<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: eight-year-old]]></title>
    <link>http://securityratty.com/tag/eight-year-old</link>
    <description></description>
    <pubDate>Fri, 27 Jun 2008 19:45:03 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[A Diverse Portfolio of Fake Security Software - Part Eight]]></title>
      <link>http://securityratty.com/article/8679b7cba84c40cf05ac706ffff136e1</link>
      <guid>http://securityratty.com/article/8679b7cba84c40cf05ac706ffff136e1</guid>
      <description><![CDATA[In the spirit of &quot; taking a bite out of cybercrime &quot;, here are the latest fake security software domains, typosquatted and already acquiring traffic through a dozen of malware campaigns redirecting to...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://3.bp.blogspot.com/_wICHhTiQmrA/SOrE3tf04BI/AAAAAAAACQQ/kcG-puPQ2zs/s1600-h/fake_security_software_october.PNG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://3.bp.blogspot.com/_wICHhTiQmrA/SOrE3tf04BI/AAAAAAAACQQ/uqK0Of48ME4/s200-R/fake_security_software_october.PNG" /></a>In the spirit of "<a href="http://bp3.blogger.com/_wICHhTiQmrA/R3WKqj8-MnI/AAAAAAAABSw/9FrQmDwhpb4/s1600-h/mcgruff_cybercrime.jpg">taking a bite out of cybercrime</a>", here are the latest fake security software domains, typosquatted and already acquiring traffic through a dozen of malware campaigns redirecting to most of them :<br />
<br />
<b>antivirus-scanner-online.com</b> (67.205.75.14)<br />
<br />
<b>archivepacker.com</b> (78.157.142.111)<br />
<b>winpacker.com<br />
xh-codec.net</b><br />
<br />
<b>securedownloadcenter.com</b> (89.18.189.44)<br />
<b>winupdates-server.com<br />
browserssecuritypage.com<br />
megatradetds0.com</b><br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: left;"><a href="http://3.bp.blogspot.com/_wICHhTiQmrA/SOrFf0onJVI/AAAAAAAACQY/L3D_vlP23hU/s1600-h/fake_security_software_october1.PNG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://3.bp.blogspot.com/_wICHhTiQmrA/SOrFf0onJVI/AAAAAAAACQY/omtYi_kxTos/s200-R/fake_security_software_october1.PNG" /></a></div><b>quickscanpc.com</b> (78.159.118.144)<br />
<b>clickchecker6.com<br />
</b><br />
<b>gensoftdownload.com</b> (91.203.93.25) <br />
<br />
<b>online-av-scan2008.com</b> (66.232.105.232)<br />
<b>anothersoftportal09.com</b><br />
<b>bigfreesoftarchive.com</b><br />
<b>celebs-on-video-08.com</b><br />
<b>celebs-on-video-2008.com</b><br />
<b>cleansoftportal2009.com</b><br />
<b>hot-p0rntube.com</b><br />
<b>hot-porn-tube-2008.com</b><br />
<b>hot-porn-tube2008.com</b><br />
<b>hot-porn-tube2009.com</b><br />
<b>justdomain08.com</b><br />
<b>new-porntube-2008.com</b><br />
<b>online-av-scan2008.com</b><br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://4.bp.blogspot.com/_wICHhTiQmrA/SOrGSntRZ4I/AAAAAAAACQg/iIu0w9kigNc/s1600-h/fake_security_software_october2.PNG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://4.bp.blogspot.com/_wICHhTiQmrA/SOrGSntRZ4I/AAAAAAAACQg/AIs6ZzzeXmI/s200-R/fake_security_software_october2.PNG" /></a><b>s0ftvvarep0rtal.com<br />
s0ftvvareportal.com<br />
s0ftvvareportal08.com<br />
s0ftwarep0rtal08.com<br />
softportalforfun.com<br />
softportalforfun08.com<br />
softportalforfun2008.com<br />
softvvareportal.com<br />
softvvareportal08.com<br />
softvvareportal2008.com<br />
trustedsoftportal06.com<br />
trustedsoftportal2008.com</b><br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://4.bp.blogspot.com/_wICHhTiQmrA/SOrG2J5DAiI/AAAAAAAACQo/PHQM9BSuc6A/s1600-h/fake_security_software_october3.PNG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://4.bp.blogspot.com/_wICHhTiQmrA/SOrG2J5DAiI/AAAAAAAACQo/emqLynBbpqo/s200-R/fake_security_software_october3.PNG" /></a><b>antivirus-online-08.com</b> (89.187.48.155; 218.106.90.227)<br />
<b>anti-virus-xp.com<br />
anti-virus-xp.net<br />
anti-virusxp2008.net<br />
antimalware09.com<br />
antivirxp.net<br />
av-xp08.net<br />
av-xp2008.com<br />
av-xp2008.net<br />
avx08.net<br />
axp2008.com<br />
e-antiviruspro.com<br />
eantivirus-payment.com<br />
ekerberos.com<br />
online-security-systems.com<br />
xpprotector.com<br />
youpornzztube.com</b><br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://3.bp.blogspot.com/_wICHhTiQmrA/SOrHASFNdfI/AAAAAAAACQw/qIj8zB5yVAY/s1600-h/fake_software_october.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://3.bp.blogspot.com/_wICHhTiQmrA/SOrHASFNdfI/AAAAAAAACQw/ARL4Yobkx74/s200-R/fake_software_october.png" /></a><b>sp-preventer.com</b> (92.241.163.32)<br />
<b>spypreventers.com</b><br />
<br />
<b>u-a-v-2008.com</b> (92.241.163.31)<br />
<b>uav2008.com</b><br />
<br />
<b>power-avcc.com</b> (92.62.101.57)<br />
<b>power-avc.com<br />
pvrantivirus.com</b><br />
<br />
<b>m-s-a-v-c.com</b> (92.62.101.55)<br />
<b>ms-avcc.com<br />
ms-avc.com</b><br />
<br />
<b>wav2008.com</b> (92.241.163.30)<br />
<b>wiav2009.com</b><br />
<b>win-av.com<br />
windows-av.com<br />
windowsav.com&nbsp;</b><br />
<br />
You know the drill.<b>&nbsp;</b><br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2008/09/diverse-portfolio-of-fake-security_30.html">A Diverse Portfolio of Fake Security Software - Part Seven</a><br />
<a href="http://ddanchev.blogspot.com/2008/09/diverse-portfolio-of-fake-security_24.html">A Diverse Portfolio of Fake Security Software - Part Six</a><br />
