<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: d-link]]></title>
    <link>http://securityratty.com/tag/d-link</link>
    <description></description>
    <pubDate>Sat, 15 Nov 2008 20:34:00 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Actns/Swif.T virus found in YouTube videos]]></title>
      <link>http://securityratty.com/article/8eff71f0ca5bfea5ed734ae63e7157fa</link>
      <guid>http://securityratty.com/article/8eff71f0ca5bfea5ed734ae63e7157fa</guid>
      <description><![CDATA[TOOLS FOR FLASH ANALYSIS

Breaking news regarding malicious Flash popping up from YouTube is starting to break all over the Internet
CrunchGear has a bit of a write-up on it
Rather than sound off...]]></description>
      <content:encoded><![CDATA[<span style="font-weight:bold;">TOOLS FOR FLASH ANALYSIS<span style="font-style:italic;"></span></span><br /><br />Breaking news regarding malicious Flash popping up from YouTube is starting to break all over the Internet.<br /><a href="http://www.crunchgear.com/2008/12/02/actnsswift-virus-affecting-embedded-youtube-vids/" target="_blank">CrunchGear</a> has a bit of a write-up on it.<br />Rather than sound off about what will become old news quickly, I'd like to point you to resources I use to analyze (or have the analysis done for me, to be more concise) malicious Flash or JavaScript.<br />I grabbed the evil .swf in question from the URL below via command-line on my trusty Ubuntu box:<br /><span style="font-style:italic;">wget hxxp://www.youtube.com/v/O7tB1pYSNuE&rel=1</span> <br />I then fed l.swf to <a href="http://www.adopstools.com/index.asp" target="_blank">Adops Tools</a> and <a href="http://wepawet.cs.ucsb.edu/" target="_blank">Wepawet</a>.<br />The results from each analysis are below for your review.<br />Note <span style="font-weight:bold;">System.security.allowDomain("*")</span>.<br />Not good. ;-)<br /><a href="http://www.adopstools.com/index.asp?page=richmedia&quicklink=dVs31nEmMXI249x5&section=clickchecker&file=3-l.swf" target="_blank">Adops Tools Results</a><br /><a href="http://wepawet.cs.ucsb.edu/view.php?hash=f579d3692344177fe918405b31e5a383&type=swf" target="_blank">Wepawet Results</a><br />Use in good faith, but always be careful grabbing the evil .swf.<br /><br /><a href="http://del.icio.us/post?url=http://holisticinfosec.blogspot.com/2008/12/actnsswift-virus-found-in-youtube.html&title=Actns/Swif.T%20virus%20found%20in%20YouTube%20videos " title="Actns/Swif.T virus found in YouTube videos ">del.icio.us</a> | <a href="http://digg.com/submit?phase=2&amp;url=http://holisticinfosec.blogspot.com/2008/12/actnsswift-virus-found-in-youtube.html" title="Actns/Swif.T virus found in YouTube videos ">digg</a> | <a href="http://slashdot.org/submit.pl?url=http://holisticinfosec.blogspot.com/2008/12/actnsswift-virus-found-in-youtube.html">Submit to Slashdot</a>]]></content:encoded>
      <pubDate>Tue, 02 Dec 2008 07:51:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/wepawet results">wepawet results</category>
      <category domain="http://securityratty.com/tag/results">results</category>
      <category domain="http://securityratty.com/tag/adops tools results">adops tools results</category>
      <category domain="http://securityratty.com/tag/adops tools">adops tools</category>
      <category domain="http://securityratty.com/tag/tools">tools</category>
      <category domain="http://securityratty.com/tag/analysis">analysis</category>
      <category domain="http://securityratty.com/tag/youtube">youtube</category>
      <category domain="http://securityratty.com/tag/malicious flash">malicious flash</category>
      <category domain="http://securityratty.com/tag/flash analysis">flash analysis</category>
      <source url="http://holisticinfosec.blogspot.com/2008/12/actnsswift-virus-found-in-youtube.html">Actns/Swif.T virus found in YouTube videos</source>
    </item>
    <item>
      <title><![CDATA[The "A"]]></title>
      <link>http://securityratty.com/article/1b9ddda67145b0350bba4d9bf6a096a3</link>
      <guid>http://securityratty.com/article/1b9ddda67145b0350bba4d9bf6a096a3</guid>
      <description><![CDATA[Information Security sits in a strange area somewhere between Business and IT in a little space that really hasn't been properly defined. It is exciting here

