<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: doctor]]></title>
    <link>http://securityratty.com/tag/doctor</link>
    <description></description>
    <pubDate>Sun, 04 May 2008 11:13:07 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[A Diverse Portfolio of Fake Security Software - Part Five]]></title>
      <link>http://securityratty.com/article/38118a4a2d1022021197659857d63ff3</link>
      <guid>http://securityratty.com/article/38118a4a2d1022021197659857d63ff3</guid>
      <description><![CDATA[The &quot;campaign managers&quot; behind these fake security software propositions are not just starting to take park them at up to three different locations, localize the sites to different languages and...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://4.bp.blogspot.com/_wICHhTiQmrA/SL0JgRiDYeI/AAAAAAAACI8/6WOV1GjHRlY/s1600-h/fake_software_september1.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://4.bp.blogspot.com/_wICHhTiQmrA/SL0JgRiDYeI/AAAAAAAACI8/JMBr1bMh8no/s200-R/fake_software_september1.JPG" /></a>The "campaign managers" behind these <a href="http://ddanchev.blogspot.com/2008/08/diverse-portfolio-of-fake-security_25.html">fake security software propositions</a> are not just starting to take park them at up to three different locations, <a href="http://ddanchev.blogspot.com/2008/04/localized-fake-security-software.html">localize the sites</a> to different languages and introduce <a href="http://ddanchev.blogspot.com/2008/08/fake-security-software-domains-serving.html">client-side exploits</a>, just in case the end user gets suspicious and doesn't install it, but also, the natural evasive practices. For instance, once some of their domains get detected and blocked, they put them in a stand by mode and relaunch them online in a week or so, or ensure that only those coming to the domains from where they are supposed to come - yet another blackhat SEO or SQL injection attack - are the only ones getting to see the download screen.<br />
<br />
Some of the new additions parked at the same IPs offered by the "known suspects" include :<br />
<br />
<b>main-scanner .com</b> - (77.244.220.138; 78.159.97.247; 89.149.209.251; 212.95.37.154)<br />
<b>scanner-mainpro .com<br />
scanner-online1 .com<br />
alldiskscheck300 .com<br />
myscanners101 .com<br />
download-a1 .com<br />
scanner-online1 .com<br />
multilang1 .com<br />
ratemyblog1 .com<br />
multisearch1 .com<br />
filescheck-list303 .com<br />
woodst-sale .com<br />
scanner-mainpro .com<br />
main-scanner .com<br />
directrevisions .com</b><br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://2.bp.blogspot.com/_wICHhTiQmrA/SL0MwkX0VNI/AAAAAAAACJE/QObbQi3_9Ng/s1600-h/doctor_antivirus1.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="141" src="http://2.bp.blogspot.com/_wICHhTiQmrA/SL0MwkX0VNI/AAAAAAAACJE/vDM5gk_K5fc/s200-R/doctor_antivirus1.png" width="200" /></a><b>supersolution-freeantivirus .com</b> - (213.155.2.69)<br />
<b>antivirus-bestsolution .net<br />
antivirus4protection .net<br />
antivirusproxp .com<br />
freebest-antivirus .net<br />
goodantivirus-free .net<br />
noadwareantivirus .com<br />
pwrantivirus2009 .com<br />
solution-freeantivirus .com<br />
supersolution-antivirus .com<br />
supersolution-freeantivirus .com<br />
antivirusdwl .com<br />
securesoftdl .com<br />
viva-codec .com<br />
win-antivirus-protect .com<br />
avxp-2008 .net<br />
antivirusq .net<br />
antivirus2008b .net<br />
antivirus2008m .net<br />
antivirus2008n .net<br />
antivirus2008v .net<br />
antivirus777 .com<br />
antivirusq .net<br />
antivirusr .net<br />
antivirust .net<br />
antivirusw .net<br />
antivirusu .net<br />
expressantivirus2009 .com<br />
spywarezscan .net<br />
antispywareq .net<br />
free-anti-spywaree .net<br />
avcheckyourpc .net<br />
</b><br />
<br />
<a href="http://2.bp.blogspot.com/_wICHhTiQmrA/SL0NgVvxo5I/AAAAAAAACJM/zna4-YKQE_o/s1600-h/doctor_antivirus2.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://2.bp.blogspot.com/_wICHhTiQmrA/SL0NgVvxo5I/AAAAAAAACJM/4mda8Pv35yY/s200-R/doctor_antivirus2.png" /></a><b>software-for-me08 .com</b> - (78.157.143.250)<br />
<b>software-for-me-08 .com<br />
softwarefor-me2008 .com<br />
softwarefor-me-2008 .com<br />
software-forme08 .com</b><br />
<br />
<b>doctor2antivirus .com</b> - (217.112.94.226; 87.248.163.56)<br />
<b>doctor5antivirus .com<br />
doctor6antivirus .com<br />
doctor7antivirus .com<br />
doctor8antivirus .com<br />
doctorantivirus2008a .com<br />
doctor-antivirus .com<br />
bcodecnow .net</b><br />
<br />
<b>mysoftwarefreezone .com</b> - (91.203.92.97)<br />
<b>hotvid44 .com<br />
totsec2009 .com<br />
getdefender2009 .com<br />
totalsecure2009 .com<br />
myveryprivatevid .com<br />
mustseethatvid .com<br />
onlythebestvid .com<br />
ie-antivirus-order .com<br />
ie-anti-virus .com<br />
secure-order-box .com</b><br />
<br />
<b>secureexpertcleaner .com</b> - (89.149.227.50)<br />
<b>bestxpclean2008 .com<br />
virusremover2008 .com<br />
registrydoctor2008 .com<br />
securefileshredder .com<br />
hypersecurefileshredder .com<br />
bestsecureexpertcleaner .com</b><br />
<br />
<b>getdefender2009 .com</b> - (58.65.238.34)<br />
<b>malwarebell .com<br />
free-viruscan .com<br />
tmptmpservvv .com<br />
cometoseemyshow .com</b><br />
<br />
<b>getneededsoftware .com</b> - (91.203.93.25)<br />
<b>gettotalsec2008 .com<br />
thedownloadvid .com<br />
scan.pc-antispyware-scanner .com<br />
totalsecure2009 .com</b><br />
<br />
<b>wista-antivirus2009 .com</b> - (216.255.179.203)<br />
<b>usawindowsupdates .com</b> - (85.17.143.213)<br />
<b>mswindowsupdates .com</b><br />
<br />
The campaigns and the hosting providers are continuously monitored, especially taking into consideration the fact that the domains are already appearing in Alexa's web rankings with sudden peaks of traffic.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2008/08/fake-security-software-domains-serving.html">Fake Security Software Domains Serving Exploits</a><br />
<b> </b><a href="http://ddanchev.blogspot.com/2008/08/diverse-portfolio-of-fake-security_25.html">A Diverse Portfolio of Fake Security Software - Part Four</a><br />
<b> </b><a href="http://ddanchev.blogspot.com/2008/08/diverse-portfolio-of-fake-security_20.html">A Diverse Portfolio of Fake Security Software - Part Three</a><b> </b><br />
<a href="http://ddanchev.blogspot.com/2008/08/diverse-portfolio-of-fake-security.html">A Diverse Portfolio of Fake Security Software - Part Two</a><br />
<a href="http://ddanchev.blogspot.com/2008/04/localized-fake-security-software.html">Localized Fake Security Software</a><br />
<a href="http://ddanchev.blogspot.com/2007/12/diverse-portfolio-of-fake-security.html">Diverse Portfolio of Fake Security Software</a><br />
<a href="http://ddanchev.blogspot.com/2008/05/got-your-xpshield-up-and-running.html">Got Your XPShield Up and Running?</a><br />
<a href="http://ddanchev.blogspot.com/2008/05/fake-pestpatrol-security-software.html">Fake PestPatrol Security Software</a><br />
<a href="http://ddanchev.blogspot.com/2007/10/rbns-fake-security-software.html">RBN's Fake Security Software</a><br />
<a href="http://ddanchev.blogspot.com/2008/07/lazy-summer-days-at-ukrtelegroup-ltds.html">Lazy Summer Days at UkrTeleGroup Ltd</a><br />
<a href="http://ddanchev.blogspot.com/2008/02/geolocating-malicious-isps.html">Geolocating Malicious ISPs</a><br />
<a href="http://ddanchev.blogspot.com/2008/06/malicious-isps-you-rarely-see-in-any.html">The Malicious ISPs You Rarely See in Any Report</a><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=9RKAnL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=9RKAnL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=S4YvYL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=S4YvYL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=J1kcWl"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=J1kcWl" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=q4Iwql"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=q4Iwql" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=Cbh1CL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=Cbh1CL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=b89bjL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=b89bjL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=t2D6Bl"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=t2D6Bl" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/381234025" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 02 Sep 2008 01:04:58 +0000</pubDate>
      <category domain="http://securityratty.com/tag/fake security software">fake security software</category>
      <category domain="http://securityratty.com/tag/net">net</category>
      <category domain="http://securityratty.com/tag/diverse portfolio">diverse portfolio</category>
      <category domain="http://securityratty.com/tag/introduce client-side exploits">introduce client-side exploits</category>
      <category domain="http://securityratty.com/tag/malicious isps">malicious isps</category>
      <category domain="http://securityratty.com/tag/exploits">exploits</category>
      <category domain="http://securityratty.com/tag/sql injection attack">sql injection attack</category>
      <category domain="http://securityratty.com/tag/lazy summer days">lazy summer days</category>
      <category domain="http://securityratty.com/tag/domains">domains</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/381234025/diverse-portfolio-of-fake-security.html">A Diverse Portfolio of Fake Security Software - Part Five</source>
    </item>
    <item>
      <title><![CDATA[When turning updates off really doesnt]]></title>
      <link>http://securityratty.com/article/ad6bfd3501bc1cd24c641aab64e8f592</link>
      <guid>http://securityratty.com/article/ad6bfd3501bc1cd24c641aab64e8f592</guid>
      <description><![CDATA[In any business dealings, if you cant trust the company to do what they say they will do, You go elsewhere right? Its your decision. Not in this instance folks


