<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: collectively]]></title>
    <link>http://securityratty.com/tag/collectively</link>
    <description></description>
    <pubDate>Fri, 23 May 2008 00:00:00 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Email Hacking Going Commercial - Part Two]]></title>
      <link>http://securityratty.com/article/403816e80242e85ea676f8d2be0684b6</link>
      <guid>http://securityratty.com/article/403816e80242e85ea676f8d2be0684b6</guid>
      <description><![CDATA[Malware authors seeking financial gains from releasing their trojans often promote them as Remote Access Tools , which if we exclude the built-in anti-sandboxing and antivirus software killing...]]></description>
      <content:encoded><![CDATA[<a href="http://1.bp.blogspot.com/_wICHhTiQmrA/SJtd4DC75_I/AAAAAAAACBE/No0eDRtdb8s/s1600-h/hire_to_hack.png" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://1.bp.blogspot.com/_wICHhTiQmrA/SJtd4DC75_I/AAAAAAAACBE/BK1B_uN_Iew/s200-R/hire_to_hack.png" style="border: 0pt none ;" /></a>Malware authors seeking financial gains from releasing their trojans often promote them as <a href="http://ddanchev.blogspot.com/2007/07/shark2-rat-or-malware.html">Remote Access Tools</a>, which if we exclude the built-in anti-sandboxing and antivirus software killing capabilities, <a href="http://ddanchev.blogspot.com/2007/08/rats-or-malware.html">could pass for a RAT</a>. In a similar deceptive fashion, <a href="http://ddanchev.blogspot.com/2008/07/email-hacking-going-commercial.html">email hacking services are pitched as email password recovery services</a>. <br />
<br />
Hacking as a Service sites seems to be popping out like mushrooms these days, thanks primarily due to the fact that yesterday's script kiddies are today's entrepreneurs trying to even monetize the process of bruteforcing. Here's their pitch :<br />
<br />
"<i>Well.. There is nothing different in our       services. Like other group, we simply crack email addresses       , and provide you the current password used by the victim to       you for a suitable price. Nothing unique that we can brag       about....&nbsp; We don't hack NASA or CIA , we cannot hack a       bank and steal a million dollars.. We just crack email       password .. AND WE DO A HECK OF A JOB IN IT !! We cannot be as presentable as the other       groups, trying to look as formal and corporate, as if they       are running a Major Corporate Office. However they present       it...password retrieval, online investigation.. access       recovery...blah blah blah..&nbsp; the most simplest way to       put it is.. : Email Password Cracking: !! And since everyone else is busy faking       it, or trying to be more presentable, we utilize our skills       to get you what you want.. i.e. THE EMAIL PASSWORD. No       buttering up, no marketing skills..&nbsp; plain hardcore       hacking !! So, since you now know what we do , and       want us to do the job for you, please proceed to the order       page for your relevant TARGET EMAIL and submit your request.       All said and done, we will get the elusive password &amp; send       you a couple of proofs. You decide upon the authenticity of       the proofs, and let us know if you are comfortable going       ahead with the payment. PAY US, AND YOU GET THE PASSWORD !And as they say.......</i>"<br />
<br />
How much are they charging for the bruteforcing? $150 for starters, which is prone to increase due to their bla bla bla about how sophisticated it was to obtain the password - given they actually manage to deliver the goods :&nbsp; <br />
<br />
<div class="separator" style="text-align: center; clear: both;"><a href="http://3.bp.blogspot.com/_wICHhTiQmrA/SJyWntxCJWI/AAAAAAAACBU/aVdgDf7K46o/s1600-h/hire_to_hack1.png" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img height="160" src="http://3.bp.blogspot.com/_wICHhTiQmrA/SJyWntxCJWI/AAAAAAAACBU/wsy8qQ3XtGQ/s200-R/hire_to_hack1.png" style="border: 0pt none ;" width="200" /></a></div>"<i>Many groups charge a fixed price for an email cracking. We undertake more kinds of projects than anyone else. Frankly, each email is a different project in itself. We cannot charge you $100, for something which we can do for $50. Subsequently, we cannot charge you $100, for something which should be priced at $200. But we charge a minimum of $150 USD so that we end up taking orders from ONLY those who really need it. It is a small amount for the level of satisfaction, facts/truth and relief that you would ultimately achieve from this.It depends upon the nature of the job, the accessibility factor. and many other reasons likes:-<br />
<br />
1- The email service provider<br />
2- The target itself. How net-savvy he/she is.<br />
3- Complexity of the password<br />
4- Urgency of job and many other things collectively.<br />
<br />
We will let you know our charges once we have the desired results only. Be assured, we wont charge you the moon. We charge only what we deserve, and is acceptable by you. Trust us !!</i>"<br />
<br />
Some of their answers to the frequently asked questions :<br />
<br />
" <i>- <b>Who are you? Where are you from</b>?<br />
We are Hire2Hack Group. Member of our group are students in information technology, at some university in England, France, Italy, Japan, Australia, Canada, Brasilia and at United States of America.<br />
<br />
- <b>What services do you provide?</b><br />
We can hack ANY EMAIL password for you very fast, reliable, secure and worldwide for a suitable price.<br />
<br />
- <b>Can you really hack password or just a making a shit scam?</b><br />
Well, lot of people, lot of groups, companies do this service, but not guaranteed. This is only you can choose which group you want to Order. Be careful with these people. You can believe only on them who claims to provide proof before you really pay them.<br />
<br />
- <b>Is there any tool available to crack password?</b><br />
Yes there is. And we are not giving it to you.<br />
<br />
- <b>How long does it takes to crack a password?</b><br />
Each account is different and hacking time vary. On average, it might take about 1 to 3 days, but it may take anywhere from 24 hours to 30 days or more depending on how difficult is the hacking of each account.<br />
<br />
- <b>How can I believe you, that you got password?</b><br />
We will provide you some good proofs before requesting you to pay us. The proof can be anything, you can decide what kind proof you need.<br />
<br />
- <b>Is there person will know that his/her email id has been cracked?</b><br />
No, we provide you only the original password. That mean the current active password. Your victim/target will not realized that she/he has been hacked. NEVER, we said !<br />
<br />
- <b>How I will pay you, I do not have credit card or I do not want to give my credit card number on net?</b><br />
Well, you can use international money transfer service such as Western Union (www.westernunion.com) or Money Gram (www.moneygram.com). These services immediate transfer money on same day or same hour. You can locate their agents in yours area from their website.<br />
<br />
- <b>Do I have to give you my password?</b><br />
No. Any service which requires your password is simply trying to scam you out of access to your account.<br />
<br />
- <b>How will I know you really have the password?</b><br />
We will show you the proofs.. which are mostly convincing.<br />
<br />
- <b>Since you have the password anyway, will you give it to me?</b><br />
NO. Do not waste your time or ours. We will not release the password until full payment is made - no exceptions. We have had people request our service and once we recover the password, they reset the subject account then ask us for the original password so they can reset it back - the answer will be no. We have also had people ask if they could have the password since we've already recovered it and they cannot pay - the answer will be no. No password will be released until payment has been made in full - no exceptions.<br />
<br />
- <b>Will you recover more than one password? Can I request more than one email account?</b><br />
Yes, but a separate request must be filled out for each one as you will only be billed for each successful recovery. If we have previously recovered a password for you and you have not paid, we will not begin any new request for you until your previous request is paid in full with exceptions for our established clientele. We charge at minimum US $100 for each account hacked.<br />
<br />
- <b>Do you reset or change the current password?</b><br />
No. We do not try to guess the current password or the secret question's answer, we do not change their password. We give you only the Original password, which the victim is currently using.<br />
<br />
- <b>Is this confidential? Do you share my information with anyone else</b>?<br />
No, Not at all, Not in any case, its a trust between you and us. Your information will be respected as long as you abide by our Terms and Conditions and Privacy policy. We keep your personal records and requests confidential in our database but we respect your right to privacy and will not rent, share, sell, or trade any personal information unless required by law. <b>But, if you engage in any spamming or fraudulent actives, Your information will be given to the appropriate authorities.</b></i>"<br />
<br />
So you've got script kiddies cracking email addresses and probably engaging in the rest of the usual cybercrime activities, who are spam sensitive, and would expose their customers if they start spamming from the cracked emails? Now that's socially responsible, isn't it.<br />
<br />
Targeted attacks are sexy, but bruteforcing email accounts no matter the number of proxies and wordlists that they have access to is so irrelevant, that social engineering a potential victim into infecting herself with malware through a live exploit URL seems to be the method of choice, next to a plain simple phishing email of course. In this case, what they're asking for in respect to the victim's details is the victim's country and victim's language, so that a localized social engineering or phishing attack can take place. However, this particular group seems to be using a standard bruteforcing tool.<br />
<br />
One thing's for sure - cybercrime is getting easier to outsource, and with potential customers starting to have access to services they didn't a couple of years ago, <a href="http://ddanchev.blogspot.com/2008/08/phishers-backdooring-phishing-pages-to.html">fake scammers are also emerging in between the real ones</a>.<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=Q4SazK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=Q4SazK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=v68SQK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=v68SQK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=fTxCfk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=fTxCfk" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=m5GSCk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=m5GSCk" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=rFpJlK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=rFpJlK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=hDloOK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=hDloOK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=kzNwqk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=kzNwqk" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/359698182" height="1" width="1"/>]]></content:encoded>
      <pubDate>Fri, 08 Aug 2008 10:31:54 +0000</pubDate>
      <category domain="http://securityratty.com/tag/crack password">crack password</category>
      <category domain="http://securityratty.com/tag/crack">crack</category>
      <category domain="http://securityratty.com/tag/crack email password">crack email password</category>
      <category domain="http://securityratty.com/tag/email password">email password</category>
      <category domain="http://securityratty.com/tag/password">password</category>
      <category domain="http://securityratty.com/tag/original password">original password</category>
      <category domain="http://securityratty.com/tag/current password">current password</category>
      <category domain="http://securityratty.com/tag/password retrieval">password retrieval</category>
      <category domain="http://securityratty.com/tag/email">email</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/359698182/email-hacking-going-commercial-part-two.html">Email Hacking Going Commercial - Part Two</source>
    </item>
    <item>
      <title><![CDATA[I guess Dell and HP ran out of Lipstick]]></title>
      <link>http://securityratty.com/article/c2efa74d26b88111256742e68cb6fd45</link>
      <guid>http://securityratty.com/article/c2efa74d26b88111256742e68cb6fd45</guid>
      <description><![CDATA[Gee, ya mean Dell and HP wanna keep their customers? Might be too late