Generally, most people in Information...]]></description>
      <content:encoded><![CDATA[Information Security sits in a strange area somewhere between Business and IT in a little space that really hasn't been properly defined. It is exciting here.<br /><br />Generally, most people in Information Security today did not start out as pure Information Security people, they evolved. And where they evolved from gives one a clue as to their mindset and how they see themselves.<br /><br />Some come from an Audit background and you'll recognise these guys from their love of lists and frameworks - they dream of Cobit controls and little boxes that are waiting for ticks. Somehow they have tons of documentation and they know it all and can find it all. They generally drive Volvo's and like order.<br /><br />But most InfoSec guys come from an IT background and it shows. I guess that, having said that, most hackers come from an IT background too. And it shows.<br /><br />Now, lets consider the C-I-A triangle thingum. Quick lesson for those who don't know it - there are three aspects of information that Information Security wishes to preserve - the <span style="font-weight: bold;">C</span>onfidentiality, the <span style="font-weight: bold;">I</span>ntegrity and the <span style="font-weight: bold;">A</span>vailability. From my experience, most IT people are governed by Availability - the "A". In fact, when an IT contract is drawn up - there is no SLI or SLC but there will always be an SLA. With very specific terms, measurements and penalties.<br /><br />If the Firewall crashes and has to be rebuilt. What will the IT manager be most interested in? The A - how fast can you get the traffic moving again?<br /><br />So we have tools to measure uptime in 99.999999999999999s and such and anything that can cause network downtime (or if the network is up and the services such as mail are down - same difference) is taken care of. Spam, worms, viruses etc.<br /><br />I guess that hackers (those that define what we do) are also IT background people. They seem to be more concerned with big-bang, widely deployed DoS attacks and stealing IT resources. At least, they used to be, until they discovered that they could make money from stealing information. Actually, I may be naive but I don't believe that the hackers we have today are the same as those we had in the past... I believe that we have a new generation of hackers - criminals who merely use the Internet to steal money because that it where the money is easiest to steal.<br /><br />The problem is that we were lucky in a way that our old tools worked against the threats that we had - firewalls, antiviruses, etc etc. They don't work against people breaking into our networks and stealing information. For that we need a new generation of Information Security people (or the old generation to update their game)...<br /><br />Here is a quick poll to see which generation you are in:<br /><br />1. What is the one piece of information on your network that your competitors would love to see?<br />2. What is the percentage of mails coming into your network that are spam?<br />3. What mail is going to competitors?<br />4. What is the process for someone to order a pencil?<br />5. What is a blog?<br />6. Who in your organisation uses facebook for business?<br />7. How many of your PCs have up-to-date antivirus?<br />8. What is the worst virus out at the moment?<br />9. Do you believe that your Firewall is configured correctly?<br /><br />The answers are as follows:<br />1. This is ESSENTIAL to know if you want to be in the next generation. And you can't guess this. You may think that it is something financial but most financial information can be guessed by your competitors anyhow. You may think it is a recipe or special way of doing something but any established company has had their recipe ripped off anyhow and can beat any new competitor by competitive pricing. It may be new product information. It may be staff information. It may be the CEO's contact list. Don't guess - find out.<br /><br />2. Who cares? Certainly not the CEO. Maybe the CIO. "We are saving you x amount of bandwidth and your users x amount of time" is nice but won't save the business from closing down due to data loss. Operationalise this and get on with your job.<br /><br />3. Good to know. I'm sure that if you told your CEO/CIO "Last week we detected 5 large emails going to our competitors from inside our R&amp;D department" you'd have his full attention.<br /><br />4. Good to know. Who does the ordering? Who does the okaying? Who does the paying? If you know all of this then you know how business works. And when things go wrong - you'll be able to help.<br /><br />5. And do you want your staff to use them? And if they do, what can they put on them? What are they puting on them?<br /><br />6. This is an interesting question because Facebook is usually an issue of "The A" (productivity). But it can be an issue of C and I.