[SecurityRatty] tag: dirty

XRumer Spambot Cracks Captchas

Fri, 03 Oct 2008 07:40:21 +0000

We’ve known CAPTCHAs are insecure for some time, but now even the CAPTCHA-alternatives (often based on identifying cats from dogs or other animals) have proven insecure. Gmail, Windows Live hotmail and other popular sites were hacked as early as February. Recently another defeat has come in the form of XRumer, a spam bot that posts messages on blogs and through email in order to boost search engine rankings.

What’s the solution? Ars Technica suggests there might not be a good one, in part because malware distributors can go so far as to hire real people to do their dirty work:

Instead of trying to build better CAPTCHA-cracking programs, the malware industry went out and got itself some humans of its own. This effectively bypasses the primary security strength of the CAPTCHA system and leaves it entirely dependent on what we’ll call secondary security characteristics. CAPTCHAs are often complex (particularly these days), which does increase the chance that they’ll be misread (and returned incorrectly), while the font and display of the characters themselves are at least somewhat unfamiliar to the CAPTCHA crackers sitting on the other side of the world.

Sometimes those captcha phrases are pretty incoherent to me too. When I post over at Craigslist sometimes it says I’ve gotten its Captcha wrong, and I end up wondering if secretly I’m a bot?? Apparently not a very smart one either.

"Would you feel safe with this man looking after you?

Sun, 28 Sep 2008 16:44:00 +0000

That was the caption under the picture of Rocker,Ted Nugent, in last Tuesday's Guardian. Nugent had volunteered to be Sir Paul McCartney's "Bodyguard" when he played a concert in Israel.

Unfortunately,this is what our industry has to tolerate. Many people, from broken down celebrity deer hunters to jail guards think that if you know how to shoot a rifle or open a gate for inmates to go to the yard, it automatically follows that you know everything about protecting the life of a executive.

So, Ted Nugent knows how to play guitar and shoot deer. Just what part of that background would equip him to keep the former Beetle safe in the Middle East? It is certainly not like Mr. Nugent is trying to pull the wool over our eyes when it comes to any specialized training he may have received. "I'm Dirty Harry with a ponytail", claims the singer.

First of all Mr. Nugent, "Dirty Harry" was a film produced by Hollywood to entertain people, not a "training aid". Secondly, even if we were to stretch our imaginations and consider Harry Callaghan's actions, we would recall that the character was a Police Detective and as such, would have undergone rigourous training at a professional Police Academy.

Refering to reported Islamic Extremist Death Threats made against McCartney if he insisted on playing the concert, Nugent informed us that he "will not bend or waiver to Voodoo Religions or Whackjobs".

It is unknown whether or not Mr. Nugent thinks that Islamic Extremists come from Haiti, but if he is serious about a future career in Executive Protection, we would advise him to attend our upcoming course in Dubai next month where he will not only learn first hand the Art of Personal Protection, but he will also learn about Middle Eastern Cultures, Tradition and Religion.

Unfortunately, there's no way of predicting how much culture we may be able to pass on to Mr. Nugent, as the course is only a little over a week long. We will also be teaching etiquette and which knife and fork to use when attending a formal event with your Principal. That's right Ted, you don't get to tear the meat from the bone with your hands.

Someone call the U.A.E. and let the Hilton know that we may have to stay longer than planned.

Over half admit they dont know if they are secure!

Wed, 24 Sep 2008 19:45:18 +0000

Educating the masses continues to be a problem even with all the latest headlines about ID theft.

clipped from www.net-security.org

Lack of awareness of privacy and security software

The results show that an alarmingly high proportion of users did not know what software was running on their computers to ensure they had adequate protection from hackers, malware, viruses, ‘dirty’ websites, and other online threats. More than one-tenth of respondents (13%) said they did not have any anti-virus software installed on their machines at all, while a further 9% did not know if anti-virus was installed. Almost one-fifth of respondents (19%) did not know if they had firewalls installed.

Sorry, Qantas, No Unfettered Broadband

Thu, 18 Sep 2008 06:33:20 +0000

Qantas backs off from earlier plans, changes provider for in-flight broadband: The Sydney Morning Herald somewhat erratically and incompletely reports that Qantas has delayed and modified its in-flight broadband plans. Aeromobile was the provider when the service was tested in second quarter 2007, but OnAir is now described as the airline's partner. This was noted by colleague Fabio Zambelli, who emailed me the news, and has his own account at 7BIT (in Italian).

OnAir has so far tested their calling/texting-only service on two aircraft--one operated by Air France, one by TAP Portugal--even though RyanAir announced plans that its planes would started being unwired with the service by late 2007. Still no word on that fleet progress.

Qantas will apparently launch cached Web browsing and limited Web email (probably through a proxy) along with instant messaging, with full Internet service coming "later in 2009." This is clearly due to a lack of satellite coverage that was just remediated a few weeks ago (see below). The first plane with limited service, a new A380, should be in flight 20-October-2008.

