<![CDATA[[SecurityRatty] tag: flagrantly]]> http://securityratty.com/tag/flagrantly Thu, 19 Jun 2008 23:31:34 +0000 iRatty Engine http://blogs.law.harvard.edu/tech/rss <![CDATA[EstDomains & Intercage: A Perfect Couple in Crime]]> http://securityratty.com/article/8490240982532919695d5c4c9231e15f http://securityratty.com/article/8490240982532919695d5c4c9231e15f take on the topic, or search Emergingthreats to come up to speed.
Yesterday, EstDomains posted the most inept, ridiculous response ever issued to the endless and worthy criticism, largely leveled by Brian Krebs at the Washington Post.
Not only can't these morons from EstDomains write, they're either so deeply clueless or flagrantly malicious (likely both), it's beyond laughable. This section sums it up best:
"The company also has a reliable ally in its battle against malware in a face of Intercage, Inc which provides company with the hosting services of the highest quality. But the outstanding performance of hosting services is not the sole reason why EstDomains, Inc appreciates this partnership so greatly. Intercage, Inc generously provides EstDomains, Inc specialists with reports regarding discovered malware vehicles. As the main database for additional domain name management services is located in Intercage Data Center, EstDomains, Inc has the perfect opportunity to get notifications of the slightest mark of malware presence in the shortest time and take measures in advance."
What? Really?
Again, aside from the absolute butchery of the language, did they just say "The company also has a reliable ally in its battle against malware in a face of Intercage, Inc which provides company with the hosting services of the highest quality."? SIGH...yes, they did.

Allow me to exemplify just how ridiculous a claim that is.
Following is content from a packet capture I took during a recent Storm worm analysis.

Using the ip2asn module included in NSM-console availabe in HeX, we find:
27595 | 216.255.189.211 | INTERCAGE - InterCage, Inc.

Using Etherape, also included in HeX, we see:



Using Eric Hjelmvik's NetworkMiner, we see:



See the recurring theme? Intercage, EstDomain's "reliable ally in its battle against malware".
Nice work, guys...keep it up.

I'm submitting this to The Daily WTF as we speak.

del.icio.us | digg]]> Mon, 15 Sep 2008 17:32:00 +0000 intercage estdomains malware malware presence intercage data center track malware issues reliable ally management services malware vehicles EstDomains & Intercage: A Perfect Couple in Crime <![CDATA[UCE, shouting into thunder]]> http://securityratty.com/article/5da9e0dab3b920301d727b1b9186dd64 http://securityratty.com/article/5da9e0dab3b920301d727b1b9186dd64 Wed, 30 Jul 2008 20:00:00 +0000 commercial e-mail uce feelings violation law stop play unashamedly bad UCE, shouting into thunder <![CDATA[Security Circumvented: My Anti-Virus]]> http://securityratty.com/article/5704ba277530cbbd6aec5c9efb9863d9 http://securityratty.com/article/5704ba277530cbbd6aec5c9efb9863d9 I recently needed to renew the anti-virus subscription on my tablet PC. Of course, Symantec popped up and let me know well in advance, and of course, I waited until the almost-last-day before I renewed.

When my renewal options appeared, there was a selection to upgrade to the shiny new Norton 360. Woo hoo! It listed all these great new security features… I don’t remember what they were… but, they sounded REALLY great (I promise).

So I went with the upgrade, instead of the anti-virus signature renewal. Okay.

It did seem like a good idea at the time. However, in addition to my overly-protective Vista popups eeeevvvvery time I want to run something, connect somewhere, or wipe my nose… Now, I have the Vista pop up AND the Norton 360 popup. Okay.

Except, the Norton pops up with flagrantly ambiguous information like “An application is trying to access your Internet.” Do I want to allow it? I don’t know. How am I supposed to know- which application wants to access my Internet? Oh, it’s not going to tell me. Okay.

Well, I guess I’ll click ‘Allow’ because I have no clue what is trying to access my Internet, but I’ll assume it’s something that I have somehow asked to access my Internet… and I’ll be quite upset if whatever I clicked on doesn’t work. So YES, ALLOW. Okay again.

And what was the point in that? One click has transformed to three, and I’m no more secure than I was before, I’m just being forced to make more clicks to earn my insecurity. So today I am the poster child of what NOT to do.

Security circumvented is quite possibly worse than no security at all. I see visions of ‘invalid browser certificate’ notices dancing in my head.

# # #

]]> Thu, 19 Jun 2008 23:31:34 +0000 security norton pops norton internet security features access flagrantly ambiguous information anti-virus signature renewal possibly worse Security Circumvented: My Anti-Virus