TechSNAP Season 1, Episode 125: Security by Mediocrity

Dropbox Flaws

Get the full details are two major issues with Dropbox, that are simply built into the core of the software/service.

The Cloud Fails

Reality rained on Amazon’s Cloud recently as aspects of their EC2 hosting service suffered major outages. We look at the many issues facing cloud computing. Plus we dig into the iPhone location tracking story, and brainstorm a few possible solutions to a potentially necessary evil.

PSN Breech Details

We cover the amazing details of the Playstation Network breech, we share some of the most interesting details in this episode.

A Simple Mistake

Allan Goes to War

We’ll cover the dirty details of a Facebook flaw that exposes your private account info to snoops, look into the privacy issues around “Smart Meters” and discuss a few big tech rivals coming together to fight a bad law.

Backups & Server Hardware

Every six hours the NSA collects as much data that exists in the entire lib of congress and we have a few practical notes on how a system like that could even function. We follow up on Dropbox, and what looks like the FTC is getting involved with their recent snafus.

Let’s Go Phishing

There have been 10 separate attacks against Sony, the details are like nothing we’ve ever seen before.

Hijacking the News

Google has confirmed that 100s of Gmail accounts were being snooped on, and the targets of this attack are not happy! The cookie catastrophe in the UK continues, we’ll share the brutal details! And Find out about the hack that leaked the truth about Tupac.

Bitcoin Explained

We’ll dig into bitcoin and explain what it is, and how it works. Is there a future for this Cryptocurrency? Plus Sony is in the news again, and its not good... And we talk about a new ruling on how far your bank has to go to protect you from cyber criminals.

Encryption Best Practices

We follow up on last week’s bitcoin coverage with scandal that has a $500k price tag.

Perfect Passwords

We’ve got the details of an FBI raid that knocked several popular sites off-line. The WordPress plugin repository was compromised, and backdoors were added to a few popular plugins, and we’ll share the details.

Leaky Authentication

How many times have your credentials been leaked online? Think your safe? Chris thought he was. In today’s episode he’ll find out how many times his information has been leaked online, and we tell you how you check for your self.

Cyber Warfare

We cover what critical targets hackers and foreign governments might target to wage Cyber Warfare. Plus what major attacks have already taken place.

Phreaking 3G

We’ll cover a story that really drives home how serious cell phone hijacking has gotten, and what new technology just made it a lot easier for the bad guys.

Classified Cloud

Battery Malware

Attackers take aim at Apple with an exploit that could brick your Macbook, or perhaps worse. Plus you need to patch against a 9 year old SSL flaw.

Google Server Secrets

Find out what consumer storage device is shipping with an encryption backdoor, and we share details about Google’s super secret million servers strong infrastructure.

DEFCON Brings the Scary

Planning for Failures

The RSA leak exposes the dirty under-belly of the commercial security industry, it’s a story that sounds like it’s straight out of Hollywood. Then – We’ve packed this episode full of Audience questions, and our answers. Find out how to plan for failure, start building a website.

Keeping it Up

Smarter Google DNS

Google and openDNS join forces to improve the speed of your downloads, find out what they are doing and how it works! Plus gmail suffered another man in the middle attack, and Kernel.

Rooted Trust

Remember the Man in the Middle attack on google from last week? Turns out it was far worse than though, we now have more details on the DigiNotar compromise, and a number of other important sites have had their DNS hijacked.

Ultimate Home Router

Exploits are in the wild that can take down critical infrastructure equipment, and some highly trusted sites were attacked this week and used against their own visitors.

Ultimate RAID

When your data is important, understanding RAID can make the difference between a major loss, or saving the day.

Ultimate File Server

Ultimate Backups

We’ll tell you about AT&T leaving Android open to a hack so easy, my two year old son could pull it off.

Pimp My Network

Ultimate ZFS Overview

Buckle up and prepare for the our Ultimate ZFS overview! Plus, the next generation of Stuxnet is in the wild, but this time is laying low, collecting data.

Skype Exposes Pirates

Researches have developed a way to tie your file sharing to your Skype account.

