<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: comprehensive]]></title>
    <link>http://securityratty.com/tag/comprehensive</link>
    <description></description>
    <pubDate>Wed, 27 Aug 2008 16:53:17 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Cybersecurity, password recall, IT culture and more]]></title>
      <link>http://securityratty.com/article/53c0de20a83328a71c02b8360fb5d221</link>
      <guid>http://securityratty.com/article/53c0de20a83328a71c02b8360fb5d221</guid>
      <description><![CDATA[As part of a comprehensive cybersecurity push, the U.S. government will focus on improving its network defense capabilities and revamping acquisition rules to protect against malicious code installed...]]></description>
      <content:encoded><![CDATA[As part of a comprehensive cybersecurity push, the U.S. government will focus on improving its network defense capabilities and revamping acquisition rules to protect against malicious code installed during the manufacturing process of electronic devices.]]></content:encoded>
      <pubDate>Mon, 06 Oct 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/comprehensive cybersecurity push">comprehensive cybersecurity push</category>
      <category domain="http://securityratty.com/tag/network defense capabilities">network defense capabilities</category>
      <category domain="http://securityratty.com/tag/malicious code">malicious code</category>
      <category domain="http://securityratty.com/tag/acquisition rules">acquisition rules</category>
      <category domain="http://securityratty.com/tag/electronic devices">electronic devices</category>
      <category domain="http://securityratty.com/tag/government">government</category>
      <category domain="http://securityratty.com/tag/protect">protect</category>
      <category domain="http://securityratty.com/tag/focus">focus</category>
      <category domain="http://securityratty.com/tag/process">process</category>
      <source url="http://www.networkworld.com/news/2008/100708-cybersecurity-password-recall-it-culture.html?fsrc=rss-security">Cybersecurity, password recall, IT culture and more</source>
    </item>
    <item>
      <title><![CDATA[Hacking Your VoIP Box From The Net]]></title>
      <link>http://securityratty.com/article/ddef0bbead6572419deccb8cf4914ce6</link>
      <guid>http://securityratty.com/article/ddef0bbead6572419deccb8cf4914ce6</guid>
      <description><![CDATA[Do you do penetration testing of your own network? Is it comprehensive enough? Read this recent blog from McAfee's Avert Labs and you may wonder. An Avert analyst, reading about vulnerabilities in the...]]></description>
      <content:encoded><![CDATA[Do you do penetration testing of your own network? Is it comprehensive enough? Read <a href="http://www.avertlabs.com/research/blog/index.php/2008/09/29/the-lack-of-attention-in-voip-devices/">this recent blog from McAfee's Avert Labs</a> and you may wonder.

An Avert analyst, reading about vulnerabilities in the Cisco IP phone model 7960 then used Google to try to find publicly-accessible 7960 phones. He found "almost 10" (does that mean 9? awkward turn of phrase). 1 of them had the vulnerable firmware version  And the vulnerability was that the phone's web interface reveals a lot of sensitive network information, so the company that holds that phone has a vulnerable network.

What was revealed by the phone? "...the IP addresses of the TFTP server/router/DNS server/DHCP server/Cisco Call Manager, as well as some application links, internal device configuration, and debugging information. If there are any exploitable vulnerabilities in one of these linked servers, attackers could use this information to stage further attacks."

There's always more to test for, and mistakes you in device configuration can have dire consequences.
<p><a href="http://feedads.googleadservices.com/~a/KqezZ8B5wlQOthXrTY4hSBEoKXo/a"><img src="http://feedads.googleadservices.com/~a/KqezZ8B5wlQOthXrTY4hSBEoKXo/i" border="0" ismap="true"></img></a></p><img src="http://feedproxy.google.com/~r/RSS/cheap_hack/~4/sIcbcZ5FSGQ" height="1" width="1"/>]]></content:encoded>
      <pubDate>Sat, 04 Oct 2008 13:06:04 +0000</pubDate>
      <category domain="http://securityratty.com/tag/sensitive network information">sensitive network information</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/network">network</category>
      <category domain="http://securityratty.com/tag/device configuration">device configuration</category>
      <category domain="http://securityratty.com/tag/internal device configuration">internal device configuration</category>
      <category domain="http://securityratty.com/tag/phone model">phone model</category>
      <category domain="http://securityratty.com/tag/phone">phone</category>
      <category domain="http://securityratty.com/tag/exploitable vulnerabilities">exploitable vulnerabilities</category>
      <category domain="http://securityratty.com/tag/vulnerable network">vulnerable network</category>
      <source url="http://feeds.ziffdavisenterprise.com/~r/RSS/cheap_hack/~3/sIcbcZ5FSGQ/hacking_your_voip_box_from_the_net.html">Hacking Your VoIP Box From The Net</source>
    </item>
    <item>
      <title><![CDATA[Syndicating Google Trends Keywords for Blackhat SEO]]></title>
      <link>http://securityratty.com/article/c56eb4f87e14b19e95246ca1bd8a55dd</link>
      <guid>http://securityratty.com/article/c56eb4f87e14b19e95246ca1bd8a55dd</guid>
      <description><![CDATA[Several hundred Windows Live Spaces and AOL Journals , are currently syndicating the most popular keywords provided by Google Trends, and are consequently hijacking the top search queries exposing...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://4.bp.blogspot.com/_wICHhTiQmrA/SOXPRRoj3fI/AAAAAAAACPQ/DGGVEuUQaUc/s1600-h/bogus_blogs_google_trends_malware.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://4.bp.blogspot.com/_wICHhTiQmrA/SOXPRRoj3fI/AAAAAAAACPQ/fIYx1pvZfIM/s200-R/bogus_blogs_google_trends_malware.JPG" /></a>Several hundred <a href="http://blogs.zdnet.com/security/?p=1995">Windows Live Spaces and AOL Journals</a>, are currently syndicating the most popular keywords provided by Google Trends, and are consequently <a href="http://www.webroot.com/En_US/about-press-room-press-releases-hackers-using-real-headlines.html">hijacking the top search queries</a> exposing users to Zlob codecs.<br />