<br /><br />7. Who cares? Again, this is an operational issue. Viruses that jump onto your radar are usually ones that attack "the A" but its the ones that are pushing information out of your organisation that are sneaky enough not to have sgnatures and not to be discovered. You will have PCs without up-to-date antivirus and you will have viruses. The trick is not to let your information be stolen by viruses. Also, keep backups so if a PC does get wiped out - you can get the information back again (but this is an operational issue again).<br /><br />8. Trick question - the answer is - the one you don't know about. Old generation InfoSec guys can rattle off names of viruses that are all in the top 10 at the moment.. New generation viruses are targetted and usually do their worst before a pattern is out.<br /><br />9. Old generation answer - yes. New generation answer - who cares? Information flows all over including in and out of the Firewall. Firewalls also usually rely on port security but most everything runs on port 80 anyhow so the Firewall should be configured but it doesn't kep us safe - more work needs to be done for that.<br /><br />I find that it is not very easy to move from old generation to new generation InfoSec. The main difference is that old generation was very technical and appealed to the technical nature of computer geeks. The new generation is business oriented and requires more interaction with people, more meetings, more time with people. Ouch.<br /><br />There will always be a place for technical people in Information Security but as the tools mature and "just work" there is less demand. And a background in technology is very useful when the technical guys try to "BS" you.<br /><br />And "the A" is very important too. Protecting your network from being brought down. Protecting information from disappearing. Stopping viruses. Etc. But the new generation will need to consider "the I" and "the C" as well because the attacks against these and the importance of protecting information against disclosure or manipulation will increase.<br /><br />This post was done to add my voice to what Rich says so quickly and concisely in the <a href="http://securosis.com/2008/11/10/the-two-kinds-of-security-threats-and-how-they-affect-your-life/">securosis blog</a>.<img src="http://feeds.feedburner.com/~r/SecurityThoughts/~4/471338550" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 01 Dec 2008 10:57:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/financial information">financial information</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/information security">information security</category>
      <category domain="http://securityratty.com/tag/generation infosec guys">generation infosec guys</category>
      <category domain="http://securityratty.com/tag/infosec guys">infosec guys</category>
      <category domain="http://securityratty.com/tag/information security people">information security people</category>
      <category domain="http://securityratty.com/tag/guys">guys</category>
      <category domain="http://securityratty.com/tag/staff information">staff information</category>
      <category domain="http://securityratty.com/tag/technical guys">technical guys</category>
      <source url="http://feeds.feedburner.com/~r/SecurityThoughts/~3/471338550/a.html">The "A"</source>
    </item>
    <item>
      <title><![CDATA[10 Microsoft research projects]]></title>
      <link>http://securityratty.com/article/1d858dc8a10041df7d046d6bbc650dad</link>
      <guid>http://securityratty.com/article/1d858dc8a10041df7d046d6bbc650dad</guid>
      <description><![CDATA[A sneak peek at 10 technologies developed in Microsoft's R&amp;D...]]></description>
      <content:encoded><![CDATA[A sneak peek at 10 technologies developed in Microsoft's R&D labs]]></content:encoded>
      <pubDate>Sun, 30 Nov 2008 21:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/microsoft">microsoft</category>
      <category domain="http://securityratty.com/tag/sneak peek">sneak peek</category>
      <category domain="http://securityratty.com/tag/technologies">technologies</category>
      <category domain="http://securityratty.com/tag/labs">labs</category>
      <source url="http://www.networkworld.com/news/2008/120108-10-microsoft-research-projects.html?fsrc=rss-security">10 Microsoft research projects</source>
    </item>
    <item>
      <title><![CDATA[New DHS Head Understands Security]]></title>
      <link>http://securityratty.com/article/575cb97ea046ccf013e7674856572469</link>
      <guid>http://securityratty.com/article/575cb97ea046ccf013e7674856572469</guid>
      <description><![CDATA[This quote impresses me: Gov. Janet Napolitano, D-Ariz., is smashing the idea of a border wall, stating it would be too expensive, take too long to construct, and be ineffective once completed
You...]]></description>
      <content:encoded><![CDATA[<p><a href="http://www.worldnetdaily.com/news/article.asp?ARTICLE_ID=48017">This quote</a> impresses me:</p>

