<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: mil]]></title>
    <link>http://securityratty.com/tag/mil</link>
    <description></description>
    <pubDate>Sun, 09 Dec 2007 18:14:53 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[In the great NAC debate, Snyder KOs Stiennon in the first round!]]></title>
      <link>http://securityratty.com/article/257e5281878e732cc8ef2afaee430827</link>
      <guid>http://securityratty.com/article/257e5281878e732cc8ef2afaee430827</guid>
      <description><![CDATA[Just got done reading the transcript of yesterdays great NAC debate between Joel Snyder and Richard Stiennon. As I predicted Snyder scored a knockout early on and it was mostly over from that point...]]></description>
      <content:encoded><![CDATA[<p><a href="http://www.stillsecureafteralltheseyears.com/ashimmy/WindowsLiveWriter/boxer.jpg"><img title="boxer" style="border-right: 0px; border-top: 0px; margin: 0px 0px 5px 5px; border-left: 0px; border-bottom: 0px" height="124" alt="boxer" src="http://www.stillsecureafteralltheseyears.com/ashimmy/WindowsLiveWriter/boxer_thumb.jpg" width="142" align="right" border="0"></img></a> Just got done <a href="http://www.networkworld.com/chat/archive/2008/072308-snyder-stiennon-nac-debate.html">reading the transcript</a> of yesterdays great NAC debate between Joel Snyder and Richard Stiennon.  As I predicted Snyder scored a knockout early on and it was mostly over from that point on.  The knockout came earlier than I expected though, right off the first question.  Each combatant was asked to define NAC and that was when it happened.  Richard brought an EPAC (end point access control) to a NAC fight.  That was akin to him bringing a rubber knife to a gun fight.  A quick bullet between the eyes by Snyder and it was almost painlessly over for Richard.</p>  <p>I have been preaching for some time about what I call complete NAC. That is a complete network access control solution, not just network admission control and certainly not end point access control.  It is not an evil plot to extend Cisco/Microsoft dominance and most importantly Richard, no one and let me say this again, no one has ever said that NAC negates the need for a layered security model.  NAC is just another layer in that model.  Richard’s comments deriding the .edu and .mil markets were also laughable.  Richard, have you ever heard the term military grade?  Are you seriously trying to say that enterprises take security more seriously than the military does?  Come on now Richard.</p>  <p>The bottom line is Joel Snyder is not only a sharp dude technically, but is street savvy enough to run circles around my friend Richard.  He made Richard stay focused on the question at hand, did not let him wander and so Richard had to face reality a bit. I am sure Richard will still say NAC is useless and <a href="http://securityuncorked.squarespace.com/security-uncorked/2008/7/22/hps-nac-what-ive-been-wanting-to-tell-you-but-couldnt.html">will admonish people about hanging out with the likes of the StillSecure</a> crowd, but I guess some things will just never change.  Except, I don’t think Richard will be in anymore of these bouts.  Maybe he can start selling a grill that takes the fat out of meat or perhaps a reality TV show like the other washed up palookas ?</p>
<p><a href="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?a=ZeWwIp"><img src="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?i=ZeWwIp" border="0"></img></a></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=9TwouJ"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=9TwouJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=JHaO4J"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=JHaO4J" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=vbaihJ"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=vbaihJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=QDT1DJ"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=QDT1DJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=jnZSlj"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=jnZSlj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=6zfMHj"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=6zfMHj" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~4/344260979" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 23 Jul 2008 20:13:54 +0000</pubDate>
      <category domain="http://securityratty.com/tag/nac">nac</category>
      <category domain="http://securityratty.com/tag/richard">richard</category>
      <category domain="http://securityratty.com/tag/importantly richard">importantly richard</category>
      <category domain="http://securityratty.com/tag/richard stiennon">richard stiennon</category>
      <category domain="http://securityratty.com/tag/snyder">snyder</category>
      <category domain="http://securityratty.com/tag/friend richard">friend richard</category>
      <category domain="http://securityratty.com/tag/define nac">define nac</category>
      <category domain="http://securityratty.com/tag/nac fight">nac fight</category>
      <category domain="http://securityratty.com/tag/richard stay">richard stay</category>
      <source url="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~3/344260979/in-the-great-na.html">In the great NAC debate, Snyder KOs Stiennon in the first round!</source>
    </item>
    <item>
      <title><![CDATA[Fed Watch]]></title>
      <link>http://securityratty.com/article/af51aee9a30697b659250b255f5962ad</link>
      <guid>http://securityratty.com/article/af51aee9a30697b659250b255f5962ad</guid>
      <description><![CDATA[I was curious to see what government agencies might me using my site for training. I also wanted to learn PHP + MySQL a little better, so I wrote this project. It takes my logs and shows all of the...]]></description>
      <content:encoded><![CDATA[I was curious to see what government agencies might me using my site for 
training. I also wanted to learn PHP + MySQL a little better, so I wrote this 
project. It takes my logs and shows all of the hosts names ending in .mil or .gov, 
and what pages they visited. I obfuscated the first part of the host names, and 
the last two octets of the IPs so as to not &quot;drop their docs&quot; so to speak.]]></content:encoded>
      <pubDate>Sat, 24 May 2008 19:00:51 +0000</pubDate>
      <category domain="http://securityratty.com/tag/government agencies">government agencies</category>
      <category domain="http://securityratty.com/tag/host names">host names</category>
      <category domain="http://securityratty.com/tag/hosts names">hosts names</category>
      <category domain="http://securityratty.com/tag/project">project</category>
      <category domain="http://securityratty.com/tag/drop">drop</category>
      <category domain="http://securityratty.com/tag/logs">logs</category>
      <category domain="http://securityratty.com/tag/octets">octets</category>
      <category domain="http://securityratty.com/tag/gov">gov</category>
      <category domain="http://securityratty.com/tag/php">php</category>
      <source url="http://irongeek.com/fed-watch.php">Fed Watch</source>
    </item>
    <item>
      <title><![CDATA[Fed Watch]]></title>
      <link>http://securityratty.com/article/ccdc9ee3c5603f3ffcc2955fb4933457</link>
      <guid>http://securityratty.com/article/ccdc9ee3c5603f3ffcc2955fb4933457</guid>
      <description><![CDATA[I was curious to see what government agencies might me using my site for training. I also wanted to learn PHP + MySQL a little better, so I wrote this project. It takes my logs and shows all of the...]]></description>
      <content:encoded><![CDATA[I was curious to see what government agencies might me using my site for 
training. I also wanted to learn PHP + MySQL a little better, so I wrote this 
project. It takes my logs and shows all of the hosts names ending in .mil or .gov, 
and what pages they visited. I obfuscated the first part of the host names, and 
the last two octets of the IPs so as to not &quot;drop their docs&quot; so to speak.
<p><a href="http://feeds.feedburner.com/~a/IrongeeksSecuritySite?a=gbF0Ye"><img src="http://feeds.feedburner.com/~a/IrongeeksSecuritySite?i=gbF0Ye" border="0"></img></a></p><img src="http://feeds.feedburner.com/~r/IrongeeksSecuritySite/~4/297640132" height="1" width="1"/>]]></content:encoded>
      <pubDate>Sat, 24 May 2008 19:00:51 +0000</pubDate>
      <category domain="http://securityratty.com/tag/government agencies">government agencies</category>
      <category domain="http://securityratty.com/tag/host names">host names</category>
      <category domain="http://securityratty.com/tag/hosts names">hosts names</category>
      <category domain="http://securityratty.com/tag/project">project</category>
      <category domain="http://securityratty.com/tag/drop">drop</category>
      <category domain="http://securityratty.com/tag/logs">logs</category>
      <category domain="http://securityratty.com/tag/octets">octets</category>
      <category domain="http://securityratty.com/tag/gov">gov</category>
      <category domain="http://securityratty.com/tag/php">php</category>
      <source url="http://feeds.feedburner.com/~r/IrongeeksSecuritySite/~3/297640132/fed-watch.php">Fed Watch</source>
    </item>
    <item>
      <title><![CDATA[Fed Watch]]></title>
      <link>http://securityratty.com/article/8014214f68e329ae1faf2808afd74bb5</link>
      <guid>http://securityratty.com/article/8014214f68e329ae1faf2808afd74bb5</guid>
      <description><![CDATA[I was curious to see what government agencies might me using my site for training. I also wanted to learn PHP + MySQL a little better, so I wrote this project. It takes my logs and shows all of the...]]></description>
      <content:encoded><![CDATA[I was curious to see what government agencies might me using my site for 
training. I also wanted to learn PHP + MySQL a little better, so I wrote this 
project. It takes my logs and shows all of the hosts names ending in .mil or .gov, 
and what pages they visited. I obfuscated the first part of the host names, and 
the last two octets of the IPs so as to not &quot;drop their docs&quot; so to speak.<img src="http://feedproxy.google.com/~r/IrongeeksSecuritySite/~4/aY_eUis0x8U" height="1" width="1"/>]]></content:encoded>
      <pubDate>Sat, 24 May 2008 19:00:51 +0000</pubDate>
      <category domain="http://securityratty.com/tag/government agencies">government agencies</category>
      <category domain="http://securityratty.com/tag/host names">host names</category>
      <category domain="http://securityratty.com/tag/hosts names">hosts names</category>
      <category domain="http://securityratty.com/tag/project">project</category>
      <category domain="http://securityratty.com/tag/drop">drop</category>
      <category domain="http://securityratty.com/tag/logs">logs</category>
      <category domain="http://securityratty.com/tag/octets">octets</category>
      <category domain="http://securityratty.com/tag/gov">gov</category>
      <category domain="http://securityratty.com/tag/php">php</category>
      <source url="http://feedproxy.google.com/~r/IrongeeksSecuritySite/~3/aY_eUis0x8U/fed-watch.php">Fed Watch</source>
    </item>
    <item>
      <title><![CDATA[$160 Billion Robotic Army Network Passes First Big Test. Kinda.]]></title>
      <link>http://securityratty.com/article/6bb6208ef347d0e269a0e843e5740d09</link>
      <guid>http://securityratty.com/article/6bb6208ef347d0e269a0e843e5740d09</guid>
      <description><![CDATA[A van full of insurgents speeds through the desert. They do not notice a series of networked ground sensors that have begun tracking their every move
Hovering somewhere overhead, a tiny robot points...]]></description>
      <content:encoded><![CDATA[<p>A van full of insurgents speeds through the desert. They do not notice a series of networked ground sensors that have begun tracking their every move.</p>

