<![CDATA[[SecurityRatty] tag: introduction]]> http://securityratty.com/tag/introduction Fri, 20 Jun 2008 07:23:00 +0000 iRatty Engine http://blogs.law.harvard.edu/tech/rss <![CDATA[A Brief Introduction to Blackboard Architectures]]> http://securityratty.com/article/22d6319038389d6b246f89f8c8e84bc2 http://securityratty.com/article/22d6319038389d6b246f89f8c8e84bc2 A blackboard architecture is a distributed computing architecture where distributed applications, modelled as intelligent agents, share a common data structure called the “blackboard”  and a scheduling/control process.  The blackboard can be either centeralized or distrbuted, depending on the requirements and constraints of the application(s).

To solve a complex problem in the blackboard-style, the intelligent agents cooperate as functional specialists, observing updates to the blackboard and self-actualizing in an event driven process) when there is new information to process.  Agents continually update the blackboard with partial solutions when the agents capabilities for processing match the state of the blackboard. 

The blackboard architecture is a distributed computing model for a metaphor describing how people work together to collaboratively solve a problem around a blackboard (whiteboard in todays lingo).   For example, one person is standing at the whiteboard working on a solution while three other people are sitting (or standing) around watching.   One of the observers sees new information on the whiteboard, thinks of how he (or she) can contribute, and then jumps up, takes the whiteboard marker from the person working, and adds to the solution.  This process is repeated in various scenarios.  

The blackboard architecture can be very effective in solving complex distributed computing problems, including event processing problems; however, scheduling the self-actuating agents can be a key challenge.   Another core challenge is how to model and manage the blackboard itself, especially in distributed blackboard architectures.  

John McManus, former CTO of NASA, wrote an excellent PhD dissertation in 1992,  Design and Analysis Techniques for Concurrent Blackboard Systems, at the College of William and Mary, addressing challenges in BB systems.

The table below lists two books that focus on blackboard architecture:

Date Editor(s) Publisher ISBN Title
1989 V. Jagannathan et al Academic Press 0123799406 Blackboard Architectures and Applications
1988 Robert Engelmore and Tony Morgan Addison-Wesley 0201174316 Blackboard Systems

One of the thought leaders in blackboard architecture is Daniel D. Corkill a professor at the University of Massachusetts Amherst. 

Blackboard architecture is relevant to the field of event processing, and in particular complex event processing.   I will go into more details in future blog posts on this topic, including how blackboard architectures relate to grid computing, distributed object caching (of the blackboard), and CEP.

]]> Sun, 20 Jul 2008 09:57:12 +0000 blackboard architecture blackboard architecture isrelevant blackboard blackboard architectures architecture systems concurrent blackboard systems blackboard systems complex problemin A Brief Introduction to Blackboard Architectures <![CDATA[On Measuring a Markets Maturity]]> http://securityratty.com/article/fab7f9ba9252b7312f5d80cd5260d882 http://securityratty.com/article/fab7f9ba9252b7312f5d80cd5260d882 Professor David Luckham posts a good question in Measuring a Market’s Maturity.  Here is a slightly revised reprint of our reply:

A few folks have tried to tie “maturity” to “if the code is robust” or “if the product has certain product features.” The way we have addressed this emerging controversy over at The CEP blog is to center the discussion around the Gartner Hype Cycle, which is a pretty good model for representing the maturity, adoption and business application of specific technologies.

On CEP Maturity and the Gartner Hype Cycle

Since many folks work very closely with Gartner, I expect they are keenly aware of Gartner’s view on technology adoption maturity models and their definitions. Just for our readers who might not be as familar, I quote Gartner’s definitions below to be complete from here:

A hype cycle is a graphic representation of the maturity, adoption and business application of specific technologies. The term was coined by Gartner[citation needed], an analyst/research house, based in the United States, that provides opinions, advice and data on the global information technology industry.

