<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: interestingly]]></title>
    <link>http://securityratty.com/tag/interestingly</link>
    <description></description>
    <pubDate>Tue, 05 Aug 2008 12:52:53 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[From the Executive Women's Forum on Information Security]]></title>
      <link>http://securityratty.com/article/f2976566aba2a7d7042931766a835f14</link>
      <guid>http://securityratty.com/article/f2976566aba2a7d7042931766a835f14</guid>
      <description><![CDATA[The theme of the 2008 Executive Women's Forum on Information Security, Risk Management &amp; Privacy is &quot;risk convergence is inevitable.&quot; The risks associated with information security, privacy, physical...]]></description>
      <content:encoded><![CDATA[The theme of the 2008 Executive Women's Forum on Information Security, Risk Management & Privacy is "risk convergence is inevitable." The risks associated with information security, privacy, physical security and so forth are converging such that an integrated management approach is required from within the firm. <br />
<br />
Interestingly enough, business continuity management was not a key risk area mentioned by all panelists of the session titled "Convergence: The Good, The Bad & The Ugly." There were two pieces of strategic program management advice from the panelists. The first point is that you have to partner with all of your lines of business and corporate support areas. Since risk is related to the delivery of the business, no one department can address all of the issues. And, you might find that there are good practices already in place within your firm, so that you are not reinventing the wheel - leverage the good stuff throughout the firm. The second point is to focus on the budget issue - how many risk-related activities are already in place in your organization that could be combined, and possibly duplicated, so that more work gets done with less money spent? Pooling of already limited budgets can go a long way toward developing a program that is more mature, delivers more benefit to the organization and eliminates a lot of duplicative work. <br />
<br />
But all of this convergence comes at a price - mainly in fear, uncertainty and doubt of the workforce. Some feel that they will lose authority (especially in siloed risk approaches); others might lose their jobs as a result of the convergence. This human aspect was mentioned as the key challenge of an integrated approach. Therefore, communicating not only up within the firm but down to the workforce is critical to achieving a well-run and integrated program. <br />
<br />
And finally, for those areas that just don't want to "play the game," use your internal audit department as the "stick" that can get them to act. When I was an IT risk manager, I always said that I was management's best friend - let me tell you the gaps in your risk program rather than having them come from the audit department, which then become part of the records of the firm.]]></content:encoded>
      <pubDate>Thu, 18 Sep 2008 15:29:34 +0000</pubDate>
      <category domain="http://securityratty.com/tag/risk">risk</category>
      <category domain="http://securityratty.com/tag/risk approaches">risk approaches</category>
      <category domain="http://securityratty.com/tag/risk program">risk program</category>
      <category domain="http://securityratty.com/tag/risk management">risk management</category>
      <category domain="http://securityratty.com/tag/management">management</category>
      <category domain="http://securityratty.com/tag/management approach">management approach</category>
      <category domain="http://securityratty.com/tag/key risk">key risk</category>
      <category domain="http://securityratty.com/tag/audit department">audit department</category>
      <category domain="http://securityratty.com/tag/internal audit department">internal audit department</category>
      <source url="http://blog.gartner.com/blog/security.php?x=0&amp;itemid=3879">From the Executive Women's Forum on Information Security</source>
    </item>
    <item>
      <title><![CDATA[Spam Campaign Abusing Yahoo's Services]]></title>
      <link>http://securityratty.com/article/c2626f449f476aba6a0e3171d77be643</link>
      <guid>http://securityratty.com/article/c2626f449f476aba6a0e3171d77be643</guid>
      <description><![CDATA[Think spammers.Yahoo.com trusts Yahoo.com, consequently, a spam campaign that using bogus Yahoo.com email accounts, and spamming only Yahoo users with links to Yahoo's search engine using queries...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://1.bp.blogspot.com/_wICHhTiQmrA/SNEJZU3UKFI/AAAAAAAACKk/nL7rnM4boe0/s1600-h/captcha_outsource_bogus_accounts_yahoo1.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://1.bp.blogspot.com/_wICHhTiQmrA/SNEJZU3UKFI/AAAAAAAACKk/G05GItHoyBs/s200-R/captcha_outsource_bogus_accounts_yahoo1.JPG" /></a>Think spammers.Yahoo.com trusts Yahoo.com, consequently, a spam campaign that using bogus Yahoo.com email accounts, and spamming only Yahoo users with links to Yahoo's search engine using queries leading to the exact spammer's URLs, is almost 100% sure to make it through spam filters. That seems to be case with this spam campaign perfectly fitting into the "spam that made it through" category.<br />
<br />
<b>Sample search queries resulting in a single result with the spammer's URL :</b><br />
- yahoo.com/////////////////////////////search/search;_ylt=?p=())))))))))))))callfold(((((((((((((((()))))))))))((((()))))))5000)))))))))))(((((((<br />
- search.yahoo.com/search?p=(((((())))))))((((((((((((((housetear((((())))))(((((((())))))))(((((((((5000((((((())))))))))))))))))))<br />
- yahoo.com/search/search;_ylt=?p=]]]]]]]]]]]][[[[[[galestay[[]]]]]]][[[[[[[[[[[[[[[[[[[[$229[[[[[[[[[[[[[[[[[[[]]]]<br />
- yahoo.com/search/search;_ylt=?p=(((((())))))))))galestay((((((()((((((((((((((((($229)))))))))))(((()<br />
- yahoo.com/////////////////////////////search/search;_ylt=?p=))))))))))))))(((((richorbit((((((((((((((())))))))))))((((((())))))$229)))))))))))(((((((<br />
- yahoo.com/////////////////////////////search/search;_ylt=?p=))))))(((())))))))))richorbit((((((((((((())))))))((((((((((((((((((((((((((((($229))))))((((())<br />
<br />
<a href="http://1.bp.blogspot.com/_wICHhTiQmrA/SNEMVvsjNOI/AAAAAAAACKw/8DNIdG5HwUw/s1600-h/captcha_outsource_bogus_accounts_yahoo2.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://1.bp.blogspot.com/_wICHhTiQmrA/SNEMVvsjNOI/AAAAAAAACKw/L0wwRor-SUQ/s200-R/captcha_outsource_bogus_accounts_yahoo2.JPG" /></a><br />
