<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: domain]]></title>
    <link>http://securityratty.com/tag/domain</link>
    <description></description>
    <pubDate>Thu, 07 Aug 2008 07:21:10 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Anti-theft Protocols]]></title>
      <link>http://securityratty.com/article/2a0b13fdcf3d76640c70ce857f0644c4</link>
      <guid>http://securityratty.com/article/2a0b13fdcf3d76640c70ce857f0644c4</guid>
      <description><![CDATA[At last Fridays Security Group meeting, we talked about security protocols that are intended to deter or reduce the consquences of theft, and how they go wrong
Examples include
GSM mobile phones have...]]></description>
      <content:encoded><![CDATA[<p>At last Friday&#8217;s Security Group meeting, we talked about security protocols that are intended to deter or reduce the consquences of theft, and how they go wrong.</p>
<p>Examples include:</p>
<ul>
<li>GSM mobile phones have an identifier for the phone (separate from the identifier for the user) that can be blacklisted when the phone is stolen.</li>
<li>Some car radios will stop working when the battery is disconnected, and only start working again when a numeric code is entered. This is intended to deter theft of the radio.</li>
<li>In Windows Vista, Bitlocker can be used to encrypt files. One of  the intended applications for this is that if someone steals your laptop, it will be difficult for them to gain access to your encrypted files.</li>
</ul>
<p>Ross told a story of what happened when he needed to disconnect the battery on his car: the radio stopped working, and the code he had been given to reactivate it didn&#8217;t work - it was the wrong code.<br />
Ross argues that these reactivation codes are unecessary, because other measures taken by the car manufacturers - such as making radios non-standard sizes, and hence not refittable in other car models - have made them redundant.</p>
<p>I described how the motherboard on a laptop had needed to be replaced recently. The motherboard contains the TPM chip, which contains the encryption keys needed to decrypt files protected with Bitlocker. If you replace the motherboard, the files on your hard disk will become unreadable, even if the disk is physically OK. Domain-joined Vista machines can be configured so that a sysadmin somewhere within your organization is able to recover the keys when this happens.</p>
<p>Both of these situations suffer from classic usability problems: the recovery procedures are invoked rarely (so users may not know what they&#8217;re supposed to do), and, if your system is configured incorrectly, you only find out when it is <i>too late</i>: you key in the code to your radio and it remains a doorstop; the admin you hoped was escrowing your keys turns out not to have the private key corresponding to the public key you were encrypting under (or, more subtly: the person with the authority to ask for your laptop&#8217;s key to be recovered is not you, because the appropriate admin has the <i>wrong name</i> for the laptop&#8217;s owner in their database).</p>
<p>I also described what happens when an XBox 360 is stolen. When you buy XBox downloadable content, you buy <i>two</i> licenses: one that&#8217;s valid on any XBox, as long as you&#8217;re logged in to XBox live; and one that&#8217;s valid on just your XBox, regardless of who&#8217;s logged in. If a burglar steals your Xbox, and you buy a new one, you need to get another license of the <i>second</i> type (for all the other people in your household who make use of it). The software makes this awkward, because it knows that you already have a license of the <i>first</i> type, and assumes that you couldn&#8217;t possibly want to buy it again. The work-around is to get a new email address, a new Microsoft Live Account, and a new Gamer Tag, and use these to repurchase the license. You can&#8217;t just change the gamertag, because XBox live doesn&#8217;t let the same Microsoft Live account have two gamertags. And yes, I know, your buddies in the MMORPG you were playing know you by your gamertag, so you don&#8217;t want to change it.</p>
]]></content:encoded>
      <pubDate>Wed, 03 Sep 2008 12:18:14 +0000</pubDate>
      <category domain="http://securityratty.com/tag/xbox">xbox</category>
      <category domain="http://securityratty.com/tag/xbox downloadable content">xbox downloadable content</category>
      <category domain="http://securityratty.com/tag/wrong code">wrong code</category>
      <category domain="http://securityratty.com/tag/xbox live">xbox live</category>
      <category domain="http://securityratty.com/tag/wrong">wrong</category>
      <category domain="http://securityratty.com/tag/car">car</category>
      <category domain="http://securityratty.com/tag/car radios">car radios</category>
      <category domain="http://securityratty.com/tag/files">files</category>
      <category domain="http://securityratty.com/tag/microsoft live account">microsoft live account</category>
      <source url="http://www.lightbluetouchpaper.org/2008/09/03/anti-theft-protocols/">Anti-theft Protocols</source>
    </item>
    <item>
      <title><![CDATA[My First Rogue Cleaner Popup Of The Month]]></title>
      <link>http://securityratty.com/article/2df0704bf25c18e2b2d4a6440eb4ae20</link>
      <guid>http://securityratty.com/article/2df0704bf25c18e2b2d4a6440eb4ae20</guid>
      <description><![CDATA[Click to Enlarge

courtesy of Secureonlinetags(dot)com, seemingly associated with popups from rogue antispyware hijacks. The feedback isn't particularly positive on Siteadvisor either, so you might...]]></description>
      <content:encoded><![CDATA[
        <div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/securetags.html" onclick="window.open('http://blog.spywareguide.com/images/securetags.html','popup','width=524,height=501,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/securetags-thumb-324x309.jpg" alt="securetags.jpg" class="mt-image-none" style="" height="309" width="324" /></a></span> </div><div><div align="center">Click to Enlarge<br /></div><br />...courtesy of Secureonlinetags(dot)com, seemingly associated with popups from rogue antispyware hijacks. The feedback isn't particularly positive on <a href="http://www.siteadvisor.com/sites/secureonlinetags.com/postid/?p=1055008">Siteadvisor</a> either, so you might want to block this domain.<br /></div>
        
