<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: complaints]]></title>
    <link>http://securityratty.com/tag/complaints</link>
    <description></description>
    <pubDate>Tue, 29 Jul 2008 20:00:00 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Another link spammer]]></title>
      <link>http://securityratty.com/article/4dd72baf5933c49893c38cadde935c82</link>
      <guid>http://securityratty.com/article/4dd72baf5933c49893c38cadde935c82</guid>
      <description><![CDATA[Yet another link spammer is cluttering up my in-box. Youd think that after exposing this one , and this one , and this one , theyd know better
The latest set of miscreants operates under the brand...]]></description>
      <content:encoded><![CDATA[<p>Yet another link spammer is cluttering up my in-box. You&#8217;d think that after exposing <a href="http://www.lightbluetouchpaper.org/2007/01/07/human-rights-and-biophysics-strange-similarities/">this one</a>, and <a href="http://www.lightbluetouchpaper.org/2007/08/30/the-interns-of-privila/">this one</a>, and <a href="http://www.lightbluetouchpaper.org/2007/12/20/fatal-wine-waiters/">this one</a>, they&#8217;d know better.</p>
<p>The latest set of miscreants operates under the brand &#8220;<a href="http://www.goodeyeforlinks.com" rel="nofollow">goodeyeforlinks.com</a>&#8221; and claim to &#8220;use white hat SEO techniques in order to get high quality, do-follow links to your website&#8221;. They also claim to be &#8220;professional&#8221; which in this case must mean you pay for their services, since sending out bulk unsolicited email is anything but professional.</p>
<p>Nevertheless, although their long term aim may indeed be to make money from legitimate, albeit foolish, businesses seeking a higher profile, the sites they have been promoting so far are anything but legitimate. In fact they&#8217;ve been fake sites covered with Google adverts (so-called &#8220;<a href="http://www.sabahan.com/2006/06/26/how-mfa-made-for-adsense-sites-make-money/">Made for AdSense</a>&#8221; (MFA) sites).</p>
<p>They started by asking me to link to &#8220;<a href="http://www.entovation.net" rel="nofollow">entovation.net</a>&#8221; which they claim is &#8220;page rank 3&#8243;. In fact it is page rank 3 (!) and a blatant copy of <a href="http://www.acentesolutions.com/">http://www.acentesolutions.com</a> which appears entirely genuine (albeit only page rank 1). They have also been promoting &#8220;<a href="http://www.poland-translation-services.com" rel="nofollow">poland-translation-services.com</a>&#8220;, which claims to be a site offering &#8220;A large team of 2,500 translators specializing in each sector, located in over 30 countries&#8221; &#8230;</p>
<p>However, this site is clearly fake as well. I haven&#8217;t tracked down where it all comes from, but much of <a href="http://poland-translation-services.com/Translate-a-Document.html" rel="nofollow">this page</a> comes from <a href="http://www.intowords.com.ar/espanol/traducciones/traducciones-de-espanol-ingles.html">this Argentinian page</a>, the text of which has been pushed through <a href="http://www.google.com/language_tools?hl=en">Google&#8217;s Spanish to English translation tools</a>&#8230;  which sadly (for example) renders </p>
<blockquote><p>
Comentarios: Se considera foja al equivalente a 500 palabras. Si el documento a traducir es menor a una foja, se lo considerará como una foja.
</p></blockquote>
<p>into </p>
<blockquote><p>
Comments: foja is considered the equivalent of 500 words. If the document is translated to a lesser foja, we will consider as a foja.