clipped from windowssecrets.com

Youll...]]></description>
      <content:encoded><![CDATA[<div > In any business dealings, if you cant trust the company to do what they say they will do,<br/>You go elsewhere right?<br/>Its your decision. Not in this instance folks. </div>
<table cellpadding="0" cellspacing="0" width="100%" style="margin: 12px 0px; font-family: arial; color: #333333; background: #ffffff; border: solid 4px #e5e5e5; width: 100%; clear: left;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" class="CM_CTB_Content_Wrap" style="margin: 0px; padding: 0px;background-color: #ffffff;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" style="border-bottom: solid 1px #dcdcdc; white-space: nowrap; margin-bottom: 8px; background-color: #eeeeee ;background-image: url(http://clipmarks.com/images/source-bg.gif); background-repeat: repeat-x; height: 24px; line-height: 24px; vertical-align: middle; padding-bottom: 4px; color: #666666; font-size: 10px;">
<tr>
<td valign="top"><a href="http://clipmarks.com/clipmark/B5BE1F57-04DA-47A4-81B1-6DCC22F654F6/" title="go to this clipmark"><img src="http://content.clipmarks.com/blog_icon/9d9b6101-4fcd-4b38-800c-4f4f98154898/B5BE1F57-04DA-47A4-81B1-6DCC22F654F6/" alt="" width="19" height="19" border="0" style="vertical-align: middle; margin: 0px 4px; display: inline; border: none; float:none;" /></a>clipped from <a title="http://windowssecrets.com/comp/080814" href="http://windowssecrets.com/comp/080814" style="font-size: 11px;">windowssecrets.com</a></td>
</tr>
</table>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://windowssecrets.com/comp/080814 --><B><br />
You&#8217;ll get a new Windows Update, like it or not<br />
</B></td>
</tr>
</table>
<div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://windowssecrets.com/comp/080814 --><DIV><br />
This time, Microsoft is being more up-front about its forthcoming<br />
refresh of Windows Update. For example, product manager Michelle Haven described in a<br />
<A href="http://WindowsSecrets.com/links/$P20d/fee5a4h/?url=blogs.technet.com%2Fmu%2Farchive%2F2008%2F07%2F03%2Fupcoming-update-to-windows-update.aspx" class="nwindow" target="_blank">blog post</A> on July 3 some new features that the upgrade will add.</DIV></td>
</tr>
</table>
<div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://windowssecrets.com/comp/080814 --><DIV><br />
The new version will reportedly reduce the time WU takes to scan for and send out new updates. In addition, if you use the online version of WU, and you click an update for more information, the new version will offer you more links with additional details.</DIV></td>
</tr>
</table>
<div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://windowssecrets.com/comp/080814 --><DIV><br />
But the Redmond company hasn&#8217;t changed the wording of the Control Panel settings that appear to prevent Windows Update from performing silent downloads — but don&#8217;t.</DIV></td>
</tr>
</table>
<div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://windowssecrets.com/comp/080814 --><DIV><br />
In light of these potentially misleading controls, a few tricks on managing Windows Update are just what the doctor ordered.</DIV></td>
</tr>
</table>
</td>
</tr>
</table>
<div style="margin: 0px 6px 6px 4px;">
<table style="font-size: 11px;border-spacing: 0px;padding: 0px;" cellpadding="0" cellspacing="0" width="100%">
<tr>
<td style="background:transparent;border-width:0px;padding:0px;">&nbsp;</td>
<td align="right" style="background:transparent;border-width:0px;padding:0px;width:107px" width="107"><a href="http://clipmarks.com/share/B5BE1F57-04DA-47A4-81B1-6DCC22F654F6/blog/" title="blog or email this clip"><img src="http://content7.clipmarks.com/images/c2b-foot.png" border="0" alt="blog it" width="107" height="17" style="border-width:0px;padding:0px;margin:0px;" /></a></td>
</tr>
</table>
</div>
</td>
</tr>
</table>
]]></content:encoded>
      <pubDate>Thu, 14 Aug 2008 09:31:32 +0000</pubDate>
      <category domain="http://securityratty.com/tag/windows">windows</category>
      <category domain="http://securityratty.com/tag/prevent windows">prevent windows</category>
      <category domain="http://securityratty.com/tag/online version">online version</category>
      <category domain="http://securityratty.com/tag/version">version</category>
      <category domain="http://securityratty.com/tag/redmond company">redmond company</category>
      <category domain="http://securityratty.com/tag/company">company</category>
      <category domain="http://securityratty.com/tag/product manager michelle">product manager michelle</category>
      <category domain="http://securityratty.com/tag/control panel settings">control panel settings</category>
      <category domain="http://securityratty.com/tag/additional details">additional details</category>
      <source url="http://spywarebiz.com/spywarebizblog/?p=559">When turning updates off really doesnt</source>
    </item>
    <item>
      <title><![CDATA[Homer Simpson and the Kimya Botnet]]></title>
      <link>http://securityratty.com/article/decf0db42925ceff37d1b75ae34d14df</link>
      <guid>http://securityratty.com/article/decf0db42925ceff37d1b75ae34d14df</guid>
      <description><![CDATA[Television often relies on fake codes, phone-numbers and addresses to make up part of their fictional worlds. Sometimes, it can go slightly wrong - how many people tried to call Doctor Who last week
...]]></description>
      <content:encoded><![CDATA[
        Television often relies on fake codes, phone-numbers and addresses to make up part of their fictional worlds. Sometimes, it can go slightly wrong - <i>how many</i> people tried to <a href="http://www.telegraph.co.uk/news/newstopics/celebritynews/2261219/Doctor-Who-phone-number-has-fans-in-frenzy.html">call Doctor Who</a> last week?<br /><br />D'oh.<br /><br />Actually, "D'oh" is rather appropriate here. In an old episode of The Simpsons, it was revealed that Chunkylover53@aol.com was Homers Email address. Of course, every Simpsons fan with net access immediately added Chunkylover53 to their AIM contact list. As <a href="http://snpp.com/guides/internet.html">this article</a> points out....<br /><br /><i>Homer's e-mail address chunkylover53@aol.com, as seen on EABF03, was registered by writer-producer Matt Selman, who also replied to e-mails from fans testing it. "He logged in the night that the episode aired and it was immediately filled with the maximum number of responses. He's tried to answer every one of them and then as soon as he answers a hundred, a hundred more pop in," Al Jean told the New York Post in January 2003.</i><br /><br />The "Chunkylover53" AIM screen-name hasn't logged in for quite some time, apparently. Imagine the puzzled expressions worn by Simpsons fans when, all of a sudden, the account came back to life in the last few days with this in their "Away" message....<br /><br /><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="kimya0.gif" src="http://blog.spywareguide.com/images/kimya0.gif" class="mt-image-none" style="" height="203" width="526" /></span>
<br /><br />...yes, "Homer" has seemingly returned, and he comes bearing infection files!<br /><br />Of course, the "exclusive Simpsons episode" is nothing of the kind - what you <i>actually</i> download is a file about 150kb in size, and it looks like this:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="kimya1.jpg" src="http://blog.spywareguide.com/images/kimya1.jpg" class="mt-image-none" style="" height="65" width="63" /></span></div><br /><br />Run the file, and you won't see a new Simpsons episode - you're actually more likely to see this:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="kimya2.jpg" src="http://blog.spywareguide.com/images/kimya2.jpg" class="mt-image-none" style="" height="124" width="305" /></span></div><br /><br /> <div>....a strange error message that mentions "photos" (probably fake), followed by lots of real error messages as most of your desktop fails, leaving you with an entirely blank screen:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="kimya3.jpg" src="http://blog.spywareguide.com/images/kimya3.jpg" class="mt-image-none" style="" height="141" width="217" /></span></div><br /></div><div><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/kimya4.html" onclick="window.open('http://blog.spywareguide.com/images/kimya4.html','popup','width=736,height=531,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/kimya4-thumb-336x242.jpg" alt="kimya4.jpg" class="mt-image-none" style="" height="242" width="336" /></a></span></div><br /></div><div><div align="center">Click to Enlarge (if you really must!)<br /></div><br />From this point onwards, the PC will likely need a reboot and will be sluggish until cleaned up, constantly throwing out error messages, crashing when attempting to open Windows Explorer etc.<br /><br />Now, given that the infection links are being passed around via IM Away messages, there was always going to be the possibility of an Instant Messaging worm attack. However, a lot of testing has taken place and so far, we haven't seen any malicious messages or URLs sent via AIM or MSN Messenger.<br /><br />That's no reason to get complacent though, because what we have seen taking place is possibly quite a bit worse. First of all, a number of hidden files are dropped onto the PC, including Rootkit technology (which the bad guys have helpfully pointed out in the code):<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="rootkitkim.jpg" src="http://blog.spywareguide.com/images/rootkitkim.jpg" class="mt-image-none" style="" height="175" width="180" /></span></div><br /><br />Worse, your PC is deposited into a Botnet of Turkish origin - here's the giveaway traffic stream via an Ethereal log:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="kimyabots.gif" src="http://blog.spywareguide.com/images/kimyabots.gif" class="mt-image-none" style="" height="38" width="475" /></span></div><br /><br />....awaiting further instructions from the Botnet C&amp;C center. This particular Botnet has been around since March of this year. The Turkish connection is interesting, because I haven't seen too many Turkish Botnets - and there's been quite a surge in hacking activity from Turkey recently (most notably the <a href="http://www.channelregister.co.uk/2008/06/18/photobucket_dns_hack/">DNS attacks</a> on Photobucket and ICAAN by NeTDevilz).<br /><br />Finally, the infection drops a number of other files onto the PC besides the Rootkit, which are seemingly related to a new variant of <a href="http://www.spywareguide.com/product_show.php?id=5470">this Chinese infection</a>.<br /><br />It's worth noting that there may only be Instant Messaging infection links sent out if the person running the Botnet Command Center decides to issue all the drones with such a command - so while we haven't seen any IM infection activity, it would be wise not to rule it out completely. We recommend infected users keep an eye on all Instant Messaging activity until they can clean the infection from their computer, just in case.<br /><br />Whoever is responsible for these messages has changed them a couple of times already - last night, the download link had been updated to look like this:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="kimya66.gif" src="http://blog.spywareguide.com/images/kimya66.gif" class="mt-image-none" style="" height="372" width="406" /></span></div><br /><br />...and it currently advertises a link for a dating website:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="chunkyaway.jpg" src="http://blog.spywareguide.com/images/chunkyaway.jpg" class="mt-image-none" style="" height="53" width="288" /></span></div><br /><br />We've reported all links related to this attack, and at least two of the files claiming to be "exclusive Simpsons episodes" are currently offline, though there's bound to be more out there. For now, this is a good reminder to be cautious when randomly adding cool things seen on TV and film to your online applications - you can't always assume the person at the other end is entirely in control.<br /><br />We detect this as <a href="http://www.spywareguide.com/spydet_31515_kimya.html">Kimya</a>.<br /><br />Additional Research: Chris Mannon, FSL Senior Threat Researcher<br />Deepak Setty, FSL Senior Threat Research Engineer<br /></div>
        
