<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: generation]]></title>
    <link>http://securityratty.com/tag/generation</link>
    <description></description>
    <pubDate>Mon, 03 Nov 2008 10:41:51 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[The "A"]]></title>
      <link>http://securityratty.com/article/1b9ddda67145b0350bba4d9bf6a096a3</link>
      <guid>http://securityratty.com/article/1b9ddda67145b0350bba4d9bf6a096a3</guid>
      <description><![CDATA[Information Security sits in a strange area somewhere between Business and IT in a little space that really hasn't been properly defined. It is exciting here

Generally, most people in Information...]]></description>
      <content:encoded><![CDATA[Information Security sits in a strange area somewhere between Business and IT in a little space that really hasn't been properly defined. It is exciting here.<br /><br />Generally, most people in Information Security today did not start out as pure Information Security people, they evolved. And where they evolved from gives one a clue as to their mindset and how they see themselves.<br /><br />Some come from an Audit background and you'll recognise these guys from their love of lists and frameworks - they dream of Cobit controls and little boxes that are waiting for ticks. Somehow they have tons of documentation and they know it all and can find it all. They generally drive Volvo's and like order.<br /><br />But most InfoSec guys come from an IT background and it shows. I guess that, having said that, most hackers come from an IT background too. And it shows.<br /><br />Now, lets consider the C-I-A triangle thingum. Quick lesson for those who don't know it - there are three aspects of information that Information Security wishes to preserve - the <span style="font-weight: bold;">C</span>onfidentiality, the <span style="font-weight: bold;">I</span>ntegrity and the <span style="font-weight: bold;">A</span>vailability. From my experience, most IT people are governed by Availability - the "A". In fact, when an IT contract is drawn up - there is no SLI or SLC but there will always be an SLA. With very specific terms, measurements and penalties.<br /><br />If the Firewall crashes and has to be rebuilt. What will the IT manager be most interested in? The A - how fast can you get the traffic moving again?<br /><br />So we have tools to measure uptime in 99.999999999999999s and such and anything that can cause network downtime (or if the network is up and the services such as mail are down - same difference) is taken care of. Spam, worms, viruses etc.<br /><br />I guess that hackers (those that define what we do) are also IT background people. They seem to be more concerned with big-bang, widely deployed DoS attacks and stealing IT resources. At least, they used to be, until they discovered that they could make money from stealing information. Actually, I may be naive but I don't believe that the hackers we have today are the same as those we had in the past... I believe that we have a new generation of hackers - criminals who merely use the Internet to steal money because that it where the money is easiest to steal.<br /><br />The problem is that we were lucky in a way that our old tools worked against the threats that we had - firewalls, antiviruses, etc etc. They don't work against people breaking into our networks and stealing information. For that we need a new generation of Information Security people (or the old generation to update their game)...<br /><br />Here is a quick poll to see which generation you are in:<br /><br />1. What is the one piece of information on your network that your competitors would love to see?<br />2. What is the percentage of mails coming into your network that are spam?<br />3. What mail is going to competitors?<br />4. What is the process for someone to order a pencil?<br />5. What is a blog?<br />6. Who in your organisation uses facebook for business?<br />7. How many of your PCs have up-to-date antivirus?<br />8. What is the worst virus out at the moment?<br />9. Do you believe that your Firewall is configured correctly?<br /><br />The answers are as follows:<br />1. This is ESSENTIAL to know if you want to be in the next generation. And you can't guess this. You may think that it is something financial but most financial information can be guessed by your competitors anyhow. You may think it is a recipe or special way of doing something but any established company has had their recipe ripped off anyhow and can beat any new competitor by competitive pricing. It may be new product information. It may be staff information. It may be the CEO's contact list. Don't guess - find out.<br /><br />2. Who cares? Certainly not the CEO. Maybe the CIO. "We are saving you x amount of bandwidth and your users x amount of time" is nice but won't save the business from closing down due to data loss. Operationalise this and get on with your job.<br /><br />3. Good to know. I'm sure that if you told your CEO/CIO "Last week we detected 5 large emails going to our competitors from inside our R&amp;D department" you'd have his full attention.<br /><br />4. Good to know. Who does the ordering? Who does the okaying? Who does the paying? If you know all of this then you know how business works. And when things go wrong - you'll be able to help.<br /><br />5. And do you want your staff to use them? And if they do, what can they put on them? What are they puting on them?<br /><br />6. This is an interesting question because Facebook is usually an issue of "The A" (productivity). But it can be an issue of C and I.<br /><br />7. Who cares? Again, this is an operational issue. Viruses that jump onto your radar are usually ones that attack "the A" but its the ones that are pushing information out of your organisation that are sneaky enough not to have sgnatures and not to be discovered. You will have PCs without up-to-date antivirus and you will have viruses. The trick is not to let your information be stolen by viruses. Also, keep backups so if a PC does get wiped out - you can get the information back again (but this is an operational issue again).<br /><br />8. Trick question - the answer is - the one you don't know about. Old generation InfoSec guys can rattle off names of viruses that are all in the top 10 at the moment.. New generation viruses are targetted and usually do their worst before a pattern is out.<br /><br />9. Old generation answer - yes. New generation answer - who cares? Information flows all over including in and out of the Firewall. Firewalls also usually rely on port security but most everything runs on port 80 anyhow so the Firewall should be configured but it doesn't kep us safe - more work needs to be done for that.<br /><br />I find that it is not very easy to move from old generation to new generation InfoSec. The main difference is that old generation was very technical and appealed to the technical nature of computer geeks. The new generation is business oriented and requires more interaction with people, more meetings, more time with people. Ouch.<br /><br />There will always be a place for technical people in Information Security but as the tools mature and "just work" there is less demand. And a background in technology is very useful when the technical guys try to "BS" you.<br /><br />And "the A" is very important too. Protecting your network from being brought down. Protecting information from disappearing. Stopping viruses. Etc. But the new generation will need to consider "the I" and "the C" as well because the attacks against these and the importance of protecting information against disclosure or manipulation will increase.<br /><br />This post was done to add my voice to what Rich says so quickly and concisely in the <a href="http://securosis.com/2008/11/10/the-two-kinds-of-security-threats-and-how-they-affect-your-life/">securosis blog</a>.<img src="http://feeds.feedburner.com/~r/SecurityThoughts/~4/471338550" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 01 Dec 2008 10:57:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/financial information">financial information</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/information security">information security</category>
      <category domain="http://securityratty.com/tag/generation infosec guys">generation infosec guys</category>
      <category domain="http://securityratty.com/tag/infosec guys">infosec guys</category>
      <category domain="http://securityratty.com/tag/information security people">information security people</category>
      <category domain="http://securityratty.com/tag/guys">guys</category>
      <category domain="http://securityratty.com/tag/staff information">staff information</category>
      <category domain="http://securityratty.com/tag/technical guys">technical guys</category>
      <source url="http://feeds.feedburner.com/~r/SecurityThoughts/~3/471338550/a.html">The "A"</source>
    </item>
    <item>
      <title><![CDATA[Is That a Coffee Table or a Munition?]]></title>
      <link>http://securityratty.com/article/bcc3ebc100f5b51c419148587e587e92</link>
      <guid>http://securityratty.com/article/bcc3ebc100f5b51c419148587e587e92</guid>
      <description><![CDATA[One of the standard software security prescriptions for the SDLC is to data classification and enforce least privilege. From a security perspective this sounds fantastic, especially on a whiteboard....]]></description>
      <content:encoded><![CDATA[<p>One of the standard software security prescriptions for the SDLC is to data classification and enforce least privilege. From a security perspective this sounds fantastic, especially on a whiteboard. When the rubber meets the real world road, things often turn out slightly different.&#0160;</p><br /><div>It turns out that it is hard to conduct business with excessive granularity.</div><div><a href="http://1raindrop.typepad.com/.a/6a00d83451c75869e201053619a7a7970b-pi" style="display: inline;"><a href="http://www.economist.com/displaystory.cfm?story_id=11965352"><img alt="D3408BB1" class="at-xid-6a00d83451c75869e201053619a7a7970b " src="http://1raindrop.typepad.com/.a/6a00d83451c75869e201053619a7a7970b-320wi" /></a></a><span style="font-family: &#39;Trebuchet MS&#39;; ">
</span> <br /></div><br /><div>Here is an <a href="http://www.economist.com/displaystory.cfm?story_id=11965352">article</a> from The Economist on the challenges of space technology, commercialization and information sharing. This is widely applicable to corporate information security policies:</div><br /><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: Verdana; font-weight: bold; line-height: normal; ">Gravity is not the main obstacle for America’s space business. Government is</span></p><p><span style="font-family: Verdana; line-height: normal; ">IN THE spring of 2006 Robert Bigelow needed to take a stand on a trip to Russia to keep a satellite off the floor. The stand was made of aluminium. It had a circular base and legs. It was, says the entrepreneur and head of Bigelow Aerospace in Nevada, “indistinguishable from a common coffee table”. Nonetheless, the American authorities told Mr Bigelow that this coffee table was part of a satellite assembly and so counted as a munition. During the trip it would have to be guarded by two security officers at all times.</span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: Verdana; line-height: normal;"><br /></span><span style="font-family: Verdana; line-height: normal; ">Exporting technology has always presented a dilemma for America. The country leads the world in most technologies and some of these give it a military advantage. If export rules are too lax, foreign powers will be able to put American technology in their systems, or copy it. But if the rules are too tight, then it will stifle the industries that depend upon sales to create the next generation of technology.</span><br /><span style="font-family: Verdana; line-height: normal; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: Verdana; line-height: normal; ">It is a difficult balance to strike and critics charge that America has erred on the side of stifling. They claim that overly strict export controls have so damaged the space industry that America’s national security is now threatened by its dwindling leadership in space technology. The system, they complain, fails to distinguish between militarily sensitive hardware that should be controlled and widely available commercial technologies, such as lithium-ion batteries and solar cells. The zealous application of the export rules is the American space industry’s biggest handicap.</span></p></blockquote><div><span style="font-family: Verdana; font-weight: bold; line-height: normal;"><br /></span></div><div><span style="font-family: Verdana; line-height: normal; ">Read the whole thing its fascinating. So what started off as well intentioned asset protection eventually compromised the most important asset of all - strategic advantage.</span></div><div><span style="font-family: Verdana; line-height: normal;"><br /></span></div><div><span style="font-family: Verdana; line-height: normal;">So what&#39;s a better model? I am partial to think about these sorts of problems as free trade agreements. Each integration point should have a set of policies, and enforcement mechanisms that also include compensating transactions.</span></div><div><span style="font-family: Verdana; line-height: normal;"><br /></span></div><div><span style="font-family: Verdana; line-height: normal;">For example, did you know that in the US you can buy companies that trade on other exchanges through ADRs? You buy the ADR of say a French Telco which trades on a European exchange only you buy the ADR on the NYSE or Nasdaq. Then the French Telco issues you a dividend because you are a shareholder, but the French government withholds the dividend for foreign owners. Yet because there is a free trade agreement between the two countries, the US lets you write off the unreceived portion of the dividend on your taxes. (this may or may not be the case in US-France just an example). Anyway, its not a silver bullet but its an interesting strategy.</span></div><div><span style="font-family: Verdana; line-height: normal;"><br /></span></div>]]></content:encoded>
      <pubDate>Tue, 25 Nov 2008 09:40:20 +0000</pubDate>
      <category domain="http://securityratty.com/tag/coffee table">coffee table</category>
      <category domain="http://securityratty.com/tag/technology">technology</category>
      <category domain="http://securityratty.com/tag/american technology">american technology</category>
      <category domain="http://securityratty.com/tag/free trade agreement">free trade agreement</category>
      <category domain="http://securityratty.com/tag/trade">trade</category>
      <category domain="http://securityratty.com/tag/space technology">space technology</category>
      <category domain="http://securityratty.com/tag/french telco issues">french telco issues</category>
      <category domain="http://securityratty.com/tag/common coffee table">common coffee table</category>
      <category domain="http://securityratty.com/tag/information security policies">information security policies</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/11/is-that-a-coffee-table-or-a-munition.html">Is That a Coffee Table or a Munition?</source>
    </item>
    <item>
      <title><![CDATA[The Future of Ephemeral Conversation]]></title>
      <link>http://securityratty.com/article/1474b03de8a1d60cdf0aa28759ddce93</link>
      <guid>http://securityratty.com/article/1474b03de8a1d60cdf0aa28759ddce93</guid>
      <description><![CDATA[When he becomes president, Barack Obama will have to give up his BlackBerry. Aides are concerned that his unofficial conversations would become part of the presidential record, subject to subpoena and...]]></description>
      <content:encoded><![CDATA[<p>When he becomes president, Barack Obama will have to <a href="http://www.nytimes.com/2008/11/16/us/politics/16blackberry.html">give up</a> his BlackBerry.  Aides are concerned that his unofficial conversations would become part of the presidential record, subject to subpoena and eventually made public as part of the country's historical record.</p>

<p>This reality of the information age might be particularly stark for the president, but it's no less true for all of us.  Conversation used to be ephemeral.  Whether face-to-face or by phone, we could be reasonably sure that what we said disappeared as soon as we said it. Organized crime bosses worried about phone taps and room bugs, but that was the exception.  Privacy was just assumed.</p>