</p></blockquote>
<p>which makes the 2500 translators look more than a little bit <a href="http://www.cartoonbank.com/item/124224">foolish</a>!</p>
<p>The fake websites are hosted by <a href="http://www.euroaccess.nl/">EuroAccess Enterprises Ltd.</a> in The Netherlands (which is also where the email spam has been sent from). I&#8217;m not alone in receiving this type of email, further examples can be found <a href="http://archives.neohapsis.com/archives/openbsd/2008-09/1548.html">here</a>, and <a href="http://www.projecthoneypot.org/ip_89.248.172.66">here</a>, and <a href="http://dansdata.blogsome.com/2008/10/16/i-do-like-a-good-link-spam-in-the-morning/">here</a>, and <a href="http://avvoblog.com/2008/11/10/linkbrokers-gone-wild/">here</a>, and <a href="http://www.nabble.com/Link-exchange-with-page-rank-4--Hotel-site-td19973368.html">here</a>, and <a href="http://www.allvoices.com/contributed-news/1522559">here</a>, and even <a href="http://blogpintura.wordpress.com/#comment-5">here (in Spanish)</a>.</p>
<p>EuroAccess have a fine ticketing system for abuse complaints&#8230; so I&#8217;m able to keep track of what they&#8217;re doing about my emails drawing their attention to the fraudsters they are hosting. I am therefore fully aware that they&#8217;ve so far marked my missives as &#8220;Priority: Low&#8221;, and nothing else is recorded to have been done&#8230; However, the tickets are still &#8220;Status: Open&#8221;, so perhaps a little publicity will encourage them to reassess their prioritisation.</p>
]]></content:encoded>
      <pubDate>Sun, 23 Nov 2008 16:45:45 +0000</pubDate>
      <category domain="http://securityratty.com/tag/argentinian page">argentinian page</category>
      <category domain="http://securityratty.com/tag/page">page</category>
      <category domain="http://securityratty.com/tag/foja">foja</category>
      <category domain="http://securityratty.com/tag/lesser foja">lesser foja</category>
      <category domain="http://securityratty.com/tag/page rank">page rank</category>
      <category domain="http://securityratty.com/tag/considera foja">considera foja</category>
      <category domain="http://securityratty.com/tag/link spammer">link spammer</category>
      <category domain="http://securityratty.com/tag/link">link</category>
      <category domain="http://securityratty.com/tag/fake">fake</category>
      <source url="http://www.lightbluetouchpaper.org/2008/11/23/another-link-spammer/">Another link spammer</source>
    </item>
    <item>
      <title><![CDATA[U.S. Identity Theft Convictions Up 26 Percent, Feds Say]]></title>
      <link>http://securityratty.com/article/8effc53290bf452ab9e1e5fc78993d06</link>
      <guid>http://securityratty.com/article/8effc53290bf452ab9e1e5fc78993d06</guid>
      <description><![CDATA[Identity theft convictions in the United States increased 26 percent in 2007 from the year before, the Bush administration reported Tuesday. Still, 1.6 million complaints of identity theft are on file...]]></description>
      <content:encoded><![CDATA[Identity theft convictions in the United States increased 26 percent in 2007 from the year before, the Bush administration reported Tuesday. Still, 1.6 million complaints of identity theft are on file with the Federal Trade Commission.<br style="clear: both;"/>
  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=214c05d548f8bdf94975062dfd72c424" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=214c05d548f8bdf94975062dfd72c424" style="display: none;" border="0" height="1" width="1" alt=""/><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=IA9wM"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=IA9wM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=FGLZm"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=FGLZm" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=yeixm"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=yeixm" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=DbrZM"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=DbrZM" border="0"></img></a>
 <a href="http://feeds.wired.com/~f/wired/politics/security?a=8aWoM"><img src="http://feeds.wired.com/~f/wired/politics/security?i=8aWoM" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=AVICm"><img src="http://feeds.wired.com/~f/wired/politics/security?i=AVICm" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=2dawm"><img src="http://feeds.wired.com/~f/wired/politics/security?i=2dawm" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=fDvTM"><img src="http://feeds.wired.com/~f/wired/politics/security?i=fDvTM" border="0"></img></a> </div><img src="http://feeds.feedburner.com/~r/wired/politics/privacy/~4/427856309" height="1" width="1"/><img src="http://feeds.wired.com/~r/wired/politics/security/~4/427856311" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 21 Oct 2008 14:44:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/identity theft convictions">identity theft convictions</category>
      <category domain="http://securityratty.com/tag/identity theft">identity theft</category>
      <category domain="http://securityratty.com/tag/federal trade commission">federal trade commission</category>
      <category domain="http://securityratty.com/tag/bush administration">bush administration</category>
      <category domain="http://securityratty.com/tag/percent">percent</category>
