<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: color]]></title>
    <link>http://securityratty.com/tag/color</link>
    <description></description>
    <pubDate>Fri, 27 Jun 2008 06:56:10 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Clever Counterterrorism Tactic]]></title>
      <link>http://securityratty.com/article/9b0993eb71be732aed5e6c621525d339</link>
      <guid>http://securityratty.com/article/9b0993eb71be732aed5e6c621525d339</guid>
      <description><![CDATA[Used against the IRA : One of the most interesting operations was the laundry mat [sic]. Having lost many troops and civilians to bombings, the Brits decided they needed to determine who was making...]]></description>
      <content:encoded><![CDATA[<p>Used <a href="http://www.washingtonpost.com/wp-dyn/content/article/2008/10/03/AR2008100301978.html?hpid=opinionsbox1">against the IRA</a>:</p>

<blockquote>One of the most interesting operations was the laundry mat [sic]. Having lost many troops and civilians to bombings, the Brits decided they needed to determine who was making the bombs and where they were being manufactured. One bright fellow recommended they operate a laundry and when asked "what the hell he was talking about," he explained the plan and it was incorporated -- to much success.

<p>The plan was simple: Build a laundry and staff it with locals and a few of their own. The laundry would then send out "color coded" special discount tickets, to the effect of "get two loads for the price of one," etc. The color coding was matched to specific streets and thus when someone brought in their laundry, it was easy to determine the general location from which a city map was coded.</p>

<p>While the laundry was indeed being washed, pressed and dry cleaned, it had one additional cycle -- every garment, sheet, glove, pair of pants, was first sent through an analyzer, located in the basement, that checked for bomb-making residue. The analyzer was disguised as just another piece of the laundry equipment; good OPSEC [operational security]. Within a few weeks, multiple positives had shown up, indicating the ingredients of bomb residue, and intelligence had determined which areas of the city were involved. To narrow their target list, [the laundry] simply sent out more specific coupons [numbered] to all houses in the area, and before long they had good addresses. After confirming addresses, authorities with the SAS teams swooped down on the multiple homes and arrested multiple personnel and confiscated numerous assembled bombs, weapons and ingredients. During the entire operation, no one was injured or killed.</blockquote></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=1VsTM"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=1VsTM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=omBpM"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=omBpM" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Mon, 13 Oct 2008 09:22:24 +0000</pubDate>
      <category domain="http://securityratty.com/tag/laundry">laundry</category>
      <category domain="http://securityratty.com/tag/laundry simply">laundry simply</category>
      <category domain="http://securityratty.com/tag/laundry equipment">laundry equipment</category>
      <category domain="http://securityratty.com/tag/laundry mat sic">laundry mat sic</category>
      <category domain="http://securityratty.com/tag/color coded">color coded</category>
      <category domain="http://securityratty.com/tag/coded">coded</category>
      <category domain="http://securityratty.com/tag/bomb residue">bomb residue</category>
      <category domain="http://securityratty.com/tag/opsec operational security">opsec operational security</category>
      <category domain="http://securityratty.com/tag/city">city</category>
      <source url="http://www.schneier.com/blog/archives/2008/10/clever_countert.html">Clever Counterterrorism Tactic</source>
    </item>
    <item>
      <title><![CDATA[Just what color is a security hole?]]></title>
      <link>http://securityratty.com/article/c8ee6671bca09e0abe96c10e625cc445</link>
      <guid>http://securityratty.com/article/c8ee6671bca09e0abe96c10e625cc445</guid>
      <description><![CDATA[Computer attacks in space are no longer the stuff of science fiction: Recently, laptops on the International Space Station turned out to have computer viruses. NASA believes that the malware--a...]]></description>
      <content:encoded><![CDATA[Computer attacks in space are no longer the stuff of science fiction: Recently, laptops on the International Space Station turned out to have computer viruses. NASA believes that the malware--a password stealer that targets online games--may have infected the laptops via a USB thumb drive that one of the astronauts carried aboard. While it wasn't much of a threat, it just goes to show that the little buggers are everywhere.<p><A href="http://ad.doubleclick.net/jump/idg.us.nwf.rss/security;sz=468x60;ord=89488?">
<IMG src="http://ad.doubleclick.net/ad/idg.us.nwf.rss/security;sz=468x60;ord=89488?" border="0" width="468" height="60"></A>
</p>]]></content:encoded>
      <pubDate>Mon, 29 Sep 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/international space station">international space station</category>
      <category domain="http://securityratty.com/tag/space">space</category>
      <category domain="http://securityratty.com/tag/targets online games">targets online games</category>
      <category domain="http://securityratty.com/tag/usb thumb drive">usb thumb drive</category>
      <category domain="http://securityratty.com/tag/computer viruses">computer viruses</category>
      <category domain="http://securityratty.com/tag/computer attacks">computer attacks</category>
      <category domain="http://securityratty.com/tag/password stealer">password stealer</category>
      <category domain="http://securityratty.com/tag/laptops">laptops</category>
      <category domain="http://securityratty.com/tag/science fiction">science fiction</category>
      <source url="http://www.networkworld.com/news/2008/093008-bugs--fixes-just-what.html?fsrc=rss-security">Just what color is a security hole?</source>
    </item>
    <item>
      <title><![CDATA[We will miss you Paul Newman]]></title>
      <link>http://securityratty.com/article/0087551a911fab9d09a604e70f4ff977</link>
      <guid>http://securityratty.com/article/0087551a911fab9d09a604e70f4ff977</guid>
      <description><![CDATA[You did good Paul. Thanks for all the good you did. You have a great soul. Take care