<p>This has changed.  We chat in e-mail, over SMS and IM, and on social networking websites like Facebook, MySpace, and LiveJournal.  We blog and we Twitter.  These conversations -- with friends, lovers, colleagues, members of our cabinet -- are not ephemeral; they <a href="http://www.schneier.com/essay-109.html">leave their own electronic trails</a>.</p>

<p>We know this intellectually, but we haven't truly internalized it.  We type on, engrossed in conversation, forgetting we're being recorded and those recordings might come back to haunt us later.</p>

<p>Oliver North learned this, way back in 1987, when messages he thought he had deleted were saved by the White House PROFS system, and then subpoenaed in the Iran-Contra affair.  Bill Gates learned this in 1998 when his conversational e-mails were provided to opposing counsel as part of the antitrust litigation discovery process.  Mark Foley learned this in 2006 when his instant messages were <a href="http://abcnews.go.com/WNT/BrianRoss/story?id=2509586">saved and made public</a> by the underage men he talked to.  Paris Hilton learned this in 2005 when her cell phone account was <a href="http://www.washingtonpost.com/wp-dyn/content/article/2005/05/19/AR2005051900711.html">hacked</a>, and Sarah Palin learned it earlier this year when her Yahoo e-mail account was hacked.  Someone in George W. Bush's administration learned this, and <a href="http://www.cnn.com/2007/POLITICS/04/13/white.house.email/index.html">millions of e-mails</a> went mysteriously and conveniently missing.</p>

<p>Ephemeral conversation is dying.</p>

<p>Cardinal Richelieu famously said, :If one would give me six lines written by the hand of the most honest man, I would find something in them to have him hanged."  When all our ephemeral conversations can be saved for later examination, different rules have to apply.  Conversation is not the same thing as correspondence.  Words uttered in haste over morning coffee, whether spoken in a coffee shop or thumbed on a Blackberry, are not official pronouncements.  Discussions in a meeting, whether held in a boardroom or a chat room, are not the same as answers at a press conference.  And privacy isn't just about having something to hide; it <a href="http://www.schneier.com/essay-114.html">has enormous value</a> to democracy, liberty, and our basic humanity.</p>

<p>We can't turn back technology; electronic communications are here to stay and <a href="http://en.wikipedia.org/wiki/NSA_warrantless_surveillance_controversy">even our voice conversations are threatened</a>.  But as technology makes our conversations less ephemeral, we need laws to step in and safeguard ephemeral conversation.  We need a comprehensive data privacy law, protecting our data and communications regardless of where it is stored or how it is processed. We need laws forcing companies to keep it private and delete it as soon as it is no longer needed.  Laws requiring ISPs to store e-mails and other personal communications are exactly what we don't need.</p>

<p>Rules pertaining to government need to be different, because of the <a href="http://www.schneier.com/essay-208.html">power differential</a>.  Subjecting the president's communications to eventual public review increases liberty because it reduces the government's power with respect to the people.  Subjecting our communications to government review decreases liberty because it reduces our power with respect to the government.  The president, as well as other members of government, need some ability to converse ephemerally -- just as they're allowed to have unrecorded meetings and phone calls -- but more of their actions need to be subject to public scrutiny.</p>

<p>But laws can only go so far.  Law or no law, when something is made public it's too late.  And many of us like having complete records of all our e-mail at our fingertips; it's like our offline brains.</p>

<p>In the end, this is cultural.</p>

<p>The Internet is the greatest generation gap since rock and roll.  We're now witnessing one aspect of that generation gap: the younger generation chats digitally, and the older generation treats those chats as written correspondence.  Until our CEOs blog, our Congressmen Twitter, and our world leaders send each other LOLcats &ndash; until we have a Presidential election where both candidates have a complete history on social networking sites from before they were teenagers&ndash; we aren't fully an information age society.</p>

<p>When everyone leaves a public digital trail of their personal thoughts since birth, no one will think twice about it being there.  Obama might be on the younger side of the generation gap, but the rules he's operating under were written by the older side.  It will take another generation before society's tolerance for digital ephemera changes.</p>

