<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: individual]]></title>
    <link>http://securityratty.com/tag/individual</link>
    <description></description>
    <pubDate>Thu, 07 Aug 2008 02:11:52 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[This Generations ApathyThe Age of Specialization and ADD]]></title>
      <link>http://securityratty.com/article/de3980adf7c1fb760b23b64836636412</link>
      <guid>http://securityratty.com/article/de3980adf7c1fb760b23b64836636412</guid>
      <description><![CDATA[Robert Scoble has some interesting commentary this morning about the number of photojournalists with expensive gear covering the Olympics
Hes a bit indignant that so much energy goes to sporting...]]></description>
      <content:encoded><![CDATA[<p>Robert Scoble has some interesting <a rel="nofollow" target="_blank" href="http://scobleizer.com/">commentary</a> this morning about the number of photojournalists with expensive gear covering the Olympics.</p>
<p>He&#8217;s a bit indignant that so much energy goes to sporting events like the Olympics rather than more important news that isn&#8217;t getting reported around the world.</p>
<blockquote><p>This is in a year when tons of journalists are getting laid off.</p>
<p>This is in a year when there are tons of stories around the world that aren’t getting reported on.</p>
<p>Could we take half of those photographers and send them to Russia, for instance</p></blockquote>
<p>Reminds me of a feeling I had back in college as an undergrad student studying social sciences and humanities, about the way my friends who were physicists interacted with the world. They were so awed by the stars, Mars, astrophysics, and it seemed to me interesting but altogether unimportant. They argued they may find something outside our planet that could help solve Earth-bound problems like disease, or find the origins of earth and humanity &#8212; but really they were doing it because they loved it. One of my friends had a good argument, though &#8212; there are enough people right now that we can specialize in what we care about, and there will still be others covering other topics. He could be a physicist and look into the universe&#8217;s origin, while I studied social interaction and writing, and our other friends looked into solving cancer or eradicating invasive plants in the native wetlands. We have to specialize, and there are enough of us to do it too.</p>
<p>I think it&#8217;s the same way in journalism &#8212; whether it&#8217;s sports, celebrity journalism, or coverage of politics and war, there are a lot of opportunities right now for journalists. Of course the business model is changing, and some old-schoolers won&#8217;t know how to roll with that, but generations change slowly; we&#8217;re learning.</p>
<p>Also, the Olympics is seen as more than a sporting event, it&#8217;s also a symbol of world competition and cooperation too &#8212; a way for countries to come together and share entertainment globally. I think that&#8217;s worth covering.</p>
<p>In the second post, Robert Scoble says there are plenty of great journalists but the public doesn&#8217;t care. In some ways I have to agree with that, but I don&#8217;t think it&#8217;s negative, necessarily. I had a conversation with someone the other day about world news reportage. He says, &#8220;I was just reading this story, but what does it matter to me if there&#8217;s a flood in some city in another country I&#8217;ll never visit and some farmer lost his sheep?&#8221; World news is only important when it&#8217;s relevant, so it&#8217;s no wonder that many people don&#8217;t care &#8212; if they don&#8217;t know much about the area, and it doesn&#8217;t affect them, they have no incentive to give it full attention. You can call that apathy, but I think it&#8217;s an important selectivity skill that humans have. We have to choose what to give priority to, so if nothing stands out as being particularly important, we just ignore it or gloss over it. Human nature&#8230;</p>
<p>Also I think the common person today just gets desensitized and doesn&#8217;t know where to turn their energy, when surrounded by so many crises. Either you focus on one specialty and do your best to work toward one cause in your life &#8212; and maybe that&#8217;s just in the course of your daily work &#8212; or you become a complete Attention-Deficit-Disorder case and bounce from one problem to the next, without knowing how to solve anything. That just causes a sense of bewilderment, despair, and either that bogs you down or eventually you get desensitized.</p>
<p>There&#8217;s a commenter on Scoble&#8217;s blog, Spencer, who talks about this generation&#8217;s apathy. There are so many people who want to blame today&#8217;s generation or the young generation for this &#8220;apathy&#8221; that they sense. But I see it as a survival mechanism that arises from the way information flows these days. We&#8217;re surrounded by crises, everyone wants us to know about them &#8212; the water shortage, global warming, death in Iraq, the national deficit. Okay, crisis, I get it. But no one gives a real clear idea on what any individual is really supposed to do to solve the problem. You can&#8217;t get involved with one global cause, without ignoring all the others, and if you do get involved it&#8217;s likely to become your life&#8217;s purpose. Most people are concerned with other things &#8212; their families, their work, personal development, their homes and futures, and really that&#8217;s enough to take up all their time.</p>
<p>I&#8217;m always amazed when I read about the early unionists. Emma Goldman for example, the activist who pushed for the 8-hr workday, and campaigned for free love in the early 1900s when women were still wearing corsets, used to work 16 hour factory days as a seamstress, then lead meetings late into the night. Today we lead cushy lives comparatively&#8211;8 hour days, plus commute and lunch, family time, dinner time, gym maybe, sleep&#8230; but it still doesn&#8217;t seem like we ever have enough energy and time.</p>
<p>What Emma had that most people today don&#8217;t, is a community living in the same conditions as herself, with clear goals about what they were campaigning for, and a cause that affected their own daily lives. Today, unionism and local activism is in much shorter supply, in part due to the many people who work fairly comfy desk jobs, and the problem that everyone has his own specialization, works in a cubicle, does his or her own thing. The problems we&#8217;re facing today in terms of global warming, global water shortage, aren&#8217;t the same kinds of problems that activists have fought for in the past, and there&#8217;s no clear road map for how to solve them. Our leaders sure aren&#8217;t leading the way.</p>
<p>What we do have, at least, is the Olympics, which is an age old symbol of international cooperation, play and competition&#8230;so, uh, go sports! As for full disclosure, I don&#8217;t actually have a TV and haven&#8217;t watched the Olympics in many years, but I do try taking short showers&#8211;does that help?</p>]]></content:encoded>
      <pubDate>Tue, 19 Aug 2008 09:46:26 +0000</pubDate>
      <category domain="http://securityratty.com/tag/world news reportage">world news reportage</category>
      <category domain="http://securityratty.com/tag/world">world</category>
      <category domain="http://securityratty.com/tag/world competition">world competition</category>
      <category domain="http://securityratty.com/tag/world news">world news</category>