clipped from www.mercurynews.com

Legendary actor Paul Newman dies at age 83

WESTPORT, Conn.Paul Newman, the...]]></description>
      <content:encoded><![CDATA[<div > You did good Paul. Thanks for all the good you did. You have a great soul.<br/>Take care. </div>
<table cellpadding="0" cellspacing="0" width="100%" style="margin: 12px 0px; font-family: arial; color: #333333; background: #ffffff; border: solid 4px #e5e5e5; width: 100%; clear: left;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" class="CM_CTB_Content_Wrap" style="margin: 0px; padding: 0px;background-color: #ffffff;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" style="border-bottom: solid 1px #dcdcdc; white-space: nowrap; margin-bottom: 8px; background-color: #eeeeee ;background-image: url(http://clipmarks.com/images/source-bg.gif); background-repeat: repeat-x; height: 24px; line-height: 24px; vertical-align: middle; padding-bottom: 4px; color: #666666; font-size: 10px;">
<tr>
<td valign="top"><a href="http://clipmarks.com/clipmark/5D83C440-CC1C-4870-A9E0-B7B49CCA5528/" title="go to this clipmark"><img src="http://content.clipmarks.com/blog_icon/89c5be95-3408-428a-ac0d-fdc150777ba8/5D83C440-CC1C-4870-A9E0-B7B49CCA5528/" alt="" width="19" height="19" border="0" style="vertical-align: middle; margin: 0px 4px; display: inline; border: none; float:none;" /></a>clipped from <a title="http://www.mercurynews.com/movies/ci_10576339" href="http://www.mercurynews.com/movies/ci_10576339" style="font-size: 11px;">www.mercurynews.com</a></td>
</tr>
</table>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://www.mercurynews.com/movies/ci_10576339 -->
<div style="margin: 4px 0px; color: #000000; font-size: 20px;">Legendary actor Paul Newman dies at age 83</div>
</td>
</tr>
</table>
<div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://www.mercurynews.com/movies/ci_10576339 -->WESTPORT, Conn.—Paul Newman, the Academy-Award winning superstar who personified cool as the anti-hero of such films as &#8220;Hud,&#8221; &#8220;Cool Hand Luke&#8221; and &#8220;The Color of Money&#8221;—and as an activist, race car driver and popcorn impresario—has died. He was 83. </td>
</tr>
</table>
</td>
</tr>
</table>
<div style="margin: 0px 6px 6px 4px;">
<table style="font-size: 11px;border-spacing: 0px;padding: 0px;" cellpadding="0" cellspacing="0" width="100%">
<tr>
<td style="background:transparent;border-width:0px;padding:0px;">&nbsp;</td>
<td align="right" style="background:transparent;border-width:0px;padding:0px;width:107px" width="107"><a href="http://clipmarks.com/share/5D83C440-CC1C-4870-A9E0-B7B49CCA5528/blog/" title="blog or email this clip"><img src="http://content6.clipmarks.com/images/c2b-foot.png" border="0" alt="blog it" width="107" height="17" style="border-width:0px;padding:0px;margin:0px;" /></a></td>
</tr>
</table>
</div>
</td>
</tr>
</table>
<BR/><MAP name="bdv_RSS_Ad_270908025747"><AREA alt="Feed Ads By BidVertiser.com" shape="poly" coords="0,0,467,0,467,45,315,45,315,59,0,59" href="http://secure.bidvertiser.com/performance/bdv_rss_rd.dbm?pid=165886&amp;bid=400950&amp;PHS=270908025747&amp;click=1" target="_blank" /><AREA alt="Feed Ads By BidVertiser.com" shape="rect" coords="315,45,467,59" href="http://www.bidvertiser.com/bdv/bidvertiser/bdv_ref.dbm?Ref_PID=165886&amp;Ref_Option=main&amp;source=90614506" target="_blank" /></MAP><P><a href="http://secure.bidvertiser.com/performance/bdv_rss_rd.dbm?pid=165886&amp;bid=400950&amp;PHS=270908025747&amp;click=1" target="_blank"><IMG src="http://bdv.bidvertiser.com/BidVertiser.dbm?pid=165886&amp;bid=400950&amp;PHS=270908025747&amp;rssimage=1&amp;rSRC=2" border="0" usemap="#bdv_RSS_Ad_270908025747" /></a></P>]]></content:encoded>
      <pubDate>Sat, 27 Sep 2008 10:57:47 +0000</pubDate>
      <category domain="http://securityratty.com/tag/paul newman">paul newman</category>
      <category domain="http://securityratty.com/tag/paul">paul</category>
      <category domain="http://securityratty.com/tag/cool hand luke">cool hand luke</category>
      <category domain="http://securityratty.com/tag/cool">cool</category>
      <category domain="http://securityratty.com/tag/race car driver">race car driver</category>
      <category domain="http://securityratty.com/tag/popcorn impresariohas">popcorn impresariohas</category>
      <category domain="http://securityratty.com/tag/moneyand">moneyand</category>
      <category domain="http://securityratty.com/tag/westport">westport</category>
      <category domain="http://securityratty.com/tag/films">films</category>
      <source url="http://spywarebiz.com/spywarebizblog/?p=630">We will miss you Paul Newman</source>
    </item>
    <item>
      <title><![CDATA[Wot? No I said What! Wot?]]></title>
      <link>http://securityratty.com/article/eab31d880a38c85be552b249bd88837c</link>
      <guid>http://securityratty.com/article/eab31d880a38c85be552b249bd88837c</guid>
      <description><![CDATA[OK, its my Clip, Ill write what I wanna. Came across this review of Wot at Webtoolsandtips.com this morning. This addon seems to have great reviews, Give it a look at their site


