<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: fast]]></title>
    <link>http://securityratty.com/tag/fast</link>
    <description></description>
    <pubDate>Sat, 09 Aug 2008 06:23:08 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Airport Fast Pass Lets Redskins Fans Cut Security Line]]></title>
      <link>http://securityratty.com/article/69674275dfbf80177b4192e51ef392e0</link>
      <guid>http://securityratty.com/article/69674275dfbf80177b4192e51ef392e0</guid>
      <description><![CDATA[Redskins fans can now pay $100 a year to get into the football stadium faster and to jump to the front of the security lines at airports around the country. Will fast-pass lanes be coming to retailers...]]></description>
      <content:encoded><![CDATA[Redskins fans can now pay $100 a year to get into the football stadium faster and to jump to the front of the security lines at airports around the country. Will fast-pass lanes be coming to retailers or fast-food joints soon?<br style="clear: both;"/>
  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=8b52f8f7d0705e9e0a525bc1f5282a49" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=8b52f8f7d0705e9e0a525bc1f5282a49" style="display: none;" border="0" height="1" width="1" alt=""/><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=nrhwGK"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=nrhwGK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=S2zqqk"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=S2zqqk" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=GcWkZk"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=GcWkZk" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=q5DH1K"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=q5DH1K" border="0"></img></a>
 <a href="http://feeds.wired.com/~f/wired/politics/security?a=ybF8EK"><img src="http://feeds.wired.com/~f/wired/politics/security?i=ybF8EK" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=v5Vb4k"><img src="http://feeds.wired.com/~f/wired/politics/security?i=v5Vb4k" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=hX3Wfk"><img src="http://feeds.wired.com/~f/wired/politics/security?i=hX3Wfk" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=uaWmPK"><img src="http://feeds.wired.com/~f/wired/politics/security?i=uaWmPK" border="0"></img></a> </div><img src="http://feeds.feedburner.com/~r/wired/politics/privacy/~4/374531929" height="1" width="1"/><img src="http://feeds.wired.com/~r/wired/politics/security/~4/374531930" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 25 Aug 2008 13:15:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/redskins fans">redskins fans</category>
      <category domain="http://securityratty.com/tag/football stadium faster">football stadium faster</category>
      <category domain="http://securityratty.com/tag/fast-food joints">fast-food joints</category>
      <category domain="http://securityratty.com/tag/security lines">security lines</category>
      <category domain="http://securityratty.com/tag/fast-pass lanes">fast-pass lanes</category>
      <category domain="http://securityratty.com/tag/retailers">retailers</category>
      <category domain="http://securityratty.com/tag/country">country</category>
      <category domain="http://securityratty.com/tag/front">front</category>
      <category domain="http://securityratty.com/tag/jump">jump</category>
      <source url="http://feeds.wired.com/~r/wired/politics/security/~3/374531930/airport-fast-pa.html">Airport Fast Pass Lets Redskins Fans Cut Security Line</source>
    </item>
    <item>
      <title><![CDATA[A Diverse Portfolio of Fake Security Software - Part Four]]></title>
      <link>http://securityratty.com/article/89e92ac703db317a9f2d0ad0ae004a56</link>
      <guid>http://securityratty.com/article/89e92ac703db317a9f2d0ad0ae004a56</guid>
      <description><![CDATA[Thanks to the affiliate based business model that's driving the increase of fake security software and rogue codecs serving domains, the very same templates, but with different domain names, continue...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://4.bp.blogspot.com/_wICHhTiQmrA/SLKFy9dsYiI/AAAAAAAACHE/DiRDPArpb4A/s1600-h/fake_security_software_august.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://4.bp.blogspot.com/_wICHhTiQmrA/SLKFy9dsYiI/AAAAAAAACHE/jlXrnI7ApPo/s200-R/fake_security_software_august.JPG" /></a>Thanks to the affiliate based business model that's driving the increase of fake security software and rogue codecs serving domains, the very same templates, but with different domain names, continue appearing in blackhat SEO, spam, and malicious doorways redirection campaigns.<br />
<br />
Moreover, with the "time-to-market" of a fake security software decreasing due to the efficiency approach introduced in the form of tips for abuse-free hosting services provided by the "known suspects", and the freely available templates, we're slowly starting to see the upcoming peak of this approach. <br />
<br />
In a true proactive spirit, the domains parked at 216.195.56.88 are all upcoming fake security software, to be introduced anytime soon.<br />
<br />
<b>fast-pc-scanner-online .com</b> - (92.62.101.41; 91.203.92.48; 91.203.92.106; 58.65.238.171)<br />
<b>top-pc-scanner .com<br />
buy-secure-protection .com<br />
security-scan-pc .com<br />
pc-scanner-online .com<br />
viruses-scanonline .com<br />
virus-scanonline .com<br />
antivirus-scanonline .com<br />
topvirusscan .com<br />
virusbestscan .com<br />
best-security-protection .com<br />
infectionscanner .com<br />
virusbestscanner .com<br />
full-protection-now .com</b><br />
<br />
<b>Pwrantivirus .com</b> - 91.208.0.246<br />
<b>vav-x-scanner .com<br />
vav-scanner .com<br />
scanner.vavscan .com<br />
malware-scan .com<br />
Scanner-Pwrantivirus .com<br />
Xpertantivirus .com<br />
Scanner-xpertantivirus .com</b><br />
<br />
<b>spyware-quickscan-2008 .com</b> - (216.195.56.88)<br />
<b>virus-quickscan-2008 .com<br />
spyware-quickscan-2009 .com<br />
virus-quickscan-2009 .com<br />
winmalwarecontrol .com<br />
antispyware-quick-scan .com<br />
virus-quick-scan .com<br />
antivirus-quick-scan .com<br />
winprivacytool .com</b><br />
<br />
<b>topantispyware2008 .com</b> - (216.195.56.86)<br />
<b>cleanermaster .com</b> - (216.195.56.85)<br />
<b>antivirus777 .com</b> - (67.228.120.3)<br />
<b>pcsecuritynotice .com </b>- (67.228.120.3)<br />
<br />
Whereas the average Internet users are falling victims into this type of fraud, what I'm more concerned about is the large traffic the malicious domains receive in general due to all the different traffic acquisition tactics the people behind them apply. This anticipated traffic can then be greatly used as valuable metrics for the many other malicious ways in which it can be monetized.<br />