    ]]></content:encoded>
      <pubDate>Fri, 11 Jul 2008 13:46:17 +0000</pubDate>
      <category domain="http://securityratty.com/tag/simpsons">simpsons</category>
      <category domain="http://securityratty.com/tag/simpsons fan">simpsons fan</category>
      <category domain="http://securityratty.com/tag/simpsons fans">simpsons fans</category>
      <category domain="http://securityratty.com/tag/exclusive simpsons episode">exclusive simpsons episode</category>
      <category domain="http://securityratty.com/tag/infection">infection</category>
      <category domain="http://securityratty.com/tag/infection files">infection files</category>
      <category domain="http://securityratty.com/tag/real error messages">real error messages</category>
      <category domain="http://securityratty.com/tag/error messages">error messages</category>
      <category domain="http://securityratty.com/tag/infection activity">infection activity</category>
      <source url="http://blog.spywareguide.com/2008/07/who-hacked-homer.html">Homer Simpson and the Kimya Botnet</source>
    </item>
    <item>
      <title><![CDATA[CBAC & Medical Identity Theft]]></title>
      <link>http://securityratty.com/article/02105d066a63c57c66a00f92ef63e99d</link>
      <guid>http://securityratty.com/article/02105d066a63c57c66a00f92ef63e99d</guid>
      <description><![CDATA[Good story to keep in mind for those of you working on CBAC. Claims neeed protection and verification. Why steal an identity when you can capture a claim? (hattip: askelizabeth
The Sopranokovs
The...]]></description>
      <content:encoded><![CDATA[<p>Good story to keep in mind for those of you working on CBAC. Claims neeed protection and verification. Why steal an identity when you can capture a claim? (hattip: <a href="http://askelizabeth.typepad.com/weblog/2008/07/medical-identity-theft-the-new-frontier-for-organized-crime.html">askelizabeth</a>)

</p><blockquote><p>
	The Sopranokovs 
	</p></blockquote><blockquote><p>The Russian mob comes to town with a new scam—medical identity theft. 	
	</p></blockquote><blockquote><p>When FBI special agent Ted Price peered through the window of a dingy brick storefront on Southwest Morrison Street in March, it was what he didn’t see that caught his attention. 	</p></blockquote><blockquote><p>The business, called UnimedCorner, claimed to provide ailing seniors with orthotics—braces and other devices to correct foot, joint and back problems. 	
	</p></blockquote><blockquote><p>Price and other federal investigators were skeptical. 	
	</p></blockquote><blockquote><p>On Unimed’s showroom floor, Price saw wheelchairs, motorized scooters, a variety of canes and, on the walls, a selection of amateurish paintings and framed photographs. There was no evidence, however, of the kinds of equipment for which Unimed had billed Medicare nearly $2 million in the previous couple of months. 	
	</p></blockquote><blockquote><p>“I observed wheelchairs and canes through the window but did not see any orthotics in the store,” Price later wrote in a search-warrant affidavit. “It is a sign of fraud that the store is not stocking the items [for which] it is billing.” 	
	</p></blockquote><blockquote><p>By the time Price arrived on the scene, the company’s owner, a shadowy Russian immigrant named Alexandr Shcherbakov, was long gone. 	
	</p></blockquote><blockquote><p>Today, Shcherbakov’s store sits undisturbed. The message light on the phone blinks, dead potted plants droop and a stuffed toy monkey slumps in a glass display case. 	
	</p></blockquote><blockquote><p>And behind the cash register hangs a framed poster of television’s best-known mobsters, the Sopranos. 	
	</p></blockquote><blockquote><p>From interviews and information presented in federal affidavits, it is clear Shcherbakov moved to Oregon to commit a crime elegant and lucrative enough to make Tony Soprano envious: medical identity theft. 	
	</p></blockquote><blockquote><p>... 	
	</p></blockquote><blockquote><p>“Medical identity theft is the new frontier for organized crime,” says Alex Johnson, a former FBI agent who investigates fraud for Regence BlueShield. “Pretty much anybody can set up a mom-and-pop operation and start cranking out claims.”
	
	Someday, most Americans will need a cane, wheelchair, home hospital bed or another of the items healthcare professionals call “durable medical equipment,” or DME. 	
	</p></blockquote><blockquote><p>For those over 64 and without private insurance, there’s a good chance federally funded Medicare will pick up the tab for that equipment. Last year, according to federal statistics, Medicare spent $8.6 billion on DME. 	
	</p></blockquote><blockquote><p>Here’s the way the system is supposed to work: A doctor prescribes a device such as a wheelchair for a patient, who presents his prescription to a DME supplier. The supplier provides the equipment and bills Medicare, which typically pays 80 percent of the cost.
	
	Unlike pharmacists, who fill prescriptions under strict scrutiny of state and federal watchdogs, DME suppliers are lightly regulated.
	
	“DME is very vulnerable to fraud,” says Consuelo Woodhead, the chief healthcare fraud prosecutor for the U.S. Attorney’s Office in Los Angeles. “It doesn’t require any background in medicine, any kind of professional licensure or appreciable capital. </p></blockquote><blockquote><p>There are barriers of entry in other medical fields, but not in DME.”
	
