ubuntu下vmware里面的系统声音经常时有时无,一直没在意,以为是驱动不兼容,今天看了下警告信息google了下.

Failed to open sound device /dev/dsp: Device or resource busy

Reference:
[1]http://www.mombu.com/gnu_linux/ubuntu/t-failed-to-open-sound-device-devdsp-on-vmware-server-1060750.html
[2]http://www.pinoytux.com/linux/vmware-failed-to-open-sound-device

The logs maintained by HideMyAss.com, in addition to other evidence, has led to the arrest of another LulzSec member in Arizona, The Tech Herald has learned. Cody Kretsinger, 23, allegedly used the anonymity service during his role in the attack on Sony Pictures.

In late May, during the height of their escapades, LulzSec said it was the beginning of the end for Sony. A week later, they released 140,000 records. The breach was possible thanks to a single SQL Injection flaw within a promotional page for the movie Ghostbusters. The SQLi flaw led them to more than one million clear text passwords, 3.5 million “music coupon” codes, and 75,000 “music codes”.

At the time, database dump with 12,500 records, containing names, home addresses, phone numbers, email addresses, usernames and passwords, was viewed as the most damaging part of the release. In a statement, Sony Pictures confirmed the breach, and said they were working with the FBI during the investigation. [More]

According to a recently unsealed indictment filed in Los Angeles, and a press release from the FBI, one of the participants in the LulzSec attack was arrested without incident at his home in Phoenix, Arizona on Thursday.

The indictment states Cody Kretsinger used a VPN from HideMyAss.com to scout Sony Pictures’ website for SQL Injection vulnerabilities. Based on statements made by the group at the time, Kretsinger’s efforts were successful. In an attempt to cover his tracks, he formatted his hard drive.

Sources at the U.S. Department of Justice told The Tech Herald this afternoon that depending on the methods used to erase the drive, it was entirely possible that data would be recovered. Computer Forensics has come a long way in the last decade. Aside from outright destroying a disk, it’s hard to wipe a hard drive in a short amount of time. In addition, the source suggested that server logs presented by Sony and the anonymity service helped with the investigation.

Logs, seized equipment, and testimony from those arrested, seems to be the undoing for those connected to Anonymous and LulzSec. However, the source refused to comment on the scope and general flow of the FBI’s investigation into Anonymous and LulzSec, so it is unknown how investigators are connecting the dots.

According to HideMyAss.com, “…services such as ours do not exist to hide people from illegal activity. We will cooperate with law enforcement agencies if it has become evident that your account has been used for illegal activities.”

The service stores logs for 30-days when it comes to Website proxy services, and they store the connecting IP address, as well as time stamps for those using the VPN offerings. Emails seeking comment on HideMyAss.com’s level of cooperation with the FBI, as well as to confirm what information was made available, were not returned.

Kretsinger made an initial appearance before a federal magistrate in U.S. District Court in Phoenix on Thursday. If convicted, he faces a maximum sentence of 15 years in prison.

In related news, a homeless man was arrested in San Francisco on Thursday as well, for his connection to Anonymous and an attack against the Santa Cruz County government. Moreover, the FBI conducted raids in Minnesota, Montana, and New Jersey, as part of their investigation into the actions of Anonymous and LulzSec.

# From http://www.thetechherald.com/article.php/201138/7643/Proxy-logs-helped-FBI-track-and-arrest-LulzSec-member

Mitsubishi Heavy Industries Ltd, Japan's largest defense contractor, has been a victim of a cyber attack, according to a report from the company. The company said attackers had gained access to company computer systems, with some reports saying the attacks targeted its submarine, missile and nuclear power plant component businesses.

"We can't rule out small possibilities of further information leakage but so far crucial data about our products or technologies have been kept safe," a Mitsubishi Heavy spokesman told Reuters. "We've found out that some system information such as IP addresses have been leaked and that's creepy enough," the spokesman added.

According to The Yomiuri newspaper, approximately 80 systems had been infected with malware at the company's headquarters in Tokyo, as well as manufacturing and research and development sites, including Kobe Shipyard & Machinery Works, Nagasaki Shipyard & Machinery Works and Nagoya Guidance & Propulsion System Works.

