<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: 36-minute]]></title>
    <link>http://securityratty.com/tag/36-minute</link>
    <description></description>
    <pubDate>Thu, 17 Jul 2008 06:10:12 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Fake Porn Sites Serving Malware - Part Three]]></title>
      <link>http://securityratty.com/article/df6f06139a5c1a6029631a2d5221d428</link>
      <guid>http://securityratty.com/article/df6f06139a5c1a6029631a2d5221d428</guid>
      <description><![CDATA[Continue the Fake Porn Sites Serving Malware and Fake Porn Sites Serving Malware - Part Two series, in part three we'll take a peek at the emerging trend of parking a single domain at up to three...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://4.bp.blogspot.com/_wICHhTiQmrA/SLQENtZvVWI/AAAAAAAACHU/3Th9wGTcre4/s1600-h/fake_porn_zlob_codec_localized.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://4.bp.blogspot.com/_wICHhTiQmrA/SLQENtZvVWI/AAAAAAAACHU/1aZSLqClTi4/s200-R/fake_porn_zlob_codec_localized.JPG" /></a>Continue the <a href="http://ddanchev.blogspot.com/2008/06/fake-porn-sites-serving-malware.html">Fake Porn Sites Serving Malware</a> and <a href="http://ddanchev.blogspot.com/2008/07/fake-porn-sites-serving-malware-part.html">Fake Porn Sites Serving Malware - Part Two</a> series, in part three we'll take a peek at the emerging trend of parking a single domain at up to three different hosting locations, re-establishing connections between malicious ISPs for yet another time in between exposing the domains and the download locations sharing the same IPs.<br />
<br />
<b>downlfreesexgirlbeach .com</b> first redirects to <b>infodist1 .com/in.cgi?2 </b>then to <b>watchnenjoy.com/index.php?id=1314&amp;style=black</b>, and finally to the front end to the codec's download location <b>handmadeclips .com</b>, where the codec is downloaded from <b>fwlprocedure .com</b>.  Behind these domains, we can easily expose many other fake porn sites and pharmaceutical scams, next to a small portfolio of domains specifically used for hosting the binaries. Due to the obvious rotation I've encountered several times so far, a fake porn site today, is tomorrow's blackhat SEO content farm :<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://4.bp.blogspot.com/_wICHhTiQmrA/SLQHSj0XVWI/AAAAAAAACHc/DX-IaOAduVs/s1600-h/fake_porn_august.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://4.bp.blogspot.com/_wICHhTiQmrA/SLQHSj0XVWI/AAAAAAAACHc/k9h1_E21wag/s200-R/fake_porn_august.JPG" /></a><b>downlfreesexgirlbeach .com</b> - (88.214.198.25)<br />
<b>vids365 .com<br />
downlfreesexgirlbeach .com<br />
top.only-bi .com<br />
wikiei .com<br />
paysuperporn .com<br />
aboutsexporn .com<br />
freactor .com<br />
cheapofficialpills .com<br />
finance-leaders.comnudenakedboys .com<br />
photosgayboys&nbsp; .com<br />
uniqueincest.com<br />
shyincest .com<br />
banrnd.central-xxx .com<br />
tvisklick .info<br />
thebg .net<br />
termion .net<br />
xoxvids .net<br />
bestpricepills .net<br />
bcodecnow .net</b><br />
<br />
<b>infodist1 .com</b> - (88.214.204.40)<br />
<b>farmasearch2008 .com<br />
flaxxvid .com<br />
xanax777pills .com<br />
18virgingirls .com<br />
girlnudegallaryvideox .com<br />
allxxxpornogerlsx .com<br />
jproshin .info<br />
familytaboo .info<br />
fullsitehost .info<br />
20searchonlinesite .net<br />
add-your-video .net<br />
blogs4y .net</b><br />
<br />
<div class="separator" style="clear: both; text-align: center;"></div><div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://3.bp.blogspot.com/_wICHhTiQmrA/SLQIspjO3tI/AAAAAAAACHs/MaMXiAw02F8/s1600-h/downlfreesexgirlbeach_viz.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://3.bp.blogspot.com/_wICHhTiQmrA/SLQIspjO3tI/AAAAAAAACHs/znHGKTmbcHE/s200-R/downlfreesexgirlbeach_viz.JPG" /></a><b>adult-shemale .com</b> - (88.214.198.25)<br />
<b>adult-tranny .com<br />
all-shemale&nbsp; .com&nbsp;&nbsp;&nbsp; <br />
bcodecnow .net<br />
best-tranny .com&nbsp;&nbsp;&nbsp; <br />
bestguyportal .com<br />
bestmoviez .com&nbsp;&nbsp;&nbsp; <br />
central-xxx .com<br />
downlfreesexgirlbeach .com&nbsp;&nbsp;&nbsp; <br />
gallery-boy .com<br />
hiosexywomensxxxgirlsx .com&nbsp;&nbsp;&nbsp; <br />
lady-dick .com<br />
bcodecnow .net<br />
mytoppharmacy .com<br />
nakednudeboys .com&nbsp;&nbsp;&nbsp; <br />
nakednudemen .com<br />
nudenakedboys .com<br />
only-bi .com<br />
only-shemale .com<br />
page-reviews .com<br />
paulaslosingit .com<br />
photosgayboys .com<br />
stud-boys .com&nbsp;&nbsp;&nbsp; <br />
the0download .com<br />
wikiei .com&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; <br />
moviez .com<br />
hiosexywomensxxxgirlsx .com<br />
sexygirlsisuniformh0t .com&nbsp;&nbsp;&nbsp; <br />
the0download .com</b><br />
<br />
<b>flwprocedure .com </b>- (77.91.231.201)<b><br />
movupdate .com<br />
flwupdate .com<br />
formatmpeg .com<br />
movieexternal .com<br />
flwtool .com <br />
aviexecution .com<br />
releasedvideo .com<br />
wmvcompressor .com<br />
movieopens .com<br />
mpegapparatus .com<br />
flwassistant .com<br />
flwinstrument .com<br />
piterserv .com<br />
wovview .com</b><br />
<br />
<b>Some info on a sample codec :</b><br />
Scanners Result: 11/36 (30.56%)<br />
Trojan-Downloader.Win32.Zlob.cos<br />
Trojan.Popuper.7315<br />
File size: 10240 bytes <br />
MD5...: 467e4e78974dc8b2ee5d7da024daf31a <br />