<p>This essay <a href="http://online.wsj.com/article/SB122722381368945937.html">previously appeared</a> on <ui>The Wall Street Journal</a> website (not the print newspaper), and is an update of <a href="http://www.schneier.com/essay-129.html">something I wrote previously</a>.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=jPWiN"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=jPWiN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=hlUTN"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=hlUTN" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Mon, 24 Nov 2008 11:06:41 +0000</pubDate>
      <category domain="http://securityratty.com/tag/ephemeral conversation">ephemeral conversation</category>
      <category domain="http://securityratty.com/tag/conversation">conversation</category>
      <category domain="http://securityratty.com/tag/safeguard ephemeral conversation">safeguard ephemeral conversation</category>
      <category domain="http://securityratty.com/tag/ephemeral">ephemeral</category>
      <category domain="http://securityratty.com/tag/ephemeral conversations">ephemeral conversations</category>
      <category domain="http://securityratty.com/tag/conversations">conversations</category>
      <category domain="http://securityratty.com/tag/generation">generation</category>
      <category domain="http://securityratty.com/tag/generation gap">generation gap</category>
      <category domain="http://securityratty.com/tag/public scrutiny">public scrutiny</category>
      <source url="http://www.schneier.com/blog/archives/2008/11/the_future_of_e.html">The Future of Ephemeral Conversation</source>
    </item>
    <item>
      <title><![CDATA[Opinion: Obama's Blackberry Is No Security Threat]]></title>
      <link>http://securityratty.com/article/e87ac9b85b1440c70317a2e3c99bc69a</link>
      <guid>http://securityratty.com/article/e87ac9b85b1440c70317a2e3c99bc69a</guid>
      <description><![CDATA[A lot of the stories about President-Elect Barack Obama possibly having to relinquish his BlackBerry when he takes office Jan. 20 are, for a variety of reasons, just plain dumb
Presented By
Expedition...]]></description>
      <content:encoded><![CDATA[A lot of the stories about President-Elect Barack Obama possibly having to relinquish his BlackBerry when he takes office Jan. 20 are, for a variety of reasons, just plain dumb.<br style="clear: both;"/>
  <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:ec05a75c51a0c57bf749dc34de320338:9saJDFUNixvCt9W%2FnAURKdwA2cqnMddIgJicBm8aa7XRGqSr3d0tP4bmhbLQU11krWw1pJd5zPcU'><img border='0' title='Add to digg' alt='Add to digg' src='http://www.pheedo.com/images/mm/digg.gif'/></a>
  <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:ee597d2c1bb98b27efdcaefe8ebb3f75:EF6STR8ij2QRJ8xF4MBcoSPj2lJwQex7OGQm3R4yzLgsLbUdOaDqd300xLdPMY8UCWy9otIBA7UvIQ%3D%3D'><img border='0' title='Add to StumbleUpon' alt='Add to StumbleUpon' src='http://www.pheedo.com/images/mm/stumbleit.gif'/></a>
  <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:d51c69caef3a79fa989b3a7574d817cb:uzyMPJwsArJb1adLPnID9o%2BjzBNZTeavL38C94JxNqfi1Cu7ClBDRM2SRcEXd0Rorv8gufvurWb2Vw%3D%3D'><img border='0' title='Add to Twitter' alt='Add to Twitter' src='http://www.pheedo.com/images/mm/twitter.png'/></a>
  <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:42f0cd0844493e4e350b139fc5b4aac4:MXMK2lz0WWHJX0PP4CSpEs7sIpFYH2zP5xNyh3ZAJhafvgGgWMApfnlvI1ecgN6drJ%2B6%2B12av%2F4TCA%3D%3D'><img border='0' title='Add to Slashdot' alt='Add to Slashdot' src='http://www.pheedo.com/images/mm/slashdot.png'/></a>
<br style="clear: both;"/>
<hr />
<div style="font-size:xx-small;color:gray;padding-bottom:.5em">Presented By:</div>
<div><a href="http://www.pheedo.com/feeds/ht.php?t=c&amp;i=f38edf875ae6f3723280e92fea392c4c&amp;p=1">Expedition Week Continues Tonight</a></div>
<table border="0" cellpadding="0" cellspacing="0">
<tr><td valign="top"><embed src="http://services.brightcove.com/services/viewer/federated_f8/1902560944" bgcolor="#FFFFFF" flashVars="playerId=1902560944&viewerSecureGatewayURL=https://console.brightcove.com/services/amfgateway&servicesURL=http://services.brightcove.com/services&cdnURL=http://admin.brightcove.com&domain=embed&autoStart=false&" base="http://admin.brightcove.com" name="flashObj" width="300" height="250" seamlesstabbing="false" type="application/x-shockwave-flash" swLiveConnect="true" pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash"></embed><br />
<br /><img src="http://images.pheedo.com/g/ngc/natgeologo_80x60.jpg"><br />
<font size="2" face="helvetica" >Seven nights of one great discovery after another continues tonight at 9P e/p only on National Geographic Channel.  From the ancient pyramids to the ocean depths, from lost cities to outer space, travel with the latest generation of intrepid explorers as they make one great discovery after another.  Expedition Week, only on National Geographic Channel.</font><br />
<a href="http://www.pheedo.com/click.phdo?a=v3%3Ac1abad0b6daa4d28e9a527be56ca4e2f%3As2rmGnBOH62ZTX7YSZtUtsuGGEa8BJPlu%2FnPAP5iBIxxx5lnUHVgxgWtXjRC%2BL9X6noRAJMryZFAD1poPIhkf6cQxJS8bBfGwQlOn880Zw7JEF%2BMyg8FaI55gEz%2FwsMAIsKOYGloldTlO7L2E7%2FRMBd5jFHoF%2BTSxltqVyVuyH%2BRkxk%3D" target="_blank">www.natgeotv.com/expedition</font><br />
</a></td></tr>
<tr><td>&nbsp;</td></tr>
</table>
<div style="font-size:xx-small; padding-top: 1em;"><span style="border-top: 1px solid">
<br style="display:none"/>
<a href="http://www.pheedo.com/">Ads by Pheedo</a>
</span><img alt="" style="border: 0; height: 1px; width: 1px;" border="0" height="1" width="1" src="http://www.pheedo.com/feeds/ht.php?t=v&amp;i=f38edf875ae6f3723280e92fea392c4c&amp;p=1"/>
<br/>
</div>
]]></content:encoded>
      <pubDate>Thu, 20 Nov 2008 02:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/national geographic channel">national geographic channel</category>
      <category domain="http://securityratty.com/tag/takes office jan">takes office jan</category>
      <category domain="http://securityratty.com/tag/plain dumb">plain dumb</category>
      <category domain="http://securityratty.com/tag/continues tonight">continues tonight</category>
      <category domain="http://securityratty.com/tag/blackberry">blackberry</category>
      <category domain="http://securityratty.com/tag/intrepid explorers">intrepid explorers</category>
      <category domain="http://securityratty.com/tag/expedition week">expedition week</category>
      <category domain="http://securityratty.com/tag/discovery">discovery</category>
      <category domain="http://securityratty.com/tag/ancient pyramids">ancient pyramids</category>
      <source url="http://feeds.computerworld.com/click.phdo?i=f38edf875ae6f3723280e92fea392c4c">Opinion: Obama's Blackberry Is No Security Threat</source>
    </item>
    <item>
      <title><![CDATA[IETF: Should we ignore the Kaminsky bug?]]></title>
      <link>http://securityratty.com/article/6975adc4b544aeb8b0396e1313e93ab4</link>
      <guid>http://securityratty.com/article/6975adc4b544aeb8b0396e1313e93ab4</guid>
      <description><![CDATA[The ongoing debate about a serious flaw in the DNS discovered this summer brings to mind a famous quotation from Voltaire: &quot;The perfect is the enemy of the good
Presented By
Expedition Week Continues...]]></description>
      <content:encoded><![CDATA[The ongoing debate about a serious flaw in the DNS discovered this summer brings to mind a famous quotation from Voltaire: "The perfect is the enemy of the good."<br style="clear: both;"/>
  <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:e98ff362db899b2e040e19c88e1fee62:Qf3Blz6NO2UDwDBzsnXuNsXW1lcfVfm2HeUNc5j9JnAB4Robv7e%2B%2BkMf9IDNbMTtKJ%2BFZrTGyR%2B1'><img border='0' title='Add to digg' alt='Add to digg' src='http://www.pheedo.com/images/mm/digg.gif'/></a>