The search queries lead to<b> galestay.com; housetear.com; callfold.com; richorbit.com</b> with several hundred spam domains participating in the campaign parked at <b>218.61.7.21</b> and <b>220.248.185.64</b>.<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://2.bp.blogspot.com/_wICHhTiQmrA/SNEOBcMV7WI/AAAAAAAACK4/Agv8JwvW6WY/s1600-h/king_replicas_spam.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="160" src="http://2.bp.blogspot.com/_wICHhTiQmrA/SNEOBcMV7WI/AAAAAAAACK4/OmHHnCUAIHc/s200-R/king_replicas_spam.png" width="200" /></a>With CAPTCHA solving and automatic account registration getting easier to outsource next to the easily obtainable <a href="http://ddanchev.blogspot.com/2008/05/segmenting-and-localizing-spam.html">segmented email databases of a particular ISP or web based email service provider</a>, launching such a campaign requires less efforts than it used to before. Interestingly, the spammed through Yahoo emails never leave Yahoo Mail since it's only spamming Yahoo users according to the extensive number of emails CC-ed.<br />
<br />
What's to come in the long-term? With an entire spamming infrastructure build on the foundation of the hundreds of thousands of bogus accounts at legitimate services, spammers are already starting to embrace the "legitimate sender" mentality and<b> </b>are working on ways to integrate that infrastructure in their spam systems, evidence of which can be seen in several <a href="http://blogs.zdnet.com/security/?p=1899">different managed spamming services</a>.<br />
<br />
<b>Related posts:</b><br />
<a href="http://blogs.zdnet.com/security/?p=1232">Microsoft’s CAPTCHA successfully broken</a><br />
<a href="http://blogs.zdnet.com/security/?p=1418">Gmail, Yahoo and Hotmail’s CAPTCHA broken by spammers</a><br />
<a href="http://blogs.zdnet.com/security/?p=1514">Spam coming from free email providers increasing</a><br />
<a href="http://blogs.zdnet.com/security/?p=1835">Inside India’s CAPTCHA solving economy</a><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=tyomL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=tyomL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=RprrL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=RprrL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=LDOil"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=LDOil" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=cIk3l"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=cIk3l" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=xSFKL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=xSFKL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=5sTAL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=5sTAL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=IVbIl"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=IVbIl" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/395238291" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 17 Sep 2008 05:25:24 +0000</pubDate>
      <category domain="http://securityratty.com/tag/spam">spam</category>
      <category domain="http://securityratty.com/tag/yahoo">yahoo</category>
      <category domain="http://securityratty.com/tag/spam campaign perfectly">spam campaign perfectly</category>
      <category domain="http://securityratty.com/tag/spam campaign">spam campaign</category>
      <category domain="http://securityratty.com/tag/yahoo users">yahoo users</category>
      <category domain="http://securityratty.com/tag/spam systems">spam systems</category>
      <category domain="http://securityratty.com/tag/spam domains">spam domains</category>
      <category domain="http://securityratty.com/tag/yahoo emails">yahoo emails</category>
      <category domain="http://securityratty.com/tag/campaign">campaign</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/395238291/spam-campaign-abusing-yahoos-services.html">Spam Campaign Abusing Yahoo's Services</source>
    </item>
    <item>
      <title><![CDATA[NFL Players and Senseless Violence]]></title>
      <link>http://securityratty.com/article/9ba2dec13c340b4da207249c75e0576b</link>
      <guid>http://securityratty.com/article/9ba2dec13c340b4da207249c75e0576b</guid>
      <description><![CDATA[Scott Brown writes about the dangers that well known NFL players face on a regular basis. For some, it has even led to their untimely deaths

Interestingly, many players seem reluctant to hire...]]></description>
      <content:encoded><![CDATA[<a href="http://www.pittsburghlive.com/x/pittsburghtrib/sports/steelers/s_588150.html">Scott Brown writes </a>about the dangers that well known NFL players face on a regular basis.  For some, it has even led to their untimely deaths. <br /><span id="fullpost"><br />Interestingly, many players seem reluctant to hire professional security agents.  There is a fear that it will make them seem "self important" and may arouse "indignation".  Is it just me or does this strike anybody else as a stupid reason to forego concerns and plans to safeguard one's own personal safety?    <br /></span><br />Does anybody think any less of a country's President because he/she is flanked by highly trained personal protection specialists?  Of course not. Why? Because history has proven to us that there are disturbed individuals in society who would kill a well known person/celebrity just for their 15 minutes of fame.<br /><br />Why then should an NFL player not be entitled to have a security person(s) looking out for them?  I am fairly sure that the family of Sean Taylor wishes that he had employed personal security and that they had confronted those criminals who broke into his house rather than Mr. Taylor.  <br /><br />There is no shame in taking precautions.  Ask any security consultant for their opinion on whether a person is better off saying; "I wished I had..." or saying;  "I am going to, just in case".  <br /><br />Consider of all of the wonderful music John Lennon could have produced these past years had he employed a Personal Protection Agent to watch his back and protect him from the lunatics of this world.  Artists like Lennon and world class athletes need to be protected so that they can continue to entertain us and thrill us with the gifts that they have been given.  They deserve our support, not our indignation.<div class="blogger-post-footer">Visit Sexton Executive Security at www.sextonsecurity.com</div>]]></content:encoded>
      <pubDate>Tue, 16 Sep 2008 18:58:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/players">players</category>
      <category domain="http://securityratty.com/tag/nfl players">nfl players</category>
      <category domain="http://securityratty.com/tag/world class athletes">world class athletes</category>
      <category domain="http://securityratty.com/tag/taylor">taylor</category>
      <category domain="http://securityratty.com/tag/world">world</category>
      <category domain="http://securityratty.com/tag/sean taylor wishes">sean taylor wishes</category>
      <category domain="http://securityratty.com/tag/personal protection specialists">personal protection specialists</category>
      <category domain="http://securityratty.com/tag/scott brown writes">scott brown writes</category>
      <category domain="http://securityratty.com/tag/person">person</category>