<a href="http://ddanchev.blogspot.com/2008/09/diverse-portfolio-of-fake-security.html">A  Diverse Portfolio of Fake Security Software - Part Five</a> <br />
<a href="http://ddanchev.blogspot.com/2008/08/diverse-portfolio-of-fake-security_25.html">A  Diverse Portfolio of Fake Security Software - Part Four</a><br />
<a href="http://ddanchev.blogspot.com/2008/08/diverse-portfolio-of-fake-security_20.html">A  Diverse Portfolio of Fake Security Software - Part Three</a><b> </b><br />
<a href="http://ddanchev.blogspot.com/2008/08/diverse-portfolio-of-fake-security.html">A  Diverse Portfolio of Fake Security Software - Part Two</a><br />
<a href="http://ddanchev.blogspot.com/2007/12/diverse-portfolio-of-fake-security.html">Diverse  Portfolio of Fake Security Software</a> <b></b><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=1QWvM"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=1QWvM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=r6QfM"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=r6QfM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=Q76lm"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=Q76lm" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=JZP6m"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=JZP6m" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=YNGWM"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=YNGWM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=MxVcM"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=MxVcM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=h2Vfm"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=h2Vfm" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/413758015" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 07 Oct 2008 03:21:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/fake security software">fake security software</category>
      <category domain="http://securityratty.com/tag/diverse portfolio">diverse portfolio</category>
      <category domain="http://securityratty.com/tag/net">net</category>
      <category domain="http://securityratty.com/tag/malware campaigns">malware campaigns</category>
      <category domain="http://securityratty.com/tag/av-xp2008">av-xp2008</category>
      <category domain="http://securityratty.com/tag/anti-virus-xp">anti-virus-xp</category>
      <category domain="http://securityratty.com/tag/antimalware09">antimalware09</category>
      <category domain="http://securityratty.com/tag/uav2008">uav2008</category>
      <category domain="http://securityratty.com/tag/axp2008">axp2008</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/413758015/diverse-portfolio-of-fake-security.html">A Diverse Portfolio of Fake Security Software - Part Eight</source>
    </item>
    <item>
      <title><![CDATA[Wireless Security In-Depth]]></title>
      <link>http://securityratty.com/article/d59280202b6b96b8894df9dd64ecc74d</link>
      <guid>http://securityratty.com/article/d59280202b6b96b8894df9dd64ecc74d</guid>
      <description><![CDATA[If we had told you eight years ago, when 802.11b was really taking off, that one day in the future you would be able to pick up at least ten different wireless networks on any given block of a major...]]></description>
      <content:encoded><![CDATA[If we had told you eight years ago, when 802.11b was really taking off, that one day in the future you would be able to pick up at least ten different wireless networks on any given block of a major metropolitan city, you might have believed us.]]></content:encoded>
      <pubDate>Sun, 14 Sep 2008 09:30:02 +0000</pubDate>
      <category domain="http://securityratty.com/tag/major metropolitan city">major metropolitan city</category>
      <category domain="http://securityratty.com/tag/wireless networks">wireless networks</category>
      <category domain="http://securityratty.com/tag/11b">11b</category>
      <category domain="http://securityratty.com/tag/pick">pick</category>
      <category domain="http://securityratty.com/tag/ago">ago</category>
      <category domain="http://securityratty.com/tag/future">future</category>
      <category domain="http://securityratty.com/tag/day">day</category>
      <category domain="http://securityratty.com/tag/block">block</category>
      <source url="http://digg.com/security/Wireless_Security_In_Depth">Wireless Security In-Depth</source>
    </item>
    <item>
      <title><![CDATA[Cost/Benefit of Terrorism Security]]></title>
      <link>http://securityratty.com/article/3ef2fe47ba64d2a4788b864a136d04e7</link>
      <guid>http://securityratty.com/article/3ef2fe47ba64d2a4788b864a136d04e7</guid>
      <description><![CDATA[The terrifying cost of feeling safer ,&quot; from the Sydney Morning Herald : Sandler and his colleagues conducted an analysis of the costs and benefits of five different approaches to combating terrorism....]]></description>
      <content:encoded><![CDATA[<p>"<a href="http://business.smh.com.au/business/the-terrifying-cost-of-feeling-safer-20080826-435l.html">The terrifying cost of feeling safer</a>," from the <i>Sydney Morning Herald</i>:</p>

<blockquote>Sandler and his colleagues conducted an analysis of the costs and benefits of five different approaches to combating terrorism. I must warn you that, because of the dearth of information, this study is even more reliant on assumptions than usual. Even so, in three cases the cost of the action so far exceeds the benefits that doubts about the reliability of the estimates recede.