  <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:476ecdf8d4911b3c132800f55947c97d:VYvnBXCXpc16XToke4ae5bPrRispjXT66paCrRQRv%2FHoEJnxg89j%2BydNhpWevJYkrBy8TbB8EsM5iA%3D%3D'><img border='0' title='Add to StumbleUpon' alt='Add to StumbleUpon' src='http://www.pheedo.com/images/mm/stumbleit.gif'/></a>
  <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:b3d2d39d24209a5a68360d6f388b235d:a6B3LqlGwGY%2BlBwmScylHX7qq4YKBrWtb87hjc09KX8NPsCfN9bIIsfHryuzPu7Ei5s%2Bd7KkpOnt9g%3D%3D'><img border='0' title='Add to Twitter' alt='Add to Twitter' src='http://www.pheedo.com/images/mm/twitter.png'/></a>
  <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:77fedf7512667d83d6db2fe537bb7433:yJmvetAqvQ4ADDITfukN8w%2FX7mbgOaHAibHlz20Nr6pjHIydT%2FalgCWHtJeTPar5eaTkK1MZJoaDng%3D%3D'><img border='0' title='Add to Slashdot' alt='Add to Slashdot' src='http://www.pheedo.com/images/mm/slashdot.png'/></a>
<br style="clear: both;"/>
<hr />
<div style="font-size:xx-small;color:gray;padding-bottom:.5em">Presented By:</div>
<div><a href="http://www.pheedo.com/feeds/ht.php?t=c&amp;i=f507528dc99a0b0b1c90f3b3e61f5656&amp;p=1">Expedition Week Continues Tonight</a></div>
<table border="0" cellpadding="0" cellspacing="0">
<tr><td valign="top"><embed src="http://services.brightcove.com/services/viewer/federated_f8/1902560944" bgcolor="#FFFFFF" flashVars="playerId=1902560944&viewerSecureGatewayURL=https://console.brightcove.com/services/amfgateway&servicesURL=http://services.brightcove.com/services&cdnURL=http://admin.brightcove.com&domain=embed&autoStart=false&" base="http://admin.brightcove.com" name="flashObj" width="300" height="250" seamlesstabbing="false" type="application/x-shockwave-flash" swLiveConnect="true" pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash"></embed><br />
<br /><img src="http://images.pheedo.com/g/ngc/natgeologo_80x60.jpg"><br />
<font size="2" face="helvetica" >Seven nights of one great discovery after another continues tonight at 9P e/p only on National Geographic Channel.  From the ancient pyramids to the ocean depths, from lost cities to outer space, travel with the latest generation of intrepid explorers as they make one great discovery after another.  Expedition Week, only on National Geographic Channel.</font><br />
<a href="http://www.pheedo.com/click.phdo?a=v3%3Ac1abad0b6daa4d28e9a527be56ca4e2f%3As2rmGnBOH62ZTX7YSZtUtsuGGEa8BJPlu%2FnPAP5iBIxxx5lnUHVgxgWtXjRC%2BL9X6noRAJMryZFAD1poPIhkf6cQxJS8bBfGwQlOn880Zw7JEF%2BMyg8FaI55gEz%2FwsMAIsKOYGloldTlO7L2E7%2FRMBd5jFHoF%2BTSxltqVyVuyH%2BRkxk%3D" target="_blank">www.natgeotv.com/expedition</font><br />
</a></td></tr>
<tr><td>&nbsp;</td></tr>
</table>
<div style="font-size:xx-small; padding-top: 1em;"><span style="border-top: 1px solid">
<br style="display:none"/>
<a href="http://www.pheedo.com/">Ads by Pheedo</a>
</span><img alt="" style="border: 0; height: 1px; width: 1px;" border="0" height="1" width="1" src="http://www.pheedo.com/feeds/ht.php?t=v&amp;i=f507528dc99a0b0b1c90f3b3e61f5656&amp;p=1"/>
<br/>
</div>
]]></content:encoded>
      <pubDate>Thu, 20 Nov 2008 02:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/national geographic channel">national geographic channel</category>
      <category domain="http://securityratty.com/tag/continues tonight">continues tonight</category>
      <category domain="http://securityratty.com/tag/intrepid explorers">intrepid explorers</category>
      <category domain="http://securityratty.com/tag/expedition week">expedition week</category>
      <category domain="http://securityratty.com/tag/famous quotation">famous quotation</category>
      <category domain="http://securityratty.com/tag/summer brings">summer brings</category>
      <category domain="http://securityratty.com/tag/discovery">discovery</category>
      <category domain="http://securityratty.com/tag/ancient pyramids">ancient pyramids</category>
      <category domain="http://securityratty.com/tag/lost cities">lost cities</category>
      <source url="http://feeds.computerworld.com/click.phdo?i=f507528dc99a0b0b1c90f3b3e61f5656">IETF: Should we ignore the Kaminsky bug?</source>
    </item>
    <item>
      <title><![CDATA[Feds urged to provide cybersecurity incentives]]></title>
      <link>http://securityratty.com/article/c073f8a60ea6341c662700b80792b2f4</link>
      <guid>http://securityratty.com/article/c073f8a60ea6341c662700b80792b2f4</guid>
      <description><![CDATA[President-elect Barack Obama needs to take a new approach to cybersecurity, with government providing incentives for private businesses to adopt security measures, the Internet Security Alliance, a...]]></description>
      <content:encoded><![CDATA[President-elect Barack Obama needs to take a new approach to cybersecurity, with government providing incentives for private businesses to adopt security measures, the Internet Security Alliance, a cybersecurity group, said today.<br style="clear: both;"/>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:ce20a5162ecbe5f18bbc8bb886a02b40:UoPs0lMSoT1%2F8Pwr2I0eKVwqreMUc6xwo74vSlUicN1gMYnMSLSBK9APqWI8oglG3XJdNW6arADQ'><img border='0' title='Add to digg' alt='Add to digg' src='http://www.pheedo.com/images/mm/digg.gif'/></a>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:34948390e72c4ebccdd87135e472e4e4:So%2Fivo0PyxqMtLW2GOsFDqSTIGwl%2BJM%2FarcmTsnQjRD%2BIk4znaTEfQH6TakdXvRUz6YMVTLd%2F8GEiQ%3D%3D'><img border='0' title='Add to StumbleUpon' alt='Add to StumbleUpon' src='http://www.pheedo.com/images/mm/stumbleit.gif'/></a>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:86497f03b10dd0921820f814c4d40b80:oxPEfjuiVk%2BEFPGZC%2Fma43z3JpVWEoWjMPdWv%2FUIqiRmwCsTs1Smid8fJmRaV2l100pdTsJYJXSu%2FQ%3D%3D'><img border='0' title='Add to Twitter' alt='Add to Twitter' src='http://www.pheedo.com/images/mm/twitter.png'/></a>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:a885971128c8d6ad7bffe0b100fe976d:%2BvJf%2BHLixrslrUv29ujt6XzKip3eSba%2FYir%2BbV8R2cPNtr1%2BPbd65Q2xRIYOU9DKNjzCvm003e1AyQ%3D%3D'><img border='0' title='Add to Slashdot' alt='Add to Slashdot' src='http://www.pheedo.com/images/mm/slashdot.png'/></a>
<br style="clear: both;"/>      <hr />
<div style="font-size:xx-small;color:gray;padding-bottom:.5em">Presented By:</div>
<div><a href="http://www.pheedo.com/feeds/ht.php?t=c&amp;i=9874eeb4994e7a068a102cd956f7327d">Expedition Week Continues Tonight</a></div><table border="0" cellpadding="0" cellspacing="0">
<tr><td valign="top"><embed src="http://services.brightcove.com/services/viewer/federated_f8/1902560944" bgcolor="#FFFFFF" flashVars="playerId=1902560944&viewerSecureGatewayURL=https://console.brightcove.com/services/amfgateway&servicesURL=http://services.brightcove.com/services&cdnURL=http://admin.brightcove.com&domain=embed&autoStart=false&" base="http://admin.brightcove.com" name="flashObj" width="300" height="250" seamlesstabbing="false" type="application/x-shockwave-flash" swLiveConnect="true" pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash"></embed><br />
<br /><img src="http://images.pheedo.com/g/ngc/natgeologo_80x60.jpg"><br />
<font size="2" face="helvetica" >Seven nights of one great discovery after another continues tonight at 9P e/p only on National Geographic Channel.  From the ancient pyramids to the ocean depths, from lost cities to outer space, travel with the latest generation of intrepid explorers as they make one great discovery after another.  Expedition Week, only on National Geographic Channel.</font><br />
<a href="http://www.pheedo.com/click.phdo?a=v3%3Ac1abad0b6daa4d28e9a527be56ca4e2f%3As2rmGnBOH62ZTX7YSZtUtsuGGEa8BJPlu%2FnPAP5iBIxxx5lnUHVgxgWtXjRC%2BL9X6noRAJMryZFAD1poPIhkf6cQxJS8bBfGwQlOn880Zw7JEF%2BMyg8FaI55gEz%2FwsMAIsKOYGloldTlO7L2E7%2FRMBd5jFHoF%2BTSxltqVyVuyH%2BRkxk%3D" target="_blank">www.natgeotv.com/expedition</font><br />
</a></td></tr>
<tr><td>&nbsp;</td></tr>
</table>
