<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: maximum]]></title>
    <link>http://securityratty.com/tag/maximum</link>
    <description></description>
    <pubDate>Wed, 25 Jun 2008 10:01:44 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Wee-Fi: Houston-Fi, ASCII WPA Passphrases, Green Wi-Fi]]></title>
      <link>http://securityratty.com/article/7f30d96346f66d41619e4abd9bae8e7d</link>
      <guid>http://securityratty.com/article/7f30d96346f66d41619e4abd9bae8e7d</guid>
      <description><![CDATA[Houston flips switch on free downtown Wi-Fi: Dwight Silverman of the Houston Chronicle accidentally discovers the soft launch of the network funded by EarthLink's $5m default fee. (The fee was paid...]]></description>
      <content:encoded><![CDATA[<p><img src="http://wifinetnews.com/images/weefi.jpg" align="right" border="0" hspace="5" /><a href="http://blogs.chron.com/techblog/archives/2008/08/it_lives_city_of_houston_turns_on_free_downto.html"><strong>Houston flips switch on free downtown Wi-Fi:</strong></a> Dwight Silverman of the Houston Chronicle accidentally discovers the soft launch of the network funded by EarthLink's $5m default fee. (The fee was paid when they missed a milestone, and the firm later walked away.) The downtown area now has a limited pilot project that's free; the real effort in Houston is supposed to be at 10 housing projects and in parks where service would be used to bridge the digital divide and improve the quality of life. How, exactly, is part of what's being tested.</p>

<p><a href="http://www.sfgate.com/cgi-bin/article.cgi?f=/c/a/2008/08/18/MNH312BTS1.DTL&hw=wi+fi&sn=004&sc=589"><strong>That's ASCII, not hex:</strong></a> An article on wardriving raises security hackles by repeating some slightly overheated statements about Wi-Fi security. The article opens with a 63-character ASCII WPA passphrase, which is later described as "hex." (ASCII passphrases in WPA can be up to 63 "printable" characters - ASCII 32 to 127 - while a hex version of a 256-bit TKIP or AES password is 64 hexadecimal digits long.) The article tries to conflate Wi-Fi attacks that led to the largest set of breaches in retail credit-card systems and wardriving, a hobbyist activity that's never been looked on very favorably by law enforcement. The sense of ennui of wardriving pioneers is pretty clear; when Wi-Fi is everywhere and generally secured, it's far less interesting. The wardriver in the article convinced the reporter that a maximum-length WPA passphrase stored on a USB drive for automatic use was the best way to go. But, really, 20 characters containing letters and punctuation and no words found in a dictionary along with changing your network's SSID (network name) provides all the security you'll ever need for a home or small business. (If you need more, deploy WPA/WPA2 Personal.)</p>

<p><a href="http://www.sfgate.com/cgi-bin/article.cgi?f=/c/a/2008/08/16/BUA712BH1O.DTL&hw=wi+fi&sn=001&sc=1000"><strong>Green Wi-Fi's Senegal efforts hit snags:</strong></a> The folks at Green Wi-Fi are well motivated, and they're running up against all forms of security theater and bureaucracy both here and in Senegal, where they have an active project. The San Francisco Chronicle notes the group's effort to build solar-powered, self-sustaining Internet access via mesh networked nodes. Getting devices out of the country, clearing customs in Senegal, and hooking up their solar system all hit problems they're working through. As with the One Laptop Per Child program, I see a "build it and they will come" mentality in <a href="http://www.green-wifi.org/"><strong>Green Wi-Fi's mission statement</strong></a>: the notion that providing computing power and Internet access will result in good things, rather than an effort to figure out what good things need to be achieved, and whether computers and the Internet will assist. </p>]]></content:encoded>
      <pubDate>Tue, 19 Aug 2008 06:26:25 +0000</pubDate>
      <category domain="http://securityratty.com/tag/wi-fi">wi-fi</category>
      <category domain="http://securityratty.com/tag/wi-fi attacks">wi-fi attacks</category>
      <category domain="http://securityratty.com/tag/houston">houston</category>
      <category domain="http://securityratty.com/tag/wi-fi security">wi-fi security</category>
      <category domain="http://securityratty.com/tag/free downtown wi-fi">free downtown wi-fi</category>
      <category domain="http://securityratty.com/tag/free">free</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/ascii">ascii</category>
      <category domain="http://securityratty.com/tag/security theater">security theater</category>
      <source url="http://wifinetnews.com/archives/008423.html">Wee-Fi: Houston-Fi, ASCII WPA Passphrases, Green Wi-Fi</source>
    </item>
    <item>
      <title><![CDATA[ASP.NET Health Monitoring doesn't log inner exception stack trace]]></title>
      <link>http://securityratty.com/article/b3299c7401f4189ad9619ab42a4a438e</link>
      <guid>http://securityratty.com/article/b3299c7401f4189ad9619ab42a4a438e</guid>
      <description><![CDATA[This can be a problem, especially when an ObjectDataSource starts throwing exceptions. The stack trace looks the same because of the way the methods are invoked (via reflection) - you end up with a...]]></description>
      <content:encoded><![CDATA[<p>This can be a problem, especially when an ObjectDataSource starts throwing exceptions. The stack trace looks the same because of the way the methods are invoked (via reflection) - you end up with a stack trace for a TargetInvocationException, which basically says, &quot;I used reflection to invoke some method, and it threw an exception. See the inner exception for details.&quot;</p>
<p>ASP.NET&#39;s health monitoring system does list the inner exceptions (apparently up to a maximum depth of two, from spelunking the code with <a href="http://www.aisto.com/roeder/dotnet/">reflector</a>), but it does not emit the stack traces for these exceptions, which would be <i>really helpful</i>. I&#39;ve spent some time this morning trying to figure out how I&#39;d customize things to emit this, and it looks like what I&#39;d have to do is catch the exception and generate a custom WebEvent that overrides ToString(bool, bool) and does everything that WebRequestErrorEvent does, but also generate the inner stack trace.</p>
<p>That seems a bit ugly. A search for &quot;ASP.NET web event inner exception stack trace&quot; yielded no interesting results, so if you&#39;ve dealt with this and have a cleaner solution, let me know. I&#39;ll post my solution once I get it worked out.</p><div style="clear:both;"></div><img src="http://www.pluralsight.com/community/aggbug.aspx?PostID=52306" width="1" height="1">]]></content:encoded>
      <pubDate>Fri, 01 Aug 2008 12:21:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/exception stack trace">exception stack trace</category>
      <category domain="http://securityratty.com/tag/exception">exception</category>
      <category domain="http://securityratty.com/tag/stack trace">stack trace</category>
      <category domain="http://securityratty.com/tag/net">net</category>
      <category domain="http://securityratty.com/tag/net web event">net web event</category>
      <category domain="http://securityratty.com/tag/asp">asp</category>
      <category domain="http://securityratty.com/tag/exceptions">exceptions</category>
      <category domain="http://securityratty.com/tag/solution">solution</category>
      <category domain="http://securityratty.com/tag/cleaner solution">cleaner solution</category>
      <source url="http://www.pluralsight.com/community/blogs/keith/archive/2008/08/01/asp-net-health-monitoring-doesn-t-log-inner-exception-stack-trace.aspx">ASP.NET Health Monitoring doesn't log inner exception stack trace</source>
    </item>
    <item>
      <title><![CDATA[Email Hacking Going Commercial]]></title>
      <link>http://securityratty.com/article/c942d386cfed24bfc702c39e34ba0eea</link>
      <guid>http://securityratty.com/article/c942d386cfed24bfc702c39e34ba0eea</guid>
      <description><![CDATA[This email hacking as a service offering is the direct result of the public release of a DIY hacking kit consisting of each and every publicly known vulnerability for a variety of web based email...]]></description>
      <content:encoded><![CDATA[<a href="http://bp1.blogger.com/_wICHhTiQmrA/SIb2scvQlJI/AAAAAAAAB80/xZ9U_kM3uFY/s1600-h/email_hacking_for_hire.png" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp1.blogger.com/_wICHhTiQmrA/SIb2scvQlJI/AAAAAAAAB80/h8JpVAHsl1E/s200-R/email_hacking_for_hire.png" style="border: 0pt none ;" /></a>This email hacking as a service offering is the direct result of the public release of a <a href="http://ddanchev.blogspot.com/2008/04/web-email-exploitation-kit-in-wild.html">DIY hacking kit consisting of each and every publicly known vulnerability for a variety of web based email service providers</a>, with the idea to make it easier for someone to execute their attacks more efficiently. Outsource the hacking of someone's email, and receive a proof in the form of a screenshot of the inbox, next to a guarantee that you'll be able to get back in even after they've changed their passwords? Too good to be true, but since they only charge after they provide you with a proof that they did the job, they could be in fact attempting to hack these emails, compared to the majority of cases where scammers scam the scammers. The service works in 7 steps :<br />
<br />
"<i><b>1-</b> Submit your case to one of our experts.<br />
<b>2-</b> After successful submission , you will be sent a confirmation email along with your Case Reference Number (CRN) .<br />
<b>3-</b> Our expert(s) will revert back to you in a few minutes with the details, the charges &amp; the turn-around time. You may also be asked to provided additional information through a private form if required by our expert.<br />
<b>4-</b> Once our expert has all the required information, you will be provided a username/password to our client area where you can view the real-time progress of your case.<br />
<b>5-</b> Within a matter of hours (maximum 72 hrs), you can see the results. Our expert will provide you with proof-of-success , which you can verify and confirm.<br />
<b>6- </b>Once you have verified the authenticity of success, you will be sent detailed payment instructions. You will be asked to pay using anyone of our multiple payment methods.<br />
<b>7-</b> Once the payment is realized, we will provide you the requisite information</i>"<br />
<br />
<a href="http://bp1.blogger.com/_wICHhTiQmrA/SIgn4G_LUJI/AAAAAAAAB9E/gUjdnUIhb2I/s1600-h/email_hacking_for_hire2.png" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp1.blogger.com/_wICHhTiQmrA/SIgn4G_LUJI/AAAAAAAAB9E/K90KY6BFmtc/s200-R/email_hacking_for_hire2.png" style="border: 0pt none ;" /></a>Who's doing the actual email hacking? Independent contractors on behalf of the service as it looks like :<br />
<br />
"<i>Most other groups employ phishing , trojans or viruses which could damage or even alert the target. Our experts use techniques which are developed by themselves , not shared by anyone. We don't ask them how they do it, but as long as they provide us the desired results, its ok for us. Since we test their methods while they are on probation period with us, we check if the target is being alerted or not. As of now, for the past 4 years, we have NOT RECEIVED A SINGLE COMPLAINT IN THIS REGARD, which is testimonial to the ingenuity of the methods used by CSP.</i>"<br />
<br />
How would they prove that they've managed to hack the email account before requesting the payment?<br />
<br />
"<i><b>1-</b> Multiple screenshots of the mailbox<br />
<b>2-</b> A copy of your own email which you had sent to the target<br />
<b>3-</b> A copy / part of the address-book of the target mailbox.</i>"<br />
<br />
Ironically, a hypothetical questionarry that I once speculated a private detection would require from someone interested in <a href="http://ddanchev.blogspot.com/2007/04/outsourcing-spying-on-your-wife.html">Outsourcing The Spying on Their Wife</a>, in order to set the foundations for a successful social engineering attack, is being used by the email hacking group.<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=BtCtQJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=BtCtQJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=3ICiRJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=3ICiRJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=sz7zbj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=sz7zbj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=a0Galj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=a0Galj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=OnvMKJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=OnvMKJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=u7PbTJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=u7PbTJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=6TRHXj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=6TRHXj" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/344330657" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 23 Jul 2008 22:04:48 +0000</pubDate>
      <category domain="http://securityratty.com/tag/email">email</category>
      <category domain="http://securityratty.com/tag/confirmation email">confirmation email</category>
      <category domain="http://securityratty.com/tag/methods">methods</category>
      <category domain="http://securityratty.com/tag/multiple payment methods">multiple payment methods</category>
      <category domain="http://securityratty.com/tag/actual email">actual email</category>
      <category domain="http://securityratty.com/tag/payment">payment</category>
      <category domain="http://securityratty.com/tag/email account">email account</category>
      <category domain="http://securityratty.com/tag/mailbox">mailbox</category>
      <category domain="http://securityratty.com/tag/target mailbox">target mailbox</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/344330657/email-hacking-going-commercial.html">Email Hacking Going Commercial</source>
    </item>
    <item>
      <title><![CDATA[Are you using the latest web browser?]]></title>
      <link>http://securityratty.com/article/f99696393f35efc81b36eae37200a248</link>
      <guid>http://securityratty.com/article/f99696393f35efc81b36eae37200a248</guid>
      <description><![CDATA[Written by Thomas Duebendorfer