	To operate, DME suppliers simply need a place of business, a business license and liability insurance. Unlike pharmacists, DME suppliers operate under an honor system: The feds count on them to supply the equipment they claim to provide to the beneficiaries who need it. 	
	</p></blockquote><blockquote><p>That honor system is not working. 	
	</p></blockquote><blockquote><p>The epicenter of DME fraud, according to the federal Department of Health and Human Services, is South Florida, where Medicare billing for DME quadrupled from 2002 to 2006 to $1.7 billion.
	
	Investigators found much of that increase was due to fraud. In 2006, federal inspectors revoked the licenses of 634 DME suppliers in South Florida, nearly half the DME dealers in the region. </p></blockquote><blockquote><p>Later the same year, raids in Southern California yielded similar results: The feds shut down 95 DME suppliers.
	
	Many of the DME suppliers shut down around Los Angeles were run by immigrants from the former Soviet Union. It’s probably no coincidence that when the feds raided Los Angeles DME suppliers, some Angelenos fled to cities where there was less scrutiny—such as Portland.</p></blockquote>]]></content:encoded>
      <pubDate>Thu, 10 Jul 2008 06:09:41 +0000</pubDate>
      <category domain="http://securityratty.com/tag/dme suppliers simply">dme suppliers simply</category>
      <category domain="http://securityratty.com/tag/dme suppliers">dme suppliers</category>
      <category domain="http://securityratty.com/tag/dme fraud">dme fraud</category>
      <category domain="http://securityratty.com/tag/fraud">fraud</category>
      <category domain="http://securityratty.com/tag/dme">dme</category>
      <category domain="http://securityratty.com/tag/identity">identity</category>
      <category domain="http://securityratty.com/tag/medical identity theft">medical identity theft</category>
      <category domain="http://securityratty.com/tag/dme dealers">dme dealers</category>
      <category domain="http://securityratty.com/tag/dme supplier">dme supplier</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/07/cbac-medical-identity-theft.html">CBAC &amp; Medical Identity Theft</source>
    </item>
    <item>
      <title><![CDATA[Castlecroft Medical Practice patient information at risk]]></title>
      <link>http://securityratty.com/article/7d98e304d1a9c365580155e37aa7cb76</link>
      <guid>http://securityratty.com/article/7d98e304d1a9c365580155e37aa7cb76</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
6/18/08

Organization
NHS Trust

Contractor/Consultant/Branch
Wolverhampton City Primary Care Trust
Castlecroft Medical Practice

Victims
Patients
...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/castlecroft.jpg" width="200" align="right" height="46"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>6/18/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.nhs.uk/Pages/homepage.aspx">NHS Trust</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://www.wolverhamptonhealth.nhs.uk/default.asp">Wolverhampton City Primary Care Trust</a> <br><a href="http://www.wolverhamptonhealth.nhs.uk/News/PR2008/Jan2008/castlecroft_medical_centre.asp">Castlecroft Medical Practice</a> <br><br><span style="font-weight: bold;">Victims:</span><br>Patients<br><br><span style="font-weight: bold;">Number Affected:</span><br>~11,000<br><br><span style="font-weight: bold;">Types of Data:</span><br>"names, dates of birth, addresses, contact details and confidential medical records"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"A laptop containing confidential medical records of all 11,000 Wolverhampton patients at a city surgery has been stolen from a GP’s house, police revealed today."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://ukpress.google.com/article/ALeqM5g8iNPMcsfjtLDvAlPdRONHQBsB1Q">The Press Association</a><br><a href="http://www.expressandstar.com/2008/06/18/fears-as-gps-laptop-stolen/">The Express &amp; Star</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>The Press Association<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>A laptop containing confidential information about 11,000 patients has been stolen from a GP's home.<br><span style="font-style: italic;">[Evan] This is now the 11th breach reported on The Breach Blog concerning NHS Trust and affiliated organizations.&nbsp; What is the excuse?&nbsp; Can the GP and/or Primary Care Trust and/or Medical Practice claim to not know the risks involved?</span><br><br>Contrary to Department of Health guidelines, the information was not encrypted, which would have made it unreadable without a special code to unscramble it.<br><span style="font-style: italic;">[Evan] Are medical personnel aware of and required to follow the guidelines?&nbsp; Are there penalties or sanctions for non-compliance?</span><br><br>The laptop was among items stolen in a recent burglary at the home of the unnamed doctor, who works at the Castlecroft Medical Practice in Wolverhampton.<br><br>The details of when and where the laptop was taken from are not being released, but a helpline has been launched for worried patients<br><span style="font-style: italic;">[Evan] I could not find the helpline phone number; otherwise I would publish it for people.</span><br><br>The information on the computer, which belongs to the practice, included patients' names, dates of birth, addresses, contact details and confidential medical records.<br><br>The practice has written to all of its 11,000 patients to inform them that information about them was on the stolen computer.<br><br>Dr Peter Wagstaff, senior partner at the practice, said: "The practice is treating this issue very seriously and we are extremely sorry for any distress or concern that it may cause our patients. Though not encrypted, the confidential information on the laptop was protected by a complex password system, which only a person with specialist computer knowledge would be able to crack."<br><span style="font-style: italic;">[Evan] If the organization were "treating this issue very seriously", and if it was "truly sorry" then why attempt to minimize the situation (risk) by using the password protection argument.&nbsp; In my opinion (and that shared by many information security professionals), password protection is NOT an adequate preventative control to ensure the confidentiality of the information stored on a laptop computer.&nbsp; This holds especially true in instances where the password protection is controlled by the operating system.&nbsp; See: "</span><a style="font-style: italic;" href="http://breachblog.com/2008/06/17/quest.aspx">Laptop stolen from a Quest Diagnostics employee</a><span style="font-style: italic;">" and "</span><a style="font-style: italic;" href="http://www.pogowasright.org/blogs/dissent/?p=1012">Not to worry: the stolen laptop was 'password-protected'</a><span style="font-style: italic;">".</span><br><br>He said the laptop appeared to have been stolen for its re-sale value, rather than for any information stored upon it.<br><span style="font-style: italic;">[Evan] In my opinion, this is another attempt to minimize the situation and imply that the risk of confidential information disclosure is less than it may actually be.</span><br><br>Jon Crockett, chief executive of Wolverhampton City Primary Care Trust, said the trust was "extremely concerned" about the theft.<br><br>He said: "Patients and the public have the right to expect that those dealing with confidential information maintain the highest levels of security and we are carrying out a full and urgent investigation into this incident."<br><span style="font-style: italic;">[Evan] Mr. Crockett makes a very valid point.</span><br><br>National guidance from the Department of Health is that any confidential information about patients must be stored in a safe and secure environment, and mobile devices - including laptops - which contain such data must be fully protected by encryption, he said. <br><span style="font-style: italic;">[Evan] Again, Mr. Crockett seems to "get it".</span><br><br><span style="font-weight: bold;">Commentary:</span><br>The 11th breach for NHS Trust-affiliated organizations in less than 10 months and the fact that the cause of this one is so well publicized in other breaches does not instill much confidence.<br><br>The eleven breaches are only what has been reported on The Breach Blog, there may be more. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>NHS Trust:<br>May, 2008 - <a href="http://breachblog.com/2008/05/27/sandown.aspx">Sandown Health Centre backup tape is missing </a><br>March, 2008 - <a href="http://breachblog.com/2008/03/06/telford.aspx">Stolen NHS flash drive contained adolescent information</a> <br>February, 2008 - <a href="http://breachblog.com/2008/02/15/dudley.aspx">Laptop missing from Russells Hall Hospital (UK)</a> <br>January, 2008 - <a href="http://breachblog.com/2008/02/04/boltonfeb.aspx">Stolen Bolton Hospitals Laptop affects cancer patients</a> <br>January, 2008 - <a href="http://breachblog.com/2008/01/22/sidcup.aspx">Queen Mary's Sidcup Hospital microfiche film goes missing</a> <br>January, 2008 - <a href="http://breachblog.com/2008/01/21/stockport.aspx">Stockport Primary Care Trust flash drive goes missing</a> <br>January, 2008 - <a href="http://breachblog.com/2008/01/11/oldham.aspx">Oldham Primary Care Trust NHS loses two data sticks</a> <br>January, 2008 - <a href="http://breachblog.com/2008/01/10/kingstonnhs.aspx">Highly sensitive medical information found in the road</a> <br>December, 2007 - <a href="http://breachblog.com/2007/12/19/bolton.aspx">Laptop stolen in Royal Bolton Hospital break-in </a><br>September, 2007 - <a href="http://breachblog.com/2007/09/16/nhs.aspx%20">Dudley Group of Hospitals NHS Patient Data For Sale on eBay</a> </font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/06/19/castlecroft.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Thu, 19 Jun 2008 07:54:50 +0000</pubDate>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/confidential information">confidential information</category>
      <category domain="http://securityratty.com/tag/confidential information disclosure">confidential information disclosure</category>
      <category domain="http://securityratty.com/tag/confidential information maintain">confidential information maintain</category>
      <category domain="http://securityratty.com/tag/practice">practice</category>
      <category domain="http://securityratty.com/tag/castlecroft medical practice">castlecroft medical practice</category>
      <category domain="http://securityratty.com/tag/computer">computer</category>
      <category domain="http://securityratty.com/tag/laptop computer">laptop computer</category>
      <category domain="http://securityratty.com/tag/adolescent information">adolescent information</category>
      <source url="http://breachblog.com/2008/06/19/castlecroft.aspx">Castlecroft Medical Practice patient information at risk</source>
    </item>
    <item>
      <title><![CDATA[University of Florida student information online for years]]></title>
      <link>http://securityratty.com/article/70535b81354ea161a0135979f7d38509</link>
      <guid>http://securityratty.com/article/70535b81354ea161a0135979f7d38509</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
6/11/08