<div style="font-size:xx-small; padding-top: 1em;"><span style="border-top: 1px solid">
<br style="display:none"/>
<a href="http://www.pheedo.com/">Ads by Pheedo</a>
</span><img alt="" style="border: 0;" border="0" src="http://www.pheedo.com/feeds/ht.php?t=v&amp;i=9874eeb4994e7a068a102cd956f7327d"/>
<br/>
</div>
  <img src="http://www.pheedo.com/feeds/tracker.php?i=9874eeb4994e7a068a102cd956f7327d" style="display: none;" border="0" height="1" width="1" alt=""/>]]></content:encoded>
      <pubDate>Wed, 19 Nov 2008 02:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/national geographic channel">national geographic channel</category>
      <category domain="http://securityratty.com/tag/cybersecurity">cybersecurity</category>
      <category domain="http://securityratty.com/tag/internet security alliance">internet security alliance</category>
      <category domain="http://securityratty.com/tag/president-elect barack obama">president-elect barack obama</category>
      <category domain="http://securityratty.com/tag/adopt security measures">adopt security measures</category>
      <category domain="http://securityratty.com/tag/continues tonight">continues tonight</category>
      <category domain="http://securityratty.com/tag/intrepid explorers">intrepid explorers</category>
      <category domain="http://securityratty.com/tag/incentives">incentives</category>
      <category domain="http://securityratty.com/tag/expedition week">expedition week</category>
      <source url="http://feeds.computerworld.com/click.phdo?i=9874eeb4994e7a068a102cd956f7327d">Feds urged to provide cybersecurity incentives</source>
    </item>
    <item>
      <title><![CDATA[Teaching the Elderly about Scams and Security]]></title>
      <link>http://securityratty.com/article/e41572ac9f794d144e3f8f9e4d564c20</link>
      <guid>http://securityratty.com/article/e41572ac9f794d144e3f8f9e4d564c20</guid>
      <description><![CDATA[People were being scammed long before email and malware entered into daily use and its still happening offline as well as online. So what to do if you know that someone you love is being victimized...]]></description>
      <content:encoded><![CDATA[<p>People were being scammed long before email and malware entered into daily use &#8212; and it&#8217;s still happening offline as well as online. So what to do if you know that someone you love is being victimized and scammed?</p>
<p>That&#8217;s the question the Consumerist asked readers today, with a story about a <a rel="nofollow" target="_blank" href="http://consumerist.com/5083442/she+grifters-scam-granddad-for-10000%252B-a-month">Florida grand-dad </a>whose gardener is supposedly fleecing him for over $10k / month, allegedly to help an ailing friend:</p>
<blockquote><p>Shaun says his 80+-year old grandfather, Steve, is being scammed out of over $10,000 a month. It seems Steve recently hired a female gardener who introduced him to a &#8220;wealthy friend,&#8221; and now he&#8217;s loaning them money to pay for groceries, cable, home upkeep, and, get this, bodyguards to protect her from an ex-husband and son who to want to kill her. When the family tries to intervene, Steve says the family is trying to put him in a nursing home and steal his money. Shaun is at a loss. How can he help his grandfather, who doesn&#8217;t want to be helped?</p></blockquote>
<p>Another question that might be relevant in the IT Security community is, are the elderly more prone to these scams, and if so why? In the tech world it&#8217;s widely assumed that the older generation just has a harder time learning and grasping how to use technology so may not understand what is risky and what isn&#8217;t.</p>
<p>But perhaps there&#8217;s a deeper problem, either with some form of dementia and paranoia in the older years, or just a purer vulnerability associated with being alienated from the new, cutting edge and modern world as we age, or some kind of unwillingness to be suspicious because of the need to have caring people around you?</p>]]></content:encoded>
      <pubDate>Tue, 11 Nov 2008 11:54:46 +0000</pubDate>
      <category domain="http://securityratty.com/tag/steve">steve</category>
      <category domain="http://securityratty.com/tag/steve recently hired">steve recently hired</category>
      <category domain="http://securityratty.com/tag/female gardener">female gardener</category>
      <category domain="http://securityratty.com/tag/friend">friend</category>
      <category domain="http://securityratty.com/tag/home">home</category>
      <category domain="http://securityratty.com/tag/gardener">gardener</category>
      <category domain="http://securityratty.com/tag/home upkeep">home upkeep</category>
      <category domain="http://securityratty.com/tag/wealthy friend">wealthy friend</category>
      <category domain="http://securityratty.com/tag/shaun">shaun</category>
      <source url="http://feeds.feedburner.com/~r/itsecurity/~3/450086772/">Teaching the Elderly about Scams and Security</source>
    </item>
    <item>
      <title><![CDATA[America's CTO]]></title>
      <link>http://securityratty.com/article/7370017881b0de9957b3253bdde1e5eb</link>
      <guid>http://securityratty.com/article/7370017881b0de9957b3253bdde1e5eb</guid>
      <description><![CDATA[I hope this message gets through to the Obama people - Bill Joy would be an amazingly good pick for the newly created CTO cabinet post. A grand slam to the upper deck. You can count the people with as...]]></description>
      <content:encoded><![CDATA[<p>I hope <a href="http://bits.blogs.nytimes.com/2008/11/05/john-doerrs-advice-for-barack-obama-hire-bill-joy/">this message</a> gets through to the Obama people - Bill Joy would be an amazingly good pick for the newly created CTO cabinet post. A grand slam to the upper deck. You can count the people with as a good a track record in technology on one hand.</p><br /><div>Also, I could not agree more with John Doerr on these points:</div><br /><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px; ">The next question from the president-elect was what single policy issue he could focus on that would most help entrepreneurs.</span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px;"><br /></span><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px; ">“The most important thing he’s got to do is kick-start a huge amount of research and innovation in energy,” said Mr. Doerr, who backed Google and Amazon.com and has invested heavily in clean energy technology for the last few years.</span><br /><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px; ">The nation now invests less than $1 billion a year in renewable energy versus $32 billion a year in health care, Mr. Doerr said. “I think we’ve just scratched the surface in terms of clean ways to use energy, to produce energy. It’s the challenge of our generation.”</span><br /><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px; ">How to do that? Double the number of engineers who graduate from American universities each year to 60,000, Mr. Doerr said. Bring more women into the field, and encourage foreigners who study engineering here to stay here.</span><br /><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px; ">“What we do is bring foreign nationals to the world’s greatest universities. We train them, invest in them and make them go home,” he said. “What kind of national strategy is that? So I would staple a green card to the diploma.”</span></p></blockquote><p><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px;"><br /></span></p><div><span style="color: #333333; font-family: georgia; font-size: 10px; "><p style="margin-top: 0px; margin-right: 0px; margin-bottom: 1em; margin-left: 0px; font-size: 1.4em; line-height: 1.5em; "><span id="more-1803"></span></p></span></div><div><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px;">While it is amazing that it took until 2009 for the US to have a CTO as a cabinet level position, it is very cool to think about all the things that could happen going forward. As Neal Stephenson said the US is only world class at three things - 1. Movies, 2. High speed pizza delivery and 3. Software development.</span></div><div><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px;"><br /></span></div><div><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px;">If you read your </span><a href="http://edgeperspectives.typepad.com/edge_perspectives/">John Hagel</a><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px;"> and </span><a href="http://www.johnseelybrown.com/">JSB</a><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px;">, then you know that innovation is the only sustainable edge. Luckily its hard wired into our system, but it will be helpful to have a seat at the table for certain things. &#0160;</span></div>]]></content:encoded>
