<![CDATA[[SecurityRatty] tag: ethical]]> http://securityratty.com/tag/ethical Thu, 12 Jun 2008 04:38:35 +0000 iRatty Engine http://blogs.law.harvard.edu/tech/rss <![CDATA[Another Google Bug Put Users At Phishing Risk Due To Domain Flaw And Frame Injection Possibility]]> http://securityratty.com/article/a3a826883c2875f86d3d818f4095efc1 http://securityratty.com/article/a3a826883c2875f86d3d818f4095efc1 Fri, 10 Oct 2008 19:05:05 +0000 sensitive google services users login credentials spoof pages adrian pastor security flaws google calendar security expert attack collective Another Google Bug Put Users At Phishing Risk Due To Domain Flaw And Frame Injection Possibility <![CDATA[250k of Harvested Hotmail Emails Go For?]]> http://securityratty.com/article/efaf965e7dacf43f06479ec7778d04e6 http://securityratty.com/article/efaf965e7dacf43f06479ec7778d04e6
$50 in this particular case, however, keeping in mind that the email harvester is anything but ethical, this very same database will be sold and re-sold more times than the original buyer would like to know about. Moreover, what someone is offering for sale, may in fact be already available as a value-added addition to a managed spamming service.

With metrics and quality assurance applied in a growing number of spam and phishing campaigns, filling in the niche of email harvesting by distinguishing between different types of obfuscated emails by releasing an easily embeddable module, was an anticipated move. What's to come? Spam and malware campaigns across social networks "as usual" will propagate faster thanks to the ongoing harvesting of usernames within social networks, that would later on get imported in Web 2.0 "marketing" tools targeting the high-trafficked sites and automatically spamming them.

From a spammer's perspective, geolocating these 250k emails could increase their selling prices since the buyers would be able to launch localized attacks with messages in the native languages of the receipts. Is the demand for quality email databases fueling the developments of this market segment, or are the spammers self-serving themselves and cashing-in by reselling what they've already abused a log time ago? That seems to be the case, since there's no way a buyer could verify the freshness of the harvested emails database and whether or not it has already been abused.

For the time being, we've got several developed and many other developing market segments within spamming and phishing as different markets with different players. On one hand are the legitimately looking spamming providers offering "direct marketing services" working with lone spammers who find a reliable business partner in the face of the spamming vendor whose customers drive both side's business models. On the other hand, you've got the spammers excelling in outsourcing the automatic account registration process, coming up with ways to build a spamming infrastructure -- already available as a module to integrate in managed spamming services -- using legitimate services as a provider of the infrastructure.

Despite that the arms race seems to be going on at several different fronts, spammers VS the industry and spammers VS spammers fighting for market share, the entire underground ecosystem is clearly allocating a lot of resources for research and development in order to ensure that they are always a step ahead of the industry.

Related posts:
Harvesting Youtube Usernames for Spamming 
Thousands of IM Screen Names in the Wild
Automatic Email Harvesting 2.0
Dissecting a Managed Spamming Service
Managed Spamming Appliances - the Future of Spam
Inside an Email Harvester's Configuration File
Segmenting and Localizing Spam Campaigns
Shots from the Malicious Wild West - Sample Four
]]> Thu, 25 Sep 2008 08:13:08 +0000 emails email email harvester spam campaigns spam lone spammers spammers 250k emails automatic email 250k of Harvested Hotmail Emails Go For? <![CDATA[Teaching Hacking at College by Sam Bowne]]> http://securityratty.com/article/f464683006bea78fdf7801ca7073794b http://securityratty.com/article/f464683006bea78fdf7801ca7073794b http://www.samsclass.info/ if you want to use his teaching curriculum.

]]> Tue, 23 Sep 2008 16:15:53 +0000 sam sam bowne college administration post ethical check defcon info Teaching Hacking at College by Sam Bowne <![CDATA[Blue Box #81: iSkoot vulnerability, OFCOM legislation, VoIP security news and more]]> http://securityratty.com/article/133c80b2a9536649a83e82483659eb92 http://securityratty.com/article/133c80b2a9536649a83e82483659eb92

Synopsis:  Blue Box #80: VoIPShield vulnerabilities, what is ethical disclosure?, SIP trunking, VoIP security news, new nomadism, and much more...