I hate in-flight
broadband

To Qantas' credit, note that each seat on the plane will have a laptop opower socket, a USB port, and a multimedia system that can show 100 movies and 500 TV show episodes, play the contents of 1,000 CDs and 20 radio stations, and offer 80 games.

The Morning Herald seems to overstate the importance and scope of a complaint filed by the union representing American Airlines' flight attendants. The detailed coverage in the U.S. had more to do with the potential for issues, and likely attendants lack of interest in policing yet another media on the plane. Filtering doesn't work, the attendants probably already know, and this may just be a negotiating point with the airline.

On why Qantas is waiting until late 2009? This requires unwinding how OnAir gets its signal.

Aeromobile and OnAir both rely on Inmarsat satellites for their service. Both companies had several years ago staked their futures on the fourth-generation network Inmarsat was to inaugurate with three satellites that would use beamforming to allow precise delivery of nearly 500 Kbps per receiver, with hundreds or thousands of regions being able to be targeted from a single satellite. Inmarsat's third-gen network--don't confuse this with 3G cellular ground-based networks--can deliver about 64 Kbps per channel.

Now, unfortunately, Inmarsat was three years late on launching its trans-Pacific bird. While the company claims 85 percent coverage of the earth and 98 percent coverage of population, there's a big gap over the Pacific that also prevents them from having good overlap between the U.S. and Japan/China/Korea, as well as the southern Pacific, covering Australia. Since the biggest market for long-haul flights would likely be Australia, Japan, and China, traveling trans-Pacific or trans-hemispheric routes, that gap is rather large.

Aeromobile opted to build out a service, deployed only by Emirates airline as far as I can tell, that uses the 3G service since it was available, and most necessary equipment is already installed on most over-water planes. OnAir was waiting for 4G, which has necessitated a long wait, but allowed them to launch in Europe with a seemingly next-generation service. Given that OnAir is controlled by an airline-owned integration firm, SITA, and by Airbus, they're not going anywhere.

Inmarsat finally lofted its third satellite on Baikonur Cosmodrome in Kazakhstan on 19-August-2008, and the launch and separation was reported as successful. Previously, the company has needed up to a year to verify and deploy its 4G satellites. (You can read extremely close coverage of the launch at a Web site devoted to space enthusiasm.)

However, the dirty little secret about Inmarsat's BGAN is that it costs a fortune to heft bandwidth across it. Thus, in-flight broadband over BGAN, if it's ever available, is going to be changed on an extremely high per-MB rate. None of the providers want to say this. This is in contrast to Row 44 (and, once, Connexion by Boeing), which relies on leased Ku-band transponders where they can fix costs and they require high volumes to keep per-bit costs efffectively low.

OnAir's launch of calling on Air France's service involves paying a few euros per minute for calls, which might help you understand what data costs could ultimately run.

Port and cargo security: How is the U.S.A. doing now?

Sun, 14 Sep 2008 20:00:00 +0000

In a 2006 interview, you gave the country a D+ grade when it comes to the current state of port and cargo security. And that D+ was up from an F a few years prior. Where do we stand now in 2008? We are moving probably to a C-minus. There are essentially three challenges in the area of port security and cargo security. The first is that potentially our ports can be used as a conduit to bring destructive things into country, such as a dirty bomb, a radiological device, or, in a worst case scenario, a nuclear bomb. So the first set of challenges is to figure out how do I find the needle in haystack in the tremendous volume of cargo and in a complex environment like our ports if someone wanted to smuggle something in.

What's Going on Between Asprox and Rock Phish?

Wed, 03 Sep 2008 20:00:00 +0000

When a small phishing gang decides to upgrade its infrastructure, it is often done in a quick and dirty fashion. The transition is almost immediate, and often buggy and unprofessional. But what happens when a gang on the scale of the Rock Phish group decides to abandon its old methods and upgrade its botnet infrastructure? It is done slowly, smoothly but most importantly -- professionally. The RSA FraudAction Research Labs recently gathered information that indicates major changes in the tactics employed by the Rock Phish gang. We have reason to believe that the gang is replacing its phishing infrastructure, and upgrading it to an advanced Fast-Flux botnet. We also believe that this new infrastructure belongs to none other than the infamous Asprox Botnet, which has recently been spreading itself using surges of SQL injection attacks...

Show 029 - An Interview with Dennis Fisher

Mon, 18 Aug 2008 11:05:01 +0000

On the 29th episode of The Silver Bullet Security Podcast, Gary talks with Dennis Fisher, executive editor of The Security Media Group at TechTarget. Dennis helps run SearchSecurity.com and Information Security Magazine. Gary and Dennis discuss the current “BS factor” in security journalism, shopping at TJ Maxx right after the TJX privacy breach, the state of software security, and which is harder: being a fry cook at Hardees or working as a PR flack.