Great Disk Famine

Anonymous says it’s going after a Mexican Drug Cartel, we’ll share you the amazing details! Plus: Our tips for controlling remote downloads, and why all I’m going to want for Christmas is hard drives! All that and more, on this week’s TechSNAP! Thanks to: GoDaddy.

How Malware Makes Money

The FBI shuts down a cyber crime syndicate, and we’ll tell you just how much profit they were bring in.

STOP SOPA

The Internet is facing its greatest challenge yet, we explain why the fight against online piracy has taken a turn towards Internet censorship.

Stuffed War Stories

Microsoft’s flawed code signing infrastructure puts your machine at risk, find out how.

Allan’s ZFS Server Build

Two Factor Fail

Find out how some simple Social Engineering skills can earn you $45k, a drug cartel’s private cell network.

Simulated Cyber War

Find out how the 2012 Olympics are preparing for cyper war, we’ll answer a great batch of questions.

Future SSL

Find out what major infrastructure software uses the admin password of “100”, plus future improvements to SSL, how the CIA keeps their IT guys trustworthy, and… An epic tech war story!! All that and more, on this week’s TechSNAP.

Unsafe Wifi

A major implementation flaw in protected Wifi has been found, we’ll share the amazing details.

NGINX vs Apache

How NGINX stacks up to Apache, and which server is right for the job! PLUS: The EFF has raised a red flag over the new version of AOL’s instant messenger we’ll share the details on how it’s logging your conversations, and pre-loading your links.

SQL Injections

We’ll explain how SQL Injections work, plus cover tools you can use to passively discover details about everyone connected to your network. And Adobe blames some researches for THEIR security mistakes, we’ll explain.

Cyber Bank Heist

Find out how hackers robbed a bank for nearly $6 million dollars over the Internet, the Zappos security breach, the fall of the koobface botnet, and what happened to Megaupload. Plus we look back at the web’s SOPA protest this week, and see where things stand.

Answers for Everyone

DHCP Attacks

Find out how a simple system update brought DreamHost down for nearly two days, and how the MS Updater Trojan works.

Server Room Fire

It’s a worst case scenario, when a server room catches fire in this week’s war story! Plus: We’ll share a story that might make you re-think taking advantage of your hard drive warranty, the secrets to reliable SQL replication.

First Day Fail

A first day on tech job war story, that’s as rough as they get! Plus details on recent doubt researchers have cast around the fundamental security technology behind SSL.

Email Constipation

We answer the question: What to do when your email server gets blocked, and why it keeps happening. PLUS: GSM phones are vulnerable to a simple tracking attack, all you need is some open source software and some spare hardware, we’ll share the details! And we introduce the TechSNAP “Hall of Shame”.

NASA Hacked 5,400 Times?

Federal Bureau of Lulz

We cover the amazing story of how the FBI infiltrated and exposed LulzSec. And in a retro war story, Microsoft miss more than just a leap day and we answer some of your feedback questions.

Amazon’s Secrets

Microsoft has released an extremely critical patch, the race against hackers has begun. We’ll give you the details on this important update. Secrets about Amazon’s EC2 back-end have been revealed, and we’ll share them with you.

Exploits for Sale

Does your government use taxpayer money to buy exploits from the open market? We’ll share the details, malware is being spread via Skype, and we’ve got great news for VLC users! And why you might be logged in as Kenneth today All that and much more, on this week’s TechSNAP.

Global Blackout a Hoax

Microsoft leads raids on the Zeus botnet and seizes their servers, Duqu still evolving and new details have been revealed.

Extreme WiFi Makeover

Find out what happens when the Internet Engineering Task Force is faced with unreliable hotel WiFi And we’ve got the details on backdoor built into AT&T’s Microcell’s back door. Yep the back door, has a back door.

Geek’s Natural Habitat

Software powering many of the devices we use has a critical flaw that can give an attacker root access, we’ll give you the details.

Exaggerated Cybercrime

We bust some Cybercrime propaganda, give you the scoop on a fresh openSSL vulnerability, and answer a common audience question.