    ]]></content:encoded>
      <pubDate>Mon, 01 Sep 2008 04:24:51 +0000</pubDate>
      <category domain="http://securityratty.com/tag/rogue antispyware hijacks">rogue antispyware hijacks</category>
      <category domain="http://securityratty.com/tag/courtesy">courtesy</category>
      <category domain="http://securityratty.com/tag/seemingly">seemingly</category>
      <category domain="http://securityratty.com/tag/feedback">feedback</category>
      <category domain="http://securityratty.com/tag/domain">domain</category>
      <category domain="http://securityratty.com/tag/click">click</category>
      <category domain="http://securityratty.com/tag/siteadvisor">siteadvisor</category>
      <category domain="http://securityratty.com/tag/popups">popups</category>
      <category domain="http://securityratty.com/tag/block">block</category>
      <source url="http://blog.spywareguide.com/2008/09/my-first-rogue-cleaner-popup-o.html">My First Rogue Cleaner Popup Of The Month</source>
    </item>
    <item>
      <title><![CDATA[Fake Security Software Domains Serving Exploits]]></title>
      <link>http://securityratty.com/article/a2ffa8d411dc417bdb5a774ee6ab5207</link>
      <guid>http://securityratty.com/article/a2ffa8d411dc417bdb5a774ee6ab5207</guid>
      <description><![CDATA[Psychological imagination, &quot;think cybercriminals&quot; mentality or scenario building intelligence, seem to always produce the results they are supposed to. On Monday, I pointed out that

Ironically, the...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://4.bp.blogspot.com/_wICHhTiQmrA/SLaDCa0a4yI/AAAAAAAACIU/V4NpXSLdBEA/s1600-h/fake_software_client_side_exploits.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://4.bp.blogspot.com/_wICHhTiQmrA/SLaDCa0a4yI/AAAAAAAACIU/6N2G2L2h2-0/s200-R/fake_software_client_side_exploits.png" /></a>Psychological imagination, "think cybercriminals" mentality or scenario building intelligence, seem to always produce the results they are supposed to. On Monday, <a href="http://ddanchev.blogspot.com/2008/08/diverse-portfolio-of-fake-security_25.html">I pointed out that</a> :<br />
<br />
"<i>Ironically, the participant in the affiliate program whose original objective was to drive traffic to the fake security software's site, may in fact start receiving so much traffic due to the combination of traffic acquisition tactics, that <a href="http://ddanchev.blogspot.com/2008/02/serving-malware-through-advertising.html">introducing client-side exploits courtesy of a third-party affiliate network</a>, may in fact prove more profitable then the revenue sharing partnership with the rogue security software's vendor at the first place.</i>"<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://2.bp.blogspot.com/_wICHhTiQmrA/SLaJ9G1B_YI/AAAAAAAACIk/WVx1enYkT0E/s1600-h/fake_security_client_side.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://2.bp.blogspot.com/_wICHhTiQmrA/SLaJ9G1B_YI/AAAAAAAACIk/XSe4BHhrt2w/s200-R/fake_security_client_side.JPG" /></a>The next day, <a href="http://sunbeltblog.blogspot.com/2008/08/xp-antivirus-2008-now-with-sploits.html">client-side exploits start getting introduced</a> "in between" the fake security software sites :<br />
<br />
"<i>I've blogged before about the problem of Google Adwords pushing Antivirus XP Antivirus 2008. The situation is still ongoing.&nbsp; However, it's taken a turn for the worse, as these XP Antivirus pages are pushing exploits to install malware on the users system. This will also affect the many syndicators of Google Adwords.</i>"<br />
<br />
The domain in question <b>bestantivirus2009.com</b> - (68.180.151.21) is hosting the binary at <b>bestantivirus2009 .com</b>/setup_1096_MTYwM3wzNXww_.exe and has an IFRAME pointing to <b>huytegygle .com</b>/index.php (200.46.83.246).<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://4.bp.blogspot.com/_wICHhTiQmrA/SLaOX5IUu2I/AAAAAAAACIs/UmA8sFcQCIA/s1600-h/antivirus0003.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://4.bp.blogspot.com/_wICHhTiQmrA/SLaOX5IUu2I/AAAAAAAACIs/YL8oDzvUAeY/s200-R/antivirus0003.png" /></a>Here's another example <b>antivirus0003.net</b> with an IFRAME pointing to a different location - <b>124.217.250.85 /~ave/etc/count.php?o=16</b>.<br />
<br />
Despite that these domains are part of the "International Virus Research Lab" fake domains portfolio, it remains to be seen whether others will start multitasking as well.<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=yRDO0K"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=yRDO0K" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=mEJFVK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=mEJFVK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=74vKNk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=74vKNk" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=FMF6wk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=FMF6wk" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=fnoShK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=fnoShK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=5q8hIK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=5q8hIK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=GNqd3k"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=GNqd3k" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/377056323" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 28 Aug 2008 02:41:10 +0000</pubDate>
      <category domain="http://securityratty.com/tag/exploits">exploits</category>
      <category domain="http://securityratty.com/tag/domains">domains</category>
      <category domain="http://securityratty.com/tag/client-side exploits courtesy">client-side exploits courtesy</category>
      <category domain="http://securityratty.com/tag/client-side exploits start">client-side exploits start</category>