clipped from vista.blorge.com
Microsoft upset over HP, Dell packaging Windows XP over Vista
clipped from vista.blorge.com
...]]></description>
      <content:encoded><![CDATA[<div > Gee, ya mean Dell and HP wanna keep their customers?<br/>Might be too late. </div>
<table cellpadding="0" cellspacing="0" width="100%" style="margin: 12px 0px; font-family: arial; color: #333333; background: #ffffff; border: solid 4px #e5e5e5; width: 100%; clear: left;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" class="CM_CTB_Content_Wrap" style="margin: 0px; padding: 0px;background-color: #ffffff;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" style="border-bottom: solid 1px #dcdcdc; white-space: nowrap; margin-bottom: 8px; background-color: #eeeeee ;background-image: url(http://clipmarks.com/images/source-bg.gif); background-repeat: repeat-x; height: 24px; line-height: 24px; vertical-align: middle; padding-bottom: 4px; color: #666666; font-size: 10px;">
<tr>
<td valign="top"><a href="http://clipmarks.com/clipmark/9CE9D635-24A0-4C52-A8EE-3E7B319E55BC/" title="go to this clipmark"><img src="http://content.clipmarks.com/blog_icon/7eb54fe7-075a-44d1-94af-b06c706c19a9/9CE9D635-24A0-4C52-A8EE-3E7B319E55BC/" alt="" width="19" height="19" border="0" style="vertical-align: middle; margin: 0px 4px; display: inline; border: none; float:none;" /></a>clipped from <a title="http://vista.blorge.com/2008/08/02/microsoft-upset-over-hp-dell-packaging-windows-xp-over-vista/" href="http://vista.blorge.com/2008/08/02/microsoft-upset-over-hp-dell-packaging-windows-xp-over-vista/" style="font-size: 11px;">vista.blorge.com</a></td>
</tr>
</table>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://vista.blorge.com/2008/08/02/microsoft-upset-over-hp-dell-packaging-windows-xp-over-vista/ --><H3><A title="Permanent Link: Microsoft upset over HP, Dell packaging Windows XP over Vista" rel="bookmark" href="http://vista.blorge.com/2008/08/02/microsoft-upset-over-hp-dell-packaging-windows-xp-over-vista/">Microsoft upset over HP, Dell packaging Windows XP over Vista</A></H3></td>
</tr>
</table>
<table cellpadding="0" cellspacing="0" width="100%" style="border-bottom: solid 1px #dcdcdc; white-space: nowrap; margin-bottom: 8px; background-color: #eeeeee ;background-image: url(http://clipmarks.com/images/source-bg.gif); background-repeat: repeat-x; height: 24px; line-height: 24px; vertical-align: middle; padding-bottom: 4px; color: #666666; font-size: 10px;">
<tr>
<td valign="top"><a href="http://clipmarks.com/clipmark/9CE9D635-24A0-4C52-A8EE-3E7B319E55BC/" title="go to this clipmark"><img src="http://content7.clipmarks.com/images/clip-icon.gif" alt="" width="19" height="19" border="0" style="vertical-align: middle; margin: 0px 4px; display: inline; border: none; float:none;" /></a>clipped from <a title="http://vista.blorge.com/2008/08/02/microsoft-upset-over-hp-dell-packaging-windows-xp-over-vista/" href="http://vista.blorge.com/2008/08/02/microsoft-upset-over-hp-dell-packaging-windows-xp-over-vista/" style="font-size: 11px;">vista.blorge.com</a></td>
</tr>
</table>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://vista.blorge.com/2008/08/02/microsoft-upset-over-hp-dell-packaging-windows-xp-over-vista/ --><P><IMG width="150" height="100" align="left" src="http://vista.blorge.com/wp-content/uploads/2008/08/microsoft-upset-over-hp-dell-packaging-windows-xp-over-vista.jpg" alt="Microsoft upset over HP, Dell packaging Windows XP over Vista" /> While Microsoft recently reported it has collectively shipped some 180 million units licensed with Windows Vista, the numbers might not exactly ring true thanks to reports from HP, Dell, and others that say they’ve been opting to ship PCs downgraded to XP instead.? Microsoft’s 180 million units-sold figure is therefore misleading since it includes these units that don’t truly include Vista.</P></td>
</tr>
</table>
</td>
</tr>
</table>
<div style="margin: 0px 6px 6px 4px;">
<table style="font-size: 11px;border-spacing: 0px;padding: 0px;" cellpadding="0" cellspacing="0" width="100%">
<tr>
<td style="background:transparent;border-width:0px;padding:0px;">&nbsp;</td>
<td align="right" style="background:transparent;border-width:0px;padding:0px;width:107px" width="107"><a href="http://clipmarks.com/share/9CE9D635-24A0-4C52-A8EE-3E7B319E55BC/blog/" title="blog or email this clip"><img src="http://content8.clipmarks.com/images/c2b-foot.png" border="0" alt="blog it" width="107" height="17" style="border-width:0px;padding:0px;margin:0px;" /></a></td>
</tr>
</table>
</div>
</td>
</tr>
</table>
]]></content:encoded>
      <pubDate>Sun, 03 Aug 2008 15:10:37 +0000</pubDate>
      <category domain="http://securityratty.com/tag/million units-sold figure">million units-sold figure</category>
      <category domain="http://securityratty.com/tag/units">units</category>
      <category domain="http://securityratty.com/tag/vista">vista</category>
      <category domain="http://securityratty.com/tag/windows vista">windows vista</category>
      <category domain="http://securityratty.com/tag/dell">dell</category>
      <category domain="http://securityratty.com/tag/million units">million units</category>
      <category domain="http://securityratty.com/tag/include vista">include vista</category>
      <category domain="http://securityratty.com/tag/windows">windows</category>
      <category domain="http://securityratty.com/tag/microsoft recently">microsoft recently</category>
      <source url="http://spywarebiz.com/spywarebizblog/?p=530">I guess Dell and HP ran out of Lipstick</source>
    </item>
    <item>
      <title><![CDATA[Anti-Terrorism Stupidity at Yankee Stadium]]></title>
      <link>http://securityratty.com/article/dfb361bbe6338d8abaf924431ba80dfb</link>
      <guid>http://securityratty.com/article/dfb361bbe6338d8abaf924431ba80dfb</guid>
      <description><![CDATA[They's at Yankee Stadium: The team contends that sunscreen has long been on the list of stadium contraband, but there is no mention of it on the Yankee Web site
Four weeks ago, Stadium officials...]]></description>
      <content:encoded><![CDATA[<p>They's <a href="http://www.nypost.com/seven/07222008/news/regionalnews/sunblockheads__at_the_stadium_120930.htm"confiscating sunscreen</a> at Yankee Stadium:</p>

<blockquote>The team contends that sunscreen has long been on the list of stadium contraband, but there is no mention of it on the Yankee Web site. 

