<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: generic]]></title>
    <link>http://securityratty.com/tag/generic</link>
    <description></description>
    <pubDate>Wed, 25 Jun 2008 08:16:20 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Online Finance Flaw: TIAA-CREF XSS & Potential CSRF]]></title>
      <link>http://securityratty.com/article/5978268eaad37c626521f5473142a03e</link>
      <guid>http://securityratty.com/article/5978268eaad37c626521f5473142a03e</guid>
      <description><![CDATA[Before discussing a TIAA-CREF security flaw, allow me to clarify my &quot;terms of engagement
Prior to offering analysis of any security flaws in online financial services, be assured I have engaged the...]]></description>
      <content:encoded><![CDATA[Before discussing a <a href="http://www.tiaa-cref.org/" target="_blank">TIAA-CREF</a> security flaw, allow me to clarify my "terms of engagement". <br />Prior to offering analysis of any security flaws in online financial services, be assured I have engaged the service provider and offered what I believe to a reasonable amount of time to remedy this issue. Specifically, a minimum of two weeks and three unique contact attempts are made. Should the vendor offer a timeline in which the issue will be resolved, so long as it is not months or years, I will wait until they are ready to deploy the fix, then discuss the vulnerability. If I am not in receipt of a reply other than generic customer service replies, I will follow the two week standard, then discuss the issue.<br /><br />TIAA-CREF, or the Teachers Insurance and Annuity Association - College Retirement Equities Fund, is a respected, widely utilized provider of numerous financial products and services. The TIAA-CREF site is ranked <a href="http://www.alexa.com/search?q=tiaa-cref.org" target="_blank">26,148</a> on <a href="http://www.alexa.com" target="_blank">Alexa.com</a> at the time of this writing.<br /><br />I'll first direct you to the TIAA-CREF <a href="http://www.tiaa-cref.org/about/inside/topics/security.html" target="_blank">Security</a> page, where they discuss the expected elements like identity theft, spoofing, tips, and my favorite, phishing.<br />Here's where the trouble begins. Obviously, most phishing occurs when some miscreant creates a fake page and attempts to lure victims via email. <br /><span style="font-weight:bold;">The severity of phishing risks are greatly increased by the introduction of a cross-site scripting (<a href="http://en.wikipedia.org/wiki/Cross-site_scripting" target+"_blank">XSS</a>) vulnerability in a site that is of high value to phishing attackers.</span> <br />With such a vulnerability available, the prospect of success for a phisher are much higher given that the malicious URL they would craft could include the actual target domain, rather than a faked misrepresentation. A simple script insertion at the vulnerable variable would then allow the attacker to redirect victims to a maliciously crafted logon page in the context of the vulnerable site.<br />Sad side note: when you search <span style="font-style:italic;">security</span> at the TIAA-CREF site, the above mentioned Security page is not returned in the results as I write this. <br />However, the resulting search URL serves as the starting point for our discussion of the flaw:<br /><span style="font-style:italic;">http://www.tiaa-cref.org/explore/portlets/search.jsp?query=security&strtfrm=1&totpresults=75&srchtype=4&sc=1&frmsite=0</span><br />The vast majority of non-search input variables on the TIAA-CREF site offer reasonable XSS protections, likely a blacklist method that redirects you to the following language when common XSS strings are noted, particularly where it counts at logon pages.<br /><span style="font-weight:bold;">Due to the presence of characters known to be used in Cross Site Scripting attacks, access is forbidden. This web site does not allow Urls which might include embedded HTML tags.<span style="font-style:italic;"></span></span> <br />Unfortunately, this methodology was not deployed globally, and thus the following online finance flaw.<br />All input variables used in TIAA-CREF's search.jsp script are vulnerable to XSS.<br />Utilized by an attacker, this could have a much more significant impact on TIAA-CREF customers who fall victim to a now more convincing social engineering effort.<br />Here's the site before script insertion:<br /><br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://1.bp.blogspot.com/_kVOWaY1TAF0/STb14rWuuOI/AAAAAAAAAFk/ydVDLZjjwNI/s1600-h/tiaa-cref-before.png" target="_blank"><img style="cursor:pointer; cursor:hand;width: 320px; height: 166px;" src="http://1.bp.blogspot.com/_kVOWaY1TAF0/STb14rWuuOI/AAAAAAAAAFk/ydVDLZjjwNI/s320/tiaa-cref-before.png" border="0" alt=""id="BLOGGER_PHOTO_ID_5275674367570655458" /></a><br /><br />Here's the site after script insertion:<br /><br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://3.bp.blogspot.com/_kVOWaY1TAF0/STb2X3oLzeI/AAAAAAAAAFs/FBGmafHFZ2o/s1600-h/tiaa-cref-after.png" target="_blank"><img style="cursor:pointer; cursor:hand;width: 320px; height: 198px;" src="http://3.bp.blogspot.com/_kVOWaY1TAF0/STb2X3oLzeI/AAAAAAAAAFs/FBGmafHFZ2o/s320/tiaa-cref-after.png" border="0" alt=""id="BLOGGER_PHOTO_ID_5275674903441034722" /></a><br /><br />Further, certain parts of the site, including the <a href="https://www.account3000.com/tiaacref/TFALogin.asp" target="_blnak">Trust Company</a> logon page, show potential signs of cross-site request forgery (<a href="http://en.wikipedia.org/wiki/Cross-site_request_forgery" target="_blank">CSRF</a>) in that they accept updates via GET or allow submittal with the referrer stripped.<br /><br />Lessons learned:<br />1) Don't assume all is well even though a site may offer examples of how attentive they are to security.<br />2) Never log on to an online financial service offering (or anything else for that matter) via a link sent to you in an email. Period.<br />3) Take all steps at your disposal to ensure you are logging in to and transacting with the actual site you intended to utilize. Don't depend on security badges and SSL certificates as your sole means of confirmation.<br />4) If you note something of concern at a site you utilize, advise them immediately and demand repair or clarification until you're satisfied. <br /><br />Please feel free to send <a href="http://www.tiaa-cref.org/about/contact/index.html?tc_lnk=toputlity" target="_blank">feedback</a> to TIAA-CREF as I have per my "terms of engagement" above. Hopefully they'll resolve this issue soon, on behalf of customers in their care.<br /><br />Up next in our series, two of the top five banks mentioned in Javelin Strategy & Research's <span style="font-style:italic;">Banking Identity Safety Scorecard</span> are vulnerable to similar issues.<br /><br /><a href="http://del.icio.us/post?url=http://holisticinfosec.blogspot.com/2008/12/online-finance-flaw-tiaa-cref-xss.html&title=Online%20Finance%20Flaw:%20TIAA-CREF%20XSS%20&%20Potential%20CSRF " title="Online Finance Flaw: TIAA-CREF XSS & Potential CSRF ">del.icio.us</a> | <a href="http://digg.com/submit?phase=2&amp;url=http://holisticinfosec.blogspot.com/2008/12/online-finance-flaw-tiaa-cref-xss.html" title="Online Finance Flaw: TIAA-CREF XSS & Potential CSRF ">digg</a> | <a href="http://slashdot.org/submit.pl?url=http://holisticinfosec.blogspot.com/2008/12/online-finance-flaw-tiaa-cref-xss.html">Submit to Slashdot</a>]]></content:encoded>
      <pubDate>Wed, 03 Dec 2008 06:42:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/tiaa-cref">tiaa-cref</category>
      <category domain="http://securityratty.com/tag/site">site</category>
      <category domain="http://securityratty.com/tag/cross-site">cross-site</category>
      <category domain="http://securityratty.com/tag/tiaa-cref site">tiaa-cref site</category>
      <category domain="http://securityratty.com/tag/tiaa-cref security flaw">tiaa-cref security flaw</category>
      <category domain="http://securityratty.com/tag/flaw">flaw</category>
      <category domain="http://securityratty.com/tag/tiaa-cref security page">tiaa-cref security page</category>
      <category domain="http://securityratty.com/tag/security page">security page</category>
      <category domain="http://securityratty.com/tag/cross site">cross site</category>
      <source url="http://holisticinfosec.blogspot.com/2008/12/online-finance-flaw-tiaa-cref-xss.html">Online Finance Flaw: TIAA-CREF XSS &amp; Potential CSRF</source>
    </item>
    <item>
      <title><![CDATA[Data Retention and Privacy in Electronic Communications]]></title>
      <link>http://securityratty.com/article/8c25f32527ed66213f5716af1ebfb28b</link>
      <guid>http://securityratty.com/article/8c25f32527ed66213f5716af1ebfb28b</guid>
      <description><![CDATA[The retention of communication data by network providers, often mandated by legislation, raises social and technical security concerns. A generic model combining technical, procedural, and legal...]]></description>
      <content:encoded><![CDATA[The retention of communication data by network providers, often mandated by legislation, raises social and technical security concerns. A generic model combining technical, procedural, and legal controls can help secure retained data and minimize privacy threats against users.<br style="clear: both;"/>