Obscurity is not Security

Learning to Hack

In Barnes and Noble attempt to censor a magazine article about hacking, that have propelled it into the spotlight. We’ve got the details on this great write up! PLUS: Moving big files around the world, faster torrents, and Microsoft’s hotmail flaw.

Sage IT Wisdom

Apple’s latest version of OS X has a major bug that can store your passwords in clear text, an 8 year old vulnerability has been found in PHP, and why the DHS is hoping for attacks on Gas pipelines. Plus – We’ve got some sage advice for Adam, who’s just taken on the role of the company Sysadmin, and we share some of the essential lessons we’ve learned over the years.

No Pay? No Patch!

Adobe tells customers to upgrade to get the latest security fixes, Kickstarter has an embarrassing security lapse. PLUS: Self-destructing SSDs, and Mirroring vs a CDN, what’s the difference and when are they used.

Man In the Browser Attack

Yahoo has made a mistake so big, you have to hear it to believe it. A common feature in firewalls could actually make you more susceptible attack, Blizzard huge security blunder. PLUS: Separating traffic out between your network cards, and so much more on this week’s TechSNAP.

Feedback Blowout #1

Software that’s supposed to get you around censorship, could be logging your activities online, plus we’ve got a classic Social Engineering story for you. And then we clear the decks and answer a ton of your questions, in our feedback blowout! All that and so much more, in this week’s episode of, TechSNAP.

I Know Your Password

It’s a simple thing but everyone keeps messing it up, bad password storage practices many popular sites had their password databases leaked online this week, we’ve got the details! Plus how the Flame malware impersonated Windows Update, and another batch of audience questions! All that and more, on this week’s TechSNAP. All that and so much more, in this week’s episode of, TechSNAP.

Bypassing Authentication

A MySQL flaw so awful, I simply had to laugh. And how a simple SSH config mistake, lead to a really bad day. Plus we answer some great audience questions, all that and much more on this week’s TechSNAP.

Peek Inside

Token Security

How attackers can defeat an RSA token in as little as 15 minutes, FBI has taken down an online fraud ring, we’ve got the details. And a botched software update that shutdown a bank for days. Plus some great audience questions and our answers.

Faster GPU Cracking

Everyone’s beloved password cracker has had a major update, and you won’t believe what it can do now! The Aerospace industry has a new Advanced Persistent Threat, and a major Microsoft XML flaw already being exploited. Plus we share some infrastructure wisdom in today’s feedback segment.

Network Benchmarking

Our tools to benchmark and monitor your network.

Single Point of Failure

Find out how an entire cities infrastructure depended on a single building, and what happened when it exploded. Plus the technical details on Android’s security upgrade, the Apple Appstore payment bypass, and some great audience questions.

Failure Cascade

The failure of Google Talk takes down several other Google services including GMail and then as a result even Twitter, we got the details. Plus how to determine if your WordPress site has been hacked, and some dangerous new Mac malware. And a batch of audience questions, and our answers. All that and more in this week’s episode of TechSNAP.

Most VPNs Insecure

We’ll cover how the most common type of VPN has been cracked wide open. Plus what to look for when renting a server, and what’s involved in managing a dedicated box.

Not So Secret Answers

A Gawker Reporter’s entire online presence is hacked, and all his devices wiped. We’ll walk you through the details of this attack, and why it suggests we might be facing some fundamental challenges. Plus: Your questions, our answers, and so much more.

Server Puppeteering

Rumor has it the playstation network has been hacked again, but we’ve got the real story. Blizzard suffered a nasty database breach, and it might be much worse then they are letting on.

Not so Private Keys

How a Man in the Browser attack could expose an airport VPN, RuggedCom’s messed up the very fundamentals again, and the big update from Adobe. Plus – Running Linux in a FreeBSD Jail, virtual networking basics, and a great batch of your questions.

Double 0-Java

This week we’ll tell you the story about Agent Double 0-Java, the exploit with a license to kill. Plus Google’s creative solution to securing user content. Then it’s a big batch of your questions, and our answers. All that and much more, in this week’s TechSNAP.