<p>Four weeks ago, Stadium officials decided that sunscreen of all sizes and varieties would not be permitted, a security supervisor told The Post before last night's game. </p>

<p>"There have been a lot of complaints," he said. "We tell them to apply once and then throw it out." </p>

<p>For fans who bring babies or young children to cheer on the home team, the guard had suggested they "beg" to take the sunblock in. </p>

<p>Seeing the giant bag full of confiscated sunscreen Saturday, one steaming Yankee fan asked whether he could take one of the tubes and apply it before heading into the park. </p>

<p>"Absolutely not," the guard told him. "What if you get a rash? You might sue the Yankees."</blockquote></p>

<p>Next, I suppose, is <a href="http://www.schneier.com/blog/archives/2008/06/liquid_ban_gone.html">confiscating liquids at pools</a>.  </p>

<p>We've collectively lost our minds.</p>

<p>This story has a happy ending, though.  A day after <i>The New York Post</i> published this story, Yankee Stadium <a href="http://www.salon.com/sports/daily/?last_story=/sports/daily/feature/2008/07/23/sunblock/">reversed</a> its ban.  Now, if only the Post had that same affect on airport security.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=EgeecJ"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=EgeecJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=TjuhOJ"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=TjuhOJ" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Thu, 24 Jul 2008 02:50:24 +0000</pubDate>
      <category domain="http://securityratty.com/tag/yankee stadium">yankee stadium</category>
      <category domain="http://securityratty.com/tag/post">post</category>
      <category domain="http://securityratty.com/tag/york post">york post</category>
      <category domain="http://securityratty.com/tag/yankee web site">yankee web site</category>
      <category domain="http://securityratty.com/tag/giant bag">giant bag</category>
      <category domain="http://securityratty.com/tag/yankee fan">yankee fan</category>
      <category domain="http://securityratty.com/tag/collectively lost">collectively lost</category>
      <category domain="http://securityratty.com/tag/guard">guard</category>
      <category domain="http://securityratty.com/tag/airport security">airport security</category>
      <source url="http://www.schneier.com/blog/archives/2008/07/antiterrorism_s.html">Anti-Terrorism Stupidity at Yankee Stadium</source>
    </item>
    <item>
      <title><![CDATA[Malware Install Hides Behind Fake Blue Screen Of Death]]></title>
      <link>http://securityratty.com/article/b8c8105b310966fe1ed31d74b627f52f</link>
      <guid>http://securityratty.com/article/b8c8105b310966fe1ed31d74b627f52f</guid>
      <description><![CDATA[This hijack typically begins with the following file opened up from the web





If the file is allowed to execute on the PC, depending on what files the bundle is rotating for download at the time of...]]></description>
      <content:encoded><![CDATA[
        This hijack typically begins with the following file opened up from the web:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="sys0.jpg" src="http://blog.spywareguide.com/images/sys0.jpg" class="mt-image-none" style="" height="60" width="149" /></span></div><br /> <div><br />If the file is allowed to execute on the PC, depending on what files the bundle is rotating for download at the time of install you may well see the dreaded <a href="http://en.wikipedia.org/wiki/Blue_Screen_of_Death">Blue Screen Of Death</a> (or BSOD to its friends).<br /><br />However, all is not what it seems. While the end-user is faced with the horrors of the BSOD, behind the scenes Malware is installing by the bucketload.How is this possible, I hear you cry? Surely if the PC has crashed, nothing can be installing?<br /><br />Not in this case, because the blue screen of death is <i>fake</i> - to be more accurate, the bad guys have taken Sysinternals <a href="http://technet.microsoft.com/en-us/sysinternals/bb897558.aspx">blue screen of death screensaver</a> and bundled it in with the hijack files. This is what the .scr file looks like on the PC:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="sys1.jpg" src="http://blog.spywareguide.com/images/sys1.jpg" class="mt-image-none" style="" height="80" width="86" /></span></div><br /><br /></div><div>And this is what you see if you explore the code:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="sys2.jpg" src="http://blog.spywareguide.com/images/sys2.jpg" class="mt-image-none" style="" height="126" width="299" /></span></div><br /></div><div><br />It seems the bad guys are not without a sense of humour. Hiding a blizzard of infection file installs behind a legitimate screensaver created by a security expert is pretty bizarre. Here is the registry entry created:<br /><br /><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="sys6.jpg" src="http://blog.spywareguide.com/images/sys6.jpg" class="mt-image-none" style="" height="35" width="523" /></span><br /><br />Meanwhile, here are just some of the files installed onto the PC during the download:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/sys5.html" onclick="window.open('http://blog.spywareguide.com/images/sys5.html','popup','width=500,height=396,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/sys5-thumb-300x237.jpg" alt="sys5.jpg" class="mt-image-none" style="" height="237" width="300" /></a></span></div><br /></div><div><div align="center">Click to Enlarge<br /></div><br />The PC pretty much grinds to a halt while all of this is taking place:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="sys7.jpg" src="http://blog.spywareguide.com/images/sys7.jpg" class="mt-image-none" style="" height="189" width="357" /></span></div><br /></div><div><br />When the computer finally comes back under your contol, you can expect to see numerous warnings related to fake antispyware programs appearing all over the desktop:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/sys8.html" onclick="window.open('http://blog.spywareguide.com/images/sys8.html','popup','width=610,height=414,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/sys8-thumb-310x210.jpg" alt="sys8.jpg" class="mt-image-none" style="" height="210" width="310" /></a></span><br /></div></div><div><div align="center"><br />Click to Enlarge<br /></div><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/sys9.html" onclick="window.open('http://blog.spywareguide.com/images/sys9.html','popup','width=714,height=543,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/sys9-thumb-314x238.jpg" alt="sys9.jpg" class="mt-image-none" style="" height="238" width="314" /></a></span><br /></div></div><div><div align="center"><br />Click to Enlarge<br /></div><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="sys10.jpg" src="http://blog.spywareguide.com/images/sys10.jpg" class="mt-image-none" style="" height="137" width="383" /></span></div><br /></div><div><br />Collectively, we detect the various bundles on offer here as <a href="http://www.spywareguide.com/product_show.php?id=31505">Fake.AV</a> and <a href="http://www.spywareguide.com/product_show.php?id=31502">Smiddy</a>.<br /><br />Discovery and Research: Chris Mannon, FSL Senior Threat Researcher<br /></div>
        
    ]]></content:encoded>
      <pubDate>Wed, 09 Jul 2008 14:42:24 +0000</pubDate>
      <category domain="http://securityratty.com/tag/fake">fake</category>
      <category domain="http://securityratty.com/tag/death">death</category>
      <category domain="http://securityratty.com/tag/blue">blue</category>
      <category domain="http://securityratty.com/tag/file">file</category>
      <category domain="http://securityratty.com/tag/scr file">scr file</category>
      <category domain="http://securityratty.com/tag/infection file installs">infection file installs</category>
      <category domain="http://securityratty.com/tag/hijack files">hijack files</category>
      <category domain="http://securityratty.com/tag/hijack">hijack</category>
      <category domain="http://securityratty.com/tag/death screensaver">death screensaver</category>
      <source url="http://blog.spywareguide.com/2008/07/malware-install-hides-behind-f.html">Malware Install Hides Behind Fake Blue Screen Of Death</source>
    </item>
    <item>
      <title><![CDATA[ICANN's Announcement Of Anti-Domain Tasting Measures To Registrars]]></title>
      <link>http://securityratty.com/article/913d52903ceaedff758808be4b11d5bf</link>
      <guid>http://securityratty.com/article/913d52903ceaedff758808be4b11d5bf</guid>
      <description><![CDATA[The recent new that ICANN had taken measures to combat Domain Tasting came out in blogs, such as this one , based on second-hand news. ICANN had sent an e-mail to registrars announcing the policy...]]></description>
      <content:encoded><![CDATA[The recent new that ICANN had taken measures to combat Domain Tasting came out in blogs, <a href="http://www.domainnamenews.com/miscellaneous/icann-board-resolution-kills-domain-tasting/1689">such as this one</a>, based on second-hand news. ICANN had sent an e-mail to registrars announcing the policy change. But there was confusion over exactly what the policy was; most people just assumed it followed the recommendations of the GNSO council from April.  The incomplete information caused some confused analysis such as <a href="http://www.cadna.org/en/newsroom/press-releases/icann-tasting-solution">this from CADNA (the Coalition Against Domain Name Abuse)</a>.

I asked ICANN and they sent me the actual e-mail that they sent out to registrars. It is published below. My analysis of it is in <a href="http://www.eweek.com/c/a/Security/Yes-Domain-Tasting-Will-End/">a column on eWEEK</a>.

<blockquote>
Dear Registrar,

This message is intended to explain how certain decisions that were made by the ICANN Board of Directors at its meeting in Paris last week may affect your registrar.

Specifically, the Board adopted GNSO recommendations on domain tasting that included both budget and non-budget provisions designed to restrict the applicability of the Add Grace Period (AGP).  Please note that this message is a summary of changes that affect registrars.  You should refer to the adopted budget document and adopted motions for further information.


Summary of Important Timing Issues

After several months of discussion and public comment on both the budget and the GNSO recommendations, the Board has approved the proposed budget containing a provision for collecting transaction fees above a threshold during the AGP.  Effective 1 July 2008, the registrar-level transaction fee will be collected on transactions, including names added on or after 1 July
2008 and deleted during the Add Grace Period above a certain minimum threshold.  Each "transaction" will continue to be defined as a one-year domain registration increment caused by a successful add, renewal or transfer command, but this year any domain names deleted during the AGP (if
offered)
will be included as transactions if they exceed the maximum of (i) 10% of that registrar's net new registrations in that month (defined as total new registrations less domains deleted during AGP), or (ii) fifty (50) domain names, whichever is greater.  The budget assumes the transaction fee rate will remain at US ./send.20.