<p>Because the loss of life is so low, they measure the benefits of successful counter-terrorism measures in terms of loss of gross domestic product avoided. Trouble is, terrorism does little to disrupt economic growth, as even September 11 demonstrated.</p>

<p>Using the case of the US, Sandler estimates that simply continuing the present measures involves costs exceeding benefits by a factor of at least 10. Adopting additional defensive measures (such as stepping up security at valuable targets) would, at best, entail costs 3.5 times the benefits. Taking more pro-active measures (such as invading Afghanistan) would have costs at least eight times the benefits.</p>

<p>According to Sandler, only greater international co-operation, or adopting more sensitive foreign policies to project a more positive image abroad, could produce benefits greater than their (minimal) costs.</p>

<p>What's that? You don't care what it costs because no one can put a value on saving a human life? Heard of opportunity cost? Taxpayers' money we waste on excessive counter-terrorism measures is money we can't spend reducing the gap between white and indigenous health -- or, if that doesn't appeal, on buying Olympic medals.</blockquote></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=HIz7L"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=HIz7L" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=8TfcL"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=8TfcL" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Fri, 12 Sep 2008 02:32:33 +0000</pubDate>
      <category domain="http://securityratty.com/tag/measures involves costs">measures involves costs</category>
      <category domain="http://securityratty.com/tag/costs">costs</category>
      <category domain="http://securityratty.com/tag/measures">measures</category>
      <category domain="http://securityratty.com/tag/cost">cost</category>
      <category domain="http://securityratty.com/tag/benefits">benefits</category>
      <category domain="http://securityratty.com/tag/produce benefits">produce benefits</category>
      <category domain="http://securityratty.com/tag/pro-active measures">pro-active measures</category>
      <category domain="http://securityratty.com/tag/entail costs">entail costs</category>
      <category domain="http://securityratty.com/tag/additional defensive measures">additional defensive measures</category>
      <source url="http://www.schneier.com/blog/archives/2008/09/costbenefit_of.html">Cost/Benefit of Terrorism Security</source>
    </item>
    <item>
      <title><![CDATA[Nvidia hit with securities lawsuit over bad graphics chips]]></title>
      <link>http://securityratty.com/article/387fa799fe448b14c1ba86abd6a766cf</link>
      <guid>http://securityratty.com/article/387fa799fe448b14c1ba86abd6a766cf</guid>
      <description><![CDATA[A lawsuit filed in a California court on Tuesday alleged Nvidia violated U.S. securities laws and concealed the existence of a serious defect in its graphics-chip line for at least eight months &quot;in a...]]></description>
      <content:encoded><![CDATA[A lawsuit filed in a California court on Tuesday alleged Nvidia violated U.S. securities laws and concealed the existence of a serious defect in its graphics-chip line for at least eight months "in a series of false and misleading statements made to the investing public."<p><A href="http://ad.doubleclick.net/jump/idg.us.nwf.rss/general;sz=468x60;ord=61431?">
<IMG src="http://ad.doubleclick.net/ad/idg.us.nwf.rss/general;sz=468x60;ord=61431?" border="0" width="468" height="60"></A>
</p>]]></content:encoded>
      <pubDate>Tue, 09 Sep 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/lawsuit filed">lawsuit filed</category>
      <category domain="http://securityratty.com/tag/graphics-chip line">graphics-chip line</category>
      <category domain="http://securityratty.com/tag/nvidia">nvidia</category>
      <category domain="http://securityratty.com/tag/securities laws">securities laws</category>
      <category domain="http://securityratty.com/tag/california court">california court</category>
      <category domain="http://securityratty.com/tag/statements">statements</category>
      <category domain="http://securityratty.com/tag/false">false</category>
      <category domain="http://securityratty.com/tag/existence">existence</category>
      <category domain="http://securityratty.com/tag/tuesday">tuesday</category>
      <source url="http://www.networkworld.com/news/2008/091008-nvidia-hit-with-securities-lawsuit.html?fsrc=rss-security">Nvidia hit with securities lawsuit over bad graphics chips</source>
    </item>
    <item>
      <title><![CDATA[Microsoft patches 8 critical bugs in Windows, Office]]></title>
      <link>http://securityratty.com/article/13fbedeca572d53b5fbbff388240a90f</link>
      <guid>http://securityratty.com/article/13fbedeca572d53b5fbbff388240a90f</guid>
      <description><![CDATA[Microsoft has patched eight critical vulnerabilities in four separate security updates for Windows, Office, Windows Media Player, Internet Explorer 6, SQL Server and several other...]]></description>