SHA1..: 311e0c710bb15761ef3dace54b55489830cf5803<br />
<br />
Phones back to <b>69.50.164.50</b>/this/is/stereo/music.php?param=0;1314;1550; <b>69.50.164.50</b>/this/is/stereo/jazz.php?param=49325611;2:191:5|7:271:0|6:130:0|9:0:5|34:65536:0 and to <b>85.255.119.244</b>/this/is/stereo/music.php?param=0;4135;1548.<br />
<br />
When <b>Emil Kaperski's</b> owned <a href="http://ddanchev.blogspot.com/2008/06/malicious-isps-you-rarely-see-in-any.html">InterCage, Inc.</a> (69.50.164.50) meets <a href="http://ddanchev.blogspot.com/2008/07/lazy-summer-days-at-ukrtelegroup-ltds.html">UkrTeleGroup Ltd.</a> (85.255.119.244) previously known as <b>Andrei Kislizin's</b> owned InHoster, you know you're on the right track.<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=kUs27K"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=kUs27K" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=sRXTAK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=sRXTAK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=sOsoWk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=sOsoWk" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=fnooek"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=fnooek" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=R3T9kK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=R3T9kK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=WaKp6K"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=WaKp6K" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=R12pRk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=R12pRk" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/375241515" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 26 Aug 2008 05:02:26 +0000</pubDate>
      <category domain="http://securityratty.com/tag/fake porn sites">fake porn sites</category>
      <category domain="http://securityratty.com/tag/net">net</category>
      <category domain="http://securityratty.com/tag/info">info</category>
      <category domain="http://securityratty.com/tag/codec">codec</category>
      <category domain="http://securityratty.com/tag/malware">malware</category>
      <category domain="http://securityratty.com/tag/php">php</category>
      <category domain="http://securityratty.com/tag/sample codec">sample codec</category>
      <category domain="http://securityratty.com/tag/locations">locations</category>
      <category domain="http://securityratty.com/tag/fake porn site">fake porn site</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/375241515/fake-porn-sites-serving-malware-part.html">Fake Porn Sites Serving Malware - Part Three</source>
    </item>
    <item>
      <title><![CDATA[Friday Squid Blogging: Giant Squids on Exhibit at the Smithsonian]]></title>
      <link>http://securityratty.com/article/3440f8f99b4153bb1a7d1150b8e2734e</link>
      <guid>http://securityratty.com/article/3440f8f99b4153bb1a7d1150b8e2734e</guid>
      <description><![CDATA[Starting September 27th : a 36-foot-long, 330-lb female and a 20-foot-long, 100-lb...]]></description>
      <content:encoded><![CDATA[<p>Starting <a href="http://cenblog.org/2008/08/01/for-love-of-squid/">September 27th</a>:  a 36-foot-long, 330-lb female and a 20-foot-long, 100-lb male.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=OYL9xK"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=OYL9xK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=SeknAK"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=SeknAK" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Fri, 22 Aug 2008 12:38:01 +0000</pubDate>
      <category domain="http://securityratty.com/tag/100-lb male">100-lb male</category>
      <category domain="http://securityratty.com/tag/september 27th">september 27th</category>
      <category domain="http://securityratty.com/tag/330-lb female">330-lb female</category>
      <category domain="http://securityratty.com/tag/20-foot-long">20-foot-long</category>
      <category domain="http://securityratty.com/tag/36-foot-long">36-foot-long</category>
      <source url="http://www.schneier.com/blog/archives/2008/08/friday_squid_bl_137.html">Friday Squid Blogging: Giant Squids on Exhibit at the Smithsonian</source>
    </item>
    <item>
      <title><![CDATA[VMware Big-Time Boo-Boo]]></title>
      <link>http://securityratty.com/article/f9466fc19dd83d3ab8c94a3fa2655f2a</link>
      <guid>http://securityratty.com/article/f9466fc19dd83d3ab8c94a3fa2655f2a</guid>
      <description><![CDATA[VMware needs some good press these days. What it certainly does not need is this VI 3.5 update snafu which can shutdown thousands of virtual infrastructures and breaks VMotion
Alert do not upgrade to...]]></description>
      <content:encoded><![CDATA[<p>VMware needs some good press these days. What it certainly does not need is this VI 3.5 update snafu which can <a href="http://www.virtualization.info/2008/08/vmware-mistake-shuts-down-thousands-of.html" target="_blank">shutdown “thousands of virtual infrastructures”</a> and breaks VMotion.
<p><b>Alert – do not upgrade to Virtual Infrastructure 3.5 Update 2.</b>
<p>Apparently there’s some problem with the license expiration time and the workaround suggested by a Virtualization.Info reader is to set the date back to August 10 – which of course messes up your logs and any monitoring that you may be doing. No immediate solution forthcoming from VMware and in fact, good luck getting in touch with the company.
