<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: gift]]></title>
    <link>http://securityratty.com/tag/gift</link>
    <description></description>
    <pubDate>Sun, 23 Mar 2008 13:31:35 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Should Banks Believe Their Customers Who Claim Online Fraud?]]></title>
      <link>http://securityratty.com/article/065fedd6ff7dcb0d99d432293ba7a6a6</link>
      <guid>http://securityratty.com/article/065fedd6ff7dcb0d99d432293ba7a6a6</guid>
      <description><![CDATA[Should banks believe their customers when they claim someone hacked their accounts and committed online fraud? Apparently in one recent case, WaMu first reversed the charges when one customer claimed...]]></description>
      <content:encoded><![CDATA[<p>Should banks believe their customers when they claim someone hacked their accounts and committed online fraud? Apparently in one recent case, WaMu first reversed the charges when one customer claimed a hacker charged up debt in her itunes account &#8212; but later, the bank took back the credit, saying the customer was just plain lying. What great customer service.</p>
<p>The Consumerist has the story:</p>
<blockquote><p>WaMu&#8217;s crack fraud department is at it again, according to reader Kristin. Someone broke into her iTunes account and bought a couple hundred dollars worth of iTunes gift cards with her debit card information. She disputed the charge and WaMu told her not to worry — they&#8217;d take care of it. Two months later, while on a trip to Chicago, WaMu reversed the credits, causing Kristin to become severely overdrawn. No amount of protesting will convince WaMu that she wasn&#8217;t lying about the iTunes break-in. Why? Because she never responded to some mail they sent to her old address.</p></blockquote>
<p>Yuck. Read the customer&#8217;s full account, and more information about the credit card fraud laws, in <a rel="nofollow" target="_blank" href="http://feeds.gawker.com/~r/consumerist/full/~3/374505870/wamu-youre-lying-about-someone-breaking-into-your-itunes-account">the full article</a>.</p>]]></content:encoded>
      <pubDate>Mon, 25 Aug 2008 16:54:41 +0000</pubDate>
      <category domain="http://securityratty.com/tag/wamu">wamu</category>
      <category domain="http://securityratty.com/tag/itunes account">itunes account</category>
      <category domain="http://securityratty.com/tag/convince wamu">convince wamu</category>
      <category domain="http://securityratty.com/tag/account">account</category>
      <category domain="http://securityratty.com/tag/online fraud">online fraud</category>
      <category domain="http://securityratty.com/tag/customers">customers</category>
      <category domain="http://securityratty.com/tag/customer service">customer service</category>
      <category domain="http://securityratty.com/tag/debit card information">debit card information</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <source url="http://feeds.feedburner.com/~r/itsecurity/~3/374897918/">Should Banks Believe Their Customers Who Claim Online Fraud?</source>
    </item>
    <item>
      <title><![CDATA[Employee fraud hits Baptist Health in Arkansas]]></title>
      <link>http://securityratty.com/article/4227f770b7017f7d953c43516b49d951</link>
      <guid>http://securityratty.com/article/4227f770b7017f7d953c43516b49d951</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
7/2/08

