<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: earn]]></title>
    <link>http://securityratty.com/tag/earn</link>
    <description></description>
    <pubDate>Tue, 17 Jun 2008 06:19:08 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[MSP Snapshot Monitoring with EM7]]></title>
      <link>http://securityratty.com/article/5288692e82e0f23665e5086e43db9ed4</link>
      <guid>http://securityratty.com/article/5288692e82e0f23665e5086e43db9ed4</guid>
      <description><![CDATA[Between the fifth anniversary for ScienceLogic and the Inc 500 milestone, weve become very nostalgic about the beginnings of the company and EM7. For instance, did you know that EM7 was originally...]]></description>
      <content:encoded><![CDATA[<p>Between the <a href="http://blog.sciencelogic.com/sciencelogics-5-year-anniversary/08/2008" target="_blank">fifth anniversary for ScienceLogic</a> and the Inc 500 milestone, we’ve become very nostalgic about the beginnings of the company and EM7. For instance, did you know that EM7 was originally designed with managed service providers in mind? Not so surprising when 5 of the first 6 employees (including all 3 founders) came from hosting and MSP backgrounds and had first-hand experience with the daily trials and tribulations of MSP operations – and the tools that didn’t quite work for them.
<p><a href="http://blog.sciencelogic.com/wp-content/uploads/2008/10/john-at-interop-vegas.jpg"><img style="border-right: 0px; border-top: 0px; margin: 0px 10px 10px 0px; border-left: 0px; border-bottom: 0px" height="184" alt="John at Interop Vegas" src="http://blog.sciencelogic.com/wp-content/uploads/2008/10/john-at-interop-vegas-thumb.jpg" width="244" align="left" border="0"></a>Here we talk to John Proctor, who started out as one of our first customers (and the first MSP customer). And he believed in it so much, he eventually became part of the ScienceLogic team. (Remember &#8220;I&#8217;m not only the President, I&#8217;m also a client&#8221; from <a href="http://www.hairclub.com/inthenews_article1.php" target="_blank">the Hair Club for Men</a>?)
<p>John shares his perspectives about the service provider world and why he took a chance on a little-known product called EM7.
<p><strong>ScienceLogic:</strong> What is your background? How many years have you worked as a service provider and for what types of companies?
<p><strong>John Proctor:</strong> I have been working with Service providers for over twelve years. I worked at a major regional service provider for six years and before that I designed and built national and international networks for ISP’s and Fortune 500 companies as a consultant for PriceWaterhouseCoopers and WorldComm.
<p><strong>ScienceLogic:</strong> You were one of the first customers of EM7 – why did you choose it and how did you get over the hurdles associated with using a start-up company’s product?
<p><strong>John Proctor:</strong> We were actually customer number five. Back in 2004 when we evaluated and purchased EM7 we could see that EM7 provided about 80% of what we were looking for in one integrated solution right out of the box. One of the things that sold us on EM7 was that the ScienceLogic founders had all previously worked for a service provider, so we knew they understood our business and our challenges. But in the end, it comes down to features. Once we compared EM7 functionality to the alternatives, it was clearly a “no brainer.”
<p><strong>ScienceLogic:</strong> What other alternatives were being considered?
<p><strong>John Proctor:</strong> Well, we had started with a few point solutions, but as our business and product offerings matured, this resulted in a growing number of point solutions. What started with 3 or 4 ended up as 14 separate tools. They all had strengths but what they didn’t have was integration and because of this they could not scale. And, if the tools could not scale, our business could not grow.
<p>So, naturally we started looking at framework solutions, but they are expensive to buy, expensive to implement, and expensive to maintain. At one point, we even considered some open source projects. There were several that showed promise, but we would still be stuck with tools that were not integrated. So then we considered hiring developers to cobble something together that would work for our business. The only problem with this alternative was that we felt it would take 6 to 8 months before we could have something viable to work with.
<p><strong>ScienceLogic:</strong> What products were you using before EM7? What were your goals?
<p><strong>John Proctor:</strong> Before we purchased EM7 we used 14 different point solutions to deliver our products and services to the marketplace. Tools like NetCool, Openview, Argent, Heat, What’s Up Gold as well as several other point solutions, vendor specific applications and manually updated spreadsheets. And, as I mentioned before, this does not scale. This also adds a great deal of complexity when you begin to consider business continuity and disaster recovery. All these tools were vital to the delivery of our products and services. Any service provider will tell you it is all about uptime. So if the product is uptime, the tools used to deliver it have to be available 24&#215;7x365.
<p>Our goals were simple: scale and redundancy. As it turns out, the solution was simple as well. EM7 provided a tool that could replace the functionality of almost half of the existing point solutions and the applications that could not be replaced were integrated with EM7 to provide our staff with a “single pane of glass” to see the status and performance of each area of the business from one application. We had visibility into everything from facility systems to applications using EM7.
<p>ScienceLogic also delivers an extensible configuration that addressed uptime and redundancy. We deployed collectors throughout our network that reported back to a central pair of redundant database servers and with this configuration we were able to perform backups and add capacity without taking the system down.
<p><strong>ScienceLogic:</strong> Why are service providers different from enterprises? How are their needs different?
<p><strong>John Proctor:</strong> First and foremost, service providers face the same challenges that only the largest enterprises ever face and they also have many unique challenges that only service providers experience.
<p>One challenge we faced was that we had multiple datacenters in different states. They were all interconnected with plenty of bandwidth between each site, but the tools were not designed to be used across the WAN. Our staff in our remote data center did not have the same access as our staff in the corporate office. Since EM7 is web-based, it immediately eliminated this problem.
<p>Another challenge is that service providers must manage systems across multiple domains. Back in the early version of a specific tool we were using before EM7, the only way you could implement it across multiple domains was to put the same username and password on every computer that you monitored. Beyond the security concerns, maintenance was a nightmare. Anytime we had to change the password, we would get locked out of dozens upon dozens of systems. When the password was changed on the monitoring server, it would attempt to login to the remote machines and fail. Repeated attempts would result in the account getting locked. I think that vendor eventually addressed this issue, but service providers seldom find tools that were designed for their unique situations.
<p><strong>ScienceLogic:</strong> How is EM7 geared to service providers?
<p><strong>John Proctor:</strong> Enterprise IT is a trusted part of the business; they are one of the team. Service providers are outsiders that must earn trust by showing the customer exactly what they are doing.
<p>EM7 provides a multi-tenant environment that allows service providers to manage systems across many different customers while at the same time providing the customer access to see the same information but only what’s relevant to them.
<p>EM7 was built by service providers and even includes a few features just for them. Two of my favorites are bandwidth billing and the emergency notification system. Take bandwidth billing, for instance. EM7 provides a way to collect bandwidth utilization, store subscription information, and calculate a bill from any one of about 10 different methodologies. And at the end of the billing period, EM7 sends the completed report out to whomever you chose via email.
<p>Another unique service provider feature is the emergency notification system. EM7 allows the provider to track what customers used their unique infrastructure components. If they have to perform maintenance on the infrastructure component or have a problem they can send an email to all of the impacted customers in a matter of minutes.
<p><strong>ScienceLogic:</strong> What trends do you see for service providers? What about big trends such as virtualization and cloud computing – how will they impact service providers?
<p><strong>John Proctor:</strong> Virtualization is really hot for service providers right now and for the same reasons as in the enterprise. Service providers run data centers and data centers must be powered and cooled. So, anytime they can use a virtual server instead of adding physical equipment it is a good thing. But then you add the complexity that multiple customers reside on the same host and you must track things like bandwidth utilizations by guest OS, and it all gets a little harder. Lucky for us this is not a problem for EM7.