  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=2decd6847ba49454704c462f5e3e7364" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=2decd6847ba49454704c462f5e3e7364" style="display: none;" border="0" height="1" width="1" alt=""/>]]></content:encoded>
      <pubDate>Wed, 08 Oct 2008 00:42:06 +0000</pubDate>
      <category domain="http://securityratty.com/tag/data">data</category>
      <category domain="http://securityratty.com/tag/technical">technical</category>
      <category domain="http://securityratty.com/tag/technical security concerns">technical security concerns</category>
      <category domain="http://securityratty.com/tag/communication data">communication data</category>
      <category domain="http://securityratty.com/tag/legal controls">legal controls</category>
      <category domain="http://securityratty.com/tag/privacy threats">privacy threats</category>
      <category domain="http://securityratty.com/tag/network providers">network providers</category>
      <category domain="http://securityratty.com/tag/raises social">raises social</category>
      <category domain="http://securityratty.com/tag/retention">retention</category>
      <source url="http://www.pheedo.com/click.phdo?i=2decd6847ba49454704c462f5e3e7364">Data Retention and Privacy in Electronic Communications</source>
    </item>
    <item>
      <title><![CDATA[Syndicating Google Trends Keywords for Blackhat SEO]]></title>
      <link>http://securityratty.com/article/c56eb4f87e14b19e95246ca1bd8a55dd</link>
      <guid>http://securityratty.com/article/c56eb4f87e14b19e95246ca1bd8a55dd</guid>
      <description><![CDATA[Several hundred Windows Live Spaces and AOL Journals , are currently syndicating the most popular keywords provided by Google Trends, and are consequently hijacking the top search queries exposing...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://4.bp.blogspot.com/_wICHhTiQmrA/SOXPRRoj3fI/AAAAAAAACPQ/DGGVEuUQaUc/s1600-h/bogus_blogs_google_trends_malware.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://4.bp.blogspot.com/_wICHhTiQmrA/SOXPRRoj3fI/AAAAAAAACPQ/fIYx1pvZfIM/s200-R/bogus_blogs_google_trends_malware.JPG" /></a>Several hundred <a href="http://blogs.zdnet.com/security/?p=1995">Windows Live Spaces and AOL Journals</a>, are currently syndicating the most popular keywords provided by Google Trends, and are consequently <a href="http://www.webroot.com/En_US/about-press-room-press-releases-hackers-using-real-headlines.html">hijacking the top search queries</a> exposing users to Zlob codecs.<br />
<br />
Here are some same bogus blogs used in the campaign, naturally pre-registered long before they executed it :<br />
<br />
<b>vinniedigg18 .spaces.live.com</b><br />
<b>journals.aol .com/iolatour16</b><br />
<b>fredabreak02 .spaces.live.com</b><br />
<b>thedaalerts01 .spaces.live.com</b><br />
<b>allisonpolls08 .spaces.live.com</b><br />
<b>rheabreak18 .spaces.live.com</b><br />
<b>racquellog17 .spaces.live.com</b><br />
<b>monikavideo11 .spaces.live.com</b><br />
<b>journals.aol .com/shelvakill27</b><br />
<b>tomekadigg26 .spaces.live.com</b><br />
<b>ivahnet19 .spaces.live.com</b><br />
<b>journals.aol .com/louisathere13</b><br />
<b>allisonpolls08 .spaces.live.com</b><br />
<b>valericatch03 .spaces.live.com</b><br />
<b>journals.aol .com/iolatour16</b><br />
<b>hadleycue01 .spaces.live.com</b><br />
<b>journals.aol .com/staceyliving01</b><br />
<b>collettebreak17 .spaces.live.com</b><br />
<b>journals.aol .com/nataliablog16</b><br />
<b>natalymore26 .spaces.live.com<br />
</b><br />
<br />
<a href="http://www.filefactory.com/file/4faafd/n/rogue_blogs_google_trends_txt">A comprehensive listing of the blogs involved can be downloaded here</a>. <br />
<br />
<div class="separator" style="clear: both; text-align: center;"><a href="http://1.bp.blogspot.com/_wICHhTiQmrA/SOXYvtGnGWI/AAAAAAAACPY/7WDPIuBn5Eg/s1600-h/google_trends_blackhat_SEO.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://1.bp.blogspot.com/_wICHhTiQmrA/SOXYvtGnGWI/AAAAAAAACPY/3Ph-I65avew/s200-R/google_trends_blackhat_SEO.png" /></a></div>What do all of these bogus blogs have in common? The fact that they are all being abused by a single malware campaign, and the Keep it Simple Stupid mentality only a lazy malware campaigner can take advantage of. All of the blogs as using a central redirection domain, shutting it down or blocking it renders the number of bogus blogs is circulation irrelevant. In this case, the domain in question is <b>video.xmancer.org</b> (216.195.59.75).<br />
<br />
Here are the the rest of the domains participating in the campaign, as well as the parked ones at the corresponding IPs :<br />
<br />
<b>video.xmancer .org</b> (216.195.59.75)<br />
<b>buynowbe .com<br />
loveniche .com<br />
antivirus-freecheck .com<br />
jetelephone .cn<br />
reducki .cn<br />
woteenhas .cn<br />
lilaloft .cn</b><br />
<br />
<b>clipztimes .com</b> (78.157.143.235)<br />
<b>imagelized .com<br />
vidzdaily .com</b><br />
<br />
<b>gotmovz .com</b> (78.108.177.91) <br />
<b>dwnld-clips .com</b><br />
<br />
<b>movwmstream .com</b> (77.91.231.183)<br />
<b>newwmpupdate .com<br />
zaeplugin .com<br />
movaccelerator .com<br />
optimwares .com<br />
piterserv .com</b><br />
<br />
<b>moviesportal2008p .com</b> (72.232.183.154)<br />
<b>movieportal2008a .com<br />
funnyportal2008l .com<br />
starsportal2008p .com<br />
softportal2008p .com<br />
movieportal2008q .com</b><br />
<br />
In short, despite that the campaign is poised to attract generic search traffic, it's a self-exposing blackhat SEO campaign since each and every blog participating is also linking to the rest of the ones within the ecosystem.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2008/06/blackhat-seo-redirects-to-malware-and.html">Blackhat SEO Redirects to Malware and Rogue Software</a><br />
<a href="http://ddanchev.blogspot.com/2008/05/blackhat-seo-campaign-at-millennium.html">Blackhat SEO Campaign at The Millennium Challenge Corporation</a><br />
<a href="http://ddanchev.blogspot.com/2008/03/massive-iframe-seo-poisoning-attack.html">Massive IFRAME SEO Poisoning Attack Continuing</a><br />
<a href="http://ddanchev.blogspot.com/2008/02/massive-blackhat-seo-targeting-blogspot.html">Massive  Blackhat SEO Targeting Blogspot</a><br />
<a href="http://ddanchev.blogspot.com/2008/01/invisible-blackhat-seo-campaign.html">The  Invisible Blackhat SEO Campaign</a><br />
<a href="http://ddanchev.blogspot.com/2007/01/attack-of-seo-bots-on-edu-domain.html">Attack  of the SEO Bots on the .EDU Domain</a><br />
<a href="http://ddanchev.blogspot.com/2007/11/p0rngov-ongoing-blackhat-seo-operation.html">p0rn.gov  - The Ongoing Blackhat SEO Operation</a><br />
<a href="http://ddanchev.blogspot.com/2008/02/continuing-gov-blackat-seo-campaign.html">The Continuing .Gov Blackat SEO Campaign</a><br />
<a href="http://ddanchev.blogspot.com/2008/02/continuing-gov-blackat-seo-campaign_25.html">The Continuing .Gov Blackhat SEO Campaign - Part Two</a><br />
<a href="http://ddanchev.blogspot.com/2007/10/compromised-sites-serving-malware-and.html">Compromised Sites Serving Malware and Spam</a><b> </b><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=uwRsM"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=uwRsM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=LdmhM"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=LdmhM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=eqMbm"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=eqMbm" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=igiam"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=igiam" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=iONDM"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=iONDM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=0QewM"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=0QewM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=6xSvm"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=6xSvm" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/410092478" height="1" width="1"/>]]></content:encoded>
      <pubDate>Fri, 03 Oct 2008 00:19:24 +0000</pubDate>
      <category domain="http://securityratty.com/tag/spaces">spaces</category>
      <category domain="http://securityratty.com/tag/windows live spaces">windows live spaces</category>
      <category domain="http://securityratty.com/tag/malware">malware</category>
      <category domain="http://securityratty.com/tag/live">live</category>
      <category domain="http://securityratty.com/tag/single malware campaign">single malware campaign</category>
      <category domain="http://securityratty.com/tag/aol journals">aol journals</category>
      <category domain="http://securityratty.com/tag/journals">journals</category>
      <category domain="http://securityratty.com/tag/campaign">campaign</category>
      <category domain="http://securityratty.com/tag/blackhat seo campaign">blackhat seo campaign</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/410092478/syndicating-google-trends-keywords-for.html">Syndicating Google Trends Keywords for Blackhat SEO</source>
    </item>
    <item>
      <title><![CDATA[Interop NY: Cloud Language: The Taxonomy of On-Demand Computing]]></title>
      <link>http://securityratty.com/article/69fa97ea284dec188b278c522ed18fd8</link>
      <guid>http://securityratty.com/article/69fa97ea284dec188b278c522ed18fd8</guid>
