Security Now 298
Recorded: April 27, 2011
Published: April 27, 2011
- 1 Security Now 298: Your Questions, Steve's Answers #116
- 1.1 News & Errata
- 1.2 Spinrite Story
- 1.3 Topic
- 1.4 Questions & Answers
- 2 Notable Quotes
- 3 Significant Products
- 4 Sponsors
- 5 Production Information
Security Now 298: Your Questions, Steve's Answers #116
News & Errata
- Steve talked about the Oak Ridge National Laboratory's security breech which stemmed from a so-called Advanced Persistent Threat (APT) in the form of an e-mail purportedly from the human resources department which contained a link to malware. Steve and Leo mention the irony in the fact that the U.S. Department of Energy is among the most security-minded branches of the U.S. government.
- Steve also talked about the security breech of Sony's Playstation Network and Qriocity services, which affected a reported seventy-seven million users. Steve read the following from Sony's website:
...we believe that an unauthorized person has obtained the following information that you provided: name, address (city, state, zip), country, email address, birthdate, PlayStation Network/Qriocity password and login, and handle/PSN online ID. It is also possible that your profile data, including purchase history and billing address (city, state, zip), and your PlayStation Network/Qriocity password security answers may have been obtained. If you have authorized a sub-account for your dependent, the same data with respect to your dependent may have been obtained. While there is no evidence at this time that credit card data was taken, we cannot rule out the possibility.
- Steve then read statements from Apple's website regarding the iPhone and iPad 3G storing users location data, claiming the problem was a bug. However, Leo believes it is an attempt to gather information about Wi-Fi hotspots.
- Federal Trade Commission Chairman Jon Leibowitz says Google is the only "Do Not Track" holdout.
- Steve's great Twitter followers alerted him to a "Split-Handshake Attack," which is documented in a PDF file located at nmap.org/misc/split-handshake.pdf
- Andrew, a listener of the podcast, wrote up a nice review of the Microsoft Safety Scanner, which Steve wished to share on the podcast. That review can be found on Andrew's site (andrewtechhelp.com).
- Steve was also impressed with a technique called "Disk Drive Steganography"
- The guys ended the segment mentioning a widget for Windows 7 that counts down to the end of support for Windows XP Service Pack 3, and a clever alternative to the "CAPTCHA" system of bot-control that simply asks a question, like: "What year was the Battle of Hastings?" This system can easily thwart bots but not bother humans much.
"Hi, Steve. Last week I brought over my computer to a friend of mine because we were having a LAN party. When I got home later that weekend and booted up my computer, it was extremely slow. It was practically impossible to work with it. It would start up in about 10 minutes, 10 times longer than before, and it would get stuck while performing tasks like opening an application.
"After rebooting the computer a few times, I decided to use my copy of SpinRite. While booting into SpinRite, SpinRite immediately recognized that the drive's SMART subsystem for some reason had been turned off. So SpinRite automatically turned it on. That surprised me. So before proceeding to run SpinRite, I tried booting normally. Bang. Everything was back to normal. I didn't need to run SpinRite. The computer booted up just fine and worked as before. Thanks for a great product."
Questions & Answers
Question: [ 01 ]
Chuong Pham wrote saying: "Thanks for providing ShieldsUP! However, I have one question regarding the user specified custom port probe option. Your website shows my port number 58529 as being failed. It's not true stealth. It's open, due to the fact that I've opened this port for uploading data. Now, if I disable outgoing traffic in my router for this port, then I can't upload any data. Would it be possible for you to reevaluate the rules regarding P2P ports? Other P2P apps use different ports from Vuze, so I assume they'll also fail, according to your website scan. Interested in feedback. Kind regards, Chuong Pham.
Steve: "...what ShieldsUP! is doing is it's demonstrating that unsolicited packets are able to get into his inner sanctum, essentially, through his router. And I said, it doesn't mean that this is unsafe..."
Leo said, "I would have just said, "Dufus, that's the point of ShieldsUP!, to tell you what ports are open."
Question: [ 02 ]
Hi, Steve. Love the show. I've been listening for a little over a year now. During that time, until now, I've been able to bite my tongue. But I can't hold back any longer. For the love of all that is holy, why don't you use Linux?
Steve: "I like Windows ... I know Windows inside and out."
Leo: "And also you're a Windows developer ... Well, and that's another answer which you've given in the past, which is how am I to talk about Windows security, how am I to be an expert in Windows security, if I don't use Windows?"
Question: [ 03 ]
Friedrich H. Burkardsmaier asks, "Steve, one of your recent episodes you recommended the use of a virtual keyboard to enter passwords so they can't be intercepted by keystroke loggers. My concern is that passwords could still be intercepted by something called a "form grabber," once the virtual keyboard has been used to fill in the form. I would appreciate it if you could elaborate on this topic. How are form grabbers implemented? Are there effective countermeasures a user can take? Thanks for the excellent software and for the great podcast. I always look forward to listening to every episode."
Question: [ 04 ]
Question: [ 05 ]
Question: [ 06 ]
Question: [ 07 ]
Question: [ 08 ]
Question: [ 09 ]
Question: [ 10 ]
Question: [ 11 ]
Question: [ 12 ]
- Link URL and optional brief description
- Netflix - 1
- ad times: 1:04-1:23 and 5:53-9:49
- SqSp 4
- ad times: :47-1:04 and 1:01:33-1:04:36
- Edited by: Jason
|This area is for use by TWiT staff only. Please do not add or edit any content within this section.|