      <category domain="http://securityratty.com/tag/million complaints">million complaints</category>
      <category domain="http://securityratty.com/tag/file">file</category>
      <category domain="http://securityratty.com/tag/tuesday">tuesday</category>
      <source url="http://feeds.wired.com/~r/wired/politics/security/~3/427856311/us-identity-the.html">U.S. Identity Theft Convictions Up 26 Percent, Feds Say</source>
    </item>
    <item>
      <title><![CDATA[Antispyware Program Becomes the Problem]]></title>
      <link>http://securityratty.com/article/293227f0e73cede59dbfbac5018fc20f</link>
      <guid>http://securityratty.com/article/293227f0e73cede59dbfbac5018fc20f</guid>
      <description><![CDATA[My PC became infected by a Trojan horse that produced constant pop-ups about spyware threats and offers to get rid of them with a $30 product called WinSpywareProtect, sold on a site of the same name....]]></description>
      <content:encoded><![CDATA[My PC became infected by a Trojan horse that produced constant pop-ups about spyware threats and offers to get rid of them with a $30 product called WinSpywareProtect, sold on a site of the same name. I bought it, in part because the site had PC World's Best Buy logo. But when a Web search revealed dozens of complaints about this software, I requested a refund. I am writing to you since your logo was apparently used fraudulently, and also to see if you can recommend a legitimate antispyware program that will remove this monster from my computer.]]></content:encoded>
      <pubDate>Sun, 07 Sep 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/antispyware program">antispyware program</category>
      <category domain="http://securityratty.com/tag/trojan horse">trojan horse</category>
      <category domain="http://securityratty.com/tag/logo">logo</category>
      <category domain="http://securityratty.com/tag/site">site</category>
      <category domain="http://securityratty.com/tag/constant pop-ups">constant pop-ups</category>
      <category domain="http://securityratty.com/tag/spyware threats">spyware threats</category>
      <category domain="http://securityratty.com/tag/remove">remove</category>
      <category domain="http://securityratty.com/tag/complaints">complaints</category>
      <category domain="http://securityratty.com/tag/recommend">recommend</category>
      <source url="http://www.networkworld.com/news/2008/090808-antispyware-program-becomes-the.html?fsrc=rss-security">Antispyware Program Becomes the Problem</source>
    </item>
    <item>
      <title><![CDATA[A Costly Crush]]></title>
      <link>http://securityratty.com/article/cafa2263c602a0dce807786d68e28098</link>
      <guid>http://securityratty.com/article/cafa2263c602a0dce807786d68e28098</guid>
      <description><![CDATA[I've seen a few blog posts over the last couple of days, with people complaining about an application on Facebook charging them crazy amounts of money. Certainly, there's a lot of angry Facebook users...]]></description>
      <content:encoded><![CDATA[
        I've seen a few <a href="http://www.sokhodom.com/2008-09-02-bad-facebook-application-lead-to-heavy-phone-bill/">blog posts</a> over the last couple of days, with people complaining about an application on Facebook charging them crazy amounts of money. Certainly, there's a lot of angry Facebook users out there:<br /><br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/crushtracker01.html" onclick="window.open('http://blog.spywareguide.com/images/crushtracker01.html','popup','width=387,height=448,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/crushtracker0-thumb-287x332.gif" alt="crushtracker0.gif" class="mt-image-none" style="" height="332" width="287" /></a></span>
<br />Click to Enlarge<br /></div><br />Some more complaints? Sure, I can do that:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="hugecrush1.gif" src="http://blog.spywareguide.com/images/hugecrush1.gif" class="mt-image-none" style="" height="347" width="309" /></span></div><br /><br /><div align="left">There are many, many more like the above comments out there. One slight problem with all of this is that the complaints are scattered across a whole range of different Crush application forums - in short, they're <i>all</i> being blamed, but they can't <i>all</i> be doing this, can they? What's the alternative, though?<br /><br />A short while ago, I wrote about <a href="http://blog.spywareguide.com/2008/07/interesting-advert-placements.html">deceptive advert placements</a> with regards another facebook application. It seems we have a similar situation here, where an "enterprising" Ad network is placing Facebook-style buttons onto installer pages and hoping people will be fooled. As it turns out, it seems to be working. While attempting to install one randomly selected Crush application, I noticed the following advert at the top of the installer splash (highlighted in red):<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/hugecrush3.html" onclick="window.open('http://blog.spywareguide.com/images/hugecrush3.html','popup','width=660,height=320,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/hugecrush3-thumb-360x174.gif" alt="hugecrush3.gif" class="mt-image-none" style="" height="174" width="360" /></a></span><br />Click to Enlarge<br /></div><br />It's easy to imagine a regular Facebook user thinking this is part of the application install and clicking "Ok". Do that, and you're taken to a site called Amazingchat(dot)net that throws up a fake message regarding you having "7 New Crush Messages" (and uses geolocational technology to point a targeted message your way). If you look like you're in the UK, you'll see this:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/hugecrush41.html" onclick="window.open('http://blog.spywareguide.com/images/hugecrush41.html','popup','width=662,height=404,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/hugecrush4-thumb-362x220.gif" alt="hugecrush4.gif" class="mt-image-none" style="" height="220" width="362" /></a></span><br />Click to Enlarge<br /></div><br />Wow, FOUR of my (fake and non-existent) messages are from Sheffield! How about if I look like I'm in the States? You've guessed it....<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="hugecrush5.gif" src="http://blog.spywareguide.com/images/hugecrush5.gif" class="mt-image-none" style="" height="42" width="318" /></span></div>
<br /><br />Windy City, here I come!<br /><br />Not. It's looking promising so far, though. If we can just go to the next screen and see something utterly useless advertised in exchange for lots of money....<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/hugecrush666.html" onclick="window.open('http://blog.spywareguide.com/images/hugecrush666.html','popup','width=552,height=371,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/hugecrush666-thumb-352x236.gif" alt="hugecrush666.gif" class="mt-image-none" style="" height="236" width="352" /></a></span><br />Click to Enlarge<br /></div><br />Horoscopes for only ?9 / $15 a week? WOW!<br /><br />Also, there go your savings.<br /><br />Could this be the site at the heart of so many complaints? Well, let's quickly check who runs it...<br /><br /><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="hugecrush7.gif" src="http://blog.spywareguide.com/images/hugecrush7.gif" class="mt-image-none" style="" height="140" width="587" /></span><br /><br />"Sms-helpdesk", eh? I do believe I've seen a <a href="http://www.facebook.com/topic.php?uid=4874299673&amp;topic=3908">long thread</a> concerning people having issues with large bills for phone messages. Indeed, a rep from sms-helpdesk actually appears to be posting there:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="hugecrush8.gif" src="http://blog.spywareguide.com/images/hugecrush8.gif" class="mt-image-none" style="" height="479" width="370" /></span></div><br /><br />Shame it seems some people can't even get through to the supposed helpline. Perhaps "Denise" would be better off tackling the deceptive placement of adverts made to look like installer buttons, not to mention non-existent crush messages based around geolocational targeting?<br /><br />Just a thought...<br /></div>
        
    ]]></content:encoded>
      <pubDate>Tue, 02 Sep 2008 11:24:54 +0000</pubDate>
      <category domain="http://securityratty.com/tag/application">application</category>
      <category domain="http://securityratty.com/tag/facebook application">facebook application</category>
      <category domain="http://securityratty.com/tag/crush application">crush application</category>
      <category domain="http://securityratty.com/tag/facebook">facebook</category>
      <category domain="http://securityratty.com/tag/application install">application install</category>
      <category domain="http://securityratty.com/tag/regular facebook user">regular facebook user</category>
      <category domain="http://securityratty.com/tag/crush application forums">crush application forums</category>
      <category domain="http://securityratty.com/tag/angry facebook users">angry facebook users</category>
      <category domain="http://securityratty.com/tag/crush messages">crush messages</category>
      <source url="http://blog.spywareguide.com/2008/09/a-costly-crush.html">A Costly Crush</source>
    </item>
    <item>
      <title><![CDATA[Target Web Sites Sued for Being Inaccessible to Blind Students]]></title>
      <link>http://securityratty.com/article/db1104fd2c965daf57df168d1460857f</link>
      <guid>http://securityratty.com/article/db1104fd2c965daf57df168d1460857f</guid>
      <description><![CDATA[I fully support peoples civil rights and freedoms, and regulations that help people with disabilities survive and succeed in society. Still, I sometimes wonder if certain things can go a bit too far....]]></description>
      <content:encoded><![CDATA[<p>I fully support people&#8217;s civil rights and freedoms, and regulations that help people with disabilities survive and succeed in society. Still, I sometimes wonder if certain things can go a bit too far. Recently, a blind student sued the retailer giant Target for having a web site that couldn&#8217;t be parsed by his special reader&#8230;and won, even though no regulations actually exist to control the accessibility of web site content&#8230;</p>
<blockquote><p>Target has settled a class action lawsuit with the National Federation of the Blind over accessibility complaints with Target.com. Despite the law being unclear as to whether the Americans with Disabilities Act (ADA) applies to websites, the company will pay a substantial fee and update its web site to make it accessible to the blind.</p>