      <category domain="http://securityratty.com/tag/start">start</category>
      <category domain="http://securityratty.com/tag/fake security software">fake security software</category>
      <category domain="http://securityratty.com/tag/antivirus">antivirus</category>
      <category domain="http://securityratty.com/tag/google adwords">google adwords</category>
      <category domain="http://securityratty.com/tag/fake domains portfolio">fake domains portfolio</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/377056323/fake-security-software-domains-serving.html">Fake Security Software Domains Serving Exploits</source>
    </item>
    <item>
      <title><![CDATA[Magic Quadrant for IT Event Correlation and Analysis, 2007]]></title>
      <link>http://securityratty.com/article/73190514b58f80fbdcadffdaf0c59673</link>
      <guid>http://securityratty.com/article/73190514b58f80fbdcadffdaf0c59673</guid>
      <description><![CDATA[I often get asked that if the current self-decribed CEP vendors are not doing real CEP, in my opinon, who are the vendors in the CEP space
At the moment, event correlation and event analysisis...]]></description>
      <content:encoded><![CDATA[<p>I often get asked that if the current self-decribed CEP vendors are not doing &#8220;real CEP,&#8221; in my opinon, who are the vendors in the CEP space?</p>
<p>At the moment, event correlation and event analysis is Gartner&#8217;s closest magic quadrant (MQ)  that relates directly to complex event processing (and event processing in general).    </p>
<p style="text-align: center;"><a href="http://mediaproducts.gartner.com/reprints/microsoft/vol4/article6/153661_0001.png" target="_blank"><img class="aligncenter" style="vertical-align: middle;" src="http://mediaproducts.gartner.com/reprints/microsoft/vol4/article6/153661_0001.png" alt="" width="432" height="468" /></a></p>
<p>A number of our friends and colleagues would like to position CEP as BRE, BRMS, BPM, SOA, algo trading and just about every other technology under the sun, except event correlation!</p>
<p>In a nutshell, the state-of-the-state of CEP/EP is that a number of firms in the software industry have found some &#8220;uncharted magic quadrant waters&#8221; and are positioning themselves to be &#8220;chart worthy&#8221;. Instead of competing head on with the experienced players (event correlation and analysis) that have been in the event processing field for many years.   </p>
<p>As I have mentioned a few times here on The CEP Blog, if the current generation self-described CEP engines were leading the industry in event correlation and analysis (CEP&#8217;s core technology domain) they would be either be on Gartner&#8217;s Magic Quadrant for IT Event Correlation and Analysis, or possibly acquired by a one of these large giants in event processing to solve complex event processing and event correlation problems that remain, for the most part, still unsolved!</p>
]]></content:encoded>
      <pubDate>Tue, 26 Aug 2008 11:04:05 +0000</pubDate>
      <category domain="http://securityratty.com/tag/event">event</category>
      <category domain="http://securityratty.com/tag/event correlation">event correlation</category>
      <category domain="http://securityratty.com/tag/solve complex event">solve complex event</category>
      <category domain="http://securityratty.com/tag/complex event">complex event</category>
      <category domain="http://securityratty.com/tag/analysis">analysis</category>
      <category domain="http://securityratty.com/tag/cep vendors">cep vendors</category>
      <category domain="http://securityratty.com/tag/current generation">current generation</category>
      <category domain="http://securityratty.com/tag/ongartners magic quadrant">ongartners magic quadrant</category>
      <category domain="http://securityratty.com/tag/vendors">vendors</category>
      <source url="http://www.thecepblog.com/2008/08/26/magic-quadrant-for-it-event-correlation-and-analysis-2007/">Magic Quadrant for IT Event Correlation and Analysis, 2007</source>
    </item>
    <item>
      <title><![CDATA[Fake Porn Sites Serving Malware - Part Three]]></title>
      <link>http://securityratty.com/article/df6f06139a5c1a6029631a2d5221d428</link>
      <guid>http://securityratty.com/article/df6f06139a5c1a6029631a2d5221d428</guid>
      <description><![CDATA[Continue the Fake Porn Sites Serving Malware and Fake Porn Sites Serving Malware - Part Two series, in part three we'll take a peek at the emerging trend of parking a single domain at up to three...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://4.bp.blogspot.com/_wICHhTiQmrA/SLQENtZvVWI/AAAAAAAACHU/3Th9wGTcre4/s1600-h/fake_porn_zlob_codec_localized.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://4.bp.blogspot.com/_wICHhTiQmrA/SLQENtZvVWI/AAAAAAAACHU/1aZSLqClTi4/s200-R/fake_porn_zlob_codec_localized.JPG" /></a>Continue the <a href="http://ddanchev.blogspot.com/2008/06/fake-porn-sites-serving-malware.html">Fake Porn Sites Serving Malware</a> and <a href="http://ddanchev.blogspot.com/2008/07/fake-porn-sites-serving-malware-part.html">Fake Porn Sites Serving Malware - Part Two</a> series, in part three we'll take a peek at the emerging trend of parking a single domain at up to three different hosting locations, re-establishing connections between malicious ISPs for yet another time in between exposing the domains and the download locations sharing the same IPs.<br />
<br />
<b>downlfreesexgirlbeach .com</b> first redirects to <b>infodist1 .com/in.cgi?2 </b>then to <b>watchnenjoy.com/index.php?id=1314&amp;style=black</b>, and finally to the front end to the codec's download location <b>handmadeclips .com</b>, where the codec is downloaded from <b>fwlprocedure .com</b>.  Behind these domains, we can easily expose many other fake porn sites and pharmaceutical scams, next to a small portfolio of domains specifically used for hosting the binaries. Due to the obvious rotation I've encountered several times so far, a fake porn site today, is tomorrow's blackhat SEO content farm :<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://4.bp.blogspot.com/_wICHhTiQmrA/SLQHSj0XVWI/AAAAAAAACHc/DX-IaOAduVs/s1600-h/fake_porn_august.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://4.bp.blogspot.com/_wICHhTiQmrA/SLQHSj0XVWI/AAAAAAAACHc/k9h1_E21wag/s200-R/fake_porn_august.JPG" /></a><b>downlfreesexgirlbeach .com</b> - (88.214.198.25)<br />