<p>I still think it’s early days for cloud computing. Depending on who you talk to, much of what service providers (especially the big ones) have already been doing with SAAS offerings and hosted applications could be described as cloud computing already. In which case, service providers are ahead of the game. But whatever the “final” definition, cloud computing actually shares many similarities with virtualization – in that service providers (or enterprises) will need to be able to manage far more “devices” in real-time with “zero downtime” expectations by customers. What this really means is that you’re going to see much more automation in provisioning and IT monitoring tools to handle the scale and speed with which things can change in the data center given vm migration and the talked-about switching between “clouds” that can be used for high availability. </p>
]]></content:encoded>
      <pubDate>Wed, 08 Oct 2008 12:51:50 +0000</pubDate>
      <category domain="http://securityratty.com/tag/em7">em7</category>
      <category domain="http://securityratty.com/tag/service providers">service providers</category>
      <category domain="http://securityratty.com/tag/service providers experience">service providers experience</category>
      <category domain="http://securityratty.com/tag/service providers seldom">service providers seldom</category>
      <category domain="http://securityratty.com/tag/impact service providers">impact service providers</category>
      <category domain="http://securityratty.com/tag/em7 functionality">em7 functionality</category>
      <category domain="http://securityratty.com/tag/em7 sends">em7 sends</category>
      <category domain="http://securityratty.com/tag/service provider">service provider</category>
      <category domain="http://securityratty.com/tag/service provider world">service provider world</category>
      <source url="http://blog.sciencelogic.com/msp-snapshot-monitoring-with-em7/10/2008">MSP Snapshot Monitoring with EM7</source>
    </item>
    <item>
      <title><![CDATA[Inc 500/5000 Conference Summary]]></title>
      <link>http://securityratty.com/article/9368d02fff1906cea272fe55093a6965</link>
      <guid>http://securityratty.com/article/9368d02fff1906cea272fe55093a6965</guid>
      <description><![CDATA[It didnt really sink in until after the final black-tie awards ceremony finished last Saturday night that I had a chance to comprehend how starting a company that achieves this list is a once in a...]]></description>
      <content:encoded><![CDATA[<p><img style="border-right: 0px; border-top: 0px; margin: 5px; border-left: 0px; border-bottom: 0px" src="http://blog.sciencelogic.com/wp-content/uploads/2008/09/slinc5002.jpg" border="0" alt="slinc5002" width="240" height="181" align="left" /> It didn’t really sink in until after the final black-tie awards ceremony finished last Saturday night that I had a chance to comprehend how starting a company that achieves <a href="http://www.inc.com/inc5000/">this list</a> is a once in a lifetime experience.</p>
<p>When I walked up on stage and accepted the <a href="http://www.inc.com/inc5000/2008/company-profile.html?id=200803500" target="_blank">Inc 500 award</a>, it hit me square in the face that this is a rare accomplishment, and even more difficult for a product company that started without the benefit of VC funding.</p>
<p><img style="border-right: 0px; border-top: 0px; border-left: 0px; border-bottom: 0px" src="http://blog.sciencelogic.com/wp-content/uploads/2008/09/slinc5003.jpg" border="0" alt="slinc5003" width="240" height="181" /><br />
<em>Dave with wife, Anne, at the awards ceremony</em><br />
Over <a href="http://blog.inc.com/inc5000/" target="_blank">the 2 day period</a>, I heard from some <a href="http://secure.lenos.com/lenos/inc/Inc500WashingtonDC/speakers.asp" target="_blank">great speakers with entrepreneurial passion</a>, many who never had accomplished making the list. It is so <a href="http://www.prospectmx.com/inc-500-conference-and-awards" target="_blank">highly competitive and just plain hard</a> to do.</p>
<p>I loved <a href="http://blog.sciencelogic.com/good-to-great-built-to-last-whats-next-for-creating-great-companies/09/2008" target="_blank">hearing</a> some of the <a href="http://www.business-opportunities.biz/2008/09/24/inside-small-biz-guru-michael-gerbers-dreaming-room/" target="_blank">speeches during the conference</a> and getting to know other <a href="http://www.johnwinsor.com/my_weblog/2008/09/inc-500.html" target="_blank">entrepreneurs that attended</a> the conference talk about how they created their niche and ultimately built a successful company from a good idea.</p>
<p>Because I enjoyed hearing some of what I like to call &#8220;golden nuggets of wisdom&#8221; so much, I thought in my conference wrap-up I would pass on a few to our blog readers:</p>
<p><strong></strong></p>
<p><strong><a href="http://www.tompeters.com/" target="_blank">Tom Peters – Author In Search of Excellence and The New World of WOW</a></strong></p>
<p>“Only 7% of our great nation works for Fortune 500 companies. Small businesses and the <a href="http://www.jonlowder.com/2008/09/why-i-havent-be.html" target="_blank">entrepreneurs are the jet fuel</a> that makes our country fly.”</p>
<p>“Brand is shorthand for a collection of experiences, memories of what it will be like the next time a customer deals with you. With the <a href="http://www.debbieweil.com/blog/tom-peters/" target="_blank">advent of blogs and consumer activism</a>, Brand is impossible to fake; it is like the temperature in the room… it is there… it exists.”</p>
<p><strong><a href="http://www.carrots.com/" target="_blank">Chester Elton – SVP Carrot Culture Group</a></strong></p>
<p>“At the casino – they train the heck out of the Valet! Why do they spend 3 months on Valet training? Because he is the first and the last person to greet and interact with a visitor during their trip! Who is your company Valet?”</p>
<p><strong><a href="http://www.ideo.com/search/cluster/paul-bennett/" target="_blank">Paul Bennett – Chief Creative officer IDEO</a> – speaking on &#8212; Creating a culture of optimism:</strong></p>
<p>“You need to ditch B-B and B-C Need to become P-P Person to Person.”</p>
<p>“You don’t buy loyalty… you earn it… this is an interesting challenge, but small allows us to behave like human beings… Going off script and doing something human is a great place to start.”</p>
<p>“Stop obsessing about ROI and start obsessing about ROC! Return on Customer/Consumer is much more powerful than ROI!!!!”</p>
<p>“Happy people, unabashedly doing, happy things, makes for happy companies, which create happy businesses which enable happy cultures… IN WHICH THRIVE”</p>
<p><strong><a href="http://carlson.umn.edu/Page5365.aspx" target="_blank">Marilyn Carlson Nelson – Chairman and CEO Carlson Companies</a> – A family owned $40 Billion empire including TGI Fridays, Radisson Hotels…</strong></p>
<p>“My leadership was tested terribly - after 9/11 the travel industry was particularly harmed. It was an extraordinary time for Carlson. “</p>
<p>“Put tactics around these strategic initiatives”</p>
<ul>
<li>Whomever you serve, serve with caring</li>
<li>Whenever you dream – dream with your all</li>
<li>Wherever you go, go as a leader</li>
<li>And never, never give up</li>
<li>Whatever you do – do it with integrity</li>
</ul>
<p>“That builds trust, trust builds relationships and relationships build results.”</p>
<p>=============================================</p>
<p>Actually, I took about 40 pages of notes throughout the two days… So I can’t say that this will be my last summary post on the Inc 500/5000 conference, but I can say that the conference did leave a strong impression about how I can help shape the future of ScienceLogic in an even more positive way.</p>
]]></content:encoded>
      <pubDate>Fri, 26 Sep 2008 14:00:44 +0000</pubDate>
      <category domain="http://securityratty.com/tag/conference">conference</category>
      <category domain="http://securityratty.com/tag/happy companies">happy companies</category>
      <category domain="http://securityratty.com/tag/happy">happy</category>
      <category domain="http://securityratty.com/tag/successful company">successful company</category>
      <category domain="http://securityratty.com/tag/happy businesses">happy businesses</category>
      <category domain="http://securityratty.com/tag/company">company</category>
      <category domain="http://securityratty.com/tag/product company">product company</category>
      <category domain="http://securityratty.com/tag/companies">companies</category>
      <category domain="http://securityratty.com/tag/ceo carlson companies">ceo carlson companies</category>
      <source url="http://blog.sciencelogic.com/inc-5005000-conference-summary/09/2008">Inc 500/5000 Conference Summary</source>
    </item>
    <item>
      <title><![CDATA[EstDomains and Intercage VS Cybercrime]]></title>
      <link>http://securityratty.com/article/54303a8239cd0becf5843fb3552a50a8</link>
      <guid>http://securityratty.com/article/54303a8239cd0becf5843fb3552a50a8</guid>
      <description><![CDATA[Surreal, especially when you get to read that EstDomains has &quot; ruthlessly suspended over five thousand domains only for last week &quot;, and also, that it &quot; has a reliable ally in its battle against...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div style="text-align: left;"></div><div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://3.bp.blogspot.com/_wICHhTiQmrA/SM7tc-r3kHI/AAAAAAAACKc/aUL1ohUu-Zc/s1600-h/estdomain_alert.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://3.bp.blogspot.com/_wICHhTiQmrA/SM7tc-r3kHI/AAAAAAAACKc/yiFaA33Sfdw/s200-R/estdomain_alert.png" /></a>Surreal, especially when you get to read that EstDomains has "<i>ruthlessly suspended over five thousand domains only for last week</i>", and also, that it "<i>has a reliable ally in its battle against malware in a face of Intercage, Inc</i>".<br />
<br />
Here's <a href="http://www.domainnews.com/en/general/estdomains-denies-links-to-malware-distribution.html">the press release</a> :<br />
<br />