<p>“At the moment it seems that <strong>the entire VMware Knowledge Base collapsed</strong>. Calling the support line customers can just receive a brief message saying that <strong>the problem will be solved within 36 hours</strong>. <br />Additionally, <strong>VMware removed the capability to download any affected product</strong>.”</p>
]]></content:encoded>
      <pubDate>Tue, 12 Aug 2008 14:49:54 +0000</pubDate>
      <category domain="http://securityratty.com/tag/vmware">vmware</category>
      <category domain="http://securityratty.com/tag/support line customers">support line customers</category>
      <category domain="http://securityratty.com/tag/license expiration time">license expiration time</category>
      <category domain="http://securityratty.com/tag/virtual infrastructures">virtual infrastructures</category>
      <category domain="http://securityratty.com/tag/breaks vmotion">breaks vmotion</category>
      <category domain="http://securityratty.com/tag/info reader">info reader</category>
      <category domain="http://securityratty.com/tag/shutdown thousands">shutdown thousands</category>
      <category domain="http://securityratty.com/tag/virtual infrastructure">virtual infrastructure</category>
      <category domain="http://securityratty.com/tag/luck">luck</category>
      <source url="http://blog.sciencelogic.com/vmware-big-time-boo-boo/08/2008">VMware Big-Time Boo-Boo</source>
    </item>
    <item>
      <title><![CDATA[Portland's MetroFi Nodes Still Hanging on]]></title>
      <link>http://securityratty.com/article/6f76ffda934c74f0161ffa74afd5c788</link>
      <guid>http://securityratty.com/article/6f76ffda934c74f0161ffa74afd5c788</guid>
      <description><![CDATA[The Oregonian notes that the city may still pick up tab for removing MetroFi's base station: Although MetroFi posted a $30,000 bond against removal of its antennas, the cost could be $90,000 if the...]]></description>
      <content:encoded><![CDATA[<p><img src="http://wifinetnews.com/images/muni_icon.jpg" align="right" hspace="5" height="80" width="80" border="0" /><strong><a href="http://www.oregonlive.com/business/oregonian/index.ssf?/base/business/121824871892410.xml&coll=7">The Oregonian notes that the city may still pick up tab for removing MetroFi's base station:</a></strong> Although MetroFi posted a $30,000 bond against removal of its antennas, the cost could be $90,000 if the company winds up with insufficient assets to roll down the network. The city could pare that figure by using its own crews for removing nodes from traffic signals, but that would still leave $36,000 on the table. The paper notes that MetroFi tried to sell some nodes on eBay, but I don't believe they had takers.</p>]]></content:encoded>
      <pubDate>Fri, 08 Aug 2008 18:08:25 +0000</pubDate>
      <category domain="http://securityratty.com/tag/metrofi">metrofi</category>
      <category domain="http://securityratty.com/tag/nodes">nodes</category>
      <category domain="http://securityratty.com/tag/company winds">company winds</category>
      <category domain="http://securityratty.com/tag/city">city</category>
      <category domain="http://securityratty.com/tag/traffic signals">traffic signals</category>
      <category domain="http://securityratty.com/tag/paper notes">paper notes</category>
      <category domain="http://securityratty.com/tag/oregonian notes">oregonian notes</category>
      <category domain="http://securityratty.com/tag/insufficient assets">insufficient assets</category>
      <category domain="http://securityratty.com/tag/base station">base station</category>
      <source url="http://wifinetnews.com/archives/008415.html">Portland's MetroFi Nodes Still Hanging on</source>
    </item>
    <item>
      <title><![CDATA[The Twitter Malware Campaign Wants to Bank With You]]></title>
      <link>http://securityratty.com/article/0a86c9e6b40c8995b8c3f84a2d12480a</link>
      <guid>http://securityratty.com/article/0a86c9e6b40c8995b8c3f84a2d12480a</guid>
      <description><![CDATA[In what appears to be a lone gunman malware campaign -- where the malware spreader even left his email address within the binary - the now down Twitter malware campaign managed to attract only 69...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="text-align: center; clear: both;"></div><a href="http://bp0.blogger.com/_wICHhTiQmrA/SJgk-RghwII/AAAAAAAAB_c/xbrYBDO4K9Q/s1600-h/twitter_malware1.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp0.blogger.com/_wICHhTiQmrA/SJgk-RghwII/AAAAAAAAB_c/om2-uxKUmR4/s200-R/twitter_malware1.JPG" style="border: 0pt none ;" /></a>In <a href="http://www.twitpwn.com/2008/08/coming-up-malware-on-twitter.html">what appears to</a> be a lone gunman <a href="http://www.viruslist.com/en/weblog?weblogid=208187551">malware campaign</a> -- where the malware spreader even left his email address within the binary - the now down <a href="http://blogs.guardian.co.uk/technology/2008/08/05/twiters_trojan_problem.html">Twitter malware campaign</a> managed to attract only 69 followers before it has shut down, <a href="http://www.techcrunch.com/2008/07/27/who-is-johng77536-and-how-did-he-game-twitter/">using a trivial approach</a> for launching an XSS worm - <a href="http://en.wikipedia.org/wiki/Cross-site_request_forgery">Cross-site request forgery</a> (CSRF). More info :<br />
<br />
"<i>This week it’s Twitter’s turn to host an attack - one that is targeting both Twitter users and the Internet community at large. In this case it's a malicious Twitter profile twitter.com/[skip]/ with a name that is Portuguese for ‘pretty rabbit’ which has a photo advertising a video with girls posted.&nbsp;</i><br />
<br />