      <content:encoded><![CDATA[Microsoft has patched eight critical vulnerabilities in four separate security updates for Windows, Office, Windows Media Player, Internet Explorer 6, SQL Server and several other programs.<br style="clear: both;"/>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v2:0ed0bd2e76cf3aece50f119a86996389:g6NJiLVqWPWKuhvx87ud%2FaIFkpnjNxByi%2BZuKUIi6A1TenNTUNi74g%2FF2sIwMITZ6royL5EiF%2BNaCuE7MfNuw6WrsvXG4u0PtIESnUfbqoU%3D'><img border='0' title='Add to digg' alt='Add to digg' src='http://www.pheedo.com/images/mm/digg.gif'/></a>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v2:beb6d43746c81a87674e7f76d3e9e700:7w%2FQamQX3KsjYQcNEJbPN5mcOxq3HQL%2BTfPbz8izNvvChfyL5g2YTPshdM074igHF4O6zwPhNYnz2yQzwEqMSULe%2Fi2DNMO087GSjfX3TUw%3D'><img border='0' title='Add to StumbleUpon' alt='Add to StumbleUpon' src='http://www.pheedo.com/images/mm/stumbleit.gif'/></a>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v2:7d01e4f2259e1848796937cdb309e9ec:PEdKtgM6mNekNmzttMZofUesx7RIrRqu%2BgJ%2Fw6DgJze6Cz6CZWTLuKrPjRNZIjgTXeEF69Y8SND%2FhemRTPPFSRk0LujwJ6FBSw8uKq4%2B%2FbU%3D'><img border='0' title='Add to Twitter' alt='Add to Twitter' src='http://www.pheedo.com/images/mm/twitter.png'/></a>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v2:8c90d3e5d95f8e487caa330f4e894947:YQYfk9iKcN9OVJ9HVBgab3L61P4bsJxIauvs6pz1pBuB%2FTl0U%2FRlIgK4mpqEop4HIRw%2FiXfkoguxWWseTYPUKf2b%2BaTA80B0pX0MvZ%2BQaGE%3D'><img border='0' title='Add to Slashdot' alt='Add to Slashdot' src='http://www.pheedo.com/images/mm/slashdot.png'/></a>
<br style="clear: both;"/>  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=3997db80f6ff3378dd6d2033a3e644cd" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=3997db80f6ff3378dd6d2033a3e644cd" style="display: none;" border="0" height="1" width="1" alt=""/>]]></content:encoded>
      <pubDate>Tue, 09 Sep 2008 09:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/windows">windows</category>
      <category domain="http://securityratty.com/tag/windows media player">windows media player</category>
      <category domain="http://securityratty.com/tag/sql server">sql server</category>
      <category domain="http://securityratty.com/tag/internet explorer">internet explorer</category>
      <category domain="http://securityratty.com/tag/microsoft">microsoft</category>
      <category domain="http://securityratty.com/tag/office">office</category>
      <category domain="http://securityratty.com/tag/critical vulnerabilities">critical vulnerabilities</category>
      <category domain="http://securityratty.com/tag/programs">programs</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <source url="http://feeds.computerworld.com/click.phdo?i=3997db80f6ff3378dd6d2033a3e644cd">Microsoft patches 8 critical bugs in Windows, Office</source>
    </item>
    <item>
      <title><![CDATA[inNOvation]]></title>
      <link>http://securityratty.com/article/1cd8dbd3a11c8ad7a25d72724c2bece8</link>
      <guid>http://securityratty.com/article/1cd8dbd3a11c8ad7a25d72724c2bece8</guid>
      <description><![CDATA[It is amazing to me that in a seemingly tight Presidential race that NEITHER candidate has made innovation an issue, this article from the NYT on former Cisco CTO Judy Estrin

I am generally not an...]]></description>
      <content:encoded><![CDATA[<p>It is amazing to me that in a seemingly tight Presidential race that NEITHER candidate has made innovation an issue, this <a href="http://www.nytimes.com/2008/09/01/technology/01estrin.html">article</a> from the NYT on former Cisco CTO Judy Estrin:</p><br /><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: Georgia; font-size: 15px; line-height: 22px; ">“I am generally not an alarmist, but I have become more and more concerned about the state of our country and its innovation,” she said last week, explaining why she wrote her book, “Closing the Innovation Gap,” which arrives in bookstores Tuesday. “We have a national innovation deficit.”</span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: Georgia; font-size: 15px; line-height: 22px;"><br /></span><span style="font-family: Georgia; font-size: 15px; line-height: 22px; ">Ms. Estrin’s book is the latest call to action during the last several years by scientists, technologists and political leaders worried about the country’s future competitiveness in technology.</span><br /><span style="font-family: Georgia; font-size: 15px; line-height: 22px; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: Georgia; font-size: 15px; line-height: 22px; ">In 2005, the National Academies published “Rising Above the Gathering Storm,” a report requested by Congress, which found that federal financing of research in the physical sciences was 45 percent less in 2004 than in 1976 and that 93 percent of students in grades five through eight learn science from teachers who do not hold degrees or certifications in the topics.</span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: Georgia; font-size: 15px; line-height: 22px;">...</span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: Georgia; font-size: 15px; line-height: 22px;">“There is a remarkable telescoping in of vision and an unwillingness to make long-term bets,” said Vinton G. Cerf, the chief Internet evangelist at&#160;<a href="http://topics.nytimes.com/top/news/business/companies/google_inc/index.html?inline=nyt-org" style="color: #004276; text-decoration: underline; " title="More information about Google Inc">Google</a>.<br /></span></p></blockquote><p><span style="font-family: Georgia; font-size: 15px; line-height: 22px;"><br />Geez, its like no one ever read </span><a href="http://www.edgeperspectives.com/index3.shtml">&quot;The Only Sustainable Edge&quot;</a><span style="font-family: Georgia; font-size: 15px; line-height: 22px;"> or something...<br /></span></p><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: Georgia; font-size: 15px; line-height: 22px;"><br /></span></p></blockquote>]]></content:encoded>
