<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: assets]]></title>
    <link>http://securityratty.com/tag/assets</link>
    <description></description>
    <pubDate>Thu, 07 Aug 2008 11:01:50 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Planning for a new year]]></title>
      <link>http://securityratty.com/article/53eb51a004ab3e2477c2c3559dd8fb20</link>
      <guid>http://securityratty.com/article/53eb51a004ab3e2477c2c3559dd8fb20</guid>
      <description><![CDATA[October is creeping up on us, and for most of us that means the beginning of the end of 2008, along with the nagging feeling that we should be doing some planning for 2009. This is the perfect...]]></description>
      <content:encoded><![CDATA[October is creeping up on us, and for most of us that means the beginning of the end of 2008, along with the nagging feeling that we should be doing some planning for 2009. This is the perfect opportunity to take stock of your security and compliance programs, and to develop a plan for improving things next year. If you've been following our various blogs here at RSA you probably realize by now that we espouse a security and compliance program based on three core pillars: it's information-centric, risk-driven and framework-based. Our compliance team has spoken with hundreds of customers from all over the world and in every industry segment this year, and we're finding that this approach is gaining acceptance at an ever-increasing rate. <B>Organizations are realizing that they need to discover, manage and control their information assets in order to protect them...</b>]]></content:encoded>
      <pubDate>Tue, 02 Sep 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/compliance program based">compliance program based</category>
      <category domain="http://securityratty.com/tag/compliance team">compliance team</category>
      <category domain="http://securityratty.com/tag/industry segment">industry segment</category>
      <category domain="http://securityratty.com/tag/compliance programs">compliance programs</category>
      <category domain="http://securityratty.com/tag/information assets">information assets</category>
      <category domain="http://securityratty.com/tag/core pillars">core pillars</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/perfect opportunity">perfect opportunity</category>
      <category domain="http://securityratty.com/tag/october">october</category>
      <source url="http://www.rsa.com/blog/blog_entry.aspx?id=1337">Planning for a new year</source>
    </item>
    <item>
      <title><![CDATA[Software Security Market]]></title>
      <link>http://securityratty.com/article/0adbf216425dc6d24bde35c8640002aa</link>
      <guid>http://securityratty.com/article/0adbf216425dc6d24bde35c8640002aa</guid>
      <description><![CDATA[Information Security budgets are pretty crufty , they are an accumulation of decisions but the analysis that led to these decisions is rarely revisited, it just snowballs. So the normal Information...]]></description>
      <content:encoded><![CDATA[<p>Information Security budgets are pretty <a href="http://en.wikipedia.org/wiki/Cruft">crufty</a>, they are an accumulation of decisions but the analysis that led to these decisions is rarely revisited, it just snowballs. So the normal Information Security budget is just a legacy artifact of when the network was the greatest vulnerability. <a href="http://www.cigital.com/~gem/">Gary McGraw&#160;</a><a href="http://www.informit.com/articles/article.aspx?p=1237978">took a pass</a> at reviewing the numbers in software security, breaking down software security sectors like tools and services (note to Gary - I think <a href="http://www.aspectsecurity.com/">Aspect</a> does more than just training!). This is great work by Gary to get these numbers to see the real changes occuring in software security. Here were his findings on software security tools:</p><div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: &#39;Lucida Grande&#39;; line-height: 19px; ">One of the most important developments in the software security market can be seen in the tools space which, combined, almost doubled to $150-180 million. Top of list are two major acquisitions that closed in 2007: Watchfire&#39;s purchase by IBM (somewhere in the range of $120-150 million on 2006 revenue of $26 million) and SPI Dynamics&#39;s purchase by HP (for around $100 million on 2006 revenue of $21.2 million).</span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: &#39;Lucida Grande&#39;; line-height: 19px;">...</span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: &#39;Lucida Grande&#39;; line-height: 19px; ">The black box space was flat in 2007, with IBM/Watchfire checking in at $24.1 million and HP/SPI Dynamics earning $22.3 million. Smaller companies in the space, including Cenzic, Codenomicon, WhiteHat and the like had combined revenues around $12.5 million (a growth of 25%, though Cenzic grew 16% and WhiteHat 52%). Most of the growth &quot;hiccup&quot; in the black box market can be attributed to the serious challenges posed by any acquisition. So far 2008 looks to be back on track from a growth perspective in the black box testing space. The global reach that IBM and HP offer are already making a big difference.</span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: &#39;Lucida Grande&#39;; line-height: 19px;"><br /></span><span style="font-family: &#39;Lucida Grande&#39;; line-height: 19px; ">On a more positive note, static analysis tools for code review grew at a healthy clip in 2007 into a $91.9 million dollar market. Fortify was up 83% to $29.2 million. Klocwork grew over 60% to $26 million. Coverity grew over 50% to $27.2 million. Ounce Labs tripled their revenue to $9.5 million.</span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><br /></blockquote><div><br /><div>These are very nice growth numbers, what company doesn&#39;t want 83% growth? However, the total picture is not so good. Gary&#39;s estimate shows the software security space coming in at $150 Million total, yet we see a company like Checkpoint that won the network security war in 1995 with earnings of around $900 Million! One single network security vendor is 6 times bigger than the entire software security space?!? Complete UTTER Madness!</div><br /><div>This is the stupefying, stultifying effects of budget cruft, where the decisions made in <a href="http://1raindrop.typepad.com/1_raindrop/2007/10/network-securit.html">The People&#39;s Republic of Information Security</a> have no bearing on reality of threats or even a business case.</div><br /><div>Let&#39;s look at networks. Obviously Cisco is the biggest, they earned $39.5 Billion last year. Pretty stellar. So spending $900 Million (Checkpoint) to defined $39.5 Billion seems like a pretty good deal.</div><br /><div>Except, let&#39;s compare software security spending - last year Microsoft earned $60 Billion, SAP $16 billion, and Oracle $22 Billion. So that is about $98 Billion and you are going to &quot;defend&quot; that with allocating $150 Million worth of software security tools?</div><br />

</div><table border="1">
<tbody><tr>
<td>
</td>
<td><span style="background-color: #d0d0d0; font-family: &#39;Trebuchet MS&#39;; ">