      <description><![CDATA[This session on cloud computing was presented by Peter Laird of Oracle Corporation. Peter is a lead architect for the WebCenter product family. He previously worked with BEA as an architect for SaaS...]]></description>
      <content:encoded><![CDATA[<p>This <a href="http://www.interop.com/newyork/conference/all-by-day.php?tag=Cloud+Computing" target="_blank">session on cloud computing</a> was presented by Peter Laird of Oracle Corporation. Peter is a lead architect for the WebCenter product family. He previously worked with BEA as an architect for SaaS efforts. He also blogs at <a href="http://peterlaird.blogspot.com/" target="_blank">Laird On Demand</a>.</p>
<p><strong>Defining Cloud Computing</strong></p>
<p>Cloud computing is a very active community. The <a href="http://groups.google.com/group/cloud-computing" target="_blank">Google Group</a> gets 600 posts per month and many bloggers are covering the space. However, &#8220;cloud computing&#8221; is impossible to define in a way that satisfies everyone (or even most). Cloud computing is not alone in this controversy, consider the definition and meaning of &#8220;Web 2.0&#8243;, &#8220;mashups&#8221; or &#8220;RESTful architecture&#8221;. All of these terms are relatively recent. According to Google Trends, these terms became popular to the general public sometime between 2005 and 2007:</p>
<ul>
<li>Web 2.0 - often confused with RIA, AKA Social Computing, Long-Tail Apps, Crowdware (2005 by O&#8217;Reilly Media)</li>
<li>Mashup - made popular by Google Maps, AKA Composite/Situational Apps. (2005)</li>
<li>REST - Has a strict definition, but many don&#8217;t understand it and abuse the term. (2006 by R. Fielding)</li>
<li>Cloud computing - collides with many other terms, such as SaaS, Grid, Utility, PaaS, etc. (2007)</li>
</ul>
<p>The definition of cloud computing is in progress:</p>
<blockquote><p>There&#8217;s a Darwinian evolution of the exact definition of cloud computing running around. We&#8217;re about a country mile away from &#8220;knowing when I see it&#8221;, which is excellent progress. The cloud to everyone&#8217;s silver-lining has enough material to write a 3 volume desktop reference at this point. - Michael Cote, June 2008</p></blockquote>
<p><strong>Definition #1</strong> - &#8220;Cloud computing is the realisation of Internet (&#8221;Cloud&#8221;) based development and use of computer technology (&#8221;Computing&#8221;) delivered by an ecosystem of providers. - Sam Johnston, July 2008</p>
<p><strong>Definition #2</strong> - &#8220;Cloud computing = network computing. I love the idea of cloud computing, the next evolution of the most network intensive architecture possible, but one that if it works well, is transparent. It&#8217;s all about the transparency.&#8221; - Douglas Gourlay, Cisco, May 2008</p>
<p><strong>Definition #3</strong> - &#8220;There seems to be a group myopia around so-called &#8220;cloud computing&#8221; and its definitions. What we&#8217;re really talking about are &#8220;cloud services&#8221; of which, &#8220;computing&#8221; is only a subset&#8230;Cloud services are not SaaS. They are far more akin to web services&#8230;&#8221; - Randy Bias, neoTactics, May 2008</p>
<p><strong>(Anti-)Definition #4</strong> - &#8220;Note that I refer to cloud services, not to the could. I am not interested in defining cloud as a term, because I don&#8217;t think it&#8217;s very useful. For those of us in the distributed computing&#8217;s pace</p>
<p><strong>The Working Definition (Winner!):</strong></p>
<p>&#8220;&#8230;the notion of providing easily accessible compute and storage resources on a pay-as-you-go, on-demand basis, from a virtually infinite infrastructure managed by someone else. As a customer, you don&#8217;t know where the resources are, and for the most part, you don&#8217;t care. What&#8217;s really important is the capability to access your application anywhere, move it freely and easily, and inexpensively add resources for instant scalability.&#8221; - Mitchell Crandell, Rightscale, June 2008</p>
<p><strong>Taxonomies of the Cloud Space</strong></p>
<p>Taxonomies are useful to provide insight into a market. It classifies a multitude of players into a smaller bucket.</p>
<p><em>Andreessen&#8217;s Platforms - September 2007</em></p>
<p>Provided an early taxonomy model for emerging cloud platforms</p>
<p>Platform being a system that can be programmed</p>
<ul>
<li>Access API - platform that provides web service endpoints</li>
<li>Plug-In API - platform invokes your code, that you have deployed remotely</li>
<li>Runtime Environment - your code runs inside the platform&#8217;s process space.</li>
</ul>
<p><em>Mehta 11 Layer Stack, April 2008</em></p>
<ol>
<li>Facilities (space, power, cooling)</li>
<li>Network</li>
<li>Hardware (e.g. servers Amazon EC2 runs)</li>
<li>Hardware virtualization (e.g. Xen for EC2) - optional</li>
<li>O/S (e.g. Linux)</li>
<li>Systems Management (e.g., tools to manage EC2 instances)</li>
<li>Application Middleware (e.g., MySQL on EC2)</li>
<li>Application Code</li>
<li>Application APIs / Web Services</li>
<li>GUI for Application</li>
<li>GUI for Application Development / Customization</li>
</ol>
<p><em>Croll Cloud Stack, June 2008</em></p>
<p>7 layer stack within Turnkey app and Generic Platform.</p>
<p><em>Turnkey app</em></p>
<ul>
<li>SaaS</li>
<li>Extensible app</li>
<li>Generic IDE</li>
<li>Constrained APIs</li>
<li>App Cluster</li>
<li>Virtual Data Center</li>
<li>Virtual Servers</li>
</ul>
<p><em>Generic Platform</em></p>
<p>The bottom of Alistair&#8217;s stack includes &#8220;root access &#8220;style compute clouds.</p>
<p><em>Robert Anderson, July 2008</em></p>
<p>3 layer stack</p>
<ul>
<li>Software (SaaS)</li>
<li>Platform (PaaS)</li>
<li>Infrastructure (IaaS)</li>
</ul>
<p>This is the model taxonomy for this session.</p>
<p><strong>Related Concepts and Terms</strong></p>
<ul>
<li>Infrastructure as a Service (IaaS), Hardware as a Service (HaaS) are synonyms to cloud infrastructure.</li>
<li>Virtualization</li>
<li>Hosting</li>
<li>Autonomic computing</li>
<li>Distributed computing</li>
<li>Grid computing</li>
</ul>
<p>Cloud Applications</p>
<ul>
<li>SaaS</li>
<li>S+S (Software+Services)</li>
<li>Managed Service Provider (MSP)</li>
</ul>
]]></content:encoded>
      <pubDate>Wed, 17 Sep 2008 14:25:32 +0000</pubDate>
      <category domain="http://securityratty.com/tag/cloud">cloud</category>
      <category domain="http://securityratty.com/tag/cloud applications">cloud applications</category>
      <category domain="http://securityratty.com/tag/croll cloud stack">croll cloud stack</category>
      <category domain="http://securityratty.com/tag/cloud infrastructure">cloud infrastructure</category>
      <category domain="http://securityratty.com/tag/platforms process space">platforms process space</category>
      <category domain="http://securityratty.com/tag/space">space</category>
      <category domain="http://securityratty.com/tag/cloud space">cloud space</category>
      <category domain="http://securityratty.com/tag/cloud platforms">cloud platforms</category>
      <category domain="http://securityratty.com/tag/cloud services">cloud services</category>
      <source url="http://blog.sciencelogic.com/interop-ny-cloud-language-the-taxonomy-of-on-demand-computing/09/2008">Interop NY: Cloud Language: The Taxonomy of On-Demand Computing</source>
    </item>
    <item>
      <title><![CDATA[SQL Injecting Malicious Doorways to Serve Malware]]></title>
      <link>http://securityratty.com/article/6cec302595fea49e4d1ec4cc6e8a2a25</link>
      <guid>http://securityratty.com/article/6cec302595fea49e4d1ec4cc6e8a2a25</guid>
      <description><![CDATA[Abusing legitimate sites as redirectors to malicious doorways serving malware is becoming increasing common, as is the use of SQL injections in order for the malicious parties to ensure their...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="text-align: center; clear: both;"></div><a href="http://bp3.blogger.com/_wICHhTiQmrA/SIQqtdScFcI/AAAAAAAAB78/E-aOhcc0edk/s1600-h/sql_gpamelaaandersona_info.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp3.blogger.com/_wICHhTiQmrA/SIQqtdScFcI/AAAAAAAAB78/DQBfk5L1tng/s200-R/sql_gpamelaaandersona_info.JPG" style="border: 0pt none ;" /></a>Abusing legitimate sites as redirectors to malicious doorways serving malware is becoming increasing common, as is the use of SQL injections in order for the malicious parties to ensure their campaigns will receive enough generic traffic to their redirectors. Excluding the use of the very same traffic management tools, web malware exploitation kits, <a href="http://ddanchev.blogspot.com/2008/07/template-ization-of-malware-serving.html">templates for the rogue adult sites and the rogue security software</a>, perhaps the most important thing to point out regarding all of the previously analyzed such campaigns, is that they are all related to one another, and are operated by the same people, using the very same infrastructure and live exploit URLs most of the time.<br />
<br />
Let's expose yet another such campaign, that has been SQL injected and spammed across a couple of hundred web forums. <b>gpamelaaandersona .info</b> (82.103.129.98) is the typical comprehensive malicious doorway, whose galleries redirect to <b>tds.zbestservice .info/tds/in.cgi?11</b> (85.255.120.45), and from there the following campaigns load on-the-fly :<br />
<br />
<b>porntubev20 .com</b>/viewmovie.php?id=86 (74.50.117.84)<br />