      <source url="http://www.thebulletproofblog.com/2008/09/nfl-players-and-senseless-violence.html">NFL Players and Senseless Violence</source>
    </item>
    <item>
      <title><![CDATA[VMWare is Better Than Microsoft]]></title>
      <link>http://securityratty.com/article/a030161b183f83f292761020fb04b7d9</link>
      <guid>http://securityratty.com/article/a030161b183f83f292761020fb04b7d9</guid>
      <description><![CDATA[After barely surviving the VMworld registration process, my first session was From Hypervisors to VMware Infrastructure What Matters? or as I would have called it why VMware is so much better than...]]></description>
      <content:encoded><![CDATA[<p>After barely surviving the <a href="http://www.vmworld.com/conferences/2008/" target="_blank">VMworld</a> registration process, my <a href="https://vmworld2008.wingateweb.com/scheduler/eventguide/publicScheduleByType.jsp?ts=1221517325133" target="_blank">first session</a> was “From Hypervisors to VMware Infrastructure – What Matters?” – or as I would have called it “why VMware is so much better than Microsoft…and if you don’t believe that we can help you make even more money on top of your already successful Microsoft business.” (I know, that title is way too long but quite descriptive.)</p>
<p>The session took place at the beginning of Partner Day. The “regular” conference sessions actually begin tomorrow. Today is spent focusing on partner issues and enablement.</p>
<p>The panel for this session included:</p>
<ul>
<li>Mark Chuang <small>Group Manager, Product Marketing, </small>VMware, Inc.</li>
<li>Kenon Owens <small>Staff Systems Engineer, </small>VMware, Inc.</li>
</ul>
<p>You have to remember that <a href="http://www.virtualization.info/2008/09/more-than-20-partners-announces-support.html" target="_blank">most of the Partners here</a> are not vendors like ScienceLogic, but big and small shops that are selling IT, networking and now virtualization solutions into end-customer environments. For these guys, understanding what virtualization partner programs and tools are at NetApp, for example, is very useful. And many of these companies are already selling Microsoft software and surrounding services for Microsoft products. So if you’re VMware, what’s the message to these partners in the face of the Microsoft juggernaut?</p>
<blockquote><p>Microsoft to partners: “You may not like to admit it, but you’re probably already in bed with us.”</p>
<p>VMware to partners: &#8220;Our hypervisor technology outperforms Hyper-V and Xen, especially at scale. And anyway, it’s not about the battle at the hypervisor. It’s about the V-services on top of the hypervisor – VMotion, Storage VMotion, DRS, etc.&#8221;</p></blockquote>
<p>Interesting and what we all already know, or think we know. The scale issue is an interesting one – too soon for <a href="http://blogs.technet.com/virtualization/archive/2008/09/12/pre-vmworld-check-out-hyper-v-server-and-live-migration-demos.aspx" target="_blank">Hyper-V</a> and who uses Xen? But also interestingly enough, no announcement or even talk about extending VMware management tools to other hypervisors. The point, as the VMware product marketing guy made a point of saying, is that the question they needed to answer used to be “Why Virtualization?” and now it’s “Why VMware?&#8221;.</p>
<p>One more tidbit – this survey run by VMware asking their customers:</p>
<p><strong>What are the top 6 apps you are running on VMware today</strong></p>
<ul>
<li>IIS</li>
<li><em>Apache</em></li>
<li>Active Directory</li>
<li>SQL Server</li>
<li>Sharepoint</li>
<li>Exchange</li>
<p><em></em></ul>
<p><strong>That means, 5 of 6 are Microsoft applications. </strong>Certainly it makes it even more challenging for VMware to navigate a path here.</p>
<p>The change since 2004 – would have talked about why virtualize. And now why VMware. (Duh.)</p>
<p>Talking to partners – many of which already have a successful Microsoft business. How VMware <a href="http://gigaom.com/2008/09/14/for-vmware-an-uncertain-future/" target="_blank">enhances your existing Microsoft business</a>.</p>
<p><strong>Top 6 apps running on VMware today (5 of 6 are Microsoft applications)</strong></p>
<ul>
<li>IIS</li>
<li><em>Apache</em></li>
<li>AD</li>
<li>Sql server</li>
<li>Sharepoint</li>
<li>Exchange</li>
</ul>
<p><em>Source: VMware survey</em></p>
<p>Esxi - VMware – true thin hypervisor; maximizes resources utilization (over 100% memory commitment – allows avg of 2:1 memory overcommit) – host system memory is usually the resource bottleneck – plus Advanced Scheduler runs VMs better under load and to a greater capacity (hard to show this part); performance acceleration – using binary translation (32bit), para-virtualization and Hardware Assist (for 64-bit)</p>
<p>(rvi – rapid virtualization indexing)</p>
<p>No parent partition that all hypervisors have to go through</p>
<p>Vs ms/xen</p>
<p>Parent partition – dom 0 =&gt; potentially problem at scale; i/o that could be a bottleneck</p>
<p>Hyper-v SPECjbb comparison</p>
<p>= 9 vms on VMware and hyper-v hypervisors</p>
<p>Outperform (CPU) by 50% - general purpose scheduler isn’t able to keep up? “got to be”</p>
<p>(cpu only test)</p>
<p>Also used VMmark – to demonstrate again that VMware is performance tuned and designed to run at scale vs Hyper-V</p>
<p>Size Does Matter:</p>
<p>Vmware ESXi: 32MB</p>
<p>Hyper-v – 2.6 GB</p>
<p>Xen – 1.2 GB</p>
<p>Hyper-V uses Microsoft Server Core – so the last two Patch Tuesdays had to make changes to Server Core (nothing to do with Hyper-V) but service interruption for Hyper-V.</p>
<p>VMware VMsafe – “Provides an unprecedented level of security” “virtual is more secure than Real” (uh oh – clearly didn’t read about the</p>
<p>*****************</p>
<p>VMware TEST:512 mb vms on server w/ 4gb ram –</p>
<p>7 vms - xensource (w/no memory overcommit)</p>
<p>6vms – hyper-v before error (w/no memory overcommit)</p>
<p>14vms - w/memory overcommit and management</p>
<p>Running sql io sim – heavy workloads</p>
<p>TCO – not just license; now ESXi is free – so hardware</p>
<p>809 - ESXi</p>
<p>871 – vi3 foundation ($995)</p>
<p>1168- vi3 enterprise ($5750)</p>
<p>1621 – hyper-v – 2x cost because of hw</p>
<p>Xen – 1618</p>
<p>Memory overcommit (89% in production vs. test/dev)</p>
<p>Survey – 37% of respondents at 2:1 RATIO OR HIGHER; real average is around 1.8: 1</p>
<p>*********************</p>
<p>This guy Mark sounds like a used car salesman:</p>
<p>“Always On, On Demand Data Center”</p>
<blockquote><p>Hypervisor is very important but what is more important are the v-services on top of this. Manage shared, pooled resources. “Value Above the Hypervisor”</p></blockquote>
<p>How does all this save “your customers” $$?</p>
<p><strong>VMotion – saves cost on planned maintenance: no more overtime, no more time scheduling maintenance windows (see cost framework below)</strong></p>