Network
</span></td>
<td><span style="background-color: #d0d0d0; font-family: &#39;Trebuchet MS&#39;; ">
Software
</span></td>
</tr>
<tr>
<td>
Asset Value
</td>
<td>
$39.5 billion
</td>
<td>
$98 billion
</td>
</tr>
<tr>
<td>
Security Investment
</td>
<td>
$900 Million
</td>
<td>
$150 Million
</td>
</tr>
<tr>
<td>
Security Investment <br />&#160;as a percentage of asset value
</td>
<td>
2.28%
</td>
<td>
0.15%
</td></tr></tbody></table>

<br /><div>This table greatly disturbs me. From a prioritization standpoint The People&#39;s Republic of Information Security is misaligned by orders of magnitude. Next time you read about a data breach, or see an auditor&#39;s report with thousands of findings you won&#39;t have to wonder how it happened. It happened because Information Security doesn&#39;t have its eye on the ball.</div><br /><div>Consider that software security tools could grow 50% a year for five years and still be half of where Checkpoint is today!</div><br />I see the outcomes of backwards looking, crufty decisions by Information Security every day - one or two software security sherpas heading out to work with thousands of developers, meanwhile the network security people sit around and read the newspaper and go home every day at 5.</div><br /><div>The optimistic way of looking at all this data is that there is major room for growth for software security, if you take Checkpoint as a target, then the software security space should evolve to around 2% of the software space meaning that it should evolve into a $2 billion space <span style="font-style: italic;">around fifteen times larger</span> than it is today. Unprotected assets will either be protected or will cease to be assets, VCs get your check books ready.</div>]]></content:encoded>
      <pubDate>Mon, 25 Aug 2008 09:18:59 +0000</pubDate>
      <category domain="http://securityratty.com/tag/software">software</category>
      <category domain="http://securityratty.com/tag/software security market">software security market</category>
      <category domain="http://securityratty.com/tag/software security sectors">software security sectors</category>
      <category domain="http://securityratty.com/tag/space">space</category>
      <category domain="http://securityratty.com/tag/tools space">tools space</category>
      <category domain="http://securityratty.com/tag/compare software security">compare software security</category>
      <category domain="http://securityratty.com/tag/software security sherpas">software security sherpas</category>
      <category domain="http://securityratty.com/tag/software security space">software security space</category>
      <category domain="http://securityratty.com/tag/software security">software security</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/08/software-security-market.html">Software Security Market</source>
    </item>
    <item>
      <title><![CDATA[Should BRIC be BIIC?]]></title>
      <link>http://securityratty.com/article/aa3f442ce62735204c29d3d8180fc691</link>
      <guid>http://securityratty.com/article/aa3f442ce62735204c29d3d8180fc691</guid>
      <description><![CDATA[People who follow emerging economies know BRIC (Brazil, Russia, India, China). There are some serious doubts on Russia's margin of safety for investors,(see previous post ), noted China bull Jim...]]></description>
      <content:encoded><![CDATA[<p>People who follow emerging economies know BRIC (Brazil, Russia, India, China). There are some serious doubts on Russia&#39;s margin of safety for investors,(see previous <a href="http://1raindrop.typepad.com/1_raindrop/2008/08/corporate-identity-theft.html">post</a>), noted China bull <a href="http://www.moneymorning.com/2008/04/15/jim-rogers-chinas-economic-advance-is-all-but-unstoppable/">Jim Rogers</a></p><br /><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: &#39;Times New Roman&#39;; font-size: 16px; line-height: normal; ">&quot;Q: Where do you see Russia fitting into this as it comes onto the scene?</span></p><p><span style="font-family: &#39;Times New Roman&#39;; font-size: 16px; line-height: normal; ">Rogers: I don’t. Russia will continue to disintegrate. The Soviet Union has already broken up into 15 countries. Putin controls Petersburg, Moscow, a few airports, et cetera, but Russia never has been a homogeneous [nation] - I mean, in the Soviet Union there were 124 - the &quot;official&quot; number was 124 - ethnic, linguistic, religious, historic and national groups.&#160;</span></p><p><span style="font-family: &#39;Times New Roman&#39;; font-size: 16px; line-height: normal; ">It’s broken up into 15 states. It’ll be 50 … it’ll be 100 [states] before it’s over. Ukraine may break up next. Who knows who’ll break up [after that]? Maybe even parts of Russia.&#160;</span></p><p><span style="font-family: &#39;Times New Roman&#39;; font-size: 16px; line-height: normal; ">To the bulls who say I’m wrong, my rejoinder is this: Let me ask you about Chechnya. The Russians have been trying to deal with Chechnya for 15 years with no success.&#160;</span></p><p><span style="font-family: &#39;Times New Roman&#39;; font-size: 16px; line-height: normal; ">Chechnya’s the size of Connecticut. Chechnya has a million-and-a-half people. If they can’t handle Chechnya, how is the Soviet Union, or Russia, going to handle these other places that are pulling away?&#160;</span></p><p><span style="font-family: &#39;Times New Roman&#39;; font-size: 16px; line-height: normal; ">There’s capitalism there, but it’s outlaw capitalism. If you’re good with dealing with the Mafia, you can probably make a fortune, if you’re on the ground [there]. For the most part, they have a lot of natural resources, which has been great.&#160;</span></p><p><span style="font-family: &#39;Times New Roman&#39;; font-size: 16px; line-height: normal; ">They have huge foreign reserves, but they’re stripping the assets.&#160;</span></p><p><span style="font-family: &#39;Times New Roman&#39;; font-size: 16px; line-height: normal; ">They’re not reinvesting for the most part in productive capacity. They’re stripping the assets. You know, oil production has peaked in Russia, even though there could conceivably be gigantic amounts of oil there somewhere. Nearly everything has peaked, because they have been stripping the assets, rather than reinvesting. &quot;</span></p></blockquote><div><span style="font-family: &#39;Times New Roman&#39;; font-size: 16px; line-height: normal;"><br /></span></div><div><span style="font-family: &#39;Times New Roman&#39;; font-size: 16px; line-height: normal;">To quote Charles Barkley &quot;that&#39;s why I don&#39;t eat shrimp.&quot; The future for all the BRIC countries is probably bright in the long run, but in the short run where is the margin of safety for an investor in Russia?</span></div><div><span style="font-family: &#39;Times New Roman&#39;; font-size: 16px; line-height: normal;"><br /></span></div><div><span style="font-family: &#39;Times New Roman&#39;; font-size: 16px; line-height: normal;">Maybe instead of BRIC it should BIIC - Brazil, India, Indonesia and China. Indonesia just reported its seventh consecutive quarter of GDP growth in excess of 6%. Its the fourth largest country in the world with 240 million people and 17,000 islands. Its one to watch.</span></div>]]></content:encoded>
