<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: contacts]]></title>
    <link>http://securityratty.com/tag/contacts</link>
    <description></description>
    <pubDate>Thu, 03 Jul 2008 18:00:00 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Of Planes and Ships]]></title>
      <link>http://securityratty.com/article/47dfbf92b3eaba317f07cfa2064d0a9b</link>
      <guid>http://securityratty.com/article/47dfbf92b3eaba317f07cfa2064d0a9b</guid>
      <description><![CDATA[Tom Barnett is consistently the most interesting writer on globalization and econo-security seam. This weeks piece confronts a problem every security architect can relate to (emphasis added on the...]]></description>
      <content:encoded><![CDATA[<p><a href="http://www.thomaspmbarnett.com/weblog/2008/09/column_121.html">Tom Barnett</a> is consistently the most interesting writer on globalization and econo-security seam. This weeks piece confronts a problem every security architect can relate to (emphasis added on the &quot;nail it to the wall&quot; quote at the end):</p><p><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">One of the main problems in counterterrorism today is that there are so many people and vehicles, and so much data and material, moving through globalization&#39;s myriad networks that it seems virtually impossible to track it all effectively. Nowhere has this problem been more acute than on the high seas.</span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">In 2006, Adm. Harry Ulrich, then U.S. commander of NATO Naval Forces Europe, decided to do something about it. Despite having virtually no resources, his dream was to transpose the global air-traffic control system onto sea traffic.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">Worldwide, aircraft are transparent, because they&#39;re all required to carry an identification beacon that allows them to be tracked leaving and entering airports, and monitored between airports, by a global network of sensors. Act suspiciously and somebody&#39;s fighter aircraft will soon be on your tail.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">No such pervasive system currently exists globally for maritime traffic. While bigger ships carry an ID beacon similar to aircraft, without a shared monitoring network, that&#39;s like tracking only selected commercial jets and giving everyone else a pass.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">So Ulrich, upon taking command, asked a simple question: &quot;If we can do that in the air, why can&#39;t we do it on the sea?&quot; He made a point of pioneering his sea-traffic-control effort first inside the Mediterranean, where NATO&#39;s southern naval forces have historically been concentrated, but his real target was waters off Africa -- the most ungoverned maritime space in the world.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">Ulrich knew the U. S. Navy couldn&#39;t do it alone, much less bring Africa&#39;s meager coast-guard-like navies up to snuff so they could do it on their own. So he quickly created a network of assets -- both public and private -- to manage that space, modeling his monitoring system on international air-traffic control.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">Ulrich began stitching together a network of shore-based sensors ringing the Mediterranean. His naval command then began initial monitoring by tapping into the International Maritime Organization&#39;s existing Automated Identification System, transforming NATO&#39;s ability to track ship traffic in the Med.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">Almost overnight, NATO went from tracking dozens of ships on the Mediterranean to thousands, and instead of getting the data sometimes up to 72 hours late, now the contacts were being tracked in one to five minutes -- to an accuracy within 50 feet on the earth&#39;s surface.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">When the classic big-firm systems integrators told Ulrich it would be too costly to pull it off, the admiral turned to the Volpe Center in Cambridge, Massachusetts, a U.S. Department of Transportation research center. Instead of hundreds of millions of dollars, Ulrich&#39;s initial network cost $900,000. The shore-based receivers are small, roughly the size of a radar dish you might find on a pleasure craft.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">The strength of the system is a function of its reach: the more countries join, the larger the shared operational picture. By the time Ulrich retired at the end of 2007, he had enlisted 32 countries throughout the Mediterranean, the North Atlantic, along the west coast of Africa, around the Black Sea, and in the Pacific. Today, the network continues to spread around the planet.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; font-size: 14px; line-height: 20px; "><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">With Ulrich&#39;s system in place, local police, coast guards, and border patrols catch most bad guys, obviating American military responses. As Harry told me for an article I wrote about his work in a fall 2007 issue of Esquire, </span><span style="font-weight: bold; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">&quot;I don&#39;t do defense; I do security. When you talk defense, you talk containment and mutually assured destruction. When you talk security, you talk collaboration and networking. This is the future.&quot;</span></span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">The admiral&#39;s legacy program, the Maritime Safety and Security Information System, earned the Volpe Center a prestigious &quot;Innovations in American Government&quot; award this month from Harvard University&#39;s Ash Institute for Democratic Governance and Innovation.</span></p></blockquote><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p><div><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">Security Collaboration + Networking &#160;= Federation. This is indeed the future - SAML came along just at the nick of time.</span></div><div><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></div><div><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">When you assume that to do access control you must have &quot;Complete Mediation&quot; in Saltzer and Schroeder&#39;s terms of the subject (users), the objects (data), the session, and the roles, then you are going to have an interesting life trying to deliver anything. And if you do it will mucho expensive.</span></div><div><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></div><div><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">if you take the federated autonomous nodes approach, agree upon an attribute schema plus a protection model for same, and basic protocol, you are then free to move about the country. Security doesn&#39;t have to equal centralization or high cost. Get the attributes from point a to point b securely.</span></div>]]></content:encoded>
      <pubDate>Sun, 28 Sep 2008 19:04:11 +0000</pubDate>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/security architect">security architect</category>
      <category domain="http://securityratty.com/tag/system">system</category>
      <category domain="http://securityratty.com/tag/identification system">identification system</category>
      <category domain="http://securityratty.com/tag/initial network cost">initial network cost</category>
      <category domain="http://securityratty.com/tag/initial">initial</category>
      <category domain="http://securityratty.com/tag/cost">cost</category>
      <category domain="http://securityratty.com/tag/ulrich">ulrich</category>
      <category domain="http://securityratty.com/tag/time ulrich">time ulrich</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/09/of-planes-and-ships.html">Of Planes and Ships</source>
    </item>
    <item>
      <title><![CDATA[Interop NY: The ROI of Social Networking]]></title>
      <link>http://securityratty.com/article/8c52c835add6dca7c33f67c83e868434</link>
      <guid>http://securityratty.com/article/8c52c835add6dca7c33f67c83e868434</guid>
      <description><![CDATA[How do you derive business value from social networks
Moderator: Nick Hoover, Senior Editor, InformationWeek
Speaker - Anne Berkowitch, Co-Founder &amp; CEO, SelectMinds
Speaker - J.B. Holston, CEO and...]]></description>
      <content:encoded><![CDATA[<p>How do you derive business <a href="http://www.interop.com/newyork/conference/enterprise-20.php" target="_blank">value from social networks</a>?</p>
<ul>
<li>Moderator: Nick Hoover, Senior Editor, InformationWeek</li>
<li>Speaker - Anne Berkowitch, Co-Founder &amp; CEO, SelectMinds</li>
<li>Speaker - J.B. Holston, CEO and President, NewsGator</li>
<li>Speaker - Umberto Milletti, CEO, InsideView</li>
</ul>
<p>Businesses can take advantage of social networks by finding innovative ways to reach out to people. Looking at who you know and how you know them can benefit you. Knowing a personal connection to someone that you are trying to contact (for sales) is helpful. The blurring between home, personal, and business life is making this information more available and better able to leverage. People are able to capture more valuable long term information from social networks.</p>
<p>A lot of social network applications can be taken from the talent management space. Deploying alumni networks as a talent source is also a great asset. Alumni represent a well-known and relevant population. This provides a great economic benefit from a social network.</p>
<p>If you are running a sales organization and looking at building a pipeline of leads, consider how these leads are relevant. The ability to get more leads is apparent in finding the right person, right connection, and right contact. Underlying everything are productivity and efficiency. How much time are sales reps spending researching and pursuing each opportunity? With information on social networks, the time can be greatly decreased. Knowledge sharing is something that can be actively measured.</p>
<p>The ROI varies with the business issue that&#8217;s trying to be addressed by a particular network. Recruiting for example has a very concrete, measurable ROI. Knowledge share gets a little more tricky. How do you measure how much is shared and the impact on business systems? Businesses need to determine what specific goal they are trying to address.</p>
<p>CFOs want to see ROI, not intuitive information. If you can demonstrate engagement and participation in these networks and knowledge sharing tools, more and more executives are getting comfortable seeing how it&#8217;s used at a qualitative and process level. It&#8217;s a very case by case basis.</p>
<p>One major crisis that we see in our customers is the competition between sales and marketing. Each wants to do their own thing, they go together like oil and water. However, the push of the economy is now forcing them work together. This is a great opportunity for IT to step in and help them collaborate and be more productive.</p>
<p>Other resistance from companies are how to manage what they are trying to accomplish while still giving employees free reign of sites like Facebook. What are the incentives for using these technologies? How does it fit into your company culture and productivity scale? You must bring meaning to the structure of engaging in social networks.</p>
<p>Social networks like LinkedIn and Facebook would not exist if people did not contribute information to them. However, if people don&#8217;t know that it is there, it does not exist. People need to see the value and get drawn in to engage. There are two ways that companies get into social networks. Tie it into the business process. The general idea of social networks are intuitive and easy to understand, which make it an easier case to present to chief executives. Make it clear - how do you go about it and what&#8217;s the value?</p>
<p>Social networks are intrinsically about extending the network, the more contacts you have, the more to choose from when researching a specific contact. It also has to be integrated into your dataworkflow. Companies are going to build a variety of networks inside and outside the enterprise. The big companies (SAP, IBM) are all rushing to offer collaborative and social network functionality. However, this is not entirely useful unless it&#8217;s integrated into the entire infrastructure.</p>
]]></content:encoded>
      <pubDate>Wed, 17 Sep 2008 17:54:45 +0000</pubDate>
      <category domain="http://securityratty.com/tag/alumni networks">alumni networks</category>
      <category domain="http://securityratty.com/tag/social network applications">social network applications</category>
      <category domain="http://securityratty.com/tag/networks">networks</category>
      <category domain="http://securityratty.com/tag/social network">social network</category>
      <category domain="http://securityratty.com/tag/networks inside">networks inside</category>
      <category domain="http://securityratty.com/tag/social networks">social networks</category>
      <category domain="http://securityratty.com/tag/social network functionality">social network functionality</category>
      <category domain="http://securityratty.com/tag/network">network</category>
      <category domain="http://securityratty.com/tag/roi">roi</category>
      <source url="http://blog.sciencelogic.com/interop-ny-the-roi-of-social-networking/09/2008">Interop NY: The ROI of Social Networking</source>
    </item>
    <item>
      <title><![CDATA[Interop NY Keynotes: IBM]]></title>
      <link>http://securityratty.com/article/44ba0e9ad08b54462e9c92a6c54837a5</link>
      <guid>http://securityratty.com/article/44ba0e9ad08b54462e9c92a6c54837a5</guid>
      <description><![CDATA[Day one of Interop NY began with an introduction from Interop Manager Lenny Heymann, then Bob Picciano, General manager Lotus software and WebSpehere Portal IBM took the stage
IBMs presentation was...]]></description>
      <content:encoded><![CDATA[<p>Day one of Interop NY began with an introduction from Interop Manager Lenny Heymann, then Bob Picciano, General manager Lotus software and WebSpehere Portal IBM took the stage.</p>
<p>IBM&#8217;s presentation was cleverly titled <strong>2mor0@Wrk</strong> - Tomororow work and Web 2.0.</p>
<p><strong>Overview</strong></p>
<p>Web 2.0 is delivering a whole different paradigm of communication. The slide is Lotus Symphony - NOT PPT. Over 2 million downloads.</p>
<p>There is an information overload that impacts individual productivity in the workplace. It has a profound effect on organizational productivity. A more complex organization entity provides more pressure and more inefficiencies in workplace. Up to 70% of time can be used looking for the WRONG information.</p>
<p>Collaboration mitigates information overload. It allows you to identify experts and opinions.</p>
<p>The collaboration agenda. Enterprises are at the onset of exploring these features. Web 2.0 is giving us the capacity to do more. Collaboration optimizes business outcomes - global, secure and dynamic.The most progressive companies are looking at UNIFIED COMMUNICATIONS. Making sure that directories and profiles are fully mobile.</p>
<p>Collaboration should be a contextual part of the workflow, going directly into applications.</p>
<p>IBM&#8217;s collaboration strategy is to deliver these services through online or offline services.</p>
<p><strong>Demonstration</strong></p>
<p>Executive IT architect Ron Sebastian provided a demonstration of IBM&#8217;s collaboration strategy. IBM&#8217;s Web 2.0 solutions span delivery platforms:</p>
<ul>
<li>Platform - web as&nbsp; platform</li>
<li>Application - development</li>
<li>People - social computing</li>
</ul>
<p><a href="http://www-01.ibm.com/software/lotus/products/connections/" target="_blank">Lotus Connections</a> - a family of social computing software that provides profile lookup and community capabilities. Think of Facebook, Yahoo Groups, and delicious combined in one portal.</p>
<p>Ron demonstrated these social services embedded into a healthcare provider application. Semantic tagging is available, contact information and commenting. Not only are we providing service to customers, you can integrate sync capability to directly call the person you want.</p>
<p>The biggest aspect of Lotus Connection? It&#8217;s all integrated.</p>
<p>A new service - <a href="https://www.bluehouse.lotus.com/" target="_blank">Project Bluehouse</a>. This is a SaaS delivery of these collaborated capabilities. The store and share can manage and share documents within and outside the company. Access control is no longer an issue.</p>
<p>Collaborative Web 2.0 services available as standalone products that also work in a mobile environment.</p>
<p><strong>Case Study: Natural Disaster Management Mashup</strong></p>
<p>Boeing came up with twenty different scenarios that they could handle through their systems. The problem was the one they didn&#8217;t count on. One example was Katrina - how to deliver supplies to the area: what airports were open? Where could they land? The problem was they could not find one list of public, private and military airports, nor what was open. The mashup took different feeds to allow the deacon maker to make a more rapid and intelligent decision based on information on where they could fly in the appropriate supplies. From open information sites like <a href="http://www.airnav.com/" target="_blank">AirNav.com</a> and personal contacts, users were able to mashup the information to make better decisions.</p>
<p><strong>Conclusion</strong></p>
<p><a href="http://www.eweek.com/c/a/Messaging-and-Collaboration/IBM-to-Unveil-Social-Software-Center-at-Interop/" target="_blank">IBM announced the IBM Center for Social Software</a>, proving their commitment to connect, collaborate, and innovate. Users and academics can work together to how these innovations can be applied to businesses and provide value to the market.</p>
<p>There has been <a href="http://teblog.typepad.com/david_tebbutt/2008/04/ibms-bluehouse.html" target="_blank">some question</a> of whether or not IBM can pull this off and move into the collaborative Web 2.0 market. Despite <a href="http://www.theappgap.com/ibm-bluehouse-organizes-online-meetings-and-the-before-and-after.html" target="_blank">some criticism</a>, it looks like IBM has really taken a step forward in advancing their products and services to meet market needs.</p>
<p>People drive better business outcomes. Connecting, collaboration, and innovation is key. Having the right tools and information to do that eases pressure that many organizations feel and brings Web 2.0 technologies to the heart of businesses.</p>
]]></content:encoded>
      <pubDate>Wed, 17 Sep 2008 09:39:59 +0000</pubDate>
      <category domain="http://securityratty.com/tag/ibm">ibm</category>
      <category domain="http://securityratty.com/tag/information sites">information sites</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/collaboration">collaboration</category>
      <category domain="http://securityratty.com/tag/web">web</category>
      <category domain="http://securityratty.com/tag/social">social</category>
      <category domain="http://securityratty.com/tag/ibms collaboration strategy">ibms collaboration strategy</category>
      <category domain="http://securityratty.com/tag/social services">social services</category>
      <category domain="http://securityratty.com/tag/collaborative web">collaborative web</category>
      <source url="http://blog.sciencelogic.com/interop-ny-keynotes-ibm/09/2008">Interop NY Keynotes: IBM</source>
    </item>
    <item>
      <title><![CDATA[Skype Spamming Tool in the Wild - Part Two]]></title>
      <link>http://securityratty.com/article/2f4b287e34b2a08136f91837e197028e</link>
      <guid>http://securityratty.com/article/2f4b287e34b2a08136f91837e197028e</guid>
      <description><![CDATA[The less technologically sophisticated lone cybercriminals have always enjoyed the benefits of stand alone DIY applications. From DIY exploit embedding tools in a Cybercrime 1.0 world , maturing to...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://2.bp.blogspot.com/_wICHhTiQmrA/SMqdKYNwv9I/AAAAAAAACKE/hHcsAQOFSi8/s1600-h/skype_spamming_tool_02.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://2.bp.blogspot.com/_wICHhTiQmrA/SMqdKYNwv9I/AAAAAAAACKE/sy6IR6q_hyE/s200-R/skype_spamming_tool_02.jpg" /></a>The less technologically sophisticated lone cybercriminals have always enjoyed the benefits of stand alone DIY applications. From <a href="http://ddanchev.blogspot.com/2007/09/diy-exploits-embedding-tools.html">DIY exploit embedding tools</a> in a <a href="http://ddanchev.blogspot.com/2008/04/diy-exploit-embedding-tool-proprietary.html">Cybercrime 1.0 world</a>, maturing to today's <a href="http://ddanchev.blogspot.com/2008/08/web-based-botnet-command-and-control.html">web malware exploitation kits</a> and their <a href="http://ddanchev.blogspot.com/2008/09/copycat-web-malware-exploitation-kits.html">copycat alternatives</a>, to plain simple spamming tools that matured into <a href="http://blogs.zdnet.com/security/?p=1899">today's managed spamming services</a> already starting to offer spamming services beyond email, stand alone spamming applications remain pretty popular.<br />
<br />
With yet another <a href="http://ddanchev.blogspot.com/2008/04/skype-spamming-tool-in-wild.html">Skype spamming tool</a> released in the wild, which just like the previous one I discussed a couple of months relies on Skype's support for wildcast searches, and is spamming with authorization request messages until the user adds the contact, malicious parties seems to be more interested into supplying the desired services, than emphasizing on the quality assurance process.<br />
<br />
Despite the possibilities for localized targeted attacks delivering messages with malicious URLs into the user's native language, benchmarking this tool's features next to the ones offered by certain bots taking advantage of social engineering by spamming the infected host's contacts, is positioning it far behind even the most primitive IM spreading bot modules, whose extra layer of social engineering personalization makes their IM malware campaigns much more effective ones.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2008/05/harvesting-youtube-usernames-for.html">Harvesting Youtube Usernames for Spamming</a><br />
<a href="http://ddanchev.blogspot.com/2008/02/uncovering-msn-social-engineering-scam.html">Uncovering a MSN Social Engineering Scam</a><br />
<a href="http://ddanchev.blogspot.com/2007/05/msn-spamming-bot.html">MSN Spamming Bot</a><br />
<a href="http://ddanchev.blogspot.com/2008/01/diy-fake-msn-client-stealing-passwords.html">DIY Fake MSN Client Stealing Passwords</a><br />
<a href="http://ddanchev.blogspot.com/2007/10/thousands-of-im-screen-names-in-wild.html">Thousands of IM Screen Names in the Wild</a><br />
<a href="http://ddanchev.blogspot.com/2007/11/yahoo-messenger-controlled-malware.html">Yahoo Messenger Controlled Malware</a><b> <br />
</b><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=DnpcL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=DnpcL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=JdbNL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=JdbNL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=WyKQl"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=WyKQl" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=gjRhl"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=gjRhl" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=MFoXL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=MFoXL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=cB2ML"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=cB2ML" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=XFyul"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=XFyul" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/393258731" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 15 Sep 2008 05:28:04 +0000</pubDate>
      <category domain="http://securityratty.com/tag/social">social</category>
      <category domain="http://securityratty.com/tag/msn social">msn social</category>
      <category domain="http://securityratty.com/tag/tool">tool</category>
      <category domain="http://securityratty.com/tag/skype">skype</category>
      <category domain="http://securityratty.com/tag/wild">wild</category>
      <category domain="http://securityratty.com/tag/bot">bot</category>
      <category domain="http://securityratty.com/tag/msn">msn</category>
      <category domain="http://securityratty.com/tag/malware campaigns">malware campaigns</category>
      <category domain="http://securityratty.com/tag/malware">malware</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/393258731/skype-spamming-tool-in-wild-part-two.html">Skype Spamming Tool in the Wild - Part Two</source>
    </item>
    <item>
      <title><![CDATA[Automated Spim on Microblogging Site Via MSN Messenger]]></title>
      <link>http://securityratty.com/article/e5a1fb1ee8285e5dda0e9ae590ea20f2</link>
      <guid>http://securityratty.com/article/e5a1fb1ee8285e5dda0e9ae590ea20f2</guid>
      <description><![CDATA[There's been a fair amount of Twitter coverage recently, but it's worth noting that other countries have their own versions of Twittering and some of them have seem to be a little easier to use in...]]></description>
      <content:encoded><![CDATA[
        There's been a fair amount of <a href="http://blogs.zdnet.com/security/?p=1640">Twitter coverage</a> recently, but it's worth noting that other countries have their own versions of Twittering and some of them have seem to be a little easier to use in conjunction with Instant Messaging, whereas Twitter still seems to have a need for <a href="http://www.twittermsn.com/">third party services</a>, <a href="http://kunal.kundaje.net/twessenger/">add-ins</a> and <a href="http://www.theyagar.com/2008/01/30/twitter-bot-for-yahoo/">other tools</a> to get the job done if the service used is something other than Google Talk, Livejournal Chat or Jabber (if it's now more straightforward for other clients too, please let me know!)<br /><br />Either way, the below illustrates why adding Instant Messaging features to services such as Twitter can cause problems in the long run and needs to be considered carefully.<br /><br />We were alerted to the fact that a large amount of Spam seemed to be coming out of China in the last day or two (indeed, one contact mentioned to me that this particular message had been sent to their Honeypot around 29,000+ times, which is a lot of spamming for one URL however you look at it). The spam in question seemed to have been sent via a Spambot, and the only mentions of this URL so far in search engines seems to be related to China - shall we take a look?<br /><br />The URL in question (with part of it redacted) is<br /><br />http: //5834******/ ;)<br /><br />You'll notice the spam is short, snappy and also includes a little smiley-face thing at the end. In fact, it looks a little bit like the kind of link people send to their contacts on Twitter, doesn't it?<br /><br />Well, let's see - a quick search and we find this:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/fanf1.html" onclick="window.open('http://blog.spywareguide.com/images/fanf1.html','popup','width=780,height=584,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/fanf1-thumb-380x284.jpg" alt="fanf1.jpg" class="mt-image-none" style="" height="284" width="380" /></a></span>
<br /><br />Click to Enlarge<br /></div><br />A page from Fanfou.com, which I believe is a Chinese site "<a href="http://www.twittown.com/fanfou">inspired</a>" by Twitter with much of the same features and functionality. In fact, it has one feature working straight off the bat that Twitter users previously had to rely on <a href="http://kunal.kundaje.net/twessenger/">plugins</a> for - the ability to send messages to their page via MSN Messenger updates.<br /><br />http: //5834****** doesn't actually resolve anywhere - however, a quick Ping to that address and we have an IP:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/fanf3.html" onclick="window.open('http://blog.spywareguide.com/images/fanf3.html','popup','width=452,height=212,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/fanf3-thumb-352x165.jpg" alt="fanf3.jpg" class="mt-image-none" style="" height="165" width="352" /></a></span>
<br /><br />Click to Enlarge<br /></div><br />Type the IP address into the browser, and via some geolocational technology, you'll see a region specific version of the following dating website:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/fanf4.html" onclick="window.open('http://blog.spywareguide.com/images/fanf4.html','popup','width=780,height=564,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/fanf4-thumb-380x274.jpg" alt="fanf4.jpg" class="mt-image-none" style="" height="274" width="380" /></a></span>
<br /><br />Click to Enlarge<br /></div><br />Go back to the page on Fanfou.com, scroll down and select any of the clickable links and surprise - the same page appears. This particular account on Fanfou has something like 30+ pages devoted to endless Spim links via MSN. They link to placeholder pages, sites that look as though they've been suspended and / or deleted with no way to determine what content was there previously - all interspersed with "Twitter" style messages throughout such as this:<br /><br /><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="fanf5.jpg" src="http://blog.spywareguide.com/images/fanf5.jpg" class="mt-image-none" style="" height="27" width="208" /></span>
<br /><br />Again, note everything is coming via MSN. By this point, you're probably wondering exactly how they allow you to send messages to their Twitter-style pages. Well, the solution is quite clever - check out the <a href="http://help.fanfou.com/im.html">IM page</a>. You enter your MSN address, and when you login to your MSN account, you'll suddenly find you have a new IM buddy who wants to be a contact:<br /><br /><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="fanf6.jpg" src="http://blog.spywareguide.com/images/fanf6.jpg" class="mt-image-none" style="" height="189" width="475" /></span>
<br /><br />Add it, and whenever you want to put a message on your page, send it an <a href="http://blog.spywareguide.com/image/fanf7.jpg">instant message</a> and, lo and behold, your Tweet-style message has appeared on your page:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/fanf8.html" onclick="window.open('http://blog.spywareguide.com/images/fanf8.html','popup','width=541,height=241,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/fanf8-thumb-341x151.jpg" alt="fanf8.jpg" class="mt-image-none" style="" height="151" width="341" /></a></span><br /><br />Click to Enlarge<br /></div><br />In conclusion, the steps here appear to be<br /><br /><b>1)</b> Create a Spambot that infects users via MSN Messenger<br /><b>2)</b> Tailor the messages it sends to be short and sweet, just like a Twitter-style message<br /><b>3)</b> Set up an account on a service such as Fanfou.com that makes it easy to send messages to your page via MSN Messenger (or other IM services affected by your bot)<br /><b>4)</b> Infect the PC running your MSN Messenger account then watch as it spams the userpage with whatever messages you want it to send.<br /><br />Of course, the links can be anything from dating sites and ringtone adverts to infection files and exploits - all made so much more easier (and far less time consuming than manually typing in URLs to your userpage) by the functionality built into the site you happen to be using. It's also worth noting that the accounts sending the Spim don't <i>have</i> to be set up by the spammer - they could be compromised accounts that had been hijacked when clicking a rogue IM link, which is a great way of filling out the spamming ranks very quickly.<br /><br />This is definitely something Twitter - and any other site out there involved in <a href="http://en.wikipedia.org/wiki/Micro-blogging">microblogging</a> - need to keep an eye out for, and consider carefully when thinking of adding integration with popular Instant Messaging clients.<br /><br />We detect the file sending the weblinks via MSN as <a href="http://www.spywareguide.com/product_show.php?id=32320">Foubot</a>.<br /><br />Research and Writeup: Christopher Boyd, Director of Malware Research<br />Additional Research: Chris Mannon, Senior Threat Researcher<br /><div><br /></div>
        