<br />
Here are some same bogus blogs used in the campaign, naturally pre-registered long before they executed it :<br />
<br />
<b>vinniedigg18 .spaces.live.com</b><br />
<b>journals.aol .com/iolatour16</b><br />
<b>fredabreak02 .spaces.live.com</b><br />
<b>thedaalerts01 .spaces.live.com</b><br />
<b>allisonpolls08 .spaces.live.com</b><br />
<b>rheabreak18 .spaces.live.com</b><br />
<b>racquellog17 .spaces.live.com</b><br />
<b>monikavideo11 .spaces.live.com</b><br />
<b>journals.aol .com/shelvakill27</b><br />
<b>tomekadigg26 .spaces.live.com</b><br />
<b>ivahnet19 .spaces.live.com</b><br />
<b>journals.aol .com/louisathere13</b><br />
<b>allisonpolls08 .spaces.live.com</b><br />
<b>valericatch03 .spaces.live.com</b><br />
<b>journals.aol .com/iolatour16</b><br />
<b>hadleycue01 .spaces.live.com</b><br />
<b>journals.aol .com/staceyliving01</b><br />
<b>collettebreak17 .spaces.live.com</b><br />
<b>journals.aol .com/nataliablog16</b><br />
<b>natalymore26 .spaces.live.com<br />
</b><br />
<br />
<a href="http://www.filefactory.com/file/4faafd/n/rogue_blogs_google_trends_txt">A comprehensive listing of the blogs involved can be downloaded here</a>. <br />
<br />
<div class="separator" style="clear: both; text-align: center;"><a href="http://1.bp.blogspot.com/_wICHhTiQmrA/SOXYvtGnGWI/AAAAAAAACPY/7WDPIuBn5Eg/s1600-h/google_trends_blackhat_SEO.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://1.bp.blogspot.com/_wICHhTiQmrA/SOXYvtGnGWI/AAAAAAAACPY/3Ph-I65avew/s200-R/google_trends_blackhat_SEO.png" /></a></div>What do all of these bogus blogs have in common? The fact that they are all being abused by a single malware campaign, and the Keep it Simple Stupid mentality only a lazy malware campaigner can take advantage of. All of the blogs as using a central redirection domain, shutting it down or blocking it renders the number of bogus blogs is circulation irrelevant. In this case, the domain in question is <b>video.xmancer.org</b> (216.195.59.75).<br />
<br />
Here are the the rest of the domains participating in the campaign, as well as the parked ones at the corresponding IPs :<br />
<br />
<b>video.xmancer .org</b> (216.195.59.75)<br />
<b>buynowbe .com<br />
loveniche .com<br />
antivirus-freecheck .com<br />
jetelephone .cn<br />
reducki .cn<br />
woteenhas .cn<br />
lilaloft .cn</b><br />
<br />
<b>clipztimes .com</b> (78.157.143.235)<br />
<b>imagelized .com<br />
vidzdaily .com</b><br />
<br />
<b>gotmovz .com</b> (78.108.177.91) <br />
<b>dwnld-clips .com</b><br />
<br />
<b>movwmstream .com</b> (77.91.231.183)<br />
<b>newwmpupdate .com<br />
zaeplugin .com<br />
movaccelerator .com<br />
optimwares .com<br />
piterserv .com</b><br />
<br />
<b>moviesportal2008p .com</b> (72.232.183.154)<br />
<b>movieportal2008a .com<br />
funnyportal2008l .com<br />
starsportal2008p .com<br />
softportal2008p .com<br />
movieportal2008q .com</b><br />
<br />
In short, despite that the campaign is poised to attract generic search traffic, it's a self-exposing blackhat SEO campaign since each and every blog participating is also linking to the rest of the ones within the ecosystem.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2008/06/blackhat-seo-redirects-to-malware-and.html">Blackhat SEO Redirects to Malware and Rogue Software</a><br />
<a href="http://ddanchev.blogspot.com/2008/05/blackhat-seo-campaign-at-millennium.html">Blackhat SEO Campaign at The Millennium Challenge Corporation</a><br />
<a href="http://ddanchev.blogspot.com/2008/03/massive-iframe-seo-poisoning-attack.html">Massive IFRAME SEO Poisoning Attack Continuing</a><br />
<a href="http://ddanchev.blogspot.com/2008/02/massive-blackhat-seo-targeting-blogspot.html">Massive  Blackhat SEO Targeting Blogspot</a><br />
<a href="http://ddanchev.blogspot.com/2008/01/invisible-blackhat-seo-campaign.html">The  Invisible Blackhat SEO Campaign</a><br />
<a href="http://ddanchev.blogspot.com/2007/01/attack-of-seo-bots-on-edu-domain.html">Attack  of the SEO Bots on the .EDU Domain</a><br />
<a href="http://ddanchev.blogspot.com/2007/11/p0rngov-ongoing-blackhat-seo-operation.html">p0rn.gov  - The Ongoing Blackhat SEO Operation</a><br />
<a href="http://ddanchev.blogspot.com/2008/02/continuing-gov-blackat-seo-campaign.html">The Continuing .Gov Blackat SEO Campaign</a><br />
<a href="http://ddanchev.blogspot.com/2008/02/continuing-gov-blackat-seo-campaign_25.html">The Continuing .Gov Blackhat SEO Campaign - Part Two</a><br />
<a href="http://ddanchev.blogspot.com/2007/10/compromised-sites-serving-malware-and.html">Compromised Sites Serving Malware and Spam</a><b> </b><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=uwRsM"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=uwRsM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=LdmhM"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=LdmhM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=eqMbm"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=eqMbm" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=igiam"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=igiam" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=iONDM"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=iONDM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=0QewM"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=0QewM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=6xSvm"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=6xSvm" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/410092478" height="1" width="1"/>]]></content:encoded>
      <pubDate>Fri, 03 Oct 2008 00:19:24 +0000</pubDate>
      <category domain="http://securityratty.com/tag/spaces">spaces</category>
      <category domain="http://securityratty.com/tag/windows live spaces">windows live spaces</category>
      <category domain="http://securityratty.com/tag/malware">malware</category>
      <category domain="http://securityratty.com/tag/live">live</category>
      <category domain="http://securityratty.com/tag/single malware campaign">single malware campaign</category>