Organization
University of Florida

Contractor/Consultant/Branch
Office for Academic Support and Institutional Services

Victims
Students
...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/uflorida.jpg" align="right" height="165" width="165"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>6/11/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.ufl.edu/">University of Florida</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://web.oasis.ufl.edu/">Office for Academic Support and Institutional Services</a> <br><br><span style="font-weight: bold;">Victims:</span><br>Students <br><br><span style="font-weight: bold;">Number Affected:</span><br>"more than 11,300"<br><br><span style="font-weight: bold;">Types of Data:</span><br>"names, addresses and Social Security numbers"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"GAINESVILLE, Fla. - University of Florida officials today mailed letters of notification to more than 11,300 current and former students regarding a privacy breach that resulted in names, addresses and Social Security numbers being posted online that may have been accessible to the public."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://privacy.ufl.edu/CLASBreach/">University of Florida</a> <br><a href="http://www.miamiherald.com/top_stories/story/565567.html">Miami Herald</a> <br><a href="http://insideuf.ufl.edu/2008/06/10/clas-breach/">Inside UF</a> <br><a href="http://www.upi.com/Top_News/2008/06/11/Security_breached_at_Florida_university/UPI-38151213211913/">United Press International</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>University of Florida<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>GAINESVILLE, Fla. - University of Florida officials today mailed letters of notification to more than 11,300 current and former students regarding a privacy breach that resulted in names, addresses and Social Security numbers being posted online that may have been accessible to the public.<br><span style="font-style: italic;">[Evan] Not "may have been".&nbsp; The information was accessible to the public and was not even protected by a password.</span><br><br>The student information was actively used from 2003 through 2005 and remained posted until it was recently discovered during a routine audit of UF systems.<br><span style="font-style: italic;">[Evan] If I am reading this right, this means that some of the personal information was available publicly for ~5 years!</span><br><br>School officials emphasized that the site would not have been easy to find and they do not believe it was accessed by anyone outside the school.<br><span style="font-style: italic;">[Evan] There is no security through obscurity.</span><br><br>"The risk of someone outside actually finding this information and using it inappropriately is very low," - Steve Orlando, UF Spokesman<br><span style="font-style: italic;">[Evan] I wonder how Mr. Orlando came to the conclusion that the risk of disclosure and misuse is "very low".&nbsp; As I understand, the server was publicly accessible, presumably via the internet.&nbsp; If so, was the site indexed by search engines like Google, Yahoo, and Microsoft?&nbsp; It is much easier to find information through a search index because folder structure is much less relevant.&nbsp; The fact that this information was available for 3-5 years adds to the risk too.&nbsp; I only know what I read and based on this and experience, I wouldn't classify this as a "very low" risk situation.&nbsp; Either way, the risk was increased due to poor information security practice and was not necessary. </span><br><br>"We've done computer forensics, and we don't have any evidence that anybody accessed this information," he added.<br><span style="font-style: italic;">[Evan] This indicates poor logging and monitoring which are both essential detective controls (in most situations).&nbsp; Information security personnel (or admins) should be empowered to reconstruct events.</span><br><br>"But because we can't say that with absolute certainty, we're going through with the notification out of an abundance of caution," Orlando said.<br><span style="font-style: italic;">[Evan] I am NOT a fan of the "abundance of caution" claims that seem more popular in breach notifications lately.&nbsp; Organizations would be best advised to use an "abundance of caution" in the prevention and early detection of breaches by applying sound information security principles.</span><br><br>Since 2005, the site has been "dormant but accessible," said university spokesman Steve Orlando. "It was just sitting there."<br><br>The information has been removed and is no longer available online or elsewhere in the UF systems.<br><br>The breach occurred when former student employees of the Office for Academic Support and Institutional Service, or OASIS, program created online records of students participating in the program.<br><br>The student employees posted the information online so that they could work with it from remote locations, but they did not install security measures to keep others from accessing it as well<br><span style="font-style: italic;">[Evan] I have so many questions and arguments.&nbsp; Were the students aware of the risks?&nbsp; If not, then there is probably an information security training and awareness problem.&nbsp; Why was it necessary to include Social Security numbers in the records?&nbsp; Why were the seemingly untrained students allowed to post the information without being stopped or detected?&nbsp; I have many more questions, but I am starting to confuse myself now.</span><br><br>The university sent letters of notification to about 11,300 students whose information is believed to have been potentially compromised.<br><span style="font-style: italic;">[Evan] Here's my take on the word "compromised".&nbsp; If an organization cannot provide reasonable assurance that the information has not been subject to unauthorized disclosure, modification, or destruction, then the information has been "compromised".&nbsp; </span><br><br>University officials were unable to find contact information for about 570, so they are asking students who were enrolled in CLAS from 2003 to 2005 and did not receive a letter but who believe their information may have been compromised to call UF’s Privacy Office Hotline at 866-876-HIPA and provide the requested information.<br><br>Anyone who thinks he or she may be one of the 570 people who were not notified is urged to go to <a href="http://privacy.ufl.edu">privacy.ufl.edu</a> and read the information posted there before calling the privacy hotline.<br><br>"This would certainly appear to be the largest privacy breach we've had," Orlando said.<br><br>We're in the process of strengthening some of those policies regarding what information can be posted and what security measures should be in place<br><span style="font-style: italic;">[Evan] Good start.</span><br><br><span style="font-weight: bold;">Victim Reaction:</span><br>"Why would it be necessary to use a Social Security number instead of something else?" asked Reixach, pointing out that students were given ID numbers. "It's just silly".<br><br>"It's negligence on their part, especially if anyone has been affected with identity theft,"<br><br>Johann Arias, a spring CLAS graduate, had not heard about the breach Wednesday and said UF should be doing more to notify those affected.<br><br>"They always make information very prominent when you have a hold or owe them money," Arias said.<br><br><span style="font-weight: bold;">Commentary:</span><br>This is a case where poorly trained students are granted access or obtained access to confidential information and posted the information to an unsecured location which went undetected for years.&nbsp; Bad all around.&nbsp; <br><br><span style="font-weight: bold;">Past Breaches:</span><br>May, 2008 - <a href="http://breachblog.com/2008/05/22/uflorida.aspx">University of Florida doctor loses job over breach</a> <br>November, 2007 - <a href="http://breachblog.com/2007/11/28/uf.aspx">University of Florida student info online</a> </font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/06/12/uflorida.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Thu, 12 Jun 2008 06:41:30 +0000</pubDate>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/information online">information online</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/information security">information security</category>
      <category domain="http://securityratty.com/tag/confidential information">confidential information</category>
      <category domain="http://securityratty.com/tag/information security personnel">information security personnel</category>
      <category domain="http://securityratty.com/tag/student information">student information</category>
      <category domain="http://securityratty.com/tag/security measures">security measures</category>
      <category domain="http://securityratty.com/tag/install security measures">install security measures</category>
      <source url="http://breachblog.com/2008/06/12/uflorida.aspx">University of Florida student information online for years</source>
    </item>
    <item>
      <title><![CDATA[Academy Learning Centres stolen computers affect seniors]]></title>
      <link>http://securityratty.com/article/89621d79e70c35f86c3ad4252fd551ad</link>
      <guid>http://securityratty.com/article/89621d79e70c35f86c3ad4252fd551ad</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
5/22/08

