopic. It's not a Bradley Manning biopic either.

Of course, part of the story of WikiLeaks deals with its protagonists, and how they came to hold the ideals that drive them today. Character is not incidental to narrative, and with Proff in particular, the years he spent in the vibrant Melbourne scene are important in terms of understanding his later goals and ideals.

We've been talking to hacker collectives in Boston, in Berlin, and in the UK. It's clear that each country has its own incubator of ideas – and Melbourne in the late 1980s and early 1990s strikes us as a pretty pioneering, interesting place, with its own distinct character. BBS's were obviously a big part of all this.

Dispel the stereotype of hackers as video-gaming, pornography downloading isolationists. We're looking for people who remember the energy of the scene. The exploration. The fun. We living in a time when non-traditional actors are giving the suits a run for their money, and we want to capture a sense of the spirit.

Our film will be distributed by Universal, for wide release in theatres.

With many thanks,

Alexis Bloom

www.jigsawprods.com

It looks like Melbourne-based hosting company and ICANN-accredited domain name registrar Distribute.IT is fighting for its very survival.

The company has posted this depressing notice on what's left of its Web-site.

It might seem crazy, but Distribute.IT is facing nothing short of an existential crisis because, absurdly, it didn't take offline backups. As the company itself put it:

"Our Data Recovery teams have been working around the clock in an attempt to recover data from the affected servers shared Servers [sic]. At this time, we regret to inform that the data, sites and emails that were hosted on Drought, Hurricane, Blizzard and Cyclone can be considered by all the experts to be unrecoverable... our greatest fears have been confirmed that not only was the production data erased during the attack, but also key backups, snapshots and other information that would allow us to reconstruct these Servers from the remaining data."

This is exactly the scenario I discussed with the host of the PaulDotCom Security Weekly podcast Paul Asadoorian during an interview in Risky Business back in episode 188 [42:05].

During that discussion I suggested to Paul that the current information security risk models were ineffective in dealing with high-impact, low likelihood events. You know, like some really determined and destructive attackers burning down a business. Paul's summed it up thusly:

"We can tell management about the risk all day long and they're not going to believe us until it happens to them. If you told an executive at any one of these companies... 'with our current defences in place and the risk management tactic that we're taking now, there's a probability that this could still happen and it would be really, really bad. They're probably just going to say 'yeah, well we think the business can just recover from that,' and what you're saying, Patrick, is that's not always the case, and our current risk management thinking is allowing for these cases to happen where, are you really going to be able to recover?"

From the Distribute.IT page again:

"This leaves us little choice but to assist you in any way possible to transfer your hosting and email needs to other hosting providers."

Distribute.IT has not been able to recover. Furthermore, it seemed the company did not think this type of attack was a serious enough risk to warrant implementing a strict offline backup regimen.

This is just one example of a poor risk decision. But there are plenty of other examples of these sorts of decisions being made in large information technology environments.

Some manager, somewhere, just decides to "wear the risk" because the assumption has always been that the organisation will recover if its risk controls fail.

It's not their fault; often it's the information security "experts" from outside the organisation who actually encourage these sorts of decisions. "Risk management methodologies" are the information security industry's attempt to pretend everything's under control.

It's not, and the Distribute.IT case proves it's not always possible to recover.

Distribute.IT might be a small business in the grand scheme of things, but do we really think we couldn't see similar sorts of existential threats to larger, IT dependent businesses that might not be as risk savvy as, say, a bank?

What about a shipping company? What about a taxi service? A manufacturer? An online retailer?

To what extent are businesses and government departments vulnerable to total annihilation from external attackers?

If anyone's interested in diving a bit deeper into flaws in risk-based information security practices, check out this interview with former NSA Technical Director, Information Assurance, Brian Snow. The interview with him kicks in at around 25:21 and I thoroughly recommend it. Brian is an extremely sharp guy and makes some very salient points.

The Distribute.IT story is a sad one. But it's a great example of what happens when people ignore risks they shouldn't. Sure, you might have tape/offline backups, but are there other risks you're wearing that you shouldn't?

What do you think? Tell us in our forum thread on this topic here.

Lulzsec has featured prominently in security discussions after their hacks of PBS, Sony, Nintendo and a raft of gaming companies in the past month.

There were even more discussions when they took aim at the CIA and went on to proclaim victory.

Patrick wrote an interesting piece which went viral titled: Why we secretly love LulzSec.

His argument was simple:

So why do we like LulzSec?
"I told you so."
That's why.

The article clearly struck a chord with many who added cries of "hell yeah!" all over the twittersphere.

There's a part of me that wants to agree, and scream "we've been telling 'em since 2000... Maybe now they will listen".

Among those who've been "telling 'em since 2000" is industry stalwart Marcus Ranum.

Ranum says a lot of things. Some things I disagree with on principle, and other times he is just being contrarian.

But at BlackHat 2000 he gave a keynote titled "Script Kiddiez Suck" that has turned out to be remarkably prophetic.

The audio is still available online, and the talk is worth hearing if only for the final line: "The Huns didn’t know how to build a Rome -- they only knew how to sack it".

Quoting from his talk:

4:00: "My suspicion is that if we as a community aren't able to change that mindset in house, we're going to have the brutal jackboots of the government going to come along and do it for you... you don't want to be in the situation five years from now where what you've got is some senior guy from the FBI telling you how all those security tools you have been using for years are illegal now. And that's where it's going to go down if you're not careful".

Do we really think the same people who brought us the Patriot Act, Guantanamo and Rendition are not currently licking their lips, and preparing to "save us" from the evil hackers?

Ranum went on to warn:

07:29: "I believe the public at large is getting sick and tired of hacking... It's no longer your companies IS department that has got a problem with people getting into your firewall... It's starting to happen. Joe Average is starting to wake up and realise that the hackers and script kiddies are not his friend and what generally happens in America when Joe Average wakes up is he lashes out in anger by calling up congressmen and so forth and you get stupid knee jerk legislation out of Washington so unless we can clean this problem up.... we going to have Washington helping us with knee jerk legislation.... either way the situation is going to have to change once Joe Average gets involved".

His talk also made specific mention of the folly of attacking news/media sites. "Don't bite the hand that feeds you," he said.

The LulzSec hacks hit all three marks so perfectly, it almost reads like a script (and has to get conspiracy theorists wondering).

1. Target the media: CHECK
2. Target government installations: CHECK
3. Target Joe Average: CHECK

When average people get their Facebook accounts hacked because some site they once used was compromised by some people they never met, anger levels are bound to rise.

Ranum predicted that the next stage would be governments using the change in public sentiment to "take the fight to the attackers", that governments would target the supply chains regulating the creation and use of security tools.

Some good might come out of the recent attacks, and mega-corps like Sony may finally have learned (through crisis) the insanity of not having a CSO role, but Governments rarely leave a crisis unexploited. It's the perfect setup for them to offer us a cure, to step in and "save" us, and in this case, I fear that that the cure will be far worse than the condition we are in.

Haroon Meer is the head honcho at Thinkst in South Africa.

@haroonmeer

Click here to check out the latest Risky Business podcast and here to subscribe via iTunes.