      <category domain="http://securityratty.com/tag/aol journals">aol journals</category>
      <category domain="http://securityratty.com/tag/journals">journals</category>
      <category domain="http://securityratty.com/tag/campaign">campaign</category>
      <category domain="http://securityratty.com/tag/blackhat seo campaign">blackhat seo campaign</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/410092478/syndicating-google-trends-keywords-for.html">Syndicating Google Trends Keywords for Blackhat SEO</source>
    </item>
    <item>
      <title><![CDATA[FileAdvisor: software file search engine]]></title>
      <link>http://securityratty.com/article/856af459093a6fe1d8cb8a725ef66103</link>
      <guid>http://securityratty.com/article/856af459093a6fe1d8cb8a725ef66103</guid>
      <description><![CDATA[Troy Larson sent me a heads up on Bit9's FileAdvisor , a service they describe as &quot;a comprehensive catalog of executables, drivers, and patches found in commercial Windows applications and software...]]></description>
      <content:encoded><![CDATA[<a href="http://www.itsec.e-symposium.com/speakers/troy-larson.php" target="_blank">Troy Larson</a> sent me a heads up on Bit9's <a href="http://fileadvisor.bit9.com/services/search.aspx" target="_blank">FileAdvisor</a>, a service they describe as "a comprehensive catalog of executables, drivers, and patches found in commercial Windows applications and software packages. Malware and other unauthorized software that affects Windows computers is also indexed." <br />I immediately checked the FileAdvisor db for malware results as well non-Windows binaries and was pleasantly surprised with immediate and comprehensive results. You do have to register, but I was further impressed with the fact that they offered the option for a short or full <a href="http://fileadvisor.bit9.com/services/register.aspx" target="_blank">registration</a>.<br />This appears to be worthy of a bookmark in your incident handler/malware researcher/forensic investigator toolkit.<br /><br /><a href="http://del.icio.us/post?url=http://holisticinfosec.blogspot.com/2008/10/fileadvisor-software-file-search-engine.html&title=FileAdvisor:%20software%20file%20search%20engine " title="FileAdvisor: software file search engine ">del.icio.us</a> | <a href="http://digg.com/submit?phase=2&amp;url=http://holisticinfosec.blogspot.com/2008/10/fileadvisor-software-file-search-engine.html" title="FileAdvisor: software file search engine ">digg</a>]]></content:encoded>
      <pubDate>Wed, 01 Oct 2008 10:34:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/software">software</category>
      <category domain="http://securityratty.com/tag/fileadvisor">fileadvisor</category>
      <category domain="http://securityratty.com/tag/commercial windows applications">commercial windows applications</category>
      <category domain="http://securityratty.com/tag/malware">malware</category>
      <category domain="http://securityratty.com/tag/malware results">malware results</category>
      <category domain="http://securityratty.com/tag/software packages">software packages</category>
      <category domain="http://securityratty.com/tag/affects windows computers">affects windows computers</category>
      <category domain="http://securityratty.com/tag/comprehensive results">comprehensive results</category>
      <category domain="http://securityratty.com/tag/incident handlermalware">incident handlermalware</category>
      <source url="http://holisticinfosec.blogspot.com/2008/10/fileadvisor-software-file-search-engine.html">FileAdvisor: software file search engine</source>
    </item>
    <item>
      <title><![CDATA[Can you keep users from importing their own applications?]]></title>
      <link>http://securityratty.com/article/7086a257099ae412ea77872cdc0f0144</link>
      <guid>http://securityratty.com/article/7086a257099ae412ea77872cdc0f0144</guid>
      <description><![CDATA[Shadow IT is all the IT that was neither planned nor approved by anyone but gets chosen, deployed and used by end users. Some see this as grass-roots deployment of cool technologies; some see it as...]]></description>
      <content:encoded><![CDATA[Shadow IT is all the IT that was neither planned nor approved by anyone but gets chosen, deployed and used by end users. Some see this as grass-roots deployment of cool technologies; some see it as weeds growing from any crack in the IT plan. If you don't build it, they will go find it elsewhere. And even if you build it, if it isn't adequate, comprehensive, flexible and easy to use, they will go find it elsewhere.]]></content:encoded>
      <pubDate>Mon, 29 Sep 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/users">users</category>
      <category domain="http://securityratty.com/tag/grass-roots deployment">grass-roots deployment</category>
      <category domain="http://securityratty.com/tag/cool technologies">cool technologies</category>
      <category domain="http://securityratty.com/tag/flexible">flexible</category>
      <category domain="http://securityratty.com/tag/shadow">shadow</category>
      <category domain="http://securityratty.com/tag/weeds">weeds</category>
      <category domain="http://securityratty.com/tag/easy">easy</category>
      <category domain="http://securityratty.com/tag/comprehensive">comprehensive</category>
      <category domain="http://securityratty.com/tag/plan">plan</category>
      <source url="http://www.networkworld.com/columnists/2008/092908-andreas.html?fsrc=rss-security">Can you keep users from importing their own applications?</source>
    </item>
    <item>
      <title><![CDATA[Hardening OS 10.5 Leapord-Tips from the NSA]]></title>
      <link>http://securityratty.com/article/4966f7ac5b9bb38267e50f75cbe9ea00</link>
      <guid>http://securityratty.com/article/4966f7ac5b9bb38267e50f75cbe9ea00</guid>
      <description><![CDATA[The National Security Agency developed a configuration guide for default installations of Leapord
According to Information Week, its not a completely comprehensive guide but its a good start While the...]]></description>
      <content:encoded><![CDATA[<p>The National Security Agency developed a <a rel="nofollow" target="_blank" href="http://www.gcn.com/newspics/NSA_HardeningTips_MacOSx.pdf">configuration guide</a> for default installations of Leapord.</p>