<b>getmyvideonow .com</b>/exclusive2/id/3912999/2/black/white/ - (89.149.194.188)<br />
<b>immenseclips .com</b>/m6/movie1.php?id=1552&amp;n=celebs (85.255.118.156)<br />
<b>movieexternal .com</b>/download.php?id=1552 (77.91.231.201)<br />
<b>2008adults2008a .com</b>/freemovie/144/0/<br />
<b>avwav .com</b>/1931.htm<br />
<b>codecupgrade .com</b> (74.50.117.84)<br />
<b>iwillseethatvideo .com</b> (91.203.92.53)<br />
<b>dciman32 .com</b> (85.255.120.45)<br />
<br />
<a href="http://bp1.blogger.com/_wICHhTiQmrA/SIQUGF_f2RI/AAAAAAAAB7s/CABzXB36__M/s1600-h/gpamelaaandersona_blackhat_SEO.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp1.blogger.com/_wICHhTiQmrA/SIQUGF_f2RI/AAAAAAAAB7s/o_DEwW3VrGA/s200-R/gpamelaaandersona_blackhat_SEO.JPG" style="border: 0pt none ;" /></a>Naturally, these are just the tip of the iceberg, and the deeper you go, the more connections with malware gangs and previous campaigns can be established. For instance, here are some more "sleeping beauties" at <b>74.50.117.84</b> :<br />
<br />
&nbsp;<b>winantivirus2008 .org<br />
porntubev20 .com<br />
crack-land .com<br />
just-tube .com&nbsp;&nbsp;&nbsp; <br />
codecupgrade .com<br />
codecupgrade .com<br />
scanner-tool .com<br />
surf-scanner .com<br />
best-cracks .com<br />
updatehost .com<br />
updatehost .com<br />
freemoviesdb .net<br />
megasoftportal .net</b><br />
<br />
And even more malicious doorways, and rogue software at <b>89.149.227.195</b> :<br />
<br />
<b>musicportalfree .com<br />
softportalfree .com<br />
verifiedpaymentsolutionsonline .com<br />
my-adult-catalog .com<br />
indafuckfuck .com<br />
best-porncollection .com<br />
funfuckporn .com<br />
sanxporn .com<br />
dolcevido .com<br />
xiedefender .com<br />
online-malwarescanner .com<br />
easyvideoaccess .com<br />
my-searchresults .com<br />
creatonsoft .com<br />
ihavewetfuckpussy .com</b><br />
<br />
How come none of these are in a fast-flux? Pretty simple. Keeping in mind that they continue using the services of <a href="http://ddanchev.blogspot.com/2008/06/malicious-isps-you-rarely-see-in-any.html">the ISPs that you rarely see in any report</a>, survivability through fast-flux is irrelevant when <a href="http://ddanchev.blogspot.com/2008/02/geolocating-malicious-isps.html">emails sent to abuse@cybercrime.tolerating.isp</a> receive a standard response two weeks later, and when your abuse emails become more persistent, <a href="http://ddanchev.blogspot.com/2008/01/rbns-fake-account-suspended-notices.html">a fake account suspended notice</a> makes it to the front page, whereas the campaigns get automatically updated to redirect to an internal page, again serving the malware and the redirectors.<br />
<br />
<b>Related posts:</b><br />
<b></b><a href="http://ddanchev.blogspot.com/2008/07/fake-porn-sites-serving-malware-part.html">Fake Porn Sites Serving Malware - Part Two</a><br />
<a href="http://ddanchev.blogspot.com/2008/06/fake-porn-sites-serving-malware.html">Fake Porn Sites Serving Malware</a><br />
<a href="http://ddanchev.blogspot.com/2008/06/underground-multitasking-in-action.html">Underground Multitasking in Action</a><br />
<a href="http://ddanchev.blogspot.com/2008/06/fake-celebrity-video-sites-serving.html">Fake Celebrity Video Sites Serving Malware</a><br />
<a href="http://ddanchev.blogspot.com/2008/06/blackhat-seo-redirects-to-malware-and.html">Blackhat SEO Redirects to Malware and Rogue Software</a><br />
<a href="http://ddanchev.blogspot.com/2008/06/malicious-doorways-redirecting-to.html">Malicious Doorways Redirecting to Malware</a><br />
<a href="http://ddanchev.blogspot.com/2008/03/portfolio-of-fake-video-codecs.html">A Portfolio of Fake Video Codecs</a><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=oa2OiJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=oa2OiJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=UeSeaJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=UeSeaJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=o3c9tj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=o3c9tj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=Rln4wj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=Rln4wj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=YfC90J"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=YfC90J" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=21MM8J"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=21MM8J" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=l631Yj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=l631Yj" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/341279604" height="1" width="1"/>]]></content:encoded>
      <pubDate>Sun, 20 Jul 2008 21:45:57 +0000</pubDate>
      <category domain="http://securityratty.com/tag/malware">malware</category>
      <category domain="http://securityratty.com/tag/malicious doorways">malicious doorways</category>
      <category domain="http://securityratty.com/tag/sites">sites</category>
      <category domain="http://securityratty.com/tag/rogue adult sites">rogue adult sites</category>
      <category domain="http://securityratty.com/tag/malware gangs">malware gangs</category>
      <category domain="http://securityratty.com/tag/campaigns load on-the-fly">campaigns load on-the-fly</category>
      <category domain="http://securityratty.com/tag/campaigns">campaigns</category>
      <category domain="http://securityratty.com/tag/fake porn sites">fake porn sites</category>
      <category domain="http://securityratty.com/tag/sql">sql</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/341279604/sql-injecting-malicious-doorways-to.html">SQL Injecting Malicious Doorways to Serve Malware</source>
    </item>
    <item>
      <title><![CDATA[Messaging and Event Processing]]></title>
      <link>http://securityratty.com/article/fd1957191d920d6269f4de936020f086</link>
      <guid>http://securityratty.com/article/fd1957191d920d6269f4de936020f086</guid>
      <description><![CDATA[In On Messaging and Events Opher asks, Is event processing just fancy name to message processing
Most event processing systems would be incomplete without the ability to process events in the form of...]]></description>
      <content:encoded><![CDATA[<p>In <a href="http://http://epthinking.blogspot.com/2008/07/on-messages-and-events.html" target="_blank">On Messaging and Events</a> Opher asks, <em>&#8220;Is event processing just fancy name to message processing ?&#8221;</em></p>
<p>Most event processing systems would be incomplete without the ability to process events in the form of messages.   Messages can be delivered in either a connection-oriented protocol or a connectionless protocol.   Most enterprise-class messaging systems have both.   Many messaging systems have features like guarenteed delivery, which are important to many applications.</p>
<p>On the other hand, you do not have to work with a messaging system or enterprise service bus (ESB) to process events, because the transport layer is independent from the event processing layer, theoretically.  Most enterprise-class event processing system architectures will use a combination of both asynchronous and synchronous messaging. </p>
<p>To understand event processing I recommend you turn to network management and the practical use of Simple Network Management Protocol (SMNP) for a basic undertanding of event processing.   SNMP uses both synchronous event-based messaging, called polling, and asynchronous messaging, called traps.   Network management systems engineers use a combination of both polling and trapping in all enterprise-class operational NMS.  Optimizing polling and trapping is one of the tasks good NMS engineers do well. The same holds true in most distributed event processing architectures.  </p>
<p>For example, look at the <a href="http://www.thecepblog.com/what-is-complex-event-processing/" target="_blank">CEP/EP reference architecture</a> on this site.  You will notice that the mechanism for event transport is generic, represented as an event bus, but it does not specify the transport protocol.  If you are receiving raw events and comparing correlated results against a signature in a database, you are using both asynchronous and synchronous messaging.    In theory, you could build an event processing system with only connection-oriented protocols, but this would be an exeception, not the rule.</p>
<p>Event processing is generally associated with messaging because we generally represent event-objects as electronic messages.   In theory, we could call these cyber event-objects anything we want; for example, we could call them &#8220;packets.&#8221; However, packets are generally associated with the underlying Internet Protocol (IP) layer by network engineers.  </p>
<p>Moving up the stack, we think in terms of a complete message-object, which we generally call &#8220;a message.&#8221;  This message could be an SNMP event-object, an SMTP event-object (an email message), or an HTML request to a web server, to only name a few.    In fact, the basic unit of work at the application level of a distributed network application is what we call &#8220;a message.&#8221;  </p>
<p>So, in <a href="http://http://epthinking.blogspot.com/2008/07/on-messages-and-events.html" target="_blank">On Messaging and Events</a> Opher asks, <em>&#8220;Is event processing just fancy name to message processing ?&#8221;</em></p>