Organization
Academy Hearing Centres

Contractor/Consultant/Branch
None

Victims
Patients (mostly seniors

Number Affected
Dozens

Types of...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/academy.jpg" align="right" height="51" width="200"><font size="2"><strong>Date Reported: </strong><br>5/22/08<br><br><strong>Organization: </strong><br><a href="http://www.academyhearing.ca/index.htm">Academy Hearing Centres</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Patients (mostly seniors)<br><br><span style="font-weight: bold;">Number Affected:</span><br>"Dozens"<br><br><span style="font-weight: bold;">Types of Data:</span><br>Names, addresses, credit-card numbers, health information and health-card numbers<br><br><span style="font-weight: bold;">Breach Description:</span><br>"Dozens of Calgary seniors are alarmed after learning their credit-card numbers, addresses and health-card numbers were stored on computers that were stolen recently. The Academy Hearing Centre in Brentwood Mall, which provides hearing tests and equipment, mostly to seniors, recently mailed out letters warning of the theft."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.cbc.ca/health/story/2008/05/22/cgy-info-theft.html?ref=rss">CBC News</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>CBC News<br><br><span style="font-weight: bold;">Response:</span><br>From the online source cited above:<br><br>Dozens of Calgary seniors are alarmed after learning their credit-card numbers, addresses and health-card numbers were stored on computers that were stolen recently.<br><br>The Academy Hearing Centre in Brentwood Mall, which provides hearing tests and equipment, mostly to seniors, recently mailed out letters warning of the theft.<br><br>The Academy Hearing Centre refused the CBC's request for an interview, saying only that there is no need for clients to be alarmed.<br><span style="font-style: italic;">[Evan] This is it?&nbsp; Is this indicative of the service that one could expect from Academy Hearing Centres?&nbsp; Organizations should be more open and willing to talk about what they do to protect confidential information, unless they don't know themselves.&nbsp; Shame shame.</span><br><br><span style="font-weight: bold;">Victim Reaction(s):</span><br>"I got scared," said one elderly female client who purchased a hearing aid from the company.<br><br>She requested that her name not be released because she is worried about her security.<br><br>The woman said the thieves nabbed her name, address, health information and Alberta health-care number.<br><br>"It's the same thing, like somebody steals your social insurance number," she said.<br><br>She added that she was unable to change her health-card number.<br><br>"I called up Edmonton, the health insurance centre, and she said you have to wait about six months. Just have to notify your doctor, the family doctor. So somebody might be using my number, so let's hope it won't happen."<br><br><span style="font-weight: bold;">Commentary:</span><br>I wish I had more information to share about this breach, but this is all that is publicly available.&nbsp; In anyone has anything more to share, please feel free to comment.&nbsp; Posted on the Academy Learning Centres <a href="http://www.academyhearing.ca/index.htm">web site</a>:<br><br>"if there is any question left unanswered, please do not hesitate to contact one of our team directly by calling: ph: 403. 210. 2482."<br><br>If you suspect that you may be affected by this breach, or if you want more information, I suggest that you call.&nbsp; Victims can demand answers; after all they are the data owners.&nbsp; What makes this breach especially difficult is the fact that it affects customers that are generally easy victims of fraud and deception.<br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/05/29/academy.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Thu, 29 May 2008 05:14:25 +0000</pubDate>
      <category domain="http://securityratty.com/tag/seniors">seniors</category>
      <category domain="http://securityratty.com/tag/academy">academy</category>
      <category domain="http://securityratty.com/tag/centres">centres</category>
      <category domain="http://securityratty.com/tag/protect confidential information">protect confidential information</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/breach description">breach description</category>
      <category domain="http://securityratty.com/tag/breach">breach</category>
      <category domain="http://securityratty.com/tag/calgary seniors">calgary seniors</category>
      <category domain="http://securityratty.com/tag/health information">health information</category>
      <source url="http://breachblog.com/2008/05/29/academy.aspx">Academy Learning Centres stolen computers affect seniors</source>
    </item>
    <item>
      <title><![CDATA[University of Florida doctor loses job over breach]]></title>
      <link>http://securityratty.com/article/dec8679634b9528dc490ed1c0edf75ca</link>
      <guid>http://securityratty.com/article/dec8679634b9528dc490ed1c0edf75ca</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
5/20/08

Organization
University of Florida

Contractor/Consultant/Branch
College of Medicine

Victims
Patients

Number Affected
1,900

Types of Data...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/uflorida.jpg" align="right" height="165" width="165"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>5/20/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.ufl.edu/">University of Florida</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://www.hscj.ufl.edu/medicine/">College of Medicine</a> <br><br><span style="font-weight: bold;">Victims:</span><br>Patients<br><br><span style="font-weight: bold;">Number Affected:</span><br>~1,900<br><br><span style="font-weight: bold;">Types of Data:</span><br>Digital photographs, names, dates of birth, Social Security numbers, and Medicare numbers<br><br><span style="font-weight: bold;">Breach Description:</span><br>"University of Florida officials will be notifying about 1,900 patients of a UF plastic surgeon that their private health information might have been breached after the information was managed and disposed of improperly."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.bizjournals.com/jacksonville/stories/2008/05/19/daily9.html">Jacksonville Business Journal</a> <br><a href="http://wokv.com/localnews/2008/05/local-docs-photos-cost-him-job.html">WOKV Radio News</a> <br><a href="http://www.firstcoastnews.com/news/mostpopular/news-article.aspx?storyid=109529&amp;provider=top">First Coast News</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Jacksonville Business Journal<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>JACKSONVILLE, FL -- The private health information of 1900 local patients may have been compromised when a Jacksonville doctor gave his computer away.<br><br>Dr. Francis D. Ong, a UF assistant professor of plastic surgery at the UF College of Medicine-Jacksonville, stored unsecured digital photographs of his patients and identifying information -- such as names, dates of birth, Social Security numbers, and Medicare numbers -- on a computer.<br><br>The patients involved were treated by Dr. Ong between July 2005, when he joined UF, and December 2007.<br><br>Ong then gave the computer to a family he was friends with in late January or early February this year.<br><span style="font-style: italic;">[Evan] So, is it safe to assume that Dr. Ong owned this computer?&nbsp; If so, I can think of (at least) three problems that led to this breach.&nbsp; First, the storage of confidential information on a poorly (or less) secured client workstation.&nbsp; Second, the disposal of a client workstation in an insecure manner.&nbsp; Third, the use of a personally owned computer on a corporate (or organization) network.</span><br style="font-style: italic;"><br>One of the friends using the computer replaced its operating system, resulting in the permanent loss of most of the patient information.<br><span style="font-style: italic;">[Evan] Not true.&nbsp; Formatting and re-installing an operating system will not result in permanent loss of data.&nbsp; Depending on factors such as disk size, amount of previously stored data and location on disk, much of the confidential information could still be retrieved with relative ease.</span><br style="font-style: italic;"><br>"The family had installed a new operating system on the computer February 24, so roughly around three weeks after they got the computer and they had destroyed most of the information that was on the hard drives,"<br><span style="font-style: italic;">[Evan] See my comments above</span><br><br>According to UF policy, confidential patient information should only be stored in highly secure university servers, not individual computer hard drives.<br><span style="font-style: italic;">[Evan] A good policy statement in most cases.</span><br><br>"Dr. Ong's storage of these pictures and related data on this computer and his subsequent transfer of the computer to a family were in violation of University of Florida policy," said David Behinfar, a privacy compliance manager at the College of Medicine.<br><br>As a result, UF officials say Dr. Ong will no longer be working with the University of Florida's College of Medicine.<br><span style="font-style: italic;">[Evan] This is likely a necessary step taken by the university.&nbsp; It is sad for Dr. Ong, but a policy is only as good as its enforcement.</span><br style="font-style: italic;"><br>Ong will be no longer be working at the college by June.<br><br>"Dr. Ong has reported that the family members used the computer for their personal use and have said that neither they nor anyone else viewed any pictures or medical information on the computer,"<br><br>The computer has been returned to the University of Florida, and the school tells us the risk of anyone using the information for unlawful or mischievous purposes is extremely low.<br><span style="font-style: italic;">[Evan] I agree that the risk to the affected individuals is probably low due to the fact that the chain of custody is pretty well known with some amount of certainty.&nbsp; This breach could have been much worse.</span><br><br>"We deeply regret this event and apologize to our patients who it may have affected,"<br><br>"We have taken steps to prevent incidents of this type from occurring in the future and are continuing to educate our physicians and staff on our electronic data storage policies."<br><span style="font-style: italic;">[Evan] Some information security professionals may argue with me, but I am a big proponent of information security training and awareness programs.&nbsp; In my experience, effective programs pay for themselves.</span><br style="font-style: italic;"><br>The UF privacy office mailed letters to patients May 19, which included a brochure offering safeguarding advice and a privacy office hotline number.<br><br>Concerned patients of the College of Medicine can call the hotline at 866-876-4472.<br><br><span style="font-weight: bold;">Commentary:</span><br>I was a little surprised to see Dr. Ong's name mentioned so many times in the news reports.&nbsp; It seems to me that Dr. Ong made an honest mistake and likely regrets his actions in this case.&nbsp; This is a classic example that demonstrates the responsibility of data users to learn the information security policies, standards, guidelines and procedures that apply to them during the course of their employment.&nbsp; It is acceptable for an employee to ask questions and seek guidance in areas that aren't clear.<br><br>Information security requires cooperation from everyone involved. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>November, 2007 - <a href="http://breachblog.com/2007/11/28/uf.aspx">University of Florida student info online</a></font><br><br><script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/05/22/uflorida.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Thu, 22 May 2008 05:47:33 +0000</pubDate>
      <category domain="http://securityratty.com/tag/medical information">medical information</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/information security">information security</category>
      <category domain="http://securityratty.com/tag/confidential information">confidential information</category>
      <category domain="http://securityratty.com/tag/information security policies">information security policies</category>
      <category domain="http://securityratty.com/tag/patient information">patient information</category>
      <category domain="http://securityratty.com/tag/florida">florida</category>
      <category domain="http://securityratty.com/tag/february">february</category>
      <category domain="http://securityratty.com/tag/computer february">computer february</category>
      <source url="http://breachblog.com/2008/05/22/uflorida.aspx">University of Florida doctor loses job over breach</source>
    </item>
    <item>
      <title><![CDATA[Health care practices and UCSF patient records exposed]]></title>
      <link>http://securityratty.com/article/7cab17fdc352275114a54ec17a2e2887</link>
      <guid>http://securityratty.com/article/7cab17fdc352275114a54ec17a2e2887</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
5/1/08