<br />
Ironically, the participant in the affiliate program whose original objective was to drive traffic to the fake security software's site, may in fact start receiving so much traffic due to the combination of traffic acquisition tactics, that <a href="http://ddanchev.blogspot.com/2008/02/serving-malware-through-advertising.html">introducing client-side exploits courtesy of a third-party affiliate network</a>, may in fact prove more profitable then the revenue sharing partnership with the rogue security software's vendor at the first place.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2008/08/diverse-portfolio-of-fake-security_20.html">A Diverse Portfolio of Fake Security Software - Part Three</a><b> </b><br />
<a href="http://ddanchev.blogspot.com/2008/08/diverse-portfolio-of-fake-security.html">A Diverse Portfolio of Fake Security Software - Part Two</a><br />
<a href="http://ddanchev.blogspot.com/2008/04/localized-fake-security-software.html">Localized Fake Security Software</a><br />
<a href="http://ddanchev.blogspot.com/2007/12/diverse-portfolio-of-fake-security.html">Diverse Portfolio of Fake Security Software</a><br />
<a href="http://ddanchev.blogspot.com/2008/05/got-your-xpshield-up-and-running.html">Got Your XPShield Up and Running?</a><br />
<a href="http://ddanchev.blogspot.com/2008/05/fake-pestpatrol-security-software.html">Fake PestPatrol Security Software</a><br />
<a href="http://ddanchev.blogspot.com/2007/10/rbns-fake-security-software.html">RBN's Fake Security Software</a><br />
<a href="http://ddanchev.blogspot.com/2008/07/lazy-summer-days-at-ukrtelegroup-ltds.html">Lazy Summer Days at UkrTeleGroup Ltd</a><br />
<a href="http://ddanchev.blogspot.com/2008/02/geolocating-malicious-isps.html">Geolocating Malicious ISPs</a><br />
<a href="http://ddanchev.blogspot.com/2008/06/malicious-isps-you-rarely-see-in-any.html">The Malicious ISPs You Rarely See in Any Report</a><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=T4pWXK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=T4pWXK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=fUdxLK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=fUdxLK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=wfXZZk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=wfXZZk" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=DNdBTk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=DNdBTk" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=A69ooK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=A69ooK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=kvp7rK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=kvp7rK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=PdsGMk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=PdsGMk" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/374177616" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 25 Aug 2008 01:58:02 +0000</pubDate>
      <category domain="http://securityratty.com/tag/fake security software">fake security software</category>
      <category domain="http://securityratty.com/tag/traffic">traffic</category>
      <category domain="http://securityratty.com/tag/drive traffic">drive traffic</category>
      <category domain="http://securityratty.com/tag/diverse portfolio">diverse portfolio</category>
      <category domain="http://securityratty.com/tag/traffic acquisition tactics">traffic acquisition tactics</category>
      <category domain="http://securityratty.com/tag/malicious">malicious</category>
      <category domain="http://securityratty.com/tag/malicious isps">malicious isps</category>
      <category domain="http://securityratty.com/tag/due">due</category>
      <category domain="http://securityratty.com/tag/traffic due">traffic due</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/374177616/diverse-portfolio-of-fake-security_25.html">A Diverse Portfolio of Fake Security Software - Part Four</source>
    </item>
    <item>
      <title><![CDATA[[OT rant] Are there any home WiFi routers that DON'T SUCK?]]></title>
      <link>http://securityratty.com/article/2110e94e736fbe5f32088eee09481bee</link>
      <guid>http://securityratty.com/article/2110e94e736fbe5f32088eee09481bee</guid>
      <description><![CDATA[Warning: rant ahead, and names named
When I'm not traveling, I like to work from home some days rather than endure the trek from Seattle to Redmond (although it's much better now that our own employee...]]></description>
      <content:encoded><![CDATA[<p><em>Warning: rant ahead, and names named.</em></p>  <p>When I'm not traveling, I like to work from home some days rather than endure the trek from Seattle to Redmond (although it's much better now that our own <a href="http://seattlepi.nwsource.com/business/332970_msftbus25.html" target="_blank">employee transit service</a> has expanded into my neighborhood -- the existence of which is sad commentary on the availability and reliability of Seattle's public transit companies).</p>  <p>This means, of course, that I need fast and stable network connections. Comcast with their PowerBoost is working very well for me. But I just can't find a decent wireless router at all. My Lenovo T61p (with Intel 4965abgn adapter) just won't stay connected to my D-Link DIR-628 and IT'S DRIVING ME CRAZY! (Yes, I've tried various driver versions, from both Lenovo and Intel.)</p>  <p>My house is in an area with a lot of wireless activity -- sometimes I can see nine or ten SSIDs. I'm running draft N on 2.4GHz (which occupies two non-adjacent channels, currently 1 and 4), and I suspect the problem is collision interference. I could shift the router to 5.2GHz, which I probably would help, but then the rest of the computers in my house won't connect. Why, you ask? Well get this: the DIR-628 is part of <a href="http://www.dlink.com/products/category.asp?cid=1&amp;sec=1#cid_103" target="_blank">D-Link's RangeBooster N family</a>. So I stayed in the family and got two DWA-542 adapters for the desktop computers. Yet they only do 2.4GHz! Silly me, I assumed that being in the same family means full support of the router's capabilities.</p>  <p>I'm very tempted to replace my router again -- and I'm thinking that the best option is to get one with dual radios. That way I can move my T61p to 5.2GHz and replace the desktop adapters, while still having single-channel 802.11b/g on 2.4GHz for the Wii and my PlayStation Portable.</p>  <p>Now my request: tell me about your experience with home routers. What do you really like, and why? What should I buy?</p><img src="http://blogs.technet.com/aggbug.aspx?PostID=3110595" width="1" height="1">]]></content:encoded>
      <pubDate>Fri, 22 Aug 2008 20:12:38 +0000</pubDate>