"<i>The EstDomains, Inc management does not deny the fact that no one is secured from having a customer who uses provided services for delinquent purposes. But it must be noted that the carefully planned infrastructure of EstDomains, Inc makes the special provision for the cases of malware distribution that may originate from the domain name registered under the company's name. Such domain names are suspended immediately along with domain holder's account if there is an evidence of malware presence on the web site. <b>According to the most recent statistics over five thousand domain names were detected and ruthlessly suspended by EstDomains, Inc specialists only last week.</b><br />
<br />
<b>The company also has a reliable ally in its battle against malware in a face of Intercage, Inc which provides company with the hosting services of the highest quality.</b> But the outstanding performance of hosting services is not the sole reason why EstDomains, Inc appreciates this partnership so greatly. Intercage, Inc generously provides EstDomains, Inc specialists with reports regarding discovered malware vehicles. As the main database for additional domain name management services is located in Intercage Data Center, EstDomains, Inc has the perfect opportunity to get notifications of the slightest mark of malware presence in the shortest time and take measures in advance.</i> "<br />
<br />
The press release reminds me of <a href="http://ddanchev.blogspot.com/2008/04/hacked-by-rbn.html">RBN's defacement of my blog</a> posted on the 1st of April, and despite that <a href="http://www.malwarebytes.org/forums/index.php?showtopic=6159">EstDomains started "performing for the community"</a> as of recently, thanks to the collective intelligence and persistence of everyone turning their research into actionable intelligence against them, this performance aiming to minimize the effect of the negative PR is more or less futile considering <a href="http://www.spyware-techie.com/malicious-website-list/">all the cybercrime activities that they've been tolerating or ignoring</a> for the past couple of years. For future generations to see, <a href="http://www.malwarebytes.org/forums/index.php?showtopic=6159">this is how EstDomains "performs for the community"</a> :<br />
<br />
"<i>We've suspended all the domains listed in this topic. But please don't make posting these domains on this forum a habit. We have a 24/7 online tech support which can be contacted at <a href="https://support.estdomains.com/" target="_blank">https://support.estdomains.com</a><br />
<br />
Best regards,<br />
EstDomains Team&nbsp;</i><br />
<br />
<i>EstMate says : Ihatemondayand.com and antispycheck.com - both suspended. If any of the suspended websites are still active to you it maybe be because of your computer's or ISP's DNS-cache, others won't be able to access these websites</i><br />
<br />
<i>googlescanners-360.com isn't registered with us. As for other domains, the ones, which were registered through us, have been suspended. Regarding our preventive measures, the fact that you don't see them doesn't mean there isn't any. Yes, we don't write about them but in most cases we suspend whole accounts with problematic domains and look for connections to other accounts etc. During the last week we've suspended over 15000 different domains.</i>"<br />
<br />
What's more disturbing regarding this particular domain registrar is that it's a U.S based operation, namely, using the lack of international cybercrime cooperation as an excuse for not taking actions earlier doesn't fit into the picture. Moreover, this is just the tip of the iceberg, and taking into consideration a personal mentality that the cybercriminals you know are better than the cybercriminals you don't know, the RBN or any of its "leftovers" aren't fully taking advantage of the tactics they could be using in order to make it harder to shut them down, but how come? Simply, they don't have to put extra efforts and would once again remain online for years to come, which is perhaps more disturbing at the first place.<br />
<br />
What in the world is the Russian Business Network, is it still alive and kicking, are the same people that used to maintain my favorite netblock ever, still the ones running it, and what tactics are they taking advantage of in order to make it harder for the community to establish direct links with a particular netblock and the RBN itself?<br />
<br />
With RBN's "leftovers" -- <b>InterCage, Inc., Softlayer Technologies, Layered Technologies, Inc., Ukrtelegroup Ltd, Turkey Abdallah Internet Hizmetleri, and Hostfresh --</b> making headlines just like the way it should be, what I've been researching for the past couple of months is how they've migrated from the centralized hosting provider to what appears to be a fully operational franchise. The business model is very simple, the RBN through its extensive underground networking skills supplies to customers to franchisers operating small anti-abuse netblocks across the globe, where they offer dedicated hosting and share revenue with the RBN. Anyone trusted enough and capable of supplying such netblocks starts running the RBN anti-abuse franchise. It's also worth pointing out that these franchises are in fact starting to cut the middle man, and disintermediate the RBN by actively advertising their services in order for them to create a self-sustainable business model without having to rely on the RBN connecting them with customers.<br />
<br />
What used to be a centralized cybercrime powerhouse operating several highly visible anti-abuse netblocks, is today's decentralized infrastructure, with the profit margins for the anti-abuse services that it's logically capable to break-even and earn profits even with a few high profile dedicated hosting customers. Anyone can be the Russian Business Network, gain experience into the market segment, then disintermediate them by starting to advertise their own services. From a powerhouse to a franchise model, what the RBN had to offer can be easily duplicated by a countless number of local RBN's, and this is only starting to take place.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2008/07/lazy-summer-days-at-ukrtelegroup-ltds.html">Lazy Summer Days at UkrTeleGroup Ltd. </a><br />
<a href="http://ddanchev.blogspot.com/2008/06/malicious-isps-you-rarely-see-in-any.html">The Malicious ISPs you Rarely See in Any Report</a><br />
<a href="http://ddanchev.blogspot.com/2008/02/geolocating-malicious-isps.html">Geolocationg Malicious ISPs</a><br />
<a href="http://ddanchev.blogspot.com/2008/03/new-media-malware-gang-part-four.html">The New Media Malware Gang - Part Four</a><br />
<a href="http://ddanchev.blogspot.com/2008/02/new-media-malware-gang-part-three.html">The New Media Malware Gang - Part Three</a><br />
<a href="http://ddanchev.blogspot.com/2007/12/new-media-malware-gang-part-two.html">The New Media Malware Gang - Part Two</a><br />
<a href="http://ddanchev.blogspot.com/2007/11/new-media-malware-gang.html">The New Media Malware Gang</a><br />
<a href="http://ddanchev.blogspot.com/2008/01/rbns-fake-account-suspended-notices.html">RBN's Fake Account Suspended Notices </a><br />
<a href="http://ddanchev.blogspot.com/2008/04/hacked-by-rbn.html">HACKED BY THE RBN!</a><br />
<a href="http://ddanchev.blogspot.com/2008/03/rogue-rbn-software-pushed-through.html">Rogue RBN Software Pushed Through Blackhat SEO</a><br />
<a href="http://ddanchev.blogspot.com/2008/02/rbns-phishing-activities.html">RBN's Phishing Activities</a><br />
<a href="http://ddanchev.blogspot.com/2008/02/rbns-malware-puppets-need-their-master.html">RBN's Puppets Need Their Master</a><br />
<a href="http://ddanchev.blogspot.com/2008/01/rbns-fake-account-suspended-notices.html">RBN's Fake Account Suspended Notices</a><br />
<a href="http://ddanchev.blogspot.com/2007/12/diverse-portfolio-of-fake-security.html">A Diverse Portfolio of Fake Security Software</a><br />
<a href="http://ddanchev.blogspot.com/2007/11/go-to-sleep-go-to-sleep-my-little-rbn.html">Go to Sleep, Go to Sleep my Little RBN</a><br />
<a href="http://ddanchev.blogspot.com/2007/11/exposing-russian-business-network.html">Exposing the Russian Business Network</a><br />
<a href="http://ddanchev.blogspot.com/2007/11/detecting-and-blocking-russian-business.html">Detecting the Blocking the Russian Business Network</a><br />
<a href="http://ddanchev.blogspot.com/2007/10/over-100-malwares-hosted-on-single-rbn.html">Over 100 Malwares Hosted on a Single RBN IP</a><br />
<a href="http://ddanchev.blogspot.com/2007/10/rbns-fake-security-software.html">RBN's Fake Security Software</a><br />
<a href="http://ddanchev.blogspot.com/2007/10/russian-business-network.html">The Russian Business Network</a><b> <br />
</b><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=CWZlL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=CWZlL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=wdsJL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=wdsJL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=6wf1l"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=6wf1l" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=JLXVl"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=JLXVl" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=fkyiL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=fkyiL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=l6gML"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=l6gML" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=kPS6l"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=kPS6l" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/394232850" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 16 Sep 2008 05:09:44 +0000</pubDate>
      <category domain="http://securityratty.com/tag/single rbn">single rbn</category>
      <category domain="http://securityratty.com/tag/rbn">rbn</category>
      <category domain="http://securityratty.com/tag/rbn anti-abuse franchise">rbn anti-abuse franchise</category>
      <category domain="http://securityratty.com/tag/estdomains">estdomains</category>
      <category domain="http://securityratty.com/tag/malware">malware</category>
      <category domain="http://securityratty.com/tag/malware distribution">malware distribution</category>
      <category domain="http://securityratty.com/tag/thousand domain names">thousand domain names</category>
      <category domain="http://securityratty.com/tag/domain names">domain names</category>