Since 1995, Gartner has used hype cycles to characterize the over-enthusiasm or “hype” and subsequent disappointment that typically happens with the introduction of new technologies. Hype cycles also show how and when technologies move beyond the hype, offer practical benefits and become widely accepted. According to Gartner, hype cycles aim to separate the hype from the reality, and enable CIOs and CEOs to decide whether or not a particular technology is ready for adoption. A longer-term historical perspective on such cycles can be found in the research of the economist Carlota Perez.

A hype cycle in Gartner’s interpretation comprises 5 steps:

“Technology Trigger” — The first phase of a hype cycle is the “technology trigger” or breakthrough, product launch or other event that generates significant press and interest.

“Peak of Inflated Expectations” — In the next phase, a frenzy of publicity typically generates over-enthusiasm and unrealistic expectations. There may be some successful applications of a technology, but there are typically more failures.

“Trough of Disillusionment” — Technologies enter the “trough of disillusionment” because they fail to meet expectations and quickly become unfashionable. Consequently, the press usually abandons the topic and the technology.

“Slope of Enlightenment” — Although the press may have stopped covering the technology, some businesses continue through the “slope of enlightenment” and experiment to understand the benefits and practical application of the technology.

“Plateau of Productivity” — A technology reaches the “plateau of productivity” as the benefits of it become widely demonstrated and accepted. The technology becomes increasingly stable and evolves in second and third generations. The final height of the plateau varies according to whether the technology is broadly applicable or benefits only a niche market.

The term is now used more broadly in the marketing of new technologies.

We used the Gartner Hype Cycle in Two-Thirds of Our Readers Say CEP is Still Immature as a basis for having interested readers vote, and in a unscientific straw poll, the readers indicated that, in their view, CEP is still immature.

At the CEP Blog we ground our discussions and terminology on maturity in Gartner’s models on maturity, and we ground our discussions on event processing in the art-and-science of a long standing domain in event processing - multisensor data fusion (MSDF).

]]> Sun, 20 Jul 2008 08:10:01 +0000 hype cycles aim hype cycles hype gartner hype cycle hype cycle maturity markets maturity cep blogwe ground cep On Measuring a Markets Maturity <![CDATA[Using WebSphere information integrator to access MS server data using SQLRPGLE]]> http://securityratty.com/article/aec69fd0eff84d50a937fd6823268d2c http://securityratty.com/article/aec69fd0eff84d50a937fd6823268d2c ]]> Fri, 18 Jul 2008 10:14:08 +0000 websphere information integrator server slow solution effective solution transfer data question ftp iseries introduction Using WebSphere information integrator to access MS server data using SQLRPGLE <![CDATA[Links for 2008-07-16 [del.icio.us]]]> http://securityratty.com/article/1c0b32cbed8fe58c2b71bb261cb296be http://securityratty.com/article/1c0b32cbed8fe58c2b71bb261cb296be
  • ИКС: О разработчиках средств защиты и их судьбах
  • The Future Of Information-Centric Security: From Data Loss Prevention to Content Monitoring and Protection, Part 1 | securosis.com
  • Security is Mathematics
  • Security Event Management (SEM) with CEP (Part 1) - Introduction | The Complex Event Processing Blog
  • NitroSecurity covers its bases with RippleTech deal
  • Network Security: Getting the NAC of It - Systems Management News On The Web
    Figuring out who is allowed to access what, and on what device, is typically done by defining groups of users (HR, finance, marketing) and associating permissions with each group. “But trying to manage access and define the rules breaks down when you ha
    • ]]>     Wed, 16 Jul 2008 20:00:00 +0000 security event management security network security systems management news data loss prevention manage access access rules breaks complex event Links for 2008-07-16 [del.icio.us]     <![CDATA[The Neosploit Malware Kit Updated with Snapshot ActiveX Exploit]]> http://securityratty.com/article/cdb0e65d71e1f22f530bb119a6dfad61 http://securityratty.com/article/cdb0e65d71e1f22f530bb119a6dfad61
    Raising Symantec's ThreatCon based on a newly introduced exploit within a (random) copy of a popular web malware exploitation kit? Now that's interesting given that there are other modified versions of the publicly available malware kit empowered with exploits as they get released, the single most logical move a administrator of such kit would do is diversity the exploits set as often as possible, keeping it up to date - like they do. ThreatCon is raised already :

