<description>&lt;p&gt;Story: DDoS History as a Cyber Weapon Like so many advancements in human history, they often have a tendency to be used for more than what the originator had conceived.  The internet provides a vast amount of various beneficial services. Yet, those same services are often besieged by those that weld the collective power of the internet to […]&lt;/p&gt;
&lt;p&gt;The post &lt;a href="https://lockmedown.com/show-9-ddos-history-cyber-weapon-part-1/"&gt;Show 9: DDoS History as a Cyber Weapon Part 1&lt;/a&gt; appeared first on &lt;a href="https://lockmedown.com"&gt;Lock Me Down&lt;/a&gt;.&lt;/p&gt;</description>

For over the past 60 years, we have seen numerous movies showcase the idea of a weapon weld the ability to flash an invisible wave of power that could knock some opposition’s computer or electronic system offline.

Story: DDoS History as a Cyber Weapon 
Like so many advancements in human history, they often have a tendency to be used for more than what the originator had conceived.  The internet provides a vast amount of various beneficial services. Yet, those same services are often besieged by those that weld the collective power of the internet to conduct distributed denial of service attacks.  In this story, we look at the DDoS history and its impact as a cyber weapon. 
<a href="https://lockmedown.com/wp-content/uploads/2017/01/futuristic-gun.jpg"></a>For over the past 60 years, we have seen numerous movies showcase the idea of a weapon weld the ability to flash an invisible wave of power that could knock some opposition’s computer or electronic system offline. Sometimes it&#8217;s in the form of a futuristic pistol generating pulses or a kill switch as in the ship Nebuchadnezzar in the movie Matrix. 
Back to earth, we have seen this force in reality starting with the nuclear bomb test blasts that the U.S. has recorded for half century.  The electromagnetic pulse effect of such detonations in the megatons at various altitudes have shown to have a powerful effect.  As we&#8217;ll see in the podcast, ramifications from those nuclear blast tests have been felt at places like Hawaii where businesses and services have been knocked offline. 
In all of these examples, the results are the form of a denial of service.  Where a service has been rendered unavailable. With the collective nature of the internet, we have seen the effective power of forcing a network, site or service offline due to denial of service attacks.  This is especially evident when the attacking power is distributed over numerous computer resources such as we seen provided by the botnets formed from the <a href="https://lockmedown.com/show-8-business-club-zeus-trojan/">Zeus Trojan</a>. 
&nbsp; 
In this first part, we&#8217;ll examine DDoS history (distributed denial of service) and its role that it has played over the last two and half decades. From the origins of nothing more than juvenile uses to take over chat networks to military weapons used to take down entire nations. Like the cyber weapon we saw in the <a href="https://lockmedown.com/show-7-stuxnet-digital-sabotage/">story on Stuxnet</a>, DDoS attacks have shown to be a viable private and state-level weapons used to for extortion, smoke screens or military pre-strike attacks. 
&nbsp; 
Fabulous Failure 
<a href="https://lockmedown.com/wp-content/uploads/2017/01/central-bank-bangladesh.jpg"></a>In natural for most people and society to hear about the benefits of an education.  In this fabulous failure we&#8217;re here about the story of hackers how have managed to circumvent the network of the Central Bank of Bangladesh. But despite holding all the chips, education or possibly a lack of, causes them to loose out on $700 million. 
Story: DDoS History as a Cyber Weapon 
Like so many advancements in human history, they often have a tendency to be used for more than what the originator had conceived.  The internet provides a vast amount of various beneficial services. Yet, those same services are often besieged by those that weld the collective power of the internet to conduct distributed denial of service attacks.  In this story, we look at the DDoS history and its impact as a cyber weapon. 
<a href="https://lockmedown.com/wp-content/uploads/2017/01/futuristic-gun.jpg"></a>For over the past 60 years, we have seen numerous movies showcase the idea of a weapon weld the ability to flash an invisible wave of power that could knock some opposition’s computer or electronic system offline. Sometimes it&#8217;s in the form of a futuristic pistol generating pulses or a kill switch as in the ship Nebuchadnezzar in the movie Matrix. 
Back to earth, we have seen this force in reality starting with the nuclear bomb test blasts that the U.S.

Show 9: DDoS History as a Cyber Weapon Part 1

<description>&lt;p&gt;STORY: The Business Club and the Zeus Trojan So You Want to Be a Gangster? Whether you hail from the old school shows like Dragnet, or something more recent like The Saprano’s, theres a reason why those shows did so well and attracted long time loyal audiences – its exciting and daring and a life not known […]&lt;/p&gt;
&lt;p&gt;The post &lt;a href="https://lockmedown.com/show-8-business-club-zeus-trojan/"&gt;Show 8: The Business Club&lt;/a&gt; appeared first on &lt;a href="https://lockmedown.com"&gt;Lock Me Down&lt;/a&gt;.&lt;/p&gt;</description>

"The Business Club" is an organization that ran the highly successful and unprecedented "Gameover ZeuS" network.  Named after the original "ZeuS" trojan.  It was a highly skilled and organized crew who comprised of a number of key core members and exte...