<p>According to Information Week, it&#8217;s not a completely comprehensive guide but it&#8217;s a good start &#8212; &#8220;<span id="articleBody">While the agency&#8217;s advice may not be sufficient to stop a government agency like, say, the NSA, from accessing one&#8217;s Mac, it should significantly improve one&#8217;s security posture against less capable hackers.&#8221;</span></p>
<p>Tips cover user accounts, admin accounts, firewalls, software updates, folder permissions and more. For a few quick tips read the <a rel="nofollow" target="_blank" href="http://www.informationweek.com/blog/main/archives/2008/09/nsa_offers_secu.html;jsessionid=BVWVSEWAUIHBWQSNDLRSKHSCJUNN2JVN">full article </a>&#8211; or if you have time, download to the <a rel="nofollow" target="_blank" href="http://www.nsa.gov/notices/notic00004.cfm?Address=/snac//factsheets/macosx_hardening_tips.pdf">NSA guide</a>.</p>]]></content:encoded>
      <pubDate>Mon, 22 Sep 2008 15:46:48 +0000</pubDate>
      <category domain="http://securityratty.com/tag/nsa">nsa</category>
      <category domain="http://securityratty.com/tag/completely comprehensive guide">completely comprehensive guide</category>
      <category domain="http://securityratty.com/tag/nsa guide">nsa guide</category>
      <category domain="http://securityratty.com/tag/national security agency">national security agency</category>
      <category domain="http://securityratty.com/tag/leapord">leapord</category>
      <category domain="http://securityratty.com/tag/admin accounts">admin accounts</category>
      <category domain="http://securityratty.com/tag/information week">information week</category>
      <category domain="http://securityratty.com/tag/configuration guide">configuration guide</category>
      <category domain="http://securityratty.com/tag/government agency">government agency</category>
      <source url="http://feeds.feedburner.com/~r/itsecurity/~3/400408786/">Hardening OS 10.5 Leapord-Tips from the NSA</source>
    </item>
    <item>
      <title><![CDATA[US focusing cybersecurity on backdoors in tech products]]></title>
      <link>http://securityratty.com/article/67662088ef5261bce3aa0a2fb156558b</link>
      <guid>http://securityratty.com/article/67662088ef5261bce3aa0a2fb156558b</guid>
      <description><![CDATA[As part of a comprehensive cybersecurity push, the U.S. government will focus on improving its network defense capabilities and on revamping acquisition rules to protect against malicious code...]]></description>
      <content:encoded><![CDATA[As part of a comprehensive cybersecurity push, the U.S. government will focus on improving its network defense capabilities and on revamping acquisition rules to protect against malicious code installed during the manufacturing process of electronic devices.]]></content:encoded>
      <pubDate>Sun, 14 Sep 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/comprehensive cybersecurity push">comprehensive cybersecurity push</category>
      <category domain="http://securityratty.com/tag/network defense capabilities">network defense capabilities</category>
      <category domain="http://securityratty.com/tag/malicious code">malicious code</category>
      <category domain="http://securityratty.com/tag/acquisition rules">acquisition rules</category>
      <category domain="http://securityratty.com/tag/electronic devices">electronic devices</category>
      <category domain="http://securityratty.com/tag/government">government</category>
      <category domain="http://securityratty.com/tag/protect">protect</category>
      <category domain="http://securityratty.com/tag/focus">focus</category>
      <category domain="http://securityratty.com/tag/process">process</category>
      <source url="http://www.networkworld.com/news/2008/091508-us-focusing-cybersecurity-on-backdoors.html?fsrc=rss-security">US focusing cybersecurity on backdoors in tech products</source>
    </item>
    <item>
      <title><![CDATA[Links List 8.29.08]]></title>
      <link>http://securityratty.com/article/f1038682e1a7f7e06f6d230b158bd8a3</link>
      <guid>http://securityratty.com/article/f1038682e1a7f7e06f6d230b158bd8a3</guid>
      <description><![CDATA[ChangeWave Research released a survey of 1,947 people responsible for IT spending. Thirty percent of the respondents reported that third-quarter IT spending was lower than previously planned while 12...]]></description>
      <content:encoded><![CDATA[<p><img style="border-right: 0px; border-top: 0px; margin: 0px 10px 10px 0px; border-left: 0px; border-bottom: 0px" height="240" alt="michaelphelps" src="http://blog.sciencelogic.com/wp-content/uploads/2008/08/michaelphelps.jpg" width="174" align="left" border="0" /> ChangeWave Research released a survey of 1,947 people responsible for IT spending. Thirty percent of the respondents <a href="http://www.infoworld.com/article/08/08/27/Grim_outlook_for_US_IT_spending_1.html?source=NLC-DAILY&amp;cgd=2008-08-28" target="_blank">reported that third-quarter IT spending was lower</a> than previously planned &#8211; while 12 percent spent more than planned. Thirty-five percent cited higher energy costs as the top factor for spending slowdown. </p>
<p>Parlez-vous open source? While wide-spread open source usage is still debated in many companies, the French have been advocating for <a href="http://www.infoworld.com/article/08/08/28/35NF-open-source-france-lessons_1.html" target="_blank">all open source all the time in government and education</a>. French President Nicolas Sarkozy set up an economic commission that recommended tax benefits to stimulate more open source development. Lesson learned from France: start &#8216;em early. &#8220;All students in France use open source.&#8221;</p>
<p>Just in time for Labor Day, John Edwards (no, not that one) comes out with an informative guide on &#8220;<a href="http://www.infoworld.com/article/08/08/27/35NF-cloud-providers_1.html" target="_blank">Who provides what in the cloud</a>&#8221;. No doubt, this will be a rapidly expanding list, but what&#8217;s really interesting is the comment on the article. People have very strong opinions on the cloud&#8230;</p>