<blockquote>Gov. Janet Napolitano, D-Ariz., is smashing the idea of a border wall, stating it would be too expensive, take too long to construct, and be ineffective once completed.

<p>"You show me a 50-foot wall and I'll show you a 51-foot ladder at the border. That's the way the border works," Napolitano told the Associated Press.</p>

<p>Instead of a wall, she said funds would be better utilized on beefing up Border Patrol manpower, technology sensors and unmanned aerial vehicles.</blockquote></p>

<p>I am cautiously optimistic.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=bndCN"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=bndCN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=yBMYN"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=yBMYN" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Wed, 26 Nov 2008 09:43:33 +0000</pubDate>
      <category domain="http://securityratty.com/tag/border">border</category>
      <category domain="http://securityratty.com/tag/border patrol manpower">border patrol manpower</category>
      <category domain="http://securityratty.com/tag/border wall">border wall</category>
      <category domain="http://securityratty.com/tag/wall">wall</category>
      <category domain="http://securityratty.com/tag/50-foot wall">50-foot wall</category>
      <category domain="http://securityratty.com/tag/janet napolitano">janet napolitano</category>
      <category domain="http://securityratty.com/tag/napolitano">napolitano</category>
      <category domain="http://securityratty.com/tag/technology sensors">technology sensors</category>
      <category domain="http://securityratty.com/tag/cautiously optimistic">cautiously optimistic</category>
      <source url="http://www.schneier.com/blog/archives/2008/11/new_dhs_head_un.html">New DHS Head Understands Security</source>
    </item>
    <item>
      <title><![CDATA[Gmail security and recent phishing activity]]></title>
      <link>http://securityratty.com/article/9a45bb9bbae6a2b37196f35b1390b206</link>
      <guid>http://securityratty.com/article/9a45bb9bbae6a2b37196f35b1390b206</guid>
      <description><![CDATA[Posted by Chris Evans