      <category domain="http://securityratty.com/tag/global water shortage">global water shortage</category>
      <category domain="http://securityratty.com/tag/global">global</category>
      <category domain="http://securityratty.com/tag/time">time</category>
      <category domain="http://securityratty.com/tag/news">news</category>
      <category domain="http://securityratty.com/tag/solve earth-bound">solve earth-bound</category>
      <source url="http://feeds.feedburner.com/~r/itsecurity/~3/369359733/">This Generations ApathyThe Age of Specialization and ADD</source>
    </item>
    <item>
      <title><![CDATA[Corporate Identity Theft]]></title>
      <link>http://securityratty.com/article/57c21b4d57a8ae63a7ec8f43043877e8</link>
      <guid>http://securityratty.com/article/57c21b4d57a8ae63a7ec8f43043877e8</guid>
      <description><![CDATA[I remember a talk by the value investor Mason Hawkins (Longleaf Funds) where someone asked him about investing overseas. He answered that he does, but mainly in places where the British flag flew at...]]></description>
      <content:encoded><![CDATA[<p>I remember a <a href="http://www.bengrahaminvesting.ca/Resources/videos.htm#hawkins">talk</a>&#160;by the value investor&#160;<a href="http://en.wikipedia.org/wiki/Mason_Hawkins">Mason Hawkins</a>&#160;(Longleaf Funds) where someone asked him about investing overseas. He answered that he does, but mainly in places where the British flag flew at some point, where there is a rule of law. Here is one example of what he is worried about and why investing in places where your assets have no legal protection does not give the investor a margin of safety.</p><div>Hermitage Fund was until recently the largest fund in Russia. From the Business Week story<a href="http://hermitagefund.com/index.pl/news/article.html?id=895"> &quot;Hijacking the Hermitage Fund&quot;</a></div><br /><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p>Corruption, intimidation, robbery, violent assault, forgery, large-scale fraud. No, not the subject of the latest John Grisham novel, but sensational allegations, made public Apr. 4 by Hermitage Capital Management -- until recently the largest foreign portfolio investor in Russia. In a detailed and damning report, titled Criminal Justice -- Russian-Style, Hermitage alleges the fund&#39;s Russian subsidiaries have fallen victim to an elaborate con designed to defraud the fund of hundreds of millions of dollars.&#160;<br />&#160;&#160;<br />The most sensational part of Hermitage&#39;s allegations is that the attempted larceny was carried out with the direct connivance of officials in the Russian police. Hermitage alleges the police seized documents and equipment that were instrumental to the attempted fraud, which involved bogus court cases based on forged documents, the aim of which was to sue Hermitage subsidiaries for hundreds of millions of dollars. &quot;The most shocking thing is not that there are corporate raiders in Russia who attempt to steal your shares,&quot; says Jamison Firestone, managing partner of Firestone Duncan, Hermitage&#39;s law firm. &quot;The shocking thing is that the police worked hand-in-hand with them, and actually performed the theft of the documents so that the corporate raiders could then do their work.&quot;</p></blockquote><div><br /><div>From the most recent Hermitage Fund letter, here is the current state:</div><br /><br /></div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p>So the two-pronged scam worked in one area and failed in another. The perpetrators weren’t able to steal the assets from us based on the fake court claims, but they were able to steal $230 million from the Russian government by filing amended tax returns on behalf of our stolen companies. What makes this story even more shocking is that we filed six 255-page criminal complaints with the Russian authorities in December last year, one month before the tax fraud took place, and they did nothing to stop it. Two complaints were sent to the Russian General Prosecutor, two to the Russian State Investigative Committee and two to the Internal Affairs Department of the Interior Ministry. There was enough information to prevent the fraud and indict a number of people behind it if the government had acted.&#160;</p><p>Instead of doing anything to save the Russian state from this highly sophisticated and organized looting, two of our complaints were thrown out immediately; two were returned to the same Interior Ministry official we were complaining about (essentially, he was being asked to “investigate himself”); and one was thrown out for “lack of any crime committed.” Only one complaint was taken seriously. It was taken up by the Russian State Investigative Committee in early February, but before it could get any traction, the case was lowered to the South region of the Moscow district of the State Investigative Committee (the lowest level of the Committee) and by June, another senior Interior Ministry official whom we had named in our complaint had joined the “investigation” team (again, to “investigate himself”). To this day there has been no serious response by the Russian authorities to this massive fraud against the Russian state.&#160;</p><p>As we described in our April letter, the problem of corporate “raiding” is now so endemic in Russia that President Medvedev speaks about it as one of the biggest problems faced by Russian businesses. In this case, raiders have taken this problem to a new and absurd extreme by “raiding” the Russian state itself and so far getting away with it. Together with HSBC, we will shortly be filing new criminal complaints with the Russian General Prosecutor and Russian State Investigative Committee as well as with many law enforcement authorities outside of Russia. It is hard to predict what will happen next in this unfolding and unbelievable saga, but as always we will keep you updated on any further developments as they arise.</p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><br /></blockquote><p>Of course we see individual identity theft on a regular basis (actually as Ross Anderson points out its not really identity theft but poor controls on the bank&#39;s parts using SSNs as secrets and so on), but you dont see a major corporation stolen every day.</p>]]></content:encoded>
      <pubDate>Sat, 16 Aug 2008 05:58:30 +0000</pubDate>
      <category domain="http://securityratty.com/tag/russian police">russian police</category>
      <category domain="http://securityratty.com/tag/police">police</category>
      <category domain="http://securityratty.com/tag/russian">russian</category>
      <category domain="http://securityratty.com/tag/russian government">russian government</category>
      <category domain="http://securityratty.com/tag/government">government</category>
      <category domain="http://securityratty.com/tag/identity theft">identity theft</category>
      <category domain="http://securityratty.com/tag/russian-style">russian-style</category>
      <category domain="http://securityratty.com/tag/hermitage">hermitage</category>
      <category domain="http://securityratty.com/tag/fund">fund</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/08/corporate-identity-theft.html">Corporate Identity Theft</source>
    </item>
    <item>
      <title><![CDATA[Another Site Hiding Pirate Movies Behind a Zango Installer Prompt]]></title>
      <link>http://securityratty.com/article/503b43d35c6104929785ac82ff1128b5</link>
      <guid>http://securityratty.com/article/503b43d35c6104929785ac82ff1128b5</guid>