      <category domain="http://securityratty.com/tag/rogue rbn software">rogue rbn software</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/394232850/estdomains-and-intercage-vs-cybercrime.html">EstDomains and Intercage VS Cybercrime</source>
    </item>
    <item>
      <title><![CDATA[Summarizing August's Threatscape]]></title>
      <link>http://securityratty.com/article/01c05fcd5f209b7515be2cee57a93c9b</link>
      <guid>http://securityratty.com/article/01c05fcd5f209b7515be2cee57a93c9b</guid>
      <description><![CDATA[Following the previous summaries of June's and July's threatscape based on all the research published during the month, it's time to summarize August's threatscape

August's threatscape was dominated...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://1.bp.blogspot.com/_wICHhTiQmrA/SL_ZoXre4vI/AAAAAAAACJ0/LKtKpSt0igQ/s1600-h/ddanchev_august.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://1.bp.blogspot.com/_wICHhTiQmrA/SL_ZoXre4vI/AAAAAAAACJ0/Phtgyl6rLXQ/s200-R/ddanchev_august.png" /></a>Following the previous summaries of <a href="http://ddanchev.blogspot.com/2008/07/summarizing-junes-threatscape.html">June's</a> and <a href="http://ddanchev.blogspot.com/2008/08/summarizing-julys-threatscape.html">July's threatscape</a> based on all the research published during the month, it's time to summarize August's threatscape.<br />
<br />
August's threatscape was dominated by a huge increase of rogue security software domains made possible due to the easily obtainable templates for the sites, several malware campaigns targeting popular social networking sites, Russian's organized cyberattack against Georgia with evidence on who's behind it pointing to "everyone" and a few botnets dedicated to the attack making the whole process easy to outsource and turn responsibility into an "open topic", several new web based botnet management kits and tools found in the wild, evidence that the 76service may in fact be going mainstream since the concept of cybercrime as a service is already emerging, and, of course, a peek at India's CAPTCHA solving economy, where the best comment I've received so far is that every site should embrace reCAPTCHA, so that while solving CAPTCHAs and participating in the abuse of these services in question, they would be also digitizing books. As usual, August was a pretty dynamic month for the middle of summer, with everyone excelling in their own malicious field.<br />
<br />
<b>01.</b> <a href="http://ddanchev.blogspot.com/2008/08/mcafees-site-advisor-blocking-nruns-ag.html">McAfee's Site Advisor Blocking n.runs AG - "for starters"</a><br />
False positives are rather common, especially when you're aiming to protect the end user from himself and not let him gain access to "hacking tools", but you're flagging security tools as badware and missing over half the SQL injected domains currently in the wild due to the fact that SiteAdvisor's community still haven't reviewed them - that's not good<br />
<br />
<b>02.</b> <a href="http://ddanchev.blogspot.com/2008/08/twitter-malware-campaign-wants-to-bank.html">The Twitter Malware Campaign Wants to Bank With You</a><br />
Twitter, just like every Web 2.0 application, isn't and shouldn't be treated as a unique platform for dissemination of malware, since it's dissemination of malware "as usual". This particular malware campaign was not just executed by a lone gunman, but also, was taking advantage of a flaw allowing the author to add new followers potentially exposing them to the malicious links serving banker malware. For the the time being, MySpace, Facebook and Twitter accounts are the very last thing a malicious attacker is interesting in puchasing accounting data for, but how come? It's all due to the oversupply of automatically registered accounts at other popular services, whose ecosystem of Internet properties empower cybercriminals with the ability to launch, host and distribute malware in between abusing the very same company's services for the blackhat SEO campaign and redirection services. Theoretically, a distributed network build upon the services provided by a single company is faily easy to accomplish due to the single login authentication applied everywhere. A singly bogus Gmail account results in a blackhat SEO hosting blogspot account, flash based redirector hosted at Picasa, and a couple of thousands of spam emails sent automatically sent through Gmail in order to abuse it's trusted email reputation<br />
&nbsp; <br />
<b>03.</b> <a href="http://ddanchev.blogspot.com/2008/08/compromised-web-servers-serving-fake.html">Compromised Web Servers Serving Fake Flash Players</a><br />
If aggressiveness matter, this campaign consisting of remotely injected redirection scripts at legitimate sites next to on purposely introduced malware oriented domains, was perhaps the most aggressive one during the month. Fake flash players, fake windows media players and fake youtube players are prone to increase as a social engineering tactic of choice due to the template-ization of malware serving sites for the sake of efficiency<br />
<br />
<b>04.</b> <a href="http://ddanchev.blogspot.com/2008/08/pinch-vulnerable-to-remotely.html">Pinch Vulnerable to Remotely Exploitable Flaw</a><br />
With Zeus vulnerable to a remotely exploitable flaw allowing cybercriminals to hijack other cybercriminal's Zeus botnet, private exploits targeting the still rather popular at least in respect to usefulness Pinch malware are leaking, allowing everyone including security researchers to take a peek at a particular campaign running unpatched Pinch gateway<br />
<br />
<b>05.</b> <a href="http://ddanchev.blogspot.com/2008/08/phishers-backdooring-phishing-pages-to.html">Phishers Backdooring Phishing Pages to Scam One Another</a><br />
Backdooring phishing pages is perhaps the most minimalistic approach a cybercriminal wanting to scam another cybercriminal is going to take. The far more beneficial approach that I've encountered on a couple of occassions so far, would be to backdoor a proprietary web malware exploitation kit, release it in the wild, let them put the time and efforts into launching the campaigns, then hijack their botnet. In fact, the possibilities for backdooring copycat web malware exploitation kits in order to take advantage of the momentum while introducing a non-existent kit has always been there at the disposal of malicious attackers. One thing's for sure - there's no such thing as a free web malware exploitation kit, just like there isn't such thing as a free phishing page<br />
<br />
<b>06.</b> <a href="http://ddanchev.blogspot.com/2008/08/email-hacking-going-commercial-part-two.html">Email Hacking Going Commercial - Part Two</a><br />
In between the scammers promising the Moon and asking for anything between $20 to $250 to hack into an email account, there are "legitimate" services taking advantage of web email hacking kits consisting of each and every known XSS vulnerability for a particular service in an attempt to increase the chances of the attacker. And given that the majority of these have been patched a long time ago, social engineering comes into play. Do these services have a future? Definitely as more and more people are in fact looking for and requesting such services, in fact, they're willing to pay a bonus considering how exotic it is for them to have any email that they provide hacked into and the accounting data sent back to them<br />
<br />
<b>07.</b> <a href="http://ddanchev.blogspot.com/2008/08/russia-vs-georgia-cyber-attack.html">The Russia vs Georgia Cyber Attack</a><br />
Event of the month? Could be, but just like every "event of the moth" everyone seems to be once again restating their "selective retention" preferences. What is selective retention anyway? Selective retention is basically a situation where once Russian is attacking another country's infrastructure, you would automatically conclude that it's Russian FSB behind the attacks and consciously and subconsciously ignore all the research and articles telling you otherwise, namely that the FSB wouldn't even bother acknowledging Georgia's online presence, at least not directly. Moreover, talking about the FSB as the agency behind the cyberattacks indicates "selective retention", talking about FAPSI indicates better understanding of the subject.<br />
<br />
In times when cybercrime is getting ever easier to outsource, anyone following the news could basically orchestrate a large scale DDoS attack against a particular country in order to forward the responsibility to any country that they want to. In Russia vs Georgia, you have a combination of a collectivist society that's possessing the capabilities to launch DDoS attacks, knows where and how to order them, and that in times when your country is engaged in a war conflict drinking beer instead of DDoS-sing the major government sites of the adversary is not an option.<br />
<br />
Selective retention when combined with a typical mainstream media's mentality to "slice the threat on pieces" instead of turning the page as soon as possible, is perhaps the worst possible combination. Furthermore, coming up with <a href="http://intelfusion.net/wordpress/?p=398">Social Network analysis of the cyberattacks</a> would produce nothing more but a few fancy graphs of over enthusiastic Russian netizen's distributing the static list of the targets. The real conversations, as always, are <a href="http://blogs.nyu.edu/blogs/agc282/zia/2008/08/intelfusions_sna_of_russian_cy.html">happening in the "Dark Web" limiting the possibilities for open source intelligence</a> using a data mining software. Things changed, OPSEC is slowly emerging as a concept among malicious parties, whenever some of the "calls for action" in the DDoS attacks were posted at mainstream forums, they were immediately removed so that they don't show up in such academic initiatives<br />
<br />
<b>08.</b> <a href="http://ddanchev.blogspot.com/2008/08/76service-cybercrime-as-service-going.html">76Service - Cybercrime as a Service Going Mainstream</a><br />