We've seen some speculation recently about a purported security vulnerability in Gmail and the theft of several website owners' domains by unauthorized third parties. At Google...]]></description>
      <content:encoded><![CDATA[<span class="byline-author">Posted by Chris Evans</span><br /><br />We've seen some speculation recently about a purported security vulnerability in Gmail and the theft of several website owners' domains by unauthorized third parties. At Google we're committed to providing secure products, and we mounted an immediate investigation. Our results indicate no evidence of a Gmail vulnerability.<br /><br />With help from affected users, we determined that the cause was a phishing scheme, a common method used by malicious actors to trick people into sharing their sensitive information. Attackers sent customized e-mails encouraging web domain owners to visit fraudulent websites such as "google-hosts.com" that they set up purely to harvest usernames and passwords. These fake sites had no affiliation with Google, and the ones we've seen are now offline. Once attackers gained the user credentials, they were free to modify the affected accounts as they desired. In this case, the attacker set up mail filters specifically designed to forward messages from web domain providers.<br /><br />Several news stories referenced a <a title="domain theft from December 2007" href="http://www.davidairey.com/google-gmail-security-hijack/" id="d.kh">domain theft from December 2007</a> that was incorrectly linked to a Gmail CSRF vulnerability</span>. We did have a Gmail CSRF bug reported to us in September 2007 that we fixed and deployed worldwide within 24 hours of private disclosure of the bug details. We know of no affected users. Neither this bug nor any other Gmail bug was involved in the December 2007 domain theft.<br /><br />We recognize how many people depend on Gmail, and we strive to make it as secure as possible. At this time, we'd like to thank the wider security community for working with us to achieve this goal. We're always looking at new ways to enhance Gmail security. For example, we recently gave users the option to <a href="http://gmailblog.blogspot.com/2008/07/making-security-easier.html" id="murn" title="always connect via https">always run their entire session using https</a>.<br /><br />To keep your Google account secure online, we recommend you only ever enter your Gmail sign-in credentials to web addresses starting with https://www.google.com/accounts, and never click-through any warnings your browser may raise about certificates. For more information on how to stay safe from phishing attacks, see our blog post <a href="http://googleblog.blogspot.com/2008/04/how-to-avoid-getting-hooked.html" id="o8q2" title="here">here</a>.<div class="feedflare">
<a href="http://feedproxy.google.com/~f/GoogleOnlineSecurityBlog?a=5ziOaTxJ"><img src="http://feedproxy.google.com/~f/GoogleOnlineSecurityBlog?d=41" border="0"></img></a> <a href="http://feedproxy.google.com/~f/GoogleOnlineSecurityBlog?a=UypYbMp4"><img src="http://feedproxy.google.com/~f/GoogleOnlineSecurityBlog?i=UypYbMp4" border="0"></img></a>
</div><img src="http://feedproxy.google.com/~r/GoogleOnlineSecurityBlog/~4/jSxgatXB-tY" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 25 Nov 2008 10:22:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/gmail">gmail</category>
      <category domain="http://securityratty.com/tag/bug">bug</category>
      <category domain="http://securityratty.com/tag/bug details">bug details</category>
      <category domain="http://securityratty.com/tag/gmail bug">gmail bug</category>
      <category domain="http://securityratty.com/tag/gmail csrf vulnerability">gmail csrf vulnerability</category>
      <category domain="http://securityratty.com/tag/enhance gmail security">enhance gmail security</category>
      <category domain="http://securityratty.com/tag/gmail csrf bug">gmail csrf bug</category>
      <category domain="http://securityratty.com/tag/gmail sign-in credentials">gmail sign-in credentials</category>
      <category domain="http://securityratty.com/tag/domain theft">domain theft</category>
      <source url="http://feedproxy.google.com/~r/GoogleOnlineSecurityBlog/~3/jSxgatXB-tY/gmail-security-and-recent-phishing.html">Gmail security and recent phishing activity</source>
    </item>
    <item>
      <title><![CDATA[Schneier for TSA Administrator]]></title>
      <link>http://securityratty.com/article/5e368a8d3abaf29420cf0da59287f1d2</link>
      <guid>http://securityratty.com/article/5e368a8d3abaf29420cf0da59287f1d2</guid>
      <description><![CDATA[It's been suggested . For the record, I don't want the job. Since the election, the newspapers and Internet have been flooded with unsolicited advice for President-elect Barack Obama. I'll go ahead...]]></description>
      <content:encoded><![CDATA[<p>It's been <a href="http://www.foxnews.com/story/0,2933,453093,00.html">suggested</a>. For the record, I don't want the job.</p>

<blockquote>Since the election, the newspapers and Internet have been flooded with unsolicited advice for President-elect Barack Obama. I'll go ahead and add mine.

<p>[...]</p>

<p>And by "revamp," I mean "start over." Most security experts agree that the rigmarole we go through at the airport is mere security theater, designed not to make us safer, but to make us feel safer by making it increasingly inconvenient to fly. TSA's approach to security is too reactionary -- too set on preventing attacks and attempted attacks that have already happened. And please, whatever you do, resist the temptation to let TSA workers unionize. Security from terror attacks should be a federal jobs program. You need the authority to fire underperforming screeners quickly and effortlessly. Three game-changing possibilities to head up TSA: security guru Bruce Schneier, Cato Institute security and technology scholar Jim Harper, or Ohio State University's John Mueller.</blockquote></p>