    ]]></content:encoded>
      <pubDate>Thu, 07 Aug 2008 17:12:09 +0000</pubDate>
      <category domain="http://securityratty.com/tag/msn messenger">msn messenger</category>
      <category domain="http://securityratty.com/tag/msn">msn</category>
      <category domain="http://securityratty.com/tag/message">message</category>
      <category domain="http://securityratty.com/tag/msn messenger account">msn messenger account</category>
      <category domain="http://securityratty.com/tag/twitter-style message">twitter-style message</category>
      <category domain="http://securityratty.com/tag/account">account</category>
      <category domain="http://securityratty.com/tag/msn account">msn account</category>
      <category domain="http://securityratty.com/tag/twitter-style pages">twitter-style pages</category>
      <category domain="http://securityratty.com/tag/pages">pages</category>
      <source url="http://blog.spywareguide.com/2008/08/automated-spim-on-microbloggin.html">Automated Spim on Microblogging Site Via MSN Messenger</source>
    </item>
    <item>
      <title><![CDATA[Phishing Messages on XBox Live Network]]></title>
      <link>http://securityratty.com/article/2cd29b729c2788c0a5a83883782c45dc</link>
      <guid>http://securityratty.com/article/2cd29b729c2788c0a5a83883782c45dc</guid>
      <description><![CDATA[You may or may not have come across these before, but there seems to be a fresh set of phish messages (most likely from compromised accounts) being fired around XBox Live using the lure of free...]]></description>
      <content:encoded><![CDATA[
        You may or may not have come across these before, but there seems to be a fresh set of phish messages (most likely from compromised accounts) being fired around XBox Live using the lure of free Microsoft points as bait (gamers can use these points to buy games, amongst other things).<br /><br />Consequently, if you happen to be sent something like this by one of your contacts:<br /><br /><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="xbox.jpg" src="http://blog.spywareguide.com/images/xbox.jpg" class="mt-image-none" style="" height="118" width="403" /></span><br /> <div><br />...then run away very quickly. In this case, the website was made to look like a genuine login page - of course, when you entered your details you had been phished and would be returned to the real XBox page as if nothing untoward had happened.<br /><br />The phishing page above is currently offline, but may well return (and obviously it's the easiest thing in the world for the scammer behind this to simply change the URL being sent out by hijacked accounts).<br /></div>
        