clipped from...]]></description>
      <content:encoded><![CDATA[<div > OK, its my Clip, I&#8217;ll write what I wanna.<br/>Came across this review of Wot at Webtoolsandtips.com this morning.<br/>This addon seems to have great reviews,<br/>Give it a look at their site. </div>
<table cellpadding="0" cellspacing="0" width="100%" style="margin: 12px 0px; font-family: arial; color: #333333; background: #ffffff; border: solid 4px #e5e5e5; width: 100%; clear: left;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" class="CM_CTB_Content_Wrap" style="margin: 0px; padding: 0px;background-color: #ffffff;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" style="border-bottom: solid 1px #dcdcdc; white-space: nowrap; margin-bottom: 8px; background-color: #eeeeee ;background-image: url(http://clipmarks.com/images/source-bg.gif); background-repeat: repeat-x; height: 24px; line-height: 24px; vertical-align: middle; padding-bottom: 4px; color: #666666; font-size: 10px;">
<tr>
<td valign="top"><a href="http://clipmarks.com/clipmark/6EA8B9FC-76E9-4334-A96C-A380C5AEF85E/" title="go to this clipmark"><img src="http://content.clipmarks.com/blog_icon/b1bd3498-a992-4b18-8c15-87c2fba5fa3e/6EA8B9FC-76E9-4334-A96C-A380C5AEF85E/" alt="" width="19" height="19" border="0" style="vertical-align: middle; margin: 0px 4px; display: inline; border: none; float:none;" /></a>clipped from <a title="https://addons.mozilla.org/en-US/firefox/addons/versions/3456#version-20080917" href="https://addons.mozilla.org/en-US/firefox/addons/versions/3456#version-20080917" style="font-size: 11px;">addons.mozilla.org</a></td>
</tr>
</table>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: https://addons.mozilla.org/en-US/firefox/addons/versions/3456#version-20080917 --><H3 class="name"><IMG alt="" class="addon-icon" src="https://addons.mozilla.org/en-US/firefox/images/addon_icon/3456/1221571804" />WOT 20080917</H3></td>
</tr>
</table>
<div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: https://addons.mozilla.org/en-US/firefox/addons/versions/3456#version-20080917 --><P class="desc">WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT&#8217;s color-coded icons show you ratings for 20 million websites - green to go, yellow for caution and red to stop – helping you avoid the dangerous sites. Surf safer and add WOT to your Firefox now. </P></td>
</tr>
</table>
</td>
</tr>
</table>
<div style="margin: 0px 6px 6px 4px;">
<table style="font-size: 11px;border-spacing: 0px;padding: 0px;" cellpadding="0" cellspacing="0" width="100%">
<tr>
<td style="background:transparent;border-width:0px;padding:0px;">&nbsp;</td>
<td align="right" style="background:transparent;border-width:0px;padding:0px;width:107px" width="107"><a href="http://clipmarks.com/share/6EA8B9FC-76E9-4334-A96C-A380C5AEF85E/blog/" title="blog or email this clip"><img src="http://content6.clipmarks.com/images/c2b-foot.png" border="0" alt="blog it" width="107" height="17" style="border-width:0px;padding:0px;margin:0px;" /></a></td>
</tr>
</table>
</div>
</td>
</tr>
</table>
<BR/><MAP name="bdv_RSS_Ad_260908035935"><AREA alt="Feed Ads By BidVertiser.com" shape="poly" coords="0,0,467,0,467,45,315,45,315,59,0,59" href="http://secure.bidvertiser.com/performance/bdv_rss_rd.dbm?pid=165886&amp;bid=400950&amp;PHS=260908035935&amp;click=1" target="_blank" /><AREA alt="Feed Ads By BidVertiser.com" shape="rect" coords="315,45,467,59" href="http://www.bidvertiser.com/bdv/bidvertiser/bdv_ref.dbm?Ref_PID=165886&amp;Ref_Option=main&amp;source=90614506" target="_blank" /></MAP><P><a href="http://secure.bidvertiser.com/performance/bdv_rss_rd.dbm?pid=165886&amp;bid=400950&amp;PHS=260908035935&amp;click=1" target="_blank"><IMG src="http://bdv.bidvertiser.com/BidVertiser.dbm?pid=165886&amp;bid=400950&amp;PHS=260908035935&amp;rssimage=1&amp;rSRC=2" border="0" usemap="#bdv_RSS_Ad_260908035935" /></a></P>]]></content:encoded>
      <pubDate>Fri, 26 Sep 2008 11:59:35 +0000</pubDate>
      <category domain="http://securityratty.com/tag/wot">wot</category>
      <category domain="http://securityratty.com/tag/deliver malware">deliver malware</category>
      <category domain="http://securityratty.com/tag/surf safer">surf safer</category>
      <category domain="http://securityratty.com/tag/risky websites">risky websites</category>
      <category domain="http://securityratty.com/tag/scam visitors">scam visitors</category>
      <category domain="http://securityratty.com/tag/front-line layer">front-line layer</category>
      <category domain="http://securityratty.com/tag/online threats">online threats</category>
      <category domain="http://securityratty.com/tag/dangerous sites">dangerous sites</category>
      <category domain="http://securityratty.com/tag/unfamiliar territory">unfamiliar territory</category>
      <source url="http://spywarebiz.com/spywarebizblog/?p=629">Wot? No I said What! Wot?</source>
    </item>
    <item>
      <title><![CDATA[Wee-Fi: CSIRO Wins Patent Appeal; Zune-Fi in SF; Kodak ESP 9]]></title>
      <link>http://securityratty.com/article/95aa70e977b254cabeb9c3b2679b4b8d</link>
      <guid>http://securityratty.com/article/95aa70e977b254cabeb9c3b2679b4b8d</guid>
      <description><![CDATA[Australian tech office wins appeal: Buffalo sinks further into the hole as it loses its appeal against a judgement over its use of what the Australian CSIRO technical agency asserts is its patented...]]></description>
      <content:encoded><![CDATA[<p><img src="http://wifinetnews.com/images/weefi.jpg" align="right" border="0" hspace="5" /><a href="http://www.zdnet.com.au/news/hardware/soa/CSIRO-victorious-in-Wi-Fi-appeal/0,130061702,339292134,00.htm?omnRef=1337"><strong>Australian tech office wins appeal:</strong></a> Buffalo sinks further into the hole as it loses its appeal against a judgement over its use of what the Australian CSIRO technical agency asserts is its patented technology used in all 802.11 implementations. The case, in the patent-holder-friendly US Eastern District Court of Texas--a venue that may be dethroned as a <em>forum coveniens</em> for patentholders' suits in new legislation--prevents Buffalo from importing or selling gear in the US with Wi-Fi technology embedded. In Japan, the patent office threw out CSIRO's patent. While Cisco paid CSIRO as the result of an acquisition of an Australian company a few years ago, most US-based technology giants are involved in resisting the patent's continued validation and enforcement. I've read the patent and some of the suits, and as a non-patent expert, it's clear CSIRO original invention didn't cover what's at stake. However, CSIRO was allowed in a subsequent filing to extend its patent to cover already-in-use technology in a way that seems odd to me, but happens in patents all the time. Many millions of dollars and many more years may be expended before a resolution happens. CSIRO apparently isn't asking for insane fees, although anything paid to them would be passed along to consumers. If companies settled, this might result in an increase of 1 to 5 percent on retail prices. It may ultimately effect WiMax, too, though no suits in that area have been filed.</p>

<p><a href="http://news.cnet.com/8301-10805_3-10046542-75.html"><strong>Finding Zune-Fi:</strong></a> Ina Fried of News.com wanders the polite streets of San Francisco in search of Zune connections over Wi-Fi. She finds a few, and has a good experience. One cafe owner sees the ease with which she can stream music and calls it cool. She can't connect at the long-running Google-sponsored free Wi-Fi at Union Square, however, which means the Wi-Fi likely has an accept button that must be pressed. Surely Microsoft could insert a little technology that would allow a browser-free acceptance of terms? Probably involves Yet Another Protocol: the Wi-Fi Terms Browser-Free Presentation Protocol (WTBFPP).</p>

<p><img src="http://wifinetnews.com//images/2008/kodakesp9.jpg" alt="kodakesp9.jpg" border="0" width="150" height="120" align="right" /><a href="http://www.kodak.com/eknec/PageQuerier.jhtml?pq-path=13572&pq-locale=en_US"><strong>Kodak adds interesting Wi-Fi enabled all-in-one:</strong></a> The new Kodak ESP 9 is a multi-function printer (fax, scan, print, copy) that connects to a network via Wi-Fi or Ethernet. The $300 device spits out 30 pages per minutes in color, 32 ppm in black only. Kodak claims that the model line to which the ESP belongs uses ink in a vastly more efficient manner than the "average of comparable consumer inkjet printers." </p>]]></content:encoded>
      <pubDate>Mon, 22 Sep 2008 05:53:19 +0000</pubDate>
      <category domain="http://securityratty.com/tag/csiro">csiro</category>
      <category domain="http://securityratty.com/tag/patent">patent</category>
      <category domain="http://securityratty.com/tag/cover">cover</category>
      <category domain="http://securityratty.com/tag/cover already-in-use technology">cover already-in-use technology</category>
      <category domain="http://securityratty.com/tag/free wi-fi">free wi-fi</category>
      <category domain="http://securityratty.com/tag/wi-fi">wi-fi</category>
      <category domain="http://securityratty.com/tag/kodak">kodak</category>
      <category domain="http://securityratty.com/tag/technology">technology</category>
      <category domain="http://securityratty.com/tag/wi-fi technology">wi-fi technology</category>
      <source url="http://wifinetnews.com/archives/008452.html">Wee-Fi: CSIRO Wins Patent Appeal; Zune-Fi in SF; Kodak ESP 9</source>
    </item>
    <item>
      <title><![CDATA[Senator Obama's security concerns]]></title>
      <link>http://securityratty.com/article/ce6e50c5b4d179e0d726e937841e4dde</link>
      <guid>http://securityratty.com/article/ce6e50c5b4d179e0d726e937841e4dde</guid>
      <description><![CDATA[It appears as if the authorities in Colorado are trying to down play the reported assassination plot of Senator Obama. Question is; how real was it