      <description><![CDATA[A few days ago, I wrote about a site asking you to install Zango before you could view the site content (which happens to be pirated movies ). Well, another site has come to light doing a similar...]]></description>
      <content:encoded><![CDATA[
        A few days ago, I wrote about a site asking you to install Zango before you could view the site content (which happens to be <a href="http://blog.spywareguide.com/2008/08/a-dark-knight-for-zango.html">pirated movies</a>). Well, another site has come to light doing a similar thing - I'm starting to wonder how many of these are actually out there. It's also served to highlight what I feel is a particularly confusing popup box, but we'll get to that later. First off, here's the website in question:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/bc0.html" onclick="window.open('http://blog.spywareguide.com/images/bc0.html','popup','width=846,height=676,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/bc0-thumb-346x276.jpg" alt="bc0.jpg" class="mt-image-none" style="" height="276" width="346" /></a></span><br /> </div><div><div align="center">Click to Enlarge<br /></div><br />Bestcinemaonline(dot)com. As you can see, the site is similar to the last one (except that site is registered <a href="http://whois.domaintools.com/movietvonline.com">anonymously</a> to an individual in China, whereas this one is registered to <a href="http://whois.domaintools.com/bestcinemaonline.com">someone in Indonesia</a>). Also, the format is different - the last site was more of a "movie repository", whereas this one takes the shape and style of a blog with each individual entry pointing to a film. And what films they are!<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="bc5.jpg" src="http://blog.spywareguide.com/images/bc5.jpg" class="mt-image-none" style="" height="228" width="309" /></span><br /></div></div><div><div align="center">Batman!<br /></div><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="bc6.jpg" src="http://blog.spywareguide.com/images/bc6.jpg" class="mt-image-none" style="" height="244" width="363" /></span><br /></div></div><div><div align="center">X-Files!<br /></div><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/bc2.html" onclick="window.open('http://blog.spywareguide.com/images/bc2.html','popup','width=672,height=649,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/bc2-thumb-372x359.jpg" alt="bc2.jpg" class="mt-image-none" style="" height="359" width="372" /></a></span><br />Click to Enlarge<br /></div><br /></div><div>Hellboy! (Is that even out yet?)<br /><br />As you might have expected, a lot of the movies end up looking like this when attempting to watch them:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/bc3.html" onclick="window.open('http://blog.spywareguide.com/images/bc3.html','popup','width=771,height=573,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/bc3-thumb-371x275.jpg" alt="bc3.jpg" class="mt-image-none" style="" height="275" width="371" /></a></span><br /></div></div><div><div align="center">Click to Enlarge<br /></div><br />.....whoops.<br /><br />I must also give a special mention to one of the most confusing popup warnings I've ever seen - it really threw me, and I admit I nearly installed Zango accidentally after seeing it. If (when prompted with the Zango installer box) you click "Cancel", this appears in the middle of your screen:<br /><br /><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="bc1.jpg" src="http://blog.spywareguide.com/images/bc1.jpg" class="mt-image-none" style="" height="126" width="476" /></span><br /></div><div><br /><i>"Click <b>OK to Cancel </b>or<b> Click "Cancel" to continue </b>the installation".</i><br /><br />.....Whaaaaaa? That's a bit of a brain bender, right there. I hope this set of writeups doesn't become a Trilogy...<br /><br /><br /></div>
        
    ]]></content:encoded>
      <pubDate>Fri, 15 Aug 2008 03:44:39 +0000</pubDate>
      <category domain="http://securityratty.com/tag/site">site</category>
      <category domain="http://securityratty.com/tag/zango">zango</category>
      <category domain="http://securityratty.com/tag/site content">site content</category>
      <category domain="http://securityratty.com/tag/zango installer box">zango installer box</category>
      <category domain="http://securityratty.com/tag/click">click</category>
      <category domain="http://securityratty.com/tag/movies">movies</category>
      <category domain="http://securityratty.com/tag/individual">individual</category>
      <category domain="http://securityratty.com/tag/cancel">cancel</category>
      <category domain="http://securityratty.com/tag/install zango">install zango</category>
      <source url="http://blog.spywareguide.com/2008/08/another-site-hiding-pirate-mov.html">Another Site Hiding Pirate Movies Behind a Zango Installer Prompt</source>
    </item>
    <item>
      <title><![CDATA[76Service - Cybercrime as a Service Going Mainstream]]></title>
      <link>http://securityratty.com/article/35bdaf104e9aecf7703834d959f39050</link>
      <guid>http://securityratty.com/article/35bdaf104e9aecf7703834d959f39050</guid>
      <description><![CDATA[Disintermediating the intermediaries in the cybercrime ecosystem, ultimately results in more profitable operations. Controversial to the concept of outsourcing, some cybercriminals are in fact so...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="text-align: center; clear: both;"></div><a href="http://3.bp.blogspot.com/_wICHhTiQmrA/SKKs5L3ihpI/AAAAAAAACBs/vEaSMC2S8nI/s1600-h/76service.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://3.bp.blogspot.com/_wICHhTiQmrA/SKKs5L3ihpI/AAAAAAAACBs/qhgjQh39ej8/s200-R/76service.JPG" style="border: 0pt none ;" /></a>Disintermediating the intermediaries in the cybercrime ecosystem, ultimately results in more profitable operations. Controversial to the concept of outsourcing, some cybercriminals are in fact so self-sufficient, that the stereotype of a mysterious 76service server offered for rent could in fact easily cease to exist in an ecosystem so vibrant that literally everyone can partion their botnet and start offering access to it on a multi-user basis. Evil? Obviously. Extending the lifecycle of a proprietary malware tool? Definitely.<br />
<br />
<a href="http://www.youtube.com/watch?v=lw9IeuKkNbc">The infamous 76service</a>, a cybercrime as a service web interface where customers basically collect the final output out of the banking malware botnet during the specific period of time for which they've purchases access to the service, is going mainstream, with 76Service's Spring Edition apparently leaking out, and cybercriminals enjoying its interoperability potential by introducing different banking trojans in their campaigns. <br />
<br />
In this post, I'll discuss the 76service's spring.edition that has been combined with a <a href="http://ddanchev.blogspot.com/2007/11/metaphisher-malware-kit-spotted-in-wild.html">Metaphisher banking malware</a>, an a popular <a href="http://ddanchev.blogspot.com/2008/04/crimeware-in-middle-zeus.html">web malware exploitation kit</a>, with two campaigns currently hosting 5.51GB of stolen banking data based on over 1 million compromised hosts 59% of which are based in Russia. Screenshots courtesy of an egocentric underground show-off.<br />
<br />