      <pubDate>Sat, 16 Aug 2008 06:14:34 +0000</pubDate>
      <category domain="http://securityratty.com/tag/russia">russia</category>
      <category domain="http://securityratty.com/tag/bric">bric</category>
      <category domain="http://securityratty.com/tag/handle">handle</category>
      <category domain="http://securityratty.com/tag/soviet union">soviet union</category>
      <category domain="http://securityratty.com/tag/handle chechnya">handle chechnya</category>
      <category domain="http://securityratty.com/tag/chechnya">chechnya</category>
      <category domain="http://securityratty.com/tag/countries">countries</category>
      <category domain="http://securityratty.com/tag/bric countries">bric countries</category>
      <category domain="http://securityratty.com/tag/people">people</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/08/should-bric-be-biic.html">Should BRIC be BIIC?</source>
    </item>
    <item>
      <title><![CDATA[Corporate Identity Theft]]></title>
      <link>http://securityratty.com/article/57c21b4d57a8ae63a7ec8f43043877e8</link>
      <guid>http://securityratty.com/article/57c21b4d57a8ae63a7ec8f43043877e8</guid>
      <description><![CDATA[I remember a talk by the value investor Mason Hawkins (Longleaf Funds) where someone asked him about investing overseas. He answered that he does, but mainly in places where the British flag flew at...]]></description>
      <content:encoded><![CDATA[<p>I remember a <a href="http://www.bengrahaminvesting.ca/Resources/videos.htm#hawkins">talk</a>&#160;by the value investor&#160;<a href="http://en.wikipedia.org/wiki/Mason_Hawkins">Mason Hawkins</a>&#160;(Longleaf Funds) where someone asked him about investing overseas. He answered that he does, but mainly in places where the British flag flew at some point, where there is a rule of law. Here is one example of what he is worried about and why investing in places where your assets have no legal protection does not give the investor a margin of safety.</p><div>Hermitage Fund was until recently the largest fund in Russia. From the Business Week story<a href="http://hermitagefund.com/index.pl/news/article.html?id=895"> &quot;Hijacking the Hermitage Fund&quot;</a></div><br /><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p>Corruption, intimidation, robbery, violent assault, forgery, large-scale fraud. No, not the subject of the latest John Grisham novel, but sensational allegations, made public Apr. 4 by Hermitage Capital Management -- until recently the largest foreign portfolio investor in Russia. In a detailed and damning report, titled Criminal Justice -- Russian-Style, Hermitage alleges the fund&#39;s Russian subsidiaries have fallen victim to an elaborate con designed to defraud the fund of hundreds of millions of dollars.&#160;<br />&#160;&#160;<br />The most sensational part of Hermitage&#39;s allegations is that the attempted larceny was carried out with the direct connivance of officials in the Russian police. Hermitage alleges the police seized documents and equipment that were instrumental to the attempted fraud, which involved bogus court cases based on forged documents, the aim of which was to sue Hermitage subsidiaries for hundreds of millions of dollars. &quot;The most shocking thing is not that there are corporate raiders in Russia who attempt to steal your shares,&quot; says Jamison Firestone, managing partner of Firestone Duncan, Hermitage&#39;s law firm. &quot;The shocking thing is that the police worked hand-in-hand with them, and actually performed the theft of the documents so that the corporate raiders could then do their work.&quot;</p></blockquote><div><br /><div>From the most recent Hermitage Fund letter, here is the current state:</div><br /><br /></div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p>So the two-pronged scam worked in one area and failed in another. The perpetrators weren’t able to steal the assets from us based on the fake court claims, but they were able to steal $230 million from the Russian government by filing amended tax returns on behalf of our stolen companies. What makes this story even more shocking is that we filed six 255-page criminal complaints with the Russian authorities in December last year, one month before the tax fraud took place, and they did nothing to stop it. Two complaints were sent to the Russian General Prosecutor, two to the Russian State Investigative Committee and two to the Internal Affairs Department of the Interior Ministry. There was enough information to prevent the fraud and indict a number of people behind it if the government had acted.&#160;</p><p>Instead of doing anything to save the Russian state from this highly sophisticated and organized looting, two of our complaints were thrown out immediately; two were returned to the same Interior Ministry official we were complaining about (essentially, he was being asked to “investigate himself”); and one was thrown out for “lack of any crime committed.” Only one complaint was taken seriously. It was taken up by the Russian State Investigative Committee in early February, but before it could get any traction, the case was lowered to the South region of the Moscow district of the State Investigative Committee (the lowest level of the Committee) and by June, another senior Interior Ministry official whom we had named in our complaint had joined the “investigation” team (again, to “investigate himself”). To this day there has been no serious response by the Russian authorities to this massive fraud against the Russian state.&#160;</p><p>As we described in our April letter, the problem of corporate “raiding” is now so endemic in Russia that President Medvedev speaks about it as one of the biggest problems faced by Russian businesses. In this case, raiders have taken this problem to a new and absurd extreme by “raiding” the Russian state itself and so far getting away with it. Together with HSBC, we will shortly be filing new criminal complaints with the Russian General Prosecutor and Russian State Investigative Committee as well as with many law enforcement authorities outside of Russia. It is hard to predict what will happen next in this unfolding and unbelievable saga, but as always we will keep you updated on any further developments as they arise.</p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><br /></blockquote><p>Of course we see individual identity theft on a regular basis (actually as Ross Anderson points out its not really identity theft but poor controls on the bank&#39;s parts using SSNs as secrets and so on), but you dont see a major corporation stolen every day.</p>]]></content:encoded>
      <pubDate>Sat, 16 Aug 2008 05:58:30 +0000</pubDate>
      <category domain="http://securityratty.com/tag/russian police">russian police</category>
      <category domain="http://securityratty.com/tag/police">police</category>
      <category domain="http://securityratty.com/tag/russian">russian</category>
      <category domain="http://securityratty.com/tag/russian government">russian government</category>
      <category domain="http://securityratty.com/tag/government">government</category>