It would certainly appear that the suspects were...]]></description>
      <content:encoded><![CDATA[It appears as if the authorities in Colorado are trying to down play the reported assassination plot of Senator Obama.  Question is; how real was it?<br /><span id="fullpost"><br /> <br />It would certainly appear that the suspects were preparing for something out of the ordinary as they were reported as having a bullet proof vest and a high powered rifle with telescopic scope in their possession when apprehended.  The fact that one of the them was described by his cohort as a "white supremist" who did not believe that a man of color could be the President of the U.S.A. is surely telling.<br /><br />These three criminals were caught in much the same manner as the domestic terrorist, Timothy McVeigh.  A dilgent policeman was doing his duty and pulled over the first suspect on a traffic stop.  Some may call that luck, but having been a former Law Enforcement officer, I look upon it as good Police work.  Many others might have not noticed the one little sign that made that officer suspicious and prompted him to check out the driver of the van.<br /><br />That is why security can never rest.  Whether it is foiling a potential terrorist plot or finding a child who has been abducted, we must always remain vigilant.  It is a shame that there are those who believe a man is inferior based upon the color of his skin.  It is even more terrible to realize that such a person would be willing to kill another based on racial hatred.  <br /><br />Unfortunately, this is a sad fact of life and steps need to be taken to thwart those disturbed individuals.  Was this latest episode a non-event or by dismissing it are we attempting to sweep the shame of racism under the carpet?  I for one, don't think that we should take these warnings lightly.  Afterall, it has been 45 years and people still debate the assassination of JFK.  We still hear it being said that Lee Harvey Oswald was incapable of carrying out the killing himself.<br /><br />I recently watched a documentary on the assassination of Robert Kennedy, produced on the 40th anniversary of his death.  When interviewed, the brother of the asssassin claims that his brother was too nice a guy to do something so awful. The fact of the matter however, is that both Kennedys were brutally gunned down.  I am sure it is something that nobody ever wants to see repeated.  <br /><br />Let us hope that whomever succeeds as President in November has a long and healthy Presidency and helps to allevitae the problems that have been piling up.<div class="blogger-post-footer">Visit Sexton Executive Security at www.sextonsecurity.com</div>]]></content:encoded>
      <pubDate>Fri, 29 Aug 2008 14:42:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/assassination">assassination</category>
      <category domain="http://securityratty.com/tag/senator obama">senator obama</category>
      <category domain="http://securityratty.com/tag/assassination plot">assassination plot</category>
      <category domain="http://securityratty.com/tag/potential terrorist plot">potential terrorist plot</category>
      <category domain="http://securityratty.com/tag/based">based</category>
      <category domain="http://securityratty.com/tag/law enforcement officer">law enforcement officer</category>
      <category domain="http://securityratty.com/tag/inferior based">inferior based</category>
      <category domain="http://securityratty.com/tag/lee harvey oswald">lee harvey oswald</category>
      <category domain="http://securityratty.com/tag/bullet proof vest">bullet proof vest</category>
      <source url="http://www.thebulletproofblog.com/2008/08/senator-obamas-security-concerns.html">Senator Obama's security concerns</source>
    </item>
    <item>
      <title><![CDATA[Simulating Email in .NET]]></title>
      <link>http://securityratty.com/article/0c454dbe28b5b63d07ee0089e019de77</link>
      <guid>http://securityratty.com/article/0c454dbe28b5b63d07ee0089e019de77</guid>
      <description><![CDATA[I use email as a notification mechanism a lot, and often in class I'll demo sending email via a technique that I use frequently when developing code. It allows you to simulate sending an email...]]></description>
      <content:encoded><![CDATA[<p>I use email as a notification mechanism a lot, and often in class I&#39;ll demo sending email via a technique that I use frequently when developing code. It allows you to simulate sending an email message.</p> <p>The trick to doing this is not to hardcode things like host, port, etc. for your SMTP server when you use System.Net.Mail to send mail. Instead, use the default ctor for <a href="http://msdn.microsoft.com/en-us/library/system.net.mail.smtpclient.aspx" target="_blank">SmtpClient</a> as I&#39;ve done in the code below.</p> <blockquote><pre class="csharpcode"><span class="kwrd">static</span> <span class="kwrd">void</span> Main(<span class="kwrd">string</span>[] args)
{
    <span class="rem">// note the use of the MailAddress class</span>
    <span class="rem">// this allows me to specify display names as well as email addresses</span>
    MailAddress from = <span class="kwrd">new</span> MailAddress(<span class="str">&quot;admin@fabrikam.com&quot;</span>, <span class="str">&quot;Fabrikam Website&quot;</span>);
    MailAddress to = <span class="kwrd">new</span> MailAddress(<span class="str">&quot;mari@fabrikam.com&quot;</span>, <span class="str">&quot;Mari Joyce&quot;</span>);

    MailMessage msg = <span class="kwrd">new</span> MailMessage(from, to);
    msg.Subject  = <span class="str">&quot;Testing 123&quot;</span>;
    msg.Body = <span class="str">&quot;This is only a test!&quot;</span>;

    <span class="rem">// note use of default ctor</span>
    <span class="rem">// this looks in config to figure out how to send mail</span>
    <span class="kwrd">new</span> SmtpClient().Send(msg);
}</pre></blockquote>
.csharpcode, .csharpcode pre
{
	font-size: small;
	color: black;
	font-family: consolas, &quot;Courier New&quot;, courier, monospace;
	background-color: #ffffff;
	/*white-space: pre;*/
}
.csharpcode pre { margin: 0em; }
.csharpcode .rem { color: #008000; }
.csharpcode .kwrd { color: #0000ff; }
.csharpcode .str { color: #006080; }
.csharpcode .op { color: #0000c0; }
.csharpcode .preproc { color: #cc6633; }
.csharpcode .asp { background-color: #ffff00; }
.csharpcode .html { color: #800000; }
.csharpcode .attr { color: #ff0000; }
.csharpcode .alt 
{
	background-color: #f4f4f4;
	width: 100%;
	margin: 0em;
}
.csharpcode .lnum { color: #606060; }


<p>What you&#39;re telling .NET by using the default ctor for SmtpClient is, &quot;please use my config file to figure out how to send mail&quot;. Now you can use the system.net/mailSettings/smtp section in config to specify the details of your mail server, and all of the code in your app that is written to use the default SmtpClient ctor will inherit these settings. Here&#39;s an example of what the config on a production server might look like (if you put passwords in your config files, be sure to <a href="http://msdn.microsoft.com/en-us/library/ms998283.aspx" target="_blank">encrypt those sections</a>): </p><pre class="csharpcode"><span class="kwrd">&lt;</span><span class="html">configuration</span><span class="kwrd">&gt;</span>
  <span class="kwrd">&lt;</span><span class="html">system.net</span><span class="kwrd">&gt;</span>
    <span class="kwrd">&lt;</span><span class="html">mailSettings</span><span class="kwrd">&gt;</span>
      <span class="kwrd">&lt;</span><span class="html">smtp</span> <span class="attr">deliveryMethod</span><span class="kwrd">=&quot;Network&quot;</span><span class="kwrd">&gt;</span>
        <span class="kwrd">&lt;</span><span class="html">network</span> <span class="attr">host</span><span class="kwrd">=&quot;mail.fabrikam.com&quot;</span>
                 <span class="attr">port</span><span class="kwrd">=&quot;25&quot;</span>
                 <span class="attr">userName</span><span class="kwrd">=&quot;WebsiteMailAccount&quot;</span>
                 <span class="attr">password</span><span class="kwrd">=&quot;whatever&quot;</span><span class="kwrd">/&gt;</span>
      <span class="kwrd">&lt;/</span><span class="html">smtp</span><span class="kwrd">&gt;</span>
    <span class="kwrd">&lt;/</span><span class="html">mailSettings</span><span class="kwrd">&gt;</span>
  <span class="kwrd">&lt;/</span><span class="html">system.net</span><span class="kwrd">&gt;</span>
<span class="kwrd">&lt;/</span><span class="html">configuration</span><span class="kwrd">&gt;</span></pre><pre class="csharpcode">&nbsp;</pre>
.csharpcode, .csharpcode pre
{
	font-size: small;
	color: black;
	font-family: consolas, &quot;Courier New&quot;, courier, monospace;
	background-color: #ffffff;
	/*white-space: pre;*/
}
.csharpcode pre { margin: 0em; }
.csharpcode .rem { color: #008000; }
.csharpcode .kwrd { color: #0000ff; }
.csharpcode .str { color: #006080; }
.csharpcode .op { color: #0000c0; }
.csharpcode .preproc { color: #cc6633; }
.csharpcode .asp { background-color: #ffff00; }
.csharpcode .html { color: #800000; }
.csharpcode .attr { color: #ff0000; }
.csharpcode .alt 
{
	background-color: #f4f4f4;
	width: 100%;
	margin: 0em;
}
.csharpcode .lnum { color: #606060; }