In view of mass defacements of hundreds of thousand of web pages - with the intent to misuse them to launch drive-by download attacks - security researchers from ETH...]]></description>
      <content:encoded><![CDATA[<span class="byline-author">Written by Thomas Duebendorfer</span><br /><br />In view of mass defacements of hundreds of thousand of web pages - with the intent to misuse them to launch drive-by download attacks - security researchers from ETH Zurich, Google, and IBM Internet Security Systems were interested in looking at the other side of the attack: the web browser. By analyzing the web browser versions seen in visits to Google websites, they have shown that more than 600 million Internet users don't use the latest version of their browser.<br /><br /><b>Slow migration to latest browser version</b><br />The researchers' paper, entitled <a href="http://www.techzoom.net/insecurity-iceberg">"Understanding the Web Browser Threat"</a>, shows that as of June 2008, only 59.1% percent of Internet users worldwide use the latest major version of their preferred web browser. Firefox users are the most attentive: 92.2% of them surfed with Firefox 2, the latest major version before the recently released 3.0. Only 52.5% of Microsoft Internet Explorer users have updated to version 7, which is the most secure according to multiple publicly-cited Microsoft experts (among them Sandi Hardmeier). The study revealed that 637 million Internet users worldwide who use web browsers are either not running the latest version of their preferred browser or have not installed the latest patches. These users are vulnerable to exploitation due to their web browser's "built-in" vulnerabilities and the lack of more recent security mechanisms such as improved phishing protection.<br /><br /><b>Neglected security patches</b><br />Over the past 18 months, the study also shows, a maximum of 83.3% of Firefox users were using the latest major version of the web browser and also had all current patches installed (i.e. latest minor version). Only 56.1% and 47.6% of Opera and Internet Explorer users, respectively, were similarly utilizing fully-patched web browsers. Apple users are no better: since the public release of Safari 3, only 65.3% of users operate the latest Safari version.<br /><br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://bp1.blogger.com/_LMSk7hTEaIE/SH5ZvdukCtI/AAAAAAAAd10/-yGf2De4l8I/s1600-h/share.png"><img style="cursor: pointer;" src="http://bp1.blogger.com/_LMSk7hTEaIE/SH5ZvdukCtI/AAAAAAAAd10/-yGf2De4l8I/s400/share.png" alt="" id="BLOGGER_PHOTO_ID_5223711289765006034" border="0" /></a><br /><div><em>Maximum measured share of users surfing the web with the most secure versions of Firefox, Safari, Opera and Internet Explorer in June 2008 as seen on Google websites.</em></div><br /><br /><b>Obsolete browser warning</b><br />The study's most important finding is that technical measures now in place do not sufficiently guarantee browser security, and that users' security awareness must be further developed. The problem is that most users are unaware that they are not using their browser's latest version. It must be made clear to web browser users that outdated software is associated with significantly higher risk. The researchers therefore suggest that, as a critical component of web software, a visible warning be instituted that warns the user of missing security patches in a way analogous to the 'best before' date in the perishable food industry. Software updates must also be made easier to find. The resulting transparency would go far in contributing to end user awareness of software weaknesses, and allow users to better evaluate risks.<br /><br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://bp0.blogger.com/_LMSk7hTEaIE/SH5aAEVMy0I/AAAAAAAAd18/nXMAqQdWXno/s1600-h/expired.png"><img style="cursor: pointer;" src="http://bp0.blogger.com/_LMSk7hTEaIE/SH5aAEVMy0I/AAAAAAAAd18/nXMAqQdWXno/s400/expired.png" alt="" id="BLOGGER_PHOTO_ID_5223711575005514562" border="0" /></a><br /><div><em>Example "best before" implementation on a Web browser</em></div><br /><br />As a side effect, having users migrate faster to the latest browser version would not only increase security but also make the lives of webmasters easier, as they would need to test and optimize websites for fewer older versions of web browsers.<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/GoogleOnlineSecurityBlog?a=JC3YMJ"><img src="http://feeds.feedburner.com/~f/GoogleOnlineSecurityBlog?i=JC3YMJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/GoogleOnlineSecurityBlog?a=Tt44Ej"><img src="http://feeds.feedburner.com/~f/GoogleOnlineSecurityBlog?i=Tt44Ej" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/GoogleOnlineSecurityBlog/~4/337403441" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 16 Jul 2008 09:24:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/browser">browser</category>
      <category domain="http://securityratty.com/tag/web browser">web browser</category>
      <category domain="http://securityratty.com/tag/browser version">browser version</category>
      <category domain="http://securityratty.com/tag/versions">versions</category>
      <category domain="http://securityratty.com/tag/secure versions">secure versions</category>
      <category domain="http://securityratty.com/tag/obsolete browser">obsolete browser</category>
      <category domain="http://securityratty.com/tag/web browser versions">web browser versions</category>
      <category domain="http://securityratty.com/tag/web browser users">web browser users</category>
      <category domain="http://securityratty.com/tag/web">web</category>
      <source url="http://feeds.feedburner.com/~r/GoogleOnlineSecurityBlog/~3/337403441/are-you-using-latest-web-browser.html">Are you using the latest web browser?</source>
    </item>
    <item>
      <title><![CDATA[Homer Simpson and the Kimya Botnet]]></title>
      <link>http://securityratty.com/article/decf0db42925ceff37d1b75ae34d14df</link>
      <guid>http://securityratty.com/article/decf0db42925ceff37d1b75ae34d14df</guid>
      <description><![CDATA[Television often relies on fake codes, phone-numbers and addresses to make up part of their fictional worlds. Sometimes, it can go slightly wrong - how many people tried to call Doctor Who last week
...]]></description>
      <content:encoded><![CDATA[
        Television often relies on fake codes, phone-numbers and addresses to make up part of their fictional worlds. Sometimes, it can go slightly wrong - <i>how many</i> people tried to <a href="http://www.telegraph.co.uk/news/newstopics/celebritynews/2261219/Doctor-Who-phone-number-has-fans-in-frenzy.html">call Doctor Who</a> last week?<br /><br />D'oh.<br /><br />Actually, "D'oh" is rather appropriate here. In an old episode of The Simpsons, it was revealed that Chunkylover53@aol.com was Homers Email address. Of course, every Simpsons fan with net access immediately added Chunkylover53 to their AIM contact list. As <a href="http://snpp.com/guides/internet.html">this article</a> points out....<br /><br /><i>Homer's e-mail address chunkylover53@aol.com, as seen on EABF03, was registered by writer-producer Matt Selman, who also replied to e-mails from fans testing it. "He logged in the night that the episode aired and it was immediately filled with the maximum number of responses. He's tried to answer every one of them and then as soon as he answers a hundred, a hundred more pop in," Al Jean told the New York Post in January 2003.</i><br /><br />The "Chunkylover53" AIM screen-name hasn't logged in for quite some time, apparently. Imagine the puzzled expressions worn by Simpsons fans when, all of a sudden, the account came back to life in the last few days with this in their "Away" message....<br /><br /><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="kimya0.gif" src="http://blog.spywareguide.com/images/kimya0.gif" class="mt-image-none" style="" height="203" width="526" /></span>
<br /><br />...yes, "Homer" has seemingly returned, and he comes bearing infection files!<br /><br />Of course, the "exclusive Simpsons episode" is nothing of the kind - what you <i>actually</i> download is a file about 150kb in size, and it looks like this:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="kimya1.jpg" src="http://blog.spywareguide.com/images/kimya1.jpg" class="mt-image-none" style="" height="65" width="63" /></span></div><br /><br />Run the file, and you won't see a new Simpsons episode - you're actually more likely to see this:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="kimya2.jpg" src="http://blog.spywareguide.com/images/kimya2.jpg" class="mt-image-none" style="" height="124" width="305" /></span></div><br /><br /> <div>....a strange error message that mentions "photos" (probably fake), followed by lots of real error messages as most of your desktop fails, leaving you with an entirely blank screen:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="kimya3.jpg" src="http://blog.spywareguide.com/images/kimya3.jpg" class="mt-image-none" style="" height="141" width="217" /></span></div><br /></div><div><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/kimya4.html" onclick="window.open('http://blog.spywareguide.com/images/kimya4.html','popup','width=736,height=531,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/kimya4-thumb-336x242.jpg" alt="kimya4.jpg" class="mt-image-none" style="" height="242" width="336" /></a></span></div><br /></div><div><div align="center">Click to Enlarge (if you really must!)<br /></div><br />From this point onwards, the PC will likely need a reboot and will be sluggish until cleaned up, constantly throwing out error messages, crashing when attempting to open Windows Explorer etc.<br /><br />Now, given that the infection links are being passed around via IM Away messages, there was always going to be the possibility of an Instant Messaging worm attack. However, a lot of testing has taken place and so far, we haven't seen any malicious messages or URLs sent via AIM or MSN Messenger.<br /><br />That's no reason to get complacent though, because what we have seen taking place is possibly quite a bit worse. First of all, a number of hidden files are dropped onto the PC, including Rootkit technology (which the bad guys have helpfully pointed out in the code):<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="rootkitkim.jpg" src="http://blog.spywareguide.com/images/rootkitkim.jpg" class="mt-image-none" style="" height="175" width="180" /></span></div><br /><br />Worse, your PC is deposited into a Botnet of Turkish origin - here's the giveaway traffic stream via an Ethereal log:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="kimyabots.gif" src="http://blog.spywareguide.com/images/kimyabots.gif" class="mt-image-none" style="" height="38" width="475" /></span></div><br /><br />....awaiting further instructions from the Botnet C&amp;C center. This particular Botnet has been around since March of this year. The Turkish connection is interesting, because I haven't seen too many Turkish Botnets - and there's been quite a surge in hacking activity from Turkey recently (most notably the <a href="http://www.channelregister.co.uk/2008/06/18/photobucket_dns_hack/">DNS attacks</a> on Photobucket and ICAAN by NeTDevilz).<br /><br />Finally, the infection drops a number of other files onto the PC besides the Rootkit, which are seemingly related to a new variant of <a href="http://www.spywareguide.com/product_show.php?id=5470">this Chinese infection</a>.<br /><br />It's worth noting that there may only be Instant Messaging infection links sent out if the person running the Botnet Command Center decides to issue all the drones with such a command - so while we haven't seen any IM infection activity, it would be wise not to rule it out completely. We recommend infected users keep an eye on all Instant Messaging activity until they can clean the infection from their computer, just in case.<br /><br />Whoever is responsible for these messages has changed them a couple of times already - last night, the download link had been updated to look like this:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="kimya66.gif" src="http://blog.spywareguide.com/images/kimya66.gif" class="mt-image-none" style="" height="372" width="406" /></span></div><br /><br />...and it currently advertises a link for a dating website:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="chunkyaway.jpg" src="http://blog.spywareguide.com/images/chunkyaway.jpg" class="mt-image-none" style="" height="53" width="288" /></span></div><br /><br />We've reported all links related to this attack, and at least two of the files claiming to be "exclusive Simpsons episodes" are currently offline, though there's bound to be more out there. For now, this is a good reminder to be cautious when randomly adding cool things seen on TV and film to your online applications - you can't always assume the person at the other end is entirely in control.<br /><br />We detect this as <a href="http://www.spywareguide.com/spydet_31515_kimya.html">Kimya</a>.<br /><br />Additional Research: Chris Mannon, FSL Senior Threat Researcher<br />Deepak Setty, FSL Senior Threat Research Engineer<br /></div>
        