<i>This profile has obviously been created especially for infecting users, as there is no other data except the photo, which contains the link to the video. If you click on the link, you get a window that shows the progress of an automatic download of a so-called new version of Adobe Flash which is supposedly required to watch the video. You end up with a file labeled Adobe Flash (it’s a fake) on your machine; a technique that is currently very popular.</i>"<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="text-align: center; clear: both;"></div><a href="http://bp0.blogger.com/_wICHhTiQmrA/SJg7qxrXS-I/AAAAAAAAB_k/X5JjQEBfcgc/s1600-h/twitter_malware.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp0.blogger.com/_wICHhTiQmrA/SJg7qxrXS-I/AAAAAAAAB_k/tnrV5eIbz1M/s200-R/twitter_malware.JPG" style="border: 0pt none ;" /></a>Let's analyze the campaign before it was shut down. The original Twitter account used <b>twitter.com/video_kelly_key</b> basically included a link to <b>player-video-youtube.sytes.net</b> (204.16.252.98) which was using a URL shortening service <b>fly2.ws/NilOMN3</b> in order to redirect to the banker malware located at <b>freewebtown.com/construimagens/ Play-video-youtube.kelly-key.com</b>. It's detection rate is as follows :<br />
<br />
<b>Scanners Result</b>: 14/36 (38.89%)<br />
Trojan-Spy.Win32.Banker.caw <br />
<b>File size</b>: 88064 bytes<br />
<b>MD5</b>...: 25600af502758ca992b9e7fff3739def<br />
<b>SHA1</b>..: 9262ca501ef388e0fe42c50a3d002ddbd6e254f2<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="text-align: center; clear: both;"></div><a href="http://bp3.blogger.com/_wICHhTiQmrA/SJg8dgf3PnI/AAAAAAAAB_s/zemAG6fn3rM/s1600-h/xss_csrfworm.png" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp3.blogger.com/_wICHhTiQmrA/SJg8dgf3PnI/AAAAAAAAB_s/lOjia4dpUaw/s200-R/xss_csrfworm.png" style="border: 0pt none ;" /></a>Twitter isn't an exception to the realistic potential for <a href="http://0x000000.com/index.php?i=512&amp;bin=1000000000">XSS worms though CSRF that could affect each and every Web 2.0 service</a>, which as a matter of fact have all suffered such attempts, namely, <a href="http://ha.ckers.org/blog/20071220/orkut-xss-worm" title="Orkut XSS Worm">Orkut</a>, <a href="http://en.wikipedia.org/wiki/Samy_%28XSS%29" title="Samy MySpace XSS Worm">MySpace</a> (as well as the <a href="http://securitylabs.websense.com/content/Alerts/1319.aspx" title="MySpace QuickTime XSS Flaw">QuickTime XSS flaw</a>), <a href="http://blogs.securiteam.com/index.php/archives/786" title="GaiaOnline XSS Worm">GaiaOnline</a>, <a href="http://sirdarckcat.blogspot.com/2007/12/making-social-network-xss-worm-hi5com.html" title="Hi5 XSS Worm">Hi5</a>, and most recently the <a href="http://blogs.zdnet.com/security/?p=1487">XSS worm at Justin.tv</a>, demonstrate that trivial vulnerabilities come handy for what's to turn into a major security incident if not taken care of promptly.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2007/05/xss-planet.html">XSS The Planet</a><br />
<a href="http://ddanchev.blogspot.com/2007/02/xss-vulnerabilities-in-e-banking-sites.html">XSS Vulnerabilities in E-banking Sites</a><br />
<a href="http://ddanchev.blogspot.com/2006/05/current-state-of-web-application-worms.html">The Current State of Web Application Worms</a><br />
<a href="http://ddanchev.blogspot.com/2007/06/g0t-xssed.html">g0t XSSed?</a><br />
<a href="http://ddanchev.blogspot.com/2006/06/web-application-email-harvesting-worm.html">Web Application Email Harvesting Worm </a><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=oWAtgK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=oWAtgK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=L5UJoK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=L5UJoK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=dlgqak"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=dlgqak" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=3uAsZk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=3uAsZk" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=YHdd5K"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=YHdd5K" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=AezGSK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=AezGSK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=JZQeBk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=JZQeBk" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/356281978" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 05 Aug 2008 03:14:42 +0000</pubDate>
      <category domain="http://securityratty.com/tag/twitter">twitter</category>
      <category domain="http://securityratty.com/tag/twitter malware campaign">twitter malware campaign</category>
      <category domain="http://securityratty.com/tag/xss">xss</category>
      <category domain="http://securityratty.com/tag/xss vulnerabilities">xss vulnerabilities</category>
      <category domain="http://securityratty.com/tag/original twitter account">original twitter account</category>
      <category domain="http://securityratty.com/tag/xss worms">xss worms</category>
      <category domain="http://securityratty.com/tag/xss worm">xss worm</category>
      <category domain="http://securityratty.com/tag/twitter users">twitter users</category>
      <category domain="http://securityratty.com/tag/worm">worm</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/356281978/twitter-malware-campaign-wants-to-bank.html">The Twitter Malware Campaign Wants to Bank With You</source>
    </item>
    <item>
      <title><![CDATA[Speaking of Security Podcast #115]]></title>
      <link>http://securityratty.com/article/4700871cd343af52160f1b05a1fb9f12</link>
      <guid>http://securityratty.com/article/4700871cd343af52160f1b05a1fb9f12</guid>
      <description><![CDATA[Click to Download/Listen (10:36

A couple of weeks ago, Paul Joyal interviewed RSAs Phil Marshall about Knowledge-based Authentication , or KBA. This week, we present a conversation on the same topic...]]></description>
      <content:encoded><![CDATA[<a href="http://www.rsa.com/blog/blog_entry.aspx?id=1319">Click to Download/Listen</a> (10:36)<br><br />A couple of weeks ago, <a href="http://www.rsa.com/blog/blog_entry.aspx?id=1308">Paul Joyal interviewed RSA&rsquo;s Phil Marshall</a> about <a href="http://rsa.com/press_release.aspx?id=9459" target="_blank">Knowledge-based Authentication</a>, or KBA. This week, we present a   conversation on the same topic that Phil had with <a href="http://www.javelinstrategy.com/about/team-biographies/tracy-hoover/" target="_blank">Tom Wills</a>, Senior Analyst for Risk, Security &amp; Fraud with <a href="http://www.javelinstrategy.com/" target="_blank">Javelin Strategy and Research</a>.<br /><br /><br />]]></content:encoded>