<p>Research firm Aberdeen Group reports that <a href="http://www.cio.com/article/445863/Network_Management_Tips_for_Managing_Costs?page=1" target="_blank">network costs will increase</a> slightly more than 5 percent over 2007. Contributing factors: &#8220;need for speed&#8221;, shift from standard to mobile PCs (more end points of connectivity), and the ever-expanding network. And of course the hidden costs of multiple tools with multiple management consoles &#8211; if you&#8217;re not smart enough to choose say a comprehensive network management solution that is vendor agnostic&#8230;One tool to monitor them all&#8230;</p>
<p>And just because I miss the Olympics already, here&#8217;s an irreverent take on what it&#8217;s like to lose to Michael Phelps. <a href="http://www.thetechstop.net/?p=1503">http://www.thetechstop.net/?p=1503</a></p>
<p>Enjoy your long Labor Day Weekend!</p>
]]></content:encoded>
      <pubDate>Fri, 29 Aug 2008 10:00:44 +0000</pubDate>
      <category domain="http://securityratty.com/tag/percent">percent</category>
      <category domain="http://securityratty.com/tag/source">source</category>
      <category domain="http://securityratty.com/tag/source development">source development</category>
      <category domain="http://securityratty.com/tag/thirty percent">thirty percent</category>
      <category domain="http://securityratty.com/tag/labor day">labor day</category>
      <category domain="http://securityratty.com/tag/source usage">source usage</category>
      <category domain="http://securityratty.com/tag/costs">costs</category>
      <category domain="http://securityratty.com/tag/energy costs">energy costs</category>
      <category domain="http://securityratty.com/tag/thirty-five percent cited">thirty-five percent cited</category>
      <source url="http://blog.sciencelogic.com/links-list-82908/08/2008">Links List 8.29.08</source>
    </item>
    <item>
      <title><![CDATA[Web Services and XML Security Training at OWASP]]></title>
      <link>http://securityratty.com/article/6d12835067b0b2251fdc4b658b6928cc</link>
      <guid>http://securityratty.com/article/6d12835067b0b2251fdc4b658b6928cc</guid>
      <description><![CDATA[I am teaching Web Services and XML Security training at OWASP's AppSec conference in NYC, Sept 22-23. Web services provide the backbone that integrates many things in the enterprise from application...]]></description>
      <content:encoded><![CDATA[<p>I am teaching <a href="http://www.owasp.org/index.php/Category:OWASP_AppSec_Conference_Training#T3._Web_Services_and_XML_Security_-_2-Day_Course_-_Sep_22-23.2C_2008">Web Services and XML Security training</a> at OWASP&#39;s AppSec conference in NYC, Sept 22-23. Web services provide the backbone that integrates many things in the enterprise from application servers, databases, ERP, and CRM. &#160;Increasingly we are seeing Web services in more B2C roles with Rest, Federation and other technologies. The class looks at how Web services applications are built, what are common threats and vulnerabilities in Web services, and how to build your Web services application to defend against them.</p><br /><div>I have often said that OWASP conferences are my favorite ones because they are in depth technically and very practical. I always look forward to teaching at OWASP and the speaker lineup for this conference looks excellent.</div><br /><div>Here is a quick list of tools we have used in past classes<br /></div><br /><div><span style="color: #333333; line-height: 19px; "><p style="margin-top: 10px; margin-bottom: 10px; text-align: left; "><strong>Web Services frameworks</strong><br /><a href="http://incubator.apache.org/cxf/" style="text-decoration: underline; color: #003366; ">Apache CXF</a>&#160;- very interesting open source Web services framework with support for JMS, SOAP, and Rest<br />Apache&#160;<a href="http://ws.apache.org/axis/" style="text-decoration: underline; color: #003366; ">Axis</a>&#160;&amp;&#160;<a href="http://ws.apache.org/axis2/" style="text-decoration: underline; color: #003366; ">Axis2</a><br /><a href="http://en.wikipedia.org/wiki/Windows_Communication_Foundation" style="text-decoration: underline; color: #003366; ">.Net</a><br /><a href="https://metro.dev.java.net/" style="text-decoration: underline; color: #003366; ">Metro</a>&#160;- interesting framework from Sun for interop with WCF</p><p style="margin-top: 10px; margin-bottom: 10px; text-align: left; "><strong>Identity</strong>&#160;<br /><a href="http://www.pingidentity.com/products/pingfederate.cfm" style="text-decoration: underline; color: #003366; ">PingFederate</a>&#160;- leading federation tool, we&#39;ll look at browser based SSO with SAML<br /><a href="http://www.pingidentity.com/products/web-services.cfm" style="text-decoration: underline; color: #003366; ">PingFederate Web Services</a>&#160;- we&#39;ll look at how to implement a STS in Web services<br /><a href="http://www.bandit-project.org/index.php/Welcome_to_Bandit" style="text-decoration: underline; color: #003366; ">Bandit</a>&#160;-&#160;<a href="http://en.wikipedia.org/wiki/Windows_CardSpace" style="text-decoration: underline; color: #003366; ">Cardspace</a>, authorization, and auditing</p><p style="margin-top: 10px; margin-bottom: 10px; text-align: left; "><strong>Security Services</strong><br /><a href="http://www.vordel.com/products/vx_gateway/" style="text-decoration: underline; color: #003366; ">VordelSecure</a>&#160;- XML gateway, comprehensive web services security policy creation and enforcement, deploying decentralized security services<br /><a href="http://ws.apache.org/axis2/modules/rampart/1_0/security-module.html" style="text-decoration: underline; color: #003366; ">Apache Ramparts</a><br /><a href="http://www.modsecurity.org/" style="text-decoration: underline; color: #003366; ">modecurity</a></p><p style="margin-top: 10px; margin-bottom: 10px; text-align: left; "><strong>Testing</strong><br /><a href="http://www.vordel.com/products/soapbox/" style="text-decoration: underline; color: #003366; ">Soapbox</a>&#160;- web services security testing<br /><a href="http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project" style="text-decoration: underline; color: #003366; ">WebScarab</a>&#160;- web services fuzzing</p><p style="margin-top: 10px; margin-bottom: 10px; text-align: left; "><strong>Static Analysis</strong><br /><a href="http://www.fortifysoftware.com/products/sca/" style="text-decoration: underline; color: #003366; ">Fortify SC</a>A - how to scan your web services code for security bugs *before* you deploy</p></span><br /><div><span style="color: #333333; line-height: 19px; ">This is just a quick list, new tools are added periodically. If you are using tools of these types in your company you may find it interesting <a href="http://www.owasp.org/index.php/Category:OWASP_AppSec_Conference_Training#T3._Web_Services_and_XML_Security_-_2-Day_Course_-_Sep_22-23.2C_2008">to attend</a>.