<p>10 (# of servers) x 6 (@ of updates) x [ (overtime cost 2hrs x $150/hr) + (scheduling downtime # of apps per server 15 x time spend scheduling per app 0.75 hr x $50/hr)] = $58,500</p>
<p>Same thing with using VMware Storage VMotion</p>
<p>Overtime cost + scheduling downtime + planning move + alternative tool cost - $68,750 (2.5 TeraBytes)</p>
<p><strong>The Value of High Availability</strong></p>
<p>- cost of lost business, lost work</p>
<p>- cost of lost productive time</p>
<p>4 hours of downtime x # of users per vm 10 x number of vms per host 15 x cost of user productive time $50/hr x failures per year in 10-host cluster 2 = $60K</p>
<p>(10 servers, 150 vms)</p>
<p><strong>SAVINGS (using enterprise version)</strong></p>
<p>Update management 149,760</p>
<p>HA 60K</p>
<p>DRS, VMotion Storage VMotion 187,250</p>
<p>808,259 – hw, power cooling, etc.</p>
]]></content:encoded>
      <pubDate>Mon, 15 Sep 2008 19:00:12 +0000</pubDate>
      <category domain="http://securityratty.com/tag/vmware">vmware</category>
      <category domain="http://securityratty.com/tag/microsoft">microsoft</category>
      <category domain="http://securityratty.com/tag/survey">survey</category>
      <category domain="http://securityratty.com/tag/vmware survey">vmware survey</category>
      <category domain="http://securityratty.com/tag/vmware enhances">vmware enhances</category>
      <category domain="http://securityratty.com/tag/vmware infrastructure">vmware infrastructure</category>
      <category domain="http://securityratty.com/tag/test">test</category>
      <category domain="http://securityratty.com/tag/vmware test">vmware test</category>
      <category domain="http://securityratty.com/tag/overtime cost 2hrs">overtime cost 2hrs</category>
      <source url="http://blog.sciencelogic.com/vmware-is-better-than-microsoft/09/2008">VMWare is Better Than Microsoft</source>
    </item>
    <item>
      <title><![CDATA[More on Why Routing is Not Complex Event Processing]]></title>
      <link>http://securityratty.com/article/b2a2132904db8b6f400e9dc6e9ba65b1</link>
      <guid>http://securityratty.com/article/b2a2132904db8b6f400e9dc6e9ba65b1</guid>
      <description><![CDATA[Interestingly, CEP is Not BPM, BAM, BRE, BRMS or SOA stimulated many great comments andthe rebuttal Smart Order Routing and CEP - Made for Each Other . James Taylor responded with Business rules,...]]></description>
      <content:encoded><![CDATA[<p>Interestingly, <a href="http://www.thecepblog.com/2008/08/27/cep-is-not-bpm-bam-bpm-brms-or-soa/">CEP is Not BPM, BAM, BRE, BRMS or SOA</a> stimulated many great comments and the rebuttal <a href="http://streambase.typepad.com/streambase_stream_process/2008/09/smart-order-routing-and-cep.html">Smart Order Routing and CEP - Made for Each Other</a>.  James Taylor responded with <a href="http://www.ebizq.net/blogs/decision_management/2008/08/business_rules_decisions_and_e.php">Business rules, decisions and events</a>.   I followed up with <a href="http://www.thecepblog.com/2008/09/03/cep-is-not-low-latency-messaging-eai-or-esb/">CEP is Not Low Latency Messaging, EAI or ESB</a> and James replied in turn with <a href="http://www.ebizq.net/blogs/decision_management/2008/09/still_more_on_event_processing.php" target="_blank">Still More on Event Processing</a>.  It&#8217;s great to see the blogosphere doing so well.  Continuing, I would like to discuss smart order routing (SOR) a bit more and why routing is not CEP.</p>
<p>First of all, let&#8217;s ground the discussion a bit by translating &#8220;smart order routing&#8221; to &#8220;rule-based message routing&#8221; since in this application &#8220;smart&#8221;  translates to &#8220;using rules&#8221; and &#8220;order&#8221; translates to &#8220;message&#8221;.    Basically, Mark (and other &#8220;new on the routing scene&#8221; stream processing players) argue that rule-based message routing is CEP.  I will argue that routing is not even close to CEP.  Here is why,</p>
<p>Let&#8217;s take a look at a router on the backbone of the global Internet.   A backbone router has very sophisticated software developed over many decades.   These routers run sophisticated, mature algorithms to determine how to route messages (packets) and use these algorithms to build complex routing tables. </p>
<p>In addition, these routers process messages (packets) from countless sources and route messages (packets) to countless destinations.  Using some of the terms in early posts (above), there is a great &#8220;confluence of events&#8221; processed by routers.    Futhermore, there are normally quite complex authentication, authorization and other security parameters managed in a router, all in real time.   Routers do much more, but I don&#8217;t want to get too deep into routing in this post.</p>
<p>My point is that, without any doubt, global Internet routers process very &#8220;cloudy&#8221; &#8220;confluence of events&#8221; with much more sophistication than order routing applications.    However, we do not call Internet routing &#8220;CEP&#8221;, regardless of how many connections are processed or how much sophisticated processing occurs.  The reason is because the &#8220;C&#8221; in &#8220;CEP&#8221; defines a complexity that is at a higher abstraction than messaging and routing.</p>
<p>If you study the literature on CEP, some of which I posted recently, CEP was envisioned to solve complex event processing problems &#8220;on top of the routing layer&#8221; because the routing layer is a mature technology layer.  We can route, pure and simple.  Of course, we are always seeking faster, more scaleable and more secure routing. </p>
<p>I admire some of the startups in the CEP/ESP/EP space for working hard to make money and for aggressively positioning their products and attempting to build market share.   However, issues surface when these same companies seem to believe they are the first companies to work in the event processing or message routing space and that they can define whatever they want as &#8220;complex event processing&#8221; as long as it benefits their sales targets.</p>
<p>There is no doubt that a router does much more sophisticated event processing than the new rule-based stream processing systems running continuous queries across streaming data.  There is no doubt that a router processes a complex &#8220;confluence of events&#8221;.   However, we don&#8217;t call routers &#8220;CEP&#8221;. </p>
<p>We do not call routers &#8220;CEP&#8221; because CEP is about a higher level of knowledge processing.  CEP was created to detect the &#8220;complex events&#8221; that happen above the mediation and routing layer.     The literature and original examples on CEP are quite clear on this.</p>
<p> </p>
]]></content:encoded>
      <pubDate>Thu, 04 Sep 2008 05:38:58 +0000</pubDate>
      <category domain="http://securityratty.com/tag/complex">complex</category>
      <category domain="http://securityratty.com/tag/complex event">complex event</category>