      <pubDate>Sat, 08 Nov 2008 13:08:05 +0000</pubDate>
      <category domain="http://securityratty.com/tag/energy">energy</category>
      <category domain="http://securityratty.com/tag/produce energy">produce energy</category>
      <category domain="http://securityratty.com/tag/renewable energy versus">renewable energy versus</category>
      <category domain="http://securityratty.com/tag/cto">cto</category>
      <category domain="http://securityratty.com/tag/clean energy technology">clean energy technology</category>
      <category domain="http://securityratty.com/tag/clean">clean</category>
      <category domain="http://securityratty.com/tag/doerr">doerr</category>
      <category domain="http://securityratty.com/tag/john doerr">john doerr</category>
      <category domain="http://securityratty.com/tag/technology">technology</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/11/americas-cto.html">America's CTO</source>
    </item>
    <item>
      <title><![CDATA[DIY Phishing Pages With Command and Control Interfaces]]></title>
      <link>http://securityratty.com/article/78a81ce667063a0a1268788bb3f66128</link>
      <guid>http://securityratty.com/article/78a81ce667063a0a1268788bb3f66128</guid>
      <description><![CDATA[The day when DIY phishing pages start coming with manuals is the day when consciously or subconsciously a phisher is lowering down the entry barriers into phishing for yet another time. A much more...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://2.bp.blogspot.com/_wICHhTiQmrA/SRIwl6hmo2I/AAAAAAAACa8/_1fYFgW0kzk/s1600-h/rapidshare_phishing_admin_panel.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://2.bp.blogspot.com/_wICHhTiQmrA/SRIwl6hmo2I/AAAAAAAACa8/_1fYFgW0kzk/s200/rapidshare_phishing_admin_panel.jpg" /></a>The day when DIY phishing pages start coming with manuals is the day when consciously or subconsciously a phisher is lowering down the entry barriers into phishing for yet another time. A much more user-friendly compared to the old-fashioned -- yet effective -- <a href="http://ddanchev.blogspot.com/2007/09/209-host-locked.html">rock phish directory listing</a>, a recently released command and control interface for Rapidshare phishing campaigns aims to empower its users with easy dynamic link generation for their campaigns.<br />
<br />
<a href="http://3.bp.blogspot.com/_wICHhTiQmrA/SRLdeRIJEbI/AAAAAAAACbE/ta5F-iiF2gg/s1600-h/DIY_phishing_scripts.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://3.bp.blogspot.com/_wICHhTiQmrA/SRLdeRIJEbI/AAAAAAAACbE/ta5F-iiF2gg/s200/DIY_phishing_scripts.JPG" /></a>What they've managed to achieve is another trust factor since Rapidshare generates a second dynamic link upon clicking on the original one. The script not only generates a dynamically looking link, but also, actually logs in the victim into their account in order to avoid suspicion whereas it still logs all the accounting data.<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="http://3.bp.blogspot.com/_wICHhTiQmrA/SRLhzGDKcrI/AAAAAAAACbM/5-CHdeukArk/s1600-h/rapidshare_phishing_insecure_directory_permissions.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://3.bp.blogspot.com/_wICHhTiQmrA/SRLhzGDKcrI/AAAAAAAACbM/5-CHdeukArk/s200/rapidshare_phishing_insecure_directory_permissions.JPG" /></a></div>Scammers also tend to be ironic every then and now. For instance, in this particular case, one of the users finds it ironic that the Rapidshare phishing page is hosted at Rapidshare itself. Is the script actually working? It appears so at least going through a misconfigured accounting data dump left by one of the phishers.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2008/03/phishing-pages-for-every-bank-are.html">Phishing Pages for Every Bank are a Commodity</a><br />
<a href="http://ddanchev.blogspot.com/2007/08/diy-phishing-kits.html">DIY Phishing Kits</a><br />
<a href="http://ddanchev.blogspot.com/2007/09/diy-phishing-kit-goes-20.html">DIY Phishing Kit Goes 2.0</a><br />
<a href="http://ddanchev.blogspot.com/2008/05/diy-phishing-kits-introducing-new.html">DIY Phishing Kits Introducing New Features</a><br />
<a href="http://ddanchev.blogspot.com/2007/09/209-host-locked.html">209 Host Locked</a><br />
<a href="http://ddanchev.blogspot.com/2007/12/2091-host-locked.html">209.1 Host Locked</a><br />
<a href="http://ddanchev.blogspot.com/2007/11/661-host-locked.html">66.1 Host Locked</a><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=5kY3N"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=5kY3N" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=r8EaN"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=r8EaN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=Qtrtn"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=Qtrtn" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=qM6qn"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=qM6qn" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=T3U6N"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=T3U6N" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=YwrRN"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=YwrRN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=nQNrn"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=nQNrn" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/444324371" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 06 Nov 2008 03:31:43 +0000</pubDate>
      <category domain="http://securityratty.com/tag/diy">diy</category>
      <category domain="http://securityratty.com/tag/pages">pages</category>
      <category domain="http://securityratty.com/tag/rapidshare">rapidshare</category>
      <category domain="http://securityratty.com/tag/data dump">data dump</category>
      <category domain="http://securityratty.com/tag/data">data</category>
      <category domain="http://securityratty.com/tag/campaigns">campaigns</category>
      <category domain="http://securityratty.com/tag/dynamic link">dynamic link</category>
      <category domain="http://securityratty.com/tag/pages start">pages start</category>
      <category domain="http://securityratty.com/tag/link">link</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/444324371/diy-phishing-pages-with-command-and.html">DIY Phishing Pages With Command and Control Interfaces</source>
    </item>
    <item>
      <title><![CDATA[Microsoft Begins the MS08-067 Post-Mortem]]></title>
      <link>http://securityratty.com/article/8b1a636e03c8882d65a7f324bcded81f</link>
      <guid>http://securityratty.com/article/8b1a636e03c8882d65a7f324bcded81f</guid>
      <description><![CDATA[It's finger-pointing time. Who let the infamous MS08-067 RPC bug through? Did the vaunted Microsoft Security Development Lifecycle fail? Did people approve the code when they shouldn't have? Microsoft...]]></description>
      <content:encoded><![CDATA[It's finger-pointing time.