<a href="http://www.cio.com/article/print/135500">Some general info on the 76service</a> :<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="text-align: center; clear: both;"></div><a href="http://1.bp.blogspot.com/_wICHhTiQmrA/SKKyWAXgYGI/AAAAAAAACB0/JXHZFuBb6Rs/s1600-h/76service1.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://1.bp.blogspot.com/_wICHhTiQmrA/SKKyWAXgYGI/AAAAAAAACB0/2qZfVy6YfU8/s200-R/76service1.JPG" style="border: 0pt none ;" /></a>"<i>Subscribers could log in with their assigned user name and     password any time during the 30-day project. They’d be     met with a screen that told them which of their bots was     currently active, and a side bar of management options. For     example, they could pull down the latest drops—data     deposits that the Gozi-infected machines they subscribed to     sent to the servers, like the 3.3 GB one Jackson had     found. A project was like an investment portfolio. Individual     Gozi-infected machines were like stocks and subscribers bought     a group of them, betting they could gain enough personal     information from their portfolio of infected machines to make a     profit, mostly by turning around and selling credentials on the     black market. (In some cases, subscribers would use a few of     the credentials themselves). Some machines, like some stocks, would under perform and     provide little private information. But others would land the     subscriber a windfall of private data. The point was to     subscribe to several infected machines to balance that risk,     the way Wall Street fund managers invest in many stocks to     offset losses in one company with gains in another.</i>"<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="text-align: center; clear: both;"></div><a href="http://1.bp.blogspot.com/_wICHhTiQmrA/SKKy5q1ebVI/AAAAAAAACB8/uGe8GuhDvRg/s1600-h/76service2.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://1.bp.blogspot.com/_wICHhTiQmrA/SKKy5q1ebVI/AAAAAAAACB8/88IxypeBf74/s200-R/76service2.JPG" style="border: 0pt none ;" /></a>The 76service empowers everyone who is either not willing to spend time and resources for building and maintaining a botnet, launching campaigns, and SQL injecting hundreds of thousands of sites in order to take advantage of the long tail of malware infected sites that theoretically can outpace the traffic that could come from a SQL injected high-profile site.<br />
<br />
Next to the spring.edition, <a href="http://secureworks.com/research/threats/gozi/">the winter edition's price starts from $1000 and goes to $2000</a>, which is all a matter of who you're buying it from, unless of course you haven't come across leaked copies :<br />
<br />
"<i>Assuming that the dealer offering what he claimed was the 76service kit was correct, the profit is not only in the kit, but in selling value added services like exploitation, compromised servers/accounts, database configuration, and customization of the interface. Prices start between $1000 to $2000 and go up based on added services. The underground payment methods generally involve hard-to-track virtual currencies, whose central authority is in a jurisdiction where regulation is liberal to non-existent, and feature non-reversible transactions. The individual or group called "76service" was easy to track down on the Web, but not in person.</i>" <br />
<br />
<div style="text-align: left;"></div><div class="separator" style="text-align: center; clear: both;"></div><a href="http://1.bp.blogspot.com/_wICHhTiQmrA/SKLUyA7g9LI/AAAAAAAACCE/nl-OA3FHPs0/s1600-h/76service3.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://1.bp.blogspot.com/_wICHhTiQmrA/SKLUyA7g9LI/AAAAAAAACCE/8zS6gcoEdvk/s200-R/76service3.JPG" style="border: 0pt none ;" /></a>It's interesting to monitor how services aiming to provide specific malicious services are vertically integrating by expanding their portfolio of related services -- taka a spamming vendor that will offer the segmented email databases, the advanced metrics, and the localization of the spam messages to different languages -- or letting the buyer have full control of anything that comes out of a particular botnet for a specific period of time in which he has bought access to it. For instance, DDoS for hire matured into botnet for hire, which evolved into today's "What type of stolen data do you want?" for hire mentality I'm starting to see emerging, next to the usual interest in improving the metrics and thereby the probability for a more succesful campaign. <br />
<br />
<div style="text-align: left;"></div><div class="separator" style="text-align: center; clear: both;"></div><a href="http://2.bp.blogspot.com/_wICHhTiQmrA/SKLa2TO4yAI/AAAAAAAACCM/4s3Mkgb-NOY/s1600-h/metafisher1_ukstories.jpg" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://2.bp.blogspot.com/_wICHhTiQmrA/SKLa2TO4yAI/AAAAAAAACCM/Bt7wKW7IPcE/s200-R/metafisher1_ukstories.jpg" style="border: 0pt none ;" /></a>Ironically, this cybercrime model is so efficient that the people behind it cannot seem to be able to process all of the stolen data, which like a great deal of underground assets loses its value if not sold as fast as possible. The result of this oversupply of stolen data are the increasing number of services selling raw logs segmented based on a particular country for a specific period of time.<br />
<br />
Time for a remotely exploitable vulnerability in yet another malware kit about to go mainstream? Definitely, unless of course backdooring it and releasing it doesn't achieve the obvious results of controlling someone else's cybercrime ecosystem.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2007/03/underground-economys-supply-of-goods.html">The Underground Economy's Supply of Goods and Services</a><br />
<a href="http://ddanchev.blogspot.com/2007/10/dynamics-of-malware-industry.html">The Dynamics of the Malware Industry - Proprietary Malware Tools</a><br />
<a href="http://ddanchev.blogspot.com/2008/06/using-market-forces-to-disrupt-botnets.html">Using Market Forces to Disrupt Botnets</a><br />
<a href="http://ddanchev.blogspot.com/2007/10/multiple-firewalls-bypassing.html">Multiple Firewalls Bypassing Verification on Demand</a><br />
<a href="http://ddanchev.blogspot.com/2007/10/managed-spamming-appliances-future-of.html">Managed Spamming Appliances - The Future of Spam</a><br />
<a href="http://ddanchev.blogspot.com/2008/02/localizing-cybercrime-cultural.html">Localizing Cybercrime - Cultural Diversity on Demand</a><br />
<a href="http://ddanchev.blogspot.com/2008/01/e-crime-and-socioeconomic-factors.html">E-crime and Socioeconomic Factors</a><b>&nbsp;</b><br />
<a href="http://ddanchev.blogspot.com/2007/08/malware-as-web-service.html">Malware as a Web Service</a><b>&nbsp;</b><br />
<a href="http://ddanchev.blogspot.com/2008/07/coding-spyware-and-malware-for-hire.html">Coding Spyware and Malware for Hire</a><br />
<a href="http://ddanchev.blogspot.com/2008/07/are-stolen-credit-card-details-getting.html">Are Stolen Credit Card Details Getting Cheaper?</a><br />
<a href="http://ddanchev.blogspot.com/2008/07/neosploit-team-leaving-it-underground.html">Neosploit Team Leaving the IT Underground</a><br />
<a href="http://ddanchev.blogspot.com/2008/06/zeus-crimeware-kit-vulnerable-to.html">The Zeus Crimeware Kit Vulnerable to Remotely Exploitable Flaw</a><br />
<a href="http://ddanchev.blogspot.com/2008/08/pinch-vulnerable-to-remotely.html">Pinch Vulnerable to Remotely Exploitable Flaw</a><br />
<a href="http://ddanchev.blogspot.com/2008/07/dissecting-managed-spamming-service.html">Dissecting a Managed Spamming Service</a><br />
<a href="http://ddanchev.blogspot.com/2007/10/managed-spamming-appliances-future-of.html">Managed "Spamming Appliances" - The Future of Spam</a><br />
<br />