<b>vids365 .com<br />
downlfreesexgirlbeach .com<br />
top.only-bi .com<br />
wikiei .com<br />
paysuperporn .com<br />
aboutsexporn .com<br />
freactor .com<br />
cheapofficialpills .com<br />
finance-leaders.comnudenakedboys .com<br />
photosgayboys&nbsp; .com<br />
uniqueincest.com<br />
shyincest .com<br />
banrnd.central-xxx .com<br />
tvisklick .info<br />
thebg .net<br />
termion .net<br />
xoxvids .net<br />
bestpricepills .net<br />
bcodecnow .net</b><br />
<br />
<b>infodist1 .com</b> - (88.214.204.40)<br />
<b>farmasearch2008 .com<br />
flaxxvid .com<br />
xanax777pills .com<br />
18virgingirls .com<br />
girlnudegallaryvideox .com<br />
allxxxpornogerlsx .com<br />
jproshin .info<br />
familytaboo .info<br />
fullsitehost .info<br />
20searchonlinesite .net<br />
add-your-video .net<br />
blogs4y .net</b><br />
<br />
<div class="separator" style="clear: both; text-align: center;"></div><div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://3.bp.blogspot.com/_wICHhTiQmrA/SLQIspjO3tI/AAAAAAAACHs/MaMXiAw02F8/s1600-h/downlfreesexgirlbeach_viz.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://3.bp.blogspot.com/_wICHhTiQmrA/SLQIspjO3tI/AAAAAAAACHs/znHGKTmbcHE/s200-R/downlfreesexgirlbeach_viz.JPG" /></a><b>adult-shemale .com</b> - (88.214.198.25)<br />
<b>adult-tranny .com<br />
all-shemale&nbsp; .com&nbsp;&nbsp;&nbsp; <br />
bcodecnow .net<br />
best-tranny .com&nbsp;&nbsp;&nbsp; <br />
bestguyportal .com<br />
bestmoviez .com&nbsp;&nbsp;&nbsp; <br />
central-xxx .com<br />
downlfreesexgirlbeach .com&nbsp;&nbsp;&nbsp; <br />
gallery-boy .com<br />
hiosexywomensxxxgirlsx .com&nbsp;&nbsp;&nbsp; <br />
lady-dick .com<br />
bcodecnow .net<br />
mytoppharmacy .com<br />
nakednudeboys .com&nbsp;&nbsp;&nbsp; <br />
nakednudemen .com<br />
nudenakedboys .com<br />
only-bi .com<br />
only-shemale .com<br />
page-reviews .com<br />
paulaslosingit .com<br />
photosgayboys .com<br />
stud-boys .com&nbsp;&nbsp;&nbsp; <br />
the0download .com<br />
wikiei .com&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; <br />
moviez .com<br />
hiosexywomensxxxgirlsx .com<br />
sexygirlsisuniformh0t .com&nbsp;&nbsp;&nbsp; <br />
the0download .com</b><br />
<br />
<b>flwprocedure .com </b>- (77.91.231.201)<b><br />
movupdate .com<br />
flwupdate .com<br />
formatmpeg .com<br />
movieexternal .com<br />
flwtool .com <br />
aviexecution .com<br />
releasedvideo .com<br />
wmvcompressor .com<br />
movieopens .com<br />
mpegapparatus .com<br />
flwassistant .com<br />
flwinstrument .com<br />
piterserv .com<br />
wovview .com</b><br />
<br />
<b>Some info on a sample codec :</b><br />
Scanners Result: 11/36 (30.56%)<br />
Trojan-Downloader.Win32.Zlob.cos<br />
Trojan.Popuper.7315<br />
File size: 10240 bytes <br />
MD5...: 467e4e78974dc8b2ee5d7da024daf31a <br />
SHA1..: 311e0c710bb15761ef3dace54b55489830cf5803<br />
<br />
Phones back to <b>69.50.164.50</b>/this/is/stereo/music.php?param=0;1314;1550; <b>69.50.164.50</b>/this/is/stereo/jazz.php?param=49325611;2:191:5|7:271:0|6:130:0|9:0:5|34:65536:0 and to <b>85.255.119.244</b>/this/is/stereo/music.php?param=0;4135;1548.<br />
<br />
When <b>Emil Kaperski's</b> owned <a href="http://ddanchev.blogspot.com/2008/06/malicious-isps-you-rarely-see-in-any.html">InterCage, Inc.</a> (69.50.164.50) meets <a href="http://ddanchev.blogspot.com/2008/07/lazy-summer-days-at-ukrtelegroup-ltds.html">UkrTeleGroup Ltd.</a> (85.255.119.244) previously known as <b>Andrei Kislizin's</b> owned InHoster, you know you're on the right track.<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=kUs27K"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=kUs27K" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=sRXTAK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=sRXTAK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=sOsoWk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=sOsoWk" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=fnooek"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=fnooek" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=R3T9kK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=R3T9kK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=WaKp6K"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=WaKp6K" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=R12pRk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=R12pRk" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/375241515" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 26 Aug 2008 05:02:26 +0000</pubDate>
      <category domain="http://securityratty.com/tag/fake porn sites">fake porn sites</category>
      <category domain="http://securityratty.com/tag/net">net</category>
      <category domain="http://securityratty.com/tag/info">info</category>
      <category domain="http://securityratty.com/tag/codec">codec</category>
      <category domain="http://securityratty.com/tag/malware">malware</category>
      <category domain="http://securityratty.com/tag/php">php</category>
      <category domain="http://securityratty.com/tag/sample codec">sample codec</category>
      <category domain="http://securityratty.com/tag/locations">locations</category>
      <category domain="http://securityratty.com/tag/fake porn site">fake porn site</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/375241515/fake-porn-sites-serving-malware-part.html">Fake Porn Sites Serving Malware - Part Three</source>
    </item>
    <item>
      <title><![CDATA[A Diverse Portfolio of Fake Security Software - Part Four]]></title>
      <link>http://securityratty.com/article/89e92ac703db317a9f2d0ad0ae004a56</link>
      <guid>http://securityratty.com/article/89e92ac703db317a9f2d0ad0ae004a56</guid>
