<![CDATA[[SecurityRatty] tag: fraud-detection]]> http://securityratty.com/tag/fraud-detection Thu, 30 Oct 2008 21:00:00 +0000 iRatty Engine http://blogs.law.harvard.edu/tech/rss <![CDATA[Hacking Your SOX Off: Sarbanes-Oxley, Fraud, and Fraudulent Financial Reporting]]> http://securityratty.com/article/281502f81a86714e3f7b33b438faa8bc http://securityratty.com/article/281502f81a86714e3f7b33b438faa8bc Hacking Your SOX Off: Sarbanes-Oxley, Fraud, and Fraudulent Financial Reporting
I had to do a presentation for one of my MBA courses, and one of the topic choices was the Sarbanes-Oxley act. I chose it because I thought I could relate it to computer security, but as it turns out the connection is somewhat tenuous as you will see if you watch the presentation.

]]> Sun, 30 Nov 2008 09:24:22 +0000 sarbanes-oxley fraudulent financial sarbanes-oxley act presentation fraud computer security topic choices sox mba courses Hacking Your SOX Off: Sarbanes-Oxley, Fraud, and Fraudulent Financial Reporting <![CDATA[Hacking Your SOX Off: Sarbanes-Oxley, Fraud, and Fraudulent Financial Reporting]]> http://securityratty.com/article/53096a8433f664fb46e666f371ecca54 http://securityratty.com/article/53096a8433f664fb46e666f371ecca54 Hacking Your SOX Off: Sarbanes-Oxley, Fraud, and Fraudulent Financial Reporting
I had to do a presentation for one of my MBA courses, and one of the topic choices was the Sarbanes-Oxley act. I chose it because I thought I could relate it to computer security, but as it turns out the connection is somewhat tenuous as you will see if you watch the presentation.

]]> Sun, 30 Nov 2008 09:24:22 +0000 sarbanes-oxley fraudulent financial sarbanes-oxley act presentation fraud computer security topic choices sox mba courses Hacking Your SOX Off: Sarbanes-Oxley, Fraud, and Fraudulent Financial Reporting <![CDATA[Elgan: Why you can't trust 'friends' on Facebook]]> http://securityratty.com/article/de87ddbc4f7463f03d5adac7536288e3 http://securityratty.com/article/de87ddbc4f7463f03d5adac7536288e3 Add to digg Add to StumbleUpon Add to Twitter Add to Slashdot
]]> Wed, 26 Nov 2008 02:00:00 +0000 writes mike elgan dangerous opportunities social networks facebook friend fraud subject myspace Elgan: Why you can't trust 'friends' on Facebook <![CDATA[New Visa Card, Generates Random Security Codes]]> http://securityratty.com/article/8fb7d235678e673cc04f68061fd7aeb4 http://securityratty.com/article/8fb7d235678e673cc04f68061fd7aeb4 ]]> Mon, 17 Nov 2008 06:20:02 +0000 visa europe popular concerns daily mail credit card response display digital newly keypad New Visa Card, Generates Random Security Codes <![CDATA[Apple plays catch-up, ads anti-fraud safeguard to Safari]]> http://securityratty.com/article/949c25cc922a5535dd873e46a0e7d378 http://securityratty.com/article/949c25cc922a5535dd873e46a0e7d378 Add to digg Add to StumbleUpon Add to Twitter Add to Slashdot
]]> Fri, 14 Nov 2008 02:00:00 +0000 safari web browser apple major browser security flaws protection sites blocks receive feature Apple plays catch-up, ads anti-fraud safeguard to Safari <![CDATA[Apple plays catch-up, adds anti-fraud safeguard to Safari]]> http://securityratty.com/article/6144ae4569c814f71e85265854f45805 http://securityratty.com/article/6144ae4569c814f71e85265854f45805 Thu, 13 Nov 2008 21:00:00 +0000 microsoft windows version major browser apple friday security bugs safari protection sites blocks specific Apple plays catch-up, adds anti-fraud safeguard to Safari <![CDATA[Experian South Africa launches fraud prevention tool]]> http://securityratty.com/article/fc692c99417c4305c6267e8587cb39bc http://securityratty.com/article/fc692c99417c4305c6267e8587cb39bc

]]> Mon, 10 Nov 2008 21:00:00 +0000 experian south africa security application companies Experian South Africa launches fraud prevention tool <![CDATA[Zeus Crimeware Kit Gets a Carding Layout]]> http://securityratty.com/article/2dadca90df89c26f3f517a1e2b237afd http://securityratty.com/article/2dadca90df89c26f3f517a1e2b237afd
With cybercriminals clearly expressing their nostalgia for several notorious and already shut down credit card fraud communities, they seem to have found a way to once again give their self-esteem a boost. Following the ongoing modification of open source crimeware kits and the inevitable innovation introduced by third parties, last week a new layout was introduced for Zeus, once again courtesy of a group that's piggybacking on Zeus popularity.