</span><br /></div><br /><div>Testimontials on past classes<br /><br /><div><span style="font-family: Times; font-size: 16px; line-height: normal; -webkit-border-horizontal-spacing: 2px; -webkit-border-vertical-spacing: 2px; ">&quot;High quality detailed overview of SOA security standards and approaches. Well thought-out and structured presentation.&quot;<br />- Sr. IT Architect, Fortune 10 enterprise<p>&quot;The knowledge and transfer was a great baseline and with the additional resources Gunnar made available, made this one of the best one day classes I&#39;ve taken.&quot;<br />- IT Security Lead, Fortune 10 enterprise</p><p>&quot;This class was a thorough and well-organized trek through the current Web Services Security landscape. Going beyond just describing the standards and the options available in the Web Services Security world, this class discusses real-world use cases and offers implementable solutions, best practices, even vendor choices in several key areas. &#160;This class provided me with actionable tasks that I took back to my project teams the very next day!&quot;<br />-Jesse Aalberg, Sr. Enterprise Application Architect, United Healthcare</p><p>&quot;The class was distinctly focused on Security requirements and the strength and weaknesses of the various solution approaches we could consider. The result of the course was actionable approaches to providing security in our SOA environment.&quot;<br />-Brad Sillman, Director IT Security, Deluxe Corp.</p><p>&quot;Anyone who wants up-to-date information on SOA Security, security standards and best practices should take this class.&quot;<br />-Kevin Beam, Senior Systems Engineer, Union Pacific Railroad</p><p>&quot;Good comprehensive overview of subject, standards, and threats&quot;&#160;<br />- Sr.Security Consultant, Ubizen</p><p>&quot;The class helped me get my head around what &quot;SOA&quot; and WS-Security is really all about&quot;<br />- Mike Zusman, Independent consultant</p><p>&quot;Topics addressed are timely and relevant. Labs are hands-on and help see concepts in action&quot;<br />- Jerry Tan, Systems Analyst, DTCC</p><p>&quot;This class was concise and covered a majority of the problem set my company is looking at and dealing with.&quot;&#160;<br />- Steve Reilley, Technical consultant, Commerce Insurance</p><p>&quot;Excellent two day overview of security topics as related to Web Services.&quot;<br />- Daniel Reznick, Information Security, ADP</p><p>&quot;Issue affecting&#160;<span style="text-decoration: underline;">most</span>&#160;of us today &amp; for those that don&#39;t - will soon. Very necessary education and technology.&quot;<br />Aaron Delashmutt</p><p>&quot;Great class! Effective and relevant teaching in an area without much guidance.&quot;<br />- Mark DiSabato, Senior Information Security Architect, Roche</p><p>&quot;The class cut through jargon to communicate concepts and implementation details.&quot;<br />- Developer, Fortune 100 insurance company</p><p>&quot;Good overview regarding SOA Security. Contains new technology like AMQP and REST&quot;&#160;<br />- Lars Loland, Statoil</p><p>&quot;The course covered what I had to learn about Web services&quot;<br />- Sven Vetsch, Dreamlab Technologies</p><p>&quot;Very good, eye opening especially for websecurity noob.&quot;<br />-Michael Brandon</p><p>&quot;Presenter has very broad and deep technical knowledge on subject. Content: good overview and comparison of SAML and WS-*&quot;<br />- Security consultant, ING</p><p>&quot;Good to learn where our application is vulnerable to attacks and how we can avoid them.&quot;<br />- Application Development Programmer Lead, Fortune 100 Insurance company</p><p>&quot;Entirely thorough overview of technology surrounding the use of web services with a 1 day presentation&quot;<br />- Technical consultant Contextis</p><p>&quot;Gave a good overview of the Web services security environment&quot;<br />- Francesco Degrassi, Emaze Networks</p><p>&quot;A great entry point for securing your web services&quot;<br />- Stig Kluver</p><p>&quot;Lots of good technical information about an emerging area that&#39;s very useful&quot;<br />- Rory McClune, HBOS PLC</p><p>&quot;This class reinforced the importance of software security assurance to me as it lucidly demonstrated why being &#39;behind the firewall&#39; is an outdated concept.&quot;<br />-Senior Support Engineer, Software Security vendor</p><p>&quot;The area of SOA Security is complicated and youg. A course such as this helps bring it into focus.&quot;<br />-Jayme Frye, System Engineer, Union Pacific Railroad</p><p>&quot;Web services security class provided application security concepts valuable for applications audits.&quot;<br />- Mary Ma, IT Auditor, DTCC</p><p>&quot;Very knowledgeable coverage of security requirements for Web services.&quot;<br />- David Libershal, Network Security Engineer, Johns Hopkins University Applied Physics Laboratory</p><p>&quot;WS/XML security is not a &quot;black art&quot;, but you do need to know about it to be able to take it into consideration.&quot;<br />- Applications Specialist, Global 500 manufacturer</p><p>&quot;Good overview of techniques worth considering when planning secure apps&quot;<br />- EAI Specialist, Leading Mobility company</p><p>&quot;Brought concepts in very easily understood terms.&quot;<br />-Glenn Bernard, Systems Engineer</p><p>&quot;Gives ideas about the latest Web services security standards in the industry&quot;<br />- Security Coordinator, Global 500 manufacturer</p><p>&quot;Class cleared up various WS-* standards and gave great concrete examples of how to build a message using each standard. Very good general thoughts on security groups&#39; role in IT.