    ]]></content:encoded>
      <pubDate>Tue, 05 Aug 2008 12:24:21 +0000</pubDate>
      <category domain="http://securityratty.com/tag/page">page</category>
      <category domain="http://securityratty.com/tag/real xbox page">real xbox page</category>
      <category domain="http://securityratty.com/tag/genuine login page">genuine login page</category>
      <category domain="http://securityratty.com/tag/xbox live">xbox live</category>
      <category domain="http://securityratty.com/tag/phish messages">phish messages</category>
      <category domain="http://securityratty.com/tag/fresh set">fresh set</category>
      <category domain="http://securityratty.com/tag/free microsoft">free microsoft</category>
      <category domain="http://securityratty.com/tag/accounts">accounts</category>
      <category domain="http://securityratty.com/tag/simply change">simply change</category>
      <source url="http://blog.spywareguide.com/2008/08/phishing-messages-on-xbox-live.html">Phishing Messages on XBox Live Network</source>
    </item>
    <item>
      <title><![CDATA[Quick thoughts on using the iPhone 3G]]></title>
      <link>http://securityratty.com/article/7e0dbb56452b0c71a5581a5ba7926361</link>
      <guid>http://securityratty.com/article/7e0dbb56452b0c71a5581a5ba7926361</guid>
      <description><![CDATA[So I got my iPhone 3G on Friday morning and have been using it for a few days now. I have never used one before, don't use an iPod or even a Mac computer. The iPhone was incredibily easy to use and...]]></description>
      <content:encoded><![CDATA[
<div xmlns="http://www.w3.org/1999/xhtml"><p>So I got my iPhone 3G on Friday morning and have been using it for a few days now. I have never used one before, don't use an iPod or even a Mac computer.&nbsp; The iPhone was incredibily easy to use and without using and manuals quickly had a most everything working and downloaded a bunch of apps from the app store.&nbsp; </p>