      <pubDate>Tue, 02 Sep 2008 10:20:54 +0000</pubDate>
      <category domain="http://securityratty.com/tag/innovation">innovation</category>
      <category domain="http://securityratty.com/tag/national innovation deficit">national innovation deficit</category>
      <category domain="http://securityratty.com/tag/innovation gap">innovation gap</category>
      <category domain="http://securityratty.com/tag/chief internet evangelist">chief internet evangelist</category>
      <category domain="http://securityratty.com/tag/estrins book">estrins book</category>
      <category domain="http://securityratty.com/tag/book">book</category>
      <category domain="http://securityratty.com/tag/countrys future competitiveness">countrys future competitiveness</category>
      <category domain="http://securityratty.com/tag/percent">percent</category>
      <category domain="http://securityratty.com/tag/long-term bets">long-term bets</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/09/innovation.html">inNOvation</source>
    </item>
    <item>
      <title><![CDATA[Best Western Hotel Online Booking Breached, 8 Million Victims In Personal Data Theft]]></title>
      <link>http://securityratty.com/article/1e268670aae5d79f21ac2627114fd3b4</link>
      <guid>http://securityratty.com/article/1e268670aae5d79f21ac2627114fd3b4</guid>
      <description><![CDATA[Criminal gang has stolen the identities of an estimated eight million people in a hacking raid that could ultimately net more than 2.8billion in illegal funds. Thursday night, an unknown hacker,...]]></description>
      <content:encoded><![CDATA[Criminal gang has stolen the identities of an estimated eight million people in a hacking raid that could ultimately net more than £2.8billion in illegal funds. Thursday night, an unknown hacker, possibly indian, successfully breached the IT defences of the Best Western Hotel group&#8217;s online booking system and sold details of how to access it [...]]]></content:encoded>
      <pubDate>Mon, 25 Aug 2008 09:57:47 +0000</pubDate>
      <category domain="http://securityratty.com/tag/western hotel">western hotel</category>
      <category domain="http://securityratty.com/tag/unknown hacker">unknown hacker</category>
      <category domain="http://securityratty.com/tag/possibly indian">possibly indian</category>
      <category domain="http://securityratty.com/tag/thursday night">thursday night</category>
      <category domain="http://securityratty.com/tag/million people">million people</category>
      <category domain="http://securityratty.com/tag/online">online</category>
      <category domain="http://securityratty.com/tag/ultimately net">ultimately net</category>
      <category domain="http://securityratty.com/tag/criminal gang">criminal gang</category>
      <category domain="http://securityratty.com/tag/illegal funds">illegal funds</category>
      <source url="http://cyberinsecure.com/best-western-hotel-online-booking-breached-8-million-victims-in-personal-data-theft/">Best Western Hotel Online Booking Breached, 8 Million Victims In Personal Data Theft</source>
    </item>
    <item>
      <title><![CDATA[Eight Steps to Responsible Surfing]]></title>
      <link>http://securityratty.com/article/a72ad36f246a9ff490930a87868f7ede</link>
      <guid>http://securityratty.com/article/a72ad36f246a9ff490930a87868f7ede</guid>
      <description><![CDATA[Web threats and attacks will continue to evolve, but surfers can protect themselves against the majority of malicious code by following eight different steps. To provide the greatest degree of...]]></description>
      <content:encoded><![CDATA[<div><strong></strong>Web threats and attacks will continue to evolve, but surfers can protect themselves against the majority of malicious code by following eight different steps. To provide the greatest degree of security, surfers cannot rely entirely on technology, and should also address the behavioral issues that are most likely to create risky situations.</div>
<p><strong>Changing Behavior</strong></p>
<div>The safest way to deal with a danger is avoidance. By surfing safely and adapting offline sensibilities online, surfers can greatly reduce their danger of exposure to malware.</div>
<p><strong>1. Educate yourself.</strong><br />
At least every 6 to 12 months, surfers should browse the educational information provided by their operating system and security vendors and subscribe to any security-related newsletters they might offer. According to David Perry, familiarity with the latest threats, dangers, and recommended safety tips will allow surfers to make safe choices. &#8220;Until you know what&#8217;s out there, you&#8217;re just flying blind. Without an education, you&#8217;re wide open&#8221;.<br />
<strong>2. Avoid suspect sites.</strong><br />
While criminals can infect even mainstream Web sites, sites such as gambling sites, adult Internet sites, and illegal file-sharing sites are far more likely to carry malicious code. Web sites that offer &#8220;something for nothing&#8221; frequently recoup their losses by infecting visitors&#8217; PCs.<br />
<strong>3. Lose Your Comfort Zone.</strong></p>
<div>Web surfers should migrate their offline precautions to their online experience. By beginning with an attitude of healthy skepticism and only doing business with trusted Web sites, surfers can bypass a good deal of risk.</div>
<p><strong>Recommended Technology</strong></p>
<div>Despite the best precautions, every user will encounter Web-based malware. While no technology can guarantee protection against all attacks, a combination of preventive technologies provides the most comprehensive protection possible.</div>