The reappearance of the 76Service allowing everyone to log into a web based interface and collect all the accounting and financial data coming from malware infected hosts across the globe for the period of time for which they've bought access, indicates that what used to be proprietary services which were supposedly no longer available, are now being operated in a do-it-yourself fashion. Goods and products mature into services, so from a cost-benefit analysis perspective, outsourcing is naturally most beneficial even when it comes to cybercrime <br />
<br />
<b>09.</b> <a href="http://ddanchev.blogspot.com/2008/08/whos-behind-georgia-cyber-attacks.html">Who's Behind the Georgia Cyber Attacks?</a><br />
If it's the botnets used in the attacks, they are known, if it's about who's providing the hosting for the command and control, it's the "usual suspects", but just like previous discussion of the Russian Business Network, it remains questionable on whether or not they work on a revenue-sharing basis, are simply providing the anti-abuse hosting, or are the shady conspirators that every newly born RBN expert is positioning them to be.<br />
<br />
Cheap conversation regarding the RBN ultimately serves the RBN, and just for the record, there's a RBN alternative in every country, but the only thing that remains the same are the customers, tracking the customers means exposing the RBN and the international franchises of their services, making it harder to identify their international operations. And given that the "tip of the iceberg", namely RBN's U.S operations remain in tact, talking about taking actions against their international operations in countries where cybercrime law is still pending, is yet another quality research into the topic building up the pile of research into the very same segments of the very same ISPs.<br />
<br />
Just for the record - these "very same ISPs" are regular readers of my blog, and if you analyze their activities, they're definitely reading yours too, ironically, surfing through gateways residing within their netblock that are so heavily blacklisted due to the guestbook and forum spamming activities that their bad reputation usually ends up in another massive blackhat SEO campaign exposed.<br />
<br />
<b>10.</b> <a href="http://ddanchev.blogspot.com/2008/08/guerilla-marketing-for-conspiracy-site.html">Guerilla Marketing for a Conspiracy Site</a><br />
Conspiracy theorists may in fact have a new wallpaper to show off with<br />
<br />
<b>11.</b> <a href="http://ddanchev.blogspot.com/2008/08/banker-malware-targetting-brazilian.html">Banker Malware Targeting Brazilian Banks in the Wild</a><br />
When misinformed and not knowing anything about a particular underground segment, a potential cybercriminal would stick to using such primitive compared to the sophisticated banker malware kits currently in the wild. These sophisticated banker malware kits are often coming in a customer-tailored proposition, with their price increasing or decreasing based on the specific module to be included or excluded. For instance, a module targeting all the U.S banks that has been put in a "learning mode" long before it was made available to the customers can be requested and is often available with the business model build around the customer's wants&nbsp; <br />
<br />
<b>12.</b> <a href="http://ddanchev.blogspot.com/2008/08/compromised-cpanel-accounts-for-sale.html">Compromised Cpanel Accounts For Sale</a><br />
Despite the massive SQL injection attacks, accounting data for Cpanel accounts coming from malware infected hosts seems to be once again coming into play, which isn't surprising given the filtering capabilities and log parsing tools today's botnet masters are empowered with. These very same compromised Cpanel accounts and the associated domains often end up so heavility abused that it's tactics like these that are driving the underground multitasking mentality, namely, abusing a single compromised account for each and every malicious online activity you can think of - even hosting banners for their blackhat SEO services <br />
<br />
<b>13.</b> <a href="http://ddanchev.blogspot.com/2008/08/diverse-portfolio-of-fake-security.html">A Diverse Portfolio of Fake Security Software - Part Two</a><br />
In August we saw a peek of fake security software, neatly typosquatted domains whose authors earn revenue each and every time someone installs the software. The vendors behind this software are forwarding the entire process of driving traffic to those excelling in aggregating traffic and abusing it. As anticipated, underground multitasking started taking place within the fake security software domains, with the people behind them introducing client-side exploits in order to improve the monetization of the traffic coming to the sites<br />
<br />
<b>14.</b> <a href="http://ddanchev.blogspot.com/2008/08/diy-botnet-kit-promising-eternal.html">DIY Botnet Kit Promising Eternal Updates</a><br />
There's no such thing as a (quality) free botnet kit. What's for free is often the leftovers from a single feature of a more sophisticated proprietary botnet kit. This one in particular is however trying to demonstrate that even a plain simple GUI botnet command and control software can achieve the results desired by an average script kiddie, and not necessarily satisfy the needs of the experienced botnet master<br />
<br />
<b>15.</b> <a href="http://ddanchev.blogspot.com/2008/08/diverse-portfolio-of-fake-security_20.html">A Diverse Portfolio of Fake Security Software - Part Three</a><br />
As far as trends and fads are concerned, the majority of the domains are currently parked at up to four different IPs, with most of them going into a stand by mode once they get detected and reappear back couple of weeks later<br />
<br />
<b>16.</b> <a href="http://ddanchev.blogspot.com/2008/08/fake-celebrity-video-sites-serving.html">Fake Celebrity Video Sites Serving Malware - Part Two</a><br />
Due to the template-ization of fake celebrity video sites, and simple traffic management tools combined with blackhat SEO tactics, these sites are also prone to increase in the next couple of months<br />
<br />
<b>17.</b> <a href="http://ddanchev.blogspot.com/2008/08/web-based-botnet-command-and-control.html">Web Based Botnet Command and Control Kit 2.0</a><br />
It's releases like these that remind us of the amount of time, efforts and personal touch that a malicious attacker would put into such a management kit, currently acting as a personal benchmark as far as complexity and features indicating the coder's experience with botnets is concerned. What's he's failing to anticipate is that this kit is sooner or later going to turn into the "MPack of botnet management"<br />
<br />
<b>18.</b> <a href="http://ddanchev.blogspot.com/2008/08/diverse-portfolio-of-fake-security_25.html">A Diverse Portfolio of Fake Security Software - Part Four</a><br />
Keep it coming, we'll keep it exposing until we end up getting down to the "fake software vendor" itself<br />
<br />
<b>19.</b> <a href="http://ddanchev.blogspot.com/2008/08/automatic-email-harvesting-20.html">Automatic Email Harvesting 2.0</a><br />
Email harvesting is slowly maturing into a vertically integrated service provided by vendors of managed spamming services. This email harvesting module is aiming to close the page on text obfuscation in respect to fighting spam, and is successfully recognizing and collecting such publicly available emails. From a psychological perspective though, the end users who bothered to obfuscate their emails are less likely to fall victims into phishing scams, with the obfuscation speaking for a relatively decent situational awareness on how they emails end up in a spammer's campaign<br />
<br />
<b>20.</b> <a href="http://ddanchev.blogspot.com/2008/08/fake-porn-sites-serving-malware-part.html">Fake Porn Sites Serving Malware - Part Three</a><br />
As a firm believer in sampling in order to draw conclusions on the big picture, an approach that has proven highly accurate in modeling historical and upcoming tactics and behavior, a single fake porn site serving malware campaign usually exposes a dozen of misconfigured redirectors, which thanks to their misconfiguration despite the evasive features available within the kits, expose another dozen of malware campaigns<br />
<br />
<b>21.</b> <a href="http://ddanchev.blogspot.com/2008/08/facebook-malware-campaigns-rotating.html">Facebook Malware Campaigns Rotating Tactics</a><br />
With no particular flaw exploited other than the social engineering tactic of using already compromised Facebook accounts who would automatically spam all their friends with links to flash files hosted at legitimate services, the more persistent the campaign is, the higher the chance that it will scale enough. This campaign in particular is mainly relying on rotation of tactics, namely different messages, different services and file extensions used in order to trick someone's friend into visiting the URL. With the number of users increasing, the most popular social networking sites are naturally going to be permanently under attacks from cybercriminals<br />
<br />
<b>22.</b> <a href="http://ddanchev.blogspot.com/2008/08/fake-security-software-domains-serving.html">Fake Security Software Domains Serving Exploits</a><br />
Despite that it's a single brand, namely the International Virus Research Lab that's introducing client-side exploits within it's portfolio of domains, the opportunity for abuse may be noticed by the rest of the brands pretty fast<br />
<br />
<b>23.</b> <a href="http://ddanchev.blogspot.com/2008/08/exposing-indias-captcha-solving-economy.html">Exposing India’s CAPTCHA Solving Economy</a><br />
Taking into consideration the mentality surrounding a particular country's cybercriminals, how they think, how they operate, what do they define as an opportunity, and how much personal efforts are they willing to put into their campaigns, I wouldn't be surpised if a Russian vendor offering 100,000 bogus Gmail accounts for sale has in fact outsourcing the account registration process to Indian workers, paid them pocket change and is then reselling them ten to twenty times higher than the price he originally paid for them. <br />
<br />