      <pubDate>Sun, 27 Jul 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/phil">phil</category>
      <category domain="http://securityratty.com/tag/rsas phil marshall">rsas phil marshall</category>
      <category domain="http://securityratty.com/tag/senior analyst">senior analyst</category>
      <category domain="http://securityratty.com/tag/javelin strategy">javelin strategy</category>
      <category domain="http://securityratty.com/tag/weeks ago">weeks ago</category>
      <category domain="http://securityratty.com/tag/tom wills">tom wills</category>
      <category domain="http://securityratty.com/tag/paul joyal">paul joyal</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/research">research</category>
      <source url="http://www.rsa.com/blog/blog_entry.aspx?id=1319">Speaking of Security Podcast #115</source>
    </item>
    <item>
      <title><![CDATA[Distributed Memory in Blackboard Systems]]></title>
      <link>http://securityratty.com/article/c8294d6fcd37560ac3558a8a3914fdaa</link>
      <guid>http://securityratty.com/article/c8294d6fcd37560ac3558a8a3914fdaa</guid>
      <description><![CDATA[Paul Vincent, ex-colleague at TIBCO, kindly responds to A Brief Introduction to Blackboard Architectures with Blackboards for Complex Event Processing . Paul correctly mentions that TIBCOs...]]></description>
      <content:encoded><![CDATA[<p>Paul Vincent, ex-colleague at TIBCO, kindly responds to <a href="http://www.thecepblog.com/2008/07/20/a-brief-introduction-to-blackboard-architectures/" target="_blank">A Brief Introduction to Blackboard Architectures</a> with <a title="Permalink" href="http://tibcoblogs.com/cep/2008/07/25/blackboards-for-complex-event-processing/">Blackboards for Complex Event Processing</a>.   Paul correctly mentions that TIBCO&#8217;s BusinessEvents software is an excellent scheduling component in a blackboard systems architecture.</p>
<p>However, I should briefly clarify Paul&#8217;s note that &#8220;<em>blackboard systems historically used a single memory model (i.e. multiple threads or processes using a single machine’s memory model)</em>&#8220;.</p>
<p>In fact, there were many blackboard systems, some more than a decade old, that used a distributed memory data-model.   What I think Paul meant to say, and my apologies to Paul for being so literal, is that &#8220;<em>blackboard systems <strong>originally </strong>used a single memory model (i.e. multiple threads or processes using a single machine’s memory model)</em>&#8221;</p>
<p>John McManus, <a href="http://www.nasa.gov/offices/ocio/about/j_mcmanus_bio.html" target="_blank">former CTO of NASA</a>, wrote an excellent PhD dissertation in 1992,  <a href="http://www.thecepblog.com/tb/pdf/mcmanus_thesis_blackboard.pdf" target="_blank">Design and Analysis Techniques for Concurrent Blackboard Systems</a>.    John&#8217;s thesis, now more than 16 years old, examined many details of concurrent blackboards where memory is distributed.  For example, refer to<em> Figure 2.3. Distributed Blackboard System with Distributed Blackboard Data Structure, </em> page 36 of John&#8217;s dissertation.</p>
<p>Quoting directly from page 37 of John&#8217;s disseration;</p>
<blockquote><p>Rice, Aiello and Nii [20] present several options for gaining speedups in a distributed blackboard system.</p>
<ul>
<li>1) Eliminate the centralized scheduling mechanism</li>
<li>2) Optimize system design for a distributed memory, message-passing hardware</li>
<li>3) Distribute the data across the blackboard to reduce hotspots</li>
</ul>
</blockquote>
<p>Quoting further from the same page;</p>
<blockquote><p>Poligon [21] is based on a distributed memory hardware model when each processor is viewed as a blackboard node. They define a blackboard node as follows: <em>“a blackboard node is a process on a processor, surrounded by a collection of processors able to service its requests to execute rules.” </em>[22] The implicit assumption in this definition is that all knowledge sources are rule–based systems. This assumption may severely limit the performance of systems implemented using Poligon, and limits the types of problems it is suited to address.</p></blockquote>
<p>In <a title="Permalink" href="http://tibcoblogs.com/cep/2008/07/25/blackboards-for-complex-event-processing/">Blackboards for Complex Event Processing</a>, Paul concludes, <em></em></p>
<blockquote><p><em>&#8220;One suspects the blackboard systems domain and terminology is overdue some updates thanks to developments in the Complex Event Processing space.&#8221;</em></p></blockquote>
<p>If you look at the historical literature, I would say that the following restatement is more accurate:</p>
<blockquote><p><em>&#8220;The CEP domain and terminology is overdue some updates because folks working in CEP did not reference or incorporate the advanced event processing prior art in a number of very important areas, blackboard systems being only one.&#8221;</em></p></blockquote>
<p>On the other hand,  commercial off-the-shelf rule-processing technology such as TIBCO&#8217;s BusinessEvents (BE), advances the ability to economically implement myriad complex problems that blackboard systems are designed to address.</p>
]]></content:encoded>
      <pubDate>Sat, 26 Jul 2008 03:01:30 +0000</pubDate>
      <category domain="http://securityratty.com/tag/systems">systems</category>
      <category domain="http://securityratty.com/tag/blackboard systems architecture">blackboard systems architecture</category>
      <category domain="http://securityratty.com/tag/blackboard">blackboard</category>
      <category domain="http://securityratty.com/tag/concurrent blackboard systems">concurrent blackboard systems</category>
      <category domain="http://securityratty.com/tag/blackboard architectures">blackboard architectures</category>
      <category domain="http://securityratty.com/tag/blackboard system">blackboard system</category>