Donated Privacy

The Human Factor

It was a tough week for the cloud, we’ll run down the list and summarize what happened to the services we all depend on so much! Plus a big batch of your questions, our answers, and a rocking round-up! All that and a lot more, on this week’s TechSNAP.

Self Healing Internet

The story about an antivirus that detects itself, IE’s awful zero day exploits, and the Internets amazing ability to route around problems.

Password SecuritIEEE

A big password leak from a major industry player, mobile security takes a big hit, we cover a couple of the major vulnerabilities affecting our favorite gadgets, and more Java troubles. Plus moving from Apache to Nginx, and a big batch of your questions.

Wire-Shark

We’ve got the details on a critical flaw in the chip and pin credit card system. The future of secure hashing, doing proper backups with rsync, and how squirrels and sharks take down the Internet. Plus a big batch of your questions, and our answers.

Don’t Copy That Floppy

How a Russian Spy ring used floppies to pass sensitive information, how Backblaze made it through the great hard drive shortage, and why the US congress is saying no to Chinese Telco manufactures. Plus a big batch of your questions, and our answers.

Best Tool for the Job

Breaking DKM

How an aviation blogger unlocked the secrets of the TSA’s barcode, if you’re a Barnes and Noble shopper we’ve got a story you need to hear, and a serious bug in the Linux Kernel. Plus a batch of your questions, and our answers. All that and so much more, in this week’s TechSNAP.

/var/water/logged

Security by the Horns

How a hardware failure in Indonesia took Google down in California, stealing Crypto keys from virtual machines, and the trouble with Sophos. And an inside look at how Netflix crams so much storage into a teclo near you.

Patch Your Password

Allan will build the case for abandoning the password, the Skype flaw that will shock you, And we discuss picking the right server OS, when to RAID or not to RAID, and a BIG batch of your questions, and our answers.

Tales from the BCrypt

How Allan saved PayPal from an embarrassing leak and a bunch of cash, details on the FreeBSD project’s compromise, and the latest advances in password hashing.

Cat Got Your Router

The amazing Internet speed record set by researches recently, the backdoor built into Samsung’s networked printers, and a clever attack against home routers.

MySQL or Yours?

MySQL had a bad week, we’ll run down the list of the recently disclosed vulnerabilities, the SSH server that allows an attacker full root access, and a GPU password cracking monster.

2-Factor Trojan

A trojan that targets your PC and phone to drain your bank account, a powerful 0day exploit against your SmartTV, and a new approach to GPS spoofing. Plus we answer batch of your questions, and so much more.

WordPress LAN Recon

SSH FUD Busting

We bust the FUD around the media’s overreaction to SSH Key mismanagement, plus the details on millions of WordPress databases exposed by a popular plugin.

Saving Private Exploit

Internet Explorer, Ruby on Rails, and the Windows Nvidia drivers all have new exploits. We’ll tell you the good, the bad, and the ugly. Plus picking the right VPS, a big batch of your questions, and Allan’s videos from EuroBSD Con.

Hiding in the Silence

A zero day vulnerability takes down some major wikis, how Polish researchers hide secret messages in Skype’s silence.

Red October Hunts You

If you thought Stuxnet was a big deal, wait till you meet Red October. The incredible story of some of the most sophisticated malware yet surfaces, and we’ve got the details.

Barricade Your Barracuda

If you have a Barracuda device, it’s time to put it behind a real firewall. We’ll blow your minds with the horrible state of security on many popular Barracuda products.

Universal Exploit n’ Play

It’s way past time to turn off Universal Plug and Play, we’ll give you the details on the exploit that only requires a single network packet.

Snakes in a Bank

Using phone tones and a little Python to get access to someone’s bank account, and Oracle steps up with an early patch for Java but it doesn’t fix everything. Then we answer a big batch of your questions, and much more on this week’s TechSNAP.

Battle of the Bots

A researcher stumbles into the middle of a botnet war, and documents what he finds. Plus a Facebook mistake took down countless sites around the web.