Organization
Baptist Health

Baptist Health is the largest not-for-profit healthcare organization in Arkansas

Contractor/Consultant/Branch
None...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/baptisthealth.jpg" width="120" align="right" height="274"><font size="2"><b>Date Reported: </b><br>7/2/08<br><br><b>Organization: </b><br><a href="http://www.baptist-health.org/">Baptist Health*</a><br><br><font size="1">*Baptist Health is the largest not-for-profit healthcare organization in Arkansas</font><br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Patients<br><br><span style="font-weight: bold;">Number Affected:</span><br>~1,800<br><br><span style="font-weight: bold;">Types of Data:</span><br>"name, address, date of birth, Social Security number, and reason for coming to Baptist Health"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"LITTLE ROCK (AP) - A North Little Rock woman has been arrested for using financial information from patients at Baptist Health to illegally obtain Wal-Mart gift cards for her own use. The hospital has notified about 1,800 patrons of the ID theft."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.wxvt.com/Global/story.asp?S=8609129&amp;nav=menu1344_2">Associated Press via WXVT Channel 15 News</a> <br><a href="http://arkansasmatters.com/content/fulltext/news/?cid=80211">KARK Channel 4 News</a> <br><a href="http://www.nwanews.com/adg/News/230290/">Arkansas Democrat-Gazette</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Toby Manthey, Arkansas Democrat-Gazette<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>Baptist Health has sent letters warning about 1,800 patients that the hospital system’s records may have been breached<br><span style="font-style: italic;">[Evan] Uh, "may have been breached"?!</span><br><br>The notification came after the arrest of a Baptist Health employee at a Wal-Mart store on 25 counts of financial identity fraud.<br><span style="font-style: italic;">[Evan] Wouldn't life be grand if we could trust our employees?&nbsp; Maybe, I suppose.</span><br><br>The letters, mailed last week, follow the firing of the woman in early June<br><br>North Little Rock police say Tamara Hill, 30, of that city worked at Baptist Health Medical Center-North Little Rock in the emergency department.<br><br>Hill, an admissions clerk, was arrested May 30 at the Wal-Mart<br><br>Ebony Flowers, 25, also of North Little Rock, was arrested at the store the same day on three counts of identity fraud<br><br>Flowers was listed in a police report as a janitor for the North Little Rock School District<br><span style="font-style: italic;">[Evan] Key word is "was".</span><br><br>Baptist Health recorded more than 950,000 patient visits systemwide in 2007, a number that includes repeat visits.<br><br>Mark Lowman, spokesman for the Little Rock-based Baptist Health system, confirmed that the system fired the employee after notification of the arrest.<br><br>Police reports say the women used a victim’s personal information to obtain temporary Wal-Mart "account authorization numbers" - credit cards, essentially - used to buy Wal-Mart gift cards.<br><br>The victim reported to police that he had not authorized the transactions<br><br>the same victim confirmed he was a Baptist Health patient<br><br>He expressed appreciation of the handling of the case by the system and by the North Little Rock police. <br><br>Among the items found during a search connected with the arrest of Hill was personal information for 24 other people, including "screen shots" - printouts showing the exact appearance of the images on a computer screen - that showed victims’ personal information.<br><span style="font-style: italic;">[Evan] This seems like confirmation that "may have been breached" is not all that accurate.</span><br><br>Also found were four Wal-Mart gift cards and $ 1,490 in cash<br><br>Police found a small bag of marijuana on Flowers, according to the reports. In a search connected with her arrest, they also discovered a. 25-caliber magazine with six bullets, as well as a receipt for four of the gift cards and information on three-identity theft victims.<br><span style="font-style: italic;">[Evan] A thug.</span><br><br>The U. S. Secret Service is helping with the investigation. <br><br>"Due to a breach of our information systems security policies, there is a possibility that some personal information, such as your name, address, date of birth, Social Security number, and reason for coming to Baptist Health, was accessed by an unauthorized person."<br><span style="font-style: italic;">[Evan] This is from the letter to the victims.</span><br><br>No information in the patient’s "medical records" and no information about the patient’s diagnosis or prognosis was accessed<br><br>while no "medical record" information was accessed, the letter mentioned the patient’s "reason for coming" to the system possibly was accessed<br><br>Lowman said a reason stated by a patient using the system isn’t considered medical information because the reason is a layman’s explanation, not one from a medical professional.<br><span style="font-style: italic;">[Evan] This is Mark Lowman, spokesman for the Little Rock-based Baptist Health system</span><br><br>He said the breach wouldn’t violate the Health Insurance Portability and Accountability Act, or HIPAA. <br><br>But Pam Dixon, executive director of the San Diego-based World Privacy Forum, a privacy advocacy group, thinks all the information mentioned in the letter falls under HIPAA.<br><br>"It doesn’t matter that [it’s not ] a prognosis or diagnosis," she said. <br><span style="font-style: italic;">[Evan] Splitting hairs.&nbsp; The bottom line is that confidential personal information was stolen and there are victims.&nbsp; Whether or not it is a HIPAA violation seems somewhat irrelevant.</span><br><br>Dixon found the system’s letter lacking in several respects, such as clarifying the exact meaning of a "reason for coming to Baptist Health." The letter also should have mentioned when and for how long the breach occurred, she said.<br><br>"Almost all breach letters have that," Dixon added.<br><span style="font-style: italic;">[Evan] Almost all breach letters have what?&nbsp; A mention about for how long the breach occurred?&nbsp; I must be reading some of the wrong breach letters because it seems to me that this information is 50/50 at best.&nbsp; Also missing is the "we have no reason to believe that the information will be misused", but this one doesn't fit does it?</span><br><br>Dixon said Baptist Health should have offered in the letter to set up free credit monitoring for victims.<br><span style="font-style: italic;">[Evan] Why?&nbsp; One year (or two) of credit monitoring is almost useless.&nbsp; Credit monitoring alerts a victim after fraud has already occurred and one year (or two) of monitoring is too limited for information that has a much longer lifespan.&nbsp; I guess credit monitoring would be better than nothing, but not by much.</span><br><br>Lowman said the health system continually conducts audits to know which staff members are accessing what information, and whether or not the access is appropriate.<br><span style="font-style: italic;">[Evan] Good!</span><br><br>"We’re always looking to provide better audits and better oversight of private, confidential and protected information," Lowman said.<br><span style="font-style: italic;">[Evan] And Good!</span><br><br><span style="font-weight: bold;">Commentary:</span><br>Preventing and detecting employee fraud has always been a challenge.&nbsp; This doesn't mean we give up though.&nbsp; We have some tools at our disposal such as employee background checks, role-based access control, segregation of duties, and job rotation to name a few.<br><br>I don't think that these two crooks are anything more than common criminals.&nbsp; The fact of the matter is that identity theft and fraud are very easy crimes to commit and require very little skill. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown<br></font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/07/10/baptisthealth.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Thu, 10 Jul 2008 20:00:20 +0000</pubDate>
      <category domain="http://securityratty.com/tag/confidential personal information">confidential personal information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/baptist health system">baptist health system</category>
      <category domain="http://securityratty.com/tag/health system">health system</category>
      <category domain="http://securityratty.com/tag/fraud">fraud</category>
      <category domain="http://securityratty.com/tag/victims personal information">victims personal information</category>
      <category domain="http://securityratty.com/tag/employee fraud">employee fraud</category>
      <category domain="http://securityratty.com/tag/baptist health">baptist health</category>
      <category domain="http://securityratty.com/tag/employee">employee</category>
      <source url="http://breachblog.com/2008/07/10/baptisthealth.aspx">Employee fraud hits Baptist Health in Arkansas</source>
    </item>
    <item>
      <title><![CDATA[New Jersey's Gift to Music]]></title>
      <link>http://securityratty.com/article/47c16bc9bb06e7ac68de07f8cff7e776</link>
      <guid>http://securityratty.com/article/47c16bc9bb06e7ac68de07f8cff7e776</guid>
      <description><![CDATA[Wow. Just wow. So the Feelies are playing together again after 18 years or so! I have really enjoyed some of the offshoots like Wake Ooloo , but I really never thought I would get to hear the real...]]></description>
      <content:encoded><![CDATA[<a style="float: left;" href="http://1raindrop.typepad.com/.a/6a00d83451c75869e200e5538ce4108834-pi"><img class="at-xid-6a00d83451c75869e200e5538ce4108834" alt="Earth86b" src="http://1raindrop.typepad.com/.a/6a00d83451c75869e200e5538ce4108834-320pi" style="margin: 0px 5px 5px 0px;" /></a>Wow. Just wow. So <a href="http://www.geocities.com/thefeeliesweb/index.htm">the Feelies</a> are playing together again after 18 years or so! I have really enjoyed some of the offshoots like <a href="http://www.geocities.com/wakeooloo/">Wake Ooloo</a>, but I really never thought I would get to hear the real Feelies again. Amazing. 

If you know them you are excited as me that they are playing in Hoboken next month. If not, then everything good that REM did in the early 80s was taken from "Crazy Rhythms", and I will put "The Good Earth" with any other record.
]]></content:encoded>
      <pubDate>Wed, 25 Jun 2008 17:41:17 +0000</pubDate>
      <category domain="http://securityratty.com/tag/feelies">feelies</category>
      <category domain="http://securityratty.com/tag/real feelies">real feelies</category>
      <category domain="http://securityratty.com/tag/crazy rhythms">crazy rhythms</category>
      <category domain="http://securityratty.com/tag/month">month</category>
      <category domain="http://securityratty.com/tag/offshoots">offshoots</category>
      <category domain="http://securityratty.com/tag/80s">80s</category>
      <category domain="http://securityratty.com/tag/earth">earth</category>
      <category domain="http://securityratty.com/tag/record">record</category>
      <category domain="http://securityratty.com/tag/ooloo">ooloo</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/06/new-jerseys-gift-to-music.html">New Jersey's Gift to Music</source>
    </item>
    <item>
      <title><![CDATA[Security Through Obscurity]]></title>
      <link>http://securityratty.com/article/267a33943412c423b8545ae3d6d4d048</link>
      <guid>http://securityratty.com/article/267a33943412c423b8545ae3d6d4d048</guid>
      <description><![CDATA[Sometimes security through obscurity works : Yes, the New York Police Department provided an escort, but during more than eight hours on Saturday, one of the great hoards of coins and currency on the...]]></description>
      <content:encoded><![CDATA[<p>Sometimes security through obscurity <a href="http://www.nytimes.com/2008/06/16/nyregion/16coins.html?_r=1&oref=slogin">works</a>:</p>

<blockquote>Yes, the New York Police Department provided an escort, but during more than eight hours on Saturday, one of the great hoards of coins and currency on the planet, worth hundreds of millions of dollars, was utterly unalarmed as it was bumped through potholes, squeezed by double-parked cars and slowed by tunnel-bound traffic during the trip to its fortresslike new vault a mile to the north.