<p><strong>4. Use an updated virus scanning suite.</strong><br />
The most important component of any threat mitigation system is a virus scanning suite. In addition to detecting and removing known viruses and malware, modern virus scanning suites provide additional protections against new attacks by disabling their known protocols. For example, Trend Micro™ Internet Security encrypts keyboard traffic, protecting personal data from keyboard logging programs that might go unnoticed. Users should update their scanner and virus definitions as frequently as possible to ensure the best possible coverage.<br />
<strong>5. Upgrade your OS and browser.</strong><br />
In addition to offering more features, Microsoft&#8217;s Internet Explorer version 7 and the latest Mozilla Firefox are both substantially more secure than previous-generation browsers. Users of older browsers should upgrade immediately to take advantage of increased security. Similarly, Windows Vista and Mac OS X are more secure than their predecessors, and users of older operating systems should consider upgrading, as well.<br />
<strong>6. Disable scripting and &#8220;widgets.&#8221;</strong><br />
Many Web-based attacks use various scripting languages to run infectious programs in a browser or use downloadable &#8220;widgets&#8221; to execute infections locally. By disabling scripting and avoiding downloadable widgets wherever possible, surfers disable these common attack vectors.<br />
<strong>7. Rate your Web pages.</strong><br />
Some available services rate the risk of Web pages in search results, allowing surfers to avoid unwanted content and hidden threats before viewing the pages. Rating applications (e.g., Trend Micro TrendProtect™) consume few system resources and run unobtrusively, so they are suitable for any Web-enabled personal computer.<br />
<strong>8. Ask your provider.</strong><br />
Commerce companies, banks, and credit card associations are all interested in computer security, and many offer additional features. For example, Visa&#8217;s Verified By Visa program requires cardholders to enter a second password to identify themselves during a transaction, while businesses in Poland require cell-phone confirmation of credit card purchases. While nothing will be 100 percent effective, any additional security measure provided by a trusted source will increase protection, and surfers should adopt as many as possible.</p>
<p>This article provided for your reading pleasure by Trend Micro.</p>
]]></content:encoded>
      <pubDate>Wed, 06 Aug 2008 20:30:41 +0000</pubDate>
      <category domain="http://securityratty.com/tag/mainstream web sites">mainstream web sites</category>
      <category domain="http://securityratty.com/tag/sites">sites</category>
      <category domain="http://securityratty.com/tag/adult internet sites">adult internet sites</category>
      <category domain="http://securityratty.com/tag/web sites">web sites</category>
      <category domain="http://securityratty.com/tag/web surfers">web surfers</category>
      <category domain="http://securityratty.com/tag/surfers">surfers</category>
      <category domain="http://securityratty.com/tag/surfers disable">surfers disable</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/computer security">computer security</category>
      <source url="http://spywarebiz.com/spywarebizblog/?p=536">Eight Steps to Responsible Surfing</source>
    </item>
    <item>
      <title><![CDATA[Daniel Solove on the New FISA Law]]></title>
      <link>http://securityratty.com/article/d22a0af73b41ad2a7e688547d4f91208</link>
      <guid>http://securityratty.com/article/d22a0af73b41ad2a7e688547d4f91208</guid>
      <description><![CDATA[From his blog : Future presidents can learn a lot from all this -- do exactly what the Bush Administration did! If the law holds you back, don't first go to Congress and try to work something out....]]></description>
      <content:encoded><![CDATA[From <a href="http://www.concurringopinions.com/archives/2008/07/the_new_foreign.html">his blog</a>:

<blockquote>Future presidents can learn a lot from all this -- do exactly what the Bush Administration did! If the law holds you back, don't first go to Congress and try to work something out. Secretly violate that law, and then when you get caught, staunchly demand that Congress change the law to your liking and then immunize any company that might have illegally cooperated with you. That's the lesson. You spit in Congress's face, and they'll give you what you want. 

The past eight years have witnessed a dramatic expansion of Executive Branch power, with a rather anemic push-back from the Legislative and Judicial Branches. We have extensive surveillance on a mass scale by agencies with hardly any public scrutiny, operating mostly in secret, with very limited judicial oversight, and also with very minimal legislative oversight. Most citizens know little about what is going on, and it will be difficult for them to find out, since everything is kept so secret. Secrecy and accountability rarely go well together. The telecomm lawsuits were at least one way that citizens could demand some information and accountability, but now that avenue appears to be shut down significantly with the retroactive immunity grant. There appear to be fewer ways for the individual citizen or citizen advocacy groups to ensure accountability of the government in the context of national security. 