<p>Hovering somewhere overhead, a tiny robot points its camera at the van and takes note of its color scheme and markings. An even bigger drone, thousands of feet above its hovering kin, maintains a God’s-eye vigil on the whole hunt.</p>

<p>Everything these robots see is radioed to monitors thousands of miles away -- and into the targeting systems of a B-52 bomber winging, silent and nearly invisible, several miles overhead.</p>

<p>This scenario, played out at a remote Nevada facility last week, was the first major test of the Army’s $160-billion, 20-year plan to build a high-tech family of networked robots and hybrid-electric armored vehicles. The “Future Combat Systems” program, co-managed by Boeing and consultants SAIC, aims to equip roughly a third of the Army with 14 new vehicle types that are connected constantly to a vast communications net.</p>

<p>The theory behind the FCS is that dispersed, intelligent robotic systems plugged into a universal communications network can help small numbers of U.S. troops riding in new vehicles to control huge swaths of terrain. Any ship, airplane or tank fitted with the FCS network devices will be able to see everything the others see.</p>

<p>The SkyNet-like network and dynamic coordination “is the most important thing,” Brigadier General James Terry says. </p>

<p>This is “a big deal for joint fires,” Army spokesman Paul Mehney told Wired.com. </p>

<p>“Joint fires” is mil-speak for getting all the military services to share info and coordinate their attacks. That kind of teamwork is a big factor in the U.S. military’s combat prowess. And if FCS works out as planned, the five U.S. military branches will team up better than ever.</p>

<p>Did the test work? Kinda.</p>

<p>The robots spotted the van; their targeting data bounced to a nearby unit of specially-equipped Humvees, then across the network to an Air Force intelligence cell in Langley, Virginia, then back to the B-52 -- all in just seconds. The bomber simulated dropping a guided bomb to “destroy” the van. </p>

<p>The Nevada test proved it was possible, according to Mehney. </p>

<p>But one critic says the test essentially was rigged -- that the conditions were too easy.</p>

<p>“There is ‘works’ and then there is ‘works,’” John Pike, an analyst with Globalsecurity,org, told Wired.com. </p>

<p>“A considerable fraction of the FCS network hardware does not currently exist,” Pike said. And the integration of that hardware that does exist has been touch-and-go.</p>

<p>In February, when testers “flipped the switch” for the first time on the network radios, there was a collective sigh of relief that the radios even worked -- this according to one FCS insider who spoke on background.</p>