Welcome to Blue Box: The VoIP Security Podcast #80, a 44-minute podcast  from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.   

Download the show here (MP3, 19MB) or subscribe to the RSS feed to download the show automatically. 

NOTE: This show was originally recorded on April 21, 2008.

You may also listen to this podcast right now:

Show Content:

Comments, suggestions and feedback are welcome either as replies to this post  or via e-mail to blueboxpodcast@gmail.com.  Audio comments sent as attached MP3 files are definitely welcome and will be played in future shows.  You may also call the listener comment line at either +1-415-830-5439 or via SIP to 'bluebox@voipuser.org' to leave a comment there. 

Thank you for listening and please do let us know what you think of the show.

]]> Tue, 26 Aug 2008 16:16:43 +0000 voip voip security news voip users based enterprise voip planet voip calls voip privacy security voip news voip security podcast Blue Box #81: iSkoot vulnerability, OFCOM legislation, VoIP security news and more <![CDATA[Security Assessments as Fraud, Waste, and Abuse]]> http://securityratty.com/article/d54a2c8a9fbbd6efa3d8d80caadc1a71 http://securityratty.com/article/d54a2c8a9fbbd6efa3d8d80caadc1a71 I’m going to put on my Government Security Heretic Hat for awhile here, bear me out.  By my estimate, half of the security assessments received by the Government have some kind of fraud, waste, and abuse.

What makes me say this is the amount of redundancy in some testing that I’ve seen without any value added.

The way to avoid this redundancy is the concept of common/shared controls.  The whole idea is that you take whatever security controls you have across the board and put them into one bucket.  You test that bucket once and then whenever something  shares controls with that bucket, you look at the shared control bucket and make sure that the assessment is still relevant and accurate.

So, what makes a security assessment not fraud, waste, and abuse?  It’s a good assessment if it does the following:

  • Does not repeat a previous assessment.
  • Discovers previously-undiscovered vulnerabilities, weaknesses, or findings.
  • Has findings that get fed into a risk management plan (accepted, avoided, transferred, etc–think POA&M).
  • Is not exhaustive when it doesn’t need to be.
  • Provides value to the project team, system owner, and Authorizing Official to make key decisions.

Now the problem is that the typical auditor has a hard time stopping–they have an ethical obligation to investigate anything that their “professional skepticism” tells them is out of place, just like cops have an ethical obligation to investigate anything that they think is a crime.

The Solution?  Don’t use auditors! The public accounting model that we adopted for information security does not scale the way that we need it to for ST&E, and we need to understand this in order to fix security in the Government.

What we need to be doing is Security Test and Evaluation which is focused on risk, not on compliance using a checklist of control objectives.  Usually if you know enough to say “Wow, your patch management process is whacked, you’re at a high risk!” then that’s enough to stop testing patch management controls.  This is one of the beefs I have with 800-53A in the hands of less-than-clueful people:  they will test until exhaustion.

There isn’t a whole lot of difference between ST&E and an audit, just the purpose.  Audits are by nature confrontational because you’re trying to prove that fraud, waste, and abuse hasn’t occured.  ST&E is helping the project team find things that they haven’t thought of before and eventually get the large problems funded and fixed.

The Little Frauds Songbook

The Little Frauds Harrigan & Hart’s Songs & Sketches Photo by Boston Public Library

]]> Thu, 17 Jul 2008 17:34:14 +0000 controls security controls assessment shares controls waste fraud security assessment bucket control bucket Security Assessments as Fraud, Waste, and Abuse <![CDATA[Blue Box #80: VoIPShield vulnerabilities, what is ethical disclosure?, SIP trunking, VoIP security news, new nomadism, and much more...]]> http://securityratty.com/article/90bb58ffbec02539c2d62e825dbe8146 http://securityratty.com/article/90bb58ffbec02539c2d62e825dbe8146

Synopsis:  Blue Box #80: VoIPShield vulnerabilities, what is ethical disclosure?, SIP trunking, VoIP security news, new nomadism, and much more...

Welcome to Blue Box: The VoIP Security Podcast #80, a 44-minute podcast  from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.   