<p>In February 2006, Bruce Sexton Jr., a student at the University of California-Berkeley and president of the California Association of Blind Students, sued Target because its web site was inaccessible to the blind. Filed in conjunction with the National Federation of the Blind, the suit was used as to spotlight many corporate sites that don&#8217;t play well—if at all—with screen reading technology.</p></blockquote>
<p>Read the <a rel="nofollow" target="_blank" href="http://arstechnica.com/news.ars/post/20080828-target-to-pay-6-million-to-settle-site-accessibility-suit.html">full article here.</a></p>]]></content:encoded>
      <pubDate>Thu, 28 Aug 2008 09:33:49 +0000</pubDate>
      <category domain="http://securityratty.com/tag/blind">blind</category>
      <category domain="http://securityratty.com/tag/blind students">blind students</category>
      <category domain="http://securityratty.com/tag/target">target</category>
      <category domain="http://securityratty.com/tag/web site">web site</category>
      <category domain="http://securityratty.com/tag/web site content">web site content</category>
      <category domain="http://securityratty.com/tag/blind student sued">blind student sued</category>
      <category domain="http://securityratty.com/tag/retailer giant target">retailer giant target</category>
      <category domain="http://securityratty.com/tag/sued target">sued target</category>
      <category domain="http://securityratty.com/tag/national federation">national federation</category>
      <source url="http://feeds.feedburner.com/~r/itsecurity/~3/377461325/">Target Web Sites Sued for Being Inaccessible to Blind Students</source>
    </item>
    <item>
      <title><![CDATA[Monitoring P2P Networks]]></title>
      <link>http://securityratty.com/article/e2525ed966d30506e3fee3375e62db16</link>
      <guid>http://securityratty.com/article/e2525ed966d30506e3fee3375e62db16</guid>
      <description><![CDATA[Interesting paper: &quot; Challenges and Directions for Monitoring P2P File Sharing Networks or Why My Printer Received a DMCA Takedown Notice &quot;: Abstract -- We reverse engineer copyright enforcement in...]]></description>
      <content:encoded><![CDATA[<p>Interesting paper: "<a href="http://dmca.cs.washington.edu/dmca_hotsec08.pdf">Challenges and Directions for Monitoring P2P File Sharing Networks or Why My Printer Received a DMCA Takedown Notice</a>":</p>

<blockquote>Abstract -- We reverse engineer copyright enforcement in the popular BitTorrent file sharing network and find that a common approach for identifying infringing users is not conclusive. We describe simple techniques for implicating arbitrary network endpoints in illegal content sharing and demonstrate the effectiveness of these techniques experimentally, attracting real DMCA complaints for nonsense devices, e.g., IP printers and a wireless access point. We then step back and evaluate the challenges and possible future directions for pervasive monitoring in P2P file sharing networks.</blockquote>

<p><a href="http://dmca.cs.washington.edu/">Webpage</a> on the research.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=puuvpK"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=puuvpK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=3GKIiK"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=3GKIiK" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Fri, 22 Aug 2008 08:08:57 +0000</pubDate>
      <category domain="http://securityratty.com/tag/network">network</category>
      <category domain="http://securityratty.com/tag/describe simple techniques">describe simple techniques</category>
      <category domain="http://securityratty.com/tag/networks">networks</category>
      <category domain="http://securityratty.com/tag/techniques">techniques</category>
      <category domain="http://securityratty.com/tag/p2p file">p2p file</category>
      <category domain="http://securityratty.com/tag/arbitrary network endpoints">arbitrary network endpoints</category>
      <category domain="http://securityratty.com/tag/dmca takedown notice">dmca takedown notice</category>
      <category domain="http://securityratty.com/tag/popular bittorrent file">popular bittorrent file</category>
      <category domain="http://securityratty.com/tag/real dmca complaints">real dmca complaints</category>
      <source url="http://www.schneier.com/blog/archives/2008/08/monitoring_p2p.html">Monitoring P2P Networks</source>
    </item>
    <item>
      <title><![CDATA[Beware of Rogue Anti-Malware]]></title>
      <link>http://securityratty.com/article/56bc0c383527b10009c2841b8cf095c1</link>
      <guid>http://securityratty.com/article/56bc0c383527b10009c2841b8cf095c1</guid>
      <description><![CDATA[Rogue anti-virus and anti-spyware products are not a new story, but they are a relatively growing threat. One of these threats made some news this week and taught some lessons about just how...]]></description>
      <content:encoded><![CDATA[Rogue anti-virus and anti-spyware products are not a new story, but they are a relatively growing threat. One of these threats made some news this week and taught some lessons about just how suspicious you have to be of them.