<p>Last week’s desert test comes at a critical time for Future Combat Systems. Mounting criticism from the GAO plus the growing cost of fixing and upgrading the Army’s current war-weary vehicle fleet -- $120 billion over 10 years, according to the GAO -– has put the squeeze on the futuristic program. “It is not yet clear if or when the Army and [its contractors] can develop, build, and demonstrate the … network,” the Government Accountability Office reported in March.</p>

<p>One powerful congressman, nominally a supporter of FCS, has proposed injecting extra money into the program in order to rescue some of its technologies before canceling the rest.</p>

<p>Rep. John Murtha (D-PA), chair of the defense appropriations subcommittee, promised an extra $20 billion this year for FCS, provided the Army could use the money to wrap up the program quickly. “We need to accelerate FCS if we ever want to see anything accomplished,” Matt Mazonkey, a Murtha staffer, told Wired.com. </p>

<p>The Army is still preparing its response to Murtha’s query, Mehney said. Regardless, the service’s position on FCS has never wavered. The Army says that FCS is on-budget, on-schedule, and with continued funding will deliver on its promises to connect the ground service to itself and to all the other military branches.</p>

<p>And to ensure smooth progress despite a combined $900 million budget cut last year, the Army this month asked Congress to “re-appropriate” $250 million of other Army funds into FCS coffers. </p><br style="clear: both;"/>
      <a href="http://www.pheedo.com/click.phdo?s=60fb2ddae35439be877b98960768dcc2"><img alt="" style="border: 0;" border="0" src="http://www.pheedo.com/img.phdo?s=60fb2ddae35439be877b98960768dcc2"/></a>
  <img src="http://www.pheedo.com/feeds/tracker.php?i=60fb2ddae35439be877b98960768dcc2" style="display: none;" border="0" height="1" width="1" alt=""/><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=EouXcG"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=EouXcG" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=f0GkJg"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=f0GkJg" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=KpPnsg"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=KpPnsg" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=glEASG"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=glEASG" border="0"></img></a>
 <a href="http://feeds.wired.com/~f/wired/politics/security?a=X7WHYG"><img src="http://feeds.wired.com/~f/wired/politics/security?i=X7WHYG" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=rpxZig"><img src="http://feeds.wired.com/~f/wired/politics/security?i=rpxZig" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=TyYySg"><img src="http://feeds.wired.com/~f/wired/politics/security?i=TyYySg" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=Zjk1YG"><img src="http://feeds.wired.com/~f/wired/politics/security?i=Zjk1YG" border="0"></img></a> </div><img src="http://feeds.feedburner.com/~r/wired/politics/privacy/~4/281164411" height="1" width="1"/><img src="http://feeds.wired.com/~r/wired/politics/security/~4/281164412" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 30 Apr 2008 00:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/fcs network devices">fcs network devices</category>
      <category domain="http://securityratty.com/tag/fcs">fcs</category>
      <category domain="http://securityratty.com/tag/network">network</category>
      <category domain="http://securityratty.com/tag/fcs network hardware">fcs network hardware</category>
      <category domain="http://securityratty.com/tag/test">test</category>
      <category domain="http://securityratty.com/tag/radios">radios</category>
      <category domain="http://securityratty.com/tag/network radios">network radios</category>
      <category domain="http://securityratty.com/tag/army">army</category>
      <category domain="http://securityratty.com/tag/fcs coffers">fcs coffers</category>
      <source url="http://feeds.wired.com/~r/wired/politics/security/~3/281164412/robots_army">$160 Billion Robotic Army Network Passes First Big Test. Kinda.</source>
    </item>
    <item>
      <title><![CDATA[More High Profile Sites IFRAME Injected]]></title>
      <link>http://securityratty.com/article/97c88216eb87a2fbc044f1786b1d6ce8</link>
      <guid>http://securityratty.com/article/97c88216eb87a2fbc044f1786b1d6ce8</guid>
      <description><![CDATA[The ongoing monitoring of this campaign reveals that the group is continuing to expand the campaign, introducing over a hundred new bogus .info domains acting as traffic redirection points to the...]]></description>
      <content:encoded><![CDATA[<a href="http://bp1.blogger.com/_wICHhTiQmrA/R9fVaE-0GFI/AAAAAAAABdo/lBbPf6NfozM/s1600-h/iframe_injection_CSO.jpg"><img id="BLOGGER_PHOTO_ID_5176840940676192338" style="margin: 0px 10px 10px 0px; float: left;" alt="" src="http://bp1.blogger.com/_wICHhTiQmrA/R9fVaE-0GFI/AAAAAAAABdo/lBbPf6NfozM/s200/iframe_injection_CSO.jpg" border="0" /></a>The <a href="http://ddanchev.blogspot.com/2008/03/wiredcom-and-historycom-getting-rbn-ed.html">ongoing monitoring</a> of this <a href="http://ddanchev.blogspot.com/2008/03/more-cnet-sites-under-iframe-attack.html">campaign reveals</a> that <a href="http://ddanchev.blogspot.com/2008/03/zdnet-asia-and-torrentreactor-iframe-ed.html">the group</a> is continuing <a href="http://ddanchev.blogspot.com/2008/03/rogue-rbn-software-pushed-through.html">to expand</a> the campaign, <a href="http://ddanchev.blogspot.com/2008/03/injecting-iframes-by-abusing-input.html">introducing over</a> a hundred new bogus .info domains acting as traffic redirection points to the campaigns hardcoded within the secondary redirection point, in this case <strong>radt.info</strong> where a new malware variant of Zlob is attempting to install though an ActiveX object. These are the high profile sites targeted by the same group within the past 48 hours, with number of locally cached and IFRAME injected pages within their search engines :<br /><div><br />NCSU Libraries - <span style="font-weight: bold;">lib.ncsu.edu</span> - 372,000 pages<br />FullDownloads.us - <span style="font-weight: bold;">fulldownloads.us</span> - 13,000 pages<br />Central Statistics Office Ireland - <span style="font-weight: bold;">cso.ie</span> - 10,300 pages<br />DBLife Frontpage - <span style="font-weight: bold;">dblife.cs.wisc.edu</span> - 1,130 pages<br />School of Mathematics and Statistics - <span style="font-weight: bold;">www-history.mcs.st-andrews.ac.uk</span> - 1040 pages<br />eHawaii Portal - <span style="font-weight: bold;">ehawaii.gov</span> - 992 pages<br />The World Clock - <span style="font-weight: bold;">timeanddate.com</span> - 944 pages<br />Boise State University - <span style="font-weight: bold;">boisestate.edu</span> - 471 pages<br />The U.S. Administration on Aging (AoA) - <span style="font-weight: bold;">aoa.gov</span> - 425 pages<br />Gustavus Adolphus College - <span style="font-weight: bold;">gustavus.edu</span> - 312 pages<br />Internet Archive - <span style="font-weight: bold;">archive.org</span> - 261 pages<br />Stanford Business School Alumni Association - <span style="font-weight: bold;">gsbapps.stanford.edu</span> - 157 pages<br />BushTorrent -<span style="font-weight: bold;"> bushtorrent.com</span> - 147 pages<br />ChildCareExchange - <span style="font-weight: bold;">ccie.com</span> - 131 pages<br />The University of Vermont - <span style="font-weight: bold;">uvm.edu</span> - 120 pages<br />Hippodrome State Theatre - Gainesville, FL - <span style="font-weight: bold;">thehipp.org</span> - 112 pages<br />Minnesota State University Mankato - <span style="font-weight: bold;">mnsu.edu</span> - 94 pages<br />The California Majority Report - <span style="font-weight: bold;">camajorityreport.com</span> - 16 pages<br />Medicare.gov - <span style="font-weight: bold;">medicare.gov</span> - 12 pages<br />USAMRIID - <span style="font-weight: bold;">usamriid.army.mil</span> - 3 pages<br /><br /><a href="http://bp2.blogger.com/_wICHhTiQmrA/R9fZaU-0GGI/AAAAAAAABdw/gAd8mQtOdtM/s1600-h/iframe_injection_ncsu.jpg"><img id="BLOGGER_PHOTO_ID_5176845343017670754" style="margin: 0px 10px 10px 0px; float: left;" alt="" src="http://bp2.blogger.com/_wICHhTiQmrA/R9fZaU-0GGI/AAAAAAAABdw/gAd8mQtOdtM/s200/iframe_injection_ncsu.jpg" border="0" /></a>This sample of the newly introduced .info domains reside on the same netblock as the previous ones - <strong>75.125.181.0/255</strong> a KISS strategy making it easier to respond to this incident. Best of all, they further expand the campaign since they're injected in plain text, next to javascript obfuscated, this time embedded malware :<br /><br /><div> </div><strong>hickey.info</strong><br /><div><strong>kbst.info</strong></div><strong>sezejc.info</strong><br /><div><strong>mloqrd.info</strong></div><strong>mqghrd.info</strong><br /><div><strong>ymrxwd.info</strong></div><strong>fsqpsm.info</strong><br /><div><strong>haxkwd.info</strong></div><strong>aagpcw.info</strong><br /><div><strong>zdksgj.info</strong></div><strong>cgjttz.info</strong><br /><div><strong>hkedny.info</strong></div><strong>kbsxet.info</strong><br /><div><strong>wapdjw.info</strong></div><strong>kbsxet.info</strong><br /><div><strong>tdwham.info</strong></div><strong>mqghrd.info</strong><br /><div><strong>dhqjdz.info</strong></div><strong>bhrsaa.info</strong><br /><div><strong>jramae.info</strong></div><strong>wmtwes.info</strong><br /><div><strong>tacpmh.info</strong></div><strong>qwhhxq.info</strong><br /><div><strong>gmjett.info</strong></div><strong>hkedny.info</strong><br /><div><strong>rerkqz.info<br />bhrsaa.info</strong></div><strong>txmwxb.info</strong><br /><div><strong>psyckr.info</strong></div><strong>jramae.info</strong><br /><div><strong>nhwdrh.info</strong></div><span style="font-weight: bold;">cqqxkh.info</span><br /><div><strong>stysqf.info</strong></div><strong>tgzyqz.info</strong><br /><div><strong>kbsxet.info</strong></div><strong>cgjttz.info</strong><br /><div><strong>tazbhk.info</strong></div><strong>kbsxet.info</strong><br /><div> </div><br /><div>Each of the these is loading a secondary domain, which is then taking us to two more before finally reaching the Zlob variant. In this case it's <strong>radt.info </strong><strong style="font-weight: normal;">(75.125.208.243)</strong> with several campaigns currently up and running, pointing to the same fake codec. And the samples redirects upon visiting these as follows :<br /></div><div> </div><strong><br />seivomerutam.info/Free-Paris-Hilton-Nude-Pics/<br /></strong><strong>seivomerutam.info/spam/</strong><br /><div> </div><br />all of which ultimately redirect to :<br /><div> </div><strong><br />porn-popular.com</strong> (64.28.185.78) where the Zlob variant in the face of a fake codec, is downloaded from <strong>democodec.com/download/ democodec1292.exe</strong> (64.28.184.168) via an Active X object.<br /><br /><div> </div><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://bp0.blogger.com/_wICHhTiQmrA/R9fem0-0GHI/AAAAAAAABd4/HHD-sHBpx_k/s1600-h/iframe_input_validation_active_X.jpg"><img style="margin: 0pt 10px 10px 0pt; float: left; cursor: pointer;" src="http://bp0.blogger.com/_wICHhTiQmrA/R9fem0-0GHI/AAAAAAAABd4/HHD-sHBpx_k/s200/iframe_input_validation_active_X.jpg" alt="" id="BLOGGER_PHOTO_ID_5176851055324174450" border="0" /></a><strong>Scanner results</strong> : 22% Scanner(8/36) found malware!<br /><div>File Name : democodec1292.exe</div><strong>File Size</strong> : 74823 byte<br /><div><strong>MD5</strong> : 30965fdbd893990dd24abda2285d9edc</div><strong>SHA1</strong> : 53eacbb9cdf42394bd455d9bd2275f05730332f7<br /><div>Downloader.Zlob.ZV; Trojan-Downloader.Win32.Zlob.eie; TrojanDownloader.Zlob.epx</div><br /><div> </div>It gets even more interesting as according to <a href="http://ca.com/us/securityadvisor/pest/pest.aspx?id=453119651">Computer Associates</a> :<br /><div> </div><br /><div>"<em>This fake codec is actually a hijacker that will change your DNS settings whether you are aquire your IP settings through DHCP or set your IP information manually. <span style="font-weight: bold;">This hijacker will attempt to re-route all your DNS queries through 85.255.x.29 or 85.255.x.121.