      <category domain="http://securityratty.com/tag/memory">memory</category>
      <category domain="http://securityratty.com/tag/blackboard systems domain">blackboard systems domain</category>
      <category domain="http://securityratty.com/tag/blackboard systems">blackboard systems</category>
      <source url="http://www.thecepblog.com/2008/07/26/distributed-memory-in-blackboard-systems/">Distributed Memory in Blackboard Systems</source>
    </item>
    <item>
      <title><![CDATA[A Blast From The Past: Linux-Kernel Archives 1998]]></title>
      <link>http://securityratty.com/article/bf888f833de4fd52627ed84aef931357</link>
      <guid>http://securityratty.com/article/bf888f833de4fd52627ed84aef931357</guid>
      <description><![CDATA[Oddly enough, someone emailed me this quote,found an email signature documented in 1998,from the Linux-Kernel archives
Linux is a movement, a philosophy, where programmers and technical people take...]]></description>
      <content:encoded><![CDATA[<p>Oddly enough, someone emailed me this quote, found an email signature documented in 1998, from the Linux-Kernel archives:</p>
<blockquote><p>&#8220;Linux is a movement, a philosophy, where programmers and technical people take control of their own destiny.&#8221;  &#8212; Tim Bass</p></blockquote>
<p>Ref:  <a href="http://www.ussg.iu.edu/hypermail/linux/kernel/9810.3/0050.html" target="_blank">Email signature, Re: Future of 2.0.36, G.W. Wettstein (greg@wind.enjellic.com), Sat, 24 Oct 1998 10:09:27 -0500 </a></p>
]]></content:encoded>
      <pubDate>Sun, 20 Jul 2008 01:00:51 +0000</pubDate>
      <category domain="http://securityratty.com/tag/linux-kernel archives">linux-kernel archives</category>
      <category domain="http://securityratty.com/tag/linux">linux</category>
      <category domain="http://securityratty.com/tag/email signature">email signature</category>
      <category domain="http://securityratty.com/tag/tim bass">tim bass</category>
      <category domain="http://securityratty.com/tag/technical people">technical people</category>
      <category domain="http://securityratty.com/tag/philosophy">philosophy</category>
      <category domain="http://securityratty.com/tag/oddly">oddly</category>
      <category domain="http://securityratty.com/tag/programmers">programmers</category>
      <category domain="http://securityratty.com/tag/future">future</category>
      <source url="http://www.thecepblog.com/2008/07/20/a-blast-from-the-past-linux-kernel-archives-1998/">A Blast From The Past: Linux-Kernel Archives 1998</source>
    </item>
    <item>
      <title><![CDATA[Obfuscating Fast-fluxed SQL Injected Domains]]></title>
      <link>http://securityratty.com/article/274149f12bf7d146a0527dd85513a6a5</link>
      <guid>http://securityratty.com/article/274149f12bf7d146a0527dd85513a6a5</guid>
      <description><![CDATA[It's all a matter of how you put it, and putting it like represents a good example of tactical warfare, namely, combining different tactics for the sake of making it harder to keep track of the impact...]]></description>
      <content:encoded><![CDATA[<a href="http://bp0.blogger.com/_wICHhTiQmrA/SH-jQi_d3HI/AAAAAAAAB60/xkYP_cMkqC0/s1600-h/obfuscated_SQL_injection_fast_flux.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp0.blogger.com/_wICHhTiQmrA/SH-jQi_d3HI/AAAAAAAAB60/heB4xfAF32k/s320-R/obfuscated_SQL_injection_fast_flux.JPG" style="border: 0pt none ;" /></a>It's all a matter of how you put it, and putting it like represents a good example of tactical warfare, namely, combining different tactics for the sake of making it harder to keep track of the impact of a particular SQL injection campaign. Consider the following examples of obfuscated domains, naturally being in a fast-flux in the time of the SQL injection that several Chinese script kiddies were taking advantage of :<br />
<br />
%6b%6b%36%2e%75%73 - <b>kk6.us</b><br />
%73%61%79%38%2E%75%73 - <b>s.see9.us </b><br />
%66%75%63%6B%75%75%2E%75%73 - <b>fuckuu.us </b><br />
%61%2E%6B%61%34%37%2E%75%73 - <b>a.ka47.us</b><br />
%61%31%38%38%2E%77%73 - <b>a188.ws</b><br />
%33%2E%74%72%6F%6A%61%6E%38%2E%63%6F%6D - <b>3.trojan8.com</b><br />
%6D%31%31%2E%33%33%32%32%2E%6F%72%67 - <b>m11.3322.org</b><br />
<br />
As always, these obfuscations are just the tip of the iceberg considering the countless number of other URL obfuscations techniques that spammers and phishers used to take advantage of on a large scale. For the time being, one of the main reasons we're not seeing massive SQL injections using such obfuscations is mostly because the feature hasn't been implemented in popular SQL injectors for copycat script kiddies to take advantage of. However, with the potential for evasion of common detection approaches, it's only a matter of personal will for someone to add this extra layer to ensure the survivability of the campaign.<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="text-align: center; clear: both;"></div><a href="http://bp1.blogger.com/_wICHhTiQmrA/SH-rWx8Z7QI/AAAAAAAAB68/ELjRSL8Bobw/s1600-h/real_player_exploit.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp1.blogger.com/_wICHhTiQmrA/SH-rWx8Z7QI/AAAAAAAAB68/kWffly78SVM/s200-R/real_player_exploit.JPG" style="border: 0pt none ;" /></a>The folks behind these obfuscations are naturally <a href="http://ddanchev.blogspot.com/2008/06/underground-multitasking-in-action.html">multitasking on several different underground fronts</a>. Take for instance <b>3.trojan8.com </b>(58.18.33.248) also responding to <b>w2.xnibi.com </b>which is also injected at several domains, <b>w2.xnibi.com/index.gif</b> to be precise.<b> </b>The fake .gif file in the spirit of <a href="http://ddanchev.blogspot.com/2008/04/fake-directory-listings-acquiring.html">fake directory listings for acquiring traffic in order to serve malware</a>, is actually attempting to exploit a RealPlayer vulnerability - JS/RealPlr.LB!exploit. The deeper you go, the uglier it gets.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2008/05/yet-another-massive-sql-injection.html">Yet Another Massive SQL Injection Spotted in the Wild</a><br />