The second change prohibits registries from issuing refunds above a similar threshold for names registered and deleted during the AGP (although some registries have made plans to charge for such transactions independent of this motion).  The implementation timing of this change has not been set, but should be expected to take place over a period of some months.  ICANN staff will solicit public comments and post a registrar advisory prior to implementation of this aspect of the GNSO recommendation.


Budget - Registrar Fees Effective 1 July 2008

The Operating Plan and Budget details for 2008-2009 fiscal year can be found at:

http://www.icann.org/en/financials/proposed-opplan-budget-v3-fy09-25jun0
8-en.pdf

Relevant section from the approved budget:

* Registrar-Level Transaction Fees

In FY08 the per transaction-year rate was ./send.20 (or a 5 cent discount from the established ./send.25 rate).  The draft FY09 budget assumes that the ./send.20 rate will continue for registrar transaction fees.  As in past years, each transaction will be defined as one-year domain registration increment caused by a successful add renewal or transfer command.  FY09 revenue is estimated to be .4 million for registrar-level transaction fees.  Each "transaction"
will continue to be defined as a one-year domain registration increment caused by a successful add, renewal or transfer command, but this year any domain names deleted during the AGP (if offered) will be included as transactions if they exceed the maximum of (i) 10% of that registrar's net new registrations in that month (defined as total new registrations less domains deleted during AGP), or (ii) fifty (50) domain names, whichever is greater.  Therefore per-transaction fee will continue to be charged for each one-year increment of every transaction (e.g.  at a ./send.20 fee level, the fee for a three-year renewal will be US ./send.60), and registrars will continue to have the option to "defer" payment of the fees for the years beyond one for each transaction.  n

Note, as in previous years, ICANN can collect such fees directly from the registrars only if they are "expressly approved by registrars who account, in the aggregate, for payment of two-thirds of all registrar-level fees collected by ICANN." ICANN will shortly undertake the process of requesting such approval for the 2008-09 fiscal year.  While ICANN is grateful for consistent approval by registrars of fee levels in prior years, and is optimistic about such approval this year, if for some reason the necessary approval is not achieved, the fees will be collected by ICANN, as permitted under the registry agreements through the registries.  (Note that the amount of such fees varies by registry, but in no case exceeds US ./send.25.) Registries will then be able to collect those payments from registrars to the extent permitted under the relevant contracts.  It is expected that the same transaction increments (including AGP) will be covered, whether collected directly by ICANN or in! directly by the registries, so registrars should anticipate this liability under either scenario.


ICANN Board Resolution

Whereas, ICANN community stakeholders are increasingly concerned about domain tasting, which is the practice of using the add grace period (AGP) to register domain names in bulk in order to test their profitability.

Whereas, on 17 April 2008, the GNSO Council approved, by a Supermajority vote, a motion to prohibit any gTLD operator that has implemented an AGP from offering a refund for any domain name deleted during the AGP that exceeds 10% of its net new registrations in that month, or fifty domain names, whichever is greater.  <http://gnso.icann.org/meetings/minutes-gnso-17apr08.shtml>

Whereas, on 25 April 2008, the GNSO Council forwarded its formal "Report to the ICANN Board - Recommendation for Domain Tasting"
<http://gnso.icann.org/issues/domain-tasting/domain-tasting-board-report
-gnso-council-25apr08.pdf>,
which outlines the full text of the motion and the full context and procedural history of this proceeding.

Whereas, the Board is also considering the Proposed FY 09 Operating Plan and Budget <http://www.icann.org/financials/fiscal-30jun09.htm>, which includes (at the encouragement of the GNSO Council) a proposal similar to the GNSO policy recommendation to expand the applicability of the ICANN transaction fee in order to limit domain tasting.

Resolved (2008.06.26.06), the Board adopts the GNSO policy recommendation on domain tasting, and directs staff to implement the policy following appropriate comment and notice periods on the implementation documents.


Domain tasting motion approved by the GNSO Council 17 April 2008

<http://gnso.icann.org/issues/domain-tasting/domain-tasting-board-report
-gnso-council-25apr08.pdf>

Whereas, the GNSO Council has discussed the Issues Report on Domain Tasting and the Final Outcomes Report of the ad hoc group on Domain Tasting;

Whereas, the GNSO Council resolved on 31 October 2007 to launch a PDP on Domain Tasting;

Whereas, the GNSO Council authorized on 17 January 2008 the formation of a small design team to develop a plan for the deliberations on the Domain Tasting PDP (the "Design Team"), the principal volunteers to which had been members of the Ad Hoc Group on Domain Tasting and were well-informed of both the Final Outcomes Report of the Ad Hoc Group on Domain Tasting and the GNSO Initial Report on Domain Tasting (collectively with the Issues Report, the "Reports on Domain Tasting");

Whereas, the GNSO Council has received the Draft Final Report on Domain Tasting;

Whereas, PIR, the .org registry operator, has amended its Registry Agreement to charge an Excess Deletion Fee; and both NeuStar, the .biz registry operator, and Afilias, the .info registry operator, are seeking amendments to their respective Registry Agreements to modify the existing AGP;

The GNSO Council recommends to the ICANN Board of Directors that:

1.  The applicability of the Add Grace Period shall be restricted for any gTLD which has implemented an AGP ("Applicable gTLD Operator").
Specifically, for each Applicable gTLD Operator:

  a.  During any given month, an Applicable gTLD Operator may not offer any
  refund to a registrar for any domain names deleted during the AGP that
  exceed (i) 10% of that registrar's net new registrations in that month
  (defined as total new registrations less domains deleted during AGP), or
  (ii) fifty (50) domain names, whichever is greater.

  b.  A Registrar may seek an exemption from the application of such
  restriction in a specific month, upon the documented showing of
  extraordinary circumstances.  For any Registrar requesting such an
  exemption, the Registrar must confirm in writing to the Registry Operator
  how, at the time the names were deleted, these extraordinary circumstances
  were not known, reasonably could not have been known, and were outside of
  the Registrar's control.  Acceptance of any exemption will be at the sole
  reasonable discretion of the Registry Operator, however "extraordinary
  circumstances" which reoccur regularly will not be deemed extraordinary.

  c.  In addition to all other reporting requirements to ICANN, each
  Applicable gTLD Operator shall identify each Registrar that has sought an
  exemption, along with a brief descriptive identification of the type of
  extraordinary circumstance and the action (if any) that was taken by the
  Applicable gTLD Operator.

2.  Implementation and execution of these recommendations shall be monitored by the GNSO.  Specifically;

  a.  ICANN Staff shall analyze and report to the GNSO at six month intervals
  for two years after implementation, until such time as the GNSO resolves
  otherwise, with the goal of determining;

    i.  How effectively and to what extent the policies have been implemented
    and followed by Registries and Registrars, and

    ii.  Whether or not modifications to these policies should be considered
    by the GNSO as a result of the experiences gained during the
    implementation and monitoring stages,

  b.  The purpose of these monitoring and reporting requirements are to allow
  the GNSO to determine when, if ever, these recommendations and any ensuing
  policy require additional clarification or attention based on the results
  of the reports prepared by ICANN Staff.

</blockquote>

<br style="clear: both;"/>
  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=152f487f101abbcdd9c900fc3eb46268" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=152f487f101abbcdd9c900fc3eb46268" style="display: none;" border="0" height="1" width="1" alt=""/><img src="http://feeds.ziffdavisenterprise.com/~r/RSS/cheap_hack/~4/330098895" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 08 Jul 2008 11:42:32 +0000</pubDate>
      <category domain="http://securityratty.com/tag/icann">icann</category>
      <category domain="http://securityratty.com/tag/directly">directly</category>
      <category domain="http://securityratty.com/tag/fees directly">fees directly</category>
      <category domain="http://securityratty.com/tag/fees">fees</category>
      <category domain="http://securityratty.com/tag/registrar fees effective">registrar fees effective</category>
      <category domain="http://securityratty.com/tag/effective">effective</category>
      <category domain="http://securityratty.com/tag/registrar-level fees">registrar-level fees</category>
      <category domain="http://securityratty.com/tag/fee">fee</category>
      <category domain="http://securityratty.com/tag/per-transaction fee">per-transaction fee</category>
      <source url="http://feeds.ziffdavisenterprise.com/~r/RSS/cheap_hack/~3/330098895/ch_icanns_announcement_of_antidomain_tasting_measures_to_registrars.html">ICANN's Announcement Of Anti-Domain Tasting Measures To Registrars</source>
    </item>
    <item>
      <title><![CDATA[ICANN's Announcement Of Anti-Domain Tasting Measures To Registrars]]></title>
      <link>http://securityratty.com/article/1438af7a2605c2bbe5326444d5bd9d27</link>
      <guid>http://securityratty.com/article/1438af7a2605c2bbe5326444d5bd9d27</guid>
      <description><![CDATA[The recent new that ICANN had taken measures to combat Domain Tasting came out in blogs, such as this one , based on second-hand news. ICANN had sent an e-mail to registrars announcing the policy...]]></description>
      <content:encoded><![CDATA[The recent new that ICANN had taken measures to combat Domain Tasting came out in blogs, <a href="http://www.domainnamenews.com/miscellaneous/icann-board-resolution-kills-domain-tasting/1689">such as this one</a>, based on second-hand news. ICANN had sent an e-mail to registrars announcing the policy change. But there was confusion over exactly what the policy was; most people just assumed it followed the recommendations of the GNSO council from April.  The incomplete information caused some confused analysis such as <a href="http://www.cadna.org/en/newsroom/press-releases/icann-tasting-solution">this from CADNA (the Coalition Against Domain Name Abuse)</a>.