Ah, the joys of blogging!

Tue, 29 Jul 2008 14:10:37 +0000

People ask why do you blog? In the final analysis I blog because I like to. Every once in a while though you get a comment from a reader that reminds you why it is all worth while. Here is one I received today from a person alleging to be a Julie Peterson:

Julie Peterson commented on Safe Access wins SC Magazine Award Reader Trust Award, again!:

Dressed in a tuxedo and chewing those rubber chicken breasts at the award ceremony is your idea of fun? Aren't you the same mentally retarded idiot who said in 2007 that you hated SC awards and that anyone can buy the SC awards with a sponsorship? Why do you think people give over $10k as sponsorship for the SC awards? Who is watching the awards except other vendors? By the way you suck big time with your rubbish blogs. Didn't networld magazine give you the boot within 3 months? Think before you write Mr. mental. Well done on winning, but please, dont give the impression that you cant buy an award from SC! And don't forget to eat your medication pills tonight, otherwise from your hair it is obvious you ran away from a mental hospital.

First of all Julie, let me thank you for your kind words! You made the statement and let me answer your questions for you.

1. Is dressing in a tuxedo and chewing rubber chicken breasts my idea of fun? Actually, I do enjoy dressing up in a tuxedo once in a while. The food at the awards ceremony was actually pretty good, if not diet friendly, as were the cocktails. The entertainment at the awards show was pretty good as well. Catching up with friends you had not seen for a while and networking with industry peers was pretty worthwhile too. Maybe your idea of a good time is putting on a bowling shirt and swilling a couple of beers and pretzels before going home and undressing into your dirty ripped underwear. Hey I say to each his own.

2. I am not the idiot who in 2007 said that I hated the SC awards and that anyone can buy the SC awards with a sponsorship. I am the idiot who said that about the InfoSec Products Guide award by the folks at Silicon Valley Communications. In contrast I have always said nice things about the SC awards. I actually have a lot of respect for them. Also for the record, StillSecure has never been a sponsor of the SC Magazine awards. I have seen sponsors who did not win awards as well. So looks like you got that one wrong Julie, but it happens.

3. ???Networld??? magazine didn???t give me the boot within 3 months. They never had the chance, as I never wrote for ???networld, network world or any other magazine. Maybe you have me confused with Mike Rothman or Mitchell Ashley, who do and did write for Network World. But let me assure you that I do try and think before I write.

4. Regarding what medication pills I take and does my hair make it obvious I ran away from a mental hospital. I don???t take any medication, maybe I should. Better living through chemistry you know ;-) As to my hair, what can I say. At this stage I am happy I have any hair at all. My wife always says when I get my haircut it looks like a Buzz Lightyear style, but no one ever mentioned a mental hospital look to it. In any event sorry it doesn???t appeal to you.

So who is this troll Julie Peterson? Could it be Richard Stiennon in drag? Maybe his wife striking out? Maybe another one of my fans? Who knows, but these sort of comments keep me juiced about blogging and remind me of how much fun I have doing it. Thanks again Julie!

Ah, the joys of blogging!

Tue, 29 Jul 2008 13:12:23 +0000

Julie Peterson commented on Safe Access wins SC Magazine Award Reader Trust Award, again!:

Dressed in a tuxedo and chewing those rubber chicken breasts at the award ceremony is your idea of fun? Aren't you the same mentally retarded idiot who said in 2007 that you hated SC awards and that anyone can buy the SC awards with a sponsorship? Why do you think people give over $10k as sponsorship for the SC awards? Who is watching the awards except other vendors? By the way you suck big time with your rubbish blogs. Didn't networld magazine give you the boot within 3 months? Think before you write Mr. mental. Well done on winning, but please, dont give the impression that you cant buy an award from SC! And don't forget to eat your medication pills tonight, otherwise from your hair it is obvious you ran away from a mental hospital.

First of all Julie, let me thank you for your kind words! You made the statement and let me answer your questions for you.

3. “Networld” magazine didn’t give me the boot within 3 months. They never had the chance, as I never wrote for “networld, network world or any other magazine. Maybe you have me confused with Mike Rothman or Mitchell Ashley, who do and did write for Network World. But let me assure you that I do try and think before I write.

4. Regarding what medication pills I take and does my hair make it obvious I ran away from a mental hospital. I don’t take any medication, maybe I should. Better living through chemistry you know ;-) As to my hair, what can I say. At this stage I am happy I have any hair at all. My wife always says when I get my haircut it looks like a Buzz Lightyear style, but no one ever mentioned a mental hospital look to it. In any event sorry it doesn’t appeal to you.

How CAPTCHA got trashed

Tue, 15 Jul 2008 20:00:00 +0000

CAPTCHA used to be an easy and useful way for Web administrators to authenticate users. Now it's an easy and useful way for malware authors and spammers to do their dirty work.