Organization
University of California

Contractor/Consultant/Branch
University of California at San Francisco (&quot;UCSF
Target America Inc

Victims...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/ucsf.jpg" align="right" height="54" width="79"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>5/1/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.universityofcalifornia.edu/">University of California</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://www.ucsf.edu/">University of California at San Francisco ("UCSF")</a> <br><a href="http://www.tgtam.com">Target America Inc.</a> <br><br><span style="font-weight: bold;">Victims:</span><br>Patients<br><br><span style="font-weight: bold;">Number Affected:</span><br>6,313<br><br><span style="font-weight: bold;">Types of Data:</span><br>"The information included names, addresses, medical departments and some patient medical record numbers"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"(05-01) 17:22 PDT San Francisco -- Information on thousands of UCSF patients was accessible on the Internet for more than three months last year, a possible violation of federal privacy regulations that might have exposed the patients to medical identity theft"<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.sfgate.com/cgi-bin/article.cgi?f=/c/a/2008/05/02/MNKE10DRGN.DTL">San Francisco Chronicle</a> <br><a href="http://www.news.com/8301-10784_3-9934612-7.html">CNET</a> <br><a href="http://www.upi.com/NewsTrack/Science/2008/05/03/hospital_data_left_open_online/2530/">United Press International</a> <br><a href="http://pub.ucsf.edu/newsservices/releases/200805051/">UCSF News Release</a> <br><br><b>Report Credit:</b><br>Elizabeth Fernandez, San Francisco Chronicle<br><br><b>Response:</b><br>From the online sources cited above:<br><br>Information on thousands of UCSF patients was accessible on the Internet for more than three months last year, a possible violation of federal privacy regulations that might have exposed the patients to medical identity theft, The Chronicle has learned.<br><br>The information accessible online included names and addresses of patients along with names of the departments where medical care was provided.<br><br>Some patient medical record numbers and the names of the patients' physicians also were available online.<br><br>The breach was discovered Oct. 9, but the medical institution did not send out notification letters to the 6,313 affected patients until early April, nearly six months later.<br><br>Sensitive information can be used by employers, health insurers and other entities to discriminate<br><br>thieves can use purloined information to obtain medical treatment and prescription drugs and to file false medical claims.<br><i>[Evan] Purloined is a funny word.&nbsp; </i><br><br>"This is a large and very significant data breach," said Pam Dixon, executive director of the World Privacy Forum<br><br>"To commit medical identity theft, all you need is a patient's name, address and the name of the hospital. If you have a doctor's name and the medical department where the patient was being treated, it is gold. If you add a medical record number, it is a disaster for patients."<br><i>[Evan] I don't think most people know this.&nbsp; Many people think that they are fine if there were no Social Security numbers or credit card numbers exposed.</i><br><br>Hospital officials say there's no indication of identity theft to date.<br><br>UCSF had shared information on its patients with a vendor, Target America Inc., which mines electronic databases amassing information about a nonprofit's potential or existing donors.<br><br>Target America, whose Web site says it maintains "the highest standards of security," tunnels through millions of electronic records to help nonprofits identify and cultivate future donors as well as current donors "who could be giving you more." Additionally, it unearths financial information about donor friends and business acquaintances - even offering maps of a donor's neighborhood.<br><i>[Evan] Seems wrong, doesn't it?&nbsp; You go to the clinic, the clinic farms out your information to a company that determines whether or not you are a good candidate to hit up for money (you probably don't pay enough in health insurance, deductibles and co-pays).&nbsp; If you are a deemed a good donor candidate, you get emails and letters that you never signed up for.&nbsp; The purpose of the emails and letters is to build a rapport with you with the intention of getting you to donate money.&nbsp; Personally, I would be more willing to donate if an organization were straight with me.</i><br><br>The breach was discovered, said UCSF officials, when the hospital was alerted that a patient's name had been queried on the Internet "and it was listed in association with UCSF."<br><br>Corinna Kaarlela, UCSF director of news services, said immediate action was taken to close off the information. Ten days after the breach's discovery, UCSF ended its business agreement with Target America.<br><br>Nancy Johnson, president of Target America, said she could not discuss the matter because of client confidentiality.<br><i>[Evan] There is no mention of this breach anywhere on Target America's site either.&nbsp; Sweep it under the rug and maybe it will go away?</i><br><br>The breach spotlights a little-known practice among medical institutions to plow the ranks of patients for fundraising purposes.<br><br>Hospitals and other health care providers are turning patients into "fundraising free-fire zones," said Dr. Arthur Caplan, chairman of the department of medical ethics at the University of Pennsylvania School of Medicine.<br><br>"The breach is a symptom, but the real ethics challenge is the extent to which health care institutions are tracking patients and their families for nonmedical reasons - for fundraising, marketing, advertising," Caplan said. "I don't think people are aware of the degree to which this is occurring, whether it's by a hospital or a nursing home or a hospice."<br><br>Since 2004, UCSF said it provided the names and addresses of 30,590 patients to Target America, paying the company $12,000 a year.<br><br>Hospital officials said it contracted with the company to assist "with identifying names of individuals who could potentially receive communications from UCSF."<br><i>[Evan] Why not say it like it is.&nbsp; The true motive?</i><br><br>"These opportunities included upcoming events, developments in specific UCSF programs, and opportunities to support the University."<br><i>[Evan] Closer.</i><br><br>After the breach was discovered, the hospital said it required Target America to hire "an objective third-party firm" to investigate. UCSF received the forensic analysis report March 26. It showed that information was potentially accessible from July 1 to Oct. 9 last year "if a query for a specific name was made." Notification letters were mailed to patients April 4.<br><br>While UCSF officials stressed that the breach did not involve Social Security numbers, Dixon said that patients could nonetheless be at risk for harm.<br><br>"With medical identity theft, there is so much on the line - only minimal information needs to go out for there to be a problem," she said.<br><br>Linking patients to the departments where they were treated, for instance, is problematic because it can serve as a key identifier of a patient's health condition.<br><i>[Evan] Don't think that this doesn't happen.&nbsp; Insurance companies are not in business to help people, they are in business to make money.&nbsp; They want to identify as many pre-existing conditions as possible.</i><br><br>UCSF officials say the use of a department's name is not prohibited under HIPAA. But it acknowledged that such a disclosure is against its own "best practice" policy.<br><i>[Evan] I think that this is open to interpretation.&nbsp; HIPAA is not clear (nor can it be) in all circumstances, and some people would argue this claim with UCSF officials.</i><br><br>"Steps have been taken to reinforce this practice," <br><i>[Evan] Like what?&nbsp; Are "steps" enough?</i><br><br>For one outraged UCSF patient whose name was part of the online data disclosure, the incident involved an alarming breach of medical trust.<br><br>"They told a fundraising company that I'm a patient - morally this should not ever be done by any health care provider," said the patient, a retired executive living in San Francisco. He asked that his name not be published. <br><br>"Medical records are supposed to be of utmost privacy," he said. "The University of California is high up in the totem pole for quality medical care. When you go there, the first thing you see are notices regarding patient privacy. Why in the world would they give out my private information? It boils down to monetary greed."<br><i>[Evan] There is no doubt that UCSF Medical Center is an outstanding health provider in terms of providing innovative medical care and saving lives.&nbsp; One of the best from what I read.</i><br><br>UCSF is committed to maintaining the privacy of patient information and takes any compromise of patient information very seriously. When patients are seen at UCSF, they are provided with a Notice of Privacy Practice (NOPP), which describes how UCSF may use and disclose their medical information in accordance with the Federal HIPAA Privacy Rule.<br><br>UCSF continually modifies systems and practices to enhance the security of patient information.<br><br><b>Commentary:</b><br>Hmm.&nbsp; I agree with Dr. Caplan when he stated that "The breach is a symptom, but the real ethics challenge is the extent to which health care institutions are tracking patients and their families for nonmedical reasons - for fundraising, marketing, advertising,".&nbsp; There is not much discussion surrounding the details of the actual breach itself.&nbsp; I have also read concern of the length of time it took before patients were notified.<br><br>From Target America's "<a href="http://www.tgtam.com/why.php">Why Target America?</a>" page:<br>"Target America data base, culled from 75 data sources, contains more than 7 million records of the wealthiest and most generous people in the nation -- the top 5 percent in terms of income, assets, and philanthropic history. Ninety-four percent of the individuals on the data base give more than $5,000 a year to charities. The breadth of our data is unique: we focus not only on high-profile, corporate America, but include emerging sources of wealth such as minority-owned business and women entrepreneurs."<br>Looks like a pretty important database to me.&nbsp; <br><br>There are no apologies made by UCSF or Target America for the breach. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>University of California:<br>April, 2008 - <a href="http://breachblog.com/2008/04/10/uci.aspx">University of California Irvine students are hit with mysterious breach</a> </font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/05/07/ucsf.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Wed, 07 May 2008 12:10:17 +0000</pubDate>