<p>During development, I use different settings because I don&#39;t usually want to deal with the hassle of installing an SMTP server on my development box. Instead, I want email messages delivered as individual files in a directory on my hard drive (I always have a c:\mail directory on my development box for just this purpose):</p>
<blockquote><pre class="csharpcode"><span class="kwrd">&lt;</span><span class="html">configuration</span><span class="kwrd">&gt;</span>
  <span class="kwrd">&lt;</span><span class="html">system.net</span><span class="kwrd">&gt;</span>
    <span class="kwrd">&lt;</span><span class="html">mailSettings</span><span class="kwrd">&gt;</span>
      <span class="kwrd">&lt;</span><span class="html">smtp</span> <span class="attr">deliveryMethod</span><span class="kwrd">=&quot;SpecifiedPickupDirectory&quot;</span><span class="kwrd">&gt;</span>
        <span class="kwrd">&lt;</span><span class="html">specifiedPickupDirectory</span> <span class="attr">pickupDirectoryLocation</span><span class="kwrd">=&quot;c:\mail&quot;</span><span class="kwrd">/&gt;</span>
      <span class="kwrd">&lt;/</span><span class="html">smtp</span><span class="kwrd">&gt;</span>
    <span class="kwrd">&lt;/</span><span class="html">mailSettings</span><span class="kwrd">&gt;</span>
  <span class="kwrd">&lt;/</span><span class="html">system.net</span><span class="kwrd">&gt;</span>
<span class="kwrd">&lt;/</span><span class="html">configuration</span><span class="kwrd">&gt;</span></pre></blockquote>
.csharpcode, .csharpcode pre
{
	font-size: small;
	color: black;
	font-family: consolas, &quot;Courier New&quot;, courier, monospace;
	background-color: #ffffff;
	/*white-space: pre;*/
}
.csharpcode pre { margin: 0em; }
.csharpcode .rem { color: #008000; }
.csharpcode .kwrd { color: #0000ff; }
.csharpcode .str { color: #006080; }
.csharpcode .op { color: #0000c0; }
.csharpcode .preproc { color: #cc6633; }
.csharpcode .asp { background-color: #ffff00; }
.csharpcode .html { color: #800000; }
.csharpcode .attr { color: #ff0000; }
.csharpcode .alt 
{
	background-color: #f4f4f4;
	width: 100%;
	margin: 0em;
}
.csharpcode .lnum { color: #606060; }