The text based CAPTCHAs used at the major Internet portals and services, are so efficiently abused by this approach that continuing to use is directly undermining the trust these email providers and services often come with as granted<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=VdcSL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=VdcSL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=2dvxL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=2dvxL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=hYvml"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=hYvml" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=YfcJl"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=YfcJl" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=WUVJL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=WUVJL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=jRCTL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=jRCTL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=KYkll"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=KYkll" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/388609194" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 10 Sep 2008 02:57:32 +0000</pubDate>
      <category domain="http://securityratty.com/tag/malware">malware</category>
      <category domain="http://securityratty.com/tag/facebook malware campaigns">facebook malware campaigns</category>
      <category domain="http://securityratty.com/tag/usefulness pinch malware">usefulness pinch malware</category>
      <category domain="http://securityratty.com/tag/banker malware kits">banker malware kits</category>
      <category domain="http://securityratty.com/tag/malware campaigns">malware campaigns</category>
      <category domain="http://securityratty.com/tag/botnet">botnet</category>
      <category domain="http://securityratty.com/tag/diy botnet kit">diy botnet kit</category>
      <category domain="http://securityratty.com/tag/distribute malware">distribute malware</category>
      <category domain="http://securityratty.com/tag/banker malware">banker malware</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/388609194/summarizing-augusts-threatscape.html">Summarizing August's Threatscape</source>
    </item>
    <item>
      <title><![CDATA[Exposing Indias CAPTCHA Solving Economy]]></title>
      <link>http://securityratty.com/article/ad0c8efa28ec8caf66f9be4e96ae79f0</link>
      <guid>http://securityratty.com/article/ad0c8efa28ec8caf66f9be4e96ae79f0</guid>
      <description><![CDATA[Are you a Human?&quot; - once asked the CAPTCHA, and the question got answered by, well, a human, thousands of them to be precise. Speculations around one of the main weaknesses of CAPTCHA based...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://4.bp.blogspot.com/_wICHhTiQmrA/SLhSbUhErdI/AAAAAAAACI0/6poURrjAkGI/s1600-h/india_captcha_breakers9.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://4.bp.blogspot.com/_wICHhTiQmrA/SLhSbUhErdI/AAAAAAAACI0/HZ5BF3hc6nY/s200-R/india_captcha_breakers9.JPG" /></a>"Are you a Human?" - once asked the CAPTCHA, and the question got answered by, well, a human, thousands of them to be precise. Speculations around one of the main weaknesses of CAPTCHA based authentication in the face of human CAPTCHA solvers, seems to have evolved into a booming economy in India during the past 12 months, with thousands of people involved.<br />
<br />
The following article - "<a href="http://blogs.zdnet.com/security/?p=1835">Inside India’s CAPTCHA solving economy</a>" aims to expose legitimate data entry workers, whose business models and techniques are in fact used by Russian cybercriminals not only for personal phishing, spamming and malware spreading purposes, but also, to resell the bogus accounts and earn a premium in the process :<br />
<br />
"<i>No CAPTCHA can survive a human that’s receiving financial incentives for solving it, and with an army of low-wagedIndia CAPTCHA breakers human CAPTCHA solvers officially in the business of “data processing” while earning a mere $2 for solving a thousand CAPTCHA’s, I’m already starting to see evidence of consolidation between India’s major CAPTCHA solving companies. The consolidation logically leading to increased bargaining power, is resulting in an international franchising model recruiting data processing workers empowered with do-it-yourself CAPTCHA syndication web based kits, API keys, and thousands of proxies to make their work easier, and the process more efficient.</i>"<br />
<br />
Cybercrime is just as outsourceable as CAPTCHA breaking is these days.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2008/07/unbreakable-captcha.html">The Unbreakable CAPTCHA</a><br />
<a href="http://blogs.zdnet.com/security/?p=1514">Spam coming from free email providers increasing </a><br />
<a href="http://blogs.zdnet.com/security/?p=1418">Gmail, Yahoo and Hotmail’s CAPTCHA broken by spammers</a><br />
<a href="http://blogs.zdnet.com/security/?p=1232">Microsoft’s CAPTCHA successfully broken</a><br />
<a href="http://ddanchev.blogspot.com/2007/03/vladuzs-ebay-captcha-populator.html">Vladuz's Ebay CAPTCHA Populator</a><br />
<a href="http://ddanchev.blogspot.com/2007/09/spammers-and-phishers-breaking-captchas.html">Spammers and Phishers Breaking CAPTCHAs</a><br />
<a href="http://ddanchev.blogspot.com/2007/10/diy-captcha-breaking-service.html">DIY CAPTCHA Breaking Service</a><br />
<a href="http://ddanchev.blogspot.com/2007/11/which-captcha-do-you-want-to-decode.html">Which CAPTCHA Do You Want to Decode Today?</a><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=HJ3QtK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=HJ3QtK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=m6hgDK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=m6hgDK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=0TXeOk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=0TXeOk" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=4jwe6k"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=4jwe6k" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=9clPFK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=9clPFK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=JCXayK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=JCXayK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=5ic3Pk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=5ic3Pk" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/378395296" height="1" width="1"/>]]></content:encoded>
      <pubDate>Fri, 29 Aug 2008 13:03:37 +0000</pubDate>
      <category domain="http://securityratty.com/tag/captcha">captcha</category>
      <category domain="http://securityratty.com/tag/microsofts captcha">microsofts captcha</category>
      <category domain="http://securityratty.com/tag/indias major captcha">indias major captcha</category>
      <category domain="http://securityratty.com/tag/hotmails captcha">hotmails captcha</category>
      <category domain="http://securityratty.com/tag/unbreakable captcha">unbreakable captcha</category>
      <category domain="http://securityratty.com/tag/human captcha solvers">human captcha solvers</category>
      <category domain="http://securityratty.com/tag/human">human</category>
      <category domain="http://securityratty.com/tag/inside indias captcha">inside indias captcha</category>
      <category domain="http://securityratty.com/tag/captcha based authentication">captcha based authentication</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/378395296/exposing-indias-captcha-solving-economy.html">Exposing Indias CAPTCHA Solving Economy</source>
    </item>
    <item>
      <title><![CDATA[Economist.com - Confessions of a Risk Manager]]></title>
      <link>http://securityratty.com/article/536365450db644abfa519cdc03dc2c4c</link>
      <guid>http://securityratty.com/article/536365450db644abfa519cdc03dc2c4c</guid>
      <description><![CDATA[I was reading the Economist this week and came across an excellent article titled &quot; Confessions of a Risk Manager

In the article a risk manager for a major financial institution talks about managing...]]></description>
      <content:encoded><![CDATA[I was reading the <a href="http://www.economist.com/">Economist </a>this week and came across an excellent article titled "<a href="http://www.economist.com/finance/displaystory.cfm?story_id=11897037">Confessions of a Risk Manager</a>".<br /><br />In the article a risk manager for a major financial institution talks about managing risks and how the risk department was viewed as an obstacle by the rest of the business.  I'll just quote a section here so you can see that governance roles, especially those involving trade-offs of risk vs. return are difficult not just in security.<br /><blockquote>In their eyes, we were not earning money for the bank. Worse, we had the power to say no and therefore prevent business from being done. Traders saw us as obstructive and a hindrance to their ability to earn higher bonuses. They did not take kindly to this. Sometimes the relationship between the risk department and the business lines ended in arguments.   . . .<br /><br />Tactfully explaining why we said no was not our forte. Traders were often exasperated as much by how they were told as by what they were told.  <p>At the root of it all, however, was—and still is—a deeply ingrained flaw in the decision-making process. In contrast to the law, where two sides make an equal-and-opposite argument that is fairly judged, in banks there is always a bias towards one side of the argument. The business line was more focused on getting a transaction approved than on identifying the risks in what it was proposing. The risk factors were a small part of the presentation and always “mitigated”. This made it hard to discourage transactions. If a risk manager said no, he was immediately on a collision course with the business line. The risk thinking therefore leaned towards giving the benefit of the doubt to the risk-takers.<br /></p><p>Collective common sense suffered as a result. Often in meetings, our gut reactions as risk managers were negative. But it was difficult to come up with hard-and-fast arguments for why you should decline a transaction, especially when you were sitting opposite a team that had worked for weeks on a proposal, which you had received an hour before the meeting started. In the end, with pressure for earnings and a calm market environment, we reluctantly agreed to marginal transactions.</p></blockquote><br />Every time I read about decision making like this I refer back to an some excellent presentations I've come across by Reidar Bratvold.  He has done some excellent presentations on decision making in the face of risks/uncertainty.<br /><br /><ul><li><a href="www.spe.no/stavanger/doc/Bratvold%20-%20SPE%20Dist%20Lecturer.pdf">Would You Know a Good decision if You Saw One?</a></li><li><a href="http://www.reidar-bratvold.com/Decision%20Making%20Under%20Uncertainty%20-%20BadenBaden.pdf">Decision Making Under Uncertainty</a></li></ul><img src="http://feeds.feedburner.com/~r/SecurityRetentive/~4/362069047" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 11 Aug 2008 04:42:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/risk">risk</category>