I asked ICANN and they sent me the actual e-mail that they sent out to registrars. It is published below. My analysis of it is in <a href="http://www.eweek.com/c/a/Security/Yes-Domain-Tasting-Will-End/">a column on eWEEK</a>.

<blockquote>
Dear Registrar,

This message is intended to explain how certain decisions that were made by the ICANN Board of Directors at its meeting in Paris last week may affect your registrar.

Specifically, the Board adopted GNSO recommendations on domain tasting that included both budget and non-budget provisions designed to restrict the applicability of the Add Grace Period (AGP).  Please note that this message is a summary of changes that affect registrars.  You should refer to the adopted budget document and adopted motions for further information.


Summary of Important Timing Issues

After several months of discussion and public comment on both the budget and the GNSO recommendations, the Board has approved the proposed budget containing a provision for collecting transaction fees above a threshold during the AGP.  Effective 1 July 2008, the registrar-level transaction fee will be collected on transactions, including names added on or after 1 July
2008 and deleted during the Add Grace Period above a certain minimum threshold.  Each "transaction" will continue to be defined as a one-year domain registration increment caused by a successful add, renewal or transfer command, but this year any domain names deleted during the AGP (if
offered)
will be included as transactions if they exceed the maximum of (i) 10% of that registrar's net new registrations in that month (defined as total new registrations less domains deleted during AGP), or (ii) fifty (50) domain names, whichever is greater.  The budget assumes the transaction fee rate will remain at US ./send.20.

The second change prohibits registries from issuing refunds above a similar threshold for names registered and deleted during the AGP (although some registries have made plans to charge for such transactions independent of this motion).  The implementation timing of this change has not been set, but should be expected to take place over a period of some months.  ICANN staff will solicit public comments and post a registrar advisory prior to implementation of this aspect of the GNSO recommendation.


Budget - Registrar Fees Effective 1 July 2008

The Operating Plan and Budget details for 2008-2009 fiscal year can be found at:

http://www.icann.org/en/financials/proposed-opplan-budget-v3-fy09-25jun0
8-en.pdf

Relevant section from the approved budget:

* Registrar-Level Transaction Fees

In FY08 the per transaction-year rate was ./send.20 (or a 5 cent discount from the established ./send.25 rate).  The draft FY09 budget assumes that the ./send.20 rate will continue for registrar transaction fees.  As in past years, each transaction will be defined as one-year domain registration increment caused by a successful add renewal or transfer command.  FY09 revenue is estimated to be .4 million for registrar-level transaction fees.  Each "transaction"
will continue to be defined as a one-year domain registration increment caused by a successful add, renewal or transfer command, but this year any domain names deleted during the AGP (if offered) will be included as transactions if they exceed the maximum of (i) 10% of that registrar's net new registrations in that month (defined as total new registrations less domains deleted during AGP), or (ii) fifty (50) domain names, whichever is greater.  Therefore per-transaction fee will continue to be charged for each one-year increment of every transaction (e.g.  at a ./send.20 fee level, the fee for a three-year renewal will be US ./send.60), and registrars will continue to have the option to "defer" payment of the fees for the years beyond one for each transaction.  n

Note, as in previous years, ICANN can collect such fees directly from the registrars only if they are "expressly approved by registrars who account, in the aggregate, for payment of two-thirds of all registrar-level fees collected by ICANN." ICANN will shortly undertake the process of requesting such approval for the 2008-09 fiscal year.  While ICANN is grateful for consistent approval by registrars of fee levels in prior years, and is optimistic about such approval this year, if for some reason the necessary approval is not achieved, the fees will be collected by ICANN, as permitted under the registry agreements through the registries.  (Note that the amount of such fees varies by registry, but in no case exceeds US ./send.25.) Registries will then be able to collect those payments from registrars to the extent permitted under the relevant contracts.  It is expected that the same transaction increments (including AGP) will be covered, whether collected directly by ICANN or in! directly by the registries, so registrars should anticipate this liability under either scenario.


ICANN Board Resolution

Whereas, ICANN community stakeholders are increasingly concerned about domain tasting, which is the practice of using the add grace period (AGP) to register domain names in bulk in order to test their profitability.

Whereas, on 17 April 2008, the GNSO Council approved, by a Supermajority vote, a motion to prohibit any gTLD operator that has implemented an AGP from offering a refund for any domain name deleted during the AGP that exceeds 10% of its net new registrations in that month, or fifty domain names, whichever is greater.  <http://gnso.icann.org/meetings/minutes-gnso-17apr08.shtml>

Whereas, on 25 April 2008, the GNSO Council forwarded its formal "Report to the ICANN Board - Recommendation for Domain Tasting"
<http://gnso.icann.org/issues/domain-tasting/domain-tasting-board-report
-gnso-council-25apr08.pdf>,
which outlines the full text of the motion and the full context and procedural history of this proceeding.

Whereas, the Board is also considering the Proposed FY 09 Operating Plan and Budget <http://www.icann.org/financials/fiscal-30jun09.htm>, which includes (at the encouragement of the GNSO Council) a proposal similar to the GNSO policy recommendation to expand the applicability of the ICANN transaction fee in order to limit domain tasting.

Resolved (2008.06.26.06), the Board adopts the GNSO policy recommendation on domain tasting, and directs staff to implement the policy following appropriate comment and notice periods on the implementation documents.


Domain tasting motion approved by the GNSO Council 17 April 2008

<http://gnso.icann.org/issues/domain-tasting/domain-tasting-board-report
-gnso-council-25apr08.pdf>

Whereas, the GNSO Council has discussed the Issues Report on Domain Tasting and the Final Outcomes Report of the ad hoc group on Domain Tasting;

Whereas, the GNSO Council resolved on 31 October 2007 to launch a PDP on Domain Tasting;

Whereas, the GNSO Council authorized on 17 January 2008 the formation of a small design team to develop a plan for the deliberations on the Domain Tasting PDP (the "Design Team"), the principal volunteers to which had been members of the Ad Hoc Group on Domain Tasting and were well-informed of both the Final Outcomes Report of the Ad Hoc Group on Domain Tasting and the GNSO Initial Report on Domain Tasting (collectively with the Issues Report, the "Reports on Domain Tasting");

Whereas, the GNSO Council has received the Draft Final Report on Domain Tasting;

Whereas, PIR, the .org registry operator, has amended its Registry Agreement to charge an Excess Deletion Fee; and both NeuStar, the .biz registry operator, and Afilias, the .info registry operator, are seeking amendments to their respective Registry Agreements to modify the existing AGP;

The GNSO Council recommends to the ICANN Board of Directors that:

1.  The applicability of the Add Grace Period shall be restricted for any gTLD which has implemented an AGP ("Applicable gTLD Operator").
Specifically, for each Applicable gTLD Operator:

  a.  During any given month, an Applicable gTLD Operator may not offer any
  refund to a registrar for any domain names deleted during the AGP that
  exceed (i) 10% of that registrar's net new registrations in that month
  (defined as total new registrations less domains deleted during AGP), or
  (ii) fifty (50) domain names, whichever is greater.

  b.  A Registrar may seek an exemption from the application of such
  restriction in a specific month, upon the documented showing of
  extraordinary circumstances.  For any Registrar requesting such an
  exemption, the Registrar must confirm in writing to the Registry Operator
  how, at the time the names were deleted, these extraordinary circumstances
  were not known, reasonably could not have been known, and were outside of
  the Registrar's control.  Acceptance of any exemption will be at the sole
  reasonable discretion of the Registry Operator, however "extraordinary
  circumstances" which reoccur regularly will not be deemed extraordinary.

  c.  In addition to all other reporting requirements to ICANN, each
  Applicable gTLD Operator shall identify each Registrar that has sought an
  exemption, along with a brief descriptive identification of the type of
  extraordinary circumstance and the action (if any) that was taken by the
  Applicable gTLD Operator.

2.  Implementation and execution of these recommendations shall be monitored by the GNSO.  Specifically;

  a.  ICANN Staff shall analyze and report to the GNSO at six month intervals
  for two years after implementation, until such time as the GNSO resolves
  otherwise, with the goal of determining;

    i.  How effectively and to what extent the policies have been implemented
    and followed by Registries and Registrars, and

    ii.  Whether or not modifications to these policies should be considered
    by the GNSO as a result of the experiences gained during the
    implementation and monitoring stages,

  b.  The purpose of these monitoring and reporting requirements are to allow
  the GNSO to determine when, if ever, these recommendations and any ensuing
  policy require additional clarification or attention based on the results
  of the reports prepared by ICANN Staff.