<b> </b><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=NWhwdK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=NWhwdK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=7zGnyK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=7zGnyK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=Rqgfok"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=Rqgfok" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=zA7GDk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=zA7GDk" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=4r7WMK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=4r7WMK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=880FjK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=880FjK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=3wtOmk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=3wtOmk" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/363878623" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 13 Aug 2008 04:08:43 +0000</pubDate>
      <category domain="http://securityratty.com/tag/76service">76service</category>
      <category domain="http://securityratty.com/tag/service">service</category>
      <category domain="http://securityratty.com/tag/malware">malware</category>
      <category domain="http://securityratty.com/tag/malware kit">malware kit</category>
      <category domain="http://securityratty.com/tag/cybercrime">cybercrime</category>
      <category domain="http://securityratty.com/tag/malware botnet">malware botnet</category>
      <category domain="http://securityratty.com/tag/botnet">botnet</category>
      <category domain="http://securityratty.com/tag/mysterious 76service server">mysterious 76service server</category>
      <category domain="http://securityratty.com/tag/web service">web service</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/363878623/76service-cybercrime-as-service-going.html">76Service - Cybercrime as a Service Going Mainstream</source>
    </item>
    <item>
      <title><![CDATA[Great article from getnetwise for back to school]]></title>
      <link>http://securityratty.com/article/1d1ed7cc15a59e6c75e5d1a9e7fc8d93</link>
      <guid>http://securityratty.com/article/1d1ed7cc15a59e6c75e5d1a9e7fc8d93</guid>
      <description><![CDATA[Back to school time is here kiddies! This is a great article for brushing up on the lil nasties that are out there


clipped from www.getnetwise.org
Adware and Spyware


Two of the pieces of computer...]]></description>
      <content:encoded><![CDATA[<div > Back to school time is here kiddies!<br/>This is a great article for brushing up on the lil nasties that are out there. </div>
<table cellpadding="0" cellspacing="0" width="100%" style="margin: 12px 0px; font-family: arial; color: #333333; background: #ffffff; border: solid 4px #e5e5e5; width: 100%; clear: left;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" class="CM_CTB_Content_Wrap" style="margin: 0px; padding: 0px;background-color: #ffffff;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" style="border-bottom: solid 1px #dcdcdc; white-space: nowrap; margin-bottom: 8px; background-color: #eeeeee ;background-image: url(http://clipmarks.com/images/source-bg.gif); background-repeat: repeat-x; height: 24px; line-height: 24px; vertical-align: middle; padding-bottom: 4px; color: #666666; font-size: 10px;">
<tr>
<td valign="top"><a href="http://clipmarks.com/clipmark/74E9F9DA-D42A-4582-95E0-EAE71E3BDE40/" title="go to this clipmark"><img src="http://content.clipmarks.com/blog_icon/28c5ba22-241d-410f-870b-d2de0d000e57/74E9F9DA-D42A-4582-95E0-EAE71E3BDE40/" alt="" width="19" height="19" border="0" style="vertical-align: middle; margin: 0px 4px; display: inline; border: none; float:none;" /></a>clipped from <a title="http://www.getnetwise.org/blog/2008/08/12/adware-and-spyware/" href="http://www.getnetwise.org/blog/2008/08/12/adware-and-spyware/" style="font-size: 11px;">www.getnetwise.org</a></td>
</tr>
</table>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://www.getnetwise.org/blog/2008/08/12/adware-and-spyware/ --><H2><A title="Permanent Link to Adware and Spyware" rel="bookmark" href="http://www.getnetwise.org/blog/2008/08/12/adware-and-spyware/">Adware and Spyware</A></H2></td>
</tr>
</table>
<div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://www.getnetwise.org/blog/2008/08/12/adware-and-spyware/ --><P> Two of the pieces of computer jargon that often come up in the context of safe computing are Adware and Spyware. It is important to note that these are two separate items, but often contain overlap in terms of the risk they pose to the individual.</P></td>
</tr>
</table>
</td>
</tr>
</table>
<div style="margin: 0px 6px 6px 4px;">
<table style="font-size: 11px;border-spacing: 0px;padding: 0px;" cellpadding="0" cellspacing="0" width="100%">
<tr>
<td style="background:transparent;border-width:0px;padding:0px;">&nbsp;</td>
<td align="right" style="background:transparent;border-width:0px;padding:0px;width:107px" width="107"><a href="http://clipmarks.com/share/74E9F9DA-D42A-4582-95E0-EAE71E3BDE40/blog/" title="blog or email this clip"><img src="http://content8.clipmarks.com/images/c2b-foot.png" border="0" alt="blog it" width="107" height="17" style="border-width:0px;padding:0px;margin:0px;" /></a></td>
</tr>
</table>
</div>
</td>
</tr>
</table>
]]></content:encoded>
      <pubDate>Tue, 12 Aug 2008 20:46:17 +0000</pubDate>
      <category domain="http://securityratty.com/tag/spyware">spyware</category>
      <category domain="http://securityratty.com/tag/computer jargon">computer jargon</category>
      <category domain="http://securityratty.com/tag/adware">adware</category>
      <category domain="http://securityratty.com/tag/article">article</category>
      <category domain="http://securityratty.com/tag/getnetwise">getnetwise</category>
      <category domain="http://securityratty.com/tag/lil nasties">lil nasties</category>
      <category domain="http://securityratty.com/tag/school time">school time</category>
      <category domain="http://securityratty.com/tag/kiddies">kiddies</category>
      <category domain="http://securityratty.com/tag/terms">terms</category>
      <source url="http://spywarebiz.com/spywarebizblog/?p=552">Great article from getnetwise for back to school</source>
    </item>
    <item>
      <title><![CDATA[Again, On Laptops and US Borders]]></title>
      <link>http://securityratty.com/article/2bd5c499e76fb2d415311b593b194e2f</link>
      <guid>http://securityratty.com/article/2bd5c499e76fb2d415311b593b194e2f</guid>
      <description><![CDATA[According to the U.S. Department of Homeland Security (DHS), Customs and Border Protection (CBP) officers can confiscate and detain travelers' laptops at the U.S. border without suspicion of...]]></description>