      <category domain="http://securityratty.com/tag/identity theft">identity theft</category>
      <category domain="http://securityratty.com/tag/russian-style">russian-style</category>
      <category domain="http://securityratty.com/tag/hermitage">hermitage</category>
      <category domain="http://securityratty.com/tag/fund">fund</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/08/corporate-identity-theft.html">Corporate Identity Theft</source>
    </item>
    <item>
      <title><![CDATA[Wee-Fi: Meraki Modifies, Drops Standard; Tempe's Phoenix?; Remote Wake, Wi-Fi Need Not Apply]]></title>
      <link>http://securityratty.com/article/a930349b033e6f56c6098e0b152daddf</link>
      <guid>http://securityratty.com/article/a930349b033e6f56c6098e0b152daddf</guid>
      <description><![CDATA[Meraki reworks product line, drops new sales of community flavor: The cheap mesh router company has mutated slightly once again. The partly-Google-backed firm founded by MIT RoofNet &quot;graduates&quot; built...]]></description>
      <content:encoded><![CDATA[<p><img src="http://wifinetnews.com/images/weefi.jpg" align="right" border="0" hspace="5" /><a href="http://meraki.com/"><strong>Meraki reworks product line, drops new sales of community flavor:</strong></a> The cheap mesh router company has mutated slightly once again. The partly-Google-backed firm founded by MIT RoofNet "graduates" built the company on the notion that they could sell $50 routers that could mesh with each other, and use a robust central management system they developed. Over time, the $50 price didn't hold up for commercial networks of scale. Last October, the <a href="http://wifinetnews.com/archives/007973.html"><strong>company mishandled a change</strong></a> in its business model when they abruptly announced a $100 increase in price for newly purchased nodes under their Meraki Pro level for any network that wanted to control whether or not ads appeared, have user accounts, and charge for service. (They eventually <a href="http://wifinetnews.com/archives/007979.html"><strong>recovered, apologized, and reworked</strong></a> some of the transition details.) <img src="http://wifinetnews.com//images/2008/meraki_indoor.jpg" alt="meraki_indoor.jpg" border="0" width="175" height="111" align="right" />The company continued to offer a $50 indoor and $100 outdoor Standard level nodes for networks that required ads and had other limits. As of a few days ago, Standard is dead, and the Meraki mini has been upgraded to the <a href="http://meraki.com/products_services/hardware/indoor/"><strong>Meraki Indoor</strong></a> ($150). The Indoor has signal strength LEDs on the side for better help in placing units, an internal antenna, and better resilience against power fluctuations. The company <a href="http://meraki.com/support/faq/"><strong>explains its move</strong></a> in eliminating Standard by noting that most customers moved to Pro. It's not precisely the end of idealism (nor did that happen last October), as Meraki is still one of the major commercial mesh vendors, and their products are still vastly easier and a fraction of the cost of higher-end competitors.<br clear="all"></p>

<p><a href="http://www.eastvalleytribune.com/story/123037"><strong>New life for dead Tempe network?</strong></a> Another firm has expressed interest in buying the pennies on the dollar assets that remain of the former Kite Networks installation in Tempe from the firm that financed the venture as long as they can negotiate a new, more favorable deal with the city for mounting and removal rights. CTC, Inc., which the East Valley Tribune reports runs networks in the Kansas City, Mo., area, thinks there's an opportunity. The article notes that reception problems were due in part to the prevalence of stucco in Tempe, common in the southwest. Stucco walls layer plaster or other materials on a wire mesh for strength that turns a house into a bit of an accidental <a href="http://en.wikipedia.org/wiki/Faraday_cage"><strong>Faraday cage</strong></a>, partially shielding the home from electromagnetic radiation. (Could I go so far to say that Tempe's network could be a phoenix? Ouch.)</p>

<p><a href="http://www.usatoday.com/tech/products/2008-08-14-intel-wake-up-pcs_N.htm"><strong>Wake up, you darn computer:</strong></a> Intel's new Remote Wake motherboards won't work with Wi-Fi, it's important to note. The feature, announced today, will let an incoming VoIP call (the articles all say "phone call over the Internet") to wake a computer, as long as the call comes from a particular source. Of course, the standard SIP protocol for VoIP doesn't have the kind of security and integrity that would allow this; Intel has to overcome the problem with network address translation that renders most computer unreachable from outside the local network without a separate service like GoToMyPC or LogMeIn; and it will only work for computers connected via Ethernet to a local network, because Wi-Fi is off when a computer sleeps, while Ethernet can remain lightly active. I don't have the protocol details yet, but there's long been a <a href="http://en.wikipedia.org/wiki/Wake-on-LAN"><strong>Wake on LAN protocol</strong></a> that required support in a router, operating system, and Ethernet card; Intel may be leveraging this.</p>]]></content:encoded>
      <pubDate>Thu, 14 Aug 2008 06:32:51 +0000</pubDate>
      <category domain="http://securityratty.com/tag/meraki">meraki</category>
      <category domain="http://securityratty.com/tag/network">network</category>
      <category domain="http://securityratty.com/tag/network address translation">network address translation</category>
      <category domain="http://securityratty.com/tag/dead tempe network">dead tempe network</category>
      <category domain="http://securityratty.com/tag/dead">dead</category>
      <category domain="http://securityratty.com/tag/tempe">tempe</category>
      <category domain="http://securityratty.com/tag/standard">standard</category>
      <category domain="http://securityratty.com/tag/meraki indoor">meraki indoor</category>
      <category domain="http://securityratty.com/tag/meraki mini">meraki mini</category>
      <source url="http://wifinetnews.com/archives/008420.html">Wee-Fi: Meraki Modifies, Drops Standard; Tempe's Phoenix?; Remote Wake, Wi-Fi Need Not Apply</source>
    </item>
    <item>
      <title><![CDATA[Data Mining to Detect Pump-and-Dump Scams]]></title>
      <link>http://securityratty.com/article/a5878a5dbedbdb06b13ea9db23d0e411</link>
      <guid>http://securityratty.com/article/a5878a5dbedbdb06b13ea9db23d0e411</guid>
      <description><![CDATA[I don't know any of the details, but this seems like a good use of data mining: Mr Tancredi said Verisign's fraud detection kit would help &quot;decrease the time between the attack being launched and the...]]></description>
      <content:encoded><![CDATA[<p>I don't know any of the details, but <a href="http://news.bbc.co.uk/1/hi/technology/7552009.stm">this</a> seems like a good use of data mining:</p>

<blockquote>Mr Tancredi said Verisign's fraud detection kit would help "decrease the time between the attack being launched and the brokerage being able to respond".