<p>Now when I run the program above, I get a .EML file in my c:\mail directory:</p>
<p><a href="http://www.pluralsight.com/community/cfs-file.ashx/__key/CommunityServer.Blogs.Components.WeblogFiles/keith/image_5F00_2.png"><img style="border-right:0px;border-top:0px;margin:0px 0px 0px 35px;border-left:0px;border-bottom:0px;" height="230" alt="image" src="http://www.pluralsight.com/community/cfs-file.ashx/__key/CommunityServer.Blogs.Components.WeblogFiles/keith/image_5F00_thumb.png" width="404" border="0" /></a> </p>
<p>Outlook Express is normally registered as the viewer for .EML files, so double-click the file to view it:</p>
<p><a href="http://www.pluralsight.com/community/cfs-file.ashx/__key/CommunityServer.Blogs.Components.WeblogFiles/keith/image_5F00_4.png"><img style="border-right:0px;border-top:0px;margin:0px 0px 0px 35px;border-left:0px;border-bottom:0px;" height="287" alt="image" src="http://www.pluralsight.com/community/cfs-file.ashx/__key/CommunityServer.Blogs.Components.WeblogFiles/keith/image_5F00_thumb_5F00_1.png" width="292" border="0" /></a> </p>
<p>If you&#39;ve never seen this method of simulating email before, I hope you find it as useful as I have. Happy coding!</p><div style="clear:both;"></div><img src="http://www.pluralsight.com/community/aggbug.aspx?PostID=52305" width="1" height="1">]]></content:encoded>
      <pubDate>Fri, 01 Aug 2008 09:59:01 +0000</pubDate>
      <category domain="http://securityratty.com/tag/csharpcode pre">csharpcode pre</category>
      <category domain="http://securityratty.com/tag/pre">pre</category>
      <category domain="http://securityratty.com/tag/csharpcode">csharpcode</category>
      <category domain="http://securityratty.com/tag/color">color</category>
      <category domain="http://securityratty.com/tag/email">email</category>
      <category domain="http://securityratty.com/tag/email addresses mailaddress">email addresses mailaddress</category>
      <category domain="http://securityratty.com/tag/mailaddress">mailaddress</category>
      <category domain="http://securityratty.com/tag/mail server">mail server</category>
      <category domain="http://securityratty.com/tag/mail">mail</category>
      <source url="http://www.pluralsight.com/community/blogs/keith/archive/2008/08/01/simulating-email-in-net.aspx">Simulating Email in .NET</source>
    </item>
    <item>
      <title><![CDATA[Q&A with Doug McClure: What Makes BSM Successful?]]></title>
      <link>http://securityratty.com/article/ac3c26a14f128a8ecb49f7c474cbb36e</link>
      <guid>http://securityratty.com/article/ac3c26a14f128a8ecb49f7c474cbb36e</guid>
      <description><![CDATA[Yesterday we featured our initial Q&amp;A with Doug McClure , who took some time to answer some strategic questions on BSM Lite. Today, Doug shares his thoughts on BSM and CMDB strategies for companies...]]></description>
      <content:encoded><![CDATA[<p>Yesterday we featured <a href="http://blog.sciencelogic.com/qa-with-doug-mcclure-is-bsm-lite-the-answer/07/2008" target="_blank">our initial Q&amp;A</a> with <a href="http://dougmcclure.net/blog/" target="_blank">Doug McClure</a>, who took some time to answer some strategic questions on BSM Lite. Today, Doug shares his thoughts on BSM and CMDB strategies for companies and how his stint in the U.S. Navy helped shape his future passion for BSM.</p>
<p><strong><em>ScienceLogic:</em></strong> Can you share any of the strategies/advice that you give to companies embarking on their BSM journeys?</p>
<p><strong><em>Doug McClure:</em></strong> Well, first they&#8217;ve got to have a BSM strategy. Nearly all the clients I talk to or hear about wanting to do BSM do not have a BSM strategy. I talk a lot about this on my blog and with clients and it is relevant whether you&#8217;re going to think about &#8220;BSM Lite&#8221; or &#8220;BSM Heavy&#8221; approaches.</p>
<p>Once we have a BSM strategy, we need to establish a BSM roadmap that guides us in how we’ll implement the BSM strategy in a more tactical manner, focusing on short term iterative quick wins and 30-60-90 day projects. For more of my thoughts on BSM strategy and roadmapping, see the following blog posts.</p>
<ul>
<li>
<h3><a href="http://dougmcclure.net/blog/2007/03/elements-of-business-service-management-part-3-getting-business-service-management-on-the-radar-screen/" target="_blank">Elements of Business Service Management Part 3: Getting Business Service Management on the Radar Screen</a></h3>
</li>
<li>
<h3><a href="http://dougmcclure.net/blog/2007/09/elements-of-business-service-management-part-4-what%e2%80%99s-your-business-service-management-strategy/" target="_blank">Elements of Business Service Management Part 4: What’s your Business Service Management Strategy?</a></h3>
</li>
</ul>
<p>As I&#8217;ve alluded to previously, a client first must define and understand what &#8220;BSM Lite&#8221; may mean to them. Don&#8217;t take what the analysts or the vendors pitch for what you should do to achieve BSM or what value you should get from it.</p>
<p>For any type of BSM to be successful, each client must define what BSM means to them and state what they expect to get from BSM. They must make it personal, make it a part of their company culture and elevate it to be as an important initiative as compliance, risk management, SOA, ITIL, or other initiatives may be within the company.</p>
<p>Please don&#8217;t get scared off from this strategy thing. Please don&#8217;t blow this off as something that the secret enterprise architecture council should be doing. If you&#8217;re unable to get an audience in these areas within your company, start within your own sphere of influence.</p>
<p>Your strategy could be as simple as enabling the local operations center to more efficiently classify, triage and resolve problems based on a simple business service or application contextual understanding. Focus on how this changes the game within your environment. Come up with your own metrics and measures to assess the value this has to this organizational use. Trust me, you&#8217;ll need to justify your investment some time in the future.</p>
<p>Another trait of successful BSM implementations is that of the formal monitoring and management tools group has established some sort of database or knowledge repository that enables them to &#8220;manage the business of IT management and monitoring&#8221; if you will. In my opinion, the vendor community has let their clients down significantly in this area. The CMDB may be the correct answer, but most companies just don’t value monitoring enough to demand that this be included in their formal CMDB initiatives.</p>
<p>In my last job, we developed an application that I referred to as the &#8220;Service Management Database&#8221; or &#8220;SMDB&#8221;. Others may call it something else, but in essence, it was the database that captured what was monitored, how it was monitored, who owned it, what business services and applications it supported, the impact an outage or event from it had on the business services or applications, etc.</p>
<p>One key component of this “SMDB” was establishing the relationships of real and synthetic user and transaction monitoring steps to associated servers and applications. This is a significant gap area in many tools and vendor CMDBs.</p>
<p>Clients who have instituted something formal such as this generally have a very good handle on management and monitoring within their environment. Far too many clients do not have adequate monitoring (read visibility) in place to begin their BSM journey.</p>
<p>I&#8217;d strongly recommend a good hard look at how well the client&#8217;s monitoring and management practices are implemented and managed. Simply put, if they don&#8217;t have adequate visibility into how well those business services and applications are performing, you can&#8217;t expect to manage what you can&#8217;t “see” that may be impacting the business, clients, revenue, etc.</p>
<p>Just ask yourself this – can you explicitly state what monitoring is in place for a given business service or application? Can you quantify the impact of a simple event to a business service or application? Can you explain why something is red, yellow, purple or green and what causes it to change from one color to another? If you can’t, your BSM journey will be challenging.</p>
<p>Those with formal CMDB initiatives have their hands full with high risk, long time to value projects to just get a handle with traditional configuration management models. Taking these low level configuration items (CI&#8217;s) and establishing application and service dependencies comes after a lot of work getting through the organizational challenges of getting systems access to populate the CMDB.</p>
<p>I strongly recommend that the formal monitoring and management tools group create an authoritative database that enables them to establish end-to-end visibility into the service and application delivery chain and the impacts it has on the business, customer, etc. This ultimately becomes part of a more realistic federated CMDB within the business.</p>
<p><strong>ScienceLogic:</strong> Can you provide an example of a successful implementation of BSM? Were there specific factors that especially contributed to its success?</p>
<p><strong><em>Doug McClure:</em></strong> I&#8217;ve touched on the highlights of the most successful BSM implementations throughout my previous answers. Clients that have rallied around an organizational change or transformation focusing every team member’s efforts and energy towards ensuring that the business goals and objectives are being met through the delivery of highly available business services and applications.</p>
<p>Far too often the “change” never happens and it’s the “talking heads” that are preaching to the choir about what should be done. Every person on the front line, in the support teams, at the help desk, etc. must understand how they support or impact the business in business terms. Try putting this simple phrase after job titles “Hi, my name is Doug. I’m a Systems Administrator, Supporting the Business”.</p>