      <category domain="http://securityratty.com/tag/decent wireless router">decent wireless router</category>
      <category domain="http://securityratty.com/tag/home">home</category>
      <category domain="http://securityratty.com/tag/router">router</category>
      <category domain="http://securityratty.com/tag/lenovo">lenovo</category>
      <category domain="http://securityratty.com/tag/d-link dir-628">d-link dir-628</category>
      <category domain="http://securityratty.com/tag/lenovo t61p">lenovo t61p</category>
      <category domain="http://securityratty.com/tag/intel">intel</category>
      <category domain="http://securityratty.com/tag/dir-628">dir-628</category>
      <category domain="http://securityratty.com/tag/intel 4965abgn adapter">intel 4965abgn adapter</category>
      <source url="http://blogs.technet.com/steriley/archive/2008/08/22/ot-rant-are-there-any-home-wifi-routers-that-don-t-suck.aspx">[OT rant] Are there any home WiFi routers that DON'T SUCK?</source>
    </item>
    <item>
      <title><![CDATA[SSDs are hot, but not without security risks]]></title>
      <link>http://securityratty.com/article/f2cc3357b789721828986acd326c3a5a</link>
      <guid>http://securityratty.com/article/f2cc3357b789721828986acd326c3a5a</guid>
      <description><![CDATA[Solid-state drives are fast becoming popular replacements for hard drives, especially in laptops, but experts caution that SSDs aren't as secure as commonly...]]></description>
      <content:encoded><![CDATA[Solid-state drives are fast becoming popular replacements for hard drives, especially in laptops, but experts caution that SSDs aren't as secure as commonly thought.]]></content:encoded>
      <pubDate>Thu, 21 Aug 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/experts caution">experts caution</category>
      <category domain="http://securityratty.com/tag/popular replacements">popular replacements</category>
      <category domain="http://securityratty.com/tag/ssds">ssds</category>
      <category domain="http://securityratty.com/tag/laptops">laptops</category>
      <category domain="http://securityratty.com/tag/secure">secure</category>
      <category domain="http://securityratty.com/tag/fast">fast</category>
      <category domain="http://securityratty.com/tag/commonly">commonly</category>
      <category domain="http://securityratty.com/tag/hard">hard</category>
      <source url="http://www.networkworld.com/news/2008/082208-ssds-are-hot-but-not.html?fsrc=rss-security">SSDs are hot, but not without security risks</source>
    </item>
    <item>
      <title><![CDATA[Technology Tales from Thailand: KBank Fraud Management]]></title>
      <link>http://securityratty.com/article/5f893d1cf14b7adbe58a329292652735</link>
      <guid>http://securityratty.com/article/5f893d1cf14b7adbe58a329292652735</guid>
      <description><![CDATA[In The Magical ATM Card and SMS Message in Thailand we talked about booking flights and securely paying using a SMS PayCode and ATM transfer, avoiding the possibility of on-line credit card fraud; and...]]></description>
      <content:encoded><![CDATA[<p>In <a title="The Magical ATM Card and SMS Message in Thailand" rel="bookmark" href="http://www.thecepblog.com/2008/08/03/the-magical-atm-card-and-sms-message-in-thailand/"><span style="color: #105cb6;">The Magical ATM Card and SMS Message in Thailand</span></a> we talked about booking flights and securely paying using a SMS PayCode and ATM transfer, avoiding the possibility of on-line credit card fraud; and in <a title="Keyloggers: Why Banks Need Two-Factor Authentication" rel="bookmark" href="http://www.thecepblog.com/2008/01/14/keyloggers-why-banks-need-two-factor-authentication/"><span style="color: #105cb6;">Keyloggers: Why Banks Need Two-Factor Authentication</span></a> I described how <a href="http://www.kasikornbank.com/portal/site/KBank/?" target="_blank">KBank</a> uses SMS-based one-time-passwords (OTP) to authenticate transactions.   </p>
<p>In addition to the above services, KBank offers a service that permits users to receive an SMS message that details any change in account balance and/or point-of-sale (POS) transaction with your debit card.   I really like this service and the feeling of security knowing when, where and by how much my balance changes or my debit card is used in a transaction.    The KBank POS SMS notification is so fast that when I present my card to a merchant I normally receive an SMS message detailing the transaction before the merchant returns for my signature.  (There is an unfortunate lag in the balance change notification that can run minutes to hours behind real-time, but the POS VISA debit card notification is real-time).</p>
<p>As the story goes,  I should have been using my KBank card and account a few weeks ago and not my US-based VISA debit dard.  Why?</p>
<p>My US-based VISA debit card was cloned sometime on or before August 8th.   I am really careful with this card, so I was surprised the magnetic strip was cloned at a POS merchant.   The fraudster made 7 fraudulent transactions beginning on August 8th for a total of around $2500 USD, mostly on August 11th, before I discovered the fraudulent transactions viewing my account on-line.</p>
<p>This would not have happened with KBank SMS-based transaction notification services.</p>
<p>The first transaction with my cloned VISA debit card was less than $50 USD (I assume the fraudster was &#8220;testing the water&#8221;).   If I was using my KBank card, I would have received an immediate SMS message detailing a POS transaction in Bangkok when I was physically far away from Bangkok in Chiang Mai.   I could have immediately called the bank (or logged in) and blocked the debit card, limiting potential losses to the bank or the merchant to one fraudulent transaction, not seven.</p>
<p>In addition, KBank offers what they call a Web-Shopping VISA card, where you can go into your on-line account (verified by SMS OTP as mentioned) and request a VISA debit card number (with expiration date, CCV etc).   You set the limit from 0 to 500,000 THB (Thai Baht) per day; and you can login to your account and change this anytime (authenticating your transaction with another SMS-based OTP). You can also block or cancel this number anytime and apply for another one.</p>
<p>I am amazed that in Thailand I receive much better anti-fraud prevention and detection services than with banks in the US.   I know of no bank or brokerage in the US that offers the same quality of service and security as KBank in Thailand.  </p>
]]></content:encoded>
      <pubDate>Wed, 20 Aug 2008 03:16:51 +0000</pubDate>
      <category domain="http://securityratty.com/tag/visa debit card">visa debit card</category>
      <category domain="http://securityratty.com/tag/debit card">debit card</category>