<p>Although I'd be happy to see either Jim or John with it.</p>

<p>I don't want it because it's too narrow.  I think the right thing for the government to do is to give the TSA a lot less money.  I'd rather they defend against the broad threat of terrorism than focus on the narrow threat of airplane terrorism, and I'd rather they defend against the myriad of threats that face our society than focus on the singular threat of terrorism.  But the head of the TSA can't have those opinions; he has to take the money he's given and perform the specific function he's assigned to perform.  Not very much fun, really.</p>

<p>But I'd be happy to advise whoever Obama choses to head the TSA.</p>

<p>The job of the nation's CTO would be more interesting, but I don't think I <a href="http://weblog.infoworld.com/robertxcringely/archives/2008/11/the_once_and_fu.html">want</a> <a href="http://blogs.computerworld.com/obama_cto">it</a>, either.  (Have you seen the <a href="http://www.nytimes.com/2008/11/13/us/politics/13apply.html">screening process</a>?)</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=lxRoN"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=lxRoN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=doEjN"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=doEjN" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Tue, 18 Nov 2008 10:46:24 +0000</pubDate>
      <category domain="http://securityratty.com/tag/tsa">tsa</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/mere security theater">mere security theater</category>
      <category domain="http://securityratty.com/tag/cato institute security">cato institute security</category>
      <category domain="http://securityratty.com/tag/tsa workers">tsa workers</category>
      <category domain="http://securityratty.com/tag/security experts agree">security experts agree</category>
      <category domain="http://securityratty.com/tag/attacks">attacks</category>
      <category domain="http://securityratty.com/tag/terror attacks">terror attacks</category>
      <category domain="http://securityratty.com/tag/terrorism">terrorism</category>
      <source url="http://www.schneier.com/blog/archives/2008/11/schneier_for_ts.html">Schneier for TSA Administrator</source>
    </item>
    <item>
      <title><![CDATA[Report Card: Incident Response - A, Security Management - D]]></title>
      <link>http://securityratty.com/article/64ee063128da5d1ad1801ec2008dac9b</link>
      <guid>http://securityratty.com/article/64ee063128da5d1ad1801ec2008dac9b</guid>
      <description><![CDATA[This appears to be another example of disregard for fundamental security...]]></description>
      <content:encoded><![CDATA[This appears to be another example of disregard for fundamental security practices. ]]></content:encoded>
      <pubDate>Tue, 18 Nov 2008 10:40:03 +0000</pubDate>
      <category domain="http://securityratty.com/tag/fundamental security practices">fundamental security practices</category>
      <category domain="http://securityratty.com/tag/disregard">disregard</category>
      <category domain="http://securityratty.com/tag/appears">appears</category>
      <source url="http://networking.ittoolbox.com/r/rss.asp?url=http://it.toolbox.com/blogs/adventuresinsecurity/report-card-incident-response-a-security-management-d-28371">Report Card: Incident Response - A, Security Management - D</source>
    </item>
    <item>
      <title><![CDATA[Most Spam Came from a Single Web Hosting Firm]]></title>
      <link>http://securityratty.com/article/894b4e87cb13c364abc659a7aab3070a</link>
      <guid>http://securityratty.com/article/894b4e87cb13c364abc659a7aab3070a</guid>
      <description><![CDATA[Really : Experts say the precipitous drop-off in spam comes from Internet providers unplugging McColo Corp., a hosting provider in Northern California that was the home base for machines responsible...]]></description>
      <content:encoded><![CDATA[<p><a href="http://voices.washingtonpost.com/securityfix/2008/11/spam_volumes_drop_by_23_after.html?nav=rss_blog">Really</a>:</p>

<blockquote>Experts say the precipitous drop-off in spam comes from Internet providers unplugging McColo Corp., a hosting provider in Northern California that was the home base for machines responsible for coordinating the sending of roughly 75 percent of all spam each day.</blockquote>

<p>Certainly this won't last:</p>

<blockquote>Bhandari said he expects the spam volume to recover to normal levels in about a week, as the spam operations that were previously hosted at McColo move to a new home.