The company reportedly first noticed the cyber attack on August 11th.

"It's probably just the first that hacking attacks in Japan have been detected. It's consistent with what we've seen already with big American defense companies," Andrew Davies, a cyber-warfare analyst with the government backed defense think-tank, the Australian Strategic Policy Institute, told Reuters.

The company manufactures many weapons systems and aircraft including Patriot missiles, under license from Raytheon, F-15J Fighter Jets, under license from Boeing, and several other guided weapons systems.

The company is expected to release additional information and an updated statement shortly.

# http://www.securityweek.com/japans-largest-defense-contractor-hit-cyber-attack

Reference: http://blog.trendmicro.com/japan-us-defense-industries-among-targeted-entities-in-latest-attack/

根据韩国官方的说法，金正日政权找到了新的牟利方法：开发韩国网游的自动挂机程序。韩国上周逮捕了4名韩国人和1名朝鲜族中国人，他们被控邀请30余名朝鲜程序员和专家制作“自动挂机程序”，并将此提供给中国和韩国的游戏工作室。 嫌疑人先与开设在中国的“朝鲜绫罗岛贸易总公司”、朝鲜内阁直属公司“朝鲜计算机中心”（KCC）职员进行协商后，用自己经营的公司名义向朝方发送邀请 函，还获得朝鲜驻中国领事馆的同意，邀请朝鲜黑客到中国来。他们向朝鲜黑客提供了住处和生活费。朝鲜黑客在中国停留约5个月，在此期间根据要求，以每组5 人分组制作《天堂》、《地下城与勇士》、《楓之谷》等游戏的自动挂机程序。涉案黑客大部分都是毕业于金日成综合大学、金策工业大学等朝鲜名牌大学，每月将 收入中的500美元汇给了朝鲜当局。

来源: http://games.solidot.org/article.pl?sid=11/08/08/0211218

Exclusive: Operation Shady rat—Unprecedented Cyber-espionage Campaign and Intellectual-Property Bonanza

http://www.vanityfair.com/culture/features/2011/09/operation-shady-rat-201109

http://www.secureworks.com/research/threats/htran/

(AP) -- The personal information of about 35 million Internet users in South Korea was stolen in an alleged hacking attack that originated in China, officials said Thursday.

Infrared Light Sources - MEMS based IR Light Sources for Gas Detection and Monitoring - www.Leister.com/axetris

Hackers purportedly attacked popular Internet and social media sites Nate and Cyworld earlier this week, stealing data such as social security numbers and email addresses, the Korea Communications Commission said in a statement.

The regulator said that operator of the sites, SK Communications, alleged the attack originated from computers in China based on their Internet Protocol addresses. IP addresses are the Web equivalent of a street address or phone number.

The stolen data included user IDs, passwords, social security numbers, names, mobile phone numbers and email addresses. Nate said the social security numbers and passwords are encrypted so that they are not available for illegal use.

South Korean police said Thursday they have started an investigation that could take several months.

South Korea has faced Internet attacks before, with blame frequently pinned on hackers operating from IP addresses in China. China has denied all charges of hacking in the past.

In May, South Korean prosecutors said that hackers in North Korea had broken into the computer network of a South Korean bank earlier this year. The prosecutors said software used in the hacking was similar to that used in a 2009 attack that paralyzed South Korean and U.S. websites.

North Korea has flatly denied any responsibility for the attacks.

# FROM http://www.physorg.com/news/2011-07-skorea-alleged-hacking-internet-users.html

新闻来源:网易科技
据韩联社报道，韩国四个大型门户网站遭到黑客侵袭，已核实有17万网民的个人信息被人窃取。在韩国，政府强制实行网络会员注册实名制。因此在韩国注册的网 站用户一定会将他们的身份信息包含在账户中。本次窃取的信息来自韩国国内四个大型门户网站，包括注册者的帐号、真实姓名和身份证号码等。