<p>Before now, he said, brokerages relied on counter measures such as restrictive stock trading or analysis packages that only spotted a problem when money had gone.</p>

<p>Verisign's software is a module that brokers can add to their in-house trading system that alerts anti-fraud teams to look more closely at trades that exhibit certain behaviour patterns.</p>

<p>"What this self-learning behavioural engine does is look at the different attributes of the event, not necessarily about the computer or where you are logging on from but about the actual transaction, the trade, the amount of the trade," said Mr Tancredi.</p>

<p>"For example have you liquidated all of your assets in stock that you own in order to buy one penny stock?" he said. "Another example is when a customer who normally trades tech stock on Nasdaq all of a sudden trades a penny stock that has to do with health care and is placing a trade four times more than normal."</blockquote></p>

<p>This is a good use of data mining because, as I <a href="http://www.schneier.com/blog/archives/2006/03/data_mining_for.html">said</a> previously:</p>

<blockquote>Data mining works best when there's a well-defined profile you're searching for, a reasonable number of attacks per year, and a low cost of false alarms.</blockquote>

<p>Another news article <a href="http://news.yahoo.com/s/zd/20080811/tc_zd/230711">here</a>.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=MmnOWK"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=MmnOWK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=pZdBMK"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=pZdBMK" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Thu, 14 Aug 2008 02:10:34 +0000</pubDate>
      <category domain="http://securityratty.com/tag/stock">stock</category>
      <category domain="http://securityratty.com/tag/penny stock">penny stock</category>
      <category domain="http://securityratty.com/tag/restrictive stock">restrictive stock</category>
      <category domain="http://securityratty.com/tag/data">data</category>
      <category domain="http://securityratty.com/tag/trades tech stock">trades tech stock</category>
      <category domain="http://securityratty.com/tag/trades">trades</category>
      <category domain="http://securityratty.com/tag/fraud detection kit">fraud detection kit</category>
      <category domain="http://securityratty.com/tag/alerts anti-fraud teams">alerts anti-fraud teams</category>
      <category domain="http://securityratty.com/tag/trade">trade</category>
      <source url="http://www.schneier.com/blog/archives/2008/08/data_mining_to.html">Data Mining to Detect Pump-and-Dump Scams</source>
    </item>
    <item>
      <title><![CDATA[76Service - Cybercrime as a Service Going Mainstream]]></title>
      <link>http://securityratty.com/article/35bdaf104e9aecf7703834d959f39050</link>
      <guid>http://securityratty.com/article/35bdaf104e9aecf7703834d959f39050</guid>
      <description><![CDATA[Disintermediating the intermediaries in the cybercrime ecosystem, ultimately results in more profitable operations. Controversial to the concept of outsourcing, some cybercriminals are in fact so...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="text-align: center; clear: both;"></div><a href="http://3.bp.blogspot.com/_wICHhTiQmrA/SKKs5L3ihpI/AAAAAAAACBs/vEaSMC2S8nI/s1600-h/76service.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://3.bp.blogspot.com/_wICHhTiQmrA/SKKs5L3ihpI/AAAAAAAACBs/qhgjQh39ej8/s200-R/76service.JPG" style="border: 0pt none ;" /></a>Disintermediating the intermediaries in the cybercrime ecosystem, ultimately results in more profitable operations. Controversial to the concept of outsourcing, some cybercriminals are in fact so self-sufficient, that the stereotype of a mysterious 76service server offered for rent could in fact easily cease to exist in an ecosystem so vibrant that literally everyone can partion their botnet and start offering access to it on a multi-user basis. Evil? Obviously. Extending the lifecycle of a proprietary malware tool? Definitely.<br />
<br />
<a href="http://www.youtube.com/watch?v=lw9IeuKkNbc">The infamous 76service</a>, a cybercrime as a service web interface where customers basically collect the final output out of the banking malware botnet during the specific period of time for which they've purchases access to the service, is going mainstream, with 76Service's Spring Edition apparently leaking out, and cybercriminals enjoying its interoperability potential by introducing different banking trojans in their campaigns. <br />
<br />
In this post, I'll discuss the 76service's spring.edition that has been combined with a <a href="http://ddanchev.blogspot.com/2007/11/metaphisher-malware-kit-spotted-in-wild.html">Metaphisher banking malware</a>, an a popular <a href="http://ddanchev.blogspot.com/2008/04/crimeware-in-middle-zeus.html">web malware exploitation kit</a>, with two campaigns currently hosting 5.51GB of stolen banking data based on over 1 million compromised hosts 59% of which are based in Russia. Screenshots courtesy of an egocentric underground show-off.<br />
<br />
<a href="http://www.cio.com/article/print/135500">Some general info on the 76service</a> :<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="text-align: center; clear: both;"></div><a href="http://1.bp.blogspot.com/_wICHhTiQmrA/SKKyWAXgYGI/AAAAAAAACB0/JXHZFuBb6Rs/s1600-h/76service1.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://1.bp.blogspot.com/_wICHhTiQmrA/SKKyWAXgYGI/AAAAAAAACB0/2qZfVy6YfU8/s200-R/76service1.JPG" style="border: 0pt none ;" /></a>"<i>Subscribers could log in with their assigned user name and     password any time during the 30-day project. They’d be     met with a screen that told them which of their bots was     currently active, and a side bar of management options. For     example, they could pull down the latest drops—data     deposits that the Gozi-infected machines they subscribed to     sent to the servers, like the 3.3 GB one Jackson had     found. A project was like an investment portfolio. Individual     Gozi-infected machines were like stocks and subscribers bought     a group of them, betting they could gain enough personal     information from their portfolio of infected machines to make a     profit, mostly by turning around and selling credentials on the     black market. (In some cases, subscribers would use a few of     the credentials themselves). Some machines, like some stocks, would under perform and     provide little private information. But others would land the     subscriber a windfall of private data. The point was to     subscribe to several infected machines to balance that risk,     the way Wall Street fund managers invest in many stocks to     offset losses in one company with gains in another.</i>"<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="text-align: center; clear: both;"></div><a href="http://1.bp.blogspot.com/_wICHhTiQmrA/SKKy5q1ebVI/AAAAAAAACB8/uGe8GuhDvRg/s1600-h/76service2.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://1.bp.blogspot.com/_wICHhTiQmrA/SKKy5q1ebVI/AAAAAAAACB8/88IxypeBf74/s200-R/76service2.JPG" style="border: 0pt none ;" /></a>The 76service empowers everyone who is either not willing to spend time and resources for building and maintaining a botnet, launching campaigns, and SQL injecting hundreds of thousands of sites in order to take advantage of the long tail of malware infected sites that theoretically can outpace the traffic that could come from a SQL injected high-profile site.<br />
<br />