<p>That was a mouthful, but simply put, these clients have an impressively instrumented business and IT environment with the right amount of visibility into each area, joined together with an organization that thinks, operates and responds based on their understanding of the business goals and objectives and how these business services and applications enable business success.</p>
<p>The operational model for an organization fully adopting BSM identifies ways to establish a service management mentality across the entire business service and application delivery and support chain. The delivery, operations and support organizations must be incented to manage the services and applications being delivered with this end-to-end context.</p>
<p>A leading, outside the box “service management organization” may include the traditional IT silos but within a matrixed fashion focused on one or more key business services and applications. The &#8220;service management organization&#8221; is then incented to work together, as a team, for the end-to-end delivery and support of these services or applications.</p>
<p>It’s no longer one’s job to just be the systems administrator, database administrator or network engineer, their job is now to support specific business services and applications. They provide the subject matter expertise needed to support the services and applications together, as a team, eliminating the finger pointing or “not my problem” attitudes that exist in the majority of IT organizations today.</p>
<p>Overall, the KISS approach is what will enable BSM of any type (lite, heavy) to be the most successful. If it just feels natural, doesn&#8217;t take any additional effort, clicks or tasks to do then it&#8217;s going to work. BSM should be transparent and not just another buzz word. It&#8217;s not a form that gets filled out or a special process to follow in the run book. It&#8217;s doing the right thing for the business, no matter what the situation, crisis, buzz word or technology initiative of the day is.</p>
<p><strong><em>ScienceLogic:</em></strong> How did you get involved in BSM?</p>
<p><strong><em>Doug McClure:</em></strong> I think the foundations of my service management background and passion were initially established during my service in the US Navy. Today, I relate that experience to what I call BSM for the Military or Mission Services Management (MSM).</p>
<p>We had been taught over and over that extreme attention to the details of the mission at hand (aka &#8220;the business&#8221;) was the number one priority and that all of our technology, services, and applications existed for those Sailors and Marines on the other end (the &#8220;customer&#8221;). I can recall countless instances where mission critical communications services (telephony, orderwires, teletypes, command and control systems, etc.) were impacted in one way or another. It was extremely critical that we understood who was impacted and to what degree so that contingency plans could be activated. We weren’t just talking about lost revenue, poor sales or customer experience; we were talking about human lives and the security of the United States.</p>
<p>It is that military bearing, attention to detail and real world experience that drives me with many of my modern day BSM endeavors. That migration from &#8220;Mission Services Management&#8221; to BSM was honed working for over 10 years working in the Internet Service Provider (ISP) and datacenter, hosting and colocation business.</p>
<p>In those rapid growth businesses during the Internet boom, service differentiation was what &#8220;made you millions&#8221; or paved your way to bankruptcy. The companies I worked for had an extreme passion and focus on ensuring that their services, applications and Internet access products were of the highest quality, highly reliable and just plain better than the competition.</p>
<p>Again, the IT infrastructure, service quality and customer experience relationship was ingrained in all of our heads. It was all hands on deck when Webmail, Internet access, DNS, or the network experienced problems. We were measured in terms of how many customers experienced a busy signal or dropped connection or if you couldn’t log in fast enough to read your email. Companies like Keynote Systems and LionBridge/Veritest/Inverse tested the quality of our networks, services and applications and publicly ranked us against our competition. We thought in terms of customer experience and impact every minute of the day, 24&#215;7.</p>
<p>It was in my last job managing a traditional enterprise management and monitoring development group for a nationwide ISP where I was able to work with emerging technology to help get a handle on the complexities of these rapidly growing IT environments filled with emerging technologies and products. Applying this early technology to complex service problems in our environment proved to me that the technology, coupled with the right emphasis on how the technology was implemented and an emphasis on the people and processes within the organization could bring BSM to life.</p>
<p>Where I felt left out in the cold was with my vendor relationship. While their technology gave me the potential, they didn&#8217;t teach me how to work through the organizational and technological problems to successfully implement the BSM strategy. My very first end-to-end BSM pilot was extremely successful and provided visibility into the IT environment and business service impact that have never been available before.</p>
<p>And here I am today, working at a software vendor for the first time. Welcome to the &#8220;dark side&#8221; as they say. The approach and methodology we followed for BSM has become the basis of the core BSM Methodology that I teach IBMers and our clients around the world today.</p>
<p>My personal mission and drive here at IBM Tivoli is to ensure that BSM is something that the typical monitoring tools administrator can actually implement and that our BSM story is something that any of our clients can be successful with. The sales and marketing slicks must be backed up by something like this whomever you are these days. Clients shouldn&#8217;t put up for “marketecture”, me too and gee whiz buzz words.</p>
<p>BSM takes a partnership and commitment to every client&#8217;s success, and I want to be involved in those BSM efforts in every industry or market worldwide. We need more thought leaders collaborating together in an open and public forum to change legacy attitudes about BSM and do what we can to enable client’s to be as successful as they can be.</p>
<p><a href="http://sharethis.com/item?&wp=abc&amp;publisher=ea11358c-69de-4e80-9804-e964a8930b70&amp;title=Q%26amp%3BA+with+Doug+McClure%3A+What+Makes+BSM+Successful%3F&amp;url=http%3A%2F%2Fblog.sciencelogic.com%2Fqa-with-doug-mcclure-what-makes-bsm-successful%2F07%2F2008">ShareThis</a></p>]]></content:encoded>
      <pubDate>Tue, 15 Jul 2008 15:02:39 +0000</pubDate>
      <category domain="http://securityratty.com/tag/management">management</category>
      <category domain="http://securityratty.com/tag/service management database">service management database</category>
      <category domain="http://securityratty.com/tag/management tools">management tools</category>
      <category domain="http://securityratty.com/tag/service management mentality">service management mentality</category>
      <category domain="http://securityratty.com/tag/business service management">business service management</category>
      <category domain="http://securityratty.com/tag/business service">business service</category>
      <category domain="http://securityratty.com/tag/business service impact">business service impact</category>
      <category domain="http://securityratty.com/tag/mission services management">mission services management</category>
      <category domain="http://securityratty.com/tag/database">database</category>
      <source url="http://blog.sciencelogic.com/qa-with-doug-mcclure-what-makes-bsm-successful/07/2008">Q&amp;A with Doug McClure: What Makes BSM Successful?</source>
    </item>
    <item>
      <title><![CDATA[Visualized Storm fireworks for your 4th of July]]></title>
      <link>http://securityratty.com/article/cd69cdbb404159575b86657784e007bb</link>
      <guid>http://securityratty.com/article/cd69cdbb404159575b86657784e007bb</guid>
      <description><![CDATA[As expected, the Storm botnet maestros have queued up some pwnage for your 4th of July
See the SANS diary for all the details
Upon receipt of my first fireworks.exe sample this evening, I went through...]]></description>
      <content:encoded><![CDATA[As expected, the Storm botnet maestros have queued up some pwnage for your 4th of July. <br />See the SANS <a href="http://isc.sans.org/diary.html?storyid=4669" target="_blank">diary</a> for all the details.<br />Upon receipt of my first fireworks.exe sample this evening, I went through the standard routine and ran it through the analysis mill. Like the ISC said, not much new here, but if you'd like the nitty-gritty, I've put the analysis report <a href="http://holisticinfosec.org/analysis/storm/fireworks/fireworks_storm.txt" target="_blank">here</a>, the peers config list <a href="http://holisticinfosec.org/analysis/storm/fireworks/peers.txt" target="_blank">here</a>, and the pcap <a href="http://holisticinfosec.org/analysis/storm/fireworks/fireworks.pcap" target="_blank">here</a>.<br />However, what I was really inspired to do this evening was visualize the pcap with Raffael Marty's AfterGlow. His new <a href="http://www.amazon.com/Applied-Security-Visualization-Raffael-Marty/dp/0321510100" target="_blank">book</a>, Applied Security Visualization, is coming out next month, so we can turn old Storm news into a celebration of the 4th and the pending release of Applied Security Visualization. By the way, Raffael's visualization workshop slides from the 20th Annual <a href="http://www.first.org/" target="_blank">FIRST</a> Conference in Vancouver, B.C. last week are <a href="http://www.secviz.org/content/applied-security-visualization-first-2008-talk" target="_blank">here</a>, and mine regarding Malcode Analysis for Incident Handlers are <a href="http://holisticinfosec.org/publications/McRee_MATFIH_FIRST_final.pdf" target="_blank">here</a>.<br />So, a little AfterGlow magic,<br /><span style="font-style:italic;">tcpdump -vttttnnelr /home/rmcree/pcap/fireworks.pcap | ./tcpdump2csv.pl "sip dip ttl" | perl ../graph/afterglow.pl -c /home/rmcree/afterglow/src/perl/graph/color.properties -p 2 | neato -Tgif -o fireworks.gif</span>, and the results look just like the fireworks we hoped they would. <br />Happy 4th of July everyone! <br />Except you Storm a$$hat$. ;-)<br /><br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://holisticinfosec.org/analysis/storm/fireworks/fireworks.gif" target="_blan"><img style="display:block; margin:0px auto 10px; text-align:center;cursor:pointer; cursor:hand;width: 320px;" src="http://holisticinfosec.org/analysis/storm/fireworks/fireworks.gif" border="0" alt="" /></a><br /><br /><a href="http://del.icio.us/post?url=http://holisticinfosec.blogspot.com/2008/07/visualized-storm-fireworks-for-your-4th.html&title=Visualized%20Storm%20fireworks%20for%20your%204th%20of%20July " title="Visualized Storm fireworks for your 4th of July ">del.icio.us</a> | <a href="http://digg.com/submit?phase=2&amp;url=http://holisticinfosec.blogspot.com/2008/07/visualized-storm-fireworks-for-your-4th.html" title="Visualized Storm fireworks for your 4th of July ">digg</a>]]></content:encoded>