      <category domain="http://securityratty.com/tag/card">card</category>
      <category domain="http://securityratty.com/tag/visa card">visa card</category>
      <category domain="http://securityratty.com/tag/kbank">kbank</category>
      <category domain="http://securityratty.com/tag/kbank card">kbank card</category>
      <category domain="http://securityratty.com/tag/transaction">transaction</category>
      <category domain="http://securityratty.com/tag/transaction notification services">transaction notification services</category>
      <category domain="http://securityratty.com/tag/fraudulent transaction">fraudulent transaction</category>
      <source url="http://www.thecepblog.com/2008/08/20/technology-tales-from-thailand/">Technology Tales from Thailand: KBank Fraud Management</source>
    </item>
    <item>
      <title><![CDATA[Compromised Cpanel Accounts For Sale]]></title>
      <link>http://securityratty.com/article/6228ebb081126296ff70b5f6268fd2a3</link>
      <guid>http://securityratty.com/article/6228ebb081126296ff70b5f6268fd2a3</guid>
      <description><![CDATA[Is the once popular in the second quarter of 2007, embedded malware tactic on the verge of irrelevance, and if so, what has contributed to its decline? Have SQL injections executed through botnets...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://4.bp.blogspot.com/_wICHhTiQmrA/SKlq1uSeDFI/AAAAAAAACDM/l4bxcru-BQk/s1600-h/cpanel_multiple_domains1.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://4.bp.blogspot.com/_wICHhTiQmrA/SKlq1uSeDFI/AAAAAAAACDM/ho301JgoMUs/s200-R/cpanel_multiple_domains1.png" /></a> Is the once popular in the second quarter of 2007, embedded malware tactic on the verge of irrelevance, and if so, what has contributed to its decline? Have SQL injections executed through botnets turned into the most efficient way to infect hundreds of thousands of legitimate web sites? Depends on who you're dealing with.<br />
<br />
A cyber criminal's position in the "underground food chain" can be easily tracked down on the basis of tools and tactics that he's taking advantage of, in fact, some would on purposely misinform on what their actual capabilities are in order not to attract too much attention to their real ones, consisting of high-profile compromises at hundreds of high-profile web sites.<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://3.bp.blogspot.com/_wICHhTiQmrA/SKmDVdDGnPI/AAAAAAAACDU/qNbLBUKlHp0/s1600-h/cpanel_multiple_domains3.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://3.bp.blogspot.com/_wICHhTiQmrA/SKmDVdDGnPI/AAAAAAAACDU/ZsmcK9HMeUs/s200-R/cpanel_multiple_domains3.jpg" /></a>Embedded malware may not be as hot as it used to be in the last quarter of 2007, but thanks to the oversupply of stolen accounting data, certain individuals within the underground ecosystem seem to be abusing entire portfolios of domains on the basis of purchasing access to the compromised accounts. In fact, the oversupply of compromised Cpanel accounts is logically resulting in their decreasing price, with the sellers differentiating their propositions, and charging premium prices based on the site's page ranks and traffic, measured through publicly available services, or through the internal statistics.<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://4.bp.blogspot.com/_wICHhTiQmrA/SKmMyr4CWEI/AAAAAAAACDc/UafOTCKAb-0/s1600-h/cpanel_multiple_domains22.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://4.bp.blogspot.com/_wICHhTiQmrA/SKmMyr4CWEI/AAAAAAAACDc/7IRBMNndy-w/s200-R/cpanel_multiple_domains22.JPG" /></a><br />
SQL injections may be the tactic of choice for the time being, but as long as stolen accounting data consisting of Cpanel logins, and web shells access to misconfigured web servers remain desired underground goods, goold old fashioned embedded malware will continue taking place.<br />
<br />
Interestingly, from an economic perspective, the way the seller markets his goods, can greatly influence the way they get abused given he continues offering after-sale services and support. It's blackhat search engine optimization I have in mind, sometimes the tactic of choice especially given its high liquidity in respect to monetizing the compromised access.<br />
<br />
The bottom line - for the time being, there's a higher probability that your web properties will get SQL injected, than IFRAME-ed, as it used to be half a year ago, and that's because what used to be a situation where malicious parties would aim at launching a targeted attack at high profile site and abuse the huge traffic it receives, is today's pragmatic reality where a couple of hundred low profile web sites can in fact return more traffic to the cyber criminals, and greatly extend the lifecycle of their campaign taking advantage of the fact the the low profile site owners would remain infected and vulnerable for months to come.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2008/03/embedding-malicious-iframes-through.html">Embedding Malicious IFRAMEs Through Stolen FTP Accounts</a><br />
<a href="http://ddanchev.blogspot.com/2008/03/injecting-iframes-by-abusing-input.html">Injecting IFRAMEs by Abusing Input Validation</a><br />
<a href="http://ddanchev.blogspot.com/2008/07/money-mule-recruiters-use-asproxs-fast.html">Money Mule Recruiters use ASProx's Fast-flux Services</a><br />
<a href="http://ddanchev.blogspot.com/2008/05/malware-domains-used-in-sql-injection.html">Malware Domains Used in the SQL Injection Attacks</a><br />
<a href="http://ddanchev.blogspot.com/2008/07/obfuscating-fast-fluxed-sql-injected.html">Obfuscating Fast-fluxed SQL Injected Domains</a><br />
<a href="http://ddanchev.blogspot.com/2008/07/sql-injecting-malicious-doorways-to.html">SQL Injecting Malicious Doorways to Serve Malware </a><br />
<a href="http://ddanchev.blogspot.com/2008/05/yet-another-massive-sql-injection.html">Yet Another Massive SQL Injection Spotted in the Wild</a><br />
<a href="http://ddanchev.blogspot.com/2008/05/malware-domains-used-in-sql-injection.html">Malware Domains Used in the SQL Injection Attacks</a><br />
<a href="http://ddanchev.blogspot.com/2007/07/sql-injection-through-search-engines.html">SQL Injection Through Search Engines Reconnaissance</a><br />
<a href="http://ddanchev.blogspot.com/2007/05/google-hacking-for-vulnerabilities.html">Google Hacking for Vulnerabilities</a><br />
<a href="http://blogs.zdnet.com/security/?p=1122">Fast-Fluxing SQL injection attacks executed from the Asprox botnet</a><br />
<a href="http://blogs.zdnet.com/security/?p=1394">Sony PlayStation's site SQL injected, redirecting to rogue security software</a><br />