Next to the spring.edition, <a href="http://secureworks.com/research/threats/gozi/">the winter edition's price starts from $1000 and goes to $2000</a>, which is all a matter of who you're buying it from, unless of course you haven't come across leaked copies :<br />
<br />
"<i>Assuming that the dealer offering what he claimed was the 76service kit was correct, the profit is not only in the kit, but in selling value added services like exploitation, compromised servers/accounts, database configuration, and customization of the interface. Prices start between $1000 to $2000 and go up based on added services. The underground payment methods generally involve hard-to-track virtual currencies, whose central authority is in a jurisdiction where regulation is liberal to non-existent, and feature non-reversible transactions. The individual or group called "76service" was easy to track down on the Web, but not in person.</i>" <br />
<br />
<div style="text-align: left;"></div><div class="separator" style="text-align: center; clear: both;"></div><a href="http://1.bp.blogspot.com/_wICHhTiQmrA/SKLUyA7g9LI/AAAAAAAACCE/nl-OA3FHPs0/s1600-h/76service3.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://1.bp.blogspot.com/_wICHhTiQmrA/SKLUyA7g9LI/AAAAAAAACCE/8zS6gcoEdvk/s200-R/76service3.JPG" style="border: 0pt none ;" /></a>It's interesting to monitor how services aiming to provide specific malicious services are vertically integrating by expanding their portfolio of related services -- taka a spamming vendor that will offer the segmented email databases, the advanced metrics, and the localization of the spam messages to different languages -- or letting the buyer have full control of anything that comes out of a particular botnet for a specific period of time in which he has bought access to it. For instance, DDoS for hire matured into botnet for hire, which evolved into today's "What type of stolen data do you want?" for hire mentality I'm starting to see emerging, next to the usual interest in improving the metrics and thereby the probability for a more succesful campaign. <br />
<br />
<div style="text-align: left;"></div><div class="separator" style="text-align: center; clear: both;"></div><a href="http://2.bp.blogspot.com/_wICHhTiQmrA/SKLa2TO4yAI/AAAAAAAACCM/4s3Mkgb-NOY/s1600-h/metafisher1_ukstories.jpg" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://2.bp.blogspot.com/_wICHhTiQmrA/SKLa2TO4yAI/AAAAAAAACCM/Bt7wKW7IPcE/s200-R/metafisher1_ukstories.jpg" style="border: 0pt none ;" /></a>Ironically, this cybercrime model is so efficient that the people behind it cannot seem to be able to process all of the stolen data, which like a great deal of underground assets loses its value if not sold as fast as possible. The result of this oversupply of stolen data are the increasing number of services selling raw logs segmented based on a particular country for a specific period of time.<br />
<br />
Time for a remotely exploitable vulnerability in yet another malware kit about to go mainstream? Definitely, unless of course backdooring it and releasing it doesn't achieve the obvious results of controlling someone else's cybercrime ecosystem.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2007/03/underground-economys-supply-of-goods.html">The Underground Economy's Supply of Goods and Services</a><br />
<a href="http://ddanchev.blogspot.com/2007/10/dynamics-of-malware-industry.html">The Dynamics of the Malware Industry - Proprietary Malware Tools</a><br />
<a href="http://ddanchev.blogspot.com/2008/06/using-market-forces-to-disrupt-botnets.html">Using Market Forces to Disrupt Botnets</a><br />
<a href="http://ddanchev.blogspot.com/2007/10/multiple-firewalls-bypassing.html">Multiple Firewalls Bypassing Verification on Demand</a><br />
<a href="http://ddanchev.blogspot.com/2007/10/managed-spamming-appliances-future-of.html">Managed Spamming Appliances - The Future of Spam</a><br />
<a href="http://ddanchev.blogspot.com/2008/02/localizing-cybercrime-cultural.html">Localizing Cybercrime - Cultural Diversity on Demand</a><br />
<a href="http://ddanchev.blogspot.com/2008/01/e-crime-and-socioeconomic-factors.html">E-crime and Socioeconomic Factors</a><b>&nbsp;</b><br />
<a href="http://ddanchev.blogspot.com/2007/08/malware-as-web-service.html">Malware as a Web Service</a><b>&nbsp;</b><br />
<a href="http://ddanchev.blogspot.com/2008/07/coding-spyware-and-malware-for-hire.html">Coding Spyware and Malware for Hire</a><br />
<a href="http://ddanchev.blogspot.com/2008/07/are-stolen-credit-card-details-getting.html">Are Stolen Credit Card Details Getting Cheaper?</a><br />
<a href="http://ddanchev.blogspot.com/2008/07/neosploit-team-leaving-it-underground.html">Neosploit Team Leaving the IT Underground</a><br />
<a href="http://ddanchev.blogspot.com/2008/06/zeus-crimeware-kit-vulnerable-to.html">The Zeus Crimeware Kit Vulnerable to Remotely Exploitable Flaw</a><br />
<a href="http://ddanchev.blogspot.com/2008/08/pinch-vulnerable-to-remotely.html">Pinch Vulnerable to Remotely Exploitable Flaw</a><br />
<a href="http://ddanchev.blogspot.com/2008/07/dissecting-managed-spamming-service.html">Dissecting a Managed Spamming Service</a><br />
<a href="http://ddanchev.blogspot.com/2007/10/managed-spamming-appliances-future-of.html">Managed "Spamming Appliances" - The Future of Spam</a><br />
<br />
<b> </b><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=NWhwdK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=NWhwdK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=7zGnyK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=7zGnyK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=Rqgfok"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=Rqgfok" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=zA7GDk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=zA7GDk" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=4r7WMK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=4r7WMK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=880FjK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=880FjK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=3wtOmk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=3wtOmk" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/363878623" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 13 Aug 2008 04:08:43 +0000</pubDate>
      <category domain="http://securityratty.com/tag/76service">76service</category>
      <category domain="http://securityratty.com/tag/service">service</category>
      <category domain="http://securityratty.com/tag/malware">malware</category>
      <category domain="http://securityratty.com/tag/malware kit">malware kit</category>
      <category domain="http://securityratty.com/tag/cybercrime">cybercrime</category>
      <category domain="http://securityratty.com/tag/malware botnet">malware botnet</category>
      <category domain="http://securityratty.com/tag/botnet">botnet</category>
      <category domain="http://securityratty.com/tag/mysterious 76service server">mysterious 76service server</category>
      <category domain="http://securityratty.com/tag/web service">web service</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/363878623/76service-cybercrime-as-service-going.html">76Service - Cybercrime as a Service Going Mainstream</source>
    </item>
    <item>
      <title><![CDATA[Digital Cash in Iraq]]></title>
      <link>http://securityratty.com/article/84493590b736c33ff0c22bfa1fc5590a</link>
      <guid>http://securityratty.com/article/84493590b736c33ff0c22bfa1fc5590a</guid>
      <description><![CDATA[Smart cards have still never quite taken off across the US, and at this point its fair to wonder if they will or if they will be eclipsed by phones or some such, but smart cards sure are big outside...]]></description>