Download the show here (MP3, 20MB) or subscribe to the RSS feed to download the show automatically. 

NOTE: This show was originally recorded on April 17, 2008.

You may also listen to this podcast right now:

Show Content:

Comments, suggestions and feedback are welcome either as replies to this post  or via e-mail to blueboxpodcast@gmail.com.  Audio comments sent as attached MP3 files are definitely welcome and will be played in future shows.  You may also call the listener comment line at either +1-415-830-5439 or via SIP to 'bluebox@voipuser.org' to leave a comment there. 

Thank you for listening and please do let us know what you think of the show.

]]> Tue, 15 Jul 2008 13:20:45 +0000 voip voip security news voip news australia voip news voip security voip security podcast voipsa blog site voipsa voipshield vulnerabilities Blue Box #80: VoIPShield vulnerabilities, what is ethical disclosure?, SIP trunking, VoIP security news, new nomadism, and much more... <![CDATA[Blue Box #80: VoIPShield vulnerabilities, what is ethical disclosure?, SIP trunking, VoIP security news, new nomadism, and much more...]]> http://securityratty.com/article/f67dc99a7a07715d84135662a2d7276b http://securityratty.com/article/f67dc99a7a07715d84135662a2d7276b

Synopsis:  Blue Box #80: VoIPShield vulnerabilities, what is ethical disclosure?, SIP trunking, VoIP security news, new nomadism, and much more...

Welcome to Blue Box: The VoIP Security Podcast #80, a 44-minute podcast  from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.   

Download the show here (MP3, 20MB) or subscribe to the RSS feed to download the show automatically. 

NOTE: This show was originally recorded on April 17, 2008.

You may also listen to this podcast right now:

Show Content:

Comments, suggestions and feedback are welcome either as replies to this post  or via e-mail to blueboxpodcast@gmail.com.  Audio comments sent as attached MP3 files are definitely welcome and will be played in future shows.  You may also call the listener comment line at either +1-415-830-5439 or via SIP to 'bluebox@voipuser.org' to leave a comment there. 

Thank you for listening and please do let us know what you think of the show.

]]> Tue, 15 Jul 2008 12:22:35 +0000 voip voip security news voip news australia voip news voip security voip security podcast voipsa blog site voipsa voipshield vulnerabilities Blue Box #80: VoIPShield vulnerabilities, what is ethical disclosure?, SIP trunking, VoIP security news, new nomadism, and much more... <![CDATA[Attention - Lawyers and Private Investigators!]]> http://securityratty.com/article/4008bfcd8922c7f6396c4d8d4a5e179a http://securityratty.com/article/4008bfcd8922c7f6396c4d8d4a5e179a
If the P.I. or process server is credible and ethical, there should not be a problem. If on the other hand, the server "claims" to have served the paper, charges the Law Firm for services rendered but does not actually effect the necessary service, it could be the makings of a significant lawsuit. This is what happened in Massachusetts.

The plaintiff in that casewas awarded $3,000,000.00 when the State Court ruled that the Bermuda businessman, Donald P.Lines, had not been served by the company hired to effect the service, Boston based "Stokes & Levin". It later transpired that the company had used pre-fabricated stamps of the signature of a process server who no longer worked for the company. It did not enhance the image of the Securities and Exchange Commission either as the SEC were the ones who hired "Stokes & Levin".

I have heard stories of one elderly P.I. in Virginia who gets confused when he serves civil papers and sometimes puts the same time on two different papers even when they are served 20 miles or more apart. Yet, he continues to get requests for service from lawyers that he has known a while. I hope this story serves as a reminder to him and those who hire him that you stand to lose a lot if you don't get it right - both in reputation and finacial terms. There's no shame in hanging up the gun belt when the sun starts to set on your career. It's always better to go out a winner than a defendant.
Visit Sexton Executive Security at www.sextonsecurity.com
]]> Tue, 24 Jun 2008 21:18:00 +0000 company company hired process service company serves civil papers papers service server process server lawyers Attention - Lawyers and Private Investigators! <![CDATA[EU bloggers under assault by the European Parliament - they need your help]]> http://securityratty.com/article/42471dd2ecc3d3795053ea76949e5eeb http://securityratty.com/article/42471dd2ecc3d3795053ea76949e5eeb

One of the nice things about having started the SBN was that I have gotten to meet (mostly virtually) many security bloggers from around the world.  Some of the most prolific contributors to the content of the SBN has been the members of the Belgian Security Bloggers Network.  I received word today from one of the authors of one of the blogs, belsec, that they are under assault by the EU government.  It seems in their wisdom, the European Parliament has decided that in the interests of "media pluralism", all blog owners should declare their ownership, affiliations and status of weblog authors.

