<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: emerges]]></title>
    <link>http://securityratty.com/tag/emerges</link>
    <description></description>
    <pubDate>Wed, 16 Jan 2008 21:00:00 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[NAPA Shows How the Government is Using Web 2.0]]></title>
      <link>http://securityratty.com/article/c2382eef0b0cdb073ef226ac74ecee5b</link>
      <guid>http://securityratty.com/article/c2382eef0b0cdb073ef226ac74ecee5b</guid>
      <description><![CDATA[Back in April, we attended a session at the FOSE conference that highlighted Web 2.0 usage in the public sector . We also found through a survey of government workers that 65% of government IT workers...]]></description>
      <content:encoded><![CDATA[<p>Back in April, we attended a session at the <a href="http://blog.sciencelogic.com/fose-session-web-20-for-the-public-sector/04/2008" target="_blank">FOSE conference that highlighted Web 2.0 usage in the public sector</a>. We also found <a href="http://blog.sciencelogic.com/web-20-adoption-by-the-federal-government-shouldnt-be-a-surprise/06/2008" target="_blank">through a survey of government workers</a> that 65% of government IT workers surveyed said that Web 2.0 tools are important to their operations. The overall message was that all IT, government included, have too many projects they could be taking on for the amount of resources they have. For much of the IT topics we covered in the survey, importance was high but actual deployment was lower.
<p>Dan Munz, project manager of the <a href="http://www.collaborationproject.org/" target="_blank">Collaboration Project</a> commented on <a href="http://www.collaborationproject.org/display/home/Collaboration+Project+Blog" target="_blank">the unique work</a> that the National Academy of Public Administration (NAPA) is doing to bring together government leaders. The Collaboration Project seeks to innovate across government not just down the silos and create a safe place for leaders to have discussions around innovation.
<p><strong><em>ScienceLogic:</em></strong> What is the National Academy of Public Administration?
<p><strong><em>Dan Munz:</em></strong> The Academy is an independent, non-partisan, non-profit organization dedicated to tackling government&#8217;s most complex challenges. We were founded in 1967 by James Webb, the NASA administrator who took us to the moon – he saw that he could consult the National Academy of Sciences for expert technical advice, but had no counterpart in government for expert management advice. That&#8217;s been our mission ever since.
<p><strong><em>ScienceLogic:</em></strong> What is the Collaboration Project? How long has it been around?
<p><strong><em>Dan Munz:</em></strong> The Collaboration Project is the Academy&#8217;s response to two parallel trends we see in government. The first is the government’s need to transform the way it does business. There is a strong demand for change out there driven by a number of challenges that are forcing the government to rethink its mission and structure. Challenges include a public disconnected from government; a multi-sector workforce and increasing reliance on contractors; financial instability; and new types of security threats, just to name a few. More and more, the challenges facing government reach across the traditional boundaries of agency and mission. But government isn&#8217;t configured to work that way.
<p>The second trend is the unprecedented opportunity collaborative technology offers to drive transformational change in government. Tools like blogs, wikis, and mashups are changing the way leaders think about problems. They&#8217;re focusing not on what they can do just within their offices or agencies, but what voices they need to pull together across government, non-profits, the general citizenry, and other stakeholders to solve these problems. The Collaboration Project’s goal is to encourage this type of thinking and empower leaders committed to use collaborative technology to:
<ul>
<li>strengthen citizen civic engagement;</li>
<li>enhance government transparency;</li>
<li>improve service delivery and operational efficiency; and</li>
<li>facilitate coordination and innovation within and between agencies.</li>
</ul>
<p><strong><em>ScienceLogic:</em></strong> Why focus on Web 2.0 in the government?
<p><strong><em>Dan Munz:</em></strong> The question of how web 2.0 will impact federal IT departments is a critical one. Our view is that &#8220;the era of big systems&#8221; is basically over. Things like disk space, bandwidth, and computing power are basically shifting from being assets to being commodities.
<p>There&#8217;s also a shift in expectations. People both inside and outside government – especially Gen-X and Gen-Y – are incredibly frustrated by being able to use lightning-fast apps like Flickr, YouTube, and Facebook <i>that don&#8217;t even live on their hard drives</i> while the government and other large organizations still operate clunky PCs, space-limited e-mail accounts, and sluggish e-mail servers.
<p>So aside from the opportunity for transformative leadership, the idea of web 2.0 at a government level is very appealing in terms of getting the most out of the IT infrastructure we already have, rather than embarking on costly, large-scale projects in an era of diminishing budgets.
<p><strong><em>ScienceLogic:</em></strong> How do you build a sense of community at the Collaboration Project?
<p><strong><em>Dan Munz:</em></strong> Some community feel emerges naturally, from a sense that mass collaboration really is a tool for &#8220;doing government&#8221; in a whole new way.
<p>The more formal community building mechanisms we have include <a href="http://www.collaborationproject.org" target="_blank">our web page</a>, where we share insights, news, case studies, and other content – The virtual space serves as an anchor for people, whether they&#8217;re experts or beginners, to learn about what we do.
<p>Finally, we are conducting an ongoing series of in-person meetings, usually featuring a leader who has harnessed collaborative technology in what we think is a truly revolutionary new way.
<p><strong><em>ScienceLogic:</em></strong> How do you hear about cool new government Web 2.0 projects?
<p><strong><em>Dan Munz:</em></strong> That&#8217;s a key question, because part of our mission is to inspire action by finding leaders who have succeeded and highlight their accomplishments. We&#8217;ve done that with folks like Kip Hawley, TSA, Molly O&#8217;Neill, EPA, and Jim Walker, Alabama DHS.
<p>We also feel that the Academy&#8217;s position as a &#8220;safe space&#8221; for leaders means that we&#8217;re a place people can turn to when they hear about an emerging trend or project and want some help making sense of it.
<p><strong><em>ScienceLogic:</em></strong> What are the most innovative uses of Web 2.0 technology you&#8217;ve seen in the government?
<p><strong><em>Dan Munz:</em></strong> It&#8217;s important to distinguish between agencies that are simply adjusting to the reality of web 2.0, and those that are &#8220;using&#8221; it. Getting a YouTube account for your agency, or putting some photos on Flickr, is a great first step, but we want to inspire leaders to really transform their normal ways of doing business. At the moment a few that come to mind are the EPA Puget Sound Mashup, ODNI&#8217;s Intellipedia, TSA IdeaFactory, the PTO Peer-to-Patent Project, and Virtual Alabama, to name a few.
<p>The <a href="http://www.fcw.com/print/22_5/features/151791-1.html" target="_blank">TSA launched the IdeaFactory</a> in February 2008. TSA set up a collaboration platform with commenting, voting, etc. to form communities in a way to bring people to consensus and <a href="http://www.collaborationproject.org/pages/viewpage.action?pageId=5668923&amp;navigatingVersions=true" target="_blank">offer ways to improve the agency&#8217;s performance</a>.
<p><strong><em>ScienceLogic:</em></strong> Do you see a difference between state and local versus federal adoption of Web 2.0?
<p><strong><em>Dan Munz:</em></strong> That&#8217;s a hard generalization to make – at all levels you see leaders who recognize the potential in this technology to bring new voices into the governance process.
<p><strong><em>ScienceLogic:</em></strong> What are the obstacles to Web 2.0 adoption by government agencies?
<p><strong><em>Dan Munz:</em></strong> The three main challenges that we see are in the areas of technology, culture, and policy/governance.