<p>In the end, the move did not become a caper movie.</p>

<p>“The idea was to make this as inconspicuous as possible,” said Ute Wartenberg Kagan, executive director of the American Numismatic Society. “It had to resemble a totally ordinary office move.”</p>

<p>[...]</p>

<p>Society staff members were pledged to secrecy about the timing of the move, and “we didn’t tell our movers what the cargo was until the morning of,” said James McVeigh, operations manager of Time Moving and Storage Inc. of Manhattan, referring to the crew of 20 workers.</blockquote></p>

<p>From my book <a href="http://www.schneier.com/book-beyondfear.html"><i>Beyond Fear</i></a>, pp. 211-12:</p>

<blockquote>At 3,106 carats, a little under a pound and a half, the Cullinan Diamond was the largest uncut diamond ever discovered. It was extracted from the earth at the Premier Mine, near Pretoria, South Africa, in 1905. Appreciating the literal enormity of the find, the Transvaal government bought the diamond as a gift for King Edward VII. Transporting the stone to England was a huge security problem, of course, and there was much debate on how best to do it. Detectives were sent from London to guard it on its journey. News leaked that a certain steamer was carrying it, and the presence of the detectives confirmed this. But the diamond on that steamer was a fake. Only a few people knew of the real plan; they packed the Cullinan in a small box, stuck a three-shilling stamp on it, and sent it to England anonymously by unregistered parcel post.

<p>This is a favorite story of mine. Not only can we analyze the complex security system intended to transport the diamond from continent to continent­the huge number of trusted people involved, making secrecy impossible; the involved series of steps with their associated seams, giving almost any organized gang numerous opportunities to pull off a theft­but we can contrast it with the sheer beautiful simplicity of the actual transportation plan. Whoever came up with it was really thinking­and thinking originally, boldly, and audaciously.</p>

<p>This kind of counterintuitive security is common in the world of gemstones. On 47th Street in New York, in Antwerp, in London: People walk around all the time with millions of dollars’ worth of gems in their pockets. The gemstone industry has formal guidelines: If the value of the package is under a specific amount, use the U.S. Mail. If it is over that amount but under another amount, use Federal Express. The Cullinan was again transported incognito; the British Royal Navy escorted an empty box across the North Sea to Amsterdam -- ­where the diamond would be cut­ -- while famed diamond cutter Abraham Asscher actually carried it in his pocket from London via train and night ferry to Amsterdam.</blockquote></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=tQAlaI"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=tQAlaI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=9HyNPI"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=9HyNPI" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Wed, 18 Jun 2008 09:13:26 +0000</pubDate>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/diamond">diamond</category>
      <category domain="http://securityratty.com/tag/cullinan diamond">cullinan diamond</category>
      <category domain="http://securityratty.com/tag/complex security system">complex security system</category>
      <category domain="http://securityratty.com/tag/uncut diamond">uncut diamond</category>
      <category domain="http://securityratty.com/tag/move">move</category>
      <category domain="http://securityratty.com/tag/ordinary office move">ordinary office move</category>
      <category domain="http://securityratty.com/tag/cullinan">cullinan</category>
      <category domain="http://securityratty.com/tag/huge security">huge security</category>
      <source url="http://www.schneier.com/blog/archives/2008/06/security_throug_1.html">Security Through Obscurity</source>
    </item>
    <item>
      <title><![CDATA[Picture of Camera Thieves Uploaded by Eye-Fi]]></title>
      <link>http://securityratty.com/article/4060220ba0cb57ff32255f9f96098ccb</link>
      <guid>http://securityratty.com/article/4060220ba0cb57ff32255f9f96098ccb</guid>
      <description><![CDATA[This story is a bit cute, but it's true: Alison DeLauzon, Reuters reports, had her camera stolen when left an equipment bag in a restaurant in Florida. The folks who allegedly took the bag also took...]]></description>
      <content:encoded><![CDATA[<p><a href="http://www.reuters.com/article/marketsNews/idINN0534545220080605?rpc=44"><strong>This story is a bit cute, but it's true:</strong></a> Alison DeLauzon, Reuters reports, had her camera stolen when left an equipment bag in a restaurant in Florida. The folks who allegedly took the bag also took pictures of themselves, which isn't unusual. But DeLauzon had an Eye-Fi wireless Secure Digital (SD) card in her camera, received as a gift. The thieves apparently wandered by an open access point with the same SSID as one that DeLauzon had configured for use, and pictures of her baby and the thieves were uploaded to her picture-sharing account. Nifty.</p>

<p>This is reminiscent of <a href="http://db.tidbits.com/article/9608"><strong>another recent story</strong></a> in which an Apple Store employee was able to use Mac OS X 10.5 Leopard's Back to My Mac remote access software to connect to a laptop that was stolen from her apartment to grab images and screenshots of the two men alleged to have taken the laptop and other gear.</p>]]></content:encoded>
      <pubDate>Thu, 05 Jun 2008 11:09:06 +0000</pubDate>
      <category domain="http://securityratty.com/tag/thieves">thieves</category>
      <category domain="http://securityratty.com/tag/delauzon">delauzon</category>
      <category domain="http://securityratty.com/tag/camera">camera</category>
      <category domain="http://securityratty.com/tag/alison delauzon">alison delauzon</category>
      <category domain="http://securityratty.com/tag/recent story">recent story</category>
      <category domain="http://securityratty.com/tag/story">story</category>
      <category domain="http://securityratty.com/tag/apple store employee">apple store employee</category>
      <category domain="http://securityratty.com/tag/equipment bag">equipment bag</category>
      <category domain="http://securityratty.com/tag/bag">bag</category>
      <source url="http://wifinetnews.com/archives/008343.html">Picture of Camera Thieves Uploaded by Eye-Fi</source>
    </item>
    <item>
      <title><![CDATA[E-Mail After the Rapture]]></title>
      <link>http://securityratty.com/article/9d10316e7dbd54e5a64f4162a6fdb14b</link>
      <guid>http://securityratty.com/article/9d10316e7dbd54e5a64f4162a6fdb14b</guid>
      <description><![CDATA[It's easy to laugh at the You've Been Left Behind site, which purports to send automatic e-mails to your friends after the Rapture: The unsaved will be 'left behind' on earth to go through the...]]></description>
      <content:encoded><![CDATA[<p>It's easy to laugh at the <a href="http://www.youvebeenleftbehind.com/index-3.html">You've Been Left Behind</a> site, which purports to send automatic e-mails to your friends after the Rapture:</p>