The explanatory notes of the proposed regulation says this:

In this context the report points out that the undetermined and unindicated status of authors and publishers of weblogs causes uncertainties regarding impartiality, reliability, source protection, applicability of ethical codes and the assignment of liability in the event of lawsuits.
It recommends clarification of the legal status of different categories of weblog authors and publishers as well as disclosure of interests and voluntary labelling of weblogs.

As the belsec author points out, disclosure of their identities would effectively silence their voices.  There is no first amendment freedom of speech or freedom of press constitutional right in Europe. Of course if forced to do so, the Belgian authors could take up blogs based here in the US and escape the disclosure laws of the EU, but why should they have too.  The EU is a democratic, progressive entity.  Forcing these bloggers to make their "status and identity" public should not be mandatory here.

Blogs are todays pamphlets.  Basic freedom of expression, speech and press have been protected for hundreds of years. Forcing these bloggers to identify themselves is a violation of their rights.  What would Thomas Paine and others like him think of this restriction?

If you feel that this is an unfair and unjust restriction on bloggers rights, blog about it. It is our right and to do so and we should use the medium to do so.  If you are a EU citizen write to your representative and demand that this proposed regulation does not go into effect!

Do not take your right to blog lightly.  If you don't stand up for it, it can be taken away from you.

"The world is my country, all mankind are my brethren, and to do good is my religion." - Thomas Paine

Zemanta Pixie
]]> Thu, 12 Jun 2008 05:38:11 +0000 bloggers weblog authors authors bloggers rights freedom legal status blog owners basic freedom status EU bloggers under assault by the European Parliament - they need your help <![CDATA[EU bloggers under assault by the European Parliament - they need your help]]> http://securityratty.com/article/495d89a1106383a495fba74b3adf8fdb http://securityratty.com/article/495d89a1106383a495fba74b3adf8fdb

One of the nice things about having started the SBN was that I have gotten to meet (mostly virtually) many security bloggers from around the world.  Some of the most prolific contributors to the content of the SBN has been the members of the Belgian Security Bloggers Network.  I received word today from one of the authors of one of the blogs, belsec, that they are under assault by the EU government.  It seems in their wisdom, the European Parliament has decided that in the interests of "media pluralism", all blog owners should declare their ownership, affiliations and status of weblog authors.

The explanatory notes of the proposed regulation says this:

In this context the report points out that the undetermined and unindicated status of authors
and publishers of weblogs causes uncertainties regarding impartiality, reliability, source
protection, applicability of ethical codes and the assignment of liability in the event of
lawsuits.
It recommends clarification of the legal status of different categories of weblog authors and
publishers as well as disclosure of interests and voluntary labelling of weblogs.

As the belsec author points out, disclosure of their identities would effectively silence their voices.  There is no first amendment freedom of speech or freedom of press constitutional right in Europe. Of course if forced to do so, the Belgian authors could take up blogs based here in the US and escape the disclosure laws of the EU, but why should they have too.  The EU is a democratic, progressive entity.  Forcing these bloggers to make their "status and identity" public should not be mandatory here. 

If you feel that this is a restriction on bloggers rights, blog about it. It is our right and to do so and we should use the medium to do so.  If you are a EU citizen write to your representative and demand that this proposed regulation does not go into effect!

Do not take your right to blog lightly.  If you don't stand up for it, it can be taken away from you.

"The world is my country, all mankind are my brethren, and to do good is my religion." - Thomas Paine

]]> Thu, 12 Jun 2008 04:38:35 +0000 bloggers weblog authors authors legal status blog owners status blog bloggers rights european parliament EU bloggers under assault by the European Parliament - they need your help