      <description><![CDATA[Thanks to the affiliate based business model that's driving the increase of fake security software and rogue codecs serving domains, the very same templates, but with different domain names, continue...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://4.bp.blogspot.com/_wICHhTiQmrA/SLKFy9dsYiI/AAAAAAAACHE/DiRDPArpb4A/s1600-h/fake_security_software_august.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://4.bp.blogspot.com/_wICHhTiQmrA/SLKFy9dsYiI/AAAAAAAACHE/jlXrnI7ApPo/s200-R/fake_security_software_august.JPG" /></a>Thanks to the affiliate based business model that's driving the increase of fake security software and rogue codecs serving domains, the very same templates, but with different domain names, continue appearing in blackhat SEO, spam, and malicious doorways redirection campaigns.<br />
<br />
Moreover, with the "time-to-market" of a fake security software decreasing due to the efficiency approach introduced in the form of tips for abuse-free hosting services provided by the "known suspects", and the freely available templates, we're slowly starting to see the upcoming peak of this approach. <br />
<br />
In a true proactive spirit, the domains parked at 216.195.56.88 are all upcoming fake security software, to be introduced anytime soon.<br />
<br />
<b>fast-pc-scanner-online .com</b> - (92.62.101.41; 91.203.92.48; 91.203.92.106; 58.65.238.171)<br />
<b>top-pc-scanner .com<br />
buy-secure-protection .com<br />
security-scan-pc .com<br />
pc-scanner-online .com<br />
viruses-scanonline .com<br />
virus-scanonline .com<br />
antivirus-scanonline .com<br />
topvirusscan .com<br />
virusbestscan .com<br />
best-security-protection .com<br />
infectionscanner .com<br />
virusbestscanner .com<br />
full-protection-now .com</b><br />
<br />
<b>Pwrantivirus .com</b> - 91.208.0.246<br />
<b>vav-x-scanner .com<br />
vav-scanner .com<br />
scanner.vavscan .com<br />
malware-scan .com<br />
Scanner-Pwrantivirus .com<br />
Xpertantivirus .com<br />
Scanner-xpertantivirus .com</b><br />
<br />
<b>spyware-quickscan-2008 .com</b> - (216.195.56.88)<br />
<b>virus-quickscan-2008 .com<br />
spyware-quickscan-2009 .com<br />
virus-quickscan-2009 .com<br />
winmalwarecontrol .com<br />
antispyware-quick-scan .com<br />
virus-quick-scan .com<br />
antivirus-quick-scan .com<br />
winprivacytool .com</b><br />
<br />
<b>topantispyware2008 .com</b> - (216.195.56.86)<br />
<b>cleanermaster .com</b> - (216.195.56.85)<br />
<b>antivirus777 .com</b> - (67.228.120.3)<br />
<b>pcsecuritynotice .com </b>- (67.228.120.3)<br />
<br />
Whereas the average Internet users are falling victims into this type of fraud, what I'm more concerned about is the large traffic the malicious domains receive in general due to all the different traffic acquisition tactics the people behind them apply. This anticipated traffic can then be greatly used as valuable metrics for the many other malicious ways in which it can be monetized.<br />
<br />
Ironically, the participant in the affiliate program whose original objective was to drive traffic to the fake security software's site, may in fact start receiving so much traffic due to the combination of traffic acquisition tactics, that <a href="http://ddanchev.blogspot.com/2008/02/serving-malware-through-advertising.html">introducing client-side exploits courtesy of a third-party affiliate network</a>, may in fact prove more profitable then the revenue sharing partnership with the rogue security software's vendor at the first place.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2008/08/diverse-portfolio-of-fake-security_20.html">A Diverse Portfolio of Fake Security Software - Part Three</a><b> </b><br />
<a href="http://ddanchev.blogspot.com/2008/08/diverse-portfolio-of-fake-security.html">A Diverse Portfolio of Fake Security Software - Part Two</a><br />
<a href="http://ddanchev.blogspot.com/2008/04/localized-fake-security-software.html">Localized Fake Security Software</a><br />
<a href="http://ddanchev.blogspot.com/2007/12/diverse-portfolio-of-fake-security.html">Diverse Portfolio of Fake Security Software</a><br />
<a href="http://ddanchev.blogspot.com/2008/05/got-your-xpshield-up-and-running.html">Got Your XPShield Up and Running?</a><br />
<a href="http://ddanchev.blogspot.com/2008/05/fake-pestpatrol-security-software.html">Fake PestPatrol Security Software</a><br />
<a href="http://ddanchev.blogspot.com/2007/10/rbns-fake-security-software.html">RBN's Fake Security Software</a><br />
<a href="http://ddanchev.blogspot.com/2008/07/lazy-summer-days-at-ukrtelegroup-ltds.html">Lazy Summer Days at UkrTeleGroup Ltd</a><br />
<a href="http://ddanchev.blogspot.com/2008/02/geolocating-malicious-isps.html">Geolocating Malicious ISPs</a><br />
<a href="http://ddanchev.blogspot.com/2008/06/malicious-isps-you-rarely-see-in-any.html">The Malicious ISPs You Rarely See in Any Report</a><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=T4pWXK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=T4pWXK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=fUdxLK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=fUdxLK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=wfXZZk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=wfXZZk" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=DNdBTk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=DNdBTk" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=A69ooK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=A69ooK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=kvp7rK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=kvp7rK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=PdsGMk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=PdsGMk" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/374177616" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 25 Aug 2008 01:58:02 +0000</pubDate>
      <category domain="http://securityratty.com/tag/fake security software">fake security software</category>
      <category domain="http://securityratty.com/tag/traffic">traffic</category>
      <category domain="http://securityratty.com/tag/drive traffic">drive traffic</category>