<blockquote>The unsaved will be 'left behind' on earth to go through the "tribulation period" after the "Rapture".... We have made it possible for you to send them a letter of love and a plea to receive Christ one last time. You will also be able to give them some help in living out their remaining time. In the encrypted portion of your account you can give them access to your banking, brokerage, hidden valuables, and powers of attorneys' (you won't be needing them any more, and the gift will drive home the message of love). There won't be any bodies, so probate court will take 7 years to clear your assets to your next of Kin. 7 years of course is all the time that will be left. So, basically the Government of the AntiChrist gets your stuff, unless you make it available in another way.</blockquote>

<p>But what if the creator of this site isn't as scrupulous as he implies he is?  What if he uses all of that account information, passwords, safe combinations, and whatever <i>before</i> any rapture?  And even if he is an honest true believer, this seems like a mighty juicy target for any would-be identity thief.</p>

<p>And -- if you're curious -- this is how the triggering mechanism <a href="http://www.youvebeenleftbehind.com/index-2.html">works</a>:</p>

<blockquote>We have set up a system to send documents by the email, to the addresses you provide, 6 days after the "Rapture" of the Church. This occurs when 3 of our 5 team members scattered around the U.S fail to log in over a 3 day period. Another 3 days are given to fail safe any false triggering of the system.</blockquote>

<p>The site claims that the data can be encrypted, but it looks like the encryption key is stored on the server with the data.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=Vn3BeI"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=Vn3BeI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=eLGkSI"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=eLGkSI" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Mon, 02 Jun 2008 09:09:47 +0000</pubDate>
      <category domain="http://securityratty.com/tag/rapture">rapture</category>
      <category domain="http://securityratty.com/tag/site claims">site claims</category>
      <category domain="http://securityratty.com/tag/site">site</category>
      <category domain="http://securityratty.com/tag/fail safe">fail safe</category>
      <category domain="http://securityratty.com/tag/fail">fail</category>
      <category domain="http://securityratty.com/tag/time">time</category>
      <category domain="http://securityratty.com/tag/account information">account information</category>
      <category domain="http://securityratty.com/tag/account">account</category>
      <category domain="http://securityratty.com/tag/mighty juicy target">mighty juicy target</category>
      <source url="http://www.schneier.com/blog/archives/2008/06/email_after_the.html">E-Mail After the Rapture</source>
    </item>
    <item>
      <title><![CDATA[Airlines Profiting from TSA Rules]]></title>
      <link>http://securityratty.com/article/ae60844fb451506eb91e50d2c38f84f5</link>
      <guid>http://securityratty.com/article/ae60844fb451506eb91e50d2c38f84f5</guid>
      <description><![CDATA[From CNN : Before 9/11, airlines and security personnel -- and I use the term &quot;security personnel&quot; loosely -- might have let a nickname or even a maiden name on a ticket slide. No longer. If you have...]]></description>
      <content:encoded><![CDATA[<p>From <a href="http://www.cnn.com/2008/TRAVEL/traveltips/05/15/ticketing.errors/index.html">CNN</a>:</p>

<blockquote>Before 9/11, airlines and security personnel -- and I use the term "security personnel" loosely -- might have let a nickname or even a maiden name on a ticket slide. No longer. If you have the wrong name on your ticket, you're probably grounded. And there are two reasons for this: security and greed. 

<p>The Transportation Security Administration wants to be sure the same person who bought the ticket, and who was screened, is boarding the plane. But when there's an inexact match, the airline can either charge a $100 "change" fee or force you to buy a new ticket. In an industry where every dollar counts, the exact-name rule is the government's gift to cash-starved air carriers.</p>

<p>That's the situation Gordon was confronted with, even when it was obvious that "Jan" and "Janet" were one and the same. There were suggestions that a new ticket might need to be purchased. "We didn't let it get to that," he recalls. Instead, he asked to speak with a supervisor who could finally fix the codes so that the ticket and passport matched up. How did all of this happen in the first place? Turns out Jan Gordon had signed up for a frequent flier account under her informal name, so when she booked an award ticket, it also used her informal -- and inaccurate -- name.</blockquote></p>

<p>There are two things to get pissed off about here.  One, the airlines profiting off a TSA rule.  And two, a TSA rule that requires them to ignore what is obvious.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=yjuIbH"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=yjuIbH" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=U6PdQH"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=U6PdQH" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Tue, 20 May 2008 02:51:32 +0000</pubDate>
      <category domain="http://securityratty.com/tag/ticket">ticket</category>
      <category domain="http://securityratty.com/tag/award ticket">award ticket</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/transportation security administration">transportation security administration</category>
      <category domain="http://securityratty.com/tag/ticket slide">ticket slide</category>
      <category domain="http://securityratty.com/tag/security personnel">security personnel</category>
      <category domain="http://securityratty.com/tag/tsa rule">tsa rule</category>
      <category domain="http://securityratty.com/tag/airlines">airlines</category>
      <category domain="http://securityratty.com/tag/frequent flier account">frequent flier account</category>
      <source url="http://www.schneier.com/blog/archives/2008/05/airlines_profit.html">Airlines Profiting from TSA Rules</source>
    </item>
    <item>
      <title><![CDATA[Metro Round-Up: OpenAirBOston]]></title>
      <link>http://securityratty.com/article/15bfd58431cec3dd54f644fea9d2b74e</link>
      <guid>http://securityratty.com/article/15bfd58431cec3dd54f644fea9d2b74e</guid>
      <description><![CDATA[Dubiousness on future of Long Island project: Long Island network builder E-Path has lost out in Trenton, where it asked for a mere $250,000 in contracted services to build a 7.5 sq mi network; Delay...]]></description>
      <content:encoded><![CDATA[<p><img src="http://wifinetnews.com/images/muni_icon.jpg" align="right" border="0" hspace="5" /><a href="http://www.newsday.com/news/local/ny-powire0414,0,7979123.story?track=rss"><strong>Dubiousness on future of Long Island project:</strong></a> Long Island network builder E-Path has lost out in Trenton, where it asked for a mere $250,000 in contracted services to build a 7.5 sq mi network; Delay Beach, Flor., hasn't progressed, either. Trenton's business administrator states the problem clearly: "You can't expect a company to come in and expend millions of dollars on build out costs without having some level of guarantee that they're going to recover their costs." But there's more problems with E-Path in Long Island, where the utility that needs to grant pole access for two pilot projects says they gave access months ago. We'll see what shakes out. I was dubious from the start about the scale of the project with no anchor tenant, and with a firm that had no comparable projects of scale even underway. It's not a lack of confidence in E-Path (I have no opinion on their abilities); rather, the state of financing for projects of this sort.</p>

