Industry Observations-Technical Insight-Vulnerabilities-Web Application Security-WhiteHat HackerKast

#HackerKast 41: HackingTeam, Adobe Flash Bug, UK Government’s Possible Encryption Ban

Hello everyone! Welcome to Week 41! Hope everyone enjoyed the holiday last week. Let’s get right to it:

First off, we talked about HackingTeam which is an Italian survaillence firm which sells its tools to governments to spy on citizens. We don’t know much about the breach itself in terms of technical details but the fact that this is a security company who builds malware makes it super interesting. One of the things revealed in their malware source code that was breached was weaponized child pornography which would plant this nasty stuff on victim’s computers. Also in the mix was some 0-days, most notably a previously unknown flash bug.

We covered a bit about the Flash bug which Adobe has already released a patch for and which is now available in exploit kits and Metasploit. HD Moore’s law in full effect here as we are seeing how fast these things get picked up and weaponized. We quickly rehashed some advice from the past of enabling click-to-play or uninstall this stuff completely as these things pop up constantly. It is also super telling that the only way we know about this bug is that it was leaked from an already existing exploit kit being hoarded by a private firm. There are likely tons of these floating around. Another behavior of some of these Flash bugs is once you are compromised by them, they patch the hole they used in order to make sure other hackers can’t get in.

Another story that keeps rearing its head is the UK government trying to ban encryption entirely. They’ve been talking about this for a while now but it keeps bubbling up in political news stories. Governments want the ability to spy on their own citizens as a whole and encryption is not allowing them to. We touched on the same conversation going on in the USA where the FBI wants a “golden key” scenario where there would still be encryption but they’d have the backdoor to decrypt everything. This is inherently insecure and an awful idea but lots of people keep bringing it up. This is closest to becoming a reality in the UK which would make even things like iMessage illegal and unusable.

We’re all looking forward to Vegas for BlackHat in a few weeks. Be sure to hunt us down to say hi!

Thanks for listening! Check us out on iTunes if you want an audio only version for your phone. Subscribe Here

Join the conversation over on Twitter at #HackerKast or write us directly @jeremiahg, @rsnake, @mattjay

Tags: vulnerability