Attacking the Devs

Facebook and Apple are compromised by the same Java exploit, and the details are quite interesting, Punkbuster service goes offline, taking down online game servers for 100s of users. And a thorough look at report claiming the Chinese military is responsible for hundreds of system compromises.

How I Met Your SSH

cPanel’s helpdesk was recently compromised, exposing root credentials for many of their customers, plus the troubles at Zendesk that caused quite a headache for twitter and other popular sites. And we debate if we’re living in a post-cryptography world, plus a big batch of your questions, and much more on, on this week’s TechSNAP.

100% Uptime

We’ve warned against it for nearly 100 episodes, this week we’ll share the fallout from NBC.com getting hacked, Bit9’s whitelist technology is use against them and their customers. Plus the bad news for Java users, a batch of your questions, and some big surprises.

GIF me root

We’ll explain the MiniDuke malware and the extremely clever way to slipped it’s way into victims systems. Researchers discovered a way to bypass google two-factor authentication, we’ll explain the details, and we look back at 25 years of software vulnerabilities.

Packets Over 90,000

A CloudFlare outage takes down three quarter of a million sites, we’ll tell you what went wrong. Some old school malware gets the job done, Allan’s cool toys from Japan, a big batch of your questions our answers, and much more on this week’s TechSNAP.

Time to Git ZFS

Is your bucket exposed to the public? A security researcher has recently discovered many S3 buckets are publicly available, we’ll share the details.

Amplifying the Hype

It’s been called the largest DDoS attack in history, we’ll bust past the hype and explain how a DNS Reflection attack works.

FTP Treasure Trove

A treasure trove of data was found on an open FTP site, leaving AMI BIOS users open to attack. Plus a look at PunkSPIDER, a batch of your questions, and so much more! On this week’s of TechSNAP.

Evil DNS is Evil

13 of the most popular home routes are wide open to attack, is your’s one of them? Tune in to find out.

Dedupe Gone Wrong

Oracle patches 128 vulnerabilities, you won’t believe how many of them are critical. Plus how twitter can solve their hacking problem, ZFS questions galore, and much much more! On this week’s TechSNAP.

Intelligent Malware

Packet Tells A Lot

Jails vs VMs

A security breach become a lesson for us all. We’ll make some lemonade from a bad situation, and arm you with what you need to protect your self. Plus Demonoid users get phished, a batch of your questions, and much much more. On this week’s TechSNAP.

BSDCan 2013 Recap

Researchers find exploits for popular game engines, putting both clients and servers at risk, we’ll share the details.

Making the Onion Cry

In an ironic twist of fate, the Onion suffers an embarrassing compromising, that appears to match a new pattern of attack. We’ve got the details.

Phishin’ Hole

Preparing for Orwell’s Internet

We’ve got a bunch of options to protect your privacy online, things to consider before you self host. Plus: With a little planning ahead, you can protect yourself from compelled disclosure, we’ll share the details.

What’s in Your Cache

HP’s Backdoor

Opera’s code signing certificate gets compromised, resulting in malware getting push out via their automatic update system. Plus the backdoor that ships in some high-end HP products, your questions, and much much more.

Who Watches the Monitors

Extending your office LAN for remote office workers, monitoring the monitoring service, and Zynga’s embarrassing Apache error.

Phish and Chips

We’ll cover Dropbox’s two-factor authentication flaw, how “Team Telecom” forced fibre providers to enable surveillance, the FBI’s warning about phishing attacks.

Exploit Brokers

The business of selling 0day exploits is booming, we’ll explain how this shady market works, and how a couple guys turned a Verizon Network Extender into a spy listening post.

Ethically Hacked

Grand Theft BGP

A BGP hack reroutes the traffic of banks, Amazon and many others. We’ll explain how this can happen, and why we don’t see it more often.

Cost of Encryption

Encryption Prediction

Little Fish Big Breach

Random Access Fires

RAM Prices are getting hot, we’ll tell you why. Plus the router flaw you need to know about, a pfSense disaster, your questions our answers, and much much more.

NSA SSLeaze

A mobile provider is hacked, customer records are breached, and the authorities suspect it was an inside job, we’ll share the details.