      <category domain="http://securityratty.com/tag/risk manager">risk manager</category>
      <category domain="http://securityratty.com/tag/risk factors">risk factors</category>
      <category domain="http://securityratty.com/tag/risk-takers">risk-takers</category>
      <category domain="http://securityratty.com/tag/business">business</category>
      <category domain="http://securityratty.com/tag/business line">business line</category>
      <category domain="http://securityratty.com/tag/risk managers">risk managers</category>
      <category domain="http://securityratty.com/tag/risk department">risk department</category>
      <category domain="http://securityratty.com/tag/business lines">business lines</category>
      <source url="http://feeds.feedburner.com/~r/SecurityRetentive/~3/362069047/economistcom-confessions-of-risk.html">Economist.com - Confessions of a Risk Manager</source>
    </item>
    <item>
      <title><![CDATA[Click Fraud, Botnets and Parked Domains - All Inclusive]]></title>
      <link>http://securityratty.com/article/5f5fba7cc0fecccc9eec606ee322456a</link>
      <guid>http://securityratty.com/article/5f5fba7cc0fecccc9eec606ee322456a</guid>
      <description><![CDATA[It gets very ugly when someone owns both, the botnet, and the portfolio of parked domains actively participating in PPC (pay per click) advertising programs, where the junk content, or the...]]></description>
      <content:encoded><![CDATA[<div class="separator" style="text-align: center; clear: both;"><a href="http://bp2.blogger.com/_wICHhTiQmrA/SI2zsqetKuI/AAAAAAAAB9k/tEKkNsDYkC8/s1600-h/stats_click_fraud_affiliate_based.jpg" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp2.blogger.com/_wICHhTiQmrA/SI2zsqetKuI/AAAAAAAAB9k/_l257acyNMg/s200-R/stats_click_fraud_affiliate_based.jpg" style="border: 0pt none ;" /></a></div>It gets very ugly when someone owns both, the botnet, and the portfolio of parked domains actively participating in PPC (pay per click) advertising programs, where the junk content, or the typosquatted domain names is aiming to attract high value and expensive keywords in order for the scammer to year higher on per click percentage. This is among the very latest tactics applied by those engaging in click fraud. Hypothetically, the cost to rent the botnet and commit click fraud would be cheaper than sharing revenue on per click basis with "human clickers" who earn money based on how many ads they click given a set of scammer's owned sites, where the customer supports represents a DIY proxy switching application changing their IP on the fly. <br />
<br />
<a href="http://blogs.zdnet.com/security/?p=1555">Click Forensics's recent Q2 2008 report indicates that botnets were responsible for over 25% of all click fraud</a> activity they were monitoring during Q2. Not surprising, given that <a href="http://blogs.zdnet.com/security/?p=1200">botnets have long been observed to commit blick fraud, using a common traffic exchange scheme</a>. What's new is the <a href="http://www.mediapost.com/publications/?fa=Articles.showArticleHomePage&amp;art_aid=86914">use and abuse of parked domains</a> :<br />
<br />
"<i><span class="articleText">Despite indication that some of the clicks from parked domains were invalid, Google failed to disclose to the plaintiff specific domain names in which these ads were clicked on, making detection of invalid clicks difficult and even worse concealing any evidence of invalid clicks," the lawsuit alleges. RK West eventually went through its server logs and discovered the source of the clicks, said Alfredo Torrijos, one of the company's attorneys.</span></i>"<br />
<br />
<div class="separator" style="text-align: left; clear: both;"><a href="http://bp3.blogger.com/_wICHhTiQmrA/SI25xjFW2JI/AAAAAAAAB9s/I0B4dL0kNKs/s1600-h/stats_click_fraud_affiliate_based1.jpg" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp3.blogger.com/_wICHhTiQmrA/SI25xjFW2JI/AAAAAAAAB9s/yO_zUYYDmDM/s200-R/stats_click_fraud_affiliate_based1.jpg" style="border: 0pt none ;" /></a></div>Will cybersquat security vendors for improving the chances of attracting high-valued keywords to later on click fraud? <a href="http://ddanchev.blogspot.com/2007/05/brandjacking-index.html">The trend has been pretty evident</a> for a while, with <a href="http://blogs.zdnet.com/security/?p=1240">cybersquatting increasing</a> on an yearly basis <a href="http://www.domaintrading360.com/2008/July/Cybersquatting-has-Increased-48-since-25.htm">according to multiple sources</a> :<br />
<br />
"<i>Rise in pay-per-click advertising where cybersquatters link the domain name they have registered with a website containing ads promoting a variety of competing brands.&nbsp; The cybersquatter receives money every time internet users access this website and click on one of the ads.</i>" <br />
<br />
However, the "internet users who are supposed to click on one of the ads on the parked domains owned by the scammers" will get clicked by a botnet owned or cost-effectively rented by the scammer. Here's a sample of currently parked domains attracting Symantec ads :<br />
<br />
<a href="http://bp2.blogger.com/_wICHhTiQmrA/SI2_iieZvEI/AAAAAAAAB90/vBXDvrmIQ3Y/s1600-h/symantec_parked.png" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp2.blogger.com/_wICHhTiQmrA/SI2_iieZvEI/AAAAAAAAB90/75_WIDckWa4/s200-R/symantec_parked.png" style="border: 0pt none ;" /></a><b>symentec .com<br />
symantek .com<br />
symanteck .com<br />
symantac .com<br />
symantaec .com<br />
symantic .com<br />
symmantec .com <br />
symanntec .com<br />
ssymantec .com<br />
symanthec .com<br />
symanzec .com<br />
symanttec .com<br />
sjmantec .com<br />
saimantec .com<br />
seymantec .com<br />
symanrec .com <br />
symantrc .com<br />
symantwc .com<br />
aymantec .com<br />
dymantec .com<br />
sxmantec .com<br />
symantex .com<br />
symantev .com<br />
symabtec .com<br />
symamtec .com<br />
synantec .com<br />
stmantec .com<br />
symanyec .com<br />
sumantec .com<br />
symant3c .com<br />
syman5ec .com<br />
wwwsymantec .com<br />
symanteccom .com<br />
ymantec .com<br />
syantec .com<br />
symntec .com<br />
symanec .com<br />
symantc .com<br />
symante .com<br />
symattec .com<br />
symantcc .com<br />
syman-tec .com<br />
syymantec .com<br />
symaantec .com<br />
symanteec .com<br />
symantecc .com<br />
ysmantec .com<br />
syamntec .com<br />
symnatec .com<br />
symatnec .com <br />
symanetc .com<br />
symantce .com</b><br />
<br />
As well as recent sample brandjacking Kaspersky :<br />
<div style="text-align: left;"></div><div class="separator" style="text-align: center; clear: both;"></div><a href="http://bp3.blogger.com/_wICHhTiQmrA/SI3BgYCnt9I/AAAAAAAAB98/06ZAB3dzbCI/s1600-h/kaspersky_cybersquatted.png" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp3.blogger.com/_wICHhTiQmrA/SI3BgYCnt9I/AAAAAAAAB98/GQ6jI4aBdFM/s200-R/kaspersky_cybersquatted.png" style="border: 0pt none ;" /></a><b>kespersky .com<br />
kasparsky .com<br />
kaspaersky .com<br />
kaspasky .com<br />
kasperscky .com<br />
gaspersky .com<br />
kasbersky .com <br />
kasppersky .com<br />
kasperrsky .com<br />
kasperssky .com<br />
kasperskj .com<br />
kasperskey .com<br />
kaapersky .com<br />
kasperaky .com<br />
kasperdky .com<br />
laspersky .com<br />
kaspersly .com<br />
kasperskt .com<br />
kaspersku .com<br />
kasp3rsky .com<br />
kaspe4sky .com<br />
kas0ersky .com<br />
wwwkasperskycom .com<br />
wwwkaspersky .com<br />
kasperskycom .com<br />
aspersky .com<br />
kspersky .com<br />
kasersky .com<br />
kaspesky .com&nbsp;&nbsp;&nbsp; <br />
kaspersy .com<br />
kaspersk .com<br />
kappersky .com<br />
kaspessky .com<br />
kas-persky .com <br />
kasp-ersky .com<br />
kasper-sky .com<br />
kasperskyy .com<br />
akspersky .com<br />
ksapersky .com<br />
kapsersky .com<br />
kaseprsky .com<br />
kaspesrky .com&nbsp;&nbsp;&nbsp; <br />
kaspersyk .com<br />
kaspersky24 .com<br />
kasperskyonline .com<br />
kaspersky-online .com</b><br />
<br />
<div style="text-align: left;"></div><div class="separator" style="text-align: center; clear: both;"></div><a href="http://bp3.blogger.com/_wICHhTiQmrA/SI3CDCHUR8I/AAAAAAAAB-E/CNtqkpXkdQY/s1600-h/stats_click_fraud_affiliate_based2.jpg" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp3.blogger.com/_wICHhTiQmrA/SI3CDCHUR8I/AAAAAAAAB-E/gwyx6ceVeec/s200-R/stats_click_fraud_affiliate_based2.jpg" style="border: 0pt none ;" /></a>What's most disturbing is that instead of having cybersquatting taken care take of a long time, and scammers emphasizing on the junk content in order to attract the relevant ads on the bogus domains, the still trendy cybersquatting still does the magic by including the targeted word in the domain name itself.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2008/03/cybersquatting-security-vendors-for.html">Cybersquatting Security Vendors for Fraudulent Purposes</a><br />
<a href="http://ddanchev.blogspot.com/2008/04/cybersquatting-symantecs-norton.html">Cybersquatting Symantec's Norton AntiVirus</a><br />
<a href="http://ddanchev.blogspot.com/2007/11/state-of-typosquatting-2007.html">The State of Typosquatting - 2007</a><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=wafTVJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=wafTVJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=xOMD9J"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=xOMD9J" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=8ZGBqj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=8ZGBqj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=wdaQsj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=wdaQsj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=v3m4OJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=v3m4OJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=9nz2nJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=9nz2nJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=Vplsvj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=Vplsvj" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/348369914" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 28 Jul 2008 03:58:08 +0000</pubDate>
