Josh Wieder

By accident I clicked on Eugene Kaspersky's Twitter account and I was greeted with this: What? Everything about this image is FABULOUS . First and foremost, it confirms my longstanding suspicion that any schmuck can make a few bucks in infosec, but to make bazillions you have to be an absolute drug-addled lunatic . But let's get back to the picture. So many questions. Are they standing in front of a green-screen in which someone embossed click-art from Windows 95 or did they pose in front of a cheaply painted wall, like when prison convicts take "click-clicks" to send to their pen pals ? Was I the only one who thought that maybe - just maybe - this was the album cover for an Autobahn reunion tour that I had somehow missed? These men are nihilists. Someone very much needs leak the inter-departmental memo that Kaspersky sent to demand that his least photogenic employees all wear form-fitting pastels to work. It would have to be one hell of a memo to ge

It's almost like .... they don't want people to look at the financial records for election candidates. For quite some time now, if you were a reporter or opposition researcher or political consultant and you wanted to dig up some dirt on a political candidate in Florida you would spend at least some time on the Florida Department of State's Division of Elections website. On that website was an application that I have always referred to as "Dodo", because its URL was doedoe.dos.state.fl.us and thanks to the miracle of modern browsers, typing "Dodo" into the address bar would usually get me there sooner or later. Dodo was the place to go to lookup campaign contribution records for both candidates and political committees (of which the most commonly known is a PAC) registered in the State of Florida. So you can imagine my surprise when, just for kicks, I decided to pay Dodo a visit and found this: Maybe I made a mistake. I looked up one of the boo

When installing the vulnerability scanner application Nikto/Nikto2 using yum with RedHat Enterprise Linux 7 or CentOS 7 or even Scientific Linux 7, the odds are good that you will encounter some irritating problems. Namely, the installation will fail while requiring a dependency that appears to not exist for the version of linux you are using. Fun! So you probably think you are safe if you install OpenVAS , a prepackaged suite of security utilities that includes Nikto as a plugin. But you would be wrong! Installing OpenVAS from an RPM will succeed, and everything will look fine, until you try to use Nikto within OpenVAS, which will result in a fatal error. Nikto is included in the Extra Packages for Enterprise Linux/EPEL yum repository all recent versions of RedHat linux, which is part of the Fedora Project. While it contains third party applications, it is not a third party repository like RPMFusion or Atomicorp . I have only very rarely had problems with the EPEL yum repo, and t

Those following Cryptome on Twitter saw some messages that were a little nerve-wracking yesterday. The flood of torrents attributed to Cryptome are not ours. Could be ruses, smears to spread malware. Maybe by HT types. — Cryptome (@Cryptomeorg) July 22, 2015 Some of many [CRYPTOME] torrents gushing wildly recently, could contain [Hacking Team] malware to smear Cryptome https://t.co/3bZ22OQBou — Cryptome (@Cryptomeorg) July 22, 2015 A similar warning was posted to the front page of Cryptome's website: The link in Cryptome's message led me to a Kickass Torrents user account that had been opened ~3 weeks previously under the name Cryptome. The account uses the Cryptome website logo. Similar accounts were created on Monova and Lime Torrents. Putting together an archive for a website you aren't affiliated with, whose content is already free and widely available and has been for many years, isn't necessarily unheard of (?). But doing so while ostensibly

Several months ago I identified malicious software contained within a torrent available for download from Wikileaks . The torrent was the most recent and most complete copy of what Wikileaks titled the "Global Intelligence Files" - a large trove of emails and attachments from defense contractor Stratfor. The story as it is widely understood is that former Lulzsec member and hacktivist Jeremy Hammond was involved in the acquisition of these files from Stratfor and provided them to Wikileaks. Among the many files included in the leak I have identified 18 that have malicious software; most of those are embedded within PDF and DOC files. Some of the attacks I discovered are old, others are less old. Only two of the 18 files are blocked from downloading using Google Chrome's malware protection service, for example. In a second post, I decompile one of these two (older) files using PE Explorer and Hex-Rays IDA to demonstrate how the file corrupts the Microsoft Connection Manage

Some time ago I wrote two blog posts about my discovery about a series of malware-infected files within a torrent being circulated by global whistleblower organization Wikileaks. The torrent file was one of the latest versions of what Wikileaks has named the "Global Intelligence Files" - a large cache of documents obtained from the email spool of a government contractor known as Stratfor. Since my discovery I have made several attempts to contact Wikileaks: @wikileaks sorry to contact here but no other means Ive identified sec issues with most recent torrent here: https://t.co/oeBLtLgDeb — Josh Wieder (@JoshWieder) May 3, 2015 @wikileaks I have some very basic info here http://t.co/cvjY4xWuIr and here: http://t.co/74Xbmxjmy7 can provide more as needed — Josh Wieder (@JoshWieder) May 3, 2015 In addition to Twitter I have attempted to email just about every address I could find on their site (none of them work), as well as attempting to use the chat functi

The Florida Local Government Investment Trust manages money for counties and clerks throughout the state of Florida. They handle bonds that are AAA rated by S&P; pooling assets for municipalities throughout the state to increase their buying power. The Trust was created in 1991. The Florida Local Government Investment Trust maintains a website based on Wordpress, floridatrustonline.com (I highly recommend that readers do not visit the website from an unsecured browser/computer - preferably using a platform like TAILS ). The website contains a description of the Trust, the legislation under which it carries its mandate (Florida Statute 218.415 (16) (a) and 163.01), a list of employees and trustees as well as a series of financial reports covering the last year. The floridatrustonline.com domain is registered to  Earl Donaldson , an employee of the Florida Association of Court Clerks. Donaldson's LinkedIn page lists him as a Network Engineer. The website is hosted on a shared h