<p>Events are generally represented in some electronic format.  The event-object must be transported electronically in cyberspace, and the way that it is transported is in what network engineers generally call &#8220;a message.&#8221;   It make no difference what we call it, really; because whatever we call it, it is still binary data representing information we are interested in, hopefully in a format we can efficiently process.    Enterprise-class event processing systems are designed to work with myriad formats, protocols and transports.   One size does not fit all.</p>
<p> </p>
<p> </p>
]]></content:encoded>
      <pubDate>Sun, 13 Jul 2008 05:02:47 +0000</pubDate>
      <category domain="http://securityratty.com/tag/event">event</category>
      <category domain="http://securityratty.com/tag/smtp event-object">smtp event-object</category>
      <category domain="http://securityratty.com/tag/event-object">event-object</category>
      <category domain="http://securityratty.com/tag/cyber event-objects">cyber event-objects</category>
      <category domain="http://securityratty.com/tag/snmp event-object">snmp event-object</category>
      <category domain="http://securityratty.com/tag/snmp">snmp</category>
      <category domain="http://securityratty.com/tag/event bus">event bus</category>
      <category domain="http://securityratty.com/tag/event-objects">event-objects</category>
      <category domain="http://securityratty.com/tag/event transport">event transport</category>
      <source url="http://www.thecepblog.com/2008/07/13/messaging-and-event-processing/">Messaging and Event Processing</source>
    </item>
    <item>
      <title><![CDATA[The Template-ization of Malware Serving Sites]]></title>
      <link>http://securityratty.com/article/ae9fa7925137e6a71a690ef3b705294d</link>
      <guid>http://securityratty.com/article/ae9fa7925137e6a71a690ef3b705294d</guid>
      <description><![CDATA[Just like web malware exploitation kits and phishing pages turned into a commodity underground good , allowing easy localization to different languages , and of course, the natural lowering of entry...]]></description>
      <content:encoded><![CDATA[<a href="http://bp1.blogger.com/_wICHhTiQmrA/SHZZ6zTOnOI/AAAAAAAAB5c/3Sqe37mACns/s1600-h/fake_video_codec_template.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp1.blogger.com/_wICHhTiQmrA/SHZZ6zTOnOI/AAAAAAAAB5c/Rsu1-EiUFlY/s200-R/fake_video_codec_template.JPG" style="border: 0pt none ;" /></a>Just like web <a href="http://ddanchev.blogspot.com/2007/10/mpack-and-icepack-localized-to-chinese.html">malware</a> <a href="http://ddanchev.blogspot.com/2008/05/icepack-exploitation-kit-localized-to.html">exploitation</a> <a href="http://ddanchev.blogspot.com/2008/05/firepack-exploitation-kit-localized-to.html">kits</a> and <a href="http://ddanchev.blogspot.com/2008/03/phishing-pages-for-every-bank-are.html">phishing pages turned into a commodity underground good</a>, allowing easy <a href="http://ddanchev.blogspot.com/2008/02/localizing-cybercrime-cultural.html">localization to different languages</a>, and of course, the natural lowering of entry barriers into web malware and phishing in general, the very same thing is happening with fake ActiveX templates like the ones used on <a href="http://ddanchev.blogspot.com/2008/07/fake-porn-sites-serving-malware-part.html">the majority of fake porn and celebrity sites I've been assessing recently</a>.<br />
<br />
The increase of these bogus ActiveX templates is due to the fact that despite they are currently available for sale, buyers appear to be leaking them for everyone to use so that they can continue maintaining their current business models, namely, the services they offer with the ActiveX templates. Unethical competitive practices among cybercriminals and scammers are only to starting to take place with one another trying to ruin or extend the lifecycle of their services.<br />
<br />
Talking about prevalence, the <b>TonsOfPorn ActiveX</b> remains the most widely used rogue ActiveX in the majority of fake codec campaigns for the last couple of months. The ActiveX is largely abused by using another <b>fake porn site template for PornTube</b>, which in combination result in nothing more than huge domain portfolios with no content at all if we exclude the Zlob variants.<br />
<br />
And while template-tization means more efficient malware campaigns, it also results in a common pattern for generic detection of such sites. For instance, the folks at <a href="http://www.finjan.com/MCRCblog.aspx?EntryId=1993">Finjan did an experiment by verifying the signature based detection of the common javascript file</a> that was used in the ongoing waves of SQL injection attacks. Their conclusion :<br />
<br />
"<i>Can it be that Anti-virus products are now holding more signatures for domains and URLs rather than trying to identify a malicious code they never inspected before? As my research found, just by changing the domain names, some AVs did not find this code as malicious...... surprisingly enough.</i>"<br />
<br />
<div style="text-align: left;"></div>
<div class="separator" style="text-align: center; clear: both;"></div>
<a href="http://bp0.blogger.com/_wICHhTiQmrA/SHaFBlIm7bI/AAAAAAAAB5k/lXlcCbD2H78/s1600-h/inthecloud3.jpg" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp0.blogger.com/_wICHhTiQmrA/SHaFBlIm7bI/AAAAAAAAB5k/wABNqH2-Sz0/s200-R/inthecloud3.jpg" style="border: 0pt none ;" /></a>When assessing malware campaigns in general, I usually do the same for the record. Storm Worm's use of <b>ind.php</b> for executing its set of exploits has the same detection rate - <b>scanners result: 10/33 (30.30%)</b> and is detected as JS.Zhelatin.zb.<br />
<br />
Getting back to the <b>TonsOfPorn ActiveX</b>, it's structure is more static than a Red Army statue in Estonia, making it easy to proactively protect against, no matter the domain, no matter the exploits served. It's detection rate is close to the javascript from the SQL injection attacks - <b>Scanners Result: 9/33 (27.28%) </b>and is detected as <b>Trojan.HTML.Zlob.L</b>.<br />
<br />
From my personal experience, blocking an IP address where a couple of hundred malicious domains remain parked, is just as useful as blocking a single domain acting as the main redirector behind a huge domains portfolio of malicious domains. However, the most beneficial approach on a large scale remains the practice of taking care of the most obvious patterns that still remain faily easy to detect, at least for the time being, due to the efficiency the people behind them aim to achieve, making them easily susceptible to generic detection approaches.<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=60LvHJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=60LvHJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=TvxsiJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=TvxsiJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=UeK86j"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=UeK86j" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=AHP63j"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=AHP63j" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=ci9jvJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=ci9jvJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=mQuV1J"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=mQuV1J" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=FGm2Yj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=FGm2Yj" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/332106839" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 10 Jul 2008 12:59:13 +0000</pubDate>
      <category domain="http://securityratty.com/tag/malicious domains remain">malicious domains remain</category>
      <category domain="http://securityratty.com/tag/malicious domains">malicious domains</category>
      <category domain="http://securityratty.com/tag/tonsofporn activex remains">tonsofporn activex remains</category>
      <category domain="http://securityratty.com/tag/tonsofporn activex">tonsofporn activex</category>
      <category domain="http://securityratty.com/tag/domains">domains</category>
      <category domain="http://securityratty.com/tag/generic detection approaches">generic detection approaches</category>
      <category domain="http://securityratty.com/tag/generic detection">generic detection</category>
      <category domain="http://securityratty.com/tag/activex">activex</category>
      <category domain="http://securityratty.com/tag/fake activex">fake activex</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/332106839/template-ization-of-malware-serving.html">The Template-ization of Malware Serving Sites</source>
    </item>
    <item>
      <title><![CDATA[ICANN And IANA Defaced]]></title>
      <link>http://securityratty.com/article/5887642d6261fd229fc5f260cd84c5ab</link>
      <guid>http://securityratty.com/article/5887642d6261fd229fc5f260cd84c5ab</guid>
      <description><![CDATA[Well, I have to admit I only just saw this one this morning. Since its a long weekend(ish) here in Canada I wasnt planning on updating the site until Wednesday. This one is something worth sharing. I...]]></description>
      <content:encoded><![CDATA[<p>Well, I have to admit I only just saw this one this morning. Since it&#8217;s a long weekend(ish) here in Canada I wasn&#8217;t planning on updating the site until Wednesday. This one is something worth sharing. I figured I&#8217;d pass it along. </p>