      <category domain="http://securityratty.com/tag/solve complex event">solve complex event</category>
      <category domain="http://securityratty.com/tag/upwith cep">upwith cep</category>
      <category domain="http://securityratty.com/tag/cep">cep</category>
      <category domain="http://securityratty.com/tag/event">event</category>
      <category domain="http://securityratty.com/tag/cep defines">cep defines</category>
      <category domain="http://securityratty.com/tag/call routers cep">call routers cep</category>
      <category domain="http://securityratty.com/tag/call">call</category>
      <source url="http://www.thecepblog.com/2008/09/04/more-on-why-routing-is-not-complex-event-processing/">More on Why Routing is Not Complex Event Processing</source>
    </item>
    <item>
      <title><![CDATA[Ten Back to School Security Tips]]></title>
      <link>http://securityratty.com/article/2420b92a014888ac1722b3f6f10e814c</link>
      <guid>http://securityratty.com/article/2420b92a014888ac1722b3f6f10e814c</guid>
      <description><![CDATA[Ive already gotten a laptop from a teacher thats full of Spyware, and its just the first week of back to school


clipped from www.enterpriseitplanet.com

Ten Back to School Security Tips for...]]></description>
      <content:encoded><![CDATA[<div>Ive already gotten a laptop from a teacher thats full of Spyware, and its just the first week of back to school!</div>
<table style="border: 4px solid #e5e5e5; margin: 12px 0px; background: #ffffff none repeat scroll 0% 50%; font-family: arial; color: #333333; width: 100%; clear: left;" border="0" cellspacing="0" cellpadding="0" width="100%">
<tbody>
<tr>
<td valign="top">
<table class="CM_CTB_Content_Wrap" style="margin: 0px; padding: 0px;background-color: #ffffff;" border="0" cellspacing="0" cellpadding="0" width="100%">
<tbody>
<tr>
<td valign="top">
<table style="border-bottom: 1px solid #dcdcdc; white-space: nowrap; margin-bottom: 8px; background-color: #eeeeee; background-image: url(http://clipmarks.com/images/source-bg.gif); background-repeat: repeat-x; height: 24px; line-height: 24px; vertical-align: middle; padding-bottom: 4px; color: #666666; font-size: 10px;" border="0" cellspacing="0" cellpadding="0" width="100%">
<tbody>
<tr>
<td valign="top"><a title="go to this clipmark" href="http://clipmarks.com/clipmark/18E57FB0-78C9-4D39-BD85-037C0F899609/"><img style="vertical-align: middle; margin: 0px 4px; display: inline; border: none; float:none;" src="http://content.clipmarks.com/blog_icon/13a5b5db-392f-4e18-bae1-4e78032625ef/18E57FB0-78C9-4D39-BD85-037C0F899609/" border="0" alt="" width="19" height="19" /></a>clipped from <a style="font-size: 11px;" title="http://www.enterpriseitplanet.com/security/features/article.php/3767501" href="http://www.enterpriseitplanet.com/security/features/article.php/3767501">www.enterpriseitplanet.com</a></td>
</tr>
</tbody>
</table>
<table style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;" border="0" cellspacing="0" cellpadding="0" width="100%">
<tbody>
<tr>
<td valign="top"><!-- CLIPPED FROM: http://www.enterpriseitplanet.com/security/features/article.php/3767501 --></p>
<div style="margin: 4px 0px; color: #000000; font-size: 20px;">Ten Back to School Security Tips for Administrators</div>
</td>
</tr>
</tbody>
</table>
<table style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;" border="0" cellspacing="0" cellpadding="0" width="100%">
<tbody>
<tr>
<td valign="top"><!-- CLIPPED FROM: http://www.enterpriseitplanet.com/security/features/article.php/3767501 -->With the start of school around the corner, many IT administrators have to prep their environments for the hordes of students that will insist on downloading the entirety of Internet. Interestingly enough, our employees sometimes feel that they should do the same.</td>
</tr>
</tbody>
</table>
<table style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;" border="0" cellspacing="0" cellpadding="0" width="100%">
<tbody>
<tr>
<td valign="top"><!-- CLIPPED FROM: http://www.enterpriseitplanet.com/security/features/article.php/3767501 -->While they may not necessarily be visiting unsavory sites, they are likely to visit a variety of other sites that will distract them from their learning or job responsibilities.   So what are those things should be done in preparation for the start of the school year (many at little-to-no-cost), whether at the school or in the work environment?</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
<div style="margin: 0px 6px 6px 4px;">
<table style="font-size: 11px;border-spacing: 0px;padding: 0px;" border="0" cellspacing="0" cellpadding="0" width="100%">
<tbody>
<tr>
<td style="background:transparent;border-width:0px;padding:0px;"></td>
<td style="border-width: 0px; padding: 0px; background: transparent none repeat scroll 0% 50%; width: 107px;" width="107" align="right"><a title="blog or email this clip" href="http://clipmarks.com/share/18E57FB0-78C9-4D39-BD85-037C0F899609/blog/"><img style="border-width:0px;padding:0px;margin:0px;" src="http://content6.clipmarks.com/images/c2b-foot.png" border="0" alt="blog it" width="107" height="17" /></a></td>
</tr>
</tbody>
</table>
</div>
</td>
</tr>
</tbody>
</table>
]]></content:encoded>
      <pubDate>Tue, 26 Aug 2008 10:46:01 +0000</pubDate>
      <category domain="http://securityratty.com/tag/school security tips">school security tips</category>
      <category domain="http://securityratty.com/tag/school">school</category>
      <category domain="http://securityratty.com/tag/sites">sites</category>
      <category domain="http://securityratty.com/tag/unsavory sites">unsavory sites</category>
      <category domain="http://securityratty.com/tag/administrators">administrators</category>
      <category domain="http://securityratty.com/tag/start">start</category>
      <category domain="http://securityratty.com/tag/insist">insist</category>
      <category domain="http://securityratty.com/tag/laptop">laptop</category>
      <category domain="http://securityratty.com/tag/entirety">entirety</category>
      <source url="http://spywarebiz.com/spywarebizblog/?p=585">Ten Back to School Security Tips</source>
    </item>
    <item>
      <title><![CDATA[Compromised Cpanel Accounts For Sale]]></title>
      <link>http://securityratty.com/article/6228ebb081126296ff70b5f6268fd2a3</link>
      <guid>http://securityratty.com/article/6228ebb081126296ff70b5f6268fd2a3</guid>
      <description><![CDATA[Is the once popular in the second quarter of 2007, embedded malware tactic on the verge of irrelevance, and if so, what has contributed to its decline? Have SQL injections executed through botnets...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://4.bp.blogspot.com/_wICHhTiQmrA/SKlq1uSeDFI/AAAAAAAACDM/l4bxcru-BQk/s1600-h/cpanel_multiple_domains1.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://4.bp.blogspot.com/_wICHhTiQmrA/SKlq1uSeDFI/AAAAAAAACDM/ho301JgoMUs/s200-R/cpanel_multiple_domains1.png" /></a> Is the once popular in the second quarter of 2007, embedded malware tactic on the verge of irrelevance, and if so, what has contributed to its decline? Have SQL injections executed through botnets turned into the most efficient way to infect hundreds of thousands of legitimate web sites? Depends on who you're dealing with.<br />