<p><a href="http://www1.pressdemocrat.com/article/20080413/NEWS/804130341/1033/NEWS&template=kart"><strong>Extremely fair article on Sebastopol Wi-Fi networking health debate:</strong></a> The local paper manages to push the camel through the eye of the needle in presenting various aspects of the vote by the local council to rescind the gift of a local ISP to provide city-wide Wi-Fi. It neither ridicules the symptoms of people who describe themselves as electrosensitive, nor ignores the clinical research that shows such sensitivity to be unprovable, even as the symptoms are clearly manifest (just not correlated with EMF). The article notes that one radio host who speaks on health has his words carried by a station that is bumping more signal out across Sebastopol than any Wi-Fi network would. In a true Sonoma moment, however, the leading opponent to the city-wide network and the owner of the ISP cross paths in front of Whole Foods where high school students in favor of the network were gather signatures for a petition--and hugged. That kind of behavior is more of what we need: civility, understanding, and mutual working forward to improve everyone's health. More research? Sure. And more kindness, too.</p>

<p><a href="http://www.wired.com/special_multimedia/2008/st_atlas_1603"><strong>Wired's Wi-Fi map: now, useful!</strong></a> My friend and colleague Cyrus Farivar spent weeks researching what municipal projects were proceeding, on hold, or dead across the U.S., and I wasn't very impressed by the way in which Wired presented this material in <a href="http://www.wired.com/images/multimedia/magazine/1603/1603_atlas.pdf"><strong>their print issue</strong></a>. But never fear! Online, paired with Google Maps, his research is tremendously accessible. It's now a few weeks out of date, but still useful for the scope and locations of projects. It makes me want to build an ongoing effort of the same kind! </p>

