Donated Privacy | TechSNAP 74

Donated Privacy | TechSNAP 74

Anti-sec posts 1 million Apple UDIDs they claim to have stolen from the FBI, but what was the FBI doing with them in the first place?

More infrastructure switches vulnerabilities, and a great batch of audience questions and our answers!

All that and a lot more on this week’s TechSNAP!

Thanks to:

Use our codes TechSNAP10 to save 10% at checkout, or TechSNAP20 to save 20% on hosting!

SPECIAL OFFER! Save 20% off your order!
Code: go20off5

Pick your code and save:
techsnap7: $7.49 .com
techsnap10: 10% off
techsnap11: $1.99 hosting for the first 3 months
techsnap20: 20% off 1, 2, 3 year hosting plans
techsnap40: $10 off $40
techsnap25: 25% off new Virtual DataCenter plans
techsnapx: 20% off .xxx domains


Direct Download:

HD Video | Mobile Video | MP3 Audio | Ogg Audio | YouTube | HD Torrent | Mobile Torrent

RSS Feeds:

HD Video Feed | Mobile Video Feed | MP3 Audio Feed | Ogg Audio Feed | iTunes Feeds | Torrent Feed


Support the Show:


Show Notes:

Java flaws not entirely fixed by emergency patch

  • The Polish security firm that initially discovered the 29 Java vulnerabilities back in April, two of which were the target of the emergency out-of-band patch issued by Oracle last week, has discovered that the flaws are still exploitable
  • Oracle’s patch removed the getField and getMethod methods from the implementation of the sun.awt.SunToolkit, this disabled all of the Proof of Concept exploits from the security researchers, and the exploits actively being used in the wild
  • Oracle basically removed the exploitation vector, without fixing the underlying vulnerabilities
  • The Polish firm discovered another exploitation vector, that when combined with the unpatched vulnerabilities, allowed them to update their Proof of Concept code and continue to posses a large number of working exploits again Java
  • Adam Gowdiak, CEO of Security Explorations (the Polish firm that discovered the vulnerabilities) also commented that Java 6 seemed much more secure, in all the time they spend researching it, they only ever managed to escape the sandbox once, using an Apple Quicktime exploit
  • Researchers find critical vulnerability in Java 7 patch hours after release

More infrastructure switches vulnerable

  • Some GarrettCom switches come with a hard coded password for a default account that cannot be changed or disabled
  • A researcher at Cylance discovered the hidden account in April and warned the vendor and ICS-CERT
  • The issue is present in GarrettCom Magnum MNS–6K Management Software version 4.1.14 and 14.1.14 SECURE, the vendor released an update that addresses the issue in May, but the issue was not disclosed until this week
  • The attack is mitigated somewhat by the fact that the attacker would need access to an account on the switch, in order to exploit the vulnerability and escalate the privileges of the regular user account
  • “A ‘factory’ account intended to only be allowed to log in over a local serial console port exists in certain versions of GarrettCom’s MNS–6K and MNS–6K-SECURE software. Cylance has identified an unforseen method whereby a user authenticated as ‘guest’ or ‘operator’ can escalate privileges to the ‘factory’ account”
  • GarretCom switches are marketed as “Hardened” and used in traffic control systems, railroad communications systems, power plants, electrical substations, and even US military sites. Beyond simple L2 and L3 networking these devices are also used for serial-to-ip conversion in SCADA systems
  • Original Advisory
  • ICS-CERT Advistory

Hackers claim to have stolen Mitt Romney’s tax returns from financial firm

  • A group claims to have broken into the offices of Price Waterhouse Cooper in Tennessee, accessed the network file servers and copied the Romney’s tax returns for the years before 2010
  • Later years were apparently not digitized yet and so were not able to be copied
  • It doesn’t seem correct to refer to the individuals as hackers because the data was physically stolen from unsecured file servers, rather than accessed remotely
  • The attackers seem to have thought ahead, going so far as to include secret statements in the copies of the documents sent to PWC and using those to authenticate themselves as the real attackers
  • The attackers claim to have send encrypted copies of the documents to the media, as well as both political parties
  • The attackers provide two bitcoin addresses, if the first receives 1 million USD worth of bitcoins before September 28th, then the encryption keys will be destroyed. If this does not happen, or if 1 million USD is sent to the second bitcoin address, the keys will be released publically
  • In Canada the Personal Information Protection and Electronic Documents Act (PIPEDA) mandates specific security measures be taken to safeguard such personal information, it seems that the security practices at PWC were extremely lax
  • The US Secret Service is investigating
  • Pastebin Post #1
  • Pastebin Post #2
  • Additional Coverage

Anti-sec releases 1 million iOS unique device ID, apparently stolen from FBI laptop

  • Anti-sec claims the original file they stole contains more than 12 million records
  • The file apparently includes detailed data, including the UDIDs, push notification tokens, device names, usernames, phone numbers, addresses and device types
  • Antisec claims to have remotely accessed Supervisor Special Agent Christopher K. Stangl’s Dell Vostro notebook in March 2012 using the AtomicReferenceArray Java vulnerability
  • "During the shell session some files were downloaded from his Desktop folder one of them with the name of ‘NCFTA_iOS_devices_intel.csv’
  • NCFTA is the: National Cyber Forensics and Training Alliance, a private group set up by a former FBI agent to facilitate information sharing between private companies and the FBI. Companies can share information with the 501(c)6 non-profit that they would be wary of (or prohibited from) sharing directly with the FBI
  • SSA Stangl is a member of the FBI Regional Cyber Action Team and New York FBI Office Evidence Response Team
  • The FBI denies the claim . “The FBI is aware of published reports alleging that an FBI laptop was compromised and private data regarding Apple UDIDs was exposed. At this time there is no evidence indicating that an FBI laptop was compromised or that the FBI either sought or obtained this data”
  • A website has been setup to attempt to identify which apps or companies are sharing data with the FBI
  • Original Pastebin
  • Additional Coverage


Have some fun:

What I wish the new hires “knew”


Question? Comments? Contact us here!