<br />
A cyber criminal's position in the "underground food chain" can be easily tracked down on the basis of tools and tactics that he's taking advantage of, in fact, some would on purposely misinform on what their actual capabilities are in order not to attract too much attention to their real ones, consisting of high-profile compromises at hundreds of high-profile web sites.<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://3.bp.blogspot.com/_wICHhTiQmrA/SKmDVdDGnPI/AAAAAAAACDU/qNbLBUKlHp0/s1600-h/cpanel_multiple_domains3.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://3.bp.blogspot.com/_wICHhTiQmrA/SKmDVdDGnPI/AAAAAAAACDU/ZsmcK9HMeUs/s200-R/cpanel_multiple_domains3.jpg" /></a>Embedded malware may not be as hot as it used to be in the last quarter of 2007, but thanks to the oversupply of stolen accounting data, certain individuals within the underground ecosystem seem to be abusing entire portfolios of domains on the basis of purchasing access to the compromised accounts. In fact, the oversupply of compromised Cpanel accounts is logically resulting in their decreasing price, with the sellers differentiating their propositions, and charging premium prices based on the site's page ranks and traffic, measured through publicly available services, or through the internal statistics.<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://4.bp.blogspot.com/_wICHhTiQmrA/SKmMyr4CWEI/AAAAAAAACDc/UafOTCKAb-0/s1600-h/cpanel_multiple_domains22.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://4.bp.blogspot.com/_wICHhTiQmrA/SKmMyr4CWEI/AAAAAAAACDc/7IRBMNndy-w/s200-R/cpanel_multiple_domains22.JPG" /></a><br />
SQL injections may be the tactic of choice for the time being, but as long as stolen accounting data consisting of Cpanel logins, and web shells access to misconfigured web servers remain desired underground goods, goold old fashioned embedded malware will continue taking place.<br />
<br />
Interestingly, from an economic perspective, the way the seller markets his goods, can greatly influence the way they get abused given he continues offering after-sale services and support. It's blackhat search engine optimization I have in mind, sometimes the tactic of choice especially given its high liquidity in respect to monetizing the compromised access.<br />
<br />
The bottom line - for the time being, there's a higher probability that your web properties will get SQL injected, than IFRAME-ed, as it used to be half a year ago, and that's because what used to be a situation where malicious parties would aim at launching a targeted attack at high profile site and abuse the huge traffic it receives, is today's pragmatic reality where a couple of hundred low profile web sites can in fact return more traffic to the cyber criminals, and greatly extend the lifecycle of their campaign taking advantage of the fact the the low profile site owners would remain infected and vulnerable for months to come.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2008/03/embedding-malicious-iframes-through.html">Embedding Malicious IFRAMEs Through Stolen FTP Accounts</a><br />
<a href="http://ddanchev.blogspot.com/2008/03/injecting-iframes-by-abusing-input.html">Injecting IFRAMEs by Abusing Input Validation</a><br />
<a href="http://ddanchev.blogspot.com/2008/07/money-mule-recruiters-use-asproxs-fast.html">Money Mule Recruiters use ASProx's Fast-flux Services</a><br />
<a href="http://ddanchev.blogspot.com/2008/05/malware-domains-used-in-sql-injection.html">Malware Domains Used in the SQL Injection Attacks</a><br />
<a href="http://ddanchev.blogspot.com/2008/07/obfuscating-fast-fluxed-sql-injected.html">Obfuscating Fast-fluxed SQL Injected Domains</a><br />
<a href="http://ddanchev.blogspot.com/2008/07/sql-injecting-malicious-doorways-to.html">SQL Injecting Malicious Doorways to Serve Malware </a><br />
<a href="http://ddanchev.blogspot.com/2008/05/yet-another-massive-sql-injection.html">Yet Another Massive SQL Injection Spotted in the Wild</a><br />
<a href="http://ddanchev.blogspot.com/2008/05/malware-domains-used-in-sql-injection.html">Malware Domains Used in the SQL Injection Attacks</a><br />
<a href="http://ddanchev.blogspot.com/2007/07/sql-injection-through-search-engines.html">SQL Injection Through Search Engines Reconnaissance</a><br />
<a href="http://ddanchev.blogspot.com/2007/05/google-hacking-for-vulnerabilities.html">Google Hacking for Vulnerabilities</a><br />
<a href="http://blogs.zdnet.com/security/?p=1122">Fast-Fluxing SQL injection attacks executed from the Asprox botnet</a><br />
<a href="http://blogs.zdnet.com/security/?p=1394">Sony PlayStation's site SQL injected, redirecting to rogue security software</a><br />
<a href="http://blogs.zdnet.com/security/?p=1118">Redmond Magazine Successfully SQL Injected by Chinese Hacktivists</a><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=ExzKaK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=ExzKaK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=AgwoKK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=AgwoKK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=5JjO7k"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=5JjO7k" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=5Z85mk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=5Z85mk" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=s4xhGK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=s4xhGK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=ReebmK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=ReebmK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=T0yjTk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=T0yjTk" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/368194376" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 18 Aug 2008 06:42:50 +0000</pubDate>
      <category domain="http://securityratty.com/tag/sql">sql</category>
      <category domain="http://securityratty.com/tag/sql injections">sql injections</category>
      <category domain="http://securityratty.com/tag/sql injection attacks">sql injection attacks</category>
      <category domain="http://securityratty.com/tag/massive sql injection">massive sql injection</category>
      <category domain="http://securityratty.com/tag/profile site">profile site</category>
      <category domain="http://securityratty.com/tag/site">site</category>
      <category domain="http://securityratty.com/tag/site sql">site sql</category>
      <category domain="http://securityratty.com/tag/sql injection">sql injection</category>