<a href="http://blogs.zdnet.com/security/?p=1118">Redmond Magazine Successfully SQL Injected by Chinese Hacktivists</a><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=ExzKaK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=ExzKaK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=AgwoKK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=AgwoKK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=5JjO7k"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=5JjO7k" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=5Z85mk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=5Z85mk" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=s4xhGK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=s4xhGK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=ReebmK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=ReebmK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=T0yjTk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=T0yjTk" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/368194376" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 18 Aug 2008 06:42:50 +0000</pubDate>
      <category domain="http://securityratty.com/tag/sql">sql</category>
      <category domain="http://securityratty.com/tag/sql injections">sql injections</category>
      <category domain="http://securityratty.com/tag/sql injection attacks">sql injection attacks</category>
      <category domain="http://securityratty.com/tag/massive sql injection">massive sql injection</category>
      <category domain="http://securityratty.com/tag/profile site">profile site</category>
      <category domain="http://securityratty.com/tag/site">site</category>
      <category domain="http://securityratty.com/tag/site sql">site sql</category>
      <category domain="http://securityratty.com/tag/sql injection">sql injection</category>
      <category domain="http://securityratty.com/tag/tactic">tactic</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/368194376/compromised-cpanel-accounts-for-sale.html">Compromised Cpanel Accounts For Sale</source>
    </item>
    <item>
      <title><![CDATA[76Service - Cybercrime as a Service Going Mainstream]]></title>
      <link>http://securityratty.com/article/35bdaf104e9aecf7703834d959f39050</link>
      <guid>http://securityratty.com/article/35bdaf104e9aecf7703834d959f39050</guid>
      <description><![CDATA[Disintermediating the intermediaries in the cybercrime ecosystem, ultimately results in more profitable operations. Controversial to the concept of outsourcing, some cybercriminals are in fact so...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="text-align: center; clear: both;"></div><a href="http://3.bp.blogspot.com/_wICHhTiQmrA/SKKs5L3ihpI/AAAAAAAACBs/vEaSMC2S8nI/s1600-h/76service.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://3.bp.blogspot.com/_wICHhTiQmrA/SKKs5L3ihpI/AAAAAAAACBs/qhgjQh39ej8/s200-R/76service.JPG" style="border: 0pt none ;" /></a>Disintermediating the intermediaries in the cybercrime ecosystem, ultimately results in more profitable operations. Controversial to the concept of outsourcing, some cybercriminals are in fact so self-sufficient, that the stereotype of a mysterious 76service server offered for rent could in fact easily cease to exist in an ecosystem so vibrant that literally everyone can partion their botnet and start offering access to it on a multi-user basis. Evil? Obviously. Extending the lifecycle of a proprietary malware tool? Definitely.<br />
<br />
<a href="http://www.youtube.com/watch?v=lw9IeuKkNbc">The infamous 76service</a>, a cybercrime as a service web interface where customers basically collect the final output out of the banking malware botnet during the specific period of time for which they've purchases access to the service, is going mainstream, with 76Service's Spring Edition apparently leaking out, and cybercriminals enjoying its interoperability potential by introducing different banking trojans in their campaigns. <br />
<br />
In this post, I'll discuss the 76service's spring.edition that has been combined with a <a href="http://ddanchev.blogspot.com/2007/11/metaphisher-malware-kit-spotted-in-wild.html">Metaphisher banking malware</a>, an a popular <a href="http://ddanchev.blogspot.com/2008/04/crimeware-in-middle-zeus.html">web malware exploitation kit</a>, with two campaigns currently hosting 5.51GB of stolen banking data based on over 1 million compromised hosts 59% of which are based in Russia. Screenshots courtesy of an egocentric underground show-off.<br />
<br />
<a href="http://www.cio.com/article/print/135500">Some general info on the 76service</a> :<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="text-align: center; clear: both;"></div><a href="http://1.bp.blogspot.com/_wICHhTiQmrA/SKKyWAXgYGI/AAAAAAAACB0/JXHZFuBb6Rs/s1600-h/76service1.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://1.bp.blogspot.com/_wICHhTiQmrA/SKKyWAXgYGI/AAAAAAAACB0/2qZfVy6YfU8/s200-R/76service1.JPG" style="border: 0pt none ;" /></a>"<i>Subscribers could log in with their assigned user name and     password any time during the 30-day project. They’d be     met with a screen that told them which of their bots was     currently active, and a side bar of management options. For     example, they could pull down the latest drops—data     deposits that the Gozi-infected machines they subscribed to     sent to the servers, like the 3.3 GB one Jackson had     found. A project was like an investment portfolio. Individual     Gozi-infected machines were like stocks and subscribers bought     a group of them, betting they could gain enough personal     information from their portfolio of infected machines to make a     profit, mostly by turning around and selling credentials on the     black market. (In some cases, subscribers would use a few of     the credentials themselves). Some machines, like some stocks, would under perform and     provide little private information. But others would land the     subscriber a windfall of private data. The point was to     subscribe to several infected machines to balance that risk,     the way Wall Street fund managers invest in many stocks to     offset losses in one company with gains in another.</i>"<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="text-align: center; clear: both;"></div><a href="http://1.bp.blogspot.com/_wICHhTiQmrA/SKKy5q1ebVI/AAAAAAAACB8/uGe8GuhDvRg/s1600-h/76service2.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://1.bp.blogspot.com/_wICHhTiQmrA/SKKy5q1ebVI/AAAAAAAACB8/88IxypeBf74/s200-R/76service2.JPG" style="border: 0pt none ;" /></a>The 76service empowers everyone who is either not willing to spend time and resources for building and maintaining a botnet, launching campaigns, and SQL injecting hundreds of thousands of sites in order to take advantage of the long tail of malware infected sites that theoretically can outpace the traffic that could come from a SQL injected high-profile site.<br />