STORY: The Business Club and the Zeus Trojan 
So You Want to Be a Gangster? 
Whether you hail from the old school shows like Dragnet, or something more recent like The Saprano’s, theres a reason why those shows did so well and attracted long time loyal audiences &#8211; its exciting and daring and a life not known by the everyday person like myself.  The Hollywood picture of organized crime is painted in a colorful brush, one that&#8217;s quite different than the true story behind many of history&#8217;s timeline of criminal families, bosses and the crews we have read about.  Such as the story behind the organized crime syndicate using the Zeus trojan. 
&nbsp; 
But organized crime of the digital age has a new face a new hustle, one that is moving at breakneck speed and causing record breaking cost to businesses.  In this show, were going to hear about one of those organization, one that has lasted, for over a decade. 
&nbsp; 
<a href="https://lockmedown.com/wp-content/uploads/2016/12/business-club-org.png"></a> 
 
&nbsp; 
 
 
&#8220;The Business Club&#8221; is an organization that ran the highly successful and unprecedented &#8220;Gameover ZeuS&#8221; network.  Named after the original ZeuS trojan.  It was a highly skilled and organized crew who comprised of a number of key core members and extended faction crews, not unlike any criminal organization of the 20th and 21st century. 
&nbsp; 
Various criminal organization around the world that engage in any number of illegal vices such as arms and arms trafficking, racketeering and money laundering, rely on various skills of their members or extended crews to turn a profit.   The Business Club members were known for various skills that directly contributed to their multi-million dollar enterprise.  Whether that consisted of writing the malware, hackers for distribution or organizing money mules, each played a role in its success. 
 
 
 
 
&nbsp; 
<a href="https://lockmedown.com/wp-content/uploads/2016/12/How-it-works-overview.png"></a> 
&nbsp; 
 
 
Lead by a Russian Evigeniy Mikhailovich Bogachev, the crew would compromise the computers of various nations around the world for years. Originally developed by Bogachev, the Gameover Zeus network was a highly sophisticated network of botnets and command and control servers. 
 
 
 
&nbsp; 
<a href="https://lockmedown.com/wp-content/uploads/2016/12/evgeniy-fbi.png"></a> 
&nbsp; 
 
 
But undermining the bank accounts of  individuals and corporations wasn&#8217;t the only use of this system.  There was another sinister operation at hand, one that might trace back to a political and state sponsored motivation.  Listen to show and get the full story on who was &#8220;The Business Club&#8221;. 
 
Sources 
 
 
 
 
<a href="http://money.cnn.com/2016/04/15/technology/ransomware-cyber-security/">http://money.cnn.com/2016/04/15/technology/ransomware-cyber-security/</a> 
<a href="http://cybersecurityventures.com/cybersecurity-market-report/">http://cybersecurityventures.com/cybersecurity-market-report/</a> 
 
<a href="http://www.businessinsider.com/flashpoint-report-ransomware-2016-6">http://www.businessinsider.com/flashpoint-report-ransomware-2016-6</a> 
 
<a href="https://zeustracker.abuse.ch/faq.php">https://zeustracker.abuse.ch/faq.php</a> 
 
 
<a href="http://voices.washingtonpost.com/securityfix/2009/07/an_odyssey_of_fraud_part_ii.html">http://voices.washingtonpost.com/securityfix/2009/07/an_odyssey_of_fraud_part_ii.html</a> 
 
<a href="https://www.justice.gov/iso/opa/resources/2162014411104532407242.pdf">https://www.justice.gov/iso/opa/resources/2162014411104532407242.pdf</a> 
<a href="https://www.fox-it.com/en/files/2015/08/FoxIT-Whitepaper_Blackhat-web.pdf">https://www.fox-it.

Show 8:  The Business Club

<description>&lt;p&gt;Story: The Story of Stuxnet [01:40] In June 2010, a infected computer was discovered with a unknown strain of malware would end up kicking off a year long investigation that redefined the term cyber warfare.   While many of the anti-virus and security communities opted for sidelining research on the newly discovered malware dubbed Stuxnet by […]&lt;/p&gt;
&lt;p&gt;The post &lt;a href="https://lockmedown.com/show-7-stuxnet-digital-sabotage/"&gt;Show 7: Stuxnet the Story of Digital Sabotage&lt;/a&gt; appeared first on &lt;a href="https://lockmedown.com"&gt;Lock Me Down&lt;/a&gt;.&lt;/p&gt;</description>

Assassinations, nuclear weapons, cyber warfare, a concoction full of uncertainties that are brewing in this show’s story that will have you wondering where it all will end.