That's the direction we're heading in -- more surveillance, more systemic government monitoring and data mining, and minimal oversight and accountability -- with most of the oversight being very general, not particularly rigorous, and nearly always secret -- and with the public being almost completely shut out of the process. But don't worry, you shouldn't get too upset about all this. You probably won't know much about it. They'll keep the dirty details from you, because what you don't know can't hurt you.</blockquote><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=XLl6mJ"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=XLl6mJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=Uy3eLJ"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=Uy3eLJ" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Mon, 14 Jul 2008 08:08:40 +0000</pubDate>
      <category domain="http://securityratty.com/tag/minimal legislative oversight">minimal legislative oversight</category>
      <category domain="http://securityratty.com/tag/oversight">oversight</category>
      <category domain="http://securityratty.com/tag/law">law</category>
      <category domain="http://securityratty.com/tag/ensure accountability">ensure accountability</category>
      <category domain="http://securityratty.com/tag/accountability">accountability</category>
      <category domain="http://securityratty.com/tag/minimal oversight">minimal oversight</category>
      <category domain="http://securityratty.com/tag/congress">congress</category>
      <category domain="http://securityratty.com/tag/accountability rarely">accountability rarely</category>
      <category domain="http://securityratty.com/tag/legislative">legislative</category>
      <source url="http://www.schneier.com/blog/archives/2008/07/daniel_solove_o.html">Daniel Solove on the New FISA Law</source>
    </item>
    <item>
      <title><![CDATA[Montgomery Ward breached, no notification obligation?]]></title>
      <link>http://securityratty.com/article/d0a7010fb8fd83b7750424b96154c42b</link>
      <guid>http://securityratty.com/article/d0a7010fb8fd83b7750424b96154c42b</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
6/27/08

Organization
Direct Marketing Services Inc

Contractor/Consultant/Branch
Montgomery Ward
HomeVisions.com
SearsHomeCenter.com
SearsShowPlace.com...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/wards.jpg" width="200" align="right" height="50"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>6/27/08<br><br><span style="font-weight: bold;">Organization: </span><br>Direct Marketing Services Inc.<br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://www.wards.com/wards/default.asp">Montgomery Ward</a> <br><a href="http://www.homevisions.com/hvprod/Default.asp">HomeVisions.com</a> <br><a href="http://www.searshomecenter.com/homecenter/default.asp">SearsHomeCenter.com</a> <br><a href="http://www.searsshowplace.com/showplace/default.asp">SearsShowPlace.com</a> <br><a href="http://www.searsroomforkids.com/roomforkids/default.asp?partner=0">SearsRoomForKids.com</a> <br><br><span style="font-weight: bold;">Victims:</span><br>Customers<br><br><span style="font-weight: bold;">Number Affected:</span><br>"at least 51,000 records"<br><br><span style="font-weight: bold;">Types of Data:</span><br>Names, addresses, phone numbers, card numbers, "security codes", and expiration dates<br><br><span style="font-weight: bold;">Breach Description:</span><br>"NEW YORK (AP) -- The parent company of Montgomery Ward is admitting that it was hit with a credit card hack, but it didn't inform the customers affected."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://ap.google.com/article/ALeqM5hMgFbRpfc74PW0CvbF3kFbWFkHsAD91IJCHG2">The Associated Press</a> <br><a href="http://www.wztv.com/template/inews_wire/wires.national/2c50aedd-www.fox17.com.shtml">The Associated Press via WZTV Channel 17 News</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>The Associated Press<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>At least 51,000 records were exposed in the breach at the parent company of Montgomery Ward.<br><br>The venerable Wards chain that began in 1872 went out of business in 2001, but in 2004 a catalog company, Direct Marketing Services Inc., bought the brand name out of bankruptcy.<br><br>Direct Marketing Services' CEO, David Milgrom, said the financial company Citigroup detected the computer invasion in December.<br><br>By going through HomeVisions.com, another Direct Marketing Services site, hackers had plundered the database that holds account information for all the company's retail properties.<br><span style="font-style: italic;">[Evan] The AP story names five of the six Direct Marketing Services retail properties (See Above).&nbsp; I don't know what the sixth is.</span><br style="font-style: italic;"><br>It now runs a Wards.com Web site along with six other sites, including three with Sears brands it has acquired: SearsHomeCenter.com, SearsShowplace.com and SearsRoomforKids.com<br><br>Milgrom said Direct Marketing Services immediately informed its payment processor and Visa and MasterCard.<br><br>Direct Marketing Services closely followed a set of guidelines, issued by Visa, on how to respond to a security breach.<br><span style="font-style: italic;">[Evan] This is sad.&nbsp; The Visa documentation regarding breach response is way too narrowly focused to be used as an organizational incident response.&nbsp; Every organization that creates, collects, uses, stores, and/or transfers confidential information should have an incident response policy and accompanying procedures.&nbsp; Take a look at the Visa "</span><a style="font-style: italic;" href="http://usa.visa.com/download/merchants/cisp_what_to_do_if_compromised.pdf?it=r%7C/merchants/risk_management/cisp_if_compromised.html%7CWhat%20to%20Do%20If%20Compromised">What To Do if Compromised</a><span style="font-style: italic;">" procedures, and judge for yourself.</span><br style="font-style: italic;"><br>That included a report to the U.S. Secret Service.<br><br>He said he believed by the end of December that Direct Marketing Services had met its obligations.<br><span style="font-style: italic;">[Evan] Mr. Milgrom is the president of the company.&nbsp; He really thought that his company had met all of its obligations with respect to this breach?&nbsp; It never occurred to him that he should notify customers, even if he weren't required to by law?&nbsp; Not only was the lack of notification illegal, but I think it is also unethical.</span><br style="font-style: italic;"><br>However, those guidelines from Visa are largely technical, and they do not cover a key additional step: that notification laws in nearly every state generally require organizations that have been hacked to come clean to the affected consumers, not just to the financial industry.<br><br>Companies that fail to comply can be hit with fines or be sued by affected customers, depending on the state<br><br>After being asked about those laws by The Associated Press, Milgrom said Direct Marketing Services now plans to contact consumers.