<p>The technology issue is probably the simplest to solve – it&#8217;s important to choose a technology that fits the problem you&#8217;re trying to solve, but these technologies are usually inexpensive and almost never very complex.
<p>The question of culture is harder, particularly given the way that baby boomers, gen-xers, and millenials are beginning to interact in the workforce. How do you gain acceptance and buy-in among groups that have very different comfort levels with collaborative tools and environments?
<p>Finally, the most daunting challenge might be the questions of policy and governance, if only because those are the things that most commonly prevent leaders from even dipping a toe in the waters of collaboration. Most of the policies, regulations, and statutes governing the way government does business don&#8217;t anticipate things like wikis, blogs, or instant messaging. One of our most important missions is helping leaders who just want to get to action navigate these obstacles.
<p><strong><em>ScienceLogic:</em></strong> Is there any advice you can give to government employees getting started with Web 2.0? Or any places you would point them to for more info?
<p><strong><em>Dan Munz:</em></strong> It&#8217;s shameless plug time! I&#8217;d of course point them to our web page, <a href="http://collaborationproject.org/">collaborationproject.org</a>, where, among other things, we&#8217;ve collected a case library of over 40 instances of collaborative technology being used in the government and non-profit sectors. The library is growing every day and is a sort of &#8220;database of record&#8221; for what is and isn&#8217;t working in terms of collaborative government. I think that would be a great place to start for anyone looking to get started but not really knowing the way.
<p>In terms of advice, the best thing to say is that, once you&#8217;ve settled on a problem you want to solve and an audience you want to reach out to, <b>just do it</b>! We believe strongly that there are a lot of organizational and leadership issues that still need to be addressed regarding collaboration in government, but our biggest mantra is about getting leaders to action. The most successful projects we&#8217;ve seen are ones that try something daring and new, and discover the true power of what they&#8217;ve done as it catches on more and more widely.</p>
<p><a href="http://sharethis.com/item?&wp=abc&amp;publisher=ea11358c-69de-4e80-9804-e964a8930b70&amp;title=NAPA+Shows+How+the+Government+is+Using+Web+2.0&amp;url=http%3A%2F%2Fblog.sciencelogic.com%2Fnapa-shows-how-the-government-is-using-web-20%2F07%2F2008">ShareThis</a></p>]]></content:encoded>
      <pubDate>Wed, 16 Jul 2008 16:45:37 +0000</pubDate>
      <category domain="http://securityratty.com/tag/web">web</category>
      <category domain="http://securityratty.com/tag/government">government</category>
      <category domain="http://securityratty.com/tag/web page">web page</category>
      <category domain="http://securityratty.com/tag/government web">government web</category>
      <category domain="http://securityratty.com/tag/collaboration">collaboration</category>
      <category domain="http://securityratty.com/tag/mass collaboration">mass collaboration</category>
      <category domain="http://securityratty.com/tag/collaboration project seeks">collaboration project seeks</category>
      <category domain="http://securityratty.com/tag/government employees">government employees</category>
      <category domain="http://securityratty.com/tag/enhance government transparency">enhance government transparency</category>
      <source url="http://blog.sciencelogic.com/napa-shows-how-the-government-is-using-web-20/07/2008">NAPA Shows How the Government is Using Web 2.0</source>
    </item>
    <item>
      <title><![CDATA[Terror on the Internet - Conflict of Interest]]></title>
      <link>http://securityratty.com/article/4d84e41b4c977b7092f8d353c8e6895e</link>
      <guid>http://securityratty.com/article/4d84e41b4c977b7092f8d353c8e6895e</guid>
      <description><![CDATA[Insightful article by Greg Goth, discussing various aspects of the pros and cons of monitoring cyber jihadist sites next to shutting them down, as well as mentioning my analysis of the Mujahideen...]]></description>
      <content:encoded><![CDATA[<div><a href="http://bp0.blogger.com/_wICHhTiQmrA/R9G7dU-0F6I/AAAAAAAABcQ/1bS4lvI4w-M/s1600-h/terrorist_database_hoax.jpg"><img id="BLOGGER_PHOTO_ID_5175123559348180898" style="margin: 0px 10px 10px 0px; float: left;" alt="" src="http://bp0.blogger.com/_wICHhTiQmrA/R9G7dU-0F6I/AAAAAAAABcQ/1bS4lvI4w-M/s200/terrorist_database_hoax.jpg" border="0" /></a>Insightful article by Greg Goth, discussing various aspects of the pros and cons of monitoring cyber jihadist sites next to shutting them down, as well as mentioning <a href="http://ddanchev.blogspot.com/2008/01/mujahideen-secrets-2-encryption-tool.html">my analysis</a> of the <a href="http://ddanchev.blogspot.com/2007/04/mujahideen-secrets-encryption-tool.html">Mujahideen Secrets encryption tool v1.0</a> and v2.0. <a href="http://dsonline.computer.org/portal/pages/dsonline/2008/03/o3003news.html">Terror on the Internet: A Complex Issue, and Getting Harder</a> :</div><br />"<em>Indeed, politicians around the world call at regular intervals for terrorist websites to be removed from their host sites’ servers or for search engines to block access to them. They also call for laws that would make posting instructions on how to kill or maim people or destroy property punishable by law. Franco Frattini, the European Commission’s Vice President for Freedom, Justice, and Security, </em><a href="http://europa.eu/rapid/pressReleasesAction.do?reference=SPEECH/07/505&amp;format=HTML&amp;aged=0&amp;language=EN&amp;guiLanguage=en"><em>called for a prohibition on websites that post bomb-making instructions in September 2007</em></a><em>. And just as quickly, he rushed to announce that in doing so he was not trying to impinge on freedom of speech or information access or to inhibit law enforcement agencies from monitoring sites.</em>"<br /><br /><div>There're three perspectives related to cyber jihad, should the virtual communities be shut down, monitored, or censored so that they cannot be accessed by people who would potentially get radicalized and brainwashed by the amazingly well created propaganda in the form of interactive multimedia? Given the different mandates given to different intelligence services and independent researchers, is where the conflict of interest begins. Moreover, don't forget that independent researchers sometimes come up with the final piece of the puzzle to have an intelligence agency come up with the big picture in a cost-effective and timely manner, given they actually believe in OSINT and trust the source of the intell data of course. Now, picture the situation where an intelligence agency is shutting down cyber jihadist sites on a large scale not believing in the value that the intelligence data they they could provide, another one given a mandate to censor cyber jihadist communities compiling reports stating that someone's shutting them down before they could even censor them, and a third one who would have to again play cat and mouse game the locate them once they've shut down by the first intel agency already. Ironic or not, different mandates and empowerment is where the contradiction begins. Let's discuss the three mandates and go in-depth into the pros and cons of each of them to come up with a philosophic solution to the problem, as I belive it's perhaps the only way to provoke some thought on the best variant.</div><br /><div></div><strong>Shutting the communities down</strong> -<br /><div>Before shuting them down you need to know where they are, their neighbourhood of supporters who will indirectly tip you on the their latest location once they have their previous domain shut down. Personal experience and third party research indicates that over 90% of the cyber jihadist communities/blogs are hosted by U.S based not owned companies. And with the lack of real-time intell sharing between the agencies themselves, the first who picks up the community will be responsible for its faith, literally. But in reality, preserving the integrity of a cyber jihadist community, and convincing the right people that balanced monitoring next to shutting it down is more beneficial, remains an idea yet to be considered. Back in 2007, I did an experiment, namely I <a href="http://ddanchev.blogspot.com/2007/08/analyses-of-cyber-jihadist-forums-and.html">crawled ten cyber jihadist forums and blogs and extracted all the outgoing links from these communities</a> to see their preferred choice for online video and files hosting. A couple of months later, the communities got shut down, so when the same thing happened while I was crawling the Global Islamic Media Front's, and Inshallahshaheed's web presence, it became clear that while some are crawling, and others censoring, third parties are shutting them down.