Story: The Story of Stuxnet [01:40] 
In June 2010, a infected computer was discovered with a unknown strain of malware would end up kicking off a year long investigation that redefined the term cyber warfare.   While many of the anti-virus and security communities opted for sidelining research on the newly discovered malware dubbed Stuxnet by Microsoft, there were a handful of small and enterprise groups that would relentlessly chase the answers to the malware&#8217;s unprecedented mysteries.  Mysteries that would include nuclear weapons, assassinations and nation-state endorsed military offensives before it was all said and done. 
<a href="http://lockmedown.com/wp-content/uploads/2016/03/Natanz_isis_annotated.jpg" rel="attachment wp-att-1684"></a> At the end of 2009, the International Atomic Energy Association (IAEA) would discover that the Iranian uranium enrichment facility at Natanz Iran was loosing an unprecedented amount of centrifuges with in a short number of months.  Centrifuges are a key component device in the the facilities ability to produce highly enriched uranium, now believed to be for the end goal of developing nuclear weapons.  Loosing an enormous amount of centrifuges would highly impact the country&#8217;s nuclear program and their ability to produce enriched uranium. After months of a steady increase in the facilities operational centrifuges and produced enriched uranium, was this sudden down turn a product of scientific malfunction or was it sabotage? 
If it was sabotage, there was only one problem.  The facility at Natanz was disconnected from the outside world. 
In military history, the sabotage of a strategic location would require ground forces at the target location.  This is the story about a new covert military operation never seen before.  A new cyber weapon, that once launched, could achieve the same physical sabotage and destruction without the intervention of a military force. 
The Burning Question [56:20] 
This episodes burning questions is about avoiding improper implementations of HTTP Strict Transport Security (HSTS). 
I&#8217;ve talked extensively before about implementing <a href="http://lockmedown.com/owasp-6-preventing-sensitive-data-exposure-part-3/">HSTS</a> in your web application.  But the problem that I see out in the wild when it comes to HSTS is implementation details that could make all the difference to the level of benefit it adds to your application. 
Transparency can have a benefit where it applies, such as knowing what a non-profit organization does with your donation, or certain government processes can be.  But, transparency has no place when it comes implementing HSTS. However, it is quite common to find a web application announce its HSTS details over unsecured HTTP. 
What does this mean and whats the big deal?  The whole benefit of HSTS is to reduce the surface area of a man-in-the-middle attack by possibly reducing the number of HTTP request to your web application.  It does this by allowing the browser to intercept insecure HTTP requests to your site and instead send the request over HTTPS.  But in order for the browser to do that, your site does have to notify the browser about its HSTS policy. 
However, if you&#8217;re HSTS policy never makes it to the browser, then the typical redirect song and dance will commence with each insecure HTTP request being vulnerable to a man-in-the-middle attack for the user.   How would it not make it to the user?  Through a man-in-the-middle scenario.  Any attacker who sees the policy being issued can subsequently remove it.  Leaving your browser none-the-wiser. 
Therefore, in this episode we talk about when to provide the browser with your  sites HSTS policy as well as what kind of redirect should be issued when it comes to HSTS. 
Fabulous Failure [01:02:27] 
It&#8217;s quite common place for hackers to ridicule a target for their poor security implementation after...

Show 7: Digital Sabotage

<description>&lt;p&gt;Dave Rael is a dedicated father and husband and a seasoned software professional. He specializes in building distributed systems and understanding problem domains, especially via Domain-Driven Design and Behavior-Driven Development. Outside work, he’s usually playing with kids, playing basketball, lifting weights, coaching youth sports, and enjoying dirty jokes. He blogs at optimizedprogrammer.com about writing software and getting […]&lt;/p&gt;
&lt;p&gt;The post &lt;a href="https://lockmedown.com/show-6-interview-with-dave-rael/"&gt;Show 6: Interview with Dave Rael&lt;/a&gt; appeared first on &lt;a href="https://lockmedown.com"&gt;Lock Me Down&lt;/a&gt;.&lt;/p&gt;</description>

Dave Rael is not only the voice behind the Developer on Fire podcast, but he's a seasoned developer that something to say about writing secure software