      <content:encoded><![CDATA["According to the <a href="http://www.dhs.gov/index.shtm" rel="nofollow" target="_blank">U.S. Department of Homeland Security</a> (DHS), Customs and Border Protection (CBP) officers can confiscate and detain travelers' laptops at the U.S. border <span style="font-weight: bold;">without suspicion of wrongdoing. </span>Laptops can be taken to an off-site location for an undisclosed period of time, during which officials may examine the computer's contents and share copies of files with other agencies. This policy applies to any other form of digital or analog storage device, including iPods, cell phones, flash drives, hard drives, and tapes." (<a href="http://www.smartertravel.com/blogs/today-in-travel/your-laptop-may-be-detained-at-border.html?id=2644757&amp;source=rss_today-in-travel">source</a>)<br /><br />"The key to the above paragraph, of course, is "without suspicion of wrongdoing." Indeed, in the <a href="http://www.cbp.gov/linkhandler/cgov/travel/admissability/search_authority.ctt/search_authority.pdf" target="_blank">policy</a> (PDF), DHS says (emphasis mine), "In the course of a border search, and <em>absent individualized suspicion</em>, officers can review and analyze the information transported by any individual attempting to enter, reenter, depart, pass through, or reside in the United States."" (<a href="http://www.smartertravel.com/blogs/today-in-travel/your-laptop-may-be-detained-at-border.html?id=2644757&amp;source=rss_today-in-travel">source</a>)<br /><br />Fun question that was brought by someone on a security mailing list: <span style="font-style: italic;">if your employer-owned laptop is "captured" by DHS, TSA or Customs AND it has regulated information on it (CCs, SSNs, PHUI, etc), do you have to report it as "data loss"?</span>  The chances of that info being lost are definitely much, much higher now AND the control over such data is clearly not in your hands anymore... Niiiiice.<div class="blogger-post-footer">About me: http://www.chuvakin.org</div><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=HfDTPK"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=HfDTPK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=0fuf5K"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=0fuf5K" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=RHgWqK"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=RHgWqK" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~4/363162188" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 12 Aug 2008 07:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/border protection">border protection</category>
      <category domain="http://securityratty.com/tag/laptops">laptops</category>
      <category domain="http://securityratty.com/tag/border">border</category>
      <category domain="http://securityratty.com/tag/data loss">data loss</category>
      <category domain="http://securityratty.com/tag/homeland security">homeland security</category>
      <category domain="http://securityratty.com/tag/analog storage device">analog storage device</category>
      <category domain="http://securityratty.com/tag/policy applies">policy applies</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/suspicion">suspicion</category>
      <source url="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~3/363162188/again-on-laptops-and-us-borders.html">Again, On Laptops and US Borders</source>
    </item>
    <item>
      <title><![CDATA[DMCA Does Not Apply to U.S. Government]]></title>
      <link>http://securityratty.com/article/4607cbfc396b405c40749fe3293fc5b2</link>
      <guid>http://securityratty.com/article/4607cbfc396b405c40749fe3293fc5b2</guid>
      <description><![CDATA[According to a recent court ruling , we are all subject to the provisions of the DMCA, but the government is not: he Court of Federal Claims that first heard the case threw it out, and the new...]]></description>
      <content:encoded><![CDATA[<p>According to a <a href="http://arstechnica.com/news.ars/post/20080804-air-force-cracks-software-carpet-bombs-dmca.html">recent court ruling</a>, we are all subject to the provisions of the DMCA, but the government is not:</p>

<blockquote>he Court of Federal Claims that first heard the case threw it out, and the new Appellate ruling upholds that decision. The reasoning behind the decisions focuses on the US government's sovereign immunity, which the court describes thusly: "The United States, as [a] sovereign, 'is immune from suit save as it consents to be sued . . . and the terms of its consent to be sued in any court define that court's jurisdiction to entertain the suit.'"

<p>In the case of copyright law, the US has given up much of its immunity, but the government retains a few noteworthy exceptions. The one most relevant to this case says that when a government employee is in a position to induce the use of the copyrighted material, "[the provision] does not provide a Government employee a right of action 'where he was in a position to order, influence, or induce use of the copyrighted work by the Government.'" Given that Davenport used his position as part of the relevant Air Force office to get his peers to use his software, the case fails this test.</p>

<p>But the court also addressed the DMCA claims made by Blueport, and its decision here is quite striking. "The DMCA itself contains no express waiver of sovereign immunity," the judge wrote, "Indeed, the substantive prohibitions of the DMCA refer to individual persons, not the Government." Thus, because sovereign immunity is not explicitly eliminated, and the phrasing of the statute does not mention organizations, the DMCA cannot be applied to the US government, even in cases where the more general immunity to copyright claims does not apply.</p>

<p>It appears that Congress took a "do as we say, not as we need to do" approach to strengthening digital copyrights.</blockquote></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=ocBrYK"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=ocBrYK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=zuCddK"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=zuCddK" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Fri, 08 Aug 2008 07:32:17 +0000</pubDate>
      <category domain="http://securityratty.com/tag/government">government</category>
      <category domain="http://securityratty.com/tag/dmca">dmca</category>
      <category domain="http://securityratty.com/tag/government retains">government retains</category>
      <category domain="http://securityratty.com/tag/court">court</category>
      <category domain="http://securityratty.com/tag/court define">court define</category>
      <category domain="http://securityratty.com/tag/government employee">government employee</category>
      <category domain="http://securityratty.com/tag/sovereign">sovereign</category>
      <category domain="http://securityratty.com/tag/sovereign immunity">sovereign immunity</category>
      <category domain="http://securityratty.com/tag/immunity">immunity</category>
      <source url="http://www.schneier.com/blog/archives/2008/08/dmca_does_not_a.html">DMCA Does Not Apply to U.S. Government</source>
    </item>
    <item>
      <title><![CDATA[Apptis and USNS Mercy Monitoring on the High Seas]]></title>
      <link>http://securityratty.com/article/32ab3189b54d8e46b467ebbf87db32e0</link>
      <guid>http://securityratty.com/article/32ab3189b54d8e46b467ebbf87db32e0</guid>
      <description><![CDATA[Meet Mike Lawson, Pre-Sales Engineer at Apptis, a leading system integrator and ScienceLogic partner that has deployed EM7 to meet the network, systems and application management needs of several...]]></description>
      <content:encoded><![CDATA[<p><img style="border-right: 0px; border-top: 0px; margin: 0px 10px 10px 0px; border-left: 0px; border-bottom: 0px" height="244" alt="mike2 (Small)" src="http://blog.sciencelogic.com/wp-content/uploads/2008/08/mike2-small.jpg" width="204" align="left" border="0"> Meet Mike Lawson, Pre-Sales Engineer at Apptis, a leading system integrator and ScienceLogic partner that has deployed EM7 to meet the network, systems and application management needs of several customers. We thought Mike would have an interesting perspective to share on EM7, having recently come from the “customer side” and already with a few deployments under his belt.