    ]]></content:encoded>
      <pubDate>Fri, 11 Jul 2008 13:46:17 +0000</pubDate>
      <category domain="http://securityratty.com/tag/simpsons">simpsons</category>
      <category domain="http://securityratty.com/tag/simpsons fan">simpsons fan</category>
      <category domain="http://securityratty.com/tag/simpsons fans">simpsons fans</category>
      <category domain="http://securityratty.com/tag/exclusive simpsons episode">exclusive simpsons episode</category>
      <category domain="http://securityratty.com/tag/infection">infection</category>
      <category domain="http://securityratty.com/tag/infection files">infection files</category>
      <category domain="http://securityratty.com/tag/real error messages">real error messages</category>
      <category domain="http://securityratty.com/tag/error messages">error messages</category>
      <category domain="http://securityratty.com/tag/infection activity">infection activity</category>
      <source url="http://blog.spywareguide.com/2008/07/who-hacked-homer.html">Homer Simpson and the Kimya Botnet</source>
    </item>
    <item>
      <title><![CDATA[ICANN's Announcement Of Anti-Domain Tasting Measures To Registrars]]></title>
      <link>http://securityratty.com/article/913d52903ceaedff758808be4b11d5bf</link>
      <guid>http://securityratty.com/article/913d52903ceaedff758808be4b11d5bf</guid>
      <description><![CDATA[The recent new that ICANN had taken measures to combat Domain Tasting came out in blogs, such as this one , based on second-hand news. ICANN had sent an e-mail to registrars announcing the policy...]]></description>
      <content:encoded><![CDATA[The recent new that ICANN had taken measures to combat Domain Tasting came out in blogs, <a href="http://www.domainnamenews.com/miscellaneous/icann-board-resolution-kills-domain-tasting/1689">such as this one</a>, based on second-hand news. ICANN had sent an e-mail to registrars announcing the policy change. But there was confusion over exactly what the policy was; most people just assumed it followed the recommendations of the GNSO council from April.  The incomplete information caused some confused analysis such as <a href="http://www.cadna.org/en/newsroom/press-releases/icann-tasting-solution">this from CADNA (the Coalition Against Domain Name Abuse)</a>.