</div><br /><div> </div>The bottom line - shutting them down doesn't mean that they'll dissapear and will never come back, exactly the opposite. Personal experience while handling the Global Islamic Media Front is perhaps the perfect and best hands-on experience on the benefits of shutting them down, given you've built enough convidence in your abilities to locate their new location. If you think that the cyber jihadist site or community you're currently monitoring is a star, look above, it's full of starts everywhere, once you start drawing the lines between them, a figure of something known emerges, in this case once a cyber jihadist community is shut down, its most loyal and closely connected cyber jihadist communities will expose their intimate connection not by just starting to promote their new location online, but even better, you'll have them use the second cyber jihadist community to directly reach their audience by the time they set up the new location and resume the propaganda and radicalization.<br /><div> </div><br /><div>There's no shortage of cyber jihadist blogs, forums and sites, and personal experience shows that upon having a cyber jihadist community shut down, they re-appear at another location. It's shut down again, it re-appears for a second time. I've seen this situation with Instahaleed and GIMF, and each and every time they had their blogs and sites removed from their hosting providers, mainly because it's rather disturbing that the majority of such communities are hosted on U.S servers, it's this short time frame which will either lead you to their new location, you risk loosing their tracks. However, the vivid supporters of PSYOPs are logically visionary enough to understand what does undermining their audiences' confidence in the community's capability to remain online means.</div><br /><div> </div><strong>Monitoring the communities</strong> -<br /><div>In order to reach the "shut it down or monitor it" stage in your analysis process, you really need to know where the cyber jihadists forums and sites are, else, you will be wasting your time, money and energy to create <a href="http://ddanchev.blogspot.com/2007/03/cyber-traps-for-wannabe-jihadists.html">fake cyber jihadist communities in the form of web honeypots for jihadist communication</a>. Monitoring is tricky, especially when you don't know what you're looking for, don't prioritize, don't have a contingency plan or an offline copy of the communitiy and wrongly building confidence in its ability to remain online. Moreover, <a href="http://cryptome.org/able-danger-ig-02.jpg">monitoring for too long</a> results in terrabytes of noise, and from a psychological perspective sometimes <a href="http://en.wikipedia.org/wiki/Able_Danger">the rush for yet another fancy social networking graph</a> to better communicate <a href="http://cryptome.org/able-danger-ig-01.jpg">the collected data</a>, ends up in the worst possible way - you miss the tipping point moment.</div><br /><div> </div><strong>Censoring the communities -</strong><br /><div>I often come across wishful comments in the lines of "blocking access to bomb and poison making tutorials", missing a very important point, namely, that these very same manuals, and jihadist magazines are not residing in a cyber-jihad.com/bomb-making-guide.zip domain and file extension form, making the process a bit more complex to realize. Unless of course the censorship systems figures out ways to detect the content in password encrypted archive files served with random file names and hosted on one of the hundreds free web space providers. Then again, given the factual evidence that cyber jihadists are encouraging the use of Internet anonymization services and software, your censorship efforts will remain futile.</div><br /><div> </div>As I'm posting this overview of various ways of handling cyber jihadist communities, yet another community is starting to attract cyber jihadists, thanks to their understanding of noise generation by teaching the novice cyber jihadists on the basics of running and maintaing such a community. What's perhaps most important to keep in mind is that, what you're currently analyzing, trying to shut down or censor whatsoever, is the public web, the Dark Web, the one closed behind authentication and invite-only access yet remains to be located and properly analyzed. If cyber jihad is really a priority, then there's nothing more effective than the combination of independent researchers and intelligence analysts.<br /><div> </div><br /><div><strong>Related posts:<br /><a href="http://ddanchev.blogspot.com/2007/12/inshallahshaheed-come-out-come-out.html"><span style="font-weight: normal;">Inshallahshaheed - Come Out, Come Out Wherever You Are</span></a><br /></strong><a href="http://ddanchev.blogspot.com/2007/07/gimf-switching-blogs.html">GIMF Switching Blogs</a><br /><a href="http://ddanchev.blogspot.com/2007/08/gimf-now-permanently-shut-down.html">GIMF Now Permanently Shut Down</a><br /><a href="http://ddanchev.blogspot.com/2007/08/gimf-we-will-remain.html">GIMF - "We Will Remain"</a><br /><strong><a href="http://ddanchev.blogspot.com/2007/10/wisdom-of-anti-cyber-jihadist-crowd.html"><span style="font-weight: normal;">Wisdom of the Anti Cyber Jihadist Crowd</span></a><br /><a href="http://ddanchev.blogspot.com/2007/11/cyber-jihadist-blogs-switching.html"><span style="font-weight: normal;">Cyber Jihadist Blogs Switching Locations</span></a><br /></strong></div><div><a href="http://ddanchev.blogspot.com/2006/09/internet-psyops-psychological.html">Internet PSYOPS - Psychological Operations</a><br /><div><a href="http://ddanchev.blogspot.com/2007/11/electronic-jihad-v30-what-cyber-jihad.html">Electronic Jihad v3.0 - What Cyber Jihad Isn't</a></div><div><a href="http://ddanchev.blogspot.com/2007/11/electronic-jihads-targets-list.html">Electronic Jihad's Targets List</a></div><div><a href="http://ddanchev.blogspot.com/2007/11/teaching-cyber-jihadists-how-to-hack.html">Teaching Cyber Jihadists How to Hack</a></div><a href="http://ddanchev.blogspot.com/2007/11/botnet-of-infected-terrorists.html">A Botnet of Infected Terrorists?</a><br /><a href="http://ddanchev.blogspot.com/2007/09/infecting-terrorist-suspects-with.html">Infecting Terrorist Suspects with Malware</a><br /><a href="http://ddanchev.blogspot.com/2007/09/dark-web-and-cyber-jihad.html">The Dark Web and Cyber Jihad</a><br /><a href="http://ddanchev.blogspot.com/2007/12/cyber-jihadist-hacking-teams.html">Cyber Jihadist Hacking Teams</a><br /><a href="http://ddanchev.blogspot.com/2005/12/cyberterrorism-dont-stereotype-and-its.html">Cyberterrorism - don't stereotype and it's there</a><br /><a href="http://ddanchev.blogspot.com/2006/06/tracking-down-internet-terrorist.html">Tracking Down Internet Terrorist Propaganda</a><br /><a href="http://ddanchev.blogspot.com/2006/05/arabic-extremist-group-forum-messages.html">Arabic Extremist Group Forum Messages' Characteristics</a><br /><a href="http://ddanchev.blogspot.com/2006/08/cyber-terrorism-communications-and_22.html">Cyber Terrorism Communications and Propaganda</a><br /><a href="http://ddanchev.blogspot.com/2006/05/techno-imperialism-and-effect-of.html">Techno Imperialism and the Effect of Cyberterrorism</a><br /><a href="http://ddanchev.blogspot.com/2006/10/cost-benefit-analysis-of-cyber.html">A Cost-Benefit Analysis of Cyber Terrorism</a><br /><a href="http://ddanchev.blogspot.com/2006/12/current-state-of-internet-jihad.html">Current State of Internet Jihad</a><br /><a href="http://ddanchev.blogspot.com/2007/02/characteristics-of-islamist-websites.html">Characteristics of Islamist Websites</a><br /><a href="http://ddanchev.blogspot.com/2006/09/hezbollahs-dns-service-providers-from.html">Hezbollah's DNS Service Providers from 1998 to 2006</a><br /><a href="http://ddanchev.blogspot.com/2006/12/full-list-of-hezbollahs-internet-sites.html">Full List of Hezbollah's Internet Sites</a><br /><a href="http://ddanchev.blogspot.com/2007/03/cyber-traps-for-wannabe-jihadists.html">Cyber Traps