<p><b>ScienceLogic: Mike, what’s your background working with network and management system tools?</b>
<p><b>Mike Lawson: </b>Before joining Apptis, I worked for the Air Force, mainly in satellite communications for almost nine years. I’m probably most familiar with HP OpenView and BMC Remedy. I managed a team that used them but wasn’t involved in tool selection; like many other federal IT workers, we didn’t have a choice of tools because there were existing enterprise licenses and maintenance contracts.
<p>I also saw a large systems integrator do a full Remedy/Crystal Systems/OpenView installation. It took 6 weeks to stand up and customize to meet just the basic monitoring requirements, and it cost something like half a million dollars. At the time, I thought that wasn’t bad and was a pretty typical experience.
<p><b>ScienceLogic: Coming from where you did, what’s your take on EM7?</b>
<p><strong>Mike Lawson:</strong> Honestly, I didn’t believe that EM7 could really do all that it claimed. In many ways, it was the complete opposite of what I had seen first-hand with other monitoring solutions. Could it really cover that much functionality? At relatively much lower cost to the customer and without the licensing nightmare?
<p>That quickly changed when I needed to understand the system enough to run it at a customer’s site. I went back over the training docs I received during my initial training class and jumped in; now, 6 months later, I’m the EM7 expert and can tell you that it delivers on all those promises. (But I still need to show people to get them to believe it too)
<p>I preach the “EM7 gospel” and when anyone wants to talk monitoring, I ask about the universal pain points: cost, maintenance contracts and licensing, and then I explain EM7. The cost difference is real; the solution is based on capacity, so there’s no licensing and it’s easy to use. They are shocked to learn that they can buy multiple EM7 appliances and years of maintenance for what they paid for most other tools.
<p><b>ScienceLogic: Apptis won the contract for monitoring aboard the USNS Mercy. We love that you’re using EM7 for one of the Navy’s hospital ships. Can you tell us more?</b>
<p><strong>Mike Lawson:</strong> The USNS Mercy is a Military Sealift Command hospital ship. <a href="http://www.navy.mil/navydata/fact_display.asp?cid=4400&amp;tid=400&amp;ct=4" target="_blank">Some stats</a>:
<ul>
<li>849 feet long (nearly the size of a football field)
<li>12 fully-equipped operating rooms, a 1,000 bed hospital facility, digital radiological services, a diagnostic and clinical laboratory, a pharmacy, an optometry lab, a CAT scan and two oxygen producing plants
<li>Crew: 61 civilian mariners, 956 Naval medical staff, and 259 Naval support staff</li>
</ul>
<p>The USNS recently departed on a five-month humanitarian mission in the Western Pacific and Southeast Asia in support of Pacific Partnership 2008. The partnership provides international medical, dental and engineering teams this summer to provide humanitarian support and conduct joint, combined, and cooperative Civil-Military Operations in order to improve regional stability and build partner capacity to respond to natural disasters and pandemic.
<p>For the most part, the ship’s network is self-contained, but can also use a landline when docked. The network covers 400 devices, including Windows/Exchange servers and VMware for server virtualization. Prior to using EM7, none of the monitoring was integrated; each system was independently monitored through individual vendor-specific consoles.
<p>Out of the box, EM7 provided integrated systems, application and network management for all network gear, applications and virtual machines in one solution. We didn’t have to do a lot of customization – EM7 includes best-practice based thresholds, event and monitoring templates and this covered what USNS Mercy needed to monitor.
<p><b>ScienceLogic: You’re a systems integrator with a very useful “customer point of view” when it comes to looking at tools. From that perspective, can you share what you think are the biggest benefits that EM7 provides?</b>
<p><strong>Mike Lawson:</strong> First of all, EM7 stands up right away. We’re talking days, not weeks. In contrast to the lengthy installation of OpenView and Remedy I witnessed during my military career, I was able to configure, customize, and implement the EM7 solution for the USNS Mercy in three days.
<p>Second, it’s easy to train people on and the support is outstanding. This judgment is from first-hand experience. Right before the USNS Mercy departed on its latest voyage, the system administrator I had trained on EM7 left, so I had all of a day to train some new EM7 admins. I prepared a seven-page “cheat sheet” and over a 3-hour conference call, we walked through the entire EM7 solution; I haven’t gotten a support call since.
<p>And when a problem did crop up with a device being discovered incorrectly, ScienceLogic was very responsive. We contacted ScienceLogic support on a Saturday and they created and emailed us a video to help troubleshoot the same day. Within 30 seconds of watching the video, the problem was resolved.
<p>Finally, EM7 helps us be good stewards of the government’s money. This is very important to me personally and to Apptis as a company. Because EM7 is cheaper and deploys so quickly and easily, you might think that it’s just the opposite of what a system integrator would want to use. But that’s short-term thinking. We believe in deliver the most value for customers every time. It’s what creates trust and long-term relationships with our customers. Instead of that half million spent on standing up the solution and basic setup, I’d much rather (and I know the customer would rather) spend that on fine-tuning or extending the solution to do much, much more.