I asked ICANN and they sent me the actual e-mail that they sent out to registrars. It is published below. My analysis of it is in <a href="http://www.eweek.com/c/a/Security/Yes-Domain-Tasting-Will-End/">a column on eWEEK</a>.

<blockquote>
Dear Registrar,

This message is intended to explain how certain decisions that were made by the ICANN Board of Directors at its meeting in Paris last week may affect your registrar.

Specifically, the Board adopted GNSO recommendations on domain tasting that included both budget and non-budget provisions designed to restrict the applicability of the Add Grace Period (AGP).  Please note that this message is a summary of changes that affect registrars.  You should refer to the adopted budget document and adopted motions for further information.


Summary of Important Timing Issues

After several months of discussion and public comment on both the budget and the GNSO recommendations, the Board has approved the proposed budget containing a provision for collecting transaction fees above a threshold during the AGP.  Effective 1 July 2008, the registrar-level transaction fee will be collected on transactions, including names added on or after 1 July
2008 and deleted during the Add Grace Period above a certain minimum threshold.  Each "transaction" will continue to be defined as a one-year domain registration increment caused by a successful add, renewal or transfer command, but this year any domain names deleted during the AGP (if
offered)
will be included as transactions if they exceed the maximum of (i) 10% of that registrar's net new registrations in that month (defined as total new registrations less domains deleted during AGP), or (ii) fifty (50) domain names, whichever is greater.  The budget assumes the transaction fee rate will remain at US ./send.20.

The second change prohibits registries from issuing refunds above a similar threshold for names registered and deleted during the AGP (although some registries have made plans to charge for such transactions independent of this motion).  The implementation timing of this change has not been set, but should be expected to take place over a period of some months.  ICANN staff will solicit public comments and post a registrar advisory prior to implementation of this aspect of the GNSO recommendation.


Budget - Registrar Fees Effective 1 July 2008

The Operating Plan and Budget details for 2008-2009 fiscal year can be found at:

http://www.icann.org/en/financials/proposed-opplan-budget-v3-fy09-25jun0
8-en.pdf

Relevant section from the approved budget:

* Registrar-Level Transaction Fees

In FY08 the per transaction-year rate was ./send.20 (or a 5 cent discount from the established ./send.25 rate).  The draft FY09 budget assumes that the ./send.20 rate will continue for registrar transaction fees.  As in past years, each transaction will be defined as one-year domain registration increment caused by a successful add renewal or transfer command.  FY09 revenue is estimated to be .4 million for registrar-level transaction fees.  Each "transaction"
will continue to be defined as a one-year domain registration increment caused by a successful add, renewal or transfer command, but this year any domain names deleted during the AGP (if offered) will be included as transactions if they exceed the maximum of (i) 10% of that registrar's net new registrations in that month (defined as total new registrations less domains deleted during AGP), or (ii) fifty (50) domain names, whichever is greater.  Therefore per-transaction fee will continue to be charged for each one-year increment of every transaction (e.g.  at a ./send.20 fee level, the fee for a three-year renewal will be US ./send.60), and registrars will continue to have the option to "defer" payment of the fees for the years beyond one for each transaction.  n

Note, as in previous years, ICANN can collect such fees directly from the registrars only if they are "expressly approved by registrars who account, in the aggregate, for payment of two-thirds of all registrar-level fees collected by ICANN." ICANN will shortly undertake the process of requesting such approval for the 2008-09 fiscal year.  While ICANN is grateful for consistent approval by registrars of fee levels in prior years, and is optimistic about such approval this year, if for some reason the necessary approval is not achieved, the fees will be collected by ICANN, as permitted under the registry agreements through the registries.  (Note that the amount of such fees varies by registry, but in no case exceeds US ./send.25.) Registries will then be able to collect those payments from registrars to the extent permitted under the relevant contracts.  It is expected that the same transaction increments (including AGP) will be covered, whether collected directly by ICANN or in! directly by the registries, so registrars should anticipate this liability under either scenario.


ICANN Board Resolution

Whereas, ICANN community stakeholders are increasingly concerned about domain tasting, which is the practice of using the add grace period (AGP) to register domain names in bulk in order to test their profitability.

Whereas, on 17 April 2008, the GNSO Council approved, by a Supermajority vote, a motion to prohibit any gTLD operator that has implemented an AGP from offering a refund for any domain name deleted during the AGP that exceeds 10% of its net new registrations in that month, or fifty domain names, whichever is greater.  <http://gnso.icann.org/meetings/minutes-gnso-17apr08.shtml>

Whereas, on 25 April 2008, the GNSO Council forwarded its formal "Report to the ICANN Board - Recommendation for Domain Tasting"
<http://gnso.icann.org/issues/domain-tasting/domain-tasting-board-report
-gnso-council-25apr08.pdf>,
which outlines the full text of the motion and the full context and procedural history of this proceeding.

Whereas, the Board is also considering the Proposed FY 09 Operating Plan and Budget <http://www.icann.org/financials/fiscal-30jun09.htm>, which includes (at the encouragement of the GNSO Council) a proposal similar to the GNSO policy recommendation to expand the applicability of the ICANN transaction fee in order to limit domain tasting.

Resolved (2008.06.26.06), the Board adopts the GNSO policy recommendation on domain tasting, and directs staff to implement the policy following appropriate comment and notice periods on the implementation documents.


Domain tasting motion approved by the GNSO Council 17 April 2008

<http://gnso.icann.org/issues/domain-tasting/domain-tasting-board-report
-gnso-council-25apr08.pdf>

Whereas, the GNSO Council has discussed the Issues Report on Domain Tasting and the Final Outcomes Report of the ad hoc group on Domain Tasting;

Whereas, the GNSO Council resolved on 31 October 2007 to launch a PDP on Domain Tasting;

Whereas, the GNSO Council authorized on 17 January 2008 the formation of a small design team to develop a plan for the deliberations on the Domain Tasting PDP (the "Design Team"), the principal volunteers to which had been members of the Ad Hoc Group on Domain Tasting and were well-informed of both the Final Outcomes Report of the Ad Hoc Group on Domain Tasting and the GNSO Initial Report on Domain Tasting (collectively with the Issues Report, the "Reports on Domain Tasting");

Whereas, the GNSO Council has received the Draft Final Report on Domain Tasting;

Whereas, PIR, the .org registry operator, has amended its Registry Agreement to charge an Excess Deletion Fee; and both NeuStar, the .biz registry operator, and Afilias, the .info registry operator, are seeking amendments to their respective Registry Agreements to modify the existing AGP;

The GNSO Council recommends to the ICANN Board of Directors that:

1.  The applicability of the Add Grace Period shall be restricted for any gTLD which has implemented an AGP ("Applicable gTLD Operator").
Specifically, for each Applicable gTLD Operator:

  a.  During any given month, an Applicable gTLD Operator may not offer any
  refund to a registrar for any domain names deleted during the AGP that
  exceed (i) 10% of that registrar's net new registrations in that month
  (defined as total new registrations less domains deleted during AGP), or
  (ii) fifty (50) domain names, whichever is greater.

  b.  A Registrar may seek an exemption from the application of such
  restriction in a specific month, upon the documented showing of
  extraordinary circumstances.  For any Registrar requesting such an
  exemption, the Registrar must confirm in writing to the Registry Operator
  how, at the time the names were deleted, these extraordinary circumstances
  were not known, reasonably could not have been known, and were outside of
  the Registrar's control.  Acceptance of any exemption will be at the sole
  reasonable discretion of the Registry Operator, however "extraordinary
  circumstances" which reoccur regularly will not be deemed extraordinary.

  c.  In addition to all other reporting requirements to ICANN, each
  Applicable gTLD Operator shall identify each Registrar that has sought an
  exemption, along with a brief descriptive identification of the type of
  extraordinary circumstance and the action (if any) that was taken by the
  Applicable gTLD Operator.