<p>"We're seeing a slow recovery," Bhandari. "We fully expect this to recover completely, and to go into the highest ever spam period during the upcoming holiday season."</blockquote></p>

<p>But with all the talk of massive botnets sending spam, it's interesting that most of it still comes from hosting services.  You'd think this would make the job of detecting spam a lot easier.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=dOYuN"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=dOYuN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=HEDZN"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=HEDZN" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Mon, 17 Nov 2008 02:11:07 +0000</pubDate>
      <category domain="http://securityratty.com/tag/spam">spam</category>
      <category domain="http://securityratty.com/tag/spam volume">spam volume</category>
      <category domain="http://securityratty.com/tag/spam period">spam period</category>
      <category domain="http://securityratty.com/tag/spam operations">spam operations</category>
      <category domain="http://securityratty.com/tag/recover">recover</category>
      <category domain="http://securityratty.com/tag/recover completely">recover completely</category>
      <category domain="http://securityratty.com/tag/home">home</category>
      <category domain="http://securityratty.com/tag/home base">home base</category>
      <category domain="http://securityratty.com/tag/machines responsible">machines responsible</category>
      <source url="http://www.schneier.com/blog/archives/2008/11/most_spam_came.html">Most Spam Came from a Single Web Hosting Firm</source>
    </item>
    <item>
      <title><![CDATA[Deleting your digital past -- for good]]></title>
      <link>http://securityratty.com/article/b16812bafb8af4eb041e829a3351de9e</link>
      <guid>http://securityratty.com/article/b16812bafb8af4eb041e829a3351de9e</guid>
      <description><![CDATA[Whether it's a youthful indiscretion or a bit of malicious gossip, many of us have an unsavory mention or two online that we'd like to see expunged. We tried to get a few such bits off the Net...]]></description>
      <content:encoded><![CDATA[Whether it's a youthful indiscretion or a bit of malicious gossip, many of us have an unsavory mention or two online that we'd like to see expunged. We tried to get a few such bits off the Net forever. Here's how we did.<br style="clear: both;"/>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:fe9866d61aab1ea934d2963a1d4a4179:DBrr0Jq5Mh728O5Hh3tWwKRzvHVIjJied%2FpQzFcYAHhwldklmruLjXj4IODh8NThRBbZq%2FGc2DkC'><img border='0' title='Add to digg' alt='Add to digg' src='http://www.pheedo.com/images/mm/digg.gif'/></a>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:7489329d83583ec26e0a4dda56f4b709:2UcTE1oHOP5Z44zgwSECO4iRs3vNERF2PXU2L4WqDvZ6iTgeAz5rKBldWcCe7w3SifsUwSeKXCkUiA%3D%3D'><img border='0' title='Add to StumbleUpon' alt='Add to StumbleUpon' src='http://www.pheedo.com/images/mm/stumbleit.gif'/></a>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:777be67289075f64cd87c73c79c9f984:z5Brhyqug%2BUwbFMHTGUZh18UszxPz%2FozbgDya4H%2B%2FLXDDE9tPgMNOdTw1Zj%2B4stGtsxhNa3%2BG5dCIQ%3D%3D'><img border='0' title='Add to Twitter' alt='Add to Twitter' src='http://www.pheedo.com/images/mm/twitter.png'/></a>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:eb81fa1c98232155a01e49cb2f519328:r66aHGjzOzbbio5%2FU85rz%2FpmKr14%2BoBAZ9zu0IGLRKd17xVKXXjdhzya0jlR4tPEmNfhXQXiGFAc%2FA%3D%3D'><img border='0' title='Add to Slashdot' alt='Add to Slashdot' src='http://www.pheedo.com/images/mm/slashdot.png'/></a>
<br style="clear: both;"/>  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=9ca5dae168b00cae6d65781f5c4439df" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=9ca5dae168b00cae6d65781f5c4439df" style="display: none;" border="0" height="1" width="1" alt=""/>]]></content:encoded>
      <pubDate>Sun, 16 Nov 2008 02:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/malicious gossip">malicious gossip</category>
      <category domain="http://securityratty.com/tag/youthful indiscretion">youthful indiscretion</category>