</span> If you use a static IP address, CA AntiSpyware will set your DNS server to 198.6.1.1 to prevent your DNS queries from continuing to go through the rogue DNS servers. Please change your DNS server to the DNS server provided by your IP or Network Administrator.</em>"</div><div> </div><br /><div><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://bp2.blogger.com/_wICHhTiQmrA/R9ffVU-0GII/AAAAAAAABeA/Ghf8PbhPtqI/s1600-h/zlob_variant_codec_IFRAME.jpg"><img style="margin: 0pt 10px 10px 0pt; float: left; cursor: pointer;" src="http://bp2.blogger.com/_wICHhTiQmrA/R9ffVU-0GII/AAAAAAAABeA/Ghf8PbhPtqI/s200/zlob_variant_codec_IFRAME.jpg" alt="" id="BLOGGER_PHOTO_ID_5176851854188091522" border="0" /></a>What this means is that <a href="http://ddanchev.blogspot.com/2008/02/geolocating-malicious-isps.html">known Russian Business Network netblocks</a> are receiving all the re-routed DNS queries from infected hosts, thereby setting up the foundations for a large scale pharming attack by infecting the weakest link, the end user from the perspective of using rogue DNS servers, a much more effective but noisy approach.</div><br /><div> </div>To sum up - it's a mess that I'll continue trying to structure, and it's a single group exploiting input validation capability within the sites' search engines we're talking about. With this segmented targeting of sites with high page ranks, and their persistance, is already positioning hundreds of thousands of keywords within the top search results, with the targeted sites are acting as the redirectors to the malware locations.</div><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=HfotYvF"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=HfotYvF" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=UFAs33F"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=UFAs33F" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=jrG9vvf"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=jrG9vvf" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=dDM9F6f"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=dDM9F6f" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=isZ3yzF"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=isZ3yzF" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=f8lRmjF"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=f8lRmjF" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=h8KWZCf"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=h8KWZCf" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/250167533" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 12 Mar 2008 06:49:36 +0000</pubDate>
      <category domain="http://securityratty.com/tag/info">info</category>
      <category domain="http://securityratty.com/tag/info txmwxb">info txmwxb</category>
      <category domain="http://securityratty.com/tag/info kbsxet">info kbsxet</category>
      <category domain="http://securityratty.com/tag/info bhrsaa">info bhrsaa</category>
      <category domain="http://securityratty.com/tag/info sezejc">info sezejc</category>
      <category domain="http://securityratty.com/tag/info cgjttz">info cgjttz</category>
      <category domain="http://securityratty.com/tag/info wmtwes">info wmtwes</category>
      <category domain="http://securityratty.com/tag/info cqqxkh">info cqqxkh</category>
      <category domain="http://securityratty.com/tag/info qwhhxq">info qwhhxq</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/250167533/more-high-profile-sites-iframe-injected.html">More High Profile Sites IFRAME Injected</source>
    </item>
    <item>
      <title><![CDATA[Wired.com and History.com Getting RBN-ed]]></title>
      <link>http://securityratty.com/article/43140f23637e75c4ac1b173b0948fe77</link>
      <guid>http://securityratty.com/article/43140f23637e75c4ac1b173b0948fe77</guid>
      <description><![CDATA[Monitoring last week's IFRAME injection attack at high page rank-ed sites , reveals a simple truth, that persistent simplicity seems to work. The attack is still ongoing, this time successfully...]]></description>
      <content:encoded><![CDATA[<a href="http://bp2.blogger.com/_wICHhTiQmrA/R9Ve-0-0F7I/AAAAAAAABcY/FHcHNlSIh1k/s1600-h/Wired_com_IFRAME_RBN.jpg"><img id="BLOGGER_PHOTO_ID_5176147780199258034" style="margin: 0px 10px 10px 0px; float: left;" alt="" src="http://bp2.blogger.com/_wICHhTiQmrA/R9Ve-0-0F7I/AAAAAAAABcY/FHcHNlSIh1k/s200/Wired_com_IFRAME_RBN.jpg" border="0" /></a>Monitoring <a href="http://ddanchev.blogspot.com/2008/03/rogue-rbn-software-pushed-through.html">last</a> week's <a href="http://ddanchev.blogspot.com/2008/03/zdnet-asia-and-torrentreactor-iframe-ed.html">IFRAME</a> injection <a href="http://ddanchev.blogspot.com/2008/03/more-cnet-sites-under-iframe-attack.html">attack</a> at high <a href="http://ddanchev.blogspot.com/2008/03/injecting-iframes-by-abusing-input.html">page rank-ed sites</a>, reveals a simple truth, that persistent simplicity seems to work. <strong>The attack is still ongoing, this time successfully injecting a multitude of new domains into Wired Magazine, and History.com's search engines, which are again caching anything submitted, particularly not validated input to have the malicious parties in the face of the RBN introducing a new malware, in between the pharmaceutical scams that they serve on the basis</strong><strong style="font-weight: bold;"> of an <a href="http://ddanchev.blogspot.com/2007/10/incentives-model-for-pharmaceutical.html">affiliation model</a>.</strong> So, after "<a href="http://www.itwire.com/content/view/17059/53/">CNET stops IFRAME site attacks - who's next?