<a href="http://ddanchev.blogspot.com/2008/05/malware-domains-used-in-sql-injection.html">Malware Domains Used in the SQL Injection Attacks</a><br />
<a href="http://ddanchev.blogspot.com/2007/07/sql-injection-through-search-engines.html">SQL Injection Through Search Engines Reconnaissance</a><br />
<a href="http://ddanchev.blogspot.com/2007/05/google-hacking-for-vulnerabilities.html">Google Hacking for Vulnerabilities</a><br />
<a href="http://blogs.zdnet.com/security/?p=1122">Fast-Fluxing SQL injection attacks executed from the Asprox botnet</a><br />
<a href="http://blogs.zdnet.com/security/?p=1394">Sony PlayStation's site SQL injected, redirecting to rogue security software</a><br />
<a href="http://blogs.zdnet.com/security/?p=1118">Redmond Magazine Successfully SQL Injected by Chinese Hacktivists</a><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=qerf8J"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=qerf8J" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=M97n6J"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=M97n6J" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=bexghj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=bexghj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=7Q82Qj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=7Q82Qj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=zZiRyJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=zZiRyJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=X0fmeJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=X0fmeJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=ntQNRj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=ntQNRj" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/338377430" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 17 Jul 2008 11:31:06 +0000</pubDate>
      <category domain="http://securityratty.com/tag/sql">sql</category>
      <category domain="http://securityratty.com/tag/massive sql injections">massive sql injections</category>
      <category domain="http://securityratty.com/tag/sql injection campaign">sql injection campaign</category>
      <category domain="http://securityratty.com/tag/sql injection attacks">sql injection attacks</category>
      <category domain="http://securityratty.com/tag/popular sql injectors">popular sql injectors</category>
      <category domain="http://securityratty.com/tag/massive sql injection">massive sql injection</category>
      <category domain="http://securityratty.com/tag/site sql">site sql</category>
      <category domain="http://securityratty.com/tag/sql injection">sql injection</category>
      <category domain="http://securityratty.com/tag/campaign">campaign</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/338377430/obfuscating-fast-fluxed-sql-injected.html">Obfuscating Fast-fluxed SQL Injected Domains</source>
    </item>
    <item>
      <title><![CDATA[Gonzo: Two Thumbs In and Up]]></title>
      <link>http://securityratty.com/article/6853c438c7bef73e63a300124d9cf5de</link>
      <guid>http://securityratty.com/article/6853c438c7bef73e63a300124d9cf5de</guid>
      <description><![CDATA[Just saw the Hunter S. Thompson movie - Gonzo , and if you are a fan you should to. Lots of good stuff in there, the film links various part of his life and career, and gives a pretty unvarnished view...]]></description>
      <content:encoded><![CDATA[<p><a href="http://en.wikipedia.org/wiki/Hunter_S._Thompson"></a><a style="float: left;" href="http://1raindrop.typepad.com/.a/6a00d83451c75869e200e553c045c48834-pi"><img  class="at-xid-6a00d83451c75869e200e553c045c48834 " alt="180px-Gonzo_citation" src="http://1raindrop.typepad.com/.a/6a00d83451c75869e200e553c045c48834-320wi" style="margin: 0px 5px 5px 0px;"></a> Just saw the Hunter S. Thompson movie - <a href="http://www.rottentomatoes.com/m/gonzo_the_life_and_work_of_dr_hunter_s_thompson/">Gonzo</a>, and if you are a fan you should to. Lots of good stuff in there, the film links various part of his life and career, and gives a pretty unvarnished view of the high highs and the low lows. Weaves in writing, politics, and fame seamlessly.

I have never really had as much fun as early on in my career in the early-mid 90s I was a web programmer in Aspen, hacking CGI/PERL. Among the most fun things was building and running HST's site. My boss, Ed, was his neighbor. Ed was also seriously allergic to bees. One day he was alone in his house and got stung. He was dying. Luckily Hunter was due over to his house to watch a basketball game, walked in and called 911. My boss woke up in the ambulance with Hunter pounding on him chest and screaming at him. Ed said - "Waking up to that face screaming at me, I didn't know if I was alive or dead."

Seeing the movie it was also great to see a lot of the Woody Creek folks again like George Stranahan, who lovingly said about Hunter - "my friend and neighbor who never paid his rent, broke up my marriage and taught my children to smoke dope. "

Of course, there was no way he could match his early productivity and this is true of almost all artists. Most of the last two decades were wasted from a writing standpoint. However his <a href="http://proxy.espn.go.com/espn/page2/story?id=1250751">piece</a> written on 9/11 is as good as its gets:

</p><blockquote><p>
	The towers are gone now, reduced to bloody rubble, along with all hopes for Peace in Our Time, in the United States or any other country. Make no mistake about it: We are At War now -- with somebody -- and we will stay At War with that mysterious Enemy for the rest of our lives. 	
	</p></blockquote><blockquote><p>It will be a Religious War, a sort of Christian Jihad, fueled by religious hatred and led by merciless fanatics on both sides. It will be guerilla warfare on a global scale, with no front lines and no identifiable enemy. Osama bin Laden may be a primitive "figurehead" -- or even dead, for all we know -- but whoever put those All-American jet planes loaded with All-American fuel into the Twin Towers and the Pentagon did it with chilling precision and accuracy. The second one was a dead-on bullseye. Straight into the middle of the skyscraper. 	