<p>Over all, the iPhone just is really nice to use and in many ways very easy, polished and intuitive. In other ways, it is still missing some key features in my book:</p>

<ol><li>Sort and filter email be date, sender, etc.</li>

<li>Select more than one mail at a time to delete, move, copy.&nbsp; Yes I know you can go to edit and select messages to work on, but you still have to select them one at a time. In <a class="zem_slink" title="Windows Mobile" href="http://microsoft.com/windowsmobile/" rel="homepage">Windows Mobile</a> you can just run your finger over multiple messages to complete this.</li>

<li>Deleting duplicate contacts in bulk.&nbsp; Doing them one at a time is just painful</li>

<li>A task manager. I would like to see some list that shows me which apps are running, how many resources they are using, battery usage and stuff like that.&nbsp; Also to shut down running apps</li>

<li>Better calendar integration. I tried to click on and open calendar items, but just does not seem to work.</li>

<li>The battery sucks! I am not getting more than about 6 to 7 hours of battery time. I think I have to turn off the push for my Exchange email.&nbsp; This is much less that I was getting on my Windows Mobile phone. </li></ol>

<p>I do like the phone, the iPod MP3 and camera and the overall &quot;feel&quot; of the phone. Went to the Apple store in the maill (which was jam packed) and bought a rubberized case, but was unable to get a phone car charger for it yet.&nbsp; I ordered one for 5 bucks on Amazon and will see it if works.</p>

<p>All in all, things are OK but I am going to withhold my final verdict for a while yet.</p>

<fieldset class="zemanta-related"><legend class="zemanta-related-title">Related articles by Zemanta</legend><ul class="zemanta-article-ul"><li class="zemanta-article-ul-li"><a href="http://news.cnet.com/8301-13579_3-9994744-37.html?hhTest=1&amp;part=rss&amp;subj=news">What iPhone? Apple earnings (still) about the Mac</a></li>