<br />
Next to the spring.edition, <a href="http://secureworks.com/research/threats/gozi/">the winter edition's price starts from $1000 and goes to $2000</a>, which is all a matter of who you're buying it from, unless of course you haven't come across leaked copies :<br />
<br />
"<i>Assuming that the dealer offering what he claimed was the 76service kit was correct, the profit is not only in the kit, but in selling value added services like exploitation, compromised servers/accounts, database configuration, and customization of the interface. Prices start between $1000 to $2000 and go up based on added services. The underground payment methods generally involve hard-to-track virtual currencies, whose central authority is in a jurisdiction where regulation is liberal to non-existent, and feature non-reversible transactions. The individual or group called "76service" was easy to track down on the Web, but not in person.</i>" <br />
<br />
<div style="text-align: left;"></div><div class="separator" style="text-align: center; clear: both;"></div><a href="http://1.bp.blogspot.com/_wICHhTiQmrA/SKLUyA7g9LI/AAAAAAAACCE/nl-OA3FHPs0/s1600-h/76service3.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://1.bp.blogspot.com/_wICHhTiQmrA/SKLUyA7g9LI/AAAAAAAACCE/8zS6gcoEdvk/s200-R/76service3.JPG" style="border: 0pt none ;" /></a>It's interesting to monitor how services aiming to provide specific malicious services are vertically integrating by expanding their portfolio of related services -- taka a spamming vendor that will offer the segmented email databases, the advanced metrics, and the localization of the spam messages to different languages -- or letting the buyer have full control of anything that comes out of a particular botnet for a specific period of time in which he has bought access to it. For instance, DDoS for hire matured into botnet for hire, which evolved into today's "What type of stolen data do you want?" for hire mentality I'm starting to see emerging, next to the usual interest in improving the metrics and thereby the probability for a more succesful campaign. <br />
<br />
<div style="text-align: left;"></div><div class="separator" style="text-align: center; clear: both;"></div><a href="http://2.bp.blogspot.com/_wICHhTiQmrA/SKLa2TO4yAI/AAAAAAAACCM/4s3Mkgb-NOY/s1600-h/metafisher1_ukstories.jpg" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://2.bp.blogspot.com/_wICHhTiQmrA/SKLa2TO4yAI/AAAAAAAACCM/Bt7wKW7IPcE/s200-R/metafisher1_ukstories.jpg" style="border: 0pt none ;" /></a>Ironically, this cybercrime model is so efficient that the people behind it cannot seem to be able to process all of the stolen data, which like a great deal of underground assets loses its value if not sold as fast as possible. The result of this oversupply of stolen data are the increasing number of services selling raw logs segmented based on a particular country for a specific period of time.<br />
<br />
Time for a remotely exploitable vulnerability in yet another malware kit about to go mainstream? Definitely, unless of course backdooring it and releasing it doesn't achieve the obvious results of controlling someone else's cybercrime ecosystem.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2007/03/underground-economys-supply-of-goods.html">The Underground Economy's Supply of Goods and Services</a><br />
<a href="http://ddanchev.blogspot.com/2007/10/dynamics-of-malware-industry.html">The Dynamics of the Malware Industry - Proprietary Malware Tools</a><br />
<a href="http://ddanchev.blogspot.com/2008/06/using-market-forces-to-disrupt-botnets.html">Using Market Forces to Disrupt Botnets</a><br />
<a href="http://ddanchev.blogspot.com/2007/10/multiple-firewalls-bypassing.html">Multiple Firewalls Bypassing Verification on Demand</a><br />
<a href="http://ddanchev.blogspot.com/2007/10/managed-spamming-appliances-future-of.html">Managed Spamming Appliances - The Future of Spam</a><br />
<a href="http://ddanchev.blogspot.com/2008/02/localizing-cybercrime-cultural.html">Localizing Cybercrime - Cultural Diversity on Demand</a><br />
<a href="http://ddanchev.blogspot.com/2008/01/e-crime-and-socioeconomic-factors.html">E-crime and Socioeconomic Factors</a><b>&nbsp;</b><br />
<a href="http://ddanchev.blogspot.com/2007/08/malware-as-web-service.html">Malware as a Web Service</a><b>&nbsp;</b><br />
<a href="http://ddanchev.blogspot.com/2008/07/coding-spyware-and-malware-for-hire.html">Coding Spyware and Malware for Hire</a><br />
<a href="http://ddanchev.blogspot.com/2008/07/are-stolen-credit-card-details-getting.html">Are Stolen Credit Card Details Getting Cheaper?</a><br />
<a href="http://ddanchev.blogspot.com/2008/07/neosploit-team-leaving-it-underground.html">Neosploit Team Leaving the IT Underground</a><br />
<a href="http://ddanchev.blogspot.com/2008/06/zeus-crimeware-kit-vulnerable-to.html">The Zeus Crimeware Kit Vulnerable to Remotely Exploitable Flaw</a><br />
<a href="http://ddanchev.blogspot.com/2008/08/pinch-vulnerable-to-remotely.html">Pinch Vulnerable to Remotely Exploitable Flaw</a><br />
<a href="http://ddanchev.blogspot.com/2008/07/dissecting-managed-spamming-service.html">Dissecting a Managed Spamming Service</a><br />
<a href="http://ddanchev.blogspot.com/2007/10/managed-spamming-appliances-future-of.html">Managed "Spamming Appliances" - The Future of Spam</a><br />
<br />
<b> </b><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=NWhwdK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=NWhwdK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=7zGnyK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=7zGnyK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=Rqgfok"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=Rqgfok" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=zA7GDk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=zA7GDk" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=4r7WMK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=4r7WMK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=880FjK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=880FjK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=3wtOmk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=3wtOmk" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/363878623" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 13 Aug 2008 04:08:43 +0000</pubDate>
      <category domain="http://securityratty.com/tag/76service">76service</category>
      <category domain="http://securityratty.com/tag/service">service</category>
      <category domain="http://securityratty.com/tag/malware">malware</category>
      <category domain="http://securityratty.com/tag/malware kit">malware kit</category>