      <category domain="http://securityratty.com/tag/click">click</category>
      <category domain="http://securityratty.com/tag/click fraud">click fraud</category>
      <category domain="http://securityratty.com/tag/click percentage">click percentage</category>
      <category domain="http://securityratty.com/tag/click basis">click basis</category>
      <category domain="http://securityratty.com/tag/pay-per-click">pay-per-click</category>
      <category domain="http://securityratty.com/tag/click forensics">click forensics</category>
      <category domain="http://securityratty.com/tag/click fraud activity">click fraud activity</category>
      <category domain="http://securityratty.com/tag/invalid">invalid</category>
      <category domain="http://securityratty.com/tag/invalid clicks difficult">invalid clicks difficult</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/348369914/click-fraud-botnets-and-parked-domains.html">Click Fraud, Botnets and Parked Domains - All Inclusive</source>
    </item>
    <item>
      <title><![CDATA[D.C. Police Detective Arressted for Propositioning a "Prostitute".]]></title>
      <link>http://securityratty.com/article/5764d3c57a7c61891d6d10d70473d035</link>
      <guid>http://securityratty.com/article/5764d3c57a7c61891d6d10d70473d035</guid>
      <description><![CDATA[Some time clients call us up and ask if we can send them off-duty cops for Executive Protection assignments. My first inclination is to tell them why we are reluctant to use off-duty police
...]]></description>
      <content:encoded><![CDATA[Some time clients call us up and ask if we can send them off-duty cops for Executive Protection assignments.  My first inclination is to tell them why we are reluctant to use off-duty police. <br /><span id="fullpost"><br />Yesterday, WTOP radio reported that a Detective Wheeler from the Washington D.C. Metropolitan Police had been arrested for trying to hire a Prostitute.  Unfortunately for Detective Wheeler, the "prostitute" was an undercover Police Detective herself.<br /><br />The story gets better, however.  It seems that Detective Wheeler is assigned to the Vice Unit.  For those of you who don't know what a Vice Unit does, they set up "stings" and dress female Police officers to look like prostitutes in order to arrest those who try and do business with "prostitutes".  One wonders if Detective Wheeler should be charged with the prostituion charge or one involving gross stupidity. <br /><br />Just becaause a Police officer carries a gun, does not mean that this qualifies him or her to do everything security related.  While most of them are decent, hard working indivduals, there are also some who break laws and circumvent the system for their own benefit.  When you hire an "off-duty cop", you do not know what you are getting.  Perhaps you will get a bad apple(s) who will do more harm than good.  Afterall, what way is there to vet them?<br /><br />A professional security company like ours, train their own people and enforce from day one a strong sense of Ethics.  We have a zero policy for any behaviour that might be detrimental to us or the client.  On the rare occassion when someone does something that we do not condone, they are terminated.  There is no room for Union intervention or "three strikes, you're out" or any other delaying tactic.  <br /><br />Our reputation is too important.  Then again, we do not have "jobs for life" but must instead earn buisness by constantly performing.  The next time you need a security person, keep this in mind.          <br /></span><div class="blogger-post-footer">Visit Sexton Executive Security at www.sextonsecurity.com</div>]]></content:encoded>
      <pubDate>Sat, 12 Jul 2008 14:58:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/detective wheeler">detective wheeler</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/security person">security person</category>
      <category domain="http://securityratty.com/tag/professional security company">professional security company</category>
      <category domain="http://securityratty.com/tag/time">time</category>
      <category domain="http://securityratty.com/tag/vice unit">vice unit</category>
      <category domain="http://securityratty.com/tag/time clients call">time clients call</category>
      <category domain="http://securityratty.com/tag/prostitute">prostitute</category>
      <category domain="http://securityratty.com/tag/executive protection assignments">executive protection assignments</category>
      <source url="http://www.thebulletproofblog.com/2008/07/dc-police-detective-arressted-for.html">D.C. Police Detective Arressted for Propositioning a "Prostitute".</source>
    </item>
    <item>
      <title><![CDATA[Security Circumvented: My Anti-Virus]]></title>
      <link>http://securityratty.com/article/5704ba277530cbbd6aec5c9efb9863d9</link>
      <guid>http://securityratty.com/article/5704ba277530cbbd6aec5c9efb9863d9</guid>
      <description><![CDATA[I recently needed to renew the anti-virus subscription on my tablet PC. Of course, Symantec popped up and let me know well in advance, and of course, I waited until the almost-last-day before I...]]></description>
      <content:encoded><![CDATA[<p><strong>I recently needed to renew the anti-virus subscription</strong> on my tablet PC. Of course, Symantec popped up and let me know well in advance, and of course, I waited until the almost-last-day before I renewed. </p><p>When my renewal options appeared, there was a selection to upgrade to the shiny new Norton 360. Woo hoo! It listed all these great new security features&#8230; I don&#8217;t remember what they were&#8230; but, they sounded REALLY great (I promise).</p><p>So I went with the upgrade, instead of the anti-virus signature renewal. <em>Okay</em>. </p><p>It did <strong>seem</strong> like a good idea at the time. However, in addition to my overly-protective Vista popups eeeevvvvery time I want to run something, connect somewhere, or wipe my nose&#8230; Now, I have the Vista pop up AND the Norton 360 popup.&nbsp;<em>Okay</em>.</p><p>Except, the Norton pops up with flagrantly ambiguous information like &#8220;An application is trying to access your Internet.&#8221; Do I want to allow it? I don&#8217;t know. How am I supposed to know-&nbsp;<strong>which</strong> application wants to access my Internet? Oh, it&#8217;s not going to tell me. <em>Okay</em>.</p><p>Well, I guess I&#8217;ll click &#8216;Allow&#8217; because I have no clue <strong>what</strong> is trying to access my Internet, but I&#8217;ll assume it&#8217;s something that I have somehow asked to access my Internet&#8230; and I&#8217;ll be quite upset if whatever I clicked on doesn&#8217;t work. So YES, ALLOW. <em>Okay again.</em></p><p>And what was the point in that? One click has transformed to three, and I&#8217;m no more secure than I was before, I&#8217;m just being forced to make more clicks to <u>earn</u> my insecurity. So today I am the poster child of what NOT to do. </p><p><strong>Security circumvented</strong> is quite possibly worse than no security at all. I see visions of &#8216;invalid browser certificate&#8217; notices dancing in my head. </p><p># # #</p>
]]></content:encoded>
      <pubDate>Thu, 19 Jun 2008 23:31:34 +0000</pubDate>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/norton pops">norton pops</category>
      <category domain="http://securityratty.com/tag/norton">norton</category>
      <category domain="http://securityratty.com/tag/internet">internet</category>
      <category domain="http://securityratty.com/tag/security features">security features</category>
      <category domain="http://securityratty.com/tag/access">access</category>
      <category domain="http://securityratty.com/tag/flagrantly ambiguous information">flagrantly ambiguous information</category>
      <category domain="http://securityratty.com/tag/anti-virus signature renewal">anti-virus signature renewal</category>
      <category domain="http://securityratty.com/tag/possibly worse">possibly worse</category>
      <source url="http://www.securityuncorked.com/security-uncorked/2008/6/20/security-circumvented-my-anti-virus.html">Security Circumvented: My Anti-Virus</source>
    </item>
    <item>
      <title><![CDATA[Internet fraud has taken a sinister new turn]]></title>
      <link>http://securityratty.com/article/db7751161b087a246797bbbfa5307f39</link>
      <guid>http://securityratty.com/article/db7751161b087a246797bbbfa5307f39</guid>
      <description><![CDATA[Organised crime has identified the web as a goldmine providing opportunities to launch cyber attacks that will earn large amounts of money at a relatively low risk. Learn...]]></description>
      <content:encoded><![CDATA[Organised crime has identified the web as a goldmine – providing opportunities to launch cyber attacks that will earn large amounts of money at a relatively low risk. Learn more.]]></content:encoded>
      <pubDate>Tue, 17 Jun 2008 06:19:08 +0000</pubDate>
      <category domain="http://securityratty.com/tag/launch cyber attacks">launch cyber attacks</category>
      <category domain="http://securityratty.com/tag/low risk">low risk</category>
      <category domain="http://securityratty.com/tag/money">money</category>
      <category domain="http://securityratty.com/tag/crime">crime</category>
      <category domain="http://securityratty.com/tag/goldmine">goldmine</category>
      <category domain="http://securityratty.com/tag/web">web</category>
      <category domain="http://securityratty.com/tag/opportunities">opportunities</category>
      <category domain="http://securityratty.com/tag/earn">earn</category>
      <category domain="http://securityratty.com/tag/amounts">amounts</category>
      <source url="http://digg.com/security/Internet_fraud_has_taken_a_sinister_new_turn">Internet fraud has taken a sinister new turn</source>
    </item>
  </channel>
</rss>