for Wannabe Jihadists</a><br /><a href="http://ddanchev.blogspot.com/2007/04/mujahideen-secrets-encryption-tool.html">Mujahideen Secrets Encryption Tool</a><br /><a href="http://ddanchev.blogspot.com/2006/12/analysis-of-technical-mujahid-issue-one.html">An Analysis of the Technical Mujahid Issue One</a><br /><a href="http://ddanchev.blogspot.com/2007/06/analysis-of-technical-mujahid-issue-two.html">An Analysis of the Technical Mujahid Issue Two</a><br /><a href="http://ddanchev.blogspot.com/2007/07/terrorist-groups-brand-identities.html">Terrorist Groups' Brand Identities</a><br /><a href="http://ddanchev.blogspot.com/2007/06/list-of-terrorists-blogs.html">A List of Terrorists' Blogs</a><br /><a href="http://ddanchev.blogspot.com/2007/05/jihadists-anonymous-internet-surfing.html">Jihadists' Anonymous Internet Surfing Preferences</a><br /><a href="http://ddanchev.blogspot.com/2007/05/sampling-jihadists-ips.html">Samping Jihadist IPs</a><br /><a href="http://ddanchev.blogspot.com/2007/07/cyber-jihadists-and-tor.html">Cyber Jihadists' and TOR</a><br /><a href="http://ddanchev.blogspot.com/2007/08/cyber-jihadist-dos-tool.html">A Cyber Jihadist DoS Tool</a><br /><a href="http://ddanchev.blogspot.com/2007/08/gimf-now-permanently-shut-down.html">GIMF Now Permanently Shut Down</a><br /><a href="http://ddanchev.blogspot.com/2006/08/steganography-and-cyber-terrorism.html">Steganography and Cyber Terrorism Communications</a><br /></div><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=9ODTvnF"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=9ODTvnF" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=glFBi8F"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=glFBi8F" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=D198AFf"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=D198AFf" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=z0vTnMf"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=z0vTnMf" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=sALMAMF"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=sALMAMF" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=LlGGhJF"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=LlGGhJF" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=GIrrUWf"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=GIrrUWf" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/253973814" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 18 Mar 2008 16:58:23 +0000</pubDate>
      <category domain="http://securityratty.com/tag/cyber jihadist">cyber jihadist</category>
      <category domain="http://securityratty.com/tag/cyber jihadist communities">cyber jihadist communities</category>
      <category domain="http://securityratty.com/tag/novice cyber jihadists">novice cyber jihadists</category>
      <category domain="http://securityratty.com/tag/jihadists">jihadists</category>
      <category domain="http://securityratty.com/tag/cyber jihadist forums">cyber jihadist forums</category>
      <category domain="http://securityratty.com/tag/cyber jihadist sites">cyber jihadist sites</category>
      <category domain="http://securityratty.com/tag/attract cyber jihadists">attract cyber jihadists</category>
      <category domain="http://securityratty.com/tag/internet">internet</category>
      <category domain="http://securityratty.com/tag/cyber jihadists">cyber jihadists</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/253973814/terror-on-internet-conflict-of-interest.html">Terror on the Internet - Conflict of Interest</source>
    </item>
    <item>
      <title><![CDATA[Logs: Parsing, Tokenizing or Extracting?]]></title>
      <link>http://securityratty.com/article/6d94e444ab1fab845f879bccd1b18989</link>
      <guid>http://securityratty.com/article/6d94e444ab1fab845f879bccd1b18989</guid>
      <description><![CDATA[As you know, I have long been on a quest to save the world from having to write long and ugly regular expressions (regexes) for log analysis. Back in 2005 ( post , big discussion that ensued ) and...]]></description>
      <content:encoded><![CDATA[<p>As you know, I have long been on a quest to save the world from having to write long and ugly regular expressions (regexes) for log analysis. Back in 2005 (<a href="http://lists.jammed.com/loganalysis/2005/12/0000.html">post</a>, <a href="http://lists.jammed.com/loganalysis/2005/12/index.html#0">big discussion that ensued</a>) and later in 2007 (<a href="http://www.loganalysis.org/pipermail/loganalysis/2007-September/000391.html">post</a>, <a href="http://www.loganalysis.org/pipermail/loganalysis/2007-September/thread.html#391">another big discussion that again ensued</a>), I have tried to poll people for approaches that convert logs into useful information without messing with massive quantities of regular expressions as well as performed some research on my own. In all honesty, I didn't notice a major breakthrough.</p> <p>Until now? <a href="http://dev.splunk.com/2008/02/12/delimiter-based-key-value-pair-extraction/">Here</a> ("prequel" <a href="http://dev.splunk.com/2008/01/18/key-value-pair-extraction-definition-examples-and-solutions/">here</a> and follow-up <a href="http://dev.splunk.com/2008/02/22/delimiter-base-kv-extraction-advanced/">here</a>) is what looks like an interesting and major development along that&nbsp; line. Indeed, one can automate the processing of some "self-describing" log formats (name=value pairs, comma/tab delimited with descriptive header, sequential names and values [yuck!], XML, etc) to obtain a semblance of structured data (not just a flow of text logs)&nbsp; from logs without any human involvement. </p> <p>But is that an endgame, that "holy grail" of log analysis or yet another step towards it?&nbsp; First, bad logs <a href="http://dev.splunk.com/2008/01/18/key-value-pair-extraction-definition-examples-and-solutions/">break it</a> (e.g. with space in names or values with spaces and without quotes) and thus call for a return of a human logging expert to write an even fancier regex that can deal with it (then again, bad logs often break human-written rules as well). Second, there is a more important issue that I will bring up. So, if logs contain "user=jsmith" we can certainly learn a new piece of info (that the "user" was probably "jsmith"). But what if they contain "bla_bla=huh_huh" - and we don't know what "bla_bla" and "huh_huh" mean? Do we really have more information at hand if we tokenize it as "object called 'bla_bla' has the value of 'huh_huh'" compared to just having a single blurb of text "bla_bla=huh_huh." I personally don't think so - but I've been known to be wrong before :-) </p> <p>So, let's review what we have: I decided to organize the current approaches to logs in the form of this table (hoping to start a discussion!)</p> <table cellspacing="0" cellpadding="2" width="690" border="2"> <tbody> <tr> <td valign="top" width="51">&nbsp;</td> <td valign="top" width="185"><strong>Text Indexing</strong></td> <td valign="top" width="220"><strong>Field&nbsp; Extraction (Algorithmic)</strong></td> <td valign="top" width="224"><strong>Rule-based Parsing (Manual)</strong></td></tr> <tr> <td valign="top" width="55"><strong>Pros</strong></td> <td valign="top" width="185"><strong>Easy</strong> - no human effort needed: just collect the logs and go</td> <td valign="top" width="220"><strong>Easy</strong> - no per-log effort on behalf of the log analyst (but some creative code needs to be written)</td> <td valign="top" width="222"><strong>Hard</strong> - an expensive logging expert must first understand the logs and then write the rules; <a href="http://raffy.ch/blog/2007/08/25/event-processing-normalization/">normalization</a> across devices implies having a uniform data store for logs</td></tr> <tr> <td valign="top" width="59"><strong>Cons</strong></td> <td valign="top" width="185">Output is<strong> low quality</strong> information; rather, a flow of raw data (needs more analysis)</td> <td valign="top" width="220"><strong>Mixed</strong> - some new information emerges, but not in all cases (and you can't predict when)<br>In general, no cross-device analysis is enabled ('user'&nbsp; is not the same as 'usr' in other log)</td> <td valign="top" width="222"><strong>High-quality output</strong>: tables, graphics, summaries and easy correlation across diverse log sources (highly useful information!)