      <category domain="http://securityratty.com/tag/cybercrime">cybercrime</category>
      <category domain="http://securityratty.com/tag/malware botnet">malware botnet</category>
      <category domain="http://securityratty.com/tag/botnet">botnet</category>
      <category domain="http://securityratty.com/tag/mysterious 76service server">mysterious 76service server</category>
      <category domain="http://securityratty.com/tag/web service">web service</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/363878623/76service-cybercrime-as-service-going.html">76Service - Cybercrime as a Service Going Mainstream</source>
    </item>
    <item>
      <title><![CDATA[Addressing NERC Cyber Security Standards Using a Frameworks-Based Approach]]></title>
      <link>http://securityratty.com/article/adf577a5e402094355f94e59576db638</link>
      <guid>http://securityratty.com/article/adf577a5e402094355f94e59576db638</guid>
      <description><![CDATA[Although the NERC Cyber-Security Standards ( http://www.nerc.com/files/CIP-002-1.pdf ) are applicable only in the US, I think there's no doubt that cyber security is fast becoming a major concern of...]]></description>
      <content:encoded><![CDATA[Although the NERC Cyber-Security Standards (<a href="http://www.nerc.com/files/CIP-002-1.pdf" target=_blank>http://www.nerc.com/files/CIP-002-1.pdf</a>) are applicable only in the US, I think there's no doubt that cyber security is fast becoming a major concern of electric utility companies worldwide.  In addition, other US critical infrastructure industry segments, such as water and chemical companies are also coming under increasing federal pressure to improve their own cyber-security efforts.  Still, the NERC Cyber-Security standards have been criticized for being too ambiguous, providing little in the way of guidance, <B>as well as for leaving loopholes for utility companies to beat the rules...</b> ]]></content:encoded>
      <pubDate>Tue, 12 Aug 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/nerc">nerc</category>
      <category domain="http://securityratty.com/tag/nerc cyber-security standards">nerc cyber-security standards</category>
      <category domain="http://securityratty.com/tag/cyber security">cyber security</category>
      <category domain="http://securityratty.com/tag/utility companies">utility companies</category>
      <category domain="http://securityratty.com/tag/federal pressure">federal pressure</category>
      <category domain="http://securityratty.com/tag/chemical companies">chemical companies</category>
      <category domain="http://securityratty.com/tag/major concern">major concern</category>
      <category domain="http://securityratty.com/tag/cyber-security efforts">cyber-security efforts</category>
      <category domain="http://securityratty.com/tag/guidance">guidance</category>
      <source url="http://www.rsa.com/blog/blog_entry.aspx?id=1329">Addressing NERC Cyber Security Standards Using a Frameworks-Based Approach</source>
    </item>
    <item>
      <title><![CDATA[Economist.com - Confessions of a Risk Manager]]></title>
      <link>http://securityratty.com/article/536365450db644abfa519cdc03dc2c4c</link>
      <guid>http://securityratty.com/article/536365450db644abfa519cdc03dc2c4c</guid>
      <description><![CDATA[I was reading the Economist this week and came across an excellent article titled &quot; Confessions of a Risk Manager

In the article a risk manager for a major financial institution talks about managing...]]></description>
      <content:encoded><![CDATA[I was reading the <a href="http://www.economist.com/">Economist </a>this week and came across an excellent article titled "<a href="http://www.economist.com/finance/displaystory.cfm?story_id=11897037">Confessions of a Risk Manager</a>".<br /><br />In the article a risk manager for a major financial institution talks about managing risks and how the risk department was viewed as an obstacle by the rest of the business.  I'll just quote a section here so you can see that governance roles, especially those involving trade-offs of risk vs. return are difficult not just in security.<br /><blockquote>In their eyes, we were not earning money for the bank. Worse, we had the power to say no and therefore prevent business from being done. Traders saw us as obstructive and a hindrance to their ability to earn higher bonuses. They did not take kindly to this. Sometimes the relationship between the risk department and the business lines ended in arguments.   . . .<br /><br />Tactfully explaining why we said no was not our forte. Traders were often exasperated as much by how they were told as by what they were told.  <p>At the root of it all, however, was—and still is—a deeply ingrained flaw in the decision-making process. In contrast to the law, where two sides make an equal-and-opposite argument that is fairly judged, in banks there is always a bias towards one side of the argument. The business line was more focused on getting a transaction approved than on identifying the risks in what it was proposing. The risk factors were a small part of the presentation and always “mitigated”. This made it hard to discourage transactions. If a risk manager said no, he was immediately on a collision course with the business line. The risk thinking therefore leaned towards giving the benefit of the doubt to the risk-takers.<br /></p><p>Collective common sense suffered as a result. Often in meetings, our gut reactions as risk managers were negative. But it was difficult to come up with hard-and-fast arguments for why you should decline a transaction, especially when you were sitting opposite a team that had worked for weeks on a proposal, which you had received an hour before the meeting started. In the end, with pressure for earnings and a calm market environment, we reluctantly agreed to marginal transactions.</p></blockquote><br />Every time I read about decision making like this I refer back to an some excellent presentations I've come across by Reidar Bratvold.  He has done some excellent presentations on decision making in the face of risks/uncertainty.<br /><br /><ul><li><a href="www.spe.no/stavanger/doc/Bratvold%20-%20SPE%20Dist%20Lecturer.pdf">Would You Know a Good decision if You Saw One?</a></li><li><a href="http://www.reidar-bratvold.com/Decision%20Making%20Under%20Uncertainty%20-%20BadenBaden.pdf">Decision Making Under Uncertainty</a></li></ul><img src="http://feeds.feedburner.com/~r/SecurityRetentive/~4/362069047" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 11 Aug 2008 04:42:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/risk">risk</category>
      <category domain="http://securityratty.com/tag/risk manager">risk manager</category>