      <category domain="http://securityratty.com/tag/diverse portfolio">diverse portfolio</category>
      <category domain="http://securityratty.com/tag/traffic acquisition tactics">traffic acquisition tactics</category>
      <category domain="http://securityratty.com/tag/malicious">malicious</category>
      <category domain="http://securityratty.com/tag/malicious isps">malicious isps</category>
      <category domain="http://securityratty.com/tag/due">due</category>
      <category domain="http://securityratty.com/tag/traffic due">traffic due</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/374177616/diverse-portfolio-of-fake-security_25.html">A Diverse Portfolio of Fake Security Software - Part Four</source>
    </item>
    <item>
      <title><![CDATA[Fake Celebrity Video Sites Serving Malware - Part Two]]></title>
      <link>http://securityratty.com/article/c395d54f1c682346aee8b2d88973e345</link>
      <guid>http://securityratty.com/article/c395d54f1c682346aee8b2d88973e345</guid>
      <description><![CDATA[Malicious parties remain busy crunching out domain portfolios of legitimately looking celebrity video sites. The very same templates used on the majority of fake celebrity video sites which I exposed...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://4.bp.blogspot.com/_wICHhTiQmrA/SKx9HqDP8dI/AAAAAAAACE8/IGlb0IMf6r0/s1600-h/fake_celebrity_malware.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://4.bp.blogspot.com/_wICHhTiQmrA/SKx9HqDP8dI/AAAAAAAACE8/O-KOwx_gTlI/s200-R/fake_celebrity_malware.png" /></a>Malicious parties remain busy crunching out domain portfolios of legitimately looking celebrity video sites. The very same templates used on the majority of <a href="http://ddanchev.blogspot.com/2008/06/fake-celebrity-video-sites-serving.html">fake celebrity video sites</a> which I exposed in a previous post, remain in circulation with anecdotal situations where they aren't even bothering to match the site's logo with the domain name -- it would ruin the malicious economies of scale approach. And since centralization to some, an laziness to others, remains in tact, the fake security software and fake codecs served remain once parked at the same IP as the fake celebrity sites which I'll expose in this post.<br />
<br />
<b>starfeed1 .com</b> - (85.255.117.218)<br />
<b>codecservice1 .com<br />
siteresults1 .com<br />
codecservice6 .com<br />
celebs69 .com<br />
topdirectdownload .com<br />
sexlookupworld .com<br />
favoredtube .com<br />
yourfavoritetube .com<br />
wwvyoutube .com<br />
celebsnofake .com<br />
celebsvidsonline .com<br />
celebstape .com<br />
freevidshardcore .com<br />
topsoftupdate .com<br />
porndebug .com<br />
newfunnyvideo .com<br />
bestfunnyvids .com<br />
pornmoviestube .net</b><br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><div style="text-align: right;"><a href="http://1.bp.blogspot.com/_wICHhTiQmrA/SKx_zJYKp8I/AAAAAAAACFE/s1Gjxxgtk60/s1600-h/celebrity_fake_windows_player.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://1.bp.blogspot.com/_wICHhTiQmrA/SKx_zJYKp8I/AAAAAAAACFE/ebj-Ry4Nk8g/s200-R/celebrity_fake_windows_player.JPG" /></a><b>worldstars2008 .com</b> - (79.135.167.54)</div><b>antivirus2008-pro .name<br />
antivirus-2008pro .name<br />
antivirus2008pro .name<br />
antivirus2008pro-download .org<br />
antivirus-2008-pro .org<br />
antivirus2008-pro .org<br />
antivirus-2008pro .org<br />
antivirus2008pro .org<br />
thesoft-portal-08 .com<br />
stars-08 .com<br />
thestars-08 .com<br />
thebigstars-08 .com<br />
funny-08 .com<br />
realonlinevideo-2008 .com<br />
2008-adult-2008 .com<br />
adult18tube2008 .com<br />
adultstreamportal2008 .com<br />
2008-adult-s2008 .com&nbsp;</b><br />
<a href="http://1.bp.blogspot.com/_wICHhTiQmrA/SKyBJNS-u7I/AAAAAAAACFU/0QslE2edBHQ/s1600-h/best_celebs_viz.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://1.bp.blogspot.com/_wICHhTiQmrA/SKyBJNS-u7I/AAAAAAAACFU/KWv9siOWkAg/s200-R/best_celebs_viz.JPG" /></a><b>new-content-s2008 .com<br />
newcontent-s2008 .com<br />
worldstars2008 .com<br />
thestars2008 .com<br />
thebigstars2008 .com<br />
newcontents2008 .com<br />
18x-adult2008 .com<br />
2008adult2008 .com<br />
adult-x2008 .com<br />
hotadulttube08 .com<br />
adultxx-18 .com<br />
newcontent-s2008a .com<br />
antivirus2008pro-download .com<br />
onlinestreamvide .com<br />
onlinestreamvide .com<br />
ns2.onlinestreamvide .com<br />
xxxstreamonline .com4<br />
supersoft21freeware .com<br />
kvm-secure .com<br />
kvmsecure .com<br />
themusic-08portal .com<br />
adultstreamportal .com<br />
streamxxxvideo .com<br />
antivirus-2008-pro .com<br />
antivirus2008-pro .com<br />
antivirus-2008pro .com<br />
thefunny-08 .com<br />
thestars-08 .com<br />
thestars08 .com <br />
celebsnofake .com<br />
adult-s-portal .com<br />
adultsoftcodec .com<br />
adultstreamportal .com<br />
adultxx-18 .com</b><br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://3.bp.blogspot.com/_wICHhTiQmrA/SKyAwLrICsI/AAAAAAAACFM/qnTzrD0L-ow/s1600-h/fake_celebrity_malware1.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://3.bp.blogspot.com/_wICHhTiQmrA/SKyAwLrICsI/AAAAAAAACFM/zejNrANC_lc/s200-R/fake_celebrity_malware1.png" /></a>And while none of these seem to be taking advantage of client-side exploits, a Russian celebrity site that seems to by syndicating the malicious redirectors from a legitimate advertising network, is an exception worth point out due to the Adobe Flash player exploit it's attempting to take advantage of. <b>&nbsp;</b><br />
<br />
<b>Bestcelebs .ru</b> javascript redirectors through several different doorways :<br />
<br />
<a href="http://2.bp.blogspot.com/_wICHhTiQmrA/SKyCIPWrPkI/AAAAAAAACFc/1o_3Oou-C9U/s1600-h/best_celebs1.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://2.bp.blogspot.com/_wICHhTiQmrA/SKyCIPWrPkI/AAAAAAAACFc/sp7U9iiSyqg/s200-R/best_celebs1.JPG" /></a><b>crklab .us</b>/index.php =&gt; <b>firstblu .cn</b>/3.php?19383577 =&gt; <b>xanjan .cn</b>/in.cgi?mytraf =&gt; <b>atomakayan .biz</b>/afterftpcheck/2603/index.php =&gt; <br />