</td></tr></tbody></table> <p>So, what can we conclude? It is too early to retire the human-written rules (so people will still have '\s' and '\w' coming up in bad dreams... :-)), but this automated approach should definitely be used on the logs that will "allow you to do it to them." :-) Personally, I am also very happy that <a href="http://dev.splunk.com/author/lbitincka/">somebody</a> is thinking about such matters ...</p> <p>Comment away!</p> <div class="wlWriterSmartContent" id="scid:0767317B-992E-4b12-91E0-4F059A8CECA8:aa78a5d5-d412-42ce-85ff-c63d80f33fb2" style="padding-right: 0px; display: inline; padding-left: 0px; padding-bottom: 0px; margin: 0px; padding-top: 0px">Technorati tags: <a href="http://technorati.com/tags/logging" rel="tag">logging</a>, <a href="http://technorati.com/tags/log%20analysis" rel="tag">log analysis</a>, <a href="http://technorati.com/tags/log%20management" rel="tag">log management</a></div>  <div class="blogger-post-footer">About me: http://www.chuvakin.org</div><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=7soa3NF"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=7soa3NF" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=EW9FQoF"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=EW9FQoF" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~4/249385071" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 10 Mar 2008 22:54:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/logs">logs</category>
      <category domain="http://securityratty.com/tag/log analyst">log analyst</category>
      <category domain="http://securityratty.com/tag/log">log</category>
      <category domain="http://securityratty.com/tag/convert logs">convert logs</category>
      <category domain="http://securityratty.com/tag/log management">log management</category>
      <category domain="http://securityratty.com/tag/diverse log sources">diverse log sources</category>
      <category domain="http://securityratty.com/tag/text logs">text logs</category>
      <category domain="http://securityratty.com/tag/log analysis">log analysis</category>
      <category domain="http://securityratty.com/tag/bad logs">bad logs</category>
      <source url="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~3/249385071/logs-parsing-tokenizing-or-extracting.html">Logs: Parsing, Tokenizing or Extracting?</source>
    </item>
    <item>
      <title><![CDATA[Unprofessionally Piggybacking on my Research]]></title>
      <link>http://securityratty.com/article/53a25c49df8b47c7d474fdcdd5c7deea</link>
      <guid>http://securityratty.com/article/53a25c49df8b47c7d474fdcdd5c7deea</guid>
      <description><![CDATA[Why did I bother to send this message to Full-Disclosure last night, despite that I already posted it here? Because I knew that this would happen , it's happened before, and it will happen in the...]]></description>
      <content:encoded><![CDATA[<a href="http://bp0.blogger.com/_wICHhTiQmrA/R87uEsHWvKI/AAAAAAAABbY/ufvAXwJvQ90/s1600-h/yeah_sure.jpg"><img id="BLOGGER_PHOTO_ID_5174334786224176290" style="FLOAT: left; MARGIN: 0px 10px 10px 0px; CURSOR: hand" alt="" src="http://bp0.blogger.com/_wICHhTiQmrA/R87uEsHWvKI/AAAAAAAABbY/ufvAXwJvQ90/s200/yeah_sure.jpg" border="0" /></a>Why did I bother to send this message to <a href="http://seclists.org/fulldisclosure/2008/Mar/0041.html">Full-Disclosure</a> last night, despite that I already posted it here? Because I knew <a href="http://www.itwire.com/content/view/16981/53/">that this would happen</a>, it's happened before, and it will happen in the future, so having dates and hours to prove what you see on the top of each and every blog post here, namely the real-time situational awareness objective, is what I wanted to achieve. And I did. Thankfully, there're <a href="http://www.sophos.com/security/blog/2007/10/714.html">Sophos</a>, <a href="http://blog.trendmicro.com/malicious-iframes-hosted-on-e-zines-a-media-possibility/">TrendMicro</a>, <a href="http://www.avertlabs.com/research/blog/index.php/2008/01/09/the-russian-business-network-is-on-tenterhooks/">McAfee</a> and <a href="http://blog.commtouch.com/cafe/data-and-research/response-to-dancho-danchev-on-the-malware-outbreak-center/">Commtouch</a> realizing that corporate blogging evolved from hard selling and the basics of marketing, to a complex PR platform, and therefore quote and link to my blog, to have me link back, so that <a href="http://ddanchev.blogspot.com/2006/07/security-research-reference-coverage.html">a conversation emerges</a>. Redefining the process of rephrasing so that my creative commons license per post is not violated? Find the ten differences between my post yesterday, its title, and today's statements:<br /><br />"<em>Continuing, Chia says that: “Leveraging on the fact that the site is, legitimate, and has high page ranks, the popular search engines are returning some of these iFRAME-ed results in the first few pages of the search results. And the objective? To get the unsuspicious user to click on the link”.</em>"<br /><br />So, my original post went online yesterday, <a href="http://temerc.com/forums/viewtopic.php?f=10&amp;t=4682">TeMerc reposted</a> it, <a href="http://fergdawg.blogspot.com/2008/03/zdnet-asia-and-torrentreactor-iframe-ed.html">so did Paul</a>, I sent it to <a href="http://seclists.org/fulldisclosure/2008/Mar/0041.html">Full-Disclosure</a>, and as it looks like <a href="http://www.f-secure.com/weblog/archives/00001396.html">F-Secure's Wing Fei Chia seems to read, either Full-Disclosure, or my blog</a> to come up <a href="http://www.f-secure.com/weblog/archives/00001396.html">this post</a>, 24 hours later. Anyway, SecurityFocus, again covers the incident in an article entitled "<a href="http://www.securityfocus.com/brief/695">Fraudsters piggyback on search engines</a>", quoting me, this time professionally.<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=PzBiw9F"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=PzBiw9F" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=vnkj4cF"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=vnkj4cF" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=vCCzorf"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=vCCzorf" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=5O5YXof"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=5O5YXof" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=tSsrJmF"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=tSsrJmF" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=A7gr7mF"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=A7gr7mF" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=FMmDBRf"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=FMmDBRf" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/246305044" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 05 Mar 2008 10:32:05 +0000</pubDate>
      <category domain="http://securityratty.com/tag/post">post</category>
      <category domain="http://securityratty.com/tag/original post">original post</category>
      <category domain="http://securityratty.com/tag/blog post">blog post</category>
      <category domain="http://securityratty.com/tag/post yesterday">post yesterday</category>
      <category domain="http://securityratty.com/tag/blog">blog</category>
      <category domain="http://securityratty.com/tag/chia">chia</category>
      <category domain="http://securityratty.com/tag/iframe-ed results">iframe-ed results</category>
      <category domain="http://securityratty.com/tag/full-disclosure">full-disclosure</category>
      <category domain="http://securityratty.com/tag/link">link</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/246305044/unprofessionally-piggybacking-on-my.html">Unprofessionally Piggybacking on my Research</source>
    </item>
    <item>
      <title><![CDATA[Powerful new antiphishing weapon emerges]]></title>
      <link>http://securityratty.com/article/897e5733360b9763845ffcf97e477620</link>
      <guid>http://securityratty.com/article/897e5733360b9763845ffcf97e477620</guid>
      <description><![CDATA[Some of the Internets most powerful companies -- including Yahoo, Google, PayPal and AOL-- are brandishing a new weapon in the ongoing battle against e-mail fraud. It is called DKIM, an emerging...]]></description>
      <content:encoded><![CDATA[Some of the Internet’s most powerful companies -- including Yahoo, Google, PayPal and AOL-- are brandishing a new weapon in the ongoing battle against e-mail fraud. It is called DKIM, an emerging e-mail authentication standard developed by the Internet Engineering Task Force, and it allows an organization to cryptographically sign outgoing e-mail to verify that it sent the message.
			