</a>" in terms of high-profile sites, that is <span style="font-weight: bold;">Wired.com</span> and <span style="font-weight: bold;">History.com</span><br /><div><br /><strong>Key summary points :</strong><br /><div> </div><br /><div>- the same malicious parties behind the CNET and TorrentReactor's IFRAME injection are also the ones behind Wired.com and History.com's <a href="http://ddanchev.blogspot.com/2008/03/injecting-iframes-by-abusing-input.html">abuse of input validation</a></div><br /><div> </div>- the IFRAME injection entirely relies on the lack of input validation within their search engines, making executable code possible to submit and therefore automatically execute upon accessing the cached page with a popular search query<div><strong></strong> </div><br />- many other domains have been introduced within the IFRAMEs, a complete list of which you can find in this post, several directly hosted within RBN's network<br /><div> </div><br /><div>- the main domain serving the heavily obfuscated VBS malware is located within the Russian Business Network's known netblocks</div><br /><div> </div>- given the high page ranks of the current and the previous targets, it is evident that the malicious parties are prioritizing based on the possibility to abuse input validation on high page rank-ed sites, presumably in an automated fashion<br /><div> </div><br /><div>- Keep it Simple Stupid works, as since they cannot find a way to embedd the IFRAME at these hosts, a clear indicating of the fact that they've breached them, they figured out a way to inject the IFRAMEs and again take advantage of the high page ranks to attract traffic by gaining on popular key words, or any kind of key words that they want to</div><br /><div><strong></strong></div><div><strong></strong></div><div><strong></strong></div><div><strong><div><a href="http://bp1.blogger.com/_wICHhTiQmrA/R9Vgsk-0F8I/AAAAAAAABcg/52pUSKuJCCQ/s1600-h/TV_com_IFRAME.jpg"><img id="BLOGGER_PHOTO_ID_5176149665689900994" style="margin: 0px 10px 10px 0px; float: left;" alt="" src="http://bp1.blogger.com/_wICHhTiQmrA/R9Vgsk-0F8I/AAAAAAAABcg/52pUSKuJCCQ/s200/TV_com_IFRAME.jpg" border="0" /></a></div>Sites currently affected next to Wired.com and History.com :</strong><br />fhp.osd.mil<br /></div>hcc.cc.gatech.edu<br />buffalo.edu<br />uninews.unimelb.edu.au<br />uvm.edu<br />jurist.law.pitt.edu<br />bushtorrent.com<br />torrentportal.com<br /><br /><br /><div><strong></strong><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://bp2.blogger.com/_wICHhTiQmrA/R9Vn40-0F9I/AAAAAAAABco/OYZwfHnp6C0/s1600-h/IFRAME_inputvalidation_RBN.jpg"><img style="margin: 0pt 10px 10px 0pt; float: left; cursor: pointer;" src="http://bp2.blogger.com/_wICHhTiQmrA/R9Vn40-0F9I/AAAAAAAABco/OYZwfHnp6C0/s200/IFRAME_inputvalidation_RBN.jpg" alt="" id="BLOGGER_PHOTO_ID_5176157572724692946" border="0" /></a><strong>Newly introduced domains within the IFRAMEs :</strong></div>f3w.info (74.54.95.242)<br /><div>chdjzn.info (75.125.181.78)</div>gmjett.info (75.125.181.89)<br /><div>yscmps.info (75.125.181.124)</div>egkjnx.info (75.125.208.242)<br /><div>qkecep.info (75.125.181.99)</div>qxdprq.info (75.125.181.113)<br /><div>yscmps.info (75.125.181.124)</div>mqghrd.info (75.125.181.82)<br /><div>yydcaj.info (75.125.181.122)</div>ecwrhk.info (75.125.181.86)<br /><div>zdksgj.info (75.125.181.112)</div>stysqf.info (75.125.181.67)<br /><div>egyffr.info (75.125.181.112)</div>prnprn.info (75.125.181.106)<br /><div>fast-look.com (195.225.176.25)</div>fami4ka.net (217.20.127.217)<br /><div>looseais.info (70.47.105.5)</div>my-ringtones.org (78.108.182.164)<br /><div>eyzempills.com (81.222.139.184)</div>leohin.com (58.65.239.10)<br /><div>is-t-h-e.com (69.50.167.165)</div>89.149.220.85<br /><div> </div><br /><div><strong>Where are the IFRAMEs relocating the visitor to?</strong></div>search-vip.org/pharmacy/search.php?q= (195.225.178.19)<br /><div>pharma-cist.com/item.php?id=156 (81.222.139.93)</div>vip-pharmacy.org (195.225.178.19)<br /><div>adultfriendfinder.com/go/g665961<br />gift-vip.net/images/index1.php<br /></div><div> </div><br /><div><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://bp2.blogger.com/_wICHhTiQmrA/R9Voo0-0F-I/AAAAAAAABcw/YEnw-tBUcG8/s1600-h/RBN_hosted_VBS.jpg"><img style="margin: 0pt 10px 10px 0pt; float: left; cursor: pointer;" src="http://bp2.blogger.com/_wICHhTiQmrA/R9Voo0-0F-I/AAAAAAAABcw/YEnw-tBUcG8/s200/RBN_hosted_VBS.jpg" alt="" id="BLOGGER_PHOTO_ID_5176158397358413794" border="0" /></a><strong>Where's the malware?</strong></div><div> </div>The malware is loading from <strong>g</strong><strong>ift-vip.net/images/index1.php</strong> (195.225.178.19) where upon loading another IFRAME pointing to <strong>e.pepato.org/e/ads.php?b=3029</strong> (58.65.238.59) which is using <a href="http://ddanchev.blogspot.com/2008/02/geolocating-malicious-isps.html">HostFresh</a> proving hosting, dns services courtesy of <a href="http://ddanchev.blogspot.com/2008/02/geolocating-malicious-isps.html">INTERCAGE-NETWORK-GROUP</a>, or the The Russian Business Network in all of its netblock diversity. It seems that <strong>pepato.org</strong>, currently hosted on one of RBN's netblocks, also made an appearance at <a href="http://blogs.ittoolbox.com/security/epl/archives/another-gov-site-hacked-22649">malware embedded attack at a .gov site</a> recently.<br /><div> </div><br /><div><strong>Scanner results</strong> : 3% Scanner(1/36) found malware!</div><strong>File Size</strong> : 16643 byte<br /><div><strong>MD5</strong> : 99eae1a189443c1a87681579cb4b5dbd</div><strong>SHA1</strong> : 89a04c4d06f51aa6d6cb54925a2c84d2bbdba06b<br /><div><strong>Arcavir</strong> - Trojan.HTML.JScript.Freebs.gen.9 under the JS:Feebs family; W32/Feebs-Fam ;JS.Feebs.Gen</div><br /><div> </div><strong>Several more currently active internal pages serving variants :</strong><br /><div>e.pepato.org/e/ads.php?b=3029</div>e.pepato.org/e/ads_nl.php?b=1006<br /><div>e.pepato.org/e/ads.php?b=1004</div>e.pepato.org/e/adsr.php?t=0<br /><div>e.pepato.org/e/mdqt.php</div>e.pepato.org/e/e1004.html<br /><br />Monitoring these connected incidents will continue, particularly the RBN connection, and other high profile sites' susceptibility to their attack methods.