</blockquote>

<br style="clear: both;"/>
      <a href="http://www.pheedo.com/click.phdo?s=8eea0eb864e902bc67c9b814b1af0256"><img alt="" style="border: 0;" border="0" src="http://www.pheedo.com/img.phdo?s=8eea0eb864e902bc67c9b814b1af0256"/></a>
  <img src="http://www.pheedo.com/feeds/tracker.php?i=8eea0eb864e902bc67c9b814b1af0256" style="display: none;" border="0" height="1" width="1" alt=""/><img src="http://feeds.ziffdavisenterprise.com/~r/RSS/cheap_hack/~4/338277687" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 08 Jul 2008 11:42:32 +0000</pubDate>
      <category domain="http://securityratty.com/tag/icann">icann</category>
      <category domain="http://securityratty.com/tag/directly">directly</category>
      <category domain="http://securityratty.com/tag/fees directly">fees directly</category>
      <category domain="http://securityratty.com/tag/fees">fees</category>
      <category domain="http://securityratty.com/tag/registrar fees effective">registrar fees effective</category>
      <category domain="http://securityratty.com/tag/effective">effective</category>
      <category domain="http://securityratty.com/tag/registrar-level fees">registrar-level fees</category>
      <category domain="http://securityratty.com/tag/fee">fee</category>
      <category domain="http://securityratty.com/tag/per-transaction fee">per-transaction fee</category>
      <source url="http://feeds.ziffdavisenterprise.com/~r/RSS/cheap_hack/~3/338277687/ch_icanns_announcement_of_antidomain_tasting_measures_to_registrars.html">ICANN's Announcement Of Anti-Domain Tasting Measures To Registrars</source>
    </item>
    <item>
      <title><![CDATA[ICANN's Announcement Of Anti-Domain Tasting Measures To Registrars]]></title>
      <link>http://securityratty.com/article/266456c2c42bc5e4cf836f3ca19af1c2</link>
      <guid>http://securityratty.com/article/266456c2c42bc5e4cf836f3ca19af1c2</guid>
      <description><![CDATA[The recent new that ICANN had taken measures to combat Domain Tasting came out in blogs, such as this one , based on second-hand news. ICANN had sent an e-mail to registrars announcing the policy...]]></description>
      <content:encoded><![CDATA[The recent new that ICANN had taken measures to combat Domain Tasting came out in blogs, <a href="http://www.domainnamenews.com/miscellaneous/icann-board-resolution-kills-domain-tasting/1689">such as this one</a>, based on second-hand news. ICANN had sent an e-mail to registrars announcing the policy change. But there was confusion over exactly what the policy was; most people just assumed it followed the recommendations of the GNSO council from April.  The incomplete information caused some confused analysis such as <a href="http://www.cadna.org/en/newsroom/press-releases/icann-tasting-solution">this from CADNA (the Coalition Against Domain Name Abuse)</a>.

I asked ICANN and they sent me the actual e-mail that they sent out to registrars. It is published below. My analysis of it is in <a href="http://www.eweek.com/c/a/Security/Yes-Domain-Tasting-Will-End/">a column on eWEEK</a>.

<blockquote>
Dear Registrar,

This message is intended to explain how certain decisions that were made by the ICANN Board of Directors at its meeting in Paris last week may affect your registrar.

Specifically, the Board adopted GNSO recommendations on domain tasting that included both budget and non-budget provisions designed to restrict the applicability of the Add Grace Period (AGP).  Please note that this message is a summary of changes that affect registrars.  You should refer to the adopted budget document and adopted motions for further information.


Summary of Important Timing Issues

After several months of discussion and public comment on both the budget and the GNSO recommendations, the Board has approved the proposed budget containing a provision for collecting transaction fees above a threshold during the AGP.  Effective 1 July 2008, the registrar-level transaction fee will be collected on transactions, including names added on or after 1 July
2008 and deleted during the Add Grace Period above a certain minimum threshold.  Each "transaction" will continue to be defined as a one-year domain registration increment caused by a successful add, renewal or transfer command, but this year any domain names deleted during the AGP (if
offered)
will be included as transactions if they exceed the maximum of (i) 10% of that registrar's net new registrations in that month (defined as total new registrations less domains deleted during AGP), or (ii) fifty (50) domain names, whichever is greater.  The budget assumes the transaction fee rate will remain at US ./send.20.

The second change prohibits registries from issuing refunds above a similar threshold for names registered and deleted during the AGP (although some registries have made plans to charge for such transactions independent of this motion).  The implementation timing of this change has not been set, but should be expected to take place over a period of some months.  ICANN staff will solicit public comments and post a registrar advisory prior to implementation of this aspect of the GNSO recommendation.


Budget - Registrar Fees Effective 1 July 2008

The Operating Plan and Budget details for 2008-2009 fiscal year can be found at:

http://www.icann.org/en/financials/proposed-opplan-budget-v3-fy09-25jun0
8-en.pdf

Relevant section from the approved budget:

* Registrar-Level Transaction Fees

In FY08 the per transaction-year rate was ./send.20 (or a 5 cent discount from the established ./send.25 rate).  The draft FY09 budget assumes that the ./send.20 rate will continue for registrar transaction fees.  As in past years, each transaction will be defined as one-year domain registration increment caused by a successful add renewal or transfer command.  FY09 revenue is estimated to be .4 million for registrar-level transaction fees.  Each "transaction"
will continue to be defined as a one-year domain registration increment caused by a successful add, renewal or transfer command, but this year any domain names deleted during the AGP (if offered) will be included as transactions if they exceed the maximum of (i) 10% of that registrar's net new registrations in that month (defined as total new registrations less domains deleted during AGP), or (ii) fifty (50) domain names, whichever is greater.  Therefore per-transaction fee will continue to be charged for each one-year increment of every transaction (e.g.  at a ./send.20 fee level, the fee for a three-year renewal will be US ./send.60), and registrars will continue to have the option to "defer" payment of the fees for the years beyond one for each transaction.  n

Note, as in previous years, ICANN can collect such fees directly from the registrars only if they are "expressly approved by registrars who account, in the aggregate, for payment of two-thirds of all registrar-level fees collected by ICANN." ICANN will shortly undertake the process of requesting such approval for the 2008-09 fiscal year.  While ICANN is grateful for consistent approval by registrars of fee levels in prior years, and is optimistic about such approval this year, if for some reason the necessary approval is not achieved, the fees will be collected by ICANN, as permitted under the registry agreements through the registries.  (Note that the amount of such fees varies by registry, but in no case exceeds US ./send.25.) Registries will then be able to collect those payments from registrars to the extent permitted under the relevant contracts.  It is expected that the same transaction increments (including AGP) will be covered, whether collected directly by ICANN or in! directly by the registries, so registrars should anticipate this liability under either scenario.


ICANN Board Resolution

Whereas, ICANN community stakeholders are increasingly concerned about domain tasting, which is the practice of using the add grace period (AGP) to register domain names in bulk in order to test their profitability.

Whereas, on 17 April 2008, the GNSO Council approved, by a Supermajority vote, a motion to prohibit any gTLD operator that has implemented an AGP from offering a refund for any domain name deleted during the AGP that exceeds 10% of its net new registrations in that month, or fifty domain names, whichever is greater.  <http://gnso.icann.org/meetings/minutes-gnso-17apr08.shtml>

Whereas, on 25 April 2008, the GNSO Council forwarded its formal "Report to the ICANN Board - Recommendation for Domain Tasting"
<http://gnso.icann.org/issues/domain-tasting/domain-tasting-board-report
-gnso-council-25apr08.pdf>,
which outlines the full text of the motion and the full context and procedural history of this proceeding.

Whereas, the Board is also considering the Proposed FY 09 Operating Plan and Budget <http://www.icann.org/financials/fiscal-30jun09.htm>, which includes (at the encouragement of the GNSO Council) a proposal similar to the GNSO policy recommendation to expand the applicability of the ICANN transaction fee in order to limit domain tasting.

Resolved (2008.06.26.06), the Board adopts the GNSO policy recommendation on domain tasting, and directs staff to implement the policy following appropriate comment and notice periods on the implementation documents.