<b>toksikoza .net</b>/fi/index.php?mytraf =&gt; <b>toksikoza .net</b>/fi/1.swf<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div>What you see is so not what you get.<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=wHAK8K"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=wHAK8K" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=irKgjK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=irKgjK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=uNxeIk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=uNxeIk" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=NhDw6k"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=NhDw6k" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=wScNuK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=wScNuK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=m9soyK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=m9soyK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=ISkINk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=ISkINk" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/370688968" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 20 Aug 2008 21:52:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/celebrity video sites">celebrity video sites</category>
      <category domain="http://securityratty.com/tag/net">net</category>
      <category domain="http://securityratty.com/tag/org">org</category>
      <category domain="http://securityratty.com/tag/net fi1">net fi1</category>
      <category domain="http://securityratty.com/tag/russian celebrity site">russian celebrity site</category>
      <category domain="http://securityratty.com/tag/site">site</category>
      <category domain="http://securityratty.com/tag/php">php</category>
      <category domain="http://securityratty.com/tag/net fiindex">net fiindex</category>
      <category domain="http://securityratty.com/tag/previous post">previous post</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/370688968/fake-celebrity-video-sites-serving.html">Fake Celebrity Video Sites Serving Malware - Part Two</source>
    </item>
    <item>
      <title><![CDATA[Experts: Bush Administration is Not Fixing DNS Security Hole]]></title>
      <link>http://securityratty.com/article/d976ce8c349c723b8369373d65054a0d</link>
      <guid>http://securityratty.com/article/d976ce8c349c723b8369373d65054a0d</guid>
      <description><![CDATA[Despite a recent high profile vulnerability that showed the net could be hacked in minutes, the domain name system -- a key internet infrastructure -- continues to suffer from a serious security...]]></description>
      <content:encoded><![CDATA[Despite a recent high profile vulnerability that showed the net could be hacked in minutes, the domain name system -- a key internet infrastructure -- continues to suffer from a serious security weakness, thanks to bureaucratic inertia at the U.S. government agency in charge, security experts say.]]></content:encoded>
      <pubDate>Thu, 14 Aug 2008 16:10:08 +0000</pubDate>
      <category domain="http://securityratty.com/tag/key internet infrastructure">key internet infrastructure</category>
      <category domain="http://securityratty.com/tag/security experts">security experts</category>
      <category domain="http://securityratty.com/tag/bureaucratic inertia">bureaucratic inertia</category>
      <category domain="http://securityratty.com/tag/government agency">government agency</category>
      <category domain="http://securityratty.com/tag/profile vulnerability">profile vulnerability</category>
      <category domain="http://securityratty.com/tag/security weakness">security weakness</category>
      <category domain="http://securityratty.com/tag/system">system</category>
      <category domain="http://securityratty.com/tag/minutes">minutes</category>
      <category domain="http://securityratty.com/tag/net">net</category>
      <source url="http://digg.com/security/Experts_Bush_Administration_is_Not_Fixing_DNS_Security_Hole">Experts: Bush Administration is Not Fixing DNS Security Hole</source>
    </item>
    <item>
      <title><![CDATA[EPTS: An Event Processing Marketing Society (EPMS)]]></title>
      <link>http://securityratty.com/article/4e5f9a576dd94f69f8da4a0f60aa3870</link>
      <guid>http://securityratty.com/article/4e5f9a576dd94f69f8da4a0f60aa3870</guid>
      <description><![CDATA[A number of months ago we posted Some Comments on the EPTS Member Agreement where we concluded, in summary
I have quite a few other concerns the with EPTS Member Agreement. Basically, the agreement...]]></description>
      <content:encoded><![CDATA[<p>A number of months ago we posted <a title="Some Comments on the EPTS Member Agreement" rel="bookmark" href="http://www.thecepblog.com/2008/04/06/comment-on-the-epts-member-agreement/"><span style="color: #105cb6;">Some Comments on the EPTS Member Agreement</span></a> where we concluded, in summary:</p>
<blockquote><p><em>&#8220;I have quite a few other concerns the with EPTS Member Agreement.   Basically, the agreement needs to be written with an eye toward a more flexible, open and inclusive process that puts the future of the EPTS square into the hands of the event processing community, not a small group of well intended folks who represent a small part of the overall event processing community and worldview.&#8221;</em></p></blockquote>
<p>Opher&#8217;s reply was to just dismiss these comments, a bit surprising since I served the CEP/EP community on the EPTS steering committee; worked quite hard as a matter of fact, for a number of years.   Opher&#8217;s appreciation for the years of work is to just off-handly dismiss my comments.</p>
<p>Then in <a href="http://epthinking.blogspot.com/2008/08/on-faithfull-representation-and-other.html"><span style="color: #2583ad;">On faithfull representation and other comments</span></a> and <a href="http://epthinking.blogspot.com/2008/08/on-top-down-and-bottom-up.html"><span style="color: #2583ad;">On Top Down and Bottom Up</span></a> Opher does the same thing, he simply dismisses my comments, defensively, adding humor, sarcasm and fallacy.</p>