    "Symantec honeypots have captured further exploitation of the Snapshot Viewer for Microsoft Access ActiveX Control Arbitrary File Download Vulnerability (BID 30114). Before this event, this exploit was known to be used only in isolated attacks. Further analysis of these honeypot compromises has revealed that the exploit has been added to a variant of the neosploit exploit kit, it will very likely reach a larger number of victims. This version will compromise vulnerable English versions of Microsoft Windows by downloading a malicious application into the Windows Startup folder. Computers that have Microsoft Access installed are potentially affected by this vulnerability. Customers are advised to manually set the kill bit on the following CLSIDs until a vendor update is available: F0E42D50-368C-11D0-AD81-00A0C90DC8D9 F0E42D60-368C-11D0-AD81-00A0C90DC8D9 F2175210-368C-11D0-AD81-00A0C90DC8D9"

    Why based on a random copy of the kit? Well, the Neosploit malware kit itself is a commodity despite it's publicly announced varying price in the thousands, it leaked for public use just like MPack and Icepack did originally, making statements on the exact type of the vulnerabilities included within a bit pointless, since it will only cover the the exploits included in a particular version only. Web malware exploitation kits are very modular, namely, anyone can introduce new exploits, and tweak them, which is what they've been doing for a while, mostly converging third party traffic management systems with the malware kits in order to improve both, the metrics, and the evasive practices used for making a particular campaign a bit more time consuming to analyze.

    Just like the innovations introduced within open source malware, and their localizations to native languages, the open source nature of web malware exploitation kit can result in countless number of variants whose new features make it sometimes difficult to assess whether or not it's a modified kit or an entirely new one - depending on the sophistication of the features of course. The introduction of new exploits within a copy of a particular malware kit should be considered as something logical, and if it's that big a deal, there are many other web malware exploitation kits whose features turn Neosploit into the "outdated choice" for malicious attackers.

    Related posts:
    The Zeus Crimeware Kit Vulnerable to Remotely Exploitable Flaw
    The Small Pack Web Malware Exploitation Kit
    Crimeware in the Middle - Zeus
    The Nuclear Grabber Kit
    The Apophis Kit
    The FirePack Exploitation Kit Localized to Chinese
    MPack and IcePack Localized to Chinese
    The FirePack Exploitation Kit - Part Two
    The FirePack Web Malware Exploitation Kit
    The WebAttacker in Action
    Nuclear Malware Kit
    The Random JS Malware Exploitation Kit
    Metaphisher Malware Kit Spotted in the Wild
    The Black Sun Bot
    The Cyber Bot
    Google Hacking for MPacks, Zunkers and WebAttackers
    The IcePack Malware Kit in Action
    ]]>     Tue, 15 Jul 2008 13:18:32 +0000 neosploit malware kit malware kit nuclear malware kit kit metaphisher malware kit icepack malware kit nuclear grabber kit apophis kit neosploit exploit kit The Neosploit Malware Kit Updated with Snapshot ActiveX Exploit     <![CDATA[Malware and Office Documents Joining Forces]]> http://securityratty.com/article/dee3d028ca8134c75e2aec7f397d1493 http://securityratty.com/article/dee3d028ca8134c75e2aec7f397d1493
    Common office files as documents, presentations, spreadsheets and PDF files, are the most widely abused ones in targeted attacks, which when backed up with enough personal information and take into consideration the time of their attack if the social engineering campaign is either going to be based on a current/upcoming event, or on an event anticipated due to information gathered through open source intelligence, often make it through common signature based scanning solutions.

    Despite the relatively easy to obtain, point'n'click DIY tools for backdooring common office files are available for the script kiddies to take advantage of, some are naturally remaining proprietary tools, making them harder to analyze unless a copy is obtained. Like this one, generating "undetected" by signatures based scanning, office documents and spreadsheets that would drop the actual malware on the PC.