2.  Implementation and execution of these recommendations shall be monitored by the GNSO.  Specifically;

  a.  ICANN Staff shall analyze and report to the GNSO at six month intervals
  for two years after implementation, until such time as the GNSO resolves
  otherwise, with the goal of determining;

    i.  How effectively and to what extent the policies have been implemented
    and followed by Registries and Registrars, and

    ii.  Whether or not modifications to these policies should be considered
    by the GNSO as a result of the experiences gained during the
    implementation and monitoring stages,

  b.  The purpose of these monitoring and reporting requirements are to allow
  the GNSO to determine when, if ever, these recommendations and any ensuing
  policy require additional clarification or attention based on the results
  of the reports prepared by ICANN Staff.

</blockquote>

<br style="clear: both;"/>
  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=152f487f101abbcdd9c900fc3eb46268" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=152f487f101abbcdd9c900fc3eb46268" style="display: none;" border="0" height="1" width="1" alt=""/><img src="http://feeds.ziffdavisenterprise.com/~r/RSS/cheap_hack/~4/330098895" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 08 Jul 2008 11:42:32 +0000</pubDate>
      <category domain="http://securityratty.com/tag/icann">icann</category>
      <category domain="http://securityratty.com/tag/directly">directly</category>
      <category domain="http://securityratty.com/tag/fees directly">fees directly</category>
      <category domain="http://securityratty.com/tag/fees">fees</category>
      <category domain="http://securityratty.com/tag/registrar fees effective">registrar fees effective</category>
      <category domain="http://securityratty.com/tag/effective">effective</category>
      <category domain="http://securityratty.com/tag/registrar-level fees">registrar-level fees</category>
      <category domain="http://securityratty.com/tag/fee">fee</category>
      <category domain="http://securityratty.com/tag/per-transaction fee">per-transaction fee</category>
      <source url="http://feeds.ziffdavisenterprise.com/~r/RSS/cheap_hack/~3/330098895/ch_icanns_announcement_of_antidomain_tasting_measures_to_registrars.html">ICANN's Announcement Of Anti-Domain Tasting Measures To Registrars</source>
    </item>
    <item>
      <title><![CDATA[ICANN's Announcement Of Anti-Domain Tasting Measures To Registrars]]></title>
      <link>http://securityratty.com/article/1438af7a2605c2bbe5326444d5bd9d27</link>
      <guid>http://securityratty.com/article/1438af7a2605c2bbe5326444d5bd9d27</guid>
      <description><![CDATA[The recent new that ICANN had taken measures to combat Domain Tasting came out in blogs, such as this one , based on second-hand news. ICANN had sent an e-mail to registrars announcing the policy...]]></description>
      <content:encoded><![CDATA[The recent new that ICANN had taken measures to combat Domain Tasting came out in blogs, <a href="http://www.domainnamenews.com/miscellaneous/icann-board-resolution-kills-domain-tasting/1689">such as this one</a>, based on second-hand news. ICANN had sent an e-mail to registrars announcing the policy change. But there was confusion over exactly what the policy was; most people just assumed it followed the recommendations of the GNSO council from April.  The incomplete information caused some confused analysis such as <a href="http://www.cadna.org/en/newsroom/press-releases/icann-tasting-solution">this from CADNA (the Coalition Against Domain Name Abuse)</a>.

I asked ICANN and they sent me the actual e-mail that they sent out to registrars. It is published below. My analysis of it is in <a href="http://www.eweek.com/c/a/Security/Yes-Domain-Tasting-Will-End/">a column on eWEEK</a>.

<blockquote>
Dear Registrar,

This message is intended to explain how certain decisions that were made by the ICANN Board of Directors at its meeting in Paris last week may affect your registrar.

Specifically, the Board adopted GNSO recommendations on domain tasting that included both budget and non-budget provisions designed to restrict the applicability of the Add Grace Period (AGP).  Please note that this message is a summary of changes that affect registrars.  You should refer to the adopted budget document and adopted motions for further information.


Summary of Important Timing Issues

After several months of discussion and public comment on both the budget and the GNSO recommendations, the Board has approved the proposed budget containing a provision for collecting transaction fees above a threshold during the AGP.  Effective 1 July 2008, the registrar-level transaction fee will be collected on transactions, including names added on or after 1 July
2008 and deleted during the Add Grace Period above a certain minimum threshold.  Each "transaction" will continue to be defined as a one-year domain registration increment caused by a successful add, renewal or transfer command, but this year any domain names deleted during the AGP (if
offered)
will be included as transactions if they exceed the maximum of (i) 10% of that registrar's net new registrations in that month (defined as total new registrations less domains deleted during AGP), or (ii) fifty (50) domain names, whichever is greater.  The budget assumes the transaction fee rate will remain at US ./send.20.

The second change prohibits registries from issuing refunds above a similar threshold for names registered and deleted during the AGP (although some registries have made plans to charge for such transactions independent of this motion).  The implementation timing of this change has not been set, but should be expected to take place over a period of some months.  ICANN staff will solicit public comments and post a registrar advisory prior to implementation of this aspect of the GNSO recommendation.


Budget - Registrar Fees Effective 1 July 2008

The Operating Plan and Budget details for 2008-2009 fiscal year can be found at:

http://www.icann.org/en/financials/proposed-opplan-budget-v3-fy09-25jun0
8-en.pdf

Relevant section from the approved budget:

* Registrar-Level Transaction Fees

In FY08 the per transaction-year rate was ./send.20 (or a 5 cent discount from the established ./send.25 rate).  The draft FY09 budget assumes that the ./send.20 rate will continue for registrar transaction fees.  As in past years, each transaction will be defined as one-year domain registration increment caused by a successful add renewal or transfer command.  FY09 revenue is estimated to be .4 million for registrar-level transaction fees.  Each "transaction"
will continue to be defined as a one-year domain registration increment caused by a successful add, renewal or transfer command, but this year any domain names deleted during the AGP (if offered) will be included as transactions if they exceed the maximum of (i) 10% of that registrar's net new registrations in that month (defined as total new registrations less domains deleted during AGP), or (ii) fifty (50) domain names, whichever is greater.  Therefore per-transaction fee will continue to be charged for each one-year increment of every transaction (e.g.  at a ./send.20 fee level, the fee for a three-year renewal will be US ./send.60), and registrars will continue to have the option to "defer" payment of the fees for the years beyond one for each transaction.  n

Note, as in previous years, ICANN can collect such fees directly from the registrars only if they are "expressly approved by registrars who account, in the aggregate, for payment of two-thirds of all registrar-level fees collected by ICANN." ICANN will shortly undertake the process of requesting such approval for the 2008-09 fiscal year.  While ICANN is grateful for consistent approval by registrars of fee levels in prior years, and is optimistic about such approval this year, if for some reason the necessary approval is not achieved, the fees will be collected by ICANN, as permitted under the registry agreements through the registries.  (Note that the amount of such fees varies by registry, but in no case exceeds US ./send.25.) Registries will then be able to collect those payments from registrars to the extent permitted under the relevant contracts.  It is expected that the same transaction increments (including AGP) will be covered, whether collected directly by ICANN or in! directly by the registries, so registrars should anticipate this liability under either scenario.


ICANN Board Resolution

Whereas, ICANN community stakeholders are increasingly concerned about domain tasting, which is the practice of using the add grace period (AGP) to register domain names in bulk in order to test their profitability.