We had heard of <i>XP Antivirus</i>&#151;also known by a plethora of name variants, including <i>Antivirus XP</i> and year variants like <i>Antivirus XP 2008</i>. <a href="http://research.sunbelt-software.com/threatdisplay.aspx?name=Antivirus XP 2008 (Winifixer)&threatid=310434"target="_blank">Click here for a description from Sunbelt Software.</a> Last week, <a href="http://blogs.pcmag.com/securitywatch/2008/08/googlesyndicated_malware_ads_h.php"target="_blank">advertisements for this product started appearing on CNET</a> (specifically their Download.com service) through syndicated Google ads. Not to pick on CNET specifically; Google ads are likely to be appearing elsewhere, but we were referred to them on that site.

The hallmark of such malware is to start with a free version. This version conducts a fake malware scan that finds lots of malware on the system, and the user is told to pay for the "premium" version in order to remove the malware that doesn't really exist in the first place. Often rogue anti-malware software such as this is not strictly malicious in the sense of spreading itself to other systems or hiding any functions; it is simply a scam. Of course, by buying the product you may also expose personal and credit card details to untrustworthy people.

Later last week, GlobalSign, the certificate authority that had issued a code signing certificate for use with Antivirus XP 2008, <a href="http://www.theregister.co.uk/2008/08/16/certified_malware/"target="_blank">revoked that certificate after complaints that the software was malicious</a>. They verified that the company existed but couldn't contact them. The investigation is ongoing.

The bottom line and moral of the story is that rogue anti-malware vendors are merciless and shameless when it comes to masquerading as legit software. Ads on legit sites don't prove anything, and code-signing certificates don't prove anything. You still need to use common sense and exercise precautions, like running well-known and respected anti-malware, like Sunbelt Software's. They have a lot of special in-house expertise on rogue products like this.<img src="http://feedproxy.google.com/~r/RSS/cheap_hack/~4/r_W79eeC5GM" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 18 Aug 2008 06:16:04 +0000</pubDate>
      <category domain="http://securityratty.com/tag/anti-malware">anti-malware</category>
      <category domain="http://securityratty.com/tag/rogue anti-malware vendors">rogue anti-malware vendors</category>
      <category domain="http://securityratty.com/tag/legit software">legit software</category>
      <category domain="http://securityratty.com/tag/software">software</category>
      <category domain="http://securityratty.com/tag/sunbelt software">sunbelt software</category>
      <category domain="http://securityratty.com/tag/malware">malware</category>
      <category domain="http://securityratty.com/tag/rogue anti-malware software">rogue anti-malware software</category>
      <category domain="http://securityratty.com/tag/fake malware scan">fake malware scan</category>
      <category domain="http://securityratty.com/tag/google ads">google ads</category>
      <source url="http://feeds.ziffdavisenterprise.com/~r/RSS/cheap_hack/~3/r_W79eeC5GM/beware_of_rogue_antimalware_1.html">Beware of Rogue Anti-Malware</source>
    </item>
    <item>
      <title><![CDATA[Corporate Identity Theft]]></title>
      <link>http://securityratty.com/article/57c21b4d57a8ae63a7ec8f43043877e8</link>
      <guid>http://securityratty.com/article/57c21b4d57a8ae63a7ec8f43043877e8</guid>
      <description><![CDATA[I remember a talk by the value investor Mason Hawkins (Longleaf Funds) where someone asked him about investing overseas. He answered that he does, but mainly in places where the British flag flew at...]]></description>
      <content:encoded><![CDATA[<p>I remember a <a href="http://www.bengrahaminvesting.ca/Resources/videos.htm#hawkins">talk</a>&#160;by the value investor&#160;<a href="http://en.wikipedia.org/wiki/Mason_Hawkins">Mason Hawkins</a>&#160;(Longleaf Funds) where someone asked him about investing overseas. He answered that he does, but mainly in places where the British flag flew at some point, where there is a rule of law. Here is one example of what he is worried about and why investing in places where your assets have no legal protection does not give the investor a margin of safety.</p><div>Hermitage Fund was until recently the largest fund in Russia. From the Business Week story<a href="http://hermitagefund.com/index.pl/news/article.html?id=895"> &quot;Hijacking the Hermitage Fund&quot;</a></div><br /><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p>Corruption, intimidation, robbery, violent assault, forgery, large-scale fraud. No, not the subject of the latest John Grisham novel, but sensational allegations, made public Apr. 4 by Hermitage Capital Management -- until recently the largest foreign portfolio investor in Russia. In a detailed and damning report, titled Criminal Justice -- Russian-Style, Hermitage alleges the fund&#39;s Russian subsidiaries have fallen victim to an elaborate con designed to defraud the fund of hundreds of millions of dollars.