韩国京畿地方警察厅27日逮捕了金某（29岁）等三人。三人去年6月在京畿道城南市成立因特网宣传公司，以250万韩元（相当于1.5万人民币）的价格从中 国黑客处购买到上述被窃信息，替两处网上成人用品商店和27处文件共享网站进行宣传。成人用品店宣传费为销售额的六成，文件共享网站每注册一名新会员可得 1000韩元宣传费用。

有关人士提议网民更换密码，以免遭到信息外泄的损失。韩国警方目前正在调查黑客侵袭的经过，扩大调查范围。

# 四门户才这么点信息，谁信啊！

Days after Lockheed Martin disclosed a cyber-attack on its networks, reports emerged that two more major defense contractors have also been affected.

Another defense contractor appears to have been hit by a cyber-attack, and a leaked memo indicates company executives believe attackers used information stolen from RSA Security earlier this year. If true, RSA’s SecurID technology may be irrevocably compromised.

Attackers hit major defense contractor L-3 Communications Holdings by spoofing pass codes from a cloned RSA SecurID token, Reuters reported May 27. The attackers may have used a similar method to target another defense contractor, Lockheed Martin, on May 21. The second-largest U.S. defense contractor Northrop Grumman may also have been hacked, as the company shut down remote access to its network without warning on May 26, according to Fox News.

L-3 Communications was formed out of 10 business units that had been spun off by Lockheed prior to its merger with Martin Marietta in 1995. L-3 is a major supplier of communication, intelligence, surveillance and reconnaissance technology to the Department of Defense.

"L-3 Communications has been actively targeted with penetration attacks leveraging the compromised information," an L-3 executive wrote April 6 in an internal memo obtained by Wired Threat Level.

It’s not clear from the internal email whether attackers managed to actually break into L-3 networks, or if they were detected in the midst of the attack. The memo also did not specify exactly why or how L-3 came to the conclusion that the SecurID two-factor authentication system was at fault. An L-3 spokesperson just said the company takes security seriously and that the incident has been resolved.

RSA Security admitted March 17 that cyber-attackers had breached its network and obtained “information relating to the SecurID technology.” The company has steadfastly refused to publicly discuss exactly what was stolen or when the breach actually occurred. RSA later disclosed that it had been hit by a phishing email exploiting a zero-day vulnerability in Adobe Reader.

At the time, RSA executive chairman Art Coviello said the stolen information “could potentially be used to reduce the effectiveness of a current two-factor authentication implementation as part of a broader attack.”

For someone to break into a SecurID-protect network, the attacker would need at least one employee's user name and pass code as well as have some idea of which services that employee had access to.

While the details of these attacks are not “fully known,” it is likely that attackers were able to install a keylogger somewhere within the network, according to Harry Sverdlove, CTO of security firm Bit9.  The information captured and knowledge of RSA’s token-generation algorithm would give attackers a way to breach the network, Sverdlove said, noting that this would be a “worst case scenario” for SecurID.

“It would mean that a single point of attack can be used to defeat the dual-factor authentication provided by the security tokens,” Sverdlove said.

The keylogger may have been installed on a remote system that connected to the network via a VPN. This makes sense, since the “best bet” is to attack vulnerable endpoints, or computers that are connecting remotely and are likely not under the direct control of the organization’s security policies.

Northrop Grumman does not comment on cyber-attacks against it, the company spokesperson said. It’s also unclear how Northrop Grumman was hit, as ComputerWorld reported that the defense contractor replaced all its SecurID tokens with tokens from a different vendor “immediately” after the RSA breach.

The network shutdown at Northrop Grumman caught “even senior managers by surprise” and caused chaos, according to the Fox News story. “We went through a domain name and password reset across the entire organization," an unnamed source told FoxNews.com.

Lockheed Martin shut down remote access to its internal network after a “significant and tenacious attack on its information network” May 21. Technology blogger Robert Cringley had reported at the time the breach involved RSA SecurID tokens that employees and contractors used to log in to the VPN to gain access remotely to the corporate network. 

# Source: http://www.eweek.com/c/a/Security/Northrop-Grumman-L3-Communications-Hacked-via-Cloned-RSA-SecurID-Tokens-841662/