Whereas, on 17 April 2008, the GNSO Council approved, by a Supermajority vote, a motion to prohibit any gTLD operator that has implemented an AGP from offering a refund for any domain name deleted during the AGP that exceeds 10% of its net new registrations in that month, or fifty domain names, whichever is greater.  <http://gnso.icann.org/meetings/minutes-gnso-17apr08.shtml>

Whereas, on 25 April 2008, the GNSO Council forwarded its formal "Report to the ICANN Board - Recommendation for Domain Tasting"
<http://gnso.icann.org/issues/domain-tasting/domain-tasting-board-report
-gnso-council-25apr08.pdf>,
which outlines the full text of the motion and the full context and procedural history of this proceeding.

Whereas, the Board is also considering the Proposed FY 09 Operating Plan and Budget <http://www.icann.org/financials/fiscal-30jun09.htm>, which includes (at the encouragement of the GNSO Council) a proposal similar to the GNSO policy recommendation to expand the applicability of the ICANN transaction fee in order to limit domain tasting.

Resolved (2008.06.26.06), the Board adopts the GNSO policy recommendation on domain tasting, and directs staff to implement the policy following appropriate comment and notice periods on the implementation documents.


Domain tasting motion approved by the GNSO Council 17 April 2008

<http://gnso.icann.org/issues/domain-tasting/domain-tasting-board-report
-gnso-council-25apr08.pdf>

Whereas, the GNSO Council has discussed the Issues Report on Domain Tasting and the Final Outcomes Report of the ad hoc group on Domain Tasting;

Whereas, the GNSO Council resolved on 31 October 2007 to launch a PDP on Domain Tasting;

Whereas, the GNSO Council authorized on 17 January 2008 the formation of a small design team to develop a plan for the deliberations on the Domain Tasting PDP (the "Design Team"), the principal volunteers to which had been members of the Ad Hoc Group on Domain Tasting and were well-informed of both the Final Outcomes Report of the Ad Hoc Group on Domain Tasting and the GNSO Initial Report on Domain Tasting (collectively with the Issues Report, the "Reports on Domain Tasting");

Whereas, the GNSO Council has received the Draft Final Report on Domain Tasting;

Whereas, PIR, the .org registry operator, has amended its Registry Agreement to charge an Excess Deletion Fee; and both NeuStar, the .biz registry operator, and Afilias, the .info registry operator, are seeking amendments to their respective Registry Agreements to modify the existing AGP;

The GNSO Council recommends to the ICANN Board of Directors that:

1.  The applicability of the Add Grace Period shall be restricted for any gTLD which has implemented an AGP ("Applicable gTLD Operator").
Specifically, for each Applicable gTLD Operator:

  a.  During any given month, an Applicable gTLD Operator may not offer any
  refund to a registrar for any domain names deleted during the AGP that
  exceed (i) 10% of that registrar's net new registrations in that month
  (defined as total new registrations less domains deleted during AGP), or
  (ii) fifty (50) domain names, whichever is greater.

  b.  A Registrar may seek an exemption from the application of such
  restriction in a specific month, upon the documented showing of
  extraordinary circumstances.  For any Registrar requesting such an
  exemption, the Registrar must confirm in writing to the Registry Operator
  how, at the time the names were deleted, these extraordinary circumstances
  were not known, reasonably could not have been known, and were outside of
  the Registrar's control.  Acceptance of any exemption will be at the sole
  reasonable discretion of the Registry Operator, however "extraordinary
  circumstances" which reoccur regularly will not be deemed extraordinary.

  c.  In addition to all other reporting requirements to ICANN, each
  Applicable gTLD Operator shall identify each Registrar that has sought an
  exemption, along with a brief descriptive identification of the type of
  extraordinary circumstance and the action (if any) that was taken by the
  Applicable gTLD Operator.

2.  Implementation and execution of these recommendations shall be monitored by the GNSO.  Specifically;

  a.  ICANN Staff shall analyze and report to the GNSO at six month intervals
  for two years after implementation, until such time as the GNSO resolves
  otherwise, with the goal of determining;

    i.  How effectively and to what extent the policies have been implemented
    and followed by Registries and Registrars, and

    ii.  Whether or not modifications to these policies should be considered
    by the GNSO as a result of the experiences gained during the
    implementation and monitoring stages,

  b.  The purpose of these monitoring and reporting requirements are to allow
  the GNSO to determine when, if ever, these recommendations and any ensuing
  policy require additional clarification or attention based on the results
  of the reports prepared by ICANN Staff.

</blockquote>

<br style="clear: both;"/>
      <a href="http://www.pheedo.com/click.phdo?s=8eea0eb864e902bc67c9b814b1af0256"><img alt="" style="border: 0;" border="0" src="http://www.pheedo.com/img.phdo?s=8eea0eb864e902bc67c9b814b1af0256"/></a>
  <img src="http://www.pheedo.com/feeds/tracker.php?i=8eea0eb864e902bc67c9b814b1af0256" style="display: none;" border="0" height="1" width="1" alt=""/><img src="http://feeds.ziffdavisenterprise.com/~r/RSS/cheap_hack/~4/338277687" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 08 Jul 2008 11:42:32 +0000</pubDate>
      <category domain="http://securityratty.com/tag/icann">icann</category>
      <category domain="http://securityratty.com/tag/directly">directly</category>
      <category domain="http://securityratty.com/tag/fees directly">fees directly</category>
      <category domain="http://securityratty.com/tag/fees">fees</category>
      <category domain="http://securityratty.com/tag/registrar fees effective">registrar fees effective</category>
      <category domain="http://securityratty.com/tag/effective">effective</category>
      <category domain="http://securityratty.com/tag/registrar-level fees">registrar-level fees</category>
      <category domain="http://securityratty.com/tag/fee">fee</category>
      <category domain="http://securityratty.com/tag/per-transaction fee">per-transaction fee</category>
      <source url="http://feeds.ziffdavisenterprise.com/~r/RSS/cheap_hack/~3/338277687/ch_icanns_announcement_of_antidomain_tasting_measures_to_registrars.html">ICANN's Announcement Of Anti-Domain Tasting Measures To Registrars</source>
    </item>
    <item>
      <title><![CDATA[ICANN's Announcement Of Anti-Domain Tasting Measures To Registrars]]></title>
      <link>http://securityratty.com/article/266456c2c42bc5e4cf836f3ca19af1c2</link>
      <guid>http://securityratty.com/article/266456c2c42bc5e4cf836f3ca19af1c2</guid>
      <description><![CDATA[The recent new that ICANN had taken measures to combat Domain Tasting came out in blogs, such as this one , based on second-hand news. ICANN had sent an e-mail to registrars announcing the policy...]]></description>
      <content:encoded><![CDATA[The recent new that ICANN had taken measures to combat Domain Tasting came out in blogs, <a href="http://www.domainnamenews.com/miscellaneous/icann-board-resolution-kills-domain-tasting/1689">such as this one</a>, based on second-hand news. ICANN had sent an e-mail to registrars announcing the policy change. But there was confusion over exactly what the policy was; most people just assumed it followed the recommendations of the GNSO council from April.  The incomplete information caused some confused analysis such as <a href="http://www.cadna.org/en/newsroom/press-releases/icann-tasting-solution">this from CADNA (the Coalition Against Domain Name Abuse)</a>.

I asked ICANN and they sent me the actual e-mail that they sent out to registrars. It is published below. My analysis of it is in <a href="http://www.eweek.com/c/a/Security/Yes-Domain-Tasting-Will-End/">a column on eWEEK</a>.

<blockquote>
Dear Registrar,

This message is intended to explain how certain decisions that were made by the ICANN Board of Directors at its meeting in Paris last week may affect your registrar.

Specifically, the Board adopted GNSO recommendations on domain tasting that included both budget and non-budget provisions designed to restrict the applicability of the Add Grace Period (AGP).  Please note that this message is a summary of changes that affect registrars.  You should refer to the adopted budget document and adopted motions for further information.


Summary of Important Timing Issues

After several months of discussion and public comment on both the budget and the GNSO recommendations, the Board has approved the proposed budget containing a provision for collecting transaction fees above a threshold during the AGP.  Effective 1 July 2008, the registrar-level transaction fee will be collected on transactions, including names added on or after 1 July
2008 and deleted during the Add Grace Period above a certain minimum threshold.  Each "transaction" will continue to be defined as a one-year domain registration increment caused by a successful add, renewal or transfer command, but this year any domain names deleted during the AGP (if
offered)
will be included as transactions if they exceed the maximum of (i) 10% of that registrar's net new registrations in that month (defined as total new registrations less domains deleted during AGP), or (ii) fifty (50) domain names, whichever is greater.  The budget assumes the transaction fee rate will remain at US ./send.20.