      <pubDate>Thu, 03 Jul 2008 16:54:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/4th">4th</category>
      <category domain="http://securityratty.com/tag/fireworks">fireworks</category>
      <category domain="http://securityratty.com/tag/july">july</category>
      <category domain="http://securityratty.com/tag/security visualization">security visualization</category>
      <category domain="http://securityratty.com/tag/happy 4th">happy 4th</category>
      <category domain="http://securityratty.com/tag/peers config list">peers config list</category>
      <category domain="http://securityratty.com/tag/afterglow">afterglow</category>
      <category domain="http://securityratty.com/tag/visualization workshop slides">visualization workshop slides</category>
      <category domain="http://securityratty.com/tag/raffael marty">raffael marty</category>
      <source url="http://holisticinfosec.blogspot.com/2008/07/visualized-storm-fireworks-for-your-4th.html">Visualized Storm fireworks for your 4th of July</source>
    </item>
    <item>
      <title><![CDATA[Can you hear me now?]]></title>
      <link>http://securityratty.com/article/afde45737ad0a9346c45bdf544337ad3</link>
      <guid>http://securityratty.com/article/afde45737ad0a9346c45bdf544337ad3</guid>
      <description><![CDATA[Verizon released a very interesting Data Breach report that analyzes over 500 forensic reports on their system over a number of years. It is great work by Verizon to gather this data and to publish...]]></description>
      <content:encoded><![CDATA[<p>Verizon released a very interesting <a href="http://www.verizonbusiness.com/resources/security/databreachreport.pdf">Data Breach report</a> that analyzes over 500 forensic reports on their system over a number of years. It is great work by Verizon to gather this data and to publish it. Of course a consultant I go into lots of companies where they could learn a lot just by being more open and talking through issues with peers in other companies. Would be great to see other companies follow Verizon's lead.</p><br><div>I suggest you read their report, and I would like to add a little color to their findings from the perspective of the swamp I spend most of my time in - Web services security. Granted it is just one report, but the data run counter to a lot of conventional security "wisdom":</div><br><div><span style="color: #333333; font-size: 12px; line-height: normal; "><span style="text-decoration: underline;"><strong><blockquote><p>Who is behind data breaches? </p></blockquote></strong></span><blockquote><p>73% resulted from external sources<br>18% were caused by insiders <br>39% implicated business partners <br>30% involved multiple parties</p></blockquote></span><br></div><div>The internal/external divide is pretty silly these days, as is companies' recanting "inside the firewall and outside the firewall", I spend most of time hooking things up together precisely _so_ they intereoperate remotely. The firewall is a speed bump at best. At any rate external sources is a primary concern in Web services security, because - hey look our Web service front end just made your Mainframe/As400/Unix DB/ CICS/whatever accessible remotely. This is great from a functionality standpoint, but the issue is that these back end systems were never designed with anything remotely resembling an Internet threat model. Additionally, the Verizon team's findings around business parties and multiple parties strikes at the heart of a number of popular misconceptions in Web services security - "well its just B2B and its behind a firewall."</div><br><br><div><span style="color: #333333; font-size: 12px; line-height: normal; "><span style="text-decoration: underline;"><strong><blockquote><p>How do breaches occur? </p></blockquote></strong></span><blockquote><p><br>62% were attributed to a significant error</p></blockquote><blockquote><p>59% resulted from hacking and intrusions  </p></blockquote><blockquote><p>31% incorporated malicious code </p></blockquote><blockquote><p>22% exploited a vulnerability <br>15% were due to physical threats </p></blockquote></span><br></div><div><span style="color: #333333; font-family: helvetica; font-size: 12px; line-height: normal;">A couple of things to note here - malicious code in my opinion is likely to be the biggest problem in Web services security going forward. There is a large gap waiting to be exploited here. You have no control over the other end of the pipe plus a massive attack surface, the only thing lacking is the attacker's ability to find and exploit which I strongly suspect is just a matter of time. Wrt hacking an intrusions we have the remote, passive nature of web security to blame here in Web services world. Paraphrasing </span><span style="color: #333333; font-size: 12px; line-height: normal; "><a href="http://www.aspectsecurity.com/">Jeff Williams</a></span><span style="color: #333333; font-family: helvetica; font-size: 12px; line-height: normal;">, the problem is that an attacker can just try an attack if it doesn't work, try again, again, and so on. This partially because of the loosely coupled nature of the systems, but it is also because </span><span style="color: #333333; font-size: 12px; line-height: normal; "><a href="http://1raindrop.typepad.com/1_raindrop/2008/06/mashup-of-the-titans.html">commonly used information security protocols have diverged from reality</a></span><span style="color: #333333; font-family: helvetica; font-size: 12px; line-height: normal;"> are modeled using an object-centric mentality, where you "own" the object you are protecting and can afford to put passive controls around.</span></div><div><span style="color: #333333; font-family: helvetica; font-size: 12px; line-height: normal;"><br></span></div><div><span style="color: #333333; font-size: 12px; line-height: normal; "><span style="text-decoration: underline;"><strong><blockquote><p>What commonalities exist? </p></blockquote></strong></span><blockquote><p><br>66%  involved data the victim did not know was on the system<br>75%  of breaches were not discovered by the victim  <br>83%  of attacks were not highly difficult <br>85%  of breaches were the result of opportunistic attacks <br>87%  were considered avoidable through reasonable controls </p></blockquote></span></div><div><span style="color: #333333; font-family: helvetica; font-size: 12px; line-height: normal;">Many of the attacks against Web Services are not difficult, in my </span><span style="color: #333333; font-size: 12px; line-height: normal; "><a href="http://arctecgroup.net/training.htm">training class</a></span><span style="color: #333333; font-family: helvetica; font-size: 12px; line-height: normal;">, we'll typically execute 8-10 different attacks in a two day period. But the big one from this list is the first one - the amazing amount of attack surface offered up by Web services. </span><span style="color: #333333; font-size: 12px; line-height: normal; "><a href="http://isecpartners.com/">Brad Hill</a></span><span style="color: #333333; font-family: helvetica; font-size: 12px; line-height: normal;"> has done a good job articulating these issues in SOAP/XML/WS-*, but at an enterprise its even bigger than those standards - the thing is we use Web services to make stuff interoperate, to make stuff reusable, and to virtualize endpoints. Great stuff if what you want to do is decentralize your business, but this creates oceans of space for attackers to roam. When you look beyond the Visio and the IDE view of web services, and get to the runtime there is an amazing amount of detritus left behind by all these layers.</span></div><div><span style="color: #333333; font-family: helvetica; font-size: 12px; line-height: normal;"><br></span></div><div><span style="color: #333333; font-family: helvetica; font-size: 12px; line-height: normal;"><br></span></div><div><span style="color: #333333; font-family: helvetica; font-size: 12px; line-height: normal;"><br></span></div>]]></content:encoded>
      <pubDate>Fri, 27 Jun 2008 06:56:10 +0000</pubDate>
      <category domain="http://securityratty.com/tag/web services">web services</category>
      <category domain="http://securityratty.com/tag/web services world">web services world</category>
      <category domain="http://securityratty.com/tag/web services security">web services security</category>
      <category domain="http://securityratty.com/tag/data breach report">data breach report</category>
      <category domain="http://securityratty.com/tag/report">report</category>
      <category domain="http://securityratty.com/tag/attack">attack</category>
      <category domain="http://securityratty.com/tag/massive attack surface">massive attack surface</category>
      <category domain="http://securityratty.com/tag/companies follow verizon">companies follow verizon</category>
      <category domain="http://securityratty.com/tag/data">data</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/06/can-you-hear-me-now.html">Can you hear me now?</source>
    </item>
  </channel>
</rss>