			<div style="margin-top:20" />
			<table border="1" BORDERCOLOR="#0033CC" cellspacing="0" cellpadding="2">
				<tr valign="top" align="left">
					<td>
						<table border="0" cellspacing="3" cellpadding="2" width="100%">
			
			
		  
		<tr> 
		<tr>
      <td width="*">
				<font face="Arial,Helvetica,Geneva,Sans-serif,sans-serif" size="-1">
				<p>	
			
			<a href="http://rsslinks.industrybrains.com/click?sid=93&scid=10069&rqctid=589&lid=472196&cid=133720&pr=2&tstamp=20080211000000&url=http://www.apc.com/go/promo/whitepapers/form.cfm%3fpromo_num%3d11754%26thepromo%3d101%26tsk%3da127w" target=_blank><strong>Fundamental Principles of Network Security</strong></a></p>
				<td align="right">
					<font face="Arial,Helvetica,Geneva,Sans-serif,sans-serif" COLOR="#0033CC" size="-1"><p>Advertisement</p></font>
				</td>
				</tr>
				<tr><td colspan="2"><font face="Arial,Helvetica,Geneva,Sans-serif,sans-serif" size="-1"><p>Protect the organization. Learn the 'Need To Know' aspects of network security. Free paper from APC.
			
				</p>
				</font>
		 	</td>
     </tr>
		 
		 
			