<li class="zemanta-article-ul-li"><a href="http://www.tuaw.com/2008/07/21/mod-your-dock-to-work-with-iphone-3g/">Mod your dock to work with iPhone 3G</a></li>

<li class="zemanta-article-ul-li"><a href="http://www.sauria.com/blog/2008/07/20/my-initial-iphone-experience/">My initial iPhone experience</a></li></ul></fieldset> <div class="zemanta-pixie" style="MARGIN-TOP: 10px; HEIGHT: 15px"><a class="zemanta-pixie-a" title="Zemified by Zemanta" href="http://reblog.zemanta.com/zemified/85ef20ad-b620-4d16-9f87-17955147e8a7/"><img class="zemanta-pixie-img" alt="Zemanta Pixie" src="http://img.zemanta.com/reblog_e.png?x-id=85ef20ad-b620-4d16-9f87-17955147e8a7" style="BORDER-RIGHT: medium none; BORDER-TOP: medium none; FLOAT: right; BORDER-LEFT: medium none; BORDER-BOTTOM: medium none" /></a></div></div>
]]></content:encoded>
      <pubDate>Tue, 22 Jul 2008 05:36:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/iphone">iphone</category>
      <category domain="http://securityratty.com/tag/phone car charger">phone car charger</category>
      <category domain="http://securityratty.com/tag/phone">phone</category>
      <category domain="http://securityratty.com/tag/initial iphone experience">initial iphone experience</category>
      <category domain="http://securityratty.com/tag/windows mobile phone">windows mobile phone</category>
      <category domain="http://securityratty.com/tag/windows mobile">windows mobile</category>
      <category domain="http://securityratty.com/tag/time">time</category>
      <category domain="http://securityratty.com/tag/battery time">battery time</category>
      <category domain="http://securityratty.com/tag/select messages">select messages</category>
      <source url="http://www.stillsecureafteralltheseyears.com/ashimmy/2008/07/quick-thoughts.html">Quick thoughts on using the iPhone 3G</source>
    </item>
    <item>
      <title><![CDATA[Quick thoughts on using the iPhone 3G]]></title>
      <link>http://securityratty.com/article/0cfe5d9fddb01551dfe3d3dcb40ee176</link>
      <guid>http://securityratty.com/article/0cfe5d9fddb01551dfe3d3dcb40ee176</guid>
      <description><![CDATA[So I got my iPhone 3G on Friday morning and have been using it for a few days now. I have never used one before, don't use an iPod or even a Mac computer. The iPhone was incredibily easy to use and...]]></description>
      <content:encoded><![CDATA[
<div xmlns="http://www.w3.org/1999/xhtml"><p>So I got my iPhone 3G on Friday morning and have been using it for a few days now. I have never used one before, don't use an iPod or even a Mac computer.&nbsp; The iPhone was incredibily easy to use and without using and manuals quickly had a most everything working and downloaded a bunch of apps from the app store.&nbsp; </p>

<p>Over all, the iPhone just is really nice to use and in many ways very easy, polished and intuitive. In other ways, it is still missing some key features in my book:</p>

<ol><li>Sort and filter email be date, sender, etc.</li>

<li>Select more than one mail at a time to delete, move, copy.&nbsp; Yes I know you can go to edit and select messages to work on, but you still have to select them one at a time. In <a class="zem_slink" title="Windows Mobile" href="http://microsoft.com/windowsmobile/" rel="homepage">Windows Mobile</a> you can just run your finger over multiple messages to complete this.</li>

<li>Deleting duplicate contacts in bulk.&nbsp; Doing them one at a time is just painful</li>

<li>A task manager. I would like to see some list that shows me which apps are running, how many resources they are using, battery usage and stuff like that.&nbsp; Also to shut down running apps</li>

<li>Better calendar integration. I tried to click on and open calendar items, but just does not seem to work.</li>

<li>The battery sucks! I am not getting more than about 6 to 7 hours of battery time. I think I have to turn off the push for my Exchange email.&nbsp; This is much less that I was getting on my Windows Mobile phone. </li></ol>

<p>I do like the phone, the iPod MP3 and camera and the overall &quot;feel&quot; of the phone. Went to the Apple store in the maill (which was jam packed) and bought a rubberized case, but was unable to get a phone car charger for it yet.&nbsp; I ordered one for 5 bucks on Amazon and will see it if works.</p>

<p>All in all, things are OK but I am going to withhold my final verdict for a while yet.</p>

<fieldset class="zemanta-related"><legend class="zemanta-related-title">Related articles by Zemanta</legend><ul class="zemanta-article-ul"><li class="zemanta-article-ul-li"><a href="http://news.cnet.com/8301-13579_3-9994744-37.html?hhTest=1&amp;part=rss&amp;subj=news">What iPhone? Apple earnings (still) about the Mac</a></li>

<li class="zemanta-article-ul-li"><a href="http://www.tuaw.com/2008/07/21/mod-your-dock-to-work-with-iphone-3g/">Mod your dock to work with iPhone 3G</a></li>

<li class="zemanta-article-ul-li"><a href="http://www.sauria.com/blog/2008/07/20/my-initial-iphone-experience/">My initial iPhone experience</a></li></ul></fieldset> <div class="zemanta-pixie" style="MARGIN-TOP: 10px; HEIGHT: 15px"><a class="zemanta-pixie-a" title="Zemified by Zemanta" href="http://reblog.zemanta.com/zemified/85ef20ad-b620-4d16-9f87-17955147e8a7/"><img class="zemanta-pixie-img" alt="Zemanta Pixie" src="http://img.zemanta.com/reblog_e.png?x-id=85ef20ad-b620-4d16-9f87-17955147e8a7" style="BORDER-RIGHT: medium none; BORDER-TOP: medium none; FLOAT: right; BORDER-LEFT: medium none; BORDER-BOTTOM: medium none" /></a></div></div>

<p><a href="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?a=9KiZv6"><img src="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?i=9KiZv6" border="0"></img></a></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=IOYoQJ"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=IOYoQJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=mSxf2J"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=mSxf2J" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=OhjTRJ"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=OhjTRJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=vXaNrJ"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=vXaNrJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=3F1Amj"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=3F1Amj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=RXYnnj"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=RXYnnj" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~4/342550630" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 22 Jul 2008 04:36:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/iphone">iphone</category>
      <category domain="http://securityratty.com/tag/phone car charger">phone car charger</category>
      <category domain="http://securityratty.com/tag/phone">phone</category>
      <category domain="http://securityratty.com/tag/initial iphone experience">initial iphone experience</category>
      <category domain="http://securityratty.com/tag/windows mobile phone">windows mobile phone</category>
      <category domain="http://securityratty.com/tag/windows mobile">windows mobile</category>
      <category domain="http://securityratty.com/tag/time">time</category>
      <category domain="http://securityratty.com/tag/battery time">battery time</category>
      <category domain="http://securityratty.com/tag/select messages">select messages</category>
      <source url="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~3/342550630/quick-thoughts.html">Quick thoughts on using the iPhone 3G</source>
    </item>
    <item>
      <title><![CDATA[Mailing error at the University of Maryland exposes student information]]></title>
      <link>http://securityratty.com/article/a51262d40f98a67474833c65ff29621e</link>
      <guid>http://securityratty.com/article/a51262d40f98a67474833c65ff29621e</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
7/17/08