      <content:encoded><![CDATA[<p>Smart cards have still never quite taken off across the US, and at this point its fair to wonder if they will or if they will be eclipsed by phones or some such, but smart cards sure are big outside the US. One of the most interesting applications is of course digital cash and transaction processing. <a href="http://www.aplitec.co.za/">Net1 UEPS</a>&#160;(ticker: <a href="http://finance.google.com/finance?q=ueps">UEPS</a>) out of South Africa appears to be the leader here having built a $1.2B business out of this model. there are lots of regions in the world where people are underbanked or unbanked altogether and where its dangerous to have too much cash. I blogged about this earlier on <a href="http://1raindrop.typepad.com/1_raindrop/2007/08/beer-shotguns-a.html">Beer, Shotguns and Digital Cash</a>.&#160;</p><br /><div>Now <a href="http://biz.yahoo.com/iw/080804/0421781.html">Net1 UEPS is in Iraq as well</a>:</div><br /><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: arial; line-height: normal; ">The first UEPS transaction was performed on Sunday, August 3, 2008, in Baghdad, Iraq, during the official launch of the UEPS smart card technology with the two state banks namely, Rafidain Bank and Rasheed Bank.</span></p></blockquote><div><span style="font-family: arial; line-height: normal;"><br /></span></div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: arial; line-height: normal; ">The official launch, attended by invitees from Rafidain Bank, Rasheed Bank, the Iraqi Government, War Victim Ministry and Martyrdom Ministry, demonstrated smart card registration, biometric enrolment and issuing of UEPS cards, offline loading of wage payments and government grants to the UEPS cards and dispensing of cash.</span><br /><span style="font-family: arial; line-height: normal; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: arial; line-height: normal; ">The pilot project involving 100,000 beneficiaries is now ready for implementation across selected bank branches and will enable the distribution and payment of government grants to war victims and martyrdom beneficiaries, as well as salary and wage distribution and payment to employees of the two state banks.</span><br /><span style="font-family: arial; line-height: normal; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: arial; line-height: normal; ">Brenda Stewart, Net1 Senior Vice President Sales and Marketing, said, &quot;From the entire team at Net1, we congratulate the Iraqi consortium on this historic achievement and look forward to the successful implementation of the various projects already identified for implementation, as well as the projects currently in business development. Net1 is proud that the development of its core technology, from which it creates end-user products that satisfy the requirements of its customers, can change the way business is conducted leading to the improvement of people&#39;s lives. We share the belief of our Iraqi partners that our technology can play a fundamental role in the upliftment of the economy. The success of any technology should be measured, not only by the profits it generates for its inventors, suppliers and users, but also by the difference that it makes to the lives of people,&quot; Stewart concluded.</span></p></blockquote><div><span style="font-family: arial; line-height: normal;"><p>I think there are lessons to be learned here wrt data and message level security. Net1 UEPS is a good example a of system carrying valuable assets across hostile terrain, web security architecture can learn a lot from this model.</p><p>P.S. If you are a <a href="http://en.wikipedia.org/wiki/Joel_Greenblatt">Joel Greenblatt</a> geek - UEPS is a <a href="http://www.magicformulainvesting.com/">magic formula stock</a>&#160;(meaning they make cash and are priced cheaply) last time I checked.</p><p></p></span></div>]]></content:encoded>
      <pubDate>Mon, 11 Aug 2008 08:53:52 +0000</pubDate>
      <category domain="http://securityratty.com/tag/ueps cards">ueps cards</category>
      <category domain="http://securityratty.com/tag/ueps">ueps</category>
      <category domain="http://securityratty.com/tag/digital cash">digital cash</category>
      <category domain="http://securityratty.com/tag/cash">cash</category>
      <category domain="http://securityratty.com/tag/net1 ueps">net1 ueps</category>
      <category domain="http://securityratty.com/tag/bank">bank</category>
      <category domain="http://securityratty.com/tag/net1">net1</category>
      <category domain="http://securityratty.com/tag/rafidain bank">rafidain bank</category>
      <category domain="http://securityratty.com/tag/ueps transaction">ueps transaction</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/08/digital-cash-in-iraq.html">Digital Cash in Iraq</source>
    </item>
    <item>
      <title><![CDATA[Portland's MetroFi Nodes Still Hanging on]]></title>
      <link>http://securityratty.com/article/6f76ffda934c74f0161ffa74afd5c788</link>
      <guid>http://securityratty.com/article/6f76ffda934c74f0161ffa74afd5c788</guid>
      <description><![CDATA[The Oregonian notes that the city may still pick up tab for removing MetroFi's base station: Although MetroFi posted a $30,000 bond against removal of its antennas, the cost could be $90,000 if the...]]></description>
      <content:encoded><![CDATA[<p><img src="http://wifinetnews.com/images/muni_icon.jpg" align="right" hspace="5" height="80" width="80" border="0" /><strong><a href="http://www.oregonlive.com/business/oregonian/index.ssf?/base/business/121824871892410.xml&coll=7">The Oregonian notes that the city may still pick up tab for removing MetroFi's base station:</a></strong> Although MetroFi posted a $30,000 bond against removal of its antennas, the cost could be $90,000 if the company winds up with insufficient assets to roll down the network. The city could pare that figure by using its own crews for removing nodes from traffic signals, but that would still leave $36,000 on the table. The paper notes that MetroFi tried to sell some nodes on eBay, but I don't believe they had takers.</p>]]></content:encoded>
      <pubDate>Fri, 08 Aug 2008 18:08:25 +0000</pubDate>
      <category domain="http://securityratty.com/tag/metrofi">metrofi</category>
      <category domain="http://securityratty.com/tag/nodes">nodes</category>
      <category domain="http://securityratty.com/tag/company winds">company winds</category>
      <category domain="http://securityratty.com/tag/city">city</category>
      <category domain="http://securityratty.com/tag/traffic signals">traffic signals</category>
      <category domain="http://securityratty.com/tag/paper notes">paper notes</category>
      <category domain="http://securityratty.com/tag/oregonian notes">oregonian notes</category>
      <category domain="http://securityratty.com/tag/insufficient assets">insufficient assets</category>
      <category domain="http://securityratty.com/tag/base station">base station</category>
      <source url="http://wifinetnews.com/archives/008415.html">Portland's MetroFi Nodes Still Hanging on</source>
    </item>
    <item>
      <title><![CDATA[Phishers Backdooring Phishing Pages to Scam One Another]]></title>
      <link>http://securityratty.com/article/6ccaae3434fe8c6502ba9a6fc0cfb3e0</link>
      <guid>http://securityratty.com/article/6ccaae3434fe8c6502ba9a6fc0cfb3e0</guid>