    Automatic translation of its description and core features :

    "The program represents a generator OfficeJoiner macros in the language Visual Basic for Application (VBA), for introduction in the document Microsoft Office Word / Microsoft Office Excel executable file (win32 exe), followed by fully automatic recovery and launch, without any  additional action by the user. The only requirement that formed in such a way xls / doc files is to support  VBA macros on the computer end-user formed file and permission to launch macros.

    The program uses NOT a vulnerability (exploit) or macro-virus tools for the introduction, extraction or running embedded files. This means that it has generated macros compatible with ALL versions of Microsoft Office products starting with Microsoft Office 97 package, with any established "patches" and the service pack. Macros generated by this program not detected antivirus, for the simple reason that they are not viruses or macro viruses. The program uses only "established" means products built into Microsoft Excel VBA language to achieve their goals.

    - Fully automatic generation of macro for the introduction of documents word / excel any given exe-file with his persistence in the body and subsequent documents automatic recovery and launch, when opening a document word / excel. 

    - Generated macros are compatible with all versions of ms word / excel since version 97,  employments and regardless of the presence / absence of any patches / servicepacs. 

    - Generated macros are not macro-viruses, exploits do not use and do not contain any malicious code, so do not be detected by any antivirus tools as viruses. 

    - Conversion body ex-file macro happening in such a way that while in doc / xls file it not detected any antivirus, and can be freely sent by mail safely passed all checks, even if in itself contains viral code defined antivirus.
     
    - Sgenerirovanny and attached to the body of the document macro can be protected with a password or signed certificate, using funds established Microsoft Office, which does not affect him productivity or efficiency (macro, in any case remain fully workable). 

    - Box macro can be made both in the new document, and in any document containing data and-or other macros. Generated program code is fully compatible with any other embedded in the document macros or entering data, and will not interfere with their work, as well as maintain its efficiency.

    - Added auto-finding ways to extract exe-file;
     
    - Added possibility of a macro arbitrary text in the body of the instrument;
     
    - Optimized algorithm macro-generation code;
     
    Enabling this option will lead to the creation macro code, who himself will find a way to unpack and run embedded exe-file. Auto-search finds the current user folder and produces there extraction and launch embedded file. The peculiarity of this method is that this method will work on the computers of users with a limited account, because in its user folder in any case has the right to record / performance. Using this option is justified to improve the "punching" macro on computers with limited account or unknown file structure (let Windows installed on the disk is different from C).

    You can specify a name for final file independently, or leave blank, then the name will be generated automatically.

    On this possibility has asked for a user program, its essence is that after running a macro, retrieval and downloading exe-file the document with the introduction of exe-file will be withdrawn posed text. Perhaps in this way can improve the application of social engineering, designed to force the user to allow support for macros. For example, in the text of the document indicate:

    "This document contains hidden text (password, a system of calculation formulas, interactive components, etc.), Which can be viewed only after the inclusion of support macros. Please enable support for macros and re-opening this document ".

    After resolving support macros, and the implementation of embedded exe-file, the document will be withdrawn given a string containing probable "password" or any other textual information.     "

    Despite that the tool is proprietary, the underground economy's leaks are largely driven by bargain hunters who would exchange proprietary tool, whose often biased exclusiveness may increase the profit margins, for a service or a good that may be worthless for them in general, but impossible to obtain and take advantage of in the present. It will not just leak in one way or another, someone will inevitably backdoor the backdooring tool and trick the novice bargain hunters into running it, by having both their host infected and money taken.