&quot;<br />- Matt Kasselman, UP Systems Engineering</p><p>&quot;I found this very useful as an IT architect in a &quot;security critical environment&quot;.&quot;<br />- Mika Pullinen, IT Architect, Finnish Defense Forces</p><p>&quot;Lots of useful information packed in a small amount of time. Good overall picture.&quot;<br />- Jari Pirhonen, Security Director, Samlink</p><p>&quot;Gunnar is very knowledgeable about security topics and has a great ability to explain complex ideas using simple, appropriate, and amusing language and analogies.&quot;<br />- Scott Redd, Sr. Project Engineer, Union Pacific</p><p>&quot;Excellent instructor who had a good pace to go through the presentation&quot;&#160;<br />- Anna Vaahtokan, Specialist, Nordea</p><p>&quot;Good application security principles.&quot;<br />- Tuomas Kivinen, IT Security Specialist, Nordea</p><p>&quot;I liked the class quite a bit. I took it in a &quot;survey mode&quot; where I wanted to learn about topics at a high level, and this was accomplished. It was good to listen to those in the class that were much more familiar with SAO than I.&quot;<br />- John Glazeski, Senior Systems Engineer</p></span></div></div></div>]]></content:encoded>
      <pubDate>Thu, 28 Aug 2008 04:55:59 +0000</pubDate>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/soa security standards">soa security standards</category>
      <category domain="http://securityratty.com/tag/security standards">security standards</category>
      <category domain="http://securityratty.com/tag/soa security">soa security</category>
      <category domain="http://securityratty.com/tag/soa">soa</category>
      <category domain="http://securityratty.com/tag/security critical environment">security critical environment</category>
      <category domain="http://securityratty.com/tag/information security">information security</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/application security principles">application security principles</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/08/web-services-and-xml-security-training-at-owasp.html">Web Services and XML Security Training at OWASP</source>
    </item>
    <item>
      <title><![CDATA[Blue Box #82: Asterisk & Skype security vulnerabilities, new VoIP security tools, VoIP steganography, VoIP security news and much, much more...]]></title>
      <link>http://securityratty.com/article/ab8e0e22ebb1851ff664c3be0a3baa7d</link>
      <guid>http://securityratty.com/article/ab8e0e22ebb1851ff664c3be0a3baa7d</guid>
      <description><![CDATA[Synopsis: Blue Box #82: Asterisk &amp; Skype security vulnerabilities, new VoIP security tools, VoIP steganography, VoIP security news and much, much more
Welcome to Blue Box: The VoIP Security Podcast...]]></description>
      <content:encoded><![CDATA[
<div xmlns="http://www.w3.org/1999/xhtml"><p><strong>Synopsis:</strong>&nbsp; Blue Box #82: Asterisk & Skype security vulnerabilities, new VoIP security tools, VoIP steganography, VoIP security news and much, much more...</p><hr /><p>Welcome to <strong>Blue Box: The VoIP Security Podcast</strong> #82, a 47-minute podcast&nbsp; from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.&nbsp; &nbsp; </p>

<p><a rel="enclosure" href="http://media.libsyn.com/media/lodestar/BBP-082-2008-06-21.mp3">Download the show here</a> (MP3, 21MB) or <a href="http://feeds.feedburner.com/BlueBox">subscribe to the RSS feed</a> to download the show automatically.&nbsp; </p>

<p><strong>NOTE: </strong><em>This show was originally recorded on June 21, 2008. </em></p> 

<p>You may also listen to this podcast right now:</p> 

<p><object width="200" height="20" data="http://www.blueboxpodcast.com/dewplayer.swf?son=http://media.libsyn.com/media/lodestar/BBP-082-2008-06-21.mp3" type="application/x-shockwave-flash"><param value="http://www.blueboxpodcast.com/dewplayer.swf?son=http://media.libsyn.com/media/lodestar/BBP-082-2008-06-21.mp3&amp;bgcolor=#FFFFFF" name="movie" /></object> </p> 

<p><strong>Show Content:</strong></p> 
 

<ul> <li>00:20 - Intro to the show, contact information and how to provide comments.&nbsp; Welcome to all the new listeners - and to all those listeners who have been here for so long!</li>
<li>Programming notes:
	<ul>
	<li>Note about the production team &#8211; new special editions coming soon.</li>
		<li>Note about URLs for the media files</li>
	</ul>
<li><a href="http://downloads.digium.com/pub/security/AST-2008-008.html">AST-2008-008 &#8211; Remote Crash Vulnerability in <span class="caps">SIP</span> channel driver when run in pedantic mode</a></li>
		<li><a href="http://downloads.digium.com/pub/security/AST-2008-009.html">AST-2008-009 &#8211; Remote crash vulnerability in ooh323 channel driver</a></li>
		<li><a href="http://www.skype.com/security/skype-sb-2008-003.html">Skype-SB-2008-003 &#8211; Skype File <span class="caps">URI </span>Security Bypass Code Execution Vulnerability</a></li>

<p><li><a href="http://voipsa.org/pipermail/voipsec_voipsa.org/2008-June/002677.html">New version of SIPvicious</a></li><br />
		<li><a href="http://code.google.com/p/sipflanker/">Sipflanker &#8211; tool to find <span class="caps">SIP</span> devices with web GUIs</a></li><br />
<ul><br />
	<li><a href="http://voipsa.org/pipermail/voipsec_voipsa.org/2008-June/002678.html">Discussion about VoIP Steganography</a> (pointed to by Craig Bowser)</li><br />
		<li>Geeks Are Sexy: <a href="http://www.geeksaresexy.net/2008/06/02/new-technology-hides-messages-in-internet-phone-calls/">New Technology Hides Messages in Internet Phone Calls</a> &#8211; and Switched: <a href="http://www.switched.com/2008/06/03/spies-to-use-skype-to-send-secret-messages/">Spies to Use Skype to Send Secret Messages?</a> &#8211; and <a href="http://www.theregister.co.uk/2008/06/03/voip_steganography/">The Register</a></li><br />
	<li>FierceVoIP: <a href="http://www.fiercevoip.com/story/voip-security-and-circle-trust/2008-05-06">VoIP Security and the Circle of Trust</a> pointing to Government Computer News: <a href="http://www.gcn.com/print/27_10/46209-1.html">Careful with the call</a></li><br />