&#160;<br />&#160;&#160;<br />The most sensational part of Hermitage&#39;s allegations is that the attempted larceny was carried out with the direct connivance of officials in the Russian police. Hermitage alleges the police seized documents and equipment that were instrumental to the attempted fraud, which involved bogus court cases based on forged documents, the aim of which was to sue Hermitage subsidiaries for hundreds of millions of dollars. &quot;The most shocking thing is not that there are corporate raiders in Russia who attempt to steal your shares,&quot; says Jamison Firestone, managing partner of Firestone Duncan, Hermitage&#39;s law firm. &quot;The shocking thing is that the police worked hand-in-hand with them, and actually performed the theft of the documents so that the corporate raiders could then do their work.&quot;</p></blockquote><div><br /><div>From the most recent Hermitage Fund letter, here is the current state:</div><br /><br /></div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p>So the two-pronged scam worked in one area and failed in another. The perpetrators weren’t able to steal the assets from us based on the fake court claims, but they were able to steal $230 million from the Russian government by filing amended tax returns on behalf of our stolen companies. What makes this story even more shocking is that we filed six 255-page criminal complaints with the Russian authorities in December last year, one month before the tax fraud took place, and they did nothing to stop it. Two complaints were sent to the Russian General Prosecutor, two to the Russian State Investigative Committee and two to the Internal Affairs Department of the Interior Ministry. There was enough information to prevent the fraud and indict a number of people behind it if the government had acted.&#160;</p><p>Instead of doing anything to save the Russian state from this highly sophisticated and organized looting, two of our complaints were thrown out immediately; two were returned to the same Interior Ministry official we were complaining about (essentially, he was being asked to “investigate himself”); and one was thrown out for “lack of any crime committed.” Only one complaint was taken seriously. It was taken up by the Russian State Investigative Committee in early February, but before it could get any traction, the case was lowered to the South region of the Moscow district of the State Investigative Committee (the lowest level of the Committee) and by June, another senior Interior Ministry official whom we had named in our complaint had joined the “investigation” team (again, to “investigate himself”). To this day there has been no serious response by the Russian authorities to this massive fraud against the Russian state.&#160;</p><p>As we described in our April letter, the problem of corporate “raiding” is now so endemic in Russia that President Medvedev speaks about it as one of the biggest problems faced by Russian businesses. In this case, raiders have taken this problem to a new and absurd extreme by “raiding” the Russian state itself and so far getting away with it. Together with HSBC, we will shortly be filing new criminal complaints with the Russian General Prosecutor and Russian State Investigative Committee as well as with many law enforcement authorities outside of Russia. It is hard to predict what will happen next in this unfolding and unbelievable saga, but as always we will keep you updated on any further developments as they arise.</p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><br /></blockquote><p>Of course we see individual identity theft on a regular basis (actually as Ross Anderson points out its not really identity theft but poor controls on the bank&#39;s parts using SSNs as secrets and so on), but you dont see a major corporation stolen every day.</p>]]></content:encoded>
      <pubDate>Sat, 16 Aug 2008 05:58:30 +0000</pubDate>
      <category domain="http://securityratty.com/tag/russian police">russian police</category>
      <category domain="http://securityratty.com/tag/police">police</category>
      <category domain="http://securityratty.com/tag/russian">russian</category>
      <category domain="http://securityratty.com/tag/russian government">russian government</category>
      <category domain="http://securityratty.com/tag/government">government</category>
      <category domain="http://securityratty.com/tag/identity theft">identity theft</category>
      <category domain="http://securityratty.com/tag/russian-style">russian-style</category>
      <category domain="http://securityratty.com/tag/hermitage">hermitage</category>