The second change prohibits registries from issuing refunds above a similar threshold for names registered and deleted during the AGP (although some registries have made plans to charge for such transactions independent of this motion).  The implementation timing of this change has not been set, but should be expected to take place over a period of some months.  ICANN staff will solicit public comments and post a registrar advisory prior to implementation of this aspect of the GNSO recommendation.


Budget - Registrar Fees Effective 1 July 2008

The Operating Plan and Budget details for 2008-2009 fiscal year can be found at:

http://www.icann.org/en/financials/proposed-opplan-budget-v3-fy09-25jun0
8-en.pdf

Relevant section from the approved budget:

* Registrar-Level Transaction Fees

In FY08 the per transaction-year rate was ./send.20 (or a 5 cent discount from the established ./send.25 rate).  The draft FY09 budget assumes that the ./send.20 rate will continue for registrar transaction fees.  As in past years, each transaction will be defined as one-year domain registration increment caused by a successful add renewal or transfer command.  FY09 revenue is estimated to be .4 million for registrar-level transaction fees.  Each "transaction"
will continue to be defined as a one-year domain registration increment caused by a successful add, renewal or transfer command, but this year any domain names deleted during the AGP (if offered) will be included as transactions if they exceed the maximum of (i) 10% of that registrar's net new registrations in that month (defined as total new registrations less domains deleted during AGP), or (ii) fifty (50) domain names, whichever is greater.  Therefore per-transaction fee will continue to be charged for each one-year increment of every transaction (e.g.  at a ./send.20 fee level, the fee for a three-year renewal will be US ./send.60), and registrars will continue to have the option to "defer" payment of the fees for the years beyond one for each transaction.  n

Note, as in previous years, ICANN can collect such fees directly from the registrars only if they are "expressly approved by registrars who account, in the aggregate, for payment of two-thirds of all registrar-level fees collected by ICANN." ICANN will shortly undertake the process of requesting such approval for the 2008-09 fiscal year.  While ICANN is grateful for consistent approval by registrars of fee levels in prior years, and is optimistic about such approval this year, if for some reason the necessary approval is not achieved, the fees will be collected by ICANN, as permitted under the registry agreements through the registries.  (Note that the amount of such fees varies by registry, but in no case exceeds US ./send.25.) Registries will then be able to collect those payments from registrars to the extent permitted under the relevant contracts.  It is expected that the same transaction increments (including AGP) will be covered, whether collected directly by ICANN or in! directly by the registries, so registrars should anticipate this liability under either scenario.


ICANN Board Resolution

Whereas, ICANN community stakeholders are increasingly concerned about domain tasting, which is the practice of using the add grace period (AGP) to register domain names in bulk in order to test their profitability.

Whereas, on 17 April 2008, the GNSO Council approved, by a Supermajority vote, a motion to prohibit any gTLD operator that has implemented an AGP from offering a refund for any domain name deleted during the AGP that exceeds 10% of its net new registrations in that month, or fifty domain names, whichever is greater.  <http://gnso.icann.org/meetings/minutes-gnso-17apr08.shtml>

Whereas, on 25 April 2008, the GNSO Council forwarded its formal "Report to the ICANN Board - Recommendation for Domain Tasting"
<http://gnso.icann.org/issues/domain-tasting/domain-tasting-board-report
-gnso-council-25apr08.pdf>,
which outlines the full text of the motion and the full context and procedural history of this proceeding.

Whereas, the Board is also considering the Proposed FY 09 Operating Plan and Budget <http://www.icann.org/financials/fiscal-30jun09.htm>, which includes (at the encouragement of the GNSO Council) a proposal similar to the GNSO policy recommendation to expand the applicability of the ICANN transaction fee in order to limit domain tasting.

Resolved (2008.06.26.06), the Board adopts the GNSO policy recommendation on domain tasting, and directs staff to implement the policy following appropriate comment and notice periods on the implementation documents.


Domain tasting motion approved by the GNSO Council 17 April 2008

<http://gnso.icann.org/issues/domain-tasting/domain-tasting-board-report
-gnso-council-25apr08.pdf>

Whereas, the GNSO Council has discussed the Issues Report on Domain Tasting and the Final Outcomes Report of the ad hoc group on Domain Tasting;

Whereas, the GNSO Council resolved on 31 October 2007 to launch a PDP on Domain Tasting;

Whereas, the GNSO Council authorized on 17 January 2008 the formation of a small design team to develop a plan for the deliberations on the Domain Tasting PDP (the "Design Team"), the principal volunteers to which had been members of the Ad Hoc Group on Domain Tasting and were well-informed of both the Final Outcomes Report of the Ad Hoc Group on Domain Tasting and the GNSO Initial Report on Domain Tasting (collectively with the Issues Report, the "Reports on Domain Tasting");

Whereas, the GNSO Council has received the Draft Final Report on Domain Tasting;

Whereas, PIR, the .org registry operator, has amended its Registry Agreement to charge an Excess Deletion Fee; and both NeuStar, the .biz registry operator, and Afilias, the .info registry operator, are seeking amendments to their respective Registry Agreements to modify the existing AGP;

The GNSO Council recommends to the ICANN Board of Directors that:

1.  The applicability of the Add Grace Period shall be restricted for any gTLD which has implemented an AGP ("Applicable gTLD Operator").
Specifically, for each Applicable gTLD Operator:

  a.  During any given month, an Applicable gTLD Operator may not offer any
  refund to a registrar for any domain names deleted during the AGP that
  exceed (i) 10% of that registrar's net new registrations in that month
  (defined as total new registrations less domains deleted during AGP), or
  (ii) fifty (50) domain names, whichever is greater.

  b.  A Registrar may seek an exemption from the application of such
  restriction in a specific month, upon the documented showing of
  extraordinary circumstances.  For any Registrar requesting such an
  exemption, the Registrar must confirm in writing to the Registry Operator
  how, at the time the names were deleted, these extraordinary circumstances
  were not known, reasonably could not have been known, and were outside of
  the Registrar's control.  Acceptance of any exemption will be at the sole
  reasonable discretion of the Registry Operator, however "extraordinary
  circumstances" which reoccur regularly will not be deemed extraordinary.

  c.  In addition to all other reporting requirements to ICANN, each
  Applicable gTLD Operator shall identify each Registrar that has sought an
  exemption, along with a brief descriptive identification of the type of
  extraordinary circumstance and the action (if any) that was taken by the
  Applicable gTLD Operator.

2.  Implementation and execution of these recommendations shall be monitored by the GNSO.  Specifically;

  a.  ICANN Staff shall analyze and report to the GNSO at six month intervals
  for two years after implementation, until such time as the GNSO resolves
  otherwise, with the goal of determining;

    i.  How effectively and to what extent the policies have been implemented
    and followed by Registries and Registrars, and

    ii.  Whether or not modifications to these policies should be considered
    by the GNSO as a result of the experiences gained during the
    implementation and monitoring stages,

  b.  The purpose of these monitoring and reporting requirements are to allow
  the GNSO to determine when, if ever, these recommendations and any ensuing
  policy require additional clarification or attention based on the results
  of the reports prepared by ICANN Staff.