      <category domain="http://securityratty.com/tag/tactic">tactic</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/368194376/compromised-cpanel-accounts-for-sale.html">Compromised Cpanel Accounts For Sale</source>
    </item>
    <item>
      <title><![CDATA[CNN Custom Alerts Spam]]></title>
      <link>http://securityratty.com/article/f544d5e769f123f7cc5f3036bac72fdd</link>
      <guid>http://securityratty.com/article/f544d5e769f123f7cc5f3036bac72fdd</guid>
      <description><![CDATA[In general, my anti-spam filters and tools are pretty effective. So when I start to see something like this







it's obvious that a huge spam wave is underway. These are, of course, related to the...]]></description>
      <content:encoded><![CDATA[
        In general, my anti-spam filters and tools are pretty effective. So when I start to see something like this....<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="cn1.jpg" src="http://blog.spywareguide.com/images/cn1.jpg" class="mt-image-none" style="" height="137" width="193" /></span></div><br /> <div><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="cn2.jpg" src="http://blog.spywareguide.com/images/cn2.jpg" class="mt-image-none" style="" height="247" width="214" /></span></div>
<br />....it's obvious that a huge spam wave is underway. These are, of course, related to the <a href="http://blog.spywareguide.com/2008/08/cnn-daily-top-10-videos-spam.html">fake CNN Spam</a> from a few days ago. Here, the emails take the form of "custom alerts":<br /><br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/cn32.html" onclick="window.open('http://blog.spywareguide.com/images/cn32.html','popup','width=613,height=352,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/cn3-thumb-313x179.jpg" alt="cn3.jpg" class="mt-image-none" style="" height="179" width="313" /></a></span><br /><br />Click to Enlarge<br /></div><br />I've seen two types of this mail - one links to a genuine CNN article from the headline text (with the smaller link underneath leading to an infection site), the other simply links to the infection site from both clickable links. As before, deleting these Emails is the best course of action. Interestingly, the format of these mails might not be working to the spammers advantage. Lots of people I've talked to who had one of these mails sent through simply deleted them without a second thought, thinking it was merely something on the real CNN they thought they'd signed up to and didn't actually want.<br /><br /></div><div><br /></div>
        
    ]]></content:encoded>
      <pubDate>Sun, 10 Aug 2008 13:28:40 +0000</pubDate>
      <category domain="http://securityratty.com/tag/links">links</category>
      <category domain="http://securityratty.com/tag/clickable links">clickable links</category>
      <category domain="http://securityratty.com/tag/simply links">simply links</category>
      <category domain="http://securityratty.com/tag/simply">simply</category>
      <category domain="http://securityratty.com/tag/custom alerts">custom alerts</category>
      <category domain="http://securityratty.com/tag/infection site">infection site</category>
      <category domain="http://securityratty.com/tag/fake cnn spam">fake cnn spam</category>
      <category domain="http://securityratty.com/tag/genuine cnn article">genuine cnn article</category>
      <category domain="http://securityratty.com/tag/huge spam wave">huge spam wave</category>
      <source url="http://blog.spywareguide.com/2008/08/cnn-custom-alerts.html">CNN Custom Alerts Spam</source>
    </item>
    <item>
      <title><![CDATA[Listening to the evidence]]></title>
      <link>http://securityratty.com/article/cb3684b9bd257e429791aaa34c5339e3</link>
      <guid>http://securityratty.com/article/cb3684b9bd257e429791aaa34c5339e3</guid>
      <description><![CDATA[Last week the House of Commons Culture, Media and Sport Select Committee published a report of their inquiry into Harmful content on the Internet and in video games . They make a number of...]]></description>
      <content:encoded><![CDATA[<p>Last week the <a href="http://www.parliament.uk/parliamentary_committees/culture__media_and_sport.cfm">House of Commons Culture, Media and Sport Select Committee</a> published a report of their inquiry into &#8220;<a href="http://www.publications.parliament.uk/pa/cm200708/cmselect/cmcumeds/353/353.pdf">Harmful content on the Internet and in video games</a>&#8220;. They make a number of recommendations including a self-regulatory body to set rules for Internet companies to force them to protect users; that sites should provide a &#8220;watershed&#8221; so that grown-up material cannot be viewed before 9pm; that YouTube should screen material for forbidden content; that &#8220;<a href="http://www.spiked-online.com/index.php?/site/article/4633/">suicide websites</a>&#8221; should be blocked; that ISPs should be forced to block child sexual abuse image websites whatever the cost, and that blocking of bad content was generally desirable.</p>
<p>You will discern a certain amount of enthusiasm for blocking, and for a &#8220;<a href="http://www.yes-minister.com/polterms.htm#Politicians">something must be done</a>&#8221; approach. However, in coming to their conclusions, they do not, in my view, seem to have listened too hard to the evidence, or sought out expertise elsewhere in the world&#8230;<br />
<span id="more-351"></span><br />
Google/YouTube told them that 10 hours of video was posted every minute, and the amount is increasing. In the oral evidence session an MP helpfully suggested: &#8220;That video content is tagged. You do not need to look at every single minute of video content. Surely you could have people who would look at the video content which is tagged with labels which suggest it could be inappropriate.&#8221; Of course &#8220;<a href="http://lostria.blogspot.com/2008/01/fertility-slaps.html">happy_slapping.wmv</a>&#8221; or &#8220;<a href="http://www.phrases.org.uk/meanings/bunny-boiler.html">fluffy_bunnies.avi</a>&#8221; must always contain exactly what it says on the tin (<a href="http://en.wikipedia.org/wiki/Not%21">not!</a>) but unaccountably Google said it was a &#8220;fair suggestion&#8221;, so perhaps my cynicism is misplaced.</p>
<p>However, back to blocking.</p>
<p>I submitted <a href="http://www.cl.cam.ac.uk/~rnc1/080129-cms.pdf">some evidence of my own</a>, which the committee summarised, reasonably accurately:</p>
<blockquote><p>Dr Richard Clayton, a researcher in the Security Group of the Computer Laboratory at Cambridge University and author of several academic papers on methods for blocking access to Internet content, pointed out that there was no single blocking method which was both inexpensive and discerning enough to block access to only one part of a large website (such as FaceBook). In his view, the fatal flaw of all network-level blocking schemes was the ease with which they could be overcome, either by encrypting content or by the use of proxy services hosted outside the UK.</p></blockquote>