<p><a href="http://www.bizjournals.com/masshightech/stories/2008/04/14/newscolumn2.html?ana=from_rss"><strong>Complimentary essay on Boston's pace:</strong></a> By not building fast, OpenAirBoston avoids the mistakes of other municipal networks. True. But in the end, they need to build something; they are only "behind" in the sense of not having put their neck out too far.</p>]]></content:encoded>
      <pubDate>Mon, 14 Apr 2008 07:12:29 +0000</pubDate>
      <category domain="http://securityratty.com/tag/projects">projects</category>
      <category domain="http://securityratty.com/tag/comparable projects">comparable projects</category>
      <category domain="http://securityratty.com/tag/network">network</category>
      <category domain="http://securityratty.com/tag/municipal projects">municipal projects</category>
      <category domain="http://securityratty.com/tag/wi-fi network">wi-fi network</category>
      <category domain="http://securityratty.com/tag/island project">island project</category>
      <category domain="http://securityratty.com/tag/city-wide network">city-wide network</category>
      <category domain="http://securityratty.com/tag/true">true</category>
      <category domain="http://securityratty.com/tag/pilot projects">pilot projects</category>
      <source url="http://wifinetnews.com/archives/008273.html">Metro Round-Up: OpenAirBOston</source>
    </item>
    <item>
      <title><![CDATA[Massive IFRAME SEO Poisoning Attack Continuing]]></title>
      <link>http://securityratty.com/article/dbb7b773fec312a0398ecf8414bcf689</link>
      <guid>http://securityratty.com/article/dbb7b773fec312a0398ecf8414bcf689</guid>
      <description><![CDATA[Last week's massive IFRAME injection attack is slowly turning into a what looks like a large scale web application vulnerabilities audit of high profile sites. Following the timely news coverage ,...]]></description>
      <content:encoded><![CDATA[<a href="http://bp0.blogger.com/_wICHhTiQmrA/R-w7zl2806I/AAAAAAAABfg/BMGlryOY1kw/s1600-h/rediff_seo_iframe.jpg"><img id="BLOGGER_PHOTO_ID_5182583028718556066" style="margin: 0px 10px 10px 0px; float: left;" alt="" src="http://bp0.blogger.com/_wICHhTiQmrA/R-w7zl2806I/AAAAAAAABfg/BMGlryOY1kw/s200/rediff_seo_iframe.jpg" border="0" /></a>Last week's massive IFRAME injection attack is slowly turning into a what looks like a large scale web application vulnerabilities audit of high profile sites. Following the <a href="http://ddanchev.blogspot.com/2008/03/pr-storm-mass-iframe-injectable-attacks.html">timely news coverage</a>, Symantec's <a href="http://bp3.blogger.com/_wICHhTiQmrA/R9GX6E-0F5I/AAAAAAAABcI/SpJ-qA6Dozk/s1600-h/internet_threat_meter_SYMC.jpg">rating for the attack</a> as medium risk, StopBadware <a href="http://blogs.stopbadware.org/articles/2008/03/27/alert-xp-antivirus-2008">commenting on XP Antivirus 2008</a>, and <a href="http://www.us-cert.gov/current/index.html#search_engine_iframe_injection_attacks">US-CERT issuing a warning</a> about the incident, after another week of monitoring the campaign and the type of latest malware and sites targeted, the campaign is still up and running, poisoning what looks like over a million search queries with loadable IFRAMES, whose loading state entirely relies on the site's web application security practices - or the lack of.<br /><br />What has changed since the last time? The number and importance of the sites has increased, Google is to what looks like filtering the search results despite that the malicious parties may have successfully injected the IFRAMEs already, thus trying to undermine the campaign, new malware and fake codecs are introduced under new domain names, and a couple of newly introduced domains within the IFRAMES themselves.<br /><div><div><div><br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://bp0.blogger.com/_wICHhTiQmrA/R-xQil281DI/AAAAAAAABgo/p3xF6nBKy74/s1600-h/seo_poisoning_latest_codec.jpg"><img style="margin: 0pt 10px 10px 0pt; float: left; cursor: pointer;" src="http://bp0.blogger.com/_wICHhTiQmrA/R-xQil281DI/AAAAAAAABgo/p3xF6nBKy74/s200/seo_poisoning_latest_codec.jpg" alt="" id="BLOGGER_PHOTO_ID_5182605826404963378" border="0" /></a>Keep it Simple Stupid for the sake efficiency is what makes the campaign relatively easy to track once you understand the importance of hot leads, and real-time assessments for the purpose of setting the foundation for someone else's upcoming piece of the puzzle in an OSINT manner. The main IPs within the IFRAMES acting as redirection points to the newly introduced rogue software and malware, remain the same, and are still active. The very latest high profile sites successfully injected with IFRAMES forwarding to the rogue security software and Zlob malware variants :<br /></div><div><br /></div><a href="http://img182.imageshack.us/img182/3766/usatodayseoiframehd0.jpg">USAToday.com</a>, <a href="http://img182.imageshack.us/img182/6155/abcnewsseoiframejc9.jpg">ABCNews.com</a>, <a href="http://img182.imageshack.us/img182/8131/newsseoiframeib3.jpg">News.com</a>, <a href="http://img442.imageshack.us/img442/3487/targetseoifraameab3.jpg">Target.com</a>, <a href="http://img182.imageshack.us/img182/8086/packardbellseoiframerp5.jpg">Packard Bell.com</a>, <a href="http://img182.imageshack.us/img182/9142/walmartseoiframexi0.jpg">Walmart.com</a>, <a href="http://img185.imageshack.us/img185/3336/rediffseoiframevo6.jpg">Rediff.com</a>, <a href="http://img442.imageshack.us/img442/7408/miamiheraldseoiframend0.jpg">MiamiHerald.com</a>, <a href="http://img185.imageshack.us/img185/8121/bloomingdalesseoiframeed9.jpg">Bloomingdales.com</a>, <a href="http://img413.imageshack.us/img413/3473/patentstormseoiframeax4.jpg">PatentStorm.us</a>, <a href="http://img413.imageshack.us/img413/5581/webshotsseoiframewm0.jpg">WebShots.com</a>, <a href="http://img149.imageshack.us/img149/2375/searsseoiframezb2.jpg">Sears.com</a>, <a href="http://img149.imageshack.us/img149/3306/forbesseoiframeig6.jpg">Forbes.com</a>, Ugo.com, Bartleby.com, Linkedwords.com, Circuitcity.com, Allwords.com, Blogdigger.com, Epinions.com, Buyersindex.com, Jcpenney.com, Nakido.com, Uvm.edu, hobbes.nmsu.edu, jurist.law.pitt.edu, boisestate.edu.<br /><div><br /></div>Which are the main IPs injected as IFRAME redirection points?<br /><div><br /></div><div><a href="http://bp0.blogger.com/_wICHhTiQmrA/R-w_wl2807I/AAAAAAAABfo/1w6NHXzCPuw/s1600-h/72.232.39.252_iframe_NYC.jpg"><img id="BLOGGER_PHOTO_ID_5182587375225459634" style="margin: 0px 10px 10px 0px; float: left;" alt="" src="http://bp0.blogger.com/_wICHhTiQmrA/R-w_wl2807I/AAAAAAAABfo/1w6NHXzCPuw/s200/72.232.39.252_iframe_NYC.jpg" border="0" /></a><span style="font-weight: bold;">72.232.39.252</span><br /></div><div>NetRange: 72.232.0.0 - 72.233.127.255<br /></div><div>CIDR: 72.232.0.0/16, 72.233.0.0/17</div><div>NetName: LAYERED-TECH-<br /></div><div>NetHandle: NET-72-232-0-0-1<br /></div><div>Parent: NET-72-0-0-0-0<br />NetType: Direct Allocation</div><div>NameServer: NS1.LAYEREDTECH.COM<br /></div><div>NameServer: NS2.LAYEREDTECH.COM<br /></div><div>Comment: abuse@layeredtech.com<br /></div><div><br /></div><div><a href="http://bp0.blogger.com/_wICHhTiQmrA/R-xAjl2808I/AAAAAAAABfw/OtW66MvbuOY/s1600-h/195.225.178.21_iframe_panama.jpg"><img id="BLOGGER_PHOTO_ID_5182588251398788034" style="margin: 0px 10px 10px 0px; float: left;" alt="" src="http://bp0.blogger.com/_wICHhTiQmrA/R-xAjl2808I/AAAAAAAABfw/OtW66MvbuOY/s200/195.225.178.21_iframe_panama.jpg" border="0" /></a><span style="font-weight: bold;">195.225.178.21</span><br />route: 195.225.176.0/22<br /></div><div>descr: NETCATHOST (full block)</div><div>mnt-routes: WZNET-MNT</div><div>mnt-routes: NETCATHOST-MNT<br /></div><div>origin: AS31159<br /></div><div>notify: vs@netcathost.com<br /></div><div>remarks: Abuse contacts: abuse@netcathost.com<br /><br /></div><div><a href="http://bp0.blogger.com/_wICHhTiQmrA/R-xBJl2809I/AAAAAAAABf4/6LLgNOnsHLY/s1600-h/89.149.243.201_iframe_berlin.jpg"><img id="BLOGGER_PHOTO_ID_5182588904233817042" style="margin: 0px 10px 10px 0px; float: left;" alt="" src="http://bp0.blogger.com/_wICHhTiQmrA/R-xBJl2809I/AAAAAAAABf4/6LLgNOnsHLY/s200/89.149.243.201_iframe_berlin.jpg" border="0" /></a><span style="font-weight: bold;">89.149.243.201</span></div>inetnum: 89.149.241.0 - 89.149.244.255<div>netname: NETDIRECT-NET<br />remarks: INFRA-AW<br /></div>admin-c: WW200-RIPE<br /><div>tech-c: SR614-RIPE<br />changed: technik@netdirekt.de 20070619<br /><br /></div><div><a href="http://bp2.blogger.com/_wICHhTiQmrA/R-xCEF280-I/AAAAAAAABgA/8c00a4tptZs/s1600-h/89.149.220.85_iframe_berlin.jpg"><img id="BLOGGER_PHOTO_ID_5182589909256164322" style="margin: 0px 10px 10px 0px; float: left;" alt="" src="http://bp2.blogger.com/_wICHhTiQmrA/R-xCEF280-I/AAAAAAAABgA/8c00a4tptZs/s200/89.149.220.85_iframe_berlin.jpg" border="0" /></a><span style="font-weight: bold;">89.149.220.85</span></div>inetnum: 89.149.220.0 - 89.149.221.255<br /><div>netname: NETDIRECT-NET</div>remarks: INFRA-AW<br /><div>admin-c: WW200-RIPE</div>tech-c:  SR614-RIPE<br /><div>changed: technik@netdirekt.de 20070619</div><br /><div>Newly introduced malware serving domains upon loading the IFRAMES :<br /></div><div> </div><br /><div><span style="font-weight: bold;">mynudedirect.com/3/5144</span> (216.255.186.107) loads <span style="font-weight: bold;">mynudenetwork.com/flash2/?aff=5144</span> (85.255.120.203) which attempts to load <span style="font-weight: bold;">mynudenetwork.com/load.php?aff=5144&amp;saff=0&amp;sid=3</span> where the malware is attempting to load upon accepting the ActiveX object : </div><br /><div> </div><span style="font-weight: bold;">Scanners Result: Result</span>: 12/32 (37.5%)<br /><div>Suspicious:W32/Malware!Gemini; W32/BHO.BVW</div><span style="font-weight: bold;">File size:</span> 107536 bytes<br /><div><span style="font-weight: bold;">MD5</span>: e50f2c9874a128d4c15e72d26c78352c</div><span style="font-weight: bold;">SHA1</span>: 91f8a0e2531ea63ce22d0c7f90e7366a78ebeb8a<br /><div> </div><br /><div>Moreover <span style="font-weight: bold;">gift-vip.net/images/index1.php</span> (195.225.178.19) is still loading from the previous campaign, this time pointing to <span style="font-weight: bold;">webmovies-b.com/movie/black/0/21/411/0/</span> (58.65.234.25), and of course, <span style="font-weight: bold;">e.pepato.org/e/ads.php?b=3029</span> (58.65.238.59) :</div><br /><div> </div><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://bp0.blogger.com/_wICHhTiQmrA/R-xO8l280_I/AAAAAAAABgI/lxphF6tu7LQ/s1600-h/seo_poisoning_obfuscated.jpg"><img style="margin: 0pt 10px 10px 0pt; float: left; cursor: pointer;" src="http://bp0.blogger.com/_wICHhTiQmrA/R-xO8l280_I/AAAAAAAABgI/lxphF6tu7LQ/s200/seo_poisoning_obfuscated.jpg" alt="" id="BLOGGER_PHOTO_ID_5182604074058306546" border="0" /></a><span style="font-weight: bold;">Scanners Result:</span> 2/32 (6.25%)<br /><div>JS.Feebs.rv; JS/Feebs.gen2 @ MM</div><span style="font-weight: bold;">File size</span>: 16098 bytes <div><span style="font-weight: bold;">MD5</span>: 64bbd8ba8a0c9ce009d19f5b8c9d426e</div><span style="font-weight: bold;">SHA1</span>: 1b313198ef140d2c74f36aa84c13afe9497865b6<br /><div> </div><br /><div>We also have <span style="font-weight: bold;">vipasotka.com/in.php?adv=5032&amp;val=43c46ed2</span> (119.42.149.22) loading and redirecting to <span style="font-weight: bold;">golnanosat.com/in.php?adv=5058&amp;val=e32a412f</span> (119.42.149.22)<br /><br /></div><div><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://bp1.blogger.com/_wICHhTiQmrA/R-xQF1281BI/AAAAAAAABgY/oBhImFe4B-0/s1600-h/seo_poisoning_deobfuscated.jpg"><img style="margin: 0pt 10px 10px 0pt; float: left; cursor: pointer;" src="http://bp1.blogger.com/_wICHhTiQmrA/R-xQF1281BI/AAAAAAAABgY/oBhImFe4B-0/s200/seo_poisoning_deobfuscated.jpg" alt="" id="BLOGGER_PHOTO_ID_5182605332483724306" border="0" /></a><span style="font-weight: bold;">Scanners Result</span> : Result: 11/32 (34.38%)</div>Trojan.Crypt.AN; FraudTool.Win32.UltimateDefender.cm<br /><div><span style="font-weight: bold;">File size</span>: 61440 bytes</div><span style="font-weight: bold;">MD5</span>: 5d83515199803e1fbcd3d2d8e0cd4ce5<br /><div><span style="font-weight: bold;">SHA1</span>: 4c1f0eba4be895cf3b018e41fa7f13523424874d</div><br /><div> </div> Last but not least is <span style="font-weight: bold;">d08r.cn</span> (203.174.83.55) a new domain introduced within the IFRAMES, which is also responding to, another scammy ecosystem :<br /><div><br />07search.com<br />5m9h41.com<br />a666hosting.info<br /><div><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://bp3.blogger.com/_wICHhTiQmrA/R-xQVV281CI/AAAAAAAABgg/g2LXW8QSwiM/s1600-h/malware_redirect_seo.jpg"><img style="margin: 0pt 10px 10px 0pt; float: left; cursor: pointer;" src="http://bp3.blogger.com/_wICHhTiQmrA/R-xQVV281CI/AAAAAAAABgg/g2LXW8QSwiM/s200/malware_redirect_seo.jpg" alt="" id="BLOGGER_PHOTO_ID_5182605598771696674" border="0" /></a></div> gzoe7w.com<br />l6q7x6.com<br />nashepivo.com<br />nbb3g1.com<br />sraly.com<br />uvilo.com<br />vmksxo.com<br />credits-counselor.com<br />hx0k21.com<br />mob-shop.net<br />smart-search.net<br /><br />For the time being, Google is actively filtering the results, in fact removing the cached pages on number of domains when I last checked, the practice makes it both difficult to assess how many and which sites are actually affected, and of course, undermining the SEO poisoning, as without it the input validation and injecting the IFRAMEs would have never been able to attract traffic at the first place.<br /><br />The attack is now continuing, starting two weeks ago, the main IPs behind the IFRAMES are still active, new pieces of malware and rogue software is introduced hosting for which is still courtesy of the RBN, and we're definitely going to see many other sites with high page ranks targeted by a single massive SEO poisoning in a combination with IFRAME injections. Which site is next? Let's hope not yours, as if you don't take care of your web application vulnerabilities, someone else will.<br /><br /><span style="font-weight: bold;">Related posts:<br /></span><a href="http://ddanchev.blogspot.com/2008/03/more-high-profile-sites-iframe-injected.html">More High Profile Sites IFRAME Injected</a><br /><a href="http://ddanchev.blogspot.com/2008/03/more-cnet-sites-under-iframe-attack.html">More CNET Sites Under IFRAME Attack</a><br /><a href="http://ddanchev.blogspot.com/2008/03/zdnet-asia-and-torrentreactor-iframe-ed.html">ZDNet Asia and TorrentReactor IFRAME-ed</a><br /><a href="http://ddanchev.blogspot.com/2008/03/rogue-rbn-software-pushed-through.html">Rogue RBN Software Pushed Through Blackhat SEO</a><br /><a href="http://ddanchev.blogspot.com/2008/01/massive-realplayer-exploit-embedded.html">Massive RealPlayer Exploit Embedded Attack</a><br /><a href="http://ddanchev.blogspot.com/2007/11/another-massive-embedded-malware-attack.html">Another Massive Embedded Malware Attack</a><br /><a href="http://ddanchev.blogspot.com/2008/02/yet-another-massive-embedded-malware.html">Yet Another Massive Embedded Malware Attack</a><br /><span style="font-weight: bold;"></span><a href="http://ddanchev.blogspot.com/2008/02/massive-blackhat-seo-targeting-blogspot.html">Massive Blackhat SEO Targeting Blogspot</a><br /><a href="http://ddanchev.blogspot.com/2007/08/massive-online-games-malware-attack.html">Massive Online Games Malware Attack</a><br /></div></div></div><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=qX5mxvF"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=qX5mxvF" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=CfyCQyF"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=CfyCQyF" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=Z8Rof8f"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=Z8Rof8f" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=sv3IY1f"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=sv3IY1f" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=4ekQV7F"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=4ekQV7F" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=Ord3ZKF"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=Ord3ZKF" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=i9CGuxf"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=i9CGuxf" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/259365567" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 27 Mar 2008 18:12:29 +0000</pubDate>
      <category domain="http://securityratty.com/tag/massive">massive</category>
      <category domain="http://securityratty.com/tag/single massive seo">single massive seo</category>
      <category domain="http://securityratty.com/tag/profile sites">profile sites</category>
      <category domain="http://securityratty.com/tag/profile sites iframe">profile sites iframe</category>
      <category domain="http://securityratty.com/tag/attack">attack</category>
      <category domain="http://securityratty.com/tag/seo">seo</category>
      <category domain="http://securityratty.com/tag/malware">malware</category>
      <category domain="http://securityratty.com/tag/malware attack">malware attack</category>
      <category domain="http://securityratty.com/tag/massive blackhat seo">massive blackhat seo</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/259365567/massive-iframe-seo-poisoning-attack.html">Massive IFRAME SEO Poisoning Attack Continuing</source>
    </item>
    <item>
      <title><![CDATA[Do yourself a favor and subscribe to this blog]]></title>
      <link>http://securityratty.com/article/c282dda834952852005aecd46537b747</link>
      <guid>http://securityratty.com/article/c282dda834952852005aecd46537b747</guid>
      <description><![CDATA[Peters Blog is a must for those who want to stay informed on the baddies out there who want to destroy your comfy fuzziness while online