Domain tasting motion approved by the GNSO Council 17 April 2008

<http://gnso.icann.org/issues/domain-tasting/domain-tasting-board-report
-gnso-council-25apr08.pdf>

Whereas, the GNSO Council has discussed the Issues Report on Domain Tasting and the Final Outcomes Report of the ad hoc group on Domain Tasting;

Whereas, the GNSO Council resolved on 31 October 2007 to launch a PDP on Domain Tasting;

Whereas, the GNSO Council authorized on 17 January 2008 the formation of a small design team to develop a plan for the deliberations on the Domain Tasting PDP (the "Design Team"), the principal volunteers to which had been members of the Ad Hoc Group on Domain Tasting and were well-informed of both the Final Outcomes Report of the Ad Hoc Group on Domain Tasting and the GNSO Initial Report on Domain Tasting (collectively with the Issues Report, the "Reports on Domain Tasting");

Whereas, the GNSO Council has received the Draft Final Report on Domain Tasting;

Whereas, PIR, the .org registry operator, has amended its Registry Agreement to charge an Excess Deletion Fee; and both NeuStar, the .biz registry operator, and Afilias, the .info registry operator, are seeking amendments to their respective Registry Agreements to modify the existing AGP;

The GNSO Council recommends to the ICANN Board of Directors that:

1.  The applicability of the Add Grace Period shall be restricted for any gTLD which has implemented an AGP ("Applicable gTLD Operator").
Specifically, for each Applicable gTLD Operator:

  a.  During any given month, an Applicable gTLD Operator may not offer any
  refund to a registrar for any domain names deleted during the AGP that
  exceed (i) 10% of that registrar's net new registrations in that month
  (defined as total new registrations less domains deleted during AGP), or
  (ii) fifty (50) domain names, whichever is greater.

  b.  A Registrar may seek an exemption from the application of such
  restriction in a specific month, upon the documented showing of
  extraordinary circumstances.  For any Registrar requesting such an
  exemption, the Registrar must confirm in writing to the Registry Operator
  how, at the time the names were deleted, these extraordinary circumstances
  were not known, reasonably could not have been known, and were outside of
  the Registrar's control.  Acceptance of any exemption will be at the sole
  reasonable discretion of the Registry Operator, however "extraordinary
  circumstances" which reoccur regularly will not be deemed extraordinary.

  c.  In addition to all other reporting requirements to ICANN, each
  Applicable gTLD Operator shall identify each Registrar that has sought an
  exemption, along with a brief descriptive identification of the type of
  extraordinary circumstance and the action (if any) that was taken by the
  Applicable gTLD Operator.

2.  Implementation and execution of these recommendations shall be monitored by the GNSO.  Specifically;

  a.  ICANN Staff shall analyze and report to the GNSO at six month intervals
  for two years after implementation, until such time as the GNSO resolves
  otherwise, with the goal of determining;

    i.  How effectively and to what extent the policies have been implemented
    and followed by Registries and Registrars, and

    ii.  Whether or not modifications to these policies should be considered
    by the GNSO as a result of the experiences gained during the
    implementation and monitoring stages,

  b.  The purpose of these monitoring and reporting requirements are to allow
  the GNSO to determine when, if ever, these recommendations and any ensuing
  policy require additional clarification or attention based on the results
  of the reports prepared by ICANN Staff.

</blockquote><img src="http://feedproxy.google.com/~r/RSS/cheap_hack/~4/xJKws7q3qKE" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 08 Jul 2008 11:42:32 +0000</pubDate>
      <category domain="http://securityratty.com/tag/icann">icann</category>
      <category domain="http://securityratty.com/tag/directly">directly</category>
      <category domain="http://securityratty.com/tag/fees directly">fees directly</category>
      <category domain="http://securityratty.com/tag/fees">fees</category>
      <category domain="http://securityratty.com/tag/registrar fees effective">registrar fees effective</category>
      <category domain="http://securityratty.com/tag/effective">effective</category>
      <category domain="http://securityratty.com/tag/registrar-level fees">registrar-level fees</category>
      <category domain="http://securityratty.com/tag/fee">fee</category>
      <category domain="http://securityratty.com/tag/per-transaction fee">per-transaction fee</category>
      <source url="http://feeds.ziffdavisenterprise.com/~r/RSS/cheap_hack/~3/xJKws7q3qKE/ch_icanns_announcement_of_antidomain_tasting_measures_to_registrars.html">ICANN's Announcement Of Anti-Domain Tasting Measures To Registrars</source>
    </item>
    <item>
      <title><![CDATA[Tripwire Releases VMWare Security Tool]]></title>
      <link>http://securityratty.com/article/73d5ab94312011fcafc4ec857ae5688d</link>
      <guid>http://securityratty.com/article/73d5ab94312011fcafc4ec857ae5688d</guid>
      <description><![CDATA[I received an email from the folks over at Tripwire today. They have released a tool that can be used to check the security on VMWare configs. I havent got the time to review this one so Ill leave to...]]></description>
      <content:encoded><![CDATA[<p>I received an email from the folks over at Tripwire today. They have released a tool that can be used to check the security on VMWare configs. I haven&#8217;t got the time to review this one so I&#8217;ll leave to you the good readership to arrive at your own conclusions.</p>
<p>From Tripwire:</p>
<blockquote><p>Tripwire® ConfigCheckTM is a free utility that rapidly assesses the security of VMware ESX 3.5 hypervisor configurations compared to the VMware Infrastructure 3 Security Hardening guidelines. Developed by Tripwire in cooperation with VMware, Tripwire ConfigCheck ensures ESX environments are properly configured—offering immediate insight into unintentional vulnerabilities in virtual environments—and provides the necessary steps towards full remediation when they are not. </p></blockquote>
<p>And the best part? It&#8217;s free. </p>
<p>Now it would be nice if more vendors would take a hint and release free tools from time to time to help us get our job done. It would leave us collectively better disposed to them and their product portfolios in the long run. </p>
<p><a href="http://www.tripwire.com/configcheck/index.cfm?djinn=DEM20080408-1&amp;elq=5DFC1481C9224C59AA9A6E4E67273D22">Article Link</a></p>

<p><a href="http://feeds.feedburner.com/~a/Liquidmatrix?a=jiH0rB"><img src="http://feeds.feedburner.com/~a/Liquidmatrix?i=jiH0rB" border="0"></img></a></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=Qg8D2I"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=Qg8D2I" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=LIH3Ei"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=LIH3Ei" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=6JgLUi"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=6JgLUi" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=xVfz2i"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=xVfz2i" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=YwFLoi"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=YwFLoi" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/Liquidmatrix/~4/305764895" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 05 Jun 2008 22:59:46 +0000</pubDate>
      <category domain="http://securityratty.com/tag/vmware">vmware</category>
      <category domain="http://securityratty.com/tag/tripwire">tripwire</category>
      <category domain="http://securityratty.com/tag/vmware esx">vmware esx</category>
      <category domain="http://securityratty.com/tag/release free tools">release free tools</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/free">free</category>
      <category domain="http://securityratty.com/tag/tripwire configchecktm">tripwire configchecktm</category>
      <category domain="http://securityratty.com/tag/vmware infrastructure">vmware infrastructure</category>
      <category domain="http://securityratty.com/tag/free utility">free utility</category>
      <source url="http://feeds.feedburner.com/~r/Liquidmatrix/~3/305764895/">Tripwire Releases VMWare Security Tool</source>
    </item>
    <item>
      <title><![CDATA[Murder, His Hard Drive Wrote]]></title>
      <link>http://securityratty.com/article/db0b50998359044581b87fba27753f72</link>
      <guid>http://securityratty.com/article/db0b50998359044581b87fba27753f72</guid>
      <description><![CDATA[SAN DIEGO -- Forget everything you've seen on CSI . In the information age, crime scene forensics are beginning to take a back seat to the science of recovering and sifting through evidence hidden on...]]></description>
      <content:encoded><![CDATA[<p>SAN DIEGO -- Forget everything you've seen on <cite>CSI</cite>. In the information age, crime scene forensics are beginning to take a back seat to the science of recovering and sifting through evidence hidden on computers, cellphones and thumb drives.
</p>

<p>
Nowhere is that shift clearer than at the FBI's Regional Forensic Computer Lab here, which once lifted traces of incriminating Google searches from a suspect's hard drive to help convict him of murder. This week the lab became the sixth computer forensic lab in the nation to be accredited by the American Society of Crime Laboratory Directors, in another sign that computer forensics is no longer just about investigating hacker attacks.
</p>

<p>
"We've found video of gangsters rapping a song about a murder they committed," RCFL examiner John Leamons says. 
</p>

<p>
The growth of law enforcement computer labs is an indication of how technology is increasingly involved in, or on the periphery of, criminal activity. San Diego-area law enforcement agencies founded the first regional forensic lab in 1998; there are now 14 such labs in the United States, with two more coming online this year. Last year the labs collectively performed more than 13,000 forensics examinations. The San Diego lab alone handled more than 1,000 requests from 40 law enforcement agencies in 2007, including 171 child pornography cases and 160 murder investigations.
</p>

<p>
In its early days, the RFCL examiners not only recovered the data, they analyzed it for evidentiary value based on the particulars of the case. But with exponentially growing data and caseloads, the 22 examiners here now focus on collecting and preserving data in a manner that will hold up in court, then hand that data back to the police agency for analysis.
</p>

<p>
Not surprisingly, the most valuable information comes from the files that suspects thought they had deleted, but which remained hidden in the nooks and crannies of their hard drives.  "The key to computer forensics is unallocated space," says Leamons, who is on loan to the lab from the San Diego Police Department.
</p>