	<br />
	<li>The Register: <a href="http://www.theregister.co.uk/2008/06/03/low_tech_phishing_scams/">&#8216;Untraceable&#8217; phone fraudsters eye your credit card</a></li><br />
	<br />
	<li>SearchUnifiedCommunications: <a href="http://searchunifiedcommunications.techtarget.com/news/article/0,289142,sid186_gci1315878,00.html">Disaster and recovery in the VoIP/IPT <span class="caps">RFP</span></a></li><br />
	<br />
	<li>Secure Computing: <a href="http://www.securecomputing.net.au/News/114221,voice-tools-under-enemy-fire.aspx">Voice tools under enemy fire</a></li><br />
	<br />
	<li>VNUnet: <a href="http://www.vnunet.com/computing/analysis/2217608/voip-application-worth-paying-4021945">A good VoIP application is worth paying for</a></li><br />
	<br />
	<li><a href="http://www.ofcom.org.uk/media/news/2007/12/nr_22071205">Ofcom confirms VoIP providers must provide access to 999 and 112</a></li><br />
	<br />
	<li><a href="http://blog.voipshield.com/">Bogdan Materna&#8217;s blog is live</a></li></p>

<p><li>Realtime Community: <a href="http://www.realtime-websecurity.com/ESMWSv3.asp">The Essentials Series:<br />Messaging and Web Security<br />Volume <span class="caps">III</span></a></li><br />
		<li>Global Knowledge: <a href="http://images.globalknowledge.com/wwwimages/seminars/voipsec/player.html">On-Demand Webinar on VoIP Security</a> (hat tip to <a href="http://tfl09.blogspot.com/2008/06/voip-security-web-seminar.html">Thomas Lee</a> )</li><br />
		<li>SearchSecurity: <a href="http://searchsecurity.techtarget.com.au/articles/24883-The-threats-to-telcos-and-how-they-can-repel-them">The threats to telcos and how they can repel them</a></li><br />
		<li>TMCnet: <a href="http://www.tmcnet.com/news/2008/06/02/3476832.htm">Balancing Issues in World of Telepresence</a></li><br />
		<li>Network World: <a href="http://www.networkworld.com/buyersguides/guide.php?cat=898361">VoIP Security Buying Guide</a></li></p>

<p><li><a href="http://www.fiercewireless.com/press-releases/nortel-and-securelogix-team-deliver-voice-security-and-management-solutions-worldwide">Nortel and SecureLogix Team to Deliver Voice Security and Management Solutions to Worldwide Enterprise Market</a> (see also <a href="http://www.fiercevoip.com/story/nortel-adds-voip-security-thru-securelogix/2008-06-02?utm_medium=rss&#38;utm_source=rss&#38;cmp-id=OTC-RSS-FV0">this analysis</a> )</li><br />
		<li><a href="http://www.earthtimes.org/articles/show/sipera-partner-network-arms-resellers-with-comprehensive-uc-and-voip-security,428703.shtml">Sipera Partner Network Arms Resellers With Comprehensive UC and VoIP Security</a></li><br />
		<li><a href="http://www.webitpr.com/release_detail.asp?ReleaseID=8791">VIVOphone Deploys Paradial RealTunnel?? to Solve <span class="caps">NAT </span>Traversal Challenges for VoIP Services</a></li><br />
		<li><a href="http://www.networkworld.com/newsletters/converg/2008/061608converge1.html">Audiocodes joins the ranks of <span class="caps">SBC</span> vendors</a></li><br />
<li>SearchSecurity: <a href="http://searchnetworking.techtarget.com.au/articles/24906-Securing-the-new-network">Securing the new network</a> (interesting because it shows the layers of a defense in depth)</li><br />
<li>The Hindu Business News: <a href="http://www.thehindubusinessline.com/ew/2008/06/16/stories/2008061650050201.htm">Serious about Security</a></li><br />
<li>Shows:<br />
<ul><br />
	<li><a href="http://www.iptelephonyuniversity.com/home.html">IP Telephony University</a> &#8211; June 23-24, Alexandria, VA</li><br />
		<li><a href="http://voipsa.org/pipermail/voipsec_voipsa.org/2008-June/002675.html">IPTComm 2008</a> &#8211; July 1-2, Heidelberg, Germany</li><br />
		<li><a href="http://www.thelasthope.org/index.php">The Last H.O.P.E.</a> &#8211; July 18-20, New York</li><br />
		<li><a href="http://www.speechtek.com/">SpeechTek</a> &#8211; August 18-20, New York</li><br />
	</ul><br />
<li><a href="http://article.gmane.org/gmane.comp.voip.security.voipsa/2562">Call for papers for Hack-in-the-box Malaysia</a> ends June 30th</li><br />
	<br />
	<li><a href="http://www.room362.com/archives/192-ShmooCon-2008-Videos-Hit-the-Shelves.html">SchmooCon 2008 videos available &#8211; several dealing with VoIP</a></li></p>

<p><li>No comments this week.<br />
<li>Review of the last week's traffic on the <a href="http://www.voipsa.org/VOIPSEC/">VOIPSEC </a>public mailing list&nbsp; </li><br />
<li>Wrap-up of the show </li><br />
<li>47:09 - End of show&nbsp; </li></ul> <p>Comments, suggestions and feedback are welcome either as replies to this post&nbsp; or via e-mail to <a href="mailto:blueboxpodcast@gmail.com">blueboxpodcast@gmail.com</a>.&nbsp; Audio comments sent as attached MP3 files are definitely welcome and will be played in future shows.&nbsp; You may also call the listener comment line at either +1-415-830-5439 or via SIP to '<a href="sip:bluebox@voipuser.org">bluebox@voipuser.org</a>' to leave a comment there.&nbsp; </p> <p>Thank you for listening and please do let us know what you think of the show. </p></p></div>
]]></content:encoded>
      <pubDate>Wed, 27 Aug 2008 16:53:17 +0000</pubDate>
      <category domain="http://securityratty.com/tag/voip security">voip security</category>
      <category domain="http://securityratty.com/tag/voip security news">voip security news</category>
      <category domain="http://securityratty.com/tag/voip">voip</category>
      <category domain="http://securityratty.com/tag/voip security tools">voip security tools</category>
      <category domain="http://securityratty.com/tag/voip steganography">voip steganography</category>
      <category domain="http://securityratty.com/tag/voip services">voip services</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/skype security vulnerabilities">skype security vulnerabilities</category>
      <category domain="http://securityratty.com/tag/voip security podcast">voip security podcast</category>
      <source url="http://www.blueboxpodcast.com/2008/08/blue-box-82-ast.html">Blue Box #82: Asterisk &amp; Skype security vulnerabilities, new VoIP security tools, VoIP steganography, VoIP security news and much, much more...</source>
    </item>
  </channel>
</rss>