clipped from peterhgregory.wordpress.com

Securitas Operandi...]]></description>
      <content:encoded><![CDATA[<div > Peters Blog is a must for those who want to stay informed on the baddies out there who want to destroy your comfy fuzziness while online. </div>
<table cellpadding="0" cellspacing="0" width="100%" style="margin: 12px 0px; font-family: arial; color: #333333; background: #ffffff; border: solid 4px #e5e5e5; width: 100%; clear: left;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" class="CM_CTB_Content_Wrap" style="margin: 0px; padding: 0px;background-color: #ffffff;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" style="border-bottom: solid 1px #dcdcdc; white-space: nowrap; margin-bottom: 8px; background-color: #eeeeee ;background-image: url(http://clipmarks.com/images/source-bg.gif); background-repeat: repeat-x; height: 24px; line-height: 24px; vertical-align: middle; padding-bottom: 4px; color: #666666; font-size: 10px;">
<tr>
<td valign="top"><a href="http://clipmarks.com/clipmark/0316C2D9-72A6-4BAE-9E84-19D5829FA942/" title="go to this clipmark"><img src="http://content.clipmarks.com/blog_icon/1c38697d-a5e1-43d7-99f5-d39ad8b9b8a6/0316C2D9-72A6-4BAE-9E84-19D5829FA942/" alt="" width="19" height="19" border="0" style="vertical-align: middle; margin: 0px 4px; display: inline; border: none; float:none;" /></a>clipped from <a title="http://peterhgregory.wordpress.com/" href="http://peterhgregory.wordpress.com/" style="font-size: 11px;">peterhgregory.wordpress.com</a></td>
</tr>
</table>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://peterhgregory.wordpress.com/ -->
<div style="margin: 4px 0px; color: #000000; font-size: 20px;"><A href="http://peterhgregory.wordpress.com">Securitas Operandi™</A></div>
</td>
</tr>
</table>
<div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://peterhgregory.wordpress.com/ --><P>“Reach the widest possible worldwide audience with information on data security, business security, and information assurance. Achieve this mission through published books, magazine articles, online forums, public speaking, expert court testimony, and teaching.”</P></td>
</tr>
</table>
<div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://peterhgregory.wordpress.com/ --><P><A target="_blank" title="Opens in new window" href="http://peterhgregory.wordpress.com/2007/12/26/make-a-new-years-resolution-safe-computing/"><B>Make a New Year’s resolution: safer computing</B></A></P></td>
</tr>
</table>
<div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://peterhgregory.wordpress.com/ --><P><B><A href="http://peterhgregory.wordpress.com/2007/12/20/give-the-gift-of-safe-internet-use-this-christmas/">Give the gift of safe Internet usage</A></B></P></td>
</tr>
</table>
</td>
</tr>
</table>
<div style="margin: 0px 6px 6px 4px;">
<table style="font-size: 11px;border-spacing: 0px;padding: 0px;" cellpadding="0" cellspacing="0" width="100%">
<tr>
<td style="background:transparent;border-width:0px;padding:0px;">&nbsp;</td>
<td align="right" style="background:transparent;border-width:0px;padding:0px;width:107px" width="107"><a href="http://clipmarks.com/share/0316C2D9-72A6-4BAE-9E84-19D5829FA942/blog/" title="blog or email this clip"><img src="http://content8.clipmarks.com/images/c2b-foot.png" border="0" alt="blog it" width="107" height="17" style="border-width:0px;padding:0px;margin:0px;" /></a></td>
</tr>
</table>
</div>
</td>
</tr>
</table>
]]></content:encoded>
      <pubDate>Sun, 23 Mar 2008 13:31:35 +0000</pubDate>
      <category domain="http://securityratty.com/tag/safe internet usage">safe internet usage</category>
      <category domain="http://securityratty.com/tag/expert court testimony">expert court testimony</category>
      <category domain="http://securityratty.com/tag/information assurance">information assurance</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/online forums">online forums</category>
      <category domain="http://securityratty.com/tag/online">online</category>
      <category domain="http://securityratty.com/tag/worldwide audience">worldwide audience</category>
      <category domain="http://securityratty.com/tag/business security">business security</category>
      <category domain="http://securityratty.com/tag/securitas operandi">securitas operandi</category>
      <source url="http://spywarebiz.com/spywarebizblog/?p=406">Do yourself a favor and subscribe to this blog</source>
    </item>
  </channel>
</rss>