      <category domain="http://securityratty.com/tag/ucsf">ucsf</category>
      <category domain="http://securityratty.com/tag/ucsf patient">ucsf patient</category>
      <category domain="http://securityratty.com/tag/ucsf patients">ucsf patients</category>
      <category domain="http://securityratty.com/tag/patients">patients</category>
      <category domain="http://securityratty.com/tag/patient">patient</category>
      <category domain="http://securityratty.com/tag/sensitive information">sensitive information</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/patient information">patient information</category>
      <category domain="http://securityratty.com/tag/ucsf medical center">ucsf medical center</category>
      <source url="http://breachblog.com/2008/05/07/ucsf.aspx">Health care practices and UCSF patient records exposed</source>
    </item>
    <item>
      <title><![CDATA[Why even having health insurance is not enough anymore]]></title>
      <link>http://securityratty.com/article/c4f007a02c60338f0381adcb2dd11c15</link>
      <guid>http://securityratty.com/article/c4f007a02c60338f0381adcb2dd11c15</guid>
      <description><![CDATA[Forgive me for going totally off topic (hey its my blog I write what I want) but it is Sunday and not much news on security. I wanted to write about an article I saw in the NY Times today called &quot;...]]></description>
      <content:encoded><![CDATA[
<div xmlns="http://www.w3.org/1999/xhtml"><p><a href="http://www.stillsecureafteralltheseyears.com/ashimmy/WindowsLiveWriter/INSURE_GRAPH.jpg"><img style="border-right: 0px; border-top: 0px; margin: 0px 10px 5px 0px; border-left: 0px; border-bottom: 0px" height="260" alt="INSURE_GRAPH" src="http://www.stillsecureafteralltheseyears.com/ashimmy/WindowsLiveWriter/INSURE_GRAPH_thumb.jpg" width="247" align="left" border="0"></a> Forgive me for going totally off topic (hey its my blog I write what I want) but it is Sunday and not much news on security.&nbsp; I wanted to write about an article I saw in the NY Times today called "<a href="http://www.nytimes.com/2008/05/04/business/04insure.html?_r=1&amp;partner=rssyahoo&amp;emc=rss&amp;oref=slogin" target="_blank">Even the Insured Feel the Strain of Health Costs</a>". The article details that with the hard economic times even people who have health insurance are being bitten by the ever rising costs of health care.&nbsp; Rising premiums, covering less procedures and care and charging more for prescriptions and medical care combine to put the bite on everyone.&nbsp; From my own experience here are 4 examples of how even with health insurance, medical care costs are taking a bite:</p> <p>1. My wife had minor surgery in September.&nbsp; It was ambulatory surgery where she went in the morning and went home that afternoon/evening.&nbsp; Even though we have full PPO coverage and it was participating doctors, hospital, etc. my out-of-pocket costs after insurance were almost $3000! The surgeon received a whopping $472 from the insurance company for the operation and the hospital billed like 17k!&nbsp; When I called the hospital they said they did not expect to get paid that much, but had to bill it so they could get as much as they could.&nbsp; I than had to negotiate what I would pay out of pocket beyond that. I also had to pay the anesthesia, the prescriptions, etc.</p> <p>2. Here at StillSecure we had to switch providers again this year because United Health Care wanted another 15 to 20% raise in premiums. In fact that is about normal for health insurance, way above the cost of living and inflation.&nbsp; We pay a good chunk of our employees insurance premiums, but even so the 20% or so that we have the employee pick up gets bigger and bigger.&nbsp; Plus the insurance company covers less and less.&nbsp; This squeeze is frankly baffling. How can you pay more and get less.</p> <p>3. I had a dental implant a few months back.&nbsp; Though we pay for dental coverage, our insurance would cover a bridge or cap, but they don't consider implants necessary and would not cover any of it. I had to lay 2k out of pocket. On top of this the panoramic x-ray the oral surgeon took (which again was not covered, another 100 bucks) showed I had an impacted wisdom tooth with a cyst around it.&nbsp; My dental insurance covered the wisdom tooth, but the cyst removal would be considered under my regular insurance and my dentist was not participating. In fact I could not find a participating oral surgeon in the area.&nbsp; So I had to an extra $600 dollars out of pocket and of course my out-of-network deductible was $750, so I ate it again.</p> <p>4. The orthodontist.&nbsp; This one is perhaps the worst of all and really gets my goat.&nbsp; My oldest son went for an orthodontic exam. The doctor told my wife that he would probably need braces when he gets older and that current best practices in orthodontics is to put braces on now in a phase 1 and than if necessary they put other braces on later when more of his adult teeth come in. Putting braces on now would lesson the severity of what he would need later.&nbsp; OK, great lets do it, right?&nbsp; Wrong!&nbsp; Our insurance covers a one time payment of $1200. The dentist said if we use it now, the cost for phase 1 would be $3600.&nbsp; That leaves a balance of $2400 that I have to pay.&nbsp; However, if I do it without insurance he would charge me $2400 and than I could use the $1200 towards the phase 2 braces my son may need which could be up to 10k. So if we went through insurance the cost was $3600 with $2400 out of pocket or no insurance $2400 out of pocket.&nbsp; What is wrong with that picture. Whether I have insurance or not, it still costs me $2400!&nbsp; This is fundamentally what is wrong with our health care system.&nbsp; The dentist is willing to accept $2400.&nbsp; He should take the $1200 from my insurance and I should pay him another $1200.&nbsp; Anything else is ludicrous and in my mind borders on criminal insurance fraud.</p> <p>We need to restore sanity to the whole system. It is not just the 48 million people in this country that don't have insurance, it is also the costs of the people who do have insurance. Don't tell me that giving us greater limits to put in tax deferred health savings plan are the answer either.&nbsp; Fundamentally we need the insurance companies to stop sucking the blood of the premium payers. We need the health industry to bill for what the do and what it is worth, not how to maximize what the insurance company pays and most of all we need to make sure that people can afford and receive decent health care!</p> <p>BTW, if you want to read an excellent blog on this subject, Dr. Stanley Feld, Brad's dad writes a <a href="http://stanleyfeldmdmace.typepad.com/" target="_blank">great blog</a> on it.</p></div>

<p><a href="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?a=glbKcq"><img src="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?i=glbKcq" border="0"></img></a></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=JXuPNH"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=JXuPNH" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=68kijH"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=68kijH" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=F5w3nH"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=F5w3nH" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=N5GpqH"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=N5GpqH" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=fCI2Xh"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=fCI2Xh" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=tOX5ch"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=tOX5ch" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~4/283478411" height="1" width="1"/>]]></content:encoded>
      <pubDate>Sun, 04 May 2008 11:13:07 +0000</pubDate>
      <category domain="http://securityratty.com/tag/insurance">insurance</category>
      <category domain="http://securityratty.com/tag/health insurance">health insurance</category>
      <category domain="http://securityratty.com/tag/premiums">premiums</category>
      <category domain="http://securityratty.com/tag/employees insurance premiums">employees insurance premiums</category>
      <category domain="http://securityratty.com/tag/insurance company pays">insurance company pays</category>
      <category domain="http://securityratty.com/tag/regular insurance">regular insurance</category>
      <category domain="http://securityratty.com/tag/insurance company">insurance company</category>
      <category domain="http://securityratty.com/tag/care">care</category>
      <category domain="http://securityratty.com/tag/health care system">health care system</category>
      <source url="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~3/283478411/why-even-having.html">Why even having health insurance is not enough anymore</source>
    </item>
  </channel>
</rss>