<p>As a former government employee, I know what it’s like to use a tool that doesn’t fit my needs. EM7 proves that the best solution can totally break the old model of costly, lengthy installations. EM7 has the right model: the right solution and the right price delivered as an appliance that is easy to deploy, train on and use. </p>
<p><a href="http://sharethis.com/item?&wp=abc&amp;publisher=ea11358c-69de-4e80-9804-e964a8930b70&amp;title=Apptis+and+USNS+Mercy+%26ndash%3B+Monitoring+on+the+High+Seas&amp;url=http%3A%2F%2Fblog.sciencelogic.com%2Fapptis-and-usns-mercy-monitoring-on-the-high-seas%2F08%2F2008">ShareThis</a></p>]]></content:encoded>
      <pubDate>Thu, 07 Aug 2008 11:59:40 +0000</pubDate>
      <category domain="http://securityratty.com/tag/solution">solution</category>
      <category domain="http://securityratty.com/tag/entire em7 solution">entire em7 solution</category>
      <category domain="http://securityratty.com/tag/em7">em7</category>
      <category domain="http://securityratty.com/tag/em7 gospel">em7 gospel</category>
      <category domain="http://securityratty.com/tag/em7 proves">em7 proves</category>
      <category domain="http://securityratty.com/tag/em7 admins">em7 admins</category>
      <category domain="http://securityratty.com/tag/multiple em7 appliances">multiple em7 appliances</category>
      <category domain="http://securityratty.com/tag/em7 solution">em7 solution</category>
      <category domain="http://securityratty.com/tag/explain em7">explain em7</category>
      <source url="http://blog.sciencelogic.com/apptis-and-usns-mercy-monitoring-on-the-high-seas/08/2008">Apptis and USNS Mercy Monitoring on the High Seas</source>
    </item>
    <item>
      <title><![CDATA[Object Refinement in CEP: Tracking Temperatures]]></title>
      <link>http://securityratty.com/article/4f0c3a73b377ca62b6ad376fd4626741</link>
      <guid>http://securityratty.com/article/4f0c3a73b377ca62b6ad376fd4626741</guid>
      <description><![CDATA[Our colleagues at Apama sharean interestinguse case, tracking the bodytemperature of someone walking in their recent press release
This use case is aclear example of a subfunction of complex event...]]></description>
      <content:encoded><![CDATA[<p>Our colleagues at <a href="http://www.progress.com/apama" target="_blank">Apama</a> share an interesting use case, <a href="http://newsroom.progress.com/phoenix.zhtml?c=86919&amp;p=NewsArticle&amp;id=1183176" target="_blank">tracking the body temperature of someone walking</a> in their recent press release.</p>
<p>This use case is a clear example of a subfunction of complex event processing, folks in the mult-sensor data fusion field (and <a href="http://www.thecepblog.com/what-is-complex-event-processing/" target="_blank">here</a> at The CEP Blog) refer to as <a href="http://www.thecepblog.com/2007/05/14/what-is-complex-event-processing-part-3/" target="_blank">event (object) refinement</a>, sometimes called &#8220;track and trace.&#8221;</p>
<p>The reason we call this processing function &#8220;event (object) refinement&#8221; is that, in the way the use case was described in the press release, the medical staff are basically tracking body temperature and comparing it to a key indicator to generate an alarm, in this case &#8220;body temperature too high.&#8221;   This is a simple event, not complex, because the level of inference is quite very low in an overall knowledge hierarchy.</p>
<p>For example, we cannot infer from the alarm that &#8220;body temperature too high&#8221; is caused by a previous medical condition.  There is no causality at this stage of the game.   We cannot infer from the alarm that the walker has embarked up a steep hill, and the body temperature is expected to exceed a key indicator for a period of time.</p>
<p>Looking at another complex event model,  the system does not (yet) combine all of the body temperatures of the entire group of walkers, correlated by the situation of an approaching thunderstorm, and infer that the walkers have increased their pace because they don&#8217;t want to be caught in a driving rainstorm with high winds.</p>
<p>In other words, tracking a single object like &#8220;body temperature&#8221; is a basic-step in a CEP application, but not really a CEP application yet, because to really be a complex event, there should be some inference of higher knowledge, or estimated situation.    For example, tracking and tracing the position of an aircraft is good data, but being able to infer the complex situation &#8220;potential mid-air crash&#8221; between two airplanes is better (defining a complex event vs simply tracking state changes).</p>
<p>Steam processing engines are well suited for track and trace processing of individual event objects, like a walker&#8217;s body temperature, or a similar temperature monitoring application from a network device, as demonstrated by the Apama use case.  Tracking events such as &#8220;temperature in an object reaches critical threshold&#8221; have been going on for decades, in your network, in your car,  in your washing machine, in as spacecraft, just about everywhere we sense-and-respond to temperature changes.</p>
<p>The real marvel of this application was not the event processing on the back end, but in the sensor network, comprised of the human body, an RFID sensor, and a transmission network to a centeralized data collection facility.</p>
]]></content:encoded>
      <pubDate>Thu, 07 Aug 2008 09:39:29 +0000</pubDate>
      <category domain="http://securityratty.com/tag/complex">complex</category>
      <category domain="http://securityratty.com/tag/complex event model">complex event model</category>
      <category domain="http://securityratty.com/tag/event">event</category>
      <category domain="http://securityratty.com/tag/walkers body temperature">walkers body temperature</category>
      <category domain="http://securityratty.com/tag/body temperature">body temperature</category>
      <category domain="http://securityratty.com/tag/complex event">complex event</category>
      <category domain="http://securityratty.com/tag/temperature">temperature</category>
      <category domain="http://securityratty.com/tag/simple event">simple event</category>
      <category domain="http://securityratty.com/tag/object">object</category>
      <source url="http://www.thecepblog.com/2008/08/07/object-refinement-in-cep-tracking-temperatures/">Object Refinement in CEP: Tracking Temperatures</source>
    </item>
    <item>
      <title><![CDATA[UK Electronic Passport Cloned]]></title>
      <link>http://securityratty.com/article/6a81d22ed8789bb1273fb4d5796cb199</link>
      <guid>http://securityratty.com/article/6a81d22ed8789bb1273fb4d5796cb199</guid>
      <description><![CDATA[The headline says it all: &quot;Fakeproof e-passport is cloned in minutes
Does this surprise anyone? This is what I wrote about electronic passports two years ago in The Washington Post : The other...]]></description>
      <content:encoded><![CDATA[<p>The <a href="http://www.timesonline.co.uk/tol/news/uk/crime/article4467106.ece">headline</a> says it all: "‘Fakeproof’ e-passport is cloned in minutes."</p>

<p>Does this surprise anyone?  <a href="http://www.washingtonpost.com/wp-dyn/content/article/2006/09/15/AR2006091500923.html">This</a> is what I wrote about electronic passports two years ago in <i>The Washington Post</i>:</p>

<blockquote>The other security mechanisms are also vulnerable, and several security researchers have already discovered flaws. One found that he could identify individual chips via unique characteristics of the radio transmissions. Another successfully cloned a chip. The State Department called this a "meaningless stunt," pointing out that the researcher could not read or change the data. But the researcher spent only two weeks trying; the security of your passport has to be strong enough to last 10 years.

<p>This is perhaps the greatest risk. The security mechanisms on your passport chip have to last the lifetime of your passport. It is as ridiculous to think that passport security will remain secure for that long as it would be to think that you won't see another security update for Microsoft Windows in that time. Improvements in antenna technology will certainly increase the distance at which they can be read and might even allow unauthorized readers to penetrate the shielding.</blockquote></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=WxEtPK"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=WxEtPK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=LKjanK"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=LKjanK" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Thu, 07 Aug 2008 02:11:52 +0000</pubDate>
      <category domain="http://securityratty.com/tag/passport">passport</category>
      <category domain="http://securityratty.com/tag/passport chip">passport chip</category>
      <category domain="http://securityratty.com/tag/fakeproof e-passport">fakeproof e-passport</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/passport security">passport security</category>
      <category domain="http://securityratty.com/tag/security researchers">security researchers</category>
      <category domain="http://securityratty.com/tag/security mechanisms">security mechanisms</category>
      <category domain="http://securityratty.com/tag/chip">chip</category>
      <category domain="http://securityratty.com/tag/antenna technology">antenna technology</category>
      <source url="http://www.schneier.com/blog/archives/2008/08/uk_electronic_p.html">UK Electronic Passport Cloned</source>
    </item>
  </channel>
</rss>