<br /><br /><span style="font-weight: bold;">Related embedded malware research :</span><br /><a href="http://ddanchev.blogspot.com/2008/03/embedding-malicious-iframes-through.html">Embedding Malicious IFRAMEs Through Stolen FTP Accounts</a><br /><a href="http://ddanchev.blogspot.com/2008/02/yet-another-massive-embedded-malware.html">Yet Another Massive Embedded Malware Attack</a><br /><a href="http://ddanchev.blogspot.com/2007/12/mdac-activex-code-execution-exploit.html">MDAC ActiveX Code Execution Exploit Still in the Wild</a><br /><a href="http://ddanchev.blogspot.com/2008/01/malware-serving-exploits-embedded-sites.html">Malware Serving Exploits Embedded Sites as Usual</a><br /><a href="http://ddanchev.blogspot.com/2008/01/massive-realplayer-exploit-embedded.html">Massive RealPlayer Exploit Embedded Attack</a><br /><a href="http://ddanchev.blogspot.com/2007/09/syrian-embassy-in-london-serving.html">Syrian Embassy in London Serving Malware</a><br /><a href="http://ddanchev.blogspot.com/2007/08/bank-of-india-serving-malware.html">Bank of India Serving Malware</a><br /><a href="http://ddanchev.blogspot.com/2007/09/us-consulate-st-petersburg-serving.html">U.S Consulate St. Petersburg Serving Malware</a><br /><a href="http://ddanchev.blogspot.com/2008/01/dutch-embassy-in-moscow-serving-malware.html">The Dutch Embassy in Moscow Serving Malware</a><br /><a href="http://ddanchev.blogspot.com/2008/02/uks-feta-serving-malware.html">U.K's FETA Serving Malware</a><br /><a href="http://ddanchev.blogspot.com/2008/02/anti-malware-vendors-site-serving.html">Anti-Malware Vendor's Site Serving Malware</a><br /><a href="http://ddanchev.blogspot.com/2008/02/new-media-malware-gang-part-three.html">The New Media Malware Gang - Part Three</a><br /><a href="http://ddanchev.blogspot.com/2007/12/new-media-malware-gang-part-two.html">The New Media Malware Gang - Part Two</a><br /><a href="http://ddanchev.blogspot.com/2007/11/new-media-malware-gang.html">The New Media Malware Gang</a><br /><a href="http://ddanchev.blogspot.com/2007/10/portfolio-of-malware-embedded-magazines.html">A Portfolio of Malware Embedded Magazines</a><br /><a href="http://ddanchev.blogspot.com/2007/11/another-massive-embedded-malware-attack.html">Another Massive Embedded Malware Attack</a><br /><a href="http://ddanchev.blogspot.com/2007/11/i-see-alive-iframes-everywhere.html">I See Alive IFRAMEs Everywhere</a><br /><a href="http://ddanchev.blogspot.com/2007/11/i-see-alive-iframes-everywhere-part-two.html">I See Alive IFRAMEs Everywhere - Part Two</a><br /><br /><span style="font-weight: bold;">Related RBN research :</span><br /><a href="http://ddanchev.blogspot.com/2008/02/rbns-phishing-activities.html">RBN's Phishing Activities</a><br /><a href="http://ddanchev.blogspot.com/2008/02/rbns-malware-puppets-need-their-master.html">RBN's Puppets Need Their Master</a><br /><a href="http://ddanchev.blogspot.com/2008/01/rbns-fake-account-suspended-notices.html">RBN's Fake Account Suspended Notices</a><br /><a href="http://ddanchev.blogspot.com/2007/12/diverse-portfolio-of-fake-security.html">A Diverse Portfolio of Fake Security Software</a><br /><a href="http://ddanchev.blogspot.com/2007/11/go-to-sleep-go-to-sleep-my-little-rbn.html">Go to Sleep, Go to Sleep my Little RBN</a><br /><a href="http://ddanchev.blogspot.com/2007/11/exposing-russian-business-network.html">Exposing the Russian Business Network</a><br /><a href="http://ddanchev.blogspot.com/2007/11/detecting-and-blocking-russian-business.html">Detecting the Blocking the Russian Business Network</a><br /><a href="http://ddanchev.blogspot.com/2007/10/over-100-malwares-hosted-on-single-rbn.html">Over 100 Malwares Hosted on a Single RBN IP</a><br /><a href="http://ddanchev.blogspot.com/2007/10/rbns-fake-security-software.html">RBN's Fake Security Software</a><br /><a href="http://ddanchev.blogspot.com/2007/10/russian-business-network.html">The Russian Business Network</a><br /><div> </div></div><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=sJfg24F"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=sJfg24F" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=lYPOJOF"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=lYPOJOF" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=tSeiX9f"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=tSeiX9f" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=0JQnkkf"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=0JQnkkf" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=904JlAF"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=904JlAF" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=92oj9xF"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=92oj9xF" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=JV7Ydmf"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=JV7Ydmf" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/249045166" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 10 Mar 2008 11:20:33 +0000</pubDate>
      <category domain="http://securityratty.com/tag/malware">malware</category>
      <category domain="http://securityratty.com/tag/vbs malware">vbs malware</category>
      <category domain="http://securityratty.com/tag/malware attack">malware attack</category>
      <category domain="http://securityratty.com/tag/rbn">rbn</category>
      <category domain="http://securityratty.com/tag/media malware gang">media malware gang</category>
      <category domain="http://securityratty.com/tag/iframe injection attack">iframe injection attack</category>
      <category domain="http://securityratty.com/tag/iframe injection">iframe injection</category>
      <category domain="http://securityratty.com/tag/malware research">malware research</category>
      <category domain="http://securityratty.com/tag/high-profile sites">high-profile sites</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/249045166/wiredcom-and-historycom-getting-rbn-ed.html">Wired.com and History.com Getting RBN-ed</source>
    </item>
    <item>
      <title><![CDATA[Phishers, Spammers, and Malware Authors Clearly Consolidating]]></title>
      <link>http://securityratty.com/article/630ba3b8e9e355ca51f97bb8a3578cf9</link>
      <guid>http://securityratty.com/article/630ba3b8e9e355ca51f97bb8a3578cf9</guid>
      <description><![CDATA[In a recent article entitled &quot; Popular Spammers Strategies and Tactics &quot; I emphasized on the consolidation that's been going on between phishers, spammers and malware authors for a while