It's particularly interesting to see how a one-man operation evolves into a group of third-party developers starting to claim ownership rights over the modified versions despite that they're basically brandjacking the Zeus brand and building business models on the top of it.

Open source crimeware and web malware exploitation kits on the other hand undermine the business model of a great number of "malware/spyware for hire" vendors, which surprisingly doesn't stop them from continuing offering their services and products which are often using the de facto crimeware kits as the foundations for their propositions. Are the buyers even aware of this fact? From a buyer's perspective in times when most of the output is sold in bulk form, or access to the botnet rented for a specific period of time, the buyer doesn't care about the cybercrime platform of use, but is looking for transparent ways to justify the investment he's made into renting the service.

Now that Zeus administrators and their cybercrime clerks in the face of those managing the campaigns knowingly or unknowingly knowing the type of campaigns and the data that they manage, can listen to their favorite music within Zeus and choose different layouts for the command and control interfaces while commiting cybercrime, what's next?

Convergence and improved monetization.
]]> Mon, 10 Nov 2008 02:53:52 +0000 zeus zeus administrators zeus popularity source crimeware kits cybercrime cybercrime clerks source crimeware zeus brand cybercrime platform Zeus Crimeware Kit Gets a Carding Layout <![CDATA[Fun Reading on Security AND Compliance 9]]> http://securityratty.com/article/8c92a5eb0e9512d04ed455c88f9d493d http://securityratty.com/article/8c92a5eb0e9512d04ed455c88f9d493d Instead of my usual "blogging frenzy" machine gun blast of short posts, I will just combine them into my new blog series "Fun Reading on Security." Here is an issue #9, dated October 30th, 2008. BTW, I am renaming it into “Fun Reading on Security AND Compliance”

  1. “A Gartnergate?” What happened after Mr Pescatore uttered his now famous 12 words: “The best security program is at the business with the happiest customers.” This (complete with Gunnar’s famous “firewalls+SSL” chart), this – will add more as this snowballs.
  2. Do you have an “ignorable” security policy? If yours is BOTH “ignorable” and “unfair”, then fuggedaboutit. Cisco survey kinda proves it. A few fun comments are here (“If people can't get their jobs done without having to find a way to circumvent policy then the policy is wrong.”)
  3. Risk and clouds – here, here, here and here in poetic form (!). Fun reading, but you know what? For many, many organization, what they have today is LESS secure than any future cloud computing advance…
  4. Richard Bejtlich drop-kicks SIEM too, then kicks it in the balls. Then kicks the dead horse (1,2,3)
  5. Excellent reminder about why people don’t care about security with a fabled quote from MJR (yes, it is my fave too!) Overall, Rich “reassures” with: “Don’t worry. When things get bad enough, we’ll get the call. If you’ve kept your documentation and communications up, you won’t get shafted with the proverbial short end.”
  6. A few essays on risk, from ANSI, from Schneier and from BlogInfoSec (part 1 and part 2, especially read part 2)
  7. So, what do CTOs really do every day? Interesting summary here and here.
  8. Fun exploration of security x privacy x compliance.
  9. Burton Group opines on which security technologies will fare better/worse during "The crisis”
  10. A really fun interview with our CEO Philippe Courtot here.
  11. More on IT vs IT security, this time from Richard.
  12. Do you want people like that doing “security”? A normal call center employee recognizes fraud, but their so-called “outsource security dept” authorizes the scam. Niiice.
  13. Finally, “Robots Hunt 'Non-Cooperative Humans' in Army Plan” No comment :-)

Enjoy!

About me: http://www.chuvakin.org
]]> Fri, 31 Oct 2008 09:05:00 +0000 security fun outsource security dept security technologies policy circumvent policy ignorable security policy security program ignorable Fun Reading on Security AND Compliance 9 <![CDATA[ICANN Targeting Notorious Domain Name Seller]]> http://securityratty.com/article/a5637715ddf9e86ac300b651f90f199d http://securityratty.com/article/a5637715ddf9e86ac300b651f90f199d
]]> Thu, 30 Oct 2008 21:00:00 +0000 seller estdomains plays online criminals domain ceo company defends security researchers friendly net ICANN Targeting Notorious Domain Name Seller