						</table>
					</td>
				</tr>
			</table>
			<div style="margin-top:20" />
			
			]]></content:encoded>
      <pubDate>Sun, 10 Feb 2008 21:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/e-mail authentication standard">e-mail authentication standard</category>
      <category domain="http://securityratty.com/tag/e-mail">e-mail</category>
      <category domain="http://securityratty.com/tag/network security">network security</category>
      <category domain="http://securityratty.com/tag/e-mail fraud">e-mail fraud</category>
      <category domain="http://securityratty.com/tag/task force">task force</category>
      <category domain="http://securityratty.com/tag/organization">organization</category>
      <category domain="http://securityratty.com/tag/weapon">weapon</category>
      <category domain="http://securityratty.com/tag/free paper">free paper</category>
      <category domain="http://securityratty.com/tag/powerful companies">powerful companies</category>
      <source url="http://www.networkworld.com/news/2008/021108-antiphising.html?fsrc=rss-security">Powerful new antiphishing weapon emerges</source>
    </item>
    <item>
      <title><![CDATA[The Shark3 Malware is in the Wild]]></title>
      <link>http://securityratty.com/article/dc725612535174610928742a0567c2aa</link>
      <guid>http://securityratty.com/article/dc725612535174610928742a0567c2aa</guid>
      <description><![CDATA[Life's too short to live in uncertainty, the stakes are too high. A month ago, I indicated the upcoming release of the third version of the script kiddies favorite Shark Malware . Despite that after...]]></description>
      <content:encoded><![CDATA[<a href="http://bp3.blogger.com/_wICHhTiQmrA/R6JGPrWhg3I/AAAAAAAABVo/DYlxaox0bvo/s1600-h/shark3.jpg"><img id="BLOGGER_PHOTO_ID_5161765358069187442" style="FLOAT: left; MARGIN: 0px 10px 10px 0px; CURSOR: hand" alt="" src="http://bp3.blogger.com/_wICHhTiQmrA/R6JGPrWhg3I/AAAAAAAABVo/DYlxaox0bvo/s200/shark3.jpg" border="0" /></a>Life's too short to live in uncertainty, the stakes are too high. A month ago, I indicated the <a href="http://ddanchev.blogspot.com/2007/12/shark-malware-new-versions-coming.html">upcoming release</a> of <a href="http://ddanchev.blogspot.com/2007/08/shark-2-diy-malware.html">the third version</a> of the script kiddies favorite <a href="http://ddanchev.blogspot.com/2007/07/shark2-rat-or-malware.html">Shark Malware</a>. Despite that after the negative publicity of the malware that's actually promotd as a RAT, the authors supposedly abondoned the malware, they seem to have logically resumed its development. And so, the Shark3 <div>malware is continuing its development.</div><div><br />What's new? Anti-debugger capabilities in particural against - VmWare, Norman Sandbox, Sandboxie, VirtualPC, Symantec Sandbox, Virtual Box etc.</div><div><br /><a href="http://bp3.blogger.com/_wICHhTiQmrA/R6JvWrWhg4I/AAAAAAAABVw/-_-r1Sf1qV0/s1600-h/shark3_stealth.jpg"><img id="BLOGGER_PHOTO_ID_5161810558305010562" style="FLOAT: left; MARGIN: 0px 10px 10px 0px; CURSOR: hand" alt="" src="http://bp3.blogger.com/_wICHhTiQmrA/R6JvWrWhg4I/AAAAAAAABVw/-_-r1Sf1qV0/s200/shark3_stealth.jpg" border="0" /></a><strong>Detection rate</strong> : Result: 15/31 (48.39%) - Backdoor.Win32.Shark.if<br /></div><div><strong>File size</strong>: 3104768 bytes</div><div><strong>MD5</strong>: e3a6758f5c90b39b59c6cd7551224d52</div><div><strong>SHA1</strong>: 25f025f31560a28275aab006e04aace828e012ea</div><div><br /><br /><br /></div><div></div><div><a href="http://bp0.blogger.com/_wICHhTiQmrA/R6Jvl7Whg5I/AAAAAAAABV4/dXrLutTpNVw/s1600-h/shark3_advanced.jpg"><img id="BLOGGER_PHOTO_ID_5161810820298015634" style="FLOAT: left; MARGIN: 0px 10px 10px 0px; CURSOR: hand" alt="" src="http://bp0.blogger.com/_wICHhTiQmrA/R6Jvl7Whg5I/AAAAAAAABV4/dXrLutTpNVw/s200/shark3_advanced.jpg" border="0" /></a>Some key points regarding Shark :</div><div><br />- its <a href="http://ddanchev.blogspot.com/2008/01/diy-fake-msn-client-stealing-passwords.html">do-it-yourself</a> nature, <a href="http://ddanchev.blogspot.com/2007/10/diy-german-malware-dropper.html">just</a> like <a href="http://ddanchev.blogspot.com/2007/09/diy-phishing-kit-goes-20.html">many</a> of the <a href="http://ddanchev.blogspot.com/2007/09/diy-exploits-embedding-tools.html">malware</a> tools <a href="http://ddanchev.blogspot.com/2007/09/diy-chinese-passwords-stealer.html">I've</a> covered <a href="http://ddanchev.blogspot.com/2007/06/diy-malware-droppers-in-wild.html">before</a> is <a href="http://ddanchev.blogspot.com/2007/10/empowering-script-kiddies.html">empowering script kiddies</a> with advanced point'n'click capabilities</div><div><br /></div><div>- built-in spyware functionaly, namely "aggressive service" which resets the start-up values when they're delted, yet another indication that what's pitched as a RAT is in fact malware</div><div><br /></div><div>- once released in an open source form, a community emerges around it one that starts innovating and coming up with new features</div><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=uzpTXBD"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=uzpTXBD" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=XJmYHGD"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=XJmYHGD" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=GymYcgd"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=GymYcgd" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=hIN6aQd"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=hIN6aQd" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=MhvUZtD"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=MhvUZtD" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=AdZKBZD"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=AdZKBZD" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=QaIe6Ud"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=QaIe6Ud" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/226903651" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 31 Jan 2008 16:10:57 +0000</pubDate>
      <category domain="http://securityratty.com/tag/malware">malware</category>
      <category domain="http://securityratty.com/tag/malware tools">malware tools</category>
      <category domain="http://securityratty.com/tag/built-in spyware functionaly">built-in spyware functionaly</category>
      <category domain="http://securityratty.com/tag/script kiddies">script kiddies</category>
      <category domain="http://securityratty.com/tag/shark">shark</category>
      <category domain="http://securityratty.com/tag/aggressive service">aggressive service</category>
      <category domain="http://securityratty.com/tag/negative publicity">negative publicity</category>
      <category domain="http://securityratty.com/tag/rat">rat</category>
      <category domain="http://securityratty.com/tag/authors supposedly">authors supposedly</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/226903651/shark3-malware-is-in-wild.html">The Shark3 Malware is in the Wild</source>
    </item>
    <item>
      <title><![CDATA[Locked Call Boxes and Banned Geiger Counters]]></title>
      <link>http://securityratty.com/article/251135e013a350fa030edda5ad7d7e66</link>
      <guid>http://securityratty.com/article/251135e013a350fa030edda5ad7d7e66</guid>
      <description><![CDATA[According to Fire Engineering magazine, one reason for the slow response to the Great Chicago Fire of 1871 was that fire alarms were kept locked to prevent false alarms: Q: Prior to 1870, street...]]></description>
      <content:encoded><![CDATA[<p>According to <i>Fire Engineering</i> magazine, one reason for the slow response to the Great Chicago Fire of 1871 was that <a href="http://www.fireengineering.com/articles/article_display.html?id=136064">fire alarms were kept locked</a> to prevent false alarms:</p>

<blockquote>Q: Prior to 1870, street corner fire alarm pull boxes were kept locked. Why were they kept locked and how did a person gain access to 'pull the box?'