Organization
University of Maryland

Contractor/Consultant/Branch
Department of Transportation Services

Victims
All students registered for...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/umd.jpg" width="88" align="right" height="83"><font size="2"><b>Date Reported: </b><br>7/17/08<br><br><b>Organization: </b><br><a href="http://www.umd.edu/">University of Maryland</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://www.transportation.umd.edu/index.html">Department of Transportation Services</a> <br><br><span style="font-weight: bold;">Victims:</span><br>All students registered for Fall 2008 classes<br><br><span style="font-weight: bold;">Number Affected:</span><br>23,727<br><br><span style="font-weight: bold;">Types of Data:</span><br>Names, addresses, and Social Security numbers<br><br><span style="font-weight: bold;">Breach Description:</span><br>On July 1st, 2008, the University of Maryland Department of Transportation Services mailed an </font><font size="2">on-campus parking </font><font size="2">brochure to all students </font><font size="2">registered for Fall 2008 classes</font><font size="2"> as of June 15, 2008.&nbsp; Recipient Social Security numbers were inadvertently exposed on the mailing labels.<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.transportation.umd.edu/parkingmailer/">University of Maryland</a> <br><a href="http://www.wjla.com/news/stories/0708/536794.html">ABC Channel 7 News</a> <br><a href="http://www.wtop.com/?sid=1442585&amp;nid=25">WTOP FM 103.5 News</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>University of Maryland<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>On July 1st, 2008, the University of Maryland’s Department of Transportation Services sent all students registered at the time, by U.S. mail, a brochure with on-campus parking information.<br><br>On July 8, 2008, the University discovered that the labels on that mailing included the addressees’ Social Security numbers.<br><span style="font-style: italic;">[Evan] Sheesh, a fraudster doesn't even have to tamper with the mail if the Social Security number is on the label.</span><br><br>The error was discovered on the morning of July 8 when calls were made to the University.<br><br>This parking mailer was sent to all individuals registered for Fall 2008 classes at the University of Maryland as of June 15, 2008.<br><br>The mailing list numbered 23,727 individuals.<br><br>In our annual effort to provide parking and transportation information to the University community, the names and addresses of all registered students was requested internally at the Department of Transportation Services for the purpose of creating mailing labels for a brochure.<br><br>This information was generated by a computer query and included names, addresses and what was believed to be University identification numbers (UIDs).<br><span style="font-style: italic;">[Evan] When writing and executing database queries, isn't it a good idea to check the results and see if the information displayed is the information you were looking for?&nbsp; I wonder if UIDs are also nine digits long like Social Security numbers are.</span><br><br>Our normal process is to remove the University ID numbers prior to mailing.<br><span style="font-style: italic;">[Evan] Is it safe to assume that "normal process" was not followed in this instance?&nbsp; If so, then why not?&nbsp; There is no mention in the school's response.</span><br><br>It was not apparent to departmental staff that these numbers not only still existed within the file, but were Social Security numbers, and not University ID numbers.<br><span style="font-style: italic;">[Evan] Not apparent?&nbsp; They were on the labels!</span><br><br>The numbers were not identified as Social Security numbers and did not show the normal spacing between digits.<br><span style="font-style: italic;">[Evan] So it would be xxxxxxxxx instead of xxx-xx-xxxx.&nbsp; What percentage of people would recognize the first set of nine digits as a SSN?</span><br><br>This mailer was sent using third class, bulk mail delivery and may not have been delivered to you yet.<br><br>Currently, there is no evidence that anyone's Social Security number has been misused.<br><br>The University apologizes and deeply regrets this unfortunate mistake.<br><br>We are initiating immediate action to ensure that this error does not recur.<br><span style="font-style: italic;">[Evan] Like what?&nbsp; Maybe train people to review their query results and follow "normal process"?</span><br><br>The University of Maryland values the critical importance of your personal information.<br><br>We strongly recommend that you take appropriate precautions to mask, black out or destroy this document after use.<br><br>In unfortunate situations like this, it is possible that dishonest people may contact you asking for personal information in the guise of offering assistance from the University.<br><span style="font-style: italic;">[Evan] Equally unfortunate is the fact that there are a lot of dishonest people.</span><br><br>Please note that the University WILL NOT contact you by phone, e-mail or in any other way requesting personal information regarding this incident.<br><br>Please do not release any personal information in response to contacts claiming to be from the University.<br><br>In response to this incident, the University, and specifically the Department of Transportation Services, has moved to severely restrict access to sensitive student and faculty/staff information; we believe the fewer individuals who have access to this data will only increase our ability to protect sensitive information.<br><br>If individuals feel that they would like to take extra steps beyond the fraud alert, the University has arranged with Equifax to make available, at no cost to them, a 12-month service that includes credit monitoring, customer care, fraud expense reimbursement insurance and access to their credit report.<br><br>If you have not received this mailer and are unsure if you are included in the affected group, please call toll-free 1(877) 935-2428, Monday - Friday, 8:30 a.m. - 5 p.m. EST.<br><br><span style="font-weight: bold;">You may contact us in one of the following ways:</span><br>By telephone: Toll-free 1(877) 935-2428, Monday-Friday, 8:30 a.m. - 5 p.m. EST<br>Via e-mail: parkingmailer@umd.edu<br>Mailing address: Regents Drive Garage, Building #202, College Park, MD 20742<br><br><span style="font-weight: bold;">Commentary:</span><br>The lack of attention to detail coupled with lack of control leads to an increase of risk of confidential information disclosure.&nbsp; Not all that uncommon. <br><br><b>Past Breaches:</b><br>Unknown<br></font><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/07/18/umd.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Fri, 18 Jul 2008 05:18:07 +0000</pubDate>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/university">university</category>
      <category domain="http://securityratty.com/tag/maryland">maryland</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/university identification">university identification</category>
      <category domain="http://securityratty.com/tag/university community">university community</category>
      <category domain="http://securityratty.com/tag/social security">social security</category>
      <category domain="http://securityratty.com/tag/addressees social security">addressees social security</category>
      <category domain="http://securityratty.com/tag/recipient social security">recipient social security</category>
      <source url="http://breachblog.com/2008/07/18/umd.aspx">Mailing error at the University of Maryland exposes student information</source>
    </item>
    <item>
      <title><![CDATA[U.S. Arms Dealer Tests Legal Bounds in Middle East Arms Bazaar]]></title>
      <link>http://securityratty.com/article/a494b708fadf3d4f453c6495d8064dc2</link>
      <guid>http://securityratty.com/article/a494b708fadf3d4f453c6495d8064dc2</guid>
      <description><![CDATA[Former congressman Curt Weldon is helping broker deals between Russian and Ukranian weapons suppliers and the Iraqi and Libyan governments as part of his new job with a private American defense...]]></description>
      <content:encoded><![CDATA[<p>
Former congressman Curt Weldon is helping broker deals between Russian and Ukranian weapons suppliers and the Iraqi and Libyan governments as part of his new job with a private American defense consulting firm, Wired.com has learned. 
</p>

<p>
Weldon, who is currently being investigated by the FBI over alleged corruption during his time in office, visited Libya in March to discuss a possible military deal, according to a letter describing the trip from Weldon to <a href="http://www.ds-pa.com/">Defense Solutions</a> CEO Timothy Ringgold. In May, Weldon, together with Ringgold and another company representative, traveled to Moscow to discuss working with Russia's weapons-export agency on arms sales to the Middle East.
</p>

<p>
Both trips were part of the company's effort to tap into the growing -- and often legally murky -- market for selling weapons from former Eastern Bloc countries to the Middle East and Afghanistan.
</p>



<div id="embed" style="margin: 0px 0px 15px 15px; float: right; width: 250px; height: auto;">

<img src="http://www.wired.com/images/article/full/2008/07/weldon_350px.jpg" width="250px" alt="Curt Weldon">

<div id="caption">

Ex-Rep. Curt Weldon, R-Penn., is helping broker deals between Russian weapons suppliers and the Iraqi and Libyan governments through his company, Defense Solutions.<br />
<em>Photo: H. Rumph Jr/AP</em>

</div> 

</div>

<p>
The Russians want to sell weapons to Iraq directly, but "must go slow on Iraq because of political reasons" and want to work with an "intermediary" like Defense Solutions, CEO Ringgold subsequently wrote to colleagues. "They have not spoken with any American company that can offer the quid pro quo that we can or that has the connections in Russia that we have," he boasted.
</p>



<p>
A few years ago, an American company proposing to sell weapons to Libya might have triggered a congressional hearing. So, too, would have a proposal to conduct arms deals with Russia, which the United States has accused of selling high-tech weapons to Syria and Iran. 
</p>

<p>However, U.S. government efforts to rapidly equip countries like Afghanistan and Iraq -- which have largely Soviet-origin weapons -- have created legal ambiguities and loopholes in export controls that didn't exist in years past and given rise to a new class of arms trade middlemen. So, even though both Libya and the Russian arms export agency are on official U.S. blacklists, government officials and analysts involved in weapons sales say the rules have become unclear as the push to equip allies in the global war on terror has blazed new but uncertain legal ground. 
</p>




<p>
Eagerly stepping into that virgin territory is <a href="http://www.ds-pa.com/">Defense Solutions</a>, a Pennsylvania-based company that is carving out a small but lucrative niche in a new international arms bazaar. The firm boasts as its advisors a number of influential Washington insiders, such as retired General Barry McCaffrey, the former White House drug czar.
</p>

<p>
Helping the firm make key connections is Curt Weldon, a former Republican congressman from Pennsylvania at the center of an FBI investigation into alleged conflicts of interest during his time in office.  Weldon, now a key executive at Defense Solutions, is working with the company to set up these weapons deals.
</p>

<div id="embed" style="margin: 0px 0px 15px 15px; float: right; width: 350px; height: auto;">

<img src="http://www.wired.com/images/article/full/2008/07/btr_60_350px.jpg" alt="">

<div id="caption">

Defense Solutions has also proposed refurbishing Libya's BTR-60 armored personnel carriers, according to a sales proposal seen by Wired.com. Defense Solutions denies drafting a sales proposal to Libya.