</blockquote><img src="http://feedproxy.google.com/~r/RSS/cheap_hack/~4/xJKws7q3qKE" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 08 Jul 2008 11:42:32 +0000</pubDate>
      <category domain="http://securityratty.com/tag/icann">icann</category>
      <category domain="http://securityratty.com/tag/directly">directly</category>
      <category domain="http://securityratty.com/tag/fees directly">fees directly</category>
      <category domain="http://securityratty.com/tag/fees">fees</category>
      <category domain="http://securityratty.com/tag/registrar fees effective">registrar fees effective</category>
      <category domain="http://securityratty.com/tag/effective">effective</category>
      <category domain="http://securityratty.com/tag/registrar-level fees">registrar-level fees</category>
      <category domain="http://securityratty.com/tag/fee">fee</category>
      <category domain="http://securityratty.com/tag/per-transaction fee">per-transaction fee</category>
      <source url="http://feeds.ziffdavisenterprise.com/~r/RSS/cheap_hack/~3/xJKws7q3qKE/ch_icanns_announcement_of_antidomain_tasting_measures_to_registrars.html">ICANN's Announcement Of Anti-Domain Tasting Measures To Registrars</source>
    </item>
    <item>
      <title><![CDATA[Hacker Launches Botnet Attack via P2P Software]]></title>
      <link>http://securityratty.com/article/bfd3d8c9363120ec6c67f4af509fc186</link>
      <guid>http://securityratty.com/article/bfd3d8c9363120ec6c67f4af509fc186</guid>
      <description><![CDATA[A 19-year-old hacker is agreeing to plead guilty to launching a botnet attack and stealing financial data from thousands of computers. The malware program installed itself on victims' computers when...]]></description>
      <content:encoded><![CDATA[A 19-year-old hacker is agreeing to plead guilty to launching a botnet attack and stealing financial data from thousands of computers. The malware program installed itself on victims' computers when they downloaded peer-to-peer file sharing software, authorities said. Jason Milmont, of Cheyenne, Wyoming, faces a maximum five-year term.<br style="clear: both;"/>
      <a href="http://www.pheedo.com/click.phdo?s=c65eec89785999024328d1e931fadf56"><img alt="" style="border: 0;" border="0" src="http://www.pheedo.com/img.phdo?s=c65eec89785999024328d1e931fadf56"/></a>
  <img src="http://www.pheedo.com/feeds/tracker.php?i=c65eec89785999024328d1e931fadf56" style="display: none;" border="0" height="1" width="1" alt=""/><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=zWclcI"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=zWclcI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=cWYjRi"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=cWYjRi" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=Bj63Ai"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=Bj63Ai" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=gWb9dI"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=gWb9dI" border="0"></img></a>
 <a href="http://feeds.wired.com/~f/wired/politics/security?a=cysPmI"><img src="http://feeds.wired.com/~f/wired/politics/security?i=cysPmI" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=sXQqpi"><img src="http://feeds.wired.com/~f/wired/politics/security?i=sXQqpi" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=T2iDbi"><img src="http://feeds.wired.com/~f/wired/politics/security?i=T2iDbi" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=2DarjI"><img src="http://feeds.wired.com/~f/wired/politics/security?i=2DarjI" border="0"></img></a> </div><img src="http://feeds.feedburner.com/~r/wired/politics/privacy/~4/321634487" height="1" width="1"/><img src="http://feeds.wired.com/~r/wired/politics/security/~4/321634488" height="1" width="1"/>]]></content:encoded>
      <pubDate>Fri, 27 Jun 2008 15:44:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/botnet attack">botnet attack</category>
      <category domain="http://securityratty.com/tag/maximum five-year term">maximum five-year term</category>
      <category domain="http://securityratty.com/tag/19-year-old hacker">19-year-old hacker</category>
      <category domain="http://securityratty.com/tag/peer-to-peer file">peer-to-peer file</category>
      <category domain="http://securityratty.com/tag/financial data">financial data</category>
      <category domain="http://securityratty.com/tag/computers">computers</category>
      <category domain="http://securityratty.com/tag/software">software</category>
      <category domain="http://securityratty.com/tag/jason milmont">jason milmont</category>
      <category domain="http://securityratty.com/tag/plead guilty">plead guilty</category>
      <source url="http://feeds.wired.com/~r/wired/politics/security/~3/321634488/hacker-launches.html">Hacker Launches Botnet Attack via P2P Software</source>
    </item>
    <item>
      <title><![CDATA[Latest 802.11 Standard Boosts Wi-Fi Power in New Band]]></title>
      <link>http://securityratty.com/article/8a175684170e876da287683bcc08e2a3</link>
      <guid>http://securityratty.com/article/8a175684170e876da287683bcc08e2a3</guid>
      <description><![CDATA[The nearly finished IEEE 802.11y could make Wi-Fi more practical over longer distances : Wi-Fi is a compromise. In the unlicensed bands in which it operates, it has to deal with interference from...]]></description>
      <content:encoded><![CDATA[<p><a href="http://www.warpspeed.com/wordpress/?p=2406"><strong>The nearly finished IEEE 802.11y could make Wi-Fi more practical over longer distances</strong></a>: Wi-Fi is a compromise. In the unlicensed bands in which it operates, it has to deal with interference from noise sources and other networks, while using very low power, and trying not to make a pest of itself. It's done very well. In the 2.4 GHz band and parts of 5 GHz, the maximum power from the radio is 1 watt (W), and the effective power (EIRP) is 4 W on an omnidirectional antenna. (You can push far more power if you narrow the antenna's beam. And parts of the 5 GHz band restrict radio power below 1 W. I wrote <a href="http://wifinetnews.com/archives/007336.html"><strong>a long rundown of 5 GHz issues</strong></a> back in Jan-2007.)</p>

<p>But there's this lovely new segment of lightly licensed spectrum in the U.S., the 3.65 GHz band. It's a non-exclusive licensed band available only in parts of the country that don't have pre-existing ground-to-satellite or radar uses that overlap. This omits most of the eastern seaboard and most major cities; Seattle is one exception.</p>

<p>The licensing mechanism allows any number of operators to obtain inexpensive licenses, and register the base stations they use by location. If interference arises among base stations, operators are required to work out the problems themselves. I wrote extensively about this band and its rules on 9-May-2008 in <a href="http://wifinetnews.com/archives/008313.html"><strong>profiling Azulstar</strong></a>, formerly a metro-scale Wi-Fi firm, but now a big proponent of WiMax in 3.65 GHz. I also <a href="http://wimaxnetnews.com/archives/2007/06/fcc_affirms_365.html"><strong>went over the rules</strong></a> for the band on 11-June-2007 when the FCC announced the arrangement. </p>

<p>Several firms offer base station and customer premises equipment for this band now, so close to the 3.5 GHz band more commonly exclusively licensed in Europe and elsewhere. WiMax equipment is available because the 3.65 GHz band can be used with WiMax without any modifications to that protocol, although limited to just 25 MHz of the 50 MHz that the FCC set aside.</p>

<p>Equipment that conforms to a more stringent set of rules about contention and other factors can use the whole 50 MHz, and that's where 802.11y comes in. It's an extension of Wi-Fi to cope with the specific needs--and to open Wi-Fi technology up to 20 W EIRP, a vastly higher power output. This could allow connections over 5 km, the group says.</p>

<p>The <a href="http://en.wikipedia.org/wiki/IEEE_802.11y"><strong>Wikipedia entry on 802.11y</strong></a>, clearly written by someone involved with the specification, notes that three specific additions are needed: a tweak to support the way in which the FCC wants contention among competing devices to work; a method for an access point to tell a station (a connecting radio) that it's about to switch its channel or its channel's bandwidth, and the station should do likewise; and a mechanism to handle a base station allowing or revoking permission to use the spectrum without uniquely identifying the user's system or broadcasting its precise GPS-based location.</p>

<p>The standard is near completion and initial approval. I don't have any knowledge about whether any mainstream Wi-Fi equipment makers or metro-scale equipment makers are looking into building 802.11y into their gear. </p>

<p>The fact is that this could be a great technology for the mostly sub-metropolitan markets that 3.65 GHz is available in, although it has the same pain as WiMax: all new gear on the towers and all new adapters for customers.</p>]]></content:encoded>
      <pubDate>Wed, 25 Jun 2008 10:01:44 +0000</pubDate>
      <category domain="http://securityratty.com/tag/band">band</category>
      <category domain="http://securityratty.com/tag/power">power</category>
      <category domain="http://securityratty.com/tag/wi-fi">wi-fi</category>
      <category domain="http://securityratty.com/tag/ghz band">ghz band</category>
      <category domain="http://securityratty.com/tag/ghz">ghz</category>
      <category domain="http://securityratty.com/tag/equipment">equipment</category>
      <category domain="http://securityratty.com/tag/wimax equipment">wimax equipment</category>
      <category domain="http://securityratty.com/tag/metro-scale wi-fi firm">metro-scale wi-fi firm</category>
      <category domain="http://securityratty.com/tag/power output">power output</category>
      <source url="http://wifinetnews.com/archives/008379.html">Latest 802.11 Standard Boosts Wi-Fi Power in New Band</source>
    </item>
  </channel>
</rss>