The allure...]]></description>
      <content:encoded><![CDATA[<a href="http://bp2.blogger.com/_wICHhTiQmrA/R1yns6ehXuI/AAAAAAAABOM/25SKtSRTkDs/s1600-h/biting_email.jpg"><img id="BLOGGER_PHOTO_ID_5142169264603619042" style="FLOAT: left; MARGIN: 0px 10px 10px 0px; CURSOR: hand" alt="" src="http://bp2.blogger.com/_wICHhTiQmrA/R1yns6ehXuI/AAAAAAAABOM/25SKtSRTkDs/s200/biting_email.jpg" border="0" /></a>In a recent article entitled "<a href="http://www.windowsecurity.com/articles/Popular-Spammers-Strategies-Tactics.html">Popular Spammers Strategies and Tactics</a>" I emphasized on the consolidation that's been going on between phishers, spammers and malware authors for a while :<br /><br />"<em>The allure of being self-sufficient doesn’t seem to be a relevant one when it comes to a spammer’s results oriented attitude. </em><a href="http://ddanchev.blogspot.com/2007/01/inside-email-harvesters-configuration.html" target="_blank"><em>Spammers excel at harvesting and purchasing email addresses</em></a><em>, sending, and successfully delivering the messages, phishers are masters of social engineering, while on the other hand malware authors or botnet masters in this case, provide the infrastructure for both </em><a href="http://ddanchev.blogspot.com/2007/10/fast-flux-spam-and-scams-increasing.html" target="_blank"><em>the fast-fluxing spam and scams</em></a><em> in the form of infected hosts. We’ve been witnessing this consolidation for quite some time now, and some of the recent events greatly illustrate this development of an </em><a href="http://ddanchev.blogspot.com/2007/02/phishing-ecosystem.html" target="_blank"><em>underground ecosystem</em></a><em>. Take for instance the cases when spam comes with </em><a href="http://www.informationweek.com/news/showArticle.jhtml?articleID=202603073" target="_blank"><em>embedded keyloggers</em></a><em>, when </em><a href="http://computerworld.com/action/article.do?command=viewArticleBasic&amp;taxonomyName=security&amp;articleId=9044598&amp;taxonomyId=17&amp;intsrc=kc_top" target="_blank"><em>phishing emails contain malware</em></a><em>, and a rather ironical situation where <a href="http://www.wired.com/politics/security/news/2007/09/pfizerspam">malware infected hosts inside Pfizer are spamming viagra emails</a>.</em>"<br /><br />The recently <a href="http://www.theregister.co.uk/2007/12/07/national_labs_breached/">uncovered breach at the U.S Oak Ridge National Laboratory</a> is a perfect example of some of the key concepts I covered in the article, namely, harvesting of the emails courtesy of the spammers, segmenting the emails database for <a href="http://ddanchev.blogspot.com/2007/11/targeted-spamming-of-bankers-malware.html">targeted mailings</a> on a per company, institution basis, and malware authors eventually purchasing the now segmented databases for such targeted attacks with the spammers earning a <a href="http://ddanchev.blogspot.com/2007/10/dynamics-of-malware-industry.html">higher profit margin</a> for <a href="http://ddanchev.blogspot.com/2007/03/underground-economys-supply-of-goods.html">providing the service</a> of segmentation :<br /><br />"<em>The unknown attackers managed to access a non-classified computer maintained by the Oak Ridge National Laboratory by sending employees hoax emails that contained malicious attachments. That allowed them to access a database containing the personal information of people who visited the lab over a 14-year period starting in 1990. The institution, which has a staff of about 3,800, conducts top-secret research that is used for homeland security and military purposes.</em>"<br /><br />And, of course, <a href="http://www.nytimes.com/2007/12/09/us/nationalspecial3/09hack.html?ref=technology">there's a Chinese connection</a>, but thankfully there're articles emphasizing on the concept of <a href="http://ddanchev.blogspot.com/2007/09/chinas-cyber-espionage-ambitions.html">stepping-stones before reaching the final destination</a>, with China's highly malware infected Internet population acting as the stepping-stone, not the original source of the attack :<br /><br />"<em>Security researchers said the memorandum, which was obtained by The New York Times from an executive at a private company, included a list of Web and Internet addresses that were linked to locations in China. However, they noted that such links did not prove that the Chinese government or Chinese citizens were involved in the attacks. In the past, intruders have compromised computers in China and then used them to disguise their true location.</em>"<br /><br /><a href="http://ddanchev.blogspot.com/2007/11/are-you-botnet-ing-with-me.html">Publicly obtainable research</a>, and common sense state that malware coming through email attachments is slowing down, and is actually supposed to be filtered on the gateway perimeter by default, especially executables. Even the <a href="http://ddanchev.blogspot.com/2007/01/social-engineering-and-malware.html">first round of Storm Worm malware in January, 2007</a>, concluded that email attachments are not longer as effective as they used to be, and therefore migrated to spamming malware embedded links <a href="http://ddanchev.blogspot.com/2007/12/mdac-activex-code-execution-exploit.html">exploiting outdated vulnerabilities</a>.<br /><br /><strong>How such type of targeted malware attack could have been prevented?</strong><br /><br />- ensure that the emails are harvested much harder than they are for the time being, in this particular case, a huge percentage of the emails account, thus the future contact points for the malicious parties to take advantage of ornl.gov can be harvested without even bothering to crawl the domain itself through web scrapping ornl.gov<br /><br />- a freely avaivable, but <a href="http://www.guay-leroux.com/projects/pirana-0.3.3.tar.gz">highly effective tool</a> to evaluate whether or not your mail server filtering capabilities for such type of content work, is <a href="http://www.guay-leroux.com/projects.html">PIRANA - Email Content Filters Exploitation Framework</a> :<br /><br />"<em>PIRANA is an exploitation framework that tests the security of a email content filter. By means of a vulnerability database, the content filter to be tested will be bombarded by various emails containing a malicious payload intended to compromise the computing platform. PIRANA's goal is to test whether or not any vulnerability exists on the content filtering platform. This tool uses the excellent shellcode generator from the Metasploit framework!</em>"<br /><br />Taking the second possible scenario, namely that it wasn't a targeted attack, but malware attachments "as usual", mostly because the fact that <a href="http://ddanchev.blogspot.com/2007/01/inside-email-harvesters-configuration.html">modern malware automatically excludes mailings to .gov's .mil's</a> and the majority of known to them anti-virus vendor's related email addresses, hoping to infect as much people as possible before a reactive response is in place.<br /><br />If it were a spammed malware embedded link, the chances are the receipts followed it, but a spammed malware as an attachment is too Web 1.0 for someone to fall victim into, and it's rocket scientists we're talking about anyway.<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=BHqtoDC"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=BHqtoDC" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=qwca1qC"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=qwca1qC" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=kD3t2mc"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=kD3t2mc" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=yN6jNXc"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=yN6jNXc" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=QWTgNIC"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=QWTgNIC" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=leJnuyC"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=leJnuyC" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=TRFYlDc"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=TRFYlDc" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/197838910" height="1" width="1"/>]]></content:encoded>
      <pubDate>Sun, 09 Dec 2007 18:14:53 +0000</pubDate>
      <category domain="http://securityratty.com/tag/malware">malware</category>
      <category domain="http://securityratty.com/tag/malware attachments">malware attachments</category>
      <category domain="http://securityratty.com/tag/malware attack">malware attack</category>
      <category domain="http://securityratty.com/tag/malware authors">malware authors</category>
      <category domain="http://securityratty.com/tag/hand malware authors">hand malware authors</category>
      <category domain="http://securityratty.com/tag/spammers">spammers</category>
      <category domain="http://securityratty.com/tag/modern malware">modern malware</category>
      <category domain="http://securityratty.com/tag/storm worm malware">storm worm malware</category>
      <category domain="http://securityratty.com/tag/emails courtesy">emails courtesy</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/197838910/phishers-spammers-and-malware-authors.html">Phishers, Spammers, and Malware Authors Clearly Consolidating</source>
    </item>
  </channel>
</rss>