<p>A: They were kept locked due to false alarms. Nearby shopkeepers or beat cops carried the keys.</blockquote></p>

<p><a href="http://www.amazon.com/Great-Chicago-Fire-Illinois/dp/155853265X/">Here's</a> Robert Cromie, writing in <i>The Great Chicago Fire</i> (Thomas Nelson: 1994), page 33:</p>

<blockquote>William Lee, the O'Leary's neighbor, rushed into Goll's drugstore, and gasped out a request for the key to the alarm box.  The new boxes were attached to the walls of stores or other convenient locations.  To prevent false alarms and crank calls, the boxes were locked, and the keys given to trustworthy citizens nearby.

<p>What happened when Lee made his request is not clear.  Only one fact emerges from the confusion:  No alarm was registered from any box in the vicinity of the fire until it was too late to do any good.</blockquote></p>

<p>Apparently, Lee said that Goll refused to give him the key because he'd already seen a fire engine go past; Goll said he actually did pull the alarm, twice, but if so it must not have worked.</p>

<p>(There's more about what sounds like a really bad communications failure, but it's a little too hard for me to read on the Amazon website.)</p>

<p><a href="http://urbanlegends.about.com/od/pockettales/a/firefighters.htm">Here's more</a>:</p>

<blockquote>But did you know that the fire burned for over half an hour before an alarm was ever sounded? Alarm boxes were actually kept locked in those days, to prevent false alarms!

<p>When the first alarm box was finally opened and the lever pulled, the alarm somehow did not get through. The fire dispatcher was playing a guitar for a couple of girls at the time and he kept on serenely strumming, completely unawares. After the fire had been growing and blazing for nearly an hour a watchman screamed at the dispatcher to sound an alarm, which he did, and the first three engines, two hose wagons, and two hook and ladders were sent out -- but in the wrong direction!</p>

<p>At first the dispatcher refused to sound another alarm, hoping to avoid further confusion.</blockquote></p>

<p>Compare this with a proposed law in New York City that will require people to <a href="http://cityroom.blogs.nytimes.com/2008/01/08/a-license-to-check-for-wmds/">get a license</a> before they can buy chemical, biological, or radiological attack detectors:</p>

<blockquote>The legislation — which was proposed by the Bloomberg administration and would be the first of its kind in the nation — would empower the police commissioner to decide whether to grant a free five-year permit to individuals and companies seeking to "possess or deploy such detectors." Common smoke alarms and carbon monoxide detectors would not be covered by the law, the Police Department said. Violations of the law would be considered a misdemeanor. 

<p>Why does the administration think such a law is necessary? <a href="http://www.nyc.gov/html/nypd/html/administration/counter_terrorism_co.shtml">Richard A. Falkenrath</a>, the Police Department’s deputy commissioner for counterterrorism, told the Council’s Public Safety Committee at a hearing today, "Our mutual goal is to prevent false alarms and unnecessary public concern by making sure that we know where these detectors are located and that they conform to standards of quality and reliability."</p>

<p>The law would also require anyone using such a detector -- regardless of whether they have obtained the required permit -- to notify the Police Department if the detector alerted them to a biological, chemical or radiological agent. “In this way, emergency response personnel will be able to assess threats and take appropriate action based on the maximum information available,” Dr. Falkenrath said.</blockquote></p>

<p>False positives are a problem with any detection system, and certainly putting Geiger counters in the hands of everyone will mean a lot of amateurs calling false alarms into the police.  But the way to handle that isn't to ban Geiger counters.  (Just as the way to deal with false fire alarms 100 yeras ago wasn't to lock the alarm boxes.)  The way to deal with it is by 1) putting a system in place to quickly separate the real alarms from the false alarms, and 2) prosecuting those who maliciously sound false alarms.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=9tUPPZD"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=9tUPPZD" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=cfskOpD"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=cfskOpD" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=SxU8TsD"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=SxU8TsD" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Fri, 18 Jan 2008 04:44:31 +0000</pubDate>
      <category domain="http://securityratty.com/tag/boxes">boxes</category>
      <category domain="http://securityratty.com/tag/false fire alarms">false fire alarms</category>
      <category domain="http://securityratty.com/tag/fire">fire</category>
      <category domain="http://securityratty.com/tag/fire alarms">fire alarms</category>
      <category domain="http://securityratty.com/tag/false alarms">false alarms</category>
      <category domain="http://securityratty.com/tag/prevent false alarms">prevent false alarms</category>
      <category domain="http://securityratty.com/tag/alarm boxes">alarm boxes</category>
      <category domain="http://securityratty.com/tag/alarm">alarm</category>
      <category domain="http://securityratty.com/tag/chicago fire">chicago fire</category>
      <source url="http://www.schneier.com/blog/archives/2008/01/locked_fire_box.html">Locked Call Boxes and Banned Geiger Counters</source>
    </item>
    <item>
      <title><![CDATA[Cyber espionage seen as growing threat to business, government]]></title>
      <link>http://securityratty.com/article/c4f0caf331681744c5c25853a32efd8f</link>
      <guid>http://securityratty.com/article/c4f0caf331681744c5c25853a32efd8f</guid>
      <description><![CDATA[Cyber espionage is getting renewed attention as fresh evidence emerges of online break-ins at U.S. research labs and targeted phishing against corporations and government agencies here and...]]></description>
      <content:encoded><![CDATA[Cyber espionage is getting renewed attention as fresh evidence emerges of online break-ins at U.S. research labs and targeted phishing against corporations and government agencies here and abroad.]]></content:encoded>
      <pubDate>Wed, 16 Jan 2008 21:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/cyber espionage">cyber espionage</category>
      <category domain="http://securityratty.com/tag/fresh evidence emerges">fresh evidence emerges</category>
      <category domain="http://securityratty.com/tag/research labs">research labs</category>
      <category domain="http://securityratty.com/tag/government agencies">government agencies</category>
      <category domain="http://securityratty.com/tag/online break-ins">online break-ins</category>
      <category domain="http://securityratty.com/tag/attention">attention</category>
      <category domain="http://securityratty.com/tag/corporations">corporations</category>
      <category domain="http://securityratty.com/tag/abroad">abroad</category>
      <source url="http://www.networkworld.com/news/2008/011708-cyberespionage.html?fsrc=rss-security">Cyber espionage seen as growing threat to business, government</source>
    </item>
  </channel>
</rss>