</div> 

</div>

<p>
It's an unusual, if not an entirely unexpected chapter for Weldon, whose time in office included frequent trips to Russia. As an influential member of the House Armed Services Committee, Weldon pushed for multibillion-dollar defense programs, like ballistic missile defense, and earned a reputation as a foreign policy gadfly, boasting of his contacts with officials in nations labeled by the administration as "rogue states" such as Libya and North Korea. Weldon's wild claims about a 9/11 cover-up and his sensationalist book warning of an Iranian terror plot, sometimes earned him official scorn and public ridicule, but it was accusations that he steered contracts to Eastern European businesses linked to his daughter's lobbying firm that drew the government's attention.
</p>


<!--pagebreak-->
<p>
Weldon was voted out of office in 2006 just weeks after the FBI raided his daughter's home, and that of one of her associates.
</p>

<p>
Weldon did not respond to e-mails and phone requests to be interviewed or comment for this article. But in a 2006 interview, before the FBI probe was public, Weldon spoke enthusiastically about setting up a "front company" to work with the Russian arms agency, Rosoboronexport. Weldon hoped this company could sell weapons to the Middle East, and other regions, particularly to countries where the U.S. has strained relations. He claimed the director of Rosoboronexport approached him to work with "an American company that would act as a front for weapons these nations want to buy."
</p>

<p>
Weldon called the proposal an "unbelievable offer."
</p>

<p>
The administration, he acknowledged at the time, did not welcome the idea of an American company selling Russian weapons to potentially unfriendly countries. But two years later, Weldon, now a private citizen and chief strategic officer for Defense Solutions, appears to be working on precisely that sort of deal. And whether illegal or not, Defense Solutions' business represents a new phenomenon in the international arms trade business.
</p>

<p>
In years past arms brokers -- firms or individuals who serve as middlemen to facilitate weapons sales between countries -- were largely the stuff of spy thrillers. Unlike traditional American defense companies, like Lockheed Martin or Boeing, which typically sell weapons directly to NATO countries or other governments regarded as friendly to the United States, brokers are often small outfits run by people with sometimes questionable experience and reputations they will sell to anyone. One of the most infamous arms brokers, a Russian named <a href="http://en.wikipedia.org/wiki/Victor_Bout">Viktor Bout</a>, is charged by the United States, United Nations, Interpol and others of funneling arms to terrorists and rebels around the world. He was recently arrested in Thailand. The United States is requesting his extradition on charges of supplying arms to a terrorist organization.
</p>

<div id="embed" style="margin: 0px 0px 15px 15px; float: right; width: 350px; height: auto;">

<img src="http://www.wired.com/images/article/full/2008/07/bmp_1_350px.jpg" alt="" />

<div id="caption">

Two Marines lower the trim vane on the front of an Iraqi BMP-1 mechanized infantry combat vehicle that was captured during Operation Desert Storm. The American defense consulting firm Defense Solutions has proposed refurbishing Libya's aging fleet of BMP-1s. Defense Solutions denies drafting a sales proposal to Libya.

</div> 

</div>

<p>
But ironically, Iraq has fueled a new market for these professional middlemen; the United States is funneling billions of dollars into modernizing Iraq's army so that the country's government can fend for itself after coalition troops withdraw. And Iraq's largely Soviet-equipped military is a natural market for Eastern European countries brimming with old or out-of-date equipment they would like to unload. The middlemen, in these cases, serve a key role by allowing the U.S. government to do business with an American company, which in turn buys equipment from Eastern Bloc countries in deals worth hundreds of millions of dollars, much of it financed with U.S. taxpayer dollars.
</p>

<p>
One of Defense Solutions' sales -- a deal to sell Hungarian-owed T-72 tanks to Iraq in 2005 -- was typical of these new foreign military sales. But on the more questionable side is the company's plans to work with Rosoboronexport, which is barred from doing business with the U.S. government, and Libya, which is still on the State Department's arms embargo list. 
</p>

<p>
The Eastern European-Middle East arms-brokering business, while in some cases sanctioned by the U.S. government, has run into problems, including outright corruption and quality. Defense contractor Dale Stoffel, the president of Wye Oak Technology, and another American were gunned down in Iraq in December 2004 after Stoffel alleged that the Iraqi Ministry of Defense was involved in a kickback scheme. Like Defense Solutions, the company Stoffel worked for was refurbishing the Iraq's army Eastern Bloc equipment.
</p>

<p>
Another problem is quality. Weapons from the former Soviet Bloc, which the U.S. military euphemistically calls "nonstandard equipment," have been flagged as substandard, acknowledges Brigadier General Charles Luckey, who is in charge of security assistance at <a href="http://www.mnstci.iraq.centcom.mil/">Multi-National Security Transition Command-Iraq</a>. In an interview from Iraq, Brigadier General Luckey said: "One of the frustrating things about buying nonstandard [weapons], is that I'm the guy who has to deal with the fact that some broker I've never heard of allowed weapons to get to Iraq before they were inspected."
</p>

<div id="embed" style="margin: 0px 0px 15px 15px; float: right; width: 350px; height: auto;">

<img src="http://www.wired.com/images/article/full/2008/07/tank_350px.jpg" alt="" />

<div id="caption">

Defense Solutions is carving a new niche in the arms trade, selling Soviet-made weapons to Middle Eastern countries like Afghanistan and Iraq. Defense Solutions sold Hungarian-owed T-72 tanks to Iraq in 2005.

</div> 

</div>


<p>
In one high-profile case, Iraqi officials alleged that a corrupt firm sold them $400 million in shoddy helicopters from Poland. More recently, a company led by a 21-year-old and a former masseur was offered a U.S. government contract worth nearly $300 million to sell ammunition to Afghanistan. The ammunition turned out to be outdated and of dubious origin and several people connected with the company have been indicted. A congressional investigation concluded that the company, which was on a State Department watch list, was able to take advantage of regulatory loopholes by using middlemen.
</p>

<p>
For those concerned about illicit arms trade, this new wave of weapons deals is rife with the potential for corruption and abuse, but for companies eager to pursue markets once regarded as dubious, it represents a lucrative business opportunity.  The problem in these cases, according to those familiar with arms sales, is that it's no longer clear what's legal and what's not.
</p>
<!--pagebreak-->
<p>
Rachel Stohl, an expert on international arms trade and a senior analyst at Center for Defense Information, says that in many ways, the rush to equip Iraq has led the United States to throw caution to the wind. She points to a report by the Government Accountability Office last year that found that some 190,000 weapons sold to Iraq have gone missing. "I think the reality is we won't know, until way after the fact, about all of these irregularities with the Iraq weapons provision program," she said. "We were providing them all these assault rifles that have gone missing. Why? They were not following the standard procedures that were in place."
</p>

<p>
But Iraq and Afghanistan aren't the only markets available to arms brokers like Defense Solutions. The gradual normalization of relations with Libya opens another door into a quasi-legal area of sales. 
</p>

<p>
Like Iraq, Libya has a substantial arsenal of Soviet-origin military weapons, offering a potential market for brokers working with Russia and other former Soviet states. But even when there's not an outright ban, sales to the Middle East are often fraught with controversy, particularly to countries like Libya, which was under international sanction for more than a decade. Even as sanctions against it have been lifted, European companies proposing to sell arms to Libya have faced steep criticism, particularly since the country is still ruled by dictator Muammar Gaddafi, who took power in a military coup in 1969. 
</p>