      <category domain="http://securityratty.com/tag/fund">fund</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/08/corporate-identity-theft.html">Corporate Identity Theft</source>
    </item>
    <item>
      <title><![CDATA[British UFO Hacker Gary McKinnon Is Coming to America]]></title>
      <link>http://securityratty.com/article/61b47499d37c69d1cbd158944a7ab63f</link>
      <guid>http://securityratty.com/article/61b47499d37c69d1cbd158944a7ab63f</guid>
      <description><![CDATA[The House of Lords shoots down the final appeal of a British hacker who penetrated U.S. military computers looking for a UFO coverup, despite his complaints that he might be sent to...]]></description>
      <content:encoded><![CDATA[The House of Lords shoots down the final appeal of a British hacker who penetrated U.S. military computers looking for a UFO coverup, despite his complaints that he might be sent to Guantanamo.<br style="clear: both;"/>
  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=046222e84aad163f71704214d3c3c9d7" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=046222e84aad163f71704214d3c3c9d7" style="display: none;" border="0" height="1" width="1" alt=""/><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=vCmvyJ"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=vCmvyJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=wMJuZj"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=wMJuZj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=hTZgdj"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=hTZgdj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=MYijfJ"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=MYijfJ" border="0"></img></a>
 <a href="http://feeds.wired.com/~f/wired/politics/security?a=7GB8oJ"><img src="http://feeds.wired.com/~f/wired/politics/security?i=7GB8oJ" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=uugmhj"><img src="http://feeds.wired.com/~f/wired/politics/security?i=uugmhj" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=Qz4CZj"><img src="http://feeds.wired.com/~f/wired/politics/security?i=Qz4CZj" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=lbR8iJ"><img src="http://feeds.wired.com/~f/wired/politics/security?i=lbR8iJ" border="0"></img></a> </div><img src="http://feeds.feedburner.com/~r/wired/politics/privacy/~4/350857130" height="1" width="1"/><img src="http://feeds.wired.com/~r/wired/politics/security/~4/350857136" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 30 Jul 2008 15:33:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/lords shoots">lords shoots</category>
      <category domain="http://securityratty.com/tag/military computers">military computers</category>
      <category domain="http://securityratty.com/tag/final appeal">final appeal</category>
      <category domain="http://securityratty.com/tag/ufo coverup">ufo coverup</category>
      <category domain="http://securityratty.com/tag/british hacker">british hacker</category>
      <category domain="http://securityratty.com/tag/house">house</category>
      <category domain="http://securityratty.com/tag/complaints">complaints</category>
      <category domain="http://securityratty.com/tag/guantanamo">guantanamo</category>
      <source url="http://feeds.wired.com/~r/wired/politics/security/~3/350857136/british-ufo-hac.html">British UFO Hacker Gary McKinnon Is Coming to America</source>
    </item>
    <item>
      <title><![CDATA[FBI warns of new Storm Worm attacks]]></title>
      <link>http://securityratty.com/article/194f5fb83e037653d07ec3faf97667b2</link>
      <guid>http://securityratty.com/article/194f5fb83e037653d07ec3faf97667b2</guid>
      <description><![CDATA[A rash of complaints prompted the FBI to issue a warning of a new round of spam e-mails bombarding the Internet to spread the malicious Storm...]]></description>
      <content:encoded><![CDATA[A rash of complaints prompted the FBI to issue a warning of a new round of spam e-mails bombarding the Internet to spread the malicious Storm Worm.]]></content:encoded>
      <pubDate>Tue, 29 Jul 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/malicious storm worm">malicious storm worm</category>
      <category domain="http://securityratty.com/tag/fbi">fbi</category>
      <category domain="http://securityratty.com/tag/spam e-mails">spam e-mails</category>
      <category domain="http://securityratty.com/tag/internet">internet</category>
      <category domain="http://securityratty.com/tag/complaints">complaints</category>
      <category domain="http://securityratty.com/tag/rash">rash</category>
      <category domain="http://securityratty.com/tag/round">round</category>
      <category domain="http://securityratty.com/tag/issue">issue</category>
      <category domain="http://securityratty.com/tag/spread">spread</category>
      <source url="http://www.networkworld.com/news/2008/073008-fbi-warns-of-new-storm.html?fsrc=rss-security">FBI warns of new Storm Worm attacks</source>
    </item>
  </channel>
</rss>