Who let the infamous MS08-067 RPC bug through? Did the vaunted Microsoft Security Development Lifecycle fail? Did people approve the code when they shouldn't have?

<a href="http://www.webbuyersguide.com/company/66/Microsoft&kc=eweekarticle110308&src=eweekarticle110308">Microsoft</a> has already begun examining these questions in <a href="http://blogs.msdn.com/sdl/archive/2008/10/22/ms08-067.aspx" target="_blank">an entry on the SDL blog.</a> The problem, the blog seems to conclude, is the complexity of the code. It's just really hard to find bugs of this nature. To have found it would have been lucky. Michael Howard, the SDL guru and blogger, isn't really pointing fingers, although commenters on the blog are.

It's a prime example of what I wrote about not long ago when I said <a href="http://www.eweek.com/c/a/Security/Still-Overflowing-After-All-These-Years/">buffer overflows would never go away.</a> The examples we all see of what overflows are and how to stop them are fairly simple things: Allocate a buffer of size b, read 2*b bytes into it. In this case, there were two problems making the problem significantly more complex: The overflow happens inside a loop, during which pointer arithmetic is done. This alone makes it harder to identify for humans to identify the bug and perhaps impossible for tools to identify it without incurring a large incidence of false positives. Stack-checking also failed in this instance.