<p>A group calling itself &#8220;NetDevilz&#8221; defaced the homepages for ICANN &amp; IANA. </p>
<p><center><img src="http://www.liquidmatrix.org/blog/wp-content/uploads/2008/06/icanndefaced.jpg" alt="credit: Websense, Zone-H" /></center></p>
<p>Ouch.</p>
<p>From Websense:</p>
<blockquote><p>Websense® Security Labs™ has received reports that the official website of ICANN and IANA Domains have been hijacked by a Turkish group called “NetDevilz”. ICANN and IANA are responsible for the Internet Protocol (IP) address space allocation, protocol identifier assignment, generic (gTLD) and country code Top Level Domain Name System management, and root server system management functions.</p></blockquote>
<p>For the full advisory please read on.</p>
<p><a href="http://securitylabs.websense.com/content/Alerts/3119.aspx">Article Link</a></p>
<p>For more on this check out Dancho Danchev&#8217;s <a href="http://ddanchev.blogspot.com/2008/06/icann-and-ianas-domain-names-hijacked.html">posting</a> on his site.</p>

<p><a href="http://feeds.feedburner.com/~a/Liquidmatrix?a=hrECsk"><img src="http://feeds.feedburner.com/~a/Liquidmatrix?i=hrECsk" border="0"></img></a></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=Vw07MI"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=Vw07MI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=IoWIki"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=IoWIki" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=Iv4zyi"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=Iv4zyi" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=4rciQi"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=4rciQi" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=iKXGgi"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=iKXGgi" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/Liquidmatrix/~4/323293837" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 30 Jun 2008 10:49:35 +0000</pubDate>
      <category domain="http://securityratty.com/tag/iana">iana</category>
      <category domain="http://securityratty.com/tag/icann">icann</category>
      <category domain="http://securityratty.com/tag/websense">websense</category>
      <category domain="http://securityratty.com/tag/websense security labs">websense security labs</category>
      <category domain="http://securityratty.com/tag/iana domains">iana domains</category>
      <category domain="http://securityratty.com/tag/protocol identifier assignment">protocol identifier assignment</category>
      <category domain="http://securityratty.com/tag/address space allocation">address space allocation</category>
      <category domain="http://securityratty.com/tag/article link">article link</category>
      <category domain="http://securityratty.com/tag/system management">system management</category>
      <source url="http://feeds.feedburner.com/~r/Liquidmatrix/~3/323293837/">ICANN And IANA Defaced</source>
    </item>
    <item>
      <title><![CDATA[Black Hat Bloggers Network topic of interest #2]]></title>
      <link>http://securityratty.com/article/6c2b58e37505a21fdf1bce457d0453e9</link>
      <guid>http://securityratty.com/article/6c2b58e37505a21fdf1bce457d0453e9</guid>
      <description><![CDATA[So our first topic of interest as part of the Black Hat Bloggers Network promotion was virtualization and security in honor of our own Chris Hoff presenting at Black Hat this year. While several...]]></description>
      <content:encoded><![CDATA[
<div xmlns="http://www.w3.org/1999/xhtml"><p><a href="http://www.stillsecureafteralltheseyears.com/photos/uncategorized/2008/06/25/blackhatbloggers.gif"><img title="Blackhatbloggers" height="177" alt="Blackhatbloggers" src="http://www.stillsecureafteralltheseyears.com/ashimmy/images/2008/06/25/blackhatbloggers.gif" width="200" border="0" style="FLOAT: right; MARGIN: 0px 0px 5px 5px" /></a> So our <a href="http://www.stillsecureafteralltheseyears.com/ashimmy/2008/06/black-hat-blo-1.html">first topic of interest</a> as part of the Black Hat Bloggers Network promotion was virtualization and security in honor of our own <a href="http://blackhat.com/html/bh-usa-08/bh-usa-08-speakers.html#Hoff">Chris Hoff presenting at Black Hat</a> this year. While several members of the network wrote some really great stuff, I was hoping we would get more of a broader response from the 150+ blogs on the network.&nbsp; So for topic #2 I wanted to pick something more generic and easier to blog on.&nbsp; Our topic is why go to Black Hat.&nbsp; Most of the blogger network members either go to Black Hat or wish they did.&nbsp; Why?&nbsp; Lets hear your reasons for going to Black Hat. Is it the briefings?&nbsp; the parties? seeing old friends? what?&nbsp; I am hoping to see a lot of blogs on this subject from all of our BHBN member blogs!</p>

<p>I should also point out that Black Hat is doing some great promos leading up to the show.&nbsp; They have a <a href="http://www.techwebonlineevents.com/ars/eventregistration.do?mode=eventreg&amp;F=1001004&amp;K=1AA1A1">great webinar coming up today</a> that I totally spaced on because I wanted to give everyone more notice and time to register. In the meantime, don't be like <del>Mike</del>, I mean Shimmy, go register and check out the webcast!&nbsp; Also be on the look out for some of the other great events they have cooking, as well as registering for the Black Hat Twitter feed.</p>

<fieldset class="zemanta-related"><legend>Related articles</legend><ul class="zemanta-article-ul"><li class="zemanta-article-ul-li"><a title="Open in new window" href="http://www.hackaday.com/2008/06/24/pwnie-awards-2008-nominations-open/">Pwnie awards 2008, nominations open</a> [via Zemanta] </li>

<li class="zemanta-article-ul-li"><a title="Open in new window" href="http://www.news.com/8301-10789_3-9898196-57.html?part=rss&amp;subj=news">Black Hat goes interactive in selecting upcoming speakers</a> [via Zemanta]</li></ul></fieldset> <div class="zemanta-pixie" style="MARGIN-TOP: 10px; HEIGHT: 15px"><a class="zemanta-pixie-a" title="Zemified by Zemanta" href="http://reblog.zemanta.com/zemified/e64b8780-d6ec-46ac-b96e-29967f9fb2fa/"><img class="zemanta-pixie-img" alt="Zemanta Pixie" src="http://img.zemanta.com/reblog_a.png?x-id=e64b8780-d6ec-46ac-b96e-29967f9fb2fa" style="BORDER-RIGHT: medium none; BORDER-TOP: medium none; FLOAT: right; BORDER-LEFT: medium none; BORDER-BOTTOM: medium none" /></a></div></div>
]]></content:encoded>
      <pubDate>Wed, 25 Jun 2008 21:40:04 +0000</pubDate>
      <category domain="http://securityratty.com/tag/black hat">black hat</category>
      <category domain="http://securityratty.com/tag/network">network</category>
      <category domain="http://securityratty.com/tag/topic">topic</category>
      <category domain="http://securityratty.com/tag/blogger network">blogger network</category>
      <category domain="http://securityratty.com/tag/blogs">blogs</category>
      <category domain="http://securityratty.com/tag/zemanta">zemanta</category>
      <category domain="http://securityratty.com/tag/chris hoff">chris hoff</category>
      <category domain="http://securityratty.com/tag/broader response">broader response</category>
      <category domain="http://securityratty.com/tag/pwnie awards">pwnie awards</category>
      <source url="http://www.stillsecureafteralltheseyears.com/ashimmy/2008/06/black-hat-blogg.html">Black Hat Bloggers Network topic of interest #2</source>
    </item>
    <item>
      <title><![CDATA[Fake Porn Sites Serving Malware]]></title>
      <link>http://securityratty.com/article/5dacf1e5b6c84c1bed4515dca8fc1199</link>
      <guid>http://securityratty.com/article/5dacf1e5b6c84c1bed4515dca8fc1199</guid>
      <description><![CDATA[Ah, that RBN with its centralization mentality for the sake of ease of management and 99.999% uptime. In this very latest example of using malicious doorways redirecting to fake porn sites, consisting...]]></description>
      <content:encoded><![CDATA[<a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://bp2.blogger.com/_wICHhTiQmrA/SGJTBaqN1yI/AAAAAAAAB1k/b9O7PupnB8E/s1600-h/porn_codecs.JPG"><img style="margin: 0pt 10px 10px 0pt; float: left; cursor: pointer;" src="http://bp2.blogger.com/_wICHhTiQmrA/SGJTBaqN1yI/AAAAAAAAB1k/b9O7PupnB8E/s200/porn_codecs.JPG" alt="" id="BLOGGER_PHOTO_ID_5215822602249819938" border="0" /></a>Ah, that RBN with its centralization mentality for the sake of ease of management and 99.999% uptime. In this very latest example of using malicious doorways redirecting to fake porn sites, consisting of over twenty different domains serving the usual Zlob malware variants, we have a decent abuse of a template for a porn site.<br /><br />The easy of management of such domain farms and the availability of templates for high trafficked topic segments such as celebrities and pornography, continue contributing to the increasing number of Zlob variants served through fake codecs. Moreover, once set up, the malicious infrastructure starts attracting now just generic search traffic, but also traffic coming from affiliates with whom revenue is shared on the basis of the number of people that downloaded the codec.