<br><br>This hack might have stayed quiet except for online chatter detected in June by Affinion Group Inc.'s CardCops, a group of investigators who track payment-card theft for financial institutions.<br><br>In Internet chat rooms frequented by card thieves, CardCops spotted hackers touting the sale of 200,000 payment cards belonging to one merchant.<br><br>CardCops then intercepted several hundred of the records, along with the online handles belonging to hackers whose real names remain unknown.<br><br>Along with the card numbers, their three-digit "security codes" and expiration dates, the thieves had the cardholders' names, addresses and phone numbers.<br><br>The data had been organized in the same way, indicating the numbers likely came from the same database.<br><br>CardCops' president, Dan Clements, also noticed that the vast majority of the cardholders were women, a clue that the records came from a merchant catering to a certain demographic.<br><br>When he began calling them, the first eight said they had bought things online or through mail order from Montgomery Ward. At that point, Clements realized, "there's a high probability the entire database of Montgomery Ward was breached."<br><span style="font-style: italic;">[Evan] This is some good investigative work.</span><br><br>It is not clear to Clements, though, whether the hackers were inflating their claim when they offered 200,000 records or whether Milgrom's number of 51,000 is accurate.<br><span style="font-style: italic;">[Evan] According to the article, the "hackers" were able to compromise the information from all six Direct Marketing Services, Inc. properties.&nbsp; 51,000 may be Montgomery Wards customer accounts, and the remainder could be from the other five properties (just speculating).</span><br style="font-style: italic;"><br>A spokeswoman for Discover Financial Services LLC, Mai Lee Ua, said her company had addressed the problem by sending new cards to its cardholders who appeared in the compromised records.<br><br>Ua said they weren't told which merchant had been breached<br><br>Visa declined to comment.<br><span style="font-style: italic;">[Evan] Visa always declines to comment.&nbsp; No sense in even seeking one.</span><br><br>MasterCard issued a statement Friday acknowledging it was aware of the breach at Direct Marketing Services, and had notified the banks that issue MasterCards, telling them to monitor the accounts for suspicious charges.<br><span style="font-style: italic;">[Evan] Three different card companies, three entirely different responses.&nbsp; Of the three, I think I like the Discover one the best.</span><br style="font-style: italic;"><br>Such silence was the norm in the industry for years. But in response to fears of identity theft, 44 states have passed laws that generally require organizations holding consumer data to tell people when their information has leaked<br><br>Clements and other security analysts say that despite those laws, many breaches still are kept quiet, judging by the data being hawked in online black markets.<br><br>Avivah Litan, an analyst at Gartner Inc., believes unreported data breaches might still outnumber the ones that do get publicized.<br><span style="font-style: italic;">[Evan] I absolutely agree.&nbsp; You would be naïve to think that victim notifications go out in all breaches.&nbsp; Too many corporate leaders would rather not notify and hope that nobody notices.</span><br style="font-style: italic;"><br>Litan says it especially is the case with online merchants. She believes it happens because of a lack of pressure from credit card companies, which are not responsible for fraudulent charges in "card not present" transactions over the Web and mail order.<br><br>Until fraud actually appears on the card, they'd rather avoid the cost of voiding compromised cards and giving consumers new ones, she said.<br><br>"What it reveals is the convoluted banking system," she said. "If this had taken place at a grocery store, we all would have heard about it."<br><br>In fact, because of the silence that still sometimes follows data breaches, even people who have never been informed one of their records has leaked should assume their information is floating online, Litan said.<br><br>"Probably every one of our cards is up there somewhere now," she said.<br><span style="font-style: italic;">[Evan] I agree with all of the statements made by Avivah Litan except this one.&nbsp; This is a stretch.</span><br><br><span style="font-weight: bold;">On the Net:</span><br>Links to the <a href="http://www.ncsl.org/programs/lis/cip/priv/breachlaws.htm">44 state notification laws</a> <br><br><span style="font-weight: bold;">Commentary:</span><br>Is this a case of a company that was caught trying to cover up a breach, or was this a company that didn't know any better?&nbsp; </font><font size="2">I lean towards the former.&nbsp; </font><font size="2">Either way, is ignorance of the law any kind of valid excuse?&nbsp; <br><br>Let's assume for a second that company really didn't know that they were required to notify victims.&nbsp; If this were true, then this leads me to believe that the company doesn't govern information security well (due care?), probably has no formal information security program, lacks incident response policy and procedures, and doesn't manage risk well.<br><br>I could only guess how the "hack" took place.&nbsp; What vulnerability was exploited?&nbsp; Even in this, the company appears to have not detected the attack.&nbsp; </font><font size="2">Direct Marketing Services, Inc. had to be told of it by Citibank.&nbsp; </font><font size="2">Does this mean that the company did not use intrusion detection/prevention?&nbsp; <br><br>I could go on and on, but in the end I don't have much confidence here. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/06/27/wards.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Fri, 27 Jun 2008 19:45:03 +0000</pubDate>
      <category domain="http://securityratty.com/tag/card companies">card companies</category>
      <category domain="http://securityratty.com/tag/companies">companies</category>
      <category domain="http://securityratty.com/tag/services">services</category>
      <category domain="http://securityratty.com/tag/services closely">services closely</category>
      <category domain="http://securityratty.com/tag/credit card companies">credit card companies</category>
      <category domain="http://securityratty.com/tag/services retail properties">services retail properties</category>
      <category domain="http://securityratty.com/tag/financial company citigroup">financial company citigroup</category>
      <category domain="http://securityratty.com/tag/company">company</category>
      <category domain="http://securityratty.com/tag/montgomery ward">montgomery ward</category>
      <source url="http://breachblog.com/2008/06/27/wards.aspx">Montgomery Ward breached, no notification obligation?</source>
    </item>
  </channel>
</rss>