<p>The committee&#8217;s conclusion, having read this was:</p>
<blockquote><p>At a time of rapid technological change, it is difficult to judge whether blocking access to Internet content at network level by Internet service providers is likely to become ineffective in the near future. However, this is not a reason for not doing so while it is still effective for the overwhelming majority of users.</p></blockquote>
<p>which I suppose logically means that the committee thinks that blocking should now be discarded as a policy option &#8212; but somehow I think that isn&#8217;t their intended meaning.</p>
<p>The Committee should perhaps have a look at <a href="http://www.acma.gov.au/webwr/_assets/main/lib310554/isp-level_internet_content_filtering_trial-report.pdf">this Australian report</a>, which found that ISP level content filtering (and in Australia the politicians want to use ISP level filtering to provide a child-friendly Internet) did work (up to a point) at Tier 3 (the smallest) ISPs. The <a href="http://en.wikiquote.org/wiki/Evelyn_Waugh#Scoop_.281938.29">up-to-a-point</a> is that unlike previous tests the systems didn&#8217;t completely wreck the browsing experience by slowing it down. However, the systems blocked only 85-98% of illegal material and similar percentages of material suitable for adults but not for younger children. Interestingly some products were better at different categories.</p>
<p>Getting that many sites wrong is really quite significant, so it&#8217;s difficult to see this as a ringing endorsement for blocking the web. Additionally, the Australian report found that the blocking was useless on &#8220;non-web&#8221; protocols (such as peer-to-peer) and their report specifically didn&#8217;t consider cost, or ease of circumvention &#8212; so it&#8217;s not just UK politicians not wanting to consider evidence on that topic!</p>
<p>Finally, I should note that the Culture Media and Sport Committee has also ignored some rather more recent academic work. The MPs have put into their report that they were horrified to discover that child sexual abuse images took 24 hours to remove in the UK. What (should they ever learn of it) will they make of the recent discovery by <a href="http://people.seas.harvard.edu/~tmoore/">Tyler Moore</a> and myself that shows that if the website is hosted abroad then <a href="http://www.lightbluetouchpaper.org/2008/06/11/slow-removal-of-child-sexual-abuse-image-websites/">a month is more to be expected</a>?</p>
]]></content:encoded>
      <pubDate>Thu, 07 Aug 2008 20:24:33 +0000</pubDate>
      <category domain="http://securityratty.com/tag/content">content</category>
      <category domain="http://securityratty.com/tag/isp level content">isp level content</category>
      <category domain="http://securityratty.com/tag/video games">video games</category>
      <category domain="http://securityratty.com/tag/video">video</category>
      <category domain="http://securityratty.com/tag/bad content">bad content</category>
      <category domain="http://securityratty.com/tag/video content">video content</category>
      <category domain="http://securityratty.com/tag/internet">internet</category>
      <category domain="http://securityratty.com/tag/evidence">evidence</category>
      <category domain="http://securityratty.com/tag/child-friendly internet">child-friendly internet</category>
      <source url="http://www.lightbluetouchpaper.org/2008/08/08/listening-to-the-evidence/">Listening to the evidence</source>
    </item>
    <item>
      <title><![CDATA[An "Aw3s0me" Offer?]]></title>
      <link>http://securityratty.com/article/a01a803d8e6e34d9dd9658cbc7dd24b9</link>
      <guid>http://securityratty.com/article/a01a803d8e6e34d9dd9658cbc7dd24b9</guid>
      <description><![CDATA[Yes, it's time for our regular &quot;sites to avoid&quot; update with regards URLs related to this ring of sites asking for MSN login details. Yesterday evening, I received this via MSN




Interestingly, this...]]></description>
      <content:encoded><![CDATA[
        Yes, it's time for our regular "sites to avoid" update with regards URLs related to <a href="http://blog.spywareguide.com/2008/06/another-site-asking-for-msn-lo.html">this ring of sites</a> asking for MSN login details. Yesterday evening, I received this via MSN:<br /><br /><br /><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="awesomeoffer1.jpg" src="http://blog.spywareguide.com/images/awesomeoffer1.jpg" class="mt-image-none" style="" height="164" width="394" /></span>
<br /><br />Interestingly, this is the first site I've seen promoted on MSN related to this where the site being pushed isn't asking for your login details. Instead, it cycles through a bunch of adverts &amp; promotions instead. Rather worryingly, the domain has been flagged for Phishing.<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/awesomeoffer2.html" onclick="window.open('http://blog.spywareguide.com/images/awesomeoffer2.html','popup','width=967,height=482,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/awesomeoffer2-thumb-367x182.jpg" alt="awesomeoffer2.jpg" class="mt-image-none" style="" height="182" width="367" /></a></span><br /> </div><div><div align="center"><br />Click to Enlarge<br /></div><br />In what might be a departure for these websites, there appears to be "real" <a href="http://whois.domaintools.com/aw3s0me-offer.com">Whois data</a> listed for the URL, as opposed the "privacy protected" details I seem to remember being used for all the others.<br /><br />Registrant Contact:<br />&nbsp;&nbsp; TST Management, Inc<br />&nbsp;&nbsp; Jeff Fisher <br />&nbsp;&nbsp; <br />&nbsp;&nbsp; Edificio Magna Corp. 5th Floor, Office 511<br />&nbsp;&nbsp; Ave. Manuel Maria Icaza y Calle 51<br />&nbsp;&nbsp; Panama City, Panama 0000<br />&nbsp;&nbsp; PA<br /><br />I'm sure there'll be another chapter in this ongoing saga soon.<br /></div><div><br /></div>
        
    ]]></content:encoded>
      <pubDate>Tue, 05 Aug 2008 12:52:53 +0000</pubDate>
      <category domain="http://securityratty.com/tag/details">details</category>
      <category domain="http://securityratty.com/tag/msn login details">msn login details</category>
      <category domain="http://securityratty.com/tag/login details">login details</category>
      <category domain="http://securityratty.com/tag/msn">msn</category>
      <category domain="http://securityratty.com/tag/manuel maria icaza">manuel maria icaza</category>
      <category domain="http://securityratty.com/tag/panama city">panama city</category>
      <category domain="http://securityratty.com/tag/panama">panama</category>
      <category domain="http://securityratty.com/tag/edificio magna corp">edificio magna corp</category>
      <category domain="http://securityratty.com/tag/tst management">tst management</category>
      <source url="http://blog.spywareguide.com/2008/08/an-aw3s0me-offer.html">An "Aw3s0me" Offer?</source>
    </item>
  </channel>
</rss>