<a href="http://lockmedown.com/wp-content/uploads/2016/02/Dave-Rael-Headshot.jpg" rel="attachment wp-att-1673"></a>Dave Rael is a dedicated father and husband and a seasoned software professional. He specializes in building distributed systems and understanding problem domains, especially via Domain-Driven Design and Behavior-Driven Development. Outside work, he&#8217;s usually playing with kids, playing basketball, lifting weights, coaching youth sports, and enjoying dirty jokes. He blogs at <a href="http://www.optimizedprogrammer.com/">optimizedprogrammer.com</a> about writing software and getting the most out of life and is the host of the Developer on Fire podcast at <a href="http://www.developeronfire.com/">developeronfire.com</a>, where he extracts inspiring stories from successful software geeks. 
Dave is the voice behind the popular Developer on Fire podcast, but he is also a seasoned developer, and just like you and I, he&#8217;s down in the trenches.  He&#8217;s learned a lot about software security over the years and his experience and journey has been similar to a lot of developers.  In this interview, we get to learn some of Dave&#8217;s thoughts, experience, revelations and tips on developing secure applications. 
Below are some highlight points of the interview: 
[Interview] 
&nbsp; 
(00:02:30) A bit about Dave. 
(00:12:00) Eye opening Threats. 
(00:14:50) Updates, Updates, Updates. 
(00:25:00) Bolted on or Baked in? 
(00:30:00) Hardest part about writing secure software 
(00:32:00) Dave&#8217;s security recommendations for leaders 
 
* <a href="http://beefproject.com/">BEEF Browser exploitation framework</a> 
 
&nbsp; 
I Need You: If you like the show, help me out and leave a review for the podcast on <a href="https://itunes.apple.com/us/podcast/lock-me-down-security-for/id1068646369" target="_blank">iTunes</a> but also in <a href="http://www.stitcher.com/podcast/lock-me-down?refid=stpr" target="_blank">Stitcher</a> and don&#8217;t forget to check out other Lock Me Down podcast shows. 
<a href="http://lockmedown.com/wp-content/uploads/2016/02/Dave-Rael-Headshot.jpg" rel="attachment wp-att-1673"></a>Dave Rael is a dedicated father and husband and a seasoned software professional. He specializes in building distributed systems and understanding problem domains, especially via Domain-Driven Design and Behavior-Driven Development. Outside work, he&#8217;s usually playing with kids, playing basketball, lifting weights, coaching youth sports, and enjoying dirty jokes. He blogs at <a href="http://www.optimizedprogrammer.com/">optimizedprogrammer.com</a> about writing software and getting the most out of life and is the host of the Developer on Fire podcast at <a href="http://www.developeronfire.com/">developeronfire.com</a>, where he extracts inspiring stories from successful software geeks. 
Dave is the voice behind the popular Developer on Fire podcast, but he is also a seasoned developer, and just like you and I, he&#8217;s down in the trenches.  He&#8217;s learned a lot about software security over the years and his experience and journey has been similar to a lot of developers.  In this interview, we get to learn some of Dave&#8217;s thoughts, experience, revelations and tips on developing secure applications. 
Below are some highlight points of the interview: 
[Interview] 
&nbsp; 
(00:02:30) A bit about Dave. 
(00:12:00) Eye opening Threats. 
(00:14:50) Updates, Updates, Updates. 
(00:25:00) Bolted on or Baked in? 
(00:30:00) Hardest part about writing secure software 
(00:32:00) Dave&#8217;s security recommendations for leaders 
 
* <a href="http://beefproject.com/">BEEF Browser exploitation framework</a> 
 
&nbsp; 
I Need You: If you like the show, help me out and leave a review for the podcast on <a href="https://itunes.apple.

Show 6: Interview with Dave Rael

<description>&lt;p&gt;In everything we do, despite how creative, the level of ingenuity or how cutting edge, there is always an historical flavoring, that is ever present, that comes from the pioneers that came before us.  I am talking about the trail blazers that have helped allow us to get where we are, or helped shaped the […]&lt;/p&gt;
&lt;p&gt;The post &lt;a href="https://lockmedown.com/the-notorious-hacker/"&gt;Show 5: The Notorious Hacker&lt;/a&gt; appeared first on &lt;a href="https://lockmedown.com"&gt;Lock Me Down&lt;/a&gt;.&lt;/p&gt;</description>

This person goes by many names Condor, phone phreaker as well as the worlds most notorious hacker.   A person who would shape how corporate America would view security, and directly impact the first federal laws against computer hacking ever created.

We all have our favorite stories of adventures whether on the big screen or a novel that we just can't put down. Today I have a story about someone you might have heard of, he's an author, speaker, computer security expert. But he hasn't always been. Known as one of the forefathers of hacking, who was on the run from the authorities for a number of years, evading the law, accumulating hacking trophies, he was, the notorious hacker. 
 
We'll also talk briefly on handling password resets in your app and finally a Fabulous failure that we'll make you question all your software. 
 
Show Notes: http://lockmedown.com/the-notorious-hacker

Lock Me Down | Security for the Everyday Developer

Details

Recent Episodes