<p>
While the United States lifted Libya's "state sponsor of terrorism" designation in 2006, other restrictions, such as on the sale of arms, remain in place. A State Department spokesperson confirmed that exports of "lethal munitions" to Libya, such as tanks or related equipment, are still banned, although sales of nonlethal equipment are now allowed on a case-by-case basis.
</p>

<p>
In late March, Weldon traveled to Libya for a weeklong trip at the invitation of the <a href="http://gdf.org.ly/index.php?lang=ar&Page=101&lang=en">Gaddafi Foundation</a>, a group run by the son of Libya's leader, and the chairman of Libya's foreign affairs committee, according to <a href="http://blog.wired.com/defense/files/libya_trip_report.doc">the report he sent to Defense Solutions</a> (.pdf), a copy of which was obtained by Wired.com. The trip reports states: "Agreement reached for Weldon to quickly return to Libya for meetings with son [of Libyan leader Gaddafi] Morti regarding defense and security cooperation."
</p>

<p>
A document dated April 16, just two weeks after Weldon's trip, outlines Defense Solutions' proposal to Libya to refurbish the country's fleet of armored vehicles, including its T-72 tanks, BMP-1 infantry fighting vehicles, and BTR-60 armored personnel carriers. A copy of the sales proposal, also provided to Wired.com, is on Defense Solutions' letterhead, appears to bear the signature of company CEO Timothy Ringgold, and is addressed to Libya's defense procurement council. "Defense Solutions is committed to delivering a full end-to-end solution to its clients," the proposal states. "Besides refurbishing these vehicles, we are capable of providing a full logistics support package, including a two year supply of spare parts, maintenance and repair services, and operator, maintenance, and repair training."
</p>

<p>
In an interview with Wired.com, Ringgold admitted that he's interested in doing business in Libya and confirms receiving Weldon's trip report from Libya, but denies drafting or signing an arms-sale proposal. "I've never made such a document to Libya," Ringgold insisted, after being read the proposal, and told that his signature is on it.
</p>

<p>
In addition to the Libyan arms-deal document, Wired.com has also reviewed copies of e-mails from Ringgold discussing the Libyan deal.
</p>

<p>
While Ringgold denies proposing an arms sale to Libya, he is open about speaking with Rosoboronexport, which has been on a U.S. government sanctions list since 2006, after the Russian state agency allegedly violated the Iran and Syria Nonproliferation Act. An April e-mail provided to Wired.com describes Ringgold, Weldon and Stephan Minikes, a senior advisor to Defense Solutions and a former ambassador, meeting with Rosoboronexport. The conversations included a number of potential deals, including supplying Mi-17 helicopters to Afghanistan and spare parts for Iraq's infantry fighting vehicles. Ringgold wrote to colleagues following the visit, describing the meetings as a "spectacular success," saying the Russian agency "has the ability to undercut all cost proposals from brokers."
</p>

<p>
Ringgold confirmed those discussions and said that his company has sought to do business with Rosoboronexport. Asked whether Ringgold considers his dealings with Russia to be legal, he argued that U.S. companies could work with Rosoboronexport on a "case-by-case" basis. "The particular purpose of the meeting we had -- and I want to be crystal clear -- was in response to a U.S. government requirement," he said.
</p>

<p>
A number of officials at the State Department and in the Pentagon, when contacted for this article, could not say whether working with Rosoboronexport is legal or not. A Pentagon spokeswoman said she was familiar with the issue, but deferred the question to the State Department. When asked about Rosoboronexport's status on the blacklist, John Herzberg, a State Department spokesman replied: "What's on there is on there."
</p>

<p>
Asked whether, given the ban, there was any way a company could legally work with Rosoboronexport, as Ringgold suggested, Herzberg provided an equivocal answer. "At the stage of the process we're at, I'm unable to give you an answer," he said. "You can try elsewhere in government, and maybe they'll be braver than me."
</p>

<p>
In an interview from Iraq, General Luckey conceded it was a murky area, but said, "My understanding is they are currently on our no-go list." 
</p>

<p>
The confusion over debarred parties has even led the U.S. government into its own legal tangles, according to Jim McAleese, a Washington attorney who specializes in government contracting and foreign military sales. Because the Russian government violated U.S. nonproliferation laws, even NASA had to go to Congress to ensure it could work with Russia on Soyuz flights to the international space station. "What I'm warning you about is, don't be surprised by the confusion," McAleese said. "There are a whole bunch of different statutes that were adopted piecemeal and were never intended to be reconciled."
</p>

<p>
But it's the very ambiguity of the law that troubles those who monitor export control. "It's highly unusual to do anything with the Russians, particularly Rosoboronexport," said Scott Jones, director of Export Control Programs at the <a href="http://www.uga.edu/cits/">Center for International Trade and Security</a> at the University of Georgia. 
</p>

<p>
Legal or not, reputable American companies simply don't want to work with banned entities, Jones said, for fear of risking their reputations and business. "Even if it's not an outright prohibition, most companies don't want to put themselves in a liability situation that has really bad PR … and they stay away from it," Jones said. "But if that's your business, pimping out arms from the U.S. or Russia, that's the way it works, and you push as much as possible."
</p>

<p>
Finding any U.S. defense company working with the Russian government at this point would be "remarkable," Jones added.
</p>

<p>
In the meantime, the future for Weldon is unclear. The FBI investigation continues and Weldon's former chief of staff recently pleaded guilty to a conspiracy charge and is cooperating with the government, notes Melanie Sloan, the executive director of <a href="http://www.citizensforethics.org/">Citizens for Responsibility and Ethics in Washington</a>, which filed a complaint against Weldon in 2004. Sloan speculated that Weldon may be charged with "honest service fraud" for misusing his office for personal gain. "It's an easier standard than bribery," she said. "I wouldn't be surprised [if he's charged] with bribery, but I think it will be honest services fraud."
</p>

<p>
Ringgold insists that he and Weldon are on the right side of the law. "Everything we do is in strict compliance with international and U.S. law and we operate only in the best interests of the U.S. government," he said. "I didn't serve 30 years in the United States Army to throw that away on a whim."
</p>

<p>
Asked if Weldon is still working for the company, Ringgold replied: "Absolutely, proudly so." 
</p><br style="clear: both;"/>
  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=3c1b81ed8ecb441b359b5fd6e6dec750" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=3c1b81ed8ecb441b359b5fd6e6dec750" style="display: none;" border="0" height="1" width="1" alt=""/><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=f5EjSJ"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=f5EjSJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=zYmkhj"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=zYmkhj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=S9Ojfj"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=S9Ojfj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=xPEQRJ"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=xPEQRJ" border="0"></img></a>
 <a href="http://feeds.wired.com/~f/wired/politics/security?a=OTsesJ"><img src="http://feeds.wired.com/~f/wired/politics/security?i=OTsesJ" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=wFj1Jj"><img src="http://feeds.wired.com/~f/wired/politics/security?i=wFj1Jj" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=OExjrj"><img src="http://feeds.wired.com/~f/wired/politics/security?i=OExjrj" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=DKk6TJ"><img src="http://feeds.wired.com/~f/wired/politics/security?i=DKk6TJ" border="0"></img></a> </div><img src="http://feeds.feedburner.com/~r/wired/politics/privacy/~4/326164069" height="1" width="1"/><img src="http://feeds.wired.com/~r/wired/politics/security/~4/326164070" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 03 Jul 2008 18:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/arms brokers">arms brokers</category>
      <category domain="http://securityratty.com/tag/brokers">brokers</category>
      <category domain="http://securityratty.com/tag/infamous arms brokers">infamous arms brokers</category>
      <category domain="http://securityratty.com/tag/defense">defense</category>
      <category domain="http://securityratty.com/tag/firm defense solutions">firm defense solutions</category>
      <category domain="http://securityratty.com/tag/arms">arms</category>
      <category domain="http://securityratty.com/tag/arms trade">arms trade</category>
      <category domain="http://securityratty.com/tag/international arms trade">international arms trade</category>
      <category domain="http://securityratty.com/tag/russian weapons suppliers">russian weapons suppliers</category>
      <source url="http://feeds.wired.com/~r/wired/politics/security/~3/326164070/defense_solutions">U.S. Arms Dealer Tests Legal Bounds in Middle East Arms Bazaar</source>
    </item>
  </channel>
</rss>