	</p></blockquote><blockquote><p>Nothing -- even George Bush's $350 billion "Star Wars" missile defense system -- could have prevented Tuesday's attack, and it cost next to nothing to pull off. Fewer than 20 unarmed Suicide soldiers from some apparently primitive country somewhere on the other side of the world took out the World Trade Center and half the Pentagon with three quick and costless strikes on one day. The efficiency of it was terrifying. 	
	</p></blockquote><blockquote><p>We are going to punish somebody for this attack, but just who or what will be blown to smithereens for it is hard to say. Maybe Afghanistan, maybe Pakistan or Iraq, or possibly all three at once. Who knows? Not even the Generals in what remains of the Pentagon or the New York papers calling for WAR seem to know who did it or where to look for them. 	
	</p></blockquote><blockquote><p>This is going to be a very expensive war, and Victory is not guaranteed -- for anyone, and certainly not for anyone as baffled as George W. Bush. All he knows is that his father started the war a long time ago, and that he, the goofy child-President, has been chosen by Fate and the global Oil industry to finish it Now. He will declare a National Security Emergency and clamp down Hard on Everybody, no matter where they live or why. If the guilty won't hold up their hands and confess, he and the Generals will ferret them out by force. 	
	</p></blockquote><blockquote><p>Good luck. He is in for a profoundly difficult job -- armed as he is with no credible Military Intelligence, no witnesses and only the ghost of Bin Laden to blame for the tragedy.
	
</p></blockquote><p>


One unintended lesson I take away from Hunter's life is how important patience is. Obama is a politician and may yet disappoint us all, but I gotta believe Hunter would be seriously impressed. If he had waited another couple of years, he may have seen a lot of the stuff he fought for in 1968 and 72 come to fruition. Sometimes you are just 36-40 years ahead of your time and you have to be ok with that and figure out how to deal if possible. (Note - it sure sometimes feels this way in software security).

Speaking of security:

</p><blockquote>
	<p><a href="http://www.ram.org/contrib/security.html">Security</a> 	
	</p></blockquote><blockquote><p>by Hunter S. Thompson (1955). 	
	</p></blockquote><blockquote><p>Security ... what does this word mean in relation to life as we know it today? For the most part, it means safety and freedom from worry. It is said to be the end that all men strive for; but is security a utopian goal or is it another word for rut? 	
	</p></blockquote><blockquote><p>Let us visualize the secure man; and by this term, I mean a man who has settled for financial and personal security for his goal in life. In general, he is a man who has pushed ambition and initiative aside and settled down, so to speak, in a boring, but safe and comfortable rut for the rest of his life. His future is but an extension of his present, and he accepts it as such with a complacent shrug of his shoulders. His ideas and ideals are those of society in general and he is accepted as a respectable, but average and prosaic man. But is he a man? has he any self-respect or pride in himself? How could he, when he has risked nothing and gained nothing? What does he think when he sees his youthful dreams of adventure, accomplishment, travel and romance buried under the cloak of conformity? How does he feel when he realizes that he has barely tasted the meal of life; when he sees the prison he has made for himself in pursuit of the almighty dollar? If he thinks this is all well and good, fine, but think of the tragedy of a man who has sacrificed his freedom on the altar of security, and wishes he could turn back the hands of time. A man is to be pitied who lacked the courage to accept the challenge of freedom and depart from the cushion of security and see life as it is instead of living it second-hand. Life has by-passed this man and he has watched from a secure place, afraid to seek anything better What has he done except to sit and wait for the tomorrow which never comes? 	
	</p></blockquote><blockquote><p>Turn back the pages of history and see the men who have shaped the destiny of the world. Security was never theirs, but they lived rather than existed. Where would the world be if all men had sought security and not taken risks or gambled with their lives on the chance that, if they won, life would be different and richer? It is from the bystanders (who are in the vast majority) that we receive the propaganda that life is not worth living, that life is drudgery, that the ambitions of youth must he laid aside for a life which is but a painful wait for death. These are the ones who squeeze what excitement they can from life out of the imaginations and experiences of others through books and movies. These are the insignificant and forgotten men who preach conformity because it is all they know. These are the men who dream at night of what could have been, but who wake at dawn to take their places at the now-familiar rut and to merely exist through another day. For them, the romance of life is long dead and they are forced to go through the years on a treadmill, cursing their existence, yet afraid to die because of the unknown which faces them after death. They lacked the only true courage: the kind which enables men to face the unknown regardless of the consequences. 	
	</p></blockquote><blockquote><p>As an afterthought, it seems hardly proper to write of life without once mentioning happiness; so we shall let the reader answer this question for himself: who is the happier man, he who has braved the storm of life and lived or he who has stayed securely on shore and merely existed?
</p></blockquote><p>

A ship is safest at port, but thats not why we build ships. 
</p>]]></content:encoded>
      <pubDate>Thu, 17 Jul 2008 06:10:12 +0000</pubDate>
      <category domain="http://securityratty.com/tag/life">life</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/sought security">sought security</category>
      <category domain="http://securityratty.com/tag/personal security">personal security</category>
      <category domain="http://securityratty.com/tag/national security emergency">national security emergency</category>
      <category domain="http://securityratty.com/tag/software security">software security</category>
      <category domain="http://securityratty.com/tag/expensive war">expensive war</category>
      <category domain="http://securityratty.com/tag/war">war</category>
      <category domain="http://securityratty.com/tag/hunter">hunter</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/07/gonzo-two-thumbs-in-and-up.html">Gonzo: Two Thumbs In and Up</source>
    </item>
  </channel>
</rss>