    Related posts:
    The Underground Economy's Supply of Goods and Services
    Yet Another DIY Proprietary Malware Builder
    The Small Pack Web Malware Exploitation Kit - Proprietary
    DIY Exploit Embedding Tool - A Proprietary Release
    Skype Spamming Tool in the Wild - Proprietary Release
    ]]>     Mon, 14 Jul 2008 07:20:34 +0000 document document macros support enable support macro macro viruses support vba macros exe-file extract exe-file Malware and Office Documents Joining Forces     <![CDATA[Interview on IMI Tech Talk / KFNX: Cloud Computing and Security]]> http://securityratty.com/article/c482caee5a3d90ea348672b0420ed1a8 http://securityratty.com/article/c482caee5a3d90ea348672b0420ed1a8 KFNX Radio LogoIMI Techtalk

    A quick post to say a very warm welcome to IMI Tech Talk / KFNX listeners!

    I was recently approached to take part in an interview about Cloud Computing and Security on IMI Tech Talk, broadcast on KFNX News Talk Radio.  KFNX is a US based radio station based out of Phoenix, Arizona.  More in-depth than the previous opportunity, a range of Cloud Computing technologies were discussed in the 30 minute segment:

    • Who am I?
    • What is cloud computing? (*that* question!).
    • Introduction to virtualization.
    • Examples of cloud computing services that exist today.
    • Barriers to entry.
    • Security issues of processing or storing data in the cloud
    • cloudsecurity.org
    I will update this post when the audio archive of the show is posted.

    I did mention I would provide links to useful Cloud Computing resources (as my mind went totally blank during the interview!) - watch for a post next week covering the blogs I read regularly.

    Cloudsecurity.org was born as I couldn’t find any dedicated web resource discussing Cloud Computing and Security.  If there are subjects you want to see covered, feel free to leave a suggestion in the Skribit sidebar to the right.

    I do welcome comments in response to blog posts on the blog itself - don’t be shy :-).

    For private communications I can be reached at craig.balding@gmail.com.

    My thanks to the IMI Tech Talk team, particularly Tom and Eric.

    Enjoy the blog,

    Craig

    ]]>     Sun, 06 Jul 2008 17:59:05 +0000 cloud imi tech talk tech talk security kfnx blog posts post quick post interview Interview on IMI Tech Talk / KFNX: Cloud Computing and Security     <![CDATA[A primer on the Exchange Server 2007 Exchange Management Shell]]> http://securityratty.com/article/848f13e4c62f5f6b7c54b8503abbff65 http://securityratty.com/article/848f13e4c62f5f6b7c54b8503abbff65 ]]> Wed, 02 Jul 2008 06:40:33 +0000 exchange management shell exchange server basic ems commands ems tutorial introduction wary A primer on the Exchange Server 2007 Exchange Management Shell <![CDATA[WiMAX security]]> http://securityratty.com/article/4392823336ec82c07d3685ebbf07024d http://securityratty.com/article/4392823336ec82c07d3685ebbf07024d ]]> Thu, 26 Jun 2008 04:02:38 +0000 wimax security wimax services users wimax radio technology article discuss wimax devices users access services final article WiMAX security <![CDATA[CEE White Paper Out (Finally!!!!!!!!!!)]]> http://securityratty.com/article/f81bff7958be65fc263c00efe45a89da http://securityratty.com/article/f81bff7958be65fc263c00efe45a89da
    In any case, Common Event Expression (CEE) standard takes a major step forward: our whitepaper is finally public (page, PDF)

    "Provides a detailed introduction to the Common Event Expression (CEE) initiative to create an open community-developed event interoperability standard for electronic systems. The paper describes the scope of the problem; explains how CEE’s Common Log Transport (CLT), Common Log Syntax (CLS), Common Event Expression Taxonomy (CEET), and Common Event Log Recommendations (CELR) will provide the framework for a community consensus in log transportation, log syntax, event representation, and event logging recommendations for various log sources and scenarios; examines the benefits and illustrates them in two use cases; reviews CEE in comparison to past efforts; and offers a roadmap to creating the CEE Language Specifications."

    We have been working on this baby for a long time, but it was "in approval" for loooonger....
    About me: http://www.chuvakin.org
    ]]>     Fri, 20 Jun 2008 07:23:00 +0000 cee event event representation common event expression reviews cee cee language specifications log syntax common log syntax standard CEE White Paper Out (Finally!!!!!!!!!!)