      <category domain="http://securityratty.com/tag/risk factors">risk factors</category>
      <category domain="http://securityratty.com/tag/risk-takers">risk-takers</category>
      <category domain="http://securityratty.com/tag/business">business</category>
      <category domain="http://securityratty.com/tag/business line">business line</category>
      <category domain="http://securityratty.com/tag/risk managers">risk managers</category>
      <category domain="http://securityratty.com/tag/risk department">risk department</category>
      <category domain="http://securityratty.com/tag/business lines">business lines</category>
      <source url="http://feeds.feedburner.com/~r/SecurityRetentive/~3/362069047/economistcom-confessions-of-risk.html">Economist.com - Confessions of a Risk Manager</source>
    </item>
    <item>
      <title><![CDATA[The Secret Sauce is the Situation Models]]></title>
      <link>http://securityratty.com/article/e137f84c371e05c9a9841a0cc1ff27ec</link>
      <guid>http://securityratty.com/article/e137f84c371e05c9a9841a0cc1ff27ec</guid>
      <description><![CDATA[AlanLundberg wrote, Intelligent Business Process Platform? in response to Bringing Order to Chaos where someone from PWC linked event processing to business intelligence and business process...]]></description>
      <content:encoded><![CDATA[<p>Alan Lundberg wrote, <a href="http://tibcoblogs.com/cep/2008/08/04/intelligent-business-process-platform/">Intelligent Business Process Platform?</a> in response to <a href="http://www.pwc.com/extweb/home.nsf/docid/FB2EF3AC6E351ECC8525746B00676021" target="_blank">Bringing Order to Chaos</a> where someone from PWC linked event processing to business intelligence and business process management.  In turn, James Taylor penned <a href="http://smartenoughsystems.com/wp/2008/08/05/using-decision-management-to-deliver-intelligent-business-performance/">Using decision management to deliver intelligent business performance</a> where James rightly said that it does not require &#8220;heroic efforts&#8221; to integrate event processing, BI, BPM and other decision support tools.  </p>
<p>As a reference, you may have seen this briefing, one of many where I show these functional relationships, <a href="http://debs.msrg.utoronto.ca/bass.pdf">Mythbusters: Event Stream Processing Versus Complex Event Processing</a>, from DEBS2007.  For example slide 23 shows the functional relationship between events, pre-processing, event tracking, situational detection, historical patterns (the output of BI tools, for example), visualization and business process management.</p>
<p>In <a href="http://rvsoapbox.blogspot.com/2008/08/faithful-representation.html" target="_blank">Faithful Representation</a>, Richard Veryard reminds his readers that the most challenging part is in the situation models (not the system integration).  Unfortunately, by accident, Richard incorrectly attributes Opher Etzion&#8217;s &#8220;first order situation model approximation&#8221; to both Opher and I in this quote from Richard&#8217;s post, <em>&#8220;a simple situation model of complex events, in which events (including derived, composite and complex events) represent the &#8220;situation&#8221;.    </em></p>
<p>Actually, that simple situation model above is Opher&#8217;s, not mine.  I have offered a more general and comprehensive (first draft) situation model, in <a title="A Simple Situation Model for Complex Events" rel="bookmark" href="http://www.thecepblog.com/2008/07/15/a-simple-situation-model-for-complex-events/">A Simple Situation Model for Complex Events</a> based on a cognitive situation model used by <a href="http://www.nd.edu/~memory/theory.html" target="_blank">researchers at the University of Notre Dame</a>.  I do not believe that complex events and situations can be modelled accurately using Opher&#8217;s simple model of <em>derived, composite and complex events.   </em>This model is overly simple, in my opinion. to represent the vast majority of CEP classes of problems, perhaps explaining why Opher and I do not agree on the state-of-the-art of CEP.  Opher tends to view CEP as mostly an extension of active database technology where I see CEP as a technology that is much more closely aligned with the cognitive models represented in the <a href="http://www.thecepblog.com/what-is-complex-event-processing/" target="_blank">art-and-science of multi-sensor data fusion (MSDF).</a>  </p>
<p>Complex events represent situations, and situations must be accurately modelled if we are going to accurately detect them in real-time.  If your business cannot model a complex event (situation) then it does not matter what software you buy, how much money you spend, or what event processing and integration platform you use.   The models are hard.  The system integration is relatively easy.</p>
<p>The secret sauce is the situation and complex event models.</p>
<p>As mentioned here a few times, it does not matter how fast you process events in real-time, if your model is wrong, you just detect the wrong thing very fast.  This is very bad and quite dangerous.  You will make bad decisions fast.  You will waste time, money and resources.</p>
<p>This is why CEP benchmarks should be based on accuracy in situation detection, not in latency and other low-level performance metrics.   First, get the models right; then refine to detect faster, if speed is required.   What has happened in CEP to date, is that the models are so simple, they do not really detect complex events, they just process and act on simple events that are easy to model. </p>
]]></content:encoded>
      <pubDate>Sat, 09 Aug 2008 06:23:08 +0000</pubDate>
      <category domain="http://securityratty.com/tag/situation">situation</category>
      <category domain="http://securityratty.com/tag/situation detection">situation detection</category>
      <category domain="http://securityratty.com/tag/cognitive situation model">cognitive situation model</category>
      <category domain="http://securityratty.com/tag/simple situation model">simple situation model</category>
      <category domain="http://securityratty.com/tag/model">model</category>
      <category domain="http://securityratty.com/tag/situation models">situation models</category>
      <category domain="http://securityratty.com/tag/situation model approximation">situation model approximation</category>
      <category domain="http://securityratty.com/tag/events">events</category>
      <category domain="http://securityratty.com/tag/complex events based">complex events based</category>
      <source url="http://www.thecepblog.com/2008/08/09/the-secret-sauce-is-the-situation-models/">The Secret Sauce is the Situation Models</source>
    </item>
  </channel>
</rss>