Howard called the code in question "reasonably complex" and said at a later date he would publish source code from the function. He said Microsoft's automated tools wouldn't find this bug in this type of code. Some comments on the blog asked him whether this complexity is, in and of itself, a problem. Perhaps manual code reviews should have rejected it. Howard didn't go this far, but I sense, in between the lines, that maybe he feels the same.

As a programmer I've seen this sort of code plenty of times and written it myself. The code may have seemed particularly efficient or just plain cool to the programmer, but complex loops with pointer arithmetic sound inherently like asking for trouble. I've written before that Microsoft has a long-term way of writing for the next generation of hardware, and CPU processing power is becoming absurdly cheap. Perhaps an implementation that is slower than necessary, but clear in its operation, is the better choice. Then leave the optimizing to compilers. It's actually an old argument.

Another thing Howard remarks on is the failure of Microsoft's fuzzing tools in this instance. All he says is they didn't find it and they'll work on that, and they are always working on their fuzzing tools. Fuzzing is cool and this episode shows how there's always more work to do in it. <a href="http://blogs.securiteam.com/index.php/archives/1151" target="_blank">Aviram on the SecuriTeam blog relates </a>how over two years ago famous researcher Dave Aitel said his fuzzer found no more bugs in the MS RPC code, so there must not be any. This was probably tongue-in-cheek, but even so, Aitel's probably biting his tongue now.

Even though many levels of tools and procedures put in place to prevent such vulnerabilities failed to do so, it would be a mistake to say the system failed altogether. This vulnerability, just about the worst class of bug we ever get, comes with significant mitigating factors, and is probably, as a practical matter, not exploitable on Windows Vista and Server 2008. Not everything failed.
<p><a href="http://feedads.googleadservices.com/~a/TOAsgjkEp3a_sBJoijuoWeC3U0s/a"><img src="http://feedads.googleadservices.com/~a/TOAsgjkEp3a_sBJoijuoWeC3U0s/i" border="0" ismap="true"></img></a></p><img src="http://feedproxy.google.com/~r/RSS/cheap_hack/~4/yYUo7KKMw0Q" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 03 Nov 2008 10:41:51 +0000</pubDate>
      <category domain="http://securityratty.com/tag/code">code</category>
      <category domain="http://securityratty.com/tag/code plenty">code plenty</category>
      <category domain="http://securityratty.com/tag/publish source code">publish source code</category>
      <category domain="http://securityratty.com/tag/manual code reviews">manual code reviews</category>
      <category domain="http://securityratty.com/tag/microsoft">microsoft</category>
      <category domain="http://securityratty.com/tag/rpc code">rpc code</category>
      <category domain="http://securityratty.com/tag/securiteam blog">securiteam blog</category>
      <category domain="http://securityratty.com/tag/blog">blog</category>
      <category domain="http://securityratty.com/tag/howard remarks">howard remarks</category>
      <source url="http://feeds.ziffdavisenterprise.com/~r/RSS/cheap_hack/~3/yYUo7KKMw0Q/microsoft_begins_the_ms08-067_post-mortem.html">Microsoft Begins the MS08-067 Post-Mortem</source>
    </item>
  </channel>
</rss>