      <description><![CDATA[There seems to be no such thing as a free phishing page these days, with phishers scamming one another at an alarming rate according to a recently published research entitled &quot; There is No Free...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="text-align: center; clear: both;"></div><div style="text-align: left;"></div><div class="separator" style="text-align: center; clear: both;"></div><a href="http://4.bp.blogspot.com/_wICHhTiQmrA/SJsXrRQtHeI/AAAAAAAACA8/wxZZ1xFCjPk/s1600-h/phishing_pages.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://4.bp.blogspot.com/_wICHhTiQmrA/SJsXrRQtHeI/AAAAAAAACA8/TiCS7pP_jF0/s200-R/phishing_pages.JPG" style="border: 0pt none ;" /></a>There seems to be no such thing as a free phishing page these days, with phishers scamming one another at an alarming rate according to a recently published research entitled "<a href="http://www.usenix.org/event/woot08/tech/full_papers/cova/cova_html/">There is No Free Phish:An Analysis of “Free” and Live Phishing Kits</a>".<br />
<br />
Cybercriminals attempting to scam other cybercriminals has been happening for years, with old school cases where backdoored malware tools such as crypters and binders are offered for free, or a newly released RAT whose client is in fact infected with a third-party malware. Realizing and definitely not enjoying the fact that the lowered entry barriers into cybercrime are empowering yesterday's script kiddies will malware kits that used to be utilized by a set of people who invested time and money into the process several years ago, this unethical competitive practice is only going to get more common. Backdooring phishing pages is one thing, <a href="http://blogs.zdnet.com/security/?p=1641">backdooring entire web malware exploitation kits, next to the possibility to remotely exploit a competitor's command and control server is entirely another</a> : <br />
<br />
"<i>Taking a more strategic approach, a cybercriminal wanting to scam another cybercriminal would backdoor <a href="http://blogs.zdnet.com/security/?p=1598" title="The Neosploit cybercrime group abandons its web malware exploitation kit">a highly expensive web malware exploitation kit</a>, then start distributing it for free, and in fact, there have been numerous cases when such kits have been distributed in such a fraudulent manner. The result is a total outsourcing of the process of coming up with ways to infect hundreds of thousands of users though client side exploits <a href="http://blogs.zdnet.com/security/?p=1122" title="Fast-Fluxing SQL injection attacks executed from the Asprox botnet">embedded or SQL injected at legitimate sites</a>, and basically collecting the final output - the stolen E-banking data and the botnet itself.</i>"<br />
<br />
What's to come in the long term? Why just backdoor the phishing page, when you can embedd it with a live exploit URL in an attempt to both, infect the cybercriminal about to use and obtain all of the already stolen virtual assets has has already stolen, and also, <a href="http://ddanchev.blogspot.com/2008/05/skype-phishing-pages-serving-exploits.html">have a third-party maintain a blended attack campaign without even knowing it</a>.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2008/06/phishing-campaign-spreading-across.html">Phishing Campaign Spreading Across Facebook </a><b><br />
</b><a href="http://ddanchev.blogspot.com/2008/03/phishing-pages-for-every-bank-are.html">Phishing Pages for Every Bank are a Commodity</a> <br />
<a href="http://ddanchev.blogspot.com/2008/02/rbns-phishing-activities.html">RBN's Phishing Activities</a><br />
<a href="http://ddanchev.blogspot.com/2008/02/inside-botnets-phishing-activities.html">Inside a Botnet's Phishing Activities</a><br />
<a href="http://ddanchev.blogspot.com/2007/11/large-scale-myspace-phishing-attack.html">Large Scale MySpace Phishing Attack</a><br />
<a href="http://ddanchev.blogspot.com/2007/12/update-on-myspace-phishing-campaign.html">Update on the MySpace Phishing Campaign</a><br />
<a href="http://ddanchev.blogspot.com/2008/01/myspace-phishers-now-targeting-facebook.html">MySpace Phishers Now Targeting Facebook</a><br />
<a href="http://ddanchev.blogspot.com/2008/05/myspace-hosting-myspace-phishing.html">MySpace Hosting MySpace Phishing Profiles</a><br />
<a href="http://ddanchev.blogspot.com/2007/08/diy-phishing-kits.html">DIY Phishing Kits</a><br />
<a href="http://ddanchev.blogspot.com/2007/09/diy-phishing-kit-goes-20.html">DIY Phishing Kit Goes 2.0</a><br />
<a href="http://ddanchev.blogspot.com/2007/09/paypal-and-ebay-phishing-domains.html">PayPal and Ebay Phishing Domains</a><br />
<a href="http://ddanchev.blogspot.com/2007/07/average-online-time-for-phishing-sites.html">Average Online Time for Phishing Sites</a><br />
<a href="http://ddanchev.blogspot.com/2007/02/phishing-ecosystem.html">The Phishing Ecosystem</a><br />
<a href="http://ddanchev.blogspot.com/2007/10/assessing-rock-phish-campaign.html">Assessing a Rock Phish Campaign</a><br />
<a href="http://ddanchev.blogspot.com/2007/04/taking-down-phishing-sites-business.html">Taking Down Phishing Sites - A Business Model?</a><br />
<a href="http://ddanchev.blogspot.com/2007/03/take-this-malicious-site-down.html">Take this Malicious Site Down - Processing Order..</a><br />
<a href="http://ddanchev.blogspot.com/2007/09/209-host-locked.html">209 Host Locked</a><br />
<a href="http://ddanchev.blogspot.com/2007/12/2091-host-locked.html">209.1 Host Locked</a><br />
<a href="http://ddanchev.blogspot.com/2007/11/661-host-locked.html">66.1 Host Locked</a><br />
<a href="http://ddanchev.blogspot.com/2007/07/confirm-your-gullibility.html">Confirm Your Gullibility</a><br />
<a href="http://ddanchev.blogspot.com/2007/12/phishers-spammers-and-malware-authors.html">Phishers, Spammers and Malware Authors Clearly Consolidating</a><br />
<a href="http://ddanchev.blogspot.com/2007/08/economics-of-phishing.html">The Economics of Phishing</a><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=adzwcK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=adzwcK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=r3qKtK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=r3qKtK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=lKP1Kk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=lKP1Kk" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=kwEXWk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=kwEXWk" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=vKtnuK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=vKtnuK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=hxAsFK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=hxAsFK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=3CLAFk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=3CLAFk" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/358721854" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 07 Aug 2008 11:01:50 +0000</pubDate>
      <category domain="http://securityratty.com/tag/phishers">phishers</category>
      <category domain="http://securityratty.com/tag/myspace phishers">myspace phishers</category>
      <category domain="http://securityratty.com/tag/campaign">campaign</category>
      <category domain="http://securityratty.com/tag/myspace">myspace</category>
      <category domain="http://securityratty.com/tag/rock phish campaign">rock phish campaign</category>
      <category domain="http://securityratty.com/tag/free phish">free phish</category>
      <category domain="http://securityratty.com/tag/free">free</category>
      <category domain="http://securityratty.com/tag/kits">kits</category>
      <category domain="http://securityratty.com/tag/attack">attack</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/358721854/phishers-backdooring-phishing-pages-to.html">Phishers Backdooring Phishing Pages to Scam One Another</source>
    </item>
  </channel>
</rss>