<br /><br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://bp3.blogger.com/_wICHhTiQmrA/SGJsP6kwvTI/AAAAAAAAB1s/b0lRo5htJtE/s1600-h/fake_porn_sites_ATRIVO.JPG"><img style="margin: 0pt 10px 10px 0pt; float: left; cursor: pointer;" src="http://bp3.blogger.com/_wICHhTiQmrA/SGJsP6kwvTI/AAAAAAAAB1s/b0lRo5htJtE/s200/fake_porn_sites_ATRIVO.JPG" alt="" id="BLOGGER_PHOTO_ID_5215850339125738802" border="0" /></a>In this campaign, the malicious doorway that expands the entire ecosystem is located at <span style="font-weight: bold;">search-</span><span style="font-weight: bold;">top.com/in.cgi?5&amp;parameter=drs</span> (66.96.85.113). A redirector that appears to <a href="http://www.lavasoftsupport.com/index.php?showtopic=2662">have been operating since 2006</a>, according to this forum posting.<br /><br />What follows on-the-fly, are all the fake porn sites whose legitimately looking videos attempt to download a Zlob malware variant from a single location - <span style="font-weight: bold;">vipcodec.net</span>. Here are all the fake porn sites, and the associated campaigns in this redirection :<br /><br /><span style="font-weight: bold;">watchnenjoy .com</span>/index.php?id=1287&amp;style=white<br /><span style="font-weight: bold;">craziestclips .com</span>/index.php?id=1287&amp;q=<br /><span style="font-weight: bold;">immensevids .com</span><br /><span style="font-weight: bold;">planetfreepornmovies .com</span>/?t=1&amp;id=1219<br /><span style="font-weight: bold;">poweradult .net</span>/edmund/16551689/1/&amp;id=1219<br /><span style="font-weight: bold;">scan-porn .net</span>/rosalyn/1742941675/1/&amp;id=1219<br /><span style="font-weight: bold;">about-adult .net</span>/emiline/108846601/1/&amp;id=1219<br /><span style="font-weight: bold;">service-porn .com</span>/inde/964842117/1/&amp;id=1219<br /><span style="font-weight: bold;">pleasure-porn .com</span>/elnora/648311952/1/&amp;id=1219<br /><span style="font-weight: bold;">porn-the .net</span>/verge/1734135233/1/&amp;id=1219<br /><span style="font-weight: bold;">porn-pleasure .net</span>/dal/1663381205/1/&amp;id=1219<br /><span style="font-weight: bold;">scan-porn .ne</span><span style="font-weight: bold;">t</span>/gretchen/515268975/1/&amp;id=1219<br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://bp1.blogger.com/_wICHhTiQmrA/SGJ2DJRJgoI/AAAAAAAAB10/0pUS4GVInf4/s1600-h/porn_domainfarm_codecs_visualized.JPG"><img style="margin: 0pt 10px 10px 0pt; float: left; cursor: pointer;" src="http://bp1.blogger.com/_wICHhTiQmrA/SGJ2DJRJgoI/AAAAAAAAB10/0pUS4GVInf4/s200/porn_domainfarm_codecs_visualized.JPG" alt="" id="BLOGGER_PHOTO_ID_5215861114847986306" border="0" /></a><span style="font-weight: bold;">abc-adult .com</span>/lillah/1467790484/1/&amp;id=1219<br /><span style="font-weight: bold;">about-adult .net</span>/jenne/434165228/1/&amp;id=1219<br /><span style="font-weight: bold;">look-adult .net</span>/ette/681831796/1/&amp;id=1219<br /><span style="font-weight: bold;">about-adult .net</span>/mime/65729013/1/&amp;id=1219<br /><span style="font-weight: bold;">name-adult .net</span>/alfe/550398461/1/&amp;id=1219<br /><span style="font-weight: bold;">group-ad</span><span style="font-weight: bold;">ult .net</span>/demerias/867452637/1/&amp;id=1219<br /><span style="font-weight: bold;">useporn .net</span>/rhode/167691118/1/&amp;id=1219<br /><span style="font-weight: bold;">porn-look .net</span>/hephsibah/1254235416/1/&amp;id=1219<br /><span style="font-weight: bold;">scan-porn .net</span>/hence/1684651134/1/&amp;id=1219<br /><span style="font-weight: bold;">abc-adult .com</span>/kendra/371598555/1/&amp;id=1219<br /><span style="font-weight: bold;">name-adult .net</span>/link/1334727639/1/&amp;id=1219<br /><span style="font-weight: bold;">porn-the .net</span>/flo/84660854/1/&amp;id=1219<br /><span style="font-weight: bold;">porn-popular .com</span>/assene/875893411/1/&amp;id=1219<br /><span style="font-weight: bold;">about-adult .net</span>/charlotta/972714195/1/&amp;id=1219<br /><span style="font-weight: bold;">porn-comp .com</span>/orlando/761508522/1/&amp;id=1219<br /><span style="font-weight: bold;">useporn .net</span>/jemima/1405735776/1/&amp;id=1219<br /><span style="font-weight: bold;">about-adult .net</span>/obadiah/263904242/1/&amp;id=1219<br /><span style="font-weight: bold;">group-adult .net</span>/douglas/1110779475/1/&amp;id=1219<br /><span style="font-weight: bold;">porn-look .net</span>/lydde/1844064103/1/&amp;id=1219<br /><span style="font-weight: bold;">pleasure-porn .com</span>/marcia/1627490290/1/&amp;id=1219<br /><span style="font-weight: bold;">service-porn .com</span>/cono/295680123/1/&amp;id=1219<br /><span style="font-weight: bold;">group-adult .net</span>/wes/1733468207/1/&amp;id=1219<br /><span style="font-weight: bold;">abc-adult .com</span>/wib/648341815/1/&amp;id=1219<br /><span style="font-weight: bold;">scan-porn .net</span>/greg/2064937302/1/&amp;id=1219<br /><span style="font-weight: bold;">contact-adult .net</span>/maris/33184936/1/&amp;id=1219<br /><span style="font-weight: bold;">look-adult .net</span>/regina/1273816838/1/&amp;id=1219<br /><span style="font-weight: bold;">abc-adult .com</span>/gwendolyn/869744046/1/&amp;id=1219<br /><span style="font-weight: bold;">service-porn .com</span>/carthaette/1021629112/1/&amp;id=1219<br /><span style="font-weight: bold;">scan-porn .net</span>/ninell/1522355420/1/&amp;id=1219<br /><span style="font-weight: bold;">porn-pleasure .net</span>/waldo/755290223/1/&amp;id=1219<br /><span style="font-weight: bold;">porn-the .net</span>/green/669090607/1/&amp;id=1219<br /><span style="font-weight: bold;">try-adult .com</span>/lula/447057398/1/&amp;id=1219<br /><span style="font-weight: bold;">visit-adult .net</span>/jay/1021153563/1/&amp;id=1219<br /><span style="font-weight: bold;">contact-adult .net</span>/rosa/849017739/1/&amp;id=1219<br /><span style="font-weight: bold;">name-adult .net</span>/hannah/2111126283/1/&amp;id=1219<br /><span style="font-weight: bold;">about-adult .net</span>/robin/2114086747/1/&amp;id=1219<br /><span style="font-weight: bold;">scan-porn .net</span>/geraldine/921262381/1/&amp;id=1219<br /><span style="font-weight: bold;">contact-adult .net</span>/christine/1821111087/1/&amp;id=1219<br /><span style="font-weight: bold;">porn-popular .com</span>/frederica/364993202/1/&amp;id=1219<br /><span style="font-weight: bold;">about-adult .net</span>/kerste/735582753/1/&amp;id=1219<br /><span style="font-weight: bold;">porn-the .net</span>/vine/715820953/1/&amp;id=1219<br /><span style="font-weight: bold;">porn-the .net</span>/newt/1835463160/1/&amp;id=1219<br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://bp1.blogger.com/_wICHhTiQmrA/SGJ6ha5cUzI/AAAAAAAAB18/wtJ3aPXos_Q/s1600-h/zlob_codec_setup.png"><img style="margin: 0pt 10px 10px 0pt; float: left; cursor: pointer;" src="http://bp1.blogger.com/_wICHhTiQmrA/SGJ6ha5cUzI/AAAAAAAAB18/wtJ3aPXos_Q/s200/zlob_codec_setup.png" alt="" id="BLOGGER_PHOTO_ID_5215866033022980914" border="0" /></a><span style="font-weight: bold;">try-adult .com</span>/max/602914725/1/&amp;id=1219<br /><span style="font-weight: bold;">porn-pleasure .net</span>/cille/1420660046/1/&amp;id=1219<br /><span style="font-weight: bold;">poweradult .net</span>/phililpa/178057959/1/&amp;id=1219<br /><span style="font-weight: bold;">name-adult .net</span>/lise/1379126759/1/&amp;id=1219<br /><span style="font-weight: bold;">pleasure-porn .com</span>/marianne/1083617952/1/&amp;id=1219<br /><span style="font-weight: bold;">poweradult .net</span>/emile/1173468576/1/&amp;id=1219<br /><span style="font-weight: bold;">useporn .net</span>/patse/155685496/1/&amp;id=1219<br /><span style="font-weight: bold;">helpporn .net</span>/verna/625840253/1/&amp;id=1219<br /><span style="font-weight: bold;">name-adult .net</span>/aubrey/190928373/1/&amp;id=1219<br /><span style="font-weight: bold;">about-adult .</span><span style="font-weight: bold;">net</span>/alphinias/1345158043/1/&amp;id=1219<br /><span style="font-weight: bold;">useporn .net</span>/rosa/223743611/1/&amp;id=1219<br /><span style="font-weight: bold;">pleasure-porn .com</span>/nerva/1509620489/1/&amp;id=1219<br /><span style="font-weight: bold;">helpporn .net</span>/leet/1619667733/1/&amp;id=1219<br /><span style="font-weight: bold;">about-adult .net</span>/roberta/887345003/1/&amp;id=1219<br /><span style="font-weight: bold;">porn-pleasure .net</span>/tore/1032556395/1/&amp;id=1219<br /><span style="font-weight: bold;">useporn .net</span>/bo/1963737386/1/&amp;id=1219<br /><span style="font-weight: bold;">porn-look .net</span>/karon/136085893/1/&amp;id=1219<br /><span style="font-weight: bold;">poweradult .net</span>/tense/1523522750/1/&amp;id=1219<br /><span style="font-weight: bold;">poweradult .net</span>/hopp/1955964399/1/&amp;id=1219<br /><span style="font-weight: bold;">scan-porn .net</span>/vanne/350822489/1/&amp;id=1219<br /><span style="font-weight: bold;">porn-comp .com</span>/deb/1451360694/1/&amp;id=1219<br /><span style="font-weight: bold;">about-adult .net</span>/moll/1511640690/1/&amp;id=1219<br /><span style="font-weight: bold;">porn-popular .com</span>/obediah/562846948/1/&amp;id=1219<br /><span style="font-weight: bold;">helpporn .net</span>/tamarra/776122096/1/&amp;id=1219<br /><span style="font-weight: bold;">pleasure-porn .com</span>/aristotle/1046422029/1/&amp;id=1219<br /><span style="font-weight: bold;">porn-comp .com</span>/titia/158157566/1/&amp;id=1219<br /><span style="font-weight: bold;">group-adult .net</span>/gay/1297835054/1/&amp;id=1219<br /><span style="font-weight: bold;">porn-look .net</span>/katherine/2136357734/1/&amp;id=1219<br /><span style="font-weight: bold;">helpporn .net</span>/azubah/1197502147/1/&amp;id=1219<br /><span style="font-weight: bold;">porn-comp .com</span>/claes/770105101/1/&amp;id=1219<br /><br />Associated fake porn sites :<br /><br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://bp3.blogger.com/_wICHhTiQmrA/SGJ7UYzaZJI/AAAAAAAAB2E/cy7Pijctw-8/s1600-h/fake_porn_sites_ATRIVO1.JPG"><img style="margin: 0pt 10px 10px 0pt; float: left; cursor: pointer;" src="http://bp3.blogger.com/_wICHhTiQmrA/SGJ7UYzaZJI/AAAAAAAAB2E/cy7Pijctw-8/s200/fake_porn_sites_ATRIVO1.JPG" alt="" id="BLOGGER_PHOTO_ID_5215866908634145938" border="0" /></a><span style="font-weight: bold;">pornbrake .com</span> <span style="font-weight: bold;"><br />sexnitro .net</span> <span style="font-weight: bold;"><br />brakesex .net</span> <span style="font-weight: bold;"><br />pornnitro .net</span> <span style="font-weight: bold;"><br />adultbookings .com</span> <span style="font-weight: bold;"><br />qazsex .com</span><br /><span style="font-weight: bold;">lightporn .net</span> <span style="font-weight: bold;"><br />delfiporn .net</span> <span style="font-weight: bold;"><br />pornqaz .com</span> <span style="font-weight: bold;"><br />megazporn .com</span> <span style="font-weight: bold;"><br />uinsex .com</span><br /><span style="font-weight: bold;">xerosex .com</span> <span style="font-weight: bold;"><br />serviceporn .com</span> <span style="font-weight: bold;"><br />aboutadultsex .com</span> <span style="font-weight: bold;"><br />superliveporn .com</span> <span style="font-weight: bold;"><br />bestpriceporn .com</span> <span style="font-weight: bold;"><br />contactporn .net</span> <span style="font-weight: bold;"><br />relatedporn .com</span> <span style="font-weight: bold;"><br />landporno .com</span> <span style="font-weight: bold;"><br />adultsper .com</span> <span style="font-weight: bold;"><br />plus-porn .com</span> <span style="font-weight: bold;"><br />adultstarworld .com</span><br /><span style="font-weight: bold;">cutadult .com</span> <span style="font-weight: bold;"><br />moviexxxhotel .com</span> <span style="font-weight: bold;"><br />porno-go .com</span> <span style="font-weight: bold;"><br />pornxxxfilm .com</span> <span style="font-weight: bold;"><br />porn-sea .com</span> <span style="font-weight: bold;"><br />review-sex .com</span> <span style="font-weight: bold;"><br />sureadult .com</span> <span style="font-weight: bold;"><br />browseadult .com</span> <span style="font-weight: bold;"><br />network-adult .com</span> <span style="font-weight: bold;"><br />timeadult .com</span> <span style="font-weight: bold;"><br />virtual-sexy .net</span><br /><span style="font-weight: bold;">funxxxporn .com</span> <span style="font-weight: bold;"><br />loweradult .com</span> <span style="font-weight: bold;"><br />adultfilmsite .com</span> <span style="font-weight: bold;"><br />xxxallvideo .com</span> <span style="font-weight: bold;"><br />custom-sex .com</span> <span style="font-weight: bold;"><br />g</span><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://bp2.blogger.com/_wICHhTiQmrA/SGJ8FOk2RhI/AAAAAAAAB2M/scnBizNZUOA/s1600-h/fake_porn_sites_ATRIVO2.JPG"><img style="margin: 0pt 10px 10px 0pt; float: left; cursor: pointer;" src="http://bp2.blogger.com/_wICHhTiQmrA/SGJ8FOk2RhI/AAAAAAAAB2M/scnBizNZUOA/s200/fake_porn_sites_ATRIVO2.JPG" alt="" id="BLOGGER_PHOTO_ID_5215867747702294034" border="0" /></a><span style="font-weight: bold;">allerypictures .net</span> <span style="font-weight: bold;"><br />usaadultvideo .com</span><br /><span style="font-weight: bold;">adultmovieplus .com</span> <span style="font-weight: bold;"><br />porn-cruise .com</span> <span style="font-weight: bold;"><br />clubxxxvideo .com</span> <span style="font-weight: bold;"><br />mitadult .com</span> <span style="font-weight: bold;"><br />galleryalbum .net</span> <span style="font-weight: bold;"><br />xxxteenfilm .com</span> <span style="font-weight: bold;"><br />hardcorevideosite .com</span> <span style="font-weight: bold;"><br />helpadult .com</span> <span style="font-weight: bold;"><br />portaladult .net</span> <span style="font-weight: bold;"><br />service-sex .com</span> <span style="font-weight: bold;"><br />driveadult .com</span> <span style="font-weight: bold;"><br />access-porno .com</span> <span style="font-weight: bold;"><br />time-sex .com</span> <span style="font-weight: bold;"><br />plus-adult .com</span> <span style="font-weight: bold;"><br />worldadultvideo .com</span><br /><span style="font-weight: bold;">key-adult .com</span><br /><span style="font-weight: bold;">estatesex .com</span> <span style="font-weight: bold;"><br />superadultfriend .com</span><br /><span style="font-weight: bold;">superporncity .com</span> <span style="font-weight: bold;"><br />zero-porno .com</span> <span style="font-weight: bold;"><br />scanadult .com</span> <span style="font-weight: bold;"><br />adultsexpro .com</span> <span style="font-weight: bold;"><br />adultzoneworld .com</span> <span style="font-weight: bold;"><br />porntimeguide .com</span> <span style="font-weight: bold;"><br />usbestporn .com</span> <span style="font-weight: bold;"><br />adulttow .com</span> <span style="font-weight: bold;"><br />look-porn .com</span><br /><span style="font-weight: bold;">galleryclick .net</span><br /><span style="font-weight: bold;">micro-sex .com</span> <span style="font-weight: bold;"><br />estatesex .com</span> <span style="font-weight: bold;"><br />try-sex .com</span> <span style="font-weight: bold;"><br />0bucksforpornmovie .com</span> <span style="font-weight: bold;"><br />gays-video-xxx .com</span> <span style="font-weight: bold;"><br />hackthegrid .com</span> <span style="font-weight: bold;"><br />savetop .info</span> <span style="font-weight: bold;"><br />vidsplanet .net</span> <span style="font-weight: bold;"><br />freexxxhere .com</span> <span style="font-weight: bold;"><br />gestkoeporno .com</span><br /><span style="font-weight: bold;">tv-adult .info</span> <span style="font-weight: bold;"><br />gays-adult-video .com</span> <span style="font-weight: bold;"><br />matures-video .com</span> <span style="font-weight: bold;"><br />analcekc .com</span> <span style="font-weight: bold;"><br />tabletskard .in</span> <span style="font-weight: bold;"><br />molodiedevki .com</span> <span style="font-weight: bold;"><br />dom-porno .com</span> <span style="font-weight: bold;"><br />pornoaziatki .com</span> <span style="font-weight: bold;"><br />latinosvideo .com</span> <span style="font-weight: bold;"><br />geiporno .com</span> <span style="font-weight: bold;"><br />sweetfreeporn .com</span><br /><br />If exposing a huge domains portfolio of currently active redirectors has the potential to ruin someone's vacation, then consider someone's vacation ruined already.<br /><br /><span style="font-weight: bold;">Related posts:<br /></span><a href="http://ddanchev.blogspot.com/2008/06/underground-multitasking-in-action.html">Underground Multitasking in Action</a><br /><a href="http://ddanchev.blogspot.com/2008/06/fake-celebrity-video-sites-serving.html">Fake Celebrity Video Sites Serving Malware</a><br /><a href="http://ddanchev.blogspot.com/2008/06/blackhat-seo-redirects-to-malware-and.html">Blackhat SEO Redirects to Malware and Rogue Software</a><br /><a href="http://ddanchev.blogspot.com/2008/06/malicious-doorways-redirecting-to.html">Malicious Doorways Redirecting to Malware</a><br /><a href="http://ddanchev.blogspot.com/2008/03/portfolio-of-fake-video-codecs.html">A Portfolio of Fake Video Codecs</a><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=XlaQvI"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=XlaQvI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=cI4v2I"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=cI4v2I" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=U4oTAi"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=U4oTAi" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=LbooCi"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=LbooCi" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=MITw1I"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=MITw1I" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=nqHRRI"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=nqHRRI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=2sf0Xi"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=2sf0Xi" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/319853315" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 25 Jun 2008 08:16:20 +0000</pubDate>
      <category domain="http://securityratty.com/tag/net">net</category>
      <category domain="http://securityratty.com/tag/fake porn sites">fake porn sites</category>
      <category domain="http://securityratty.com/tag/malware">malware</category>
      <category domain="http://securityratty.com/tag/about-adult">about-adult</category>
      <category domain="http://securityratty.com/tag/scan-porn">scan-porn</category>
      <category domain="http://securityratty.com/tag/zlob malware variant">zlob malware variant</category>
      <category domain="http://securityratty.com/tag/name-adult">name-adult</category>
      <category domain="http://securityratty.com/tag/useporn">useporn</category>
      <category domain="http://securityratty.com/tag/porn-the">porn-the</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/319853315/fake-porn-sites-serving-malware.html">Fake Porn Sites Serving Malware</source>
    </item>
  </channel>
</rss>
