Security Now 239

From The Official TWiT Wiki
Jump to: navigation, search
Security Now
Episode 239

Security Now 239: Stacks, Registers and Recursion

News & Errata

06:20 - 10:11

  • Microsoft have amended a patch they released last month that caused a blue screen of death on computers infected with a root kit
  • Security problems have been fixed in windows move maker and Excel

10:12 - 18:58

  • Opera has a really bad and easy exploitable vulnerability that is not currently patched, Opera recommend enabling DEP, Security professional recommend not using Opera

18:59 - 26:11

  • Aurora is the name given to the series of attacks which Google first publicized
  • McAfee Claim: The Aurora attacks were going after the penetrated corporation's stores of intellectual property, the so-called "source code repositories."
  • They also claim: That Google's source code repository was not adequately secured, and that the bad guys were able to get in there and literally browse around.

26:12 - 31:35

  • Based on a Secunia study:
    • The typical, average computer user is now being subjected to 75 patch events per year [1]

31:36 - 33:38

  • Real Networks have lost the battle to sell Real DVD

33:39 - 36:58

  • The Energizer Duo, which is a USB-powered, nickel-metal hydride battery recharger.
  • The USB interface allows your computer to monitor the charge status of the battery to see how far discharged it is and to watch it over time charge itself up.
  • Since mid-2007 that software that comes with this Energizer Duo product has been installing a trojan in the machines of everyone who used it.
  • There's a DLL named arucer.dll which is in the Windows\system32 directory after you install this Energizer Bunny Duo software.
  • It's a trojan which opens port 7777.

36:59 - 47:02

  • An employee of a unnamed major U.S. financial firm had a Facebook page which got hijacked through a means that was not disclosed.
  • So the bad guys got a hold of this employee's Facebook page.
  • Looking at the page, they saw postings about a recent company picnic. And they saw that this person's Facebook friends were, not surprisingly, other employees in the company.
  • So they sent email as if from this employee to the other employees of the company that were identified through this Facebook page.
  • The email said something to the effect of, hey, check out the pictures I took at last weekend's company picnic.
  • So a number of employees received this email, which is on point, it's contextually relevant, it's from a friend, one of their Facebook friends who's an employee of the company.
  • Clicking on the link in this one case installed a keystroke logger on the laptop of a female employee who received this email and had every reason to trust it, this so-called "weaponized" email.
  • So she now had a keystroke logger on her laptop.
  • Subsequently, when roaming outside of the company, she logged in through the company's VPN.
  • And her login credentials and whatever else was required, like a client certificate and so forth, was captured and sent to the bad guys.
  • They now had the ability, and did, to log in through the corporate VPN, get into the Intranet.
  • They spent two weeks roaming around inside the company before their presence was detected and had taken control of two of the company's internal servers by that time.

47:03 - 55:03

  • Steve likes 'Flash Forward'

Spinrite Story

55:04 - 59:00 Mark (Unknown)

Spinrite fixed a hard drive that was being used in a Astaro gateway

Stacks, Registers and Recursion

01:01:00 - 01:38:58

01:01:00 - 01:05:50

  • Steve recaps the previous episodes

01:05:51 - 01:10:00

  • At first computers only had one register
  • Then they had multiple registers
  • But this meant you could address less memory with instructions as bits were taken up specifying the register you want

01:10:01 - 01:15:25

  • The cool thing about this notion of a subroutine is you could have one instance of it in memory, and you could jump to it from all the places in your program where you need it
  • The problem is after the subroutine has finished executing how do you get back to your program
  • On a PDP 8 they stored the location of the instruction after the subroutine call in the first word of the subroutine and then started executing from the second word of the subroutine.
  • Then after it has finished executing it returned to the address in the first word
  • However this has a flaw because you can not nest subroutines (a subroutine can not call another subroutine)

01:15:26 - 01:31:54

  • To overcome this problem the stack was invented
  • There is a register called the stack pointer which initially points to the last value in memory
  • You can push data onto the stack, and this stores the value of what you're pushing in the location pointed to by the stack pointer, and then subtracts one from the stack pointer.
  • When you need to get the value that you just placed on the stack back you pop it back
  • You first increment the pointer. So it's now pointing at the top of the stack, and then we copy where that is pointing back to our register.
  • You can also temporarily store register values in the stack

Notable Quotes

Significant Products

Sponsors

Go To Assist Express

Astaro

Carbonite Pro

  • CarbonitePro.com - no other code or promo
  • Ad Times: 1:17-1:28 and 1:31:55-1:34:31

Production Information

  • Edited by: Tony
  • Notes:
Info.png This area is for use by TWiT staff only. Please do not add or edit any content within this section.
  1. Story