      <category domain="http://securityratty.com/tag/net forever">net forever</category>
      <category domain="http://securityratty.com/tag/unsavory mention">unsavory mention</category>
      <category domain="http://securityratty.com/tag/bit">bit</category>
      <category domain="http://securityratty.com/tag/bits">bits</category>
      <category domain="http://securityratty.com/tag/online">online</category>
      <source url="http://feeds.computerworld.com/click.phdo?i=9ca5dae168b00cae6d65781f5c4439df">Deleting your digital past -- for good</source>
    </item>
    <item>
      <title><![CDATA[What would you do if you knew the Air Marshal on your plane was smuggling Drugs?]]></title>
      <link>http://securityratty.com/article/6902b40b209c72e9190f6544d2968f20</link>
      <guid>http://securityratty.com/article/6902b40b209c72e9190f6544d2968f20</guid>
      <description><![CDATA[According to a recent USA TODAY article, Federal Air Marshals have been convicted of smuggling drugs, molesting children, abducting a female escort during a layover in Washington D.C., hiring a hitman...]]></description>
      <content:encoded><![CDATA[According to a recent USA TODAY article, Federal Air Marshals have been convicted of smuggling drugs, molesting children, abducting a female escort during a layover in Washington D.C., hiring a hitman to kill a spouse and many other criminal acts. <br /><span id="fullpost"><br />The ex-Air Marshal who was convicted of smuggling drugs apparently used his position to work with a drug dealer to carry cocaine and drug money with him on flights around the country.  He was caught on tape telling an informant that he was "the man with the Golden Badge".<br /></span><br />We should remember though, that with a current force of between 3,000 - 4,000 (exact numbers are confidential), there are bound to be a few bad apples in the bunch - that is the way in every profession.  <br /><br />What makes it much more alarming when we talk about Air Marshals gone bad is the fact that at 30,000 feet in the air - their authority is absolute.  The last thing a passenger in a plane needs to be concerned about is the very person on the plane whose job it is to protect the passengers.<br /><br />The Marshal's decision making skills should be beyond reproach.  If their judgement is clouded over however, due to experimenting with the cocaine they are smuggling, the consequences could prove fatal.<br /><br />Perhaps the fact that prior to 2001, the Air Marshal service had an annual budget of $4.4 million and 33 agents which exploded to $786 million and between 3,000 to 4,000 agents today might have something to do with undesirables falling through the cracks.<br /><br />Not that rapid hiring needs are an excuse for allowing criminal behavior to go unnoticed.  The office of Inspector General or Internal Affairs needs to get actively involved and properly supervise the agency so that rogue Marshals are not allowed to remain in the service.<div class="blogger-post-footer">Visit Sexton Executive Security at www.sextonsecurity.com</div>]]></content:encoded>
      <pubDate>Sat, 15 Nov 2008 20:34:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/air">air</category>
      <category domain="http://securityratty.com/tag/air marshals">air marshals</category>
      <category domain="http://securityratty.com/tag/federal air marshals">federal air marshals</category>
      <category domain="http://securityratty.com/tag/marshal">marshal</category>
      <category domain="http://securityratty.com/tag/air marshal service">air marshal service</category>
      <category domain="http://securityratty.com/tag/service">service</category>
      <category domain="http://securityratty.com/tag/drugs">drugs</category>
      <category domain="http://securityratty.com/tag/ex-air marshal">ex-air marshal</category>
      <category domain="http://securityratty.com/tag/plane">plane</category>
      <source url="http://www.thebulletproofblog.com/2008/11/what-would-you-do-if-you-knew-air.html">What would you do if you knew the Air Marshal on your plane was smuggling Drugs?</source>
    </item>
  </channel>
</rss>