<p>I am sorry Opher is so defensive of his narrow society; however I will not yield, because I do not need to resort to sarcasm, fallacy and <em>ad hominums</em>; the facts obviously support my view.  For proof that Opher has a narrow view of event processing, go no further than look at the companies he hand-picked for his EPTS Steering Committee; most startups (or with startup products) in the event processing space, working on common messages to distinguish themselves in a market with much more mature players excluded - classic &#8220;not invented here,&#8221; isn&#8217;t it?</p>
<p>Opher&#8217;s claims the EPTS view on event processing is quite general, but the  majority of vendors on the EPTS Steering Committee members are selling similar platforms, a very narrow segment of the CEP/EP space.    Opher claims that he agrees that other domains (like sensor fusion) are significant to CEP/EP, but he simply dismisses my advice to create a true, general EPTS, inclusive of the prior-art and science of CEP/EP (before the marketing folks took over).  He insists on having the EPTS &#8220;reinvent the wheel&#8221; and develop their own vocabulary, as if event processing did not exist prior to one book on CEP.</p>
<p>Opher&#8217;s fun-to-read blog counterpoints to my concerns are evolving to a mixture of <a href="http://http://en.wikipedia.org/wiki/Ad_hominum" target="_blank"><em>ad hominums</em></a> and sarcasm, sometime wrapped in a defensive tone.   I think we can do better and we must be more inclusive of the other prior-art.  I say we, because I am also a founding member of the EPTS, althought I suspect Opher will banish my name from the membership for trying to diminish the &#8220;not invented here&#8221; attitude that seems to dominate the EPTS since inception.</p>
<p>The truth of the matter is that the EPTS has a relatively narrow view of event processing, evident by the makeup of the steering committee and the focus of their discussions.    It is not a technical society about event processing, <em>per se</em>; it is a marketing society with a narrowly focused membership that discounts most of the prior-art in the event processing space, it is really, an<em> Event Processing Marketing Society (EPMS) </em>for a narrow group of niche players.</p>
<p>The event processing domain is much, much larger.   The art-and-science of event processing is deep and mature, much more mature (and inclusive) than what we see in the EPTS. </p>
<p>I think Opher (and the EPTS committee) should take these comments seriously and not discount them with sarcasm and subtle <em>ad hominum </em>replies.</p>
<p> </p>
]]></content:encoded>
      <pubDate>Wed, 13 Aug 2008 04:02:57 +0000</pubDate>
      <category domain="http://securityratty.com/tag/epts">epts</category>
      <category domain="http://securityratty.com/tag/event">event</category>
      <category domain="http://securityratty.com/tag/vendors onthe epts">vendors onthe epts</category>
      <category domain="http://securityratty.com/tag/epts committee">epts committee</category>
      <category domain="http://securityratty.com/tag/technical societyabout event">technical societyabout event</category>
      <category domain="http://securityratty.com/tag/forhis epts">forhis epts</category>
      <category domain="http://securityratty.com/tag/epts reinvent">epts reinvent</category>
      <category domain="http://securityratty.com/tag/narrow">narrow</category>
      <category domain="http://securityratty.com/tag/community">community</category>
      <source url="http://www.thecepblog.com/2008/08/13/epts-an-event-processing-marketing-society-epms/">EPTS: An Event Processing Marketing Society (EPMS)</source>
    </item>
    <item>
      <title><![CDATA[ICANN/IANA Offer DNS Domain Test]]></title>
      <link>http://securityratty.com/article/855965d8dbc50ef9ec1057e2671aedde</link>
      <guid>http://securityratty.com/article/855965d8dbc50ef9ec1057e2671aedde</guid>
      <description><![CDATA[ICANN has announced a test page, on the IANA site, to test if a domain is vulnerable to the Kaminsky DNS source port vulnerability. Click here to go to the test page. IANA also is providing a FAQ on...]]></description>
      <content:encoded><![CDATA[<a href="http://www.icann.org/en/announcements/announcement-06aug08-en.htm">ICANN has announced</a> a test page, on the IANA site, to test if a domain is vulnerable to the Kaminsky DNS source port vulnerability. <a href="http://recursive.iana.org/">Click here to go to the test page.</a>

IANA also is providing <a href="http://www.iana.org/reports/2008/cross-pollination-faq.html">a FAQ on the bug</a> that has a lot of useful information without digressing into attack details, as so many other writeups do. This FAQ is focused on explanation and practical advice for IT. There is good advice in it, such as pointing out that authoritative name servers should never be configured also to provide recursive name service. This bug is a perfect example of why.<img src="http://feeds.ziffdavisenterprise.com/~r/RSS/cheap_hack/~4/358495190" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 07 Aug 2008 07:21:10 +0000</pubDate>
      <category domain="http://securityratty.com/tag/test">test</category>
      <category domain="http://securityratty.com/tag/iana">iana</category>
      <category domain="http://securityratty.com/tag/test page">test page</category>
      <category domain="http://securityratty.com/tag/advice">advice</category>
      <category domain="http://securityratty.com/tag/iana site">iana site</category>
      <category domain="http://securityratty.com/tag/practical advice">practical advice</category>
      <category domain="http://securityratty.com/tag/provide recursive">provide recursive</category>
      <category domain="http://securityratty.com/tag/bug">bug</category>
      <category domain="http://securityratty.com/tag/domain">domain</category>
      <source url="http://feeds.ziffdavisenterprise.com/~r/RSS/cheap_hack/~3/358495190/icanniana_offer_dns_domain_test.html">ICANN/IANA Offer DNS Domain Test</source>
    </item>
  </channel>
</rss>