<p>
No one can remember a case being kicked because the lab made an error, but they can remember cases where they found evidence that exonerated people charged with crimes, Leamons says.
</p>

<p>
Cellphones pose a particular challenge, says Rebecca Adimari, one of the five examiners who work on them.
</p>

<p>
"Each has its own operating system and frequency -- there's probably over 500 makes and models and not many of them are the same," she explains. "There can be so much evidence on there."
</p>

<p>
From the unique ringtone caught on camera during a holdup -- to the accidentally recorded conversations on voice notes, to the Israeli thug keeping notes of extortion visits on his PDA -- the way people use their phones can be pretty incriminating.
</p>

<p>
"When they arrested the Arellano Felix people (a gang of Mexican drug lords later convicted of murder and drug crimes in 2007), they recovered 14 phones including one with a photo of a machine gun," Adimari says. 
</p>

<p>
She has hundreds of power and data cables, since they're all peculiar to individual phones. And she has a special box that blocks signals on the phones in the lab, so no information is lost or compromised.
</p>

<p>
Examiner Patrick Lim, from the Naval Criminal Investigative Services, says he recently recovered data from a hard drive that had been burnt to a crisp. Asked if it was from an arson or a murder, Lim says he can't reveal the details. 
</p>
<p>
"It was burned. That's all I can say."
</p><br style="clear: both;"/>
  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=96146f8394e7225b46e8937381049603" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=96146f8394e7225b46e8937381049603" style="display: none;" border="0" height="1" width="1" alt=""/><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=VQMjsH"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=VQMjsH" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=yOzuRh"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=yOzuRh" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=genN8h"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=genN8h" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=tEZQpH"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=tEZQpH" border="0"></img></a>
 <a href="http://feeds.wired.com/~f/wired/politics/security?a=b03G3H"><img src="http://feeds.wired.com/~f/wired/politics/security?i=b03G3H" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=J7IrCh"><img src="http://feeds.wired.com/~f/wired/politics/security?i=J7IrCh" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=bvmJZh"><img src="http://feeds.wired.com/~f/wired/politics/security?i=bvmJZh" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=2wmQTH"><img src="http://feeds.wired.com/~f/wired/politics/security?i=2wmQTH" border="0"></img></a> </div><img src="http://feeds.feedburner.com/~r/wired/politics/privacy/~4/296290107" height="1" width="1"/><img src="http://feeds.wired.com/~r/wired/politics/security/~4/296290109" height="1" width="1"/>]]></content:encoded>
      <pubDate>Fri, 23 May 2008 00:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/lab">lab</category>
      <category domain="http://securityratty.com/tag/murder">murder</category>
      <category domain="http://securityratty.com/tag/regional forensic lab">regional forensic lab</category>
      <category domain="http://securityratty.com/tag/hard">hard</category>
      <category domain="http://securityratty.com/tag/hard drive">hard drive</category>
      <category domain="http://securityratty.com/tag/san diego lab">san diego lab</category>
      <category domain="http://securityratty.com/tag/data cables">data cables</category>
      <category domain="http://securityratty.com/tag/data">data</category>
      <category domain="http://securityratty.com/tag/murder investigations">murder investigations</category>
      <source url="http://feeds.wired.com/~r/wired/politics/security/~3/296290109/fbi_lab">Murder, His Hard Drive Wrote</source>
    </item>
    <item>
      <title><![CDATA[Inside an FBI Computer Forensics Lab]]></title>
      <link>http://securityratty.com/article/c1a376d47aeef52fd428938ad9a0eab4</link>
      <guid>http://securityratty.com/article/c1a376d47aeef52fd428938ad9a0eab4</guid>
      <description><![CDATA[Photo: Matt Mallams/Wired.com
The experts at the FBI's newly accredited Regional Computer Forensics Lab in San Diego have already helped solve murders, child porn cases and robberies. They're among...]]></description>
      <content:encoded><![CDATA[<img src='http://www.wired.com/images/slideshow/2008/05/gallery_computer_forensics/080520_RCFL_001_t.jpg'></img>: Photo: Matt Mallams/Wired.com<p>The experts at the FBI's newly accredited Regional Computer Forensics Lab in San Diego
have already helped solve murders, child porn cases and robberies.
They're among the best in the nation at pulling evidence from hard
drives, cellphones and memory cards.</p>
<p>
There are now 14 such labs in the United States, with two more coming online
this year. Last year, the FBI labs collectively performed more than 13,000
forensics examinations. The San Diego lab alone handled more than 1,000
requests from 40 law enforcement agencies in 2007, including 171 child
pornography cases and 160 murder investigations.
</p><p>
Wired.com got a rare look at the inner workings of the San Diego lab
this week, and we snapped some photos of the toys inside.
</p>
<p>
<strong>Left:</strong> Darrell Foxworth greets members of the media in the entrance of the San Diego Regional Computer Forensic Laboratory.</p><img src='http://www.wired.com/images/slideshow/2008/05/gallery_computer_forensics/080520_RCFL_007_t.jpg'></img>: Photo: Matt Mallams/Wired.com<p>Jeff Cable, assistant director of RCFL, opens the door in to the lab to start the tour. Cable notes that it is very rare that they ever allow anyone but FBI agents through this door.</p><img src='http://www.wired.com/images/slideshow/2008/05/gallery_computer_forensics/080520_RCFL_009_t.jpg'></img>: Photo: Matt Mallams/Wired.com<p>This device copies the data off the hard drives and makes sure it can't be overwritten.</p><img src='http://www.wired.com/images/slideshow/2008/05/gallery_computer_forensics/080520_RCFL_010_t.jpg'></img>: Photo: Matt Mallams/Wired.com<p>FBI agent Dan Dandridge plugs a hard drive into a "lunch box," which clones the data off the drive as the first step of a noninvasive examination.</p><img src='http://www.wired.com/images/slideshow/2008/05/gallery_computer_forensics/080520_RCFL_011_t.jpg'></img>: Photo: Matt Mallams/Wired.com<p>Cellphones can be a treasure-trove of forensic evidence. In one case, a man was robbing a store when his cellphone rang. Captured by a security camera, and studied by the lab, the robber's unique ringtone eventually led to his conviction.</p><img src='http://www.wired.com/images/slideshow/2008/05/gallery_computer_forensics/080520_RCFL_012_t.jpg'></img>: Photo: Matt Mallams/Wired.com<p>This set of equipment is the AVID video processing system at the San Diego Regional Computer Forensics Laboratory.</p><img src='http://www.wired.com/images/slideshow/2008/05/gallery_computer_forensics/080520_RCFL_013_t.jpg'></img>: Photo: Matt Mallams/Wired.com<p>Forensic examiner Tim Hamon shows off the inside of the RCFL mobile unit.</p><img src='http://www.wired.com/images/slideshow/2008/05/gallery_computer_forensics/080520_RCFL_014_t.jpg'></img>: Photo: Matt Mallams/Wired.com<p>Lacking in subtlety, the rolling lab is not used in covert surveillance missions.</p><br style="clear: both;"/>
  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=628778b2b6f0c6c4303b5e483419e976" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=628778b2b6f0c6c4303b5e483419e976" style="display: none;" border="0" height="1" width="1" alt=""/><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=jEC8xH"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=jEC8xH" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=KFOzHh"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=KFOzHh" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=KkSBwh"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=KkSBwh" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=MFOLxH"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=MFOLxH" border="0"></img></a>
 <a href="http://feeds.wired.com/~f/wired/politics/security?a=p0QEWH"><img src="http://feeds.wired.com/~f/wired/politics/security?i=p0QEWH" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=i9SDah"><img src="http://feeds.wired.com/~f/wired/politics/security?i=i9SDah" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=ggSj5h"><img src="http://feeds.wired.com/~f/wired/politics/security?i=ggSj5h" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=GSeG1H"><img src="http://feeds.wired.com/~f/wired/politics/security?i=GSeG1H" border="0"></img></a> </div><img src="http://feeds.feedburner.com/~r/wired/politics/privacy/~4/296290108" height="1" width="1"/><img src="http://feeds.wired.com/~r/wired/politics/security/~4/296290110" height="1" width="1"/>]]></content:encoded>
      <pubDate>Fri, 23 May 2008 00:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/lab">lab</category>
      <category domain="http://securityratty.com/tag/fbi">fbi</category>
      <category domain="http://securityratty.com/tag/san diego lab">san diego lab</category>
      <category domain="http://securityratty.com/tag/photo">photo</category>
      <category domain="http://securityratty.com/tag/san diego">san diego</category>
      <category domain="http://securityratty.com/tag/matt">matt</category>
      <category domain="http://securityratty.com/tag/fbi labs collectively">fbi labs collectively</category>
      <category domain="http://securityratty.com/tag/inside">inside</category>
      <category domain="http://securityratty.com/tag/hard drive">hard drive</category>
      <source url="http://feeds.wired.com/~r/wired/politics/security/~3/296290110/gallery_computer_forensics">Inside an FBI Computer Forensics Lab</source>
    </item>
  </channel>
</rss>
