<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: multimedia]]></title>
    <link>http://securityratty.com/tag/multimedia</link>
    <description></description>
    <pubDate>Tue, 18 Mar 2008 16:58:23 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[The Results Are In: Real Savings with Deploying Global Telepresence & Multimedia Services]]></title>
      <link>http://securityratty.com/article/a70543fdfebfecce1ea619cd5382c0ae</link>
      <guid>http://securityratty.com/article/a70543fdfebfecce1ea619cd5382c0ae</guid>
      <description><![CDATA[WHEN: Thursday, October 30th10 AM PT / 1 PM ET Join us today!SPONSORED BY: Nortel-PolycomJoin this FREE webinar to see how leading enterprises are effectively deploying global Telepresence to...]]></description>
      <content:encoded><![CDATA[WHEN: Thursday, October 30th10 AM PT / 1 PM ET Join us today!SPONSORED BY: Nortel-PolycomJoin this FREE webinar to see how leading enterprises are effectively deploying global Telepresence to communi...]]></content:encoded>
      <pubDate>Mon, 06 Oct 2008 08:42:16 +0000</pubDate>
      <category domain="http://securityratty.com/tag/global telepresence">global telepresence</category>
      <category domain="http://securityratty.com/tag/october 30th10">october 30th10</category>
      <category domain="http://securityratty.com/tag/free webinar">free webinar</category>
      <category domain="http://securityratty.com/tag/communi">communi</category>
      <category domain="http://securityratty.com/tag/thursday">thursday</category>
      <category domain="http://securityratty.com/tag/enterprises">enterprises</category>
      <category domain="http://securityratty.com/tag/effectively">effectively</category>
      <category domain="http://securityratty.com/tag/join">join</category>
      <source url="http://feeds.feedburner.com/~r/itsecurity/~3/413124564/">The Results Are In: Real Savings with Deploying Global Telepresence &amp; Multimedia Services</source>
    </item>
    <item>
      <title><![CDATA[Sorry, Qantas, No Unfettered Broadband]]></title>
      <link>http://securityratty.com/article/e46bb700b1a972d41bfd64aba65817f9</link>
      <guid>http://securityratty.com/article/e46bb700b1a972d41bfd64aba65817f9</guid>
      <description><![CDATA[Qantas backs off from earlier plans, changes provider for in-flight broadband: The Sydney Morning Herald somewhat erratically and incompletely reports that Qantas has delayed and modified its...]]></description>
      <content:encoded><![CDATA[<p><img src="http://wifinetnews.com/images/plane.jpg" align="right" border="0" hspace="5" /><a href="http://www.smh.com.au/news/travel/qantas-limits-access-to-web/2008/09/17/1221330929870.html"><strong>Qantas backs off from earlier plans, changes provider for in-flight broadband:</strong></a> The Sydney Morning Herald somewhat erratically and incompletely reports that Qantas has delayed and modified its in-flight broadband plans. Aeromobile was the provider when the service <a href="http://www.breakingtravelnews.com/article.php?story=2007081609481129&query=qantas"><strong>was tested in second quarter 2007</strong></a>, but OnAir is now described as the airline's partner. This was noted by colleague Fabio Zambelli, who emailed me the news, and <a href="http://www.setteb.it/content/view/4742"><strong>has his own account</strong></a> at 7BIT (in Italian).</p>

<p><a href="http://www.onair.aero/index.php?pid=123"><strong>OnAir</strong></a> has so far tested their calling/texting-only service on two aircraft--one operated by Air France, one by TAP Portugal--even though RyanAir announced plans that its planes would started being unwired with the service by late 2007. Still no word on that fleet progress.</p>

<p>Qantas will apparently launch cached Web browsing and limited Web email (probably through a proxy) along with instant messaging, with full Internet service coming "later in 2009." This is clearly due to a lack of satellite coverage that was just remediated a few weeks ago (see below). The first plane with limited service, a new A380, should be in flight 20-October-2008.</p>

<div style="float:right; margin:0px; padding-left: 10px; padding-bottom: 0px;"><p><img src="http://wifinetnews.com//images/2008/SorryQantas.jpg" alt="SorryQantas.jpg" border="0" width="100" height="152"></p><p style="font-size: 10px">I hate in-flight<br/>broadband</p></div>To Qantas' credit, note that each seat on the plane will have a laptop opower socket, a USB port, and a multimedia system that can show 100 movies and 500 TV show episodes, play the contents of 1,000 CDs and 20 radio stations, and offer 80 games. 

<p>The Morning Herald seems to overstate the importance and scope of a complaint filed by the union representing American Airlines' flight attendants. The detailed coverage in the U.S. had more to do with the potential for issues, and likely attendants lack of interest in policing yet another media on the plane. Filtering doesn't work, the attendants probably already know, and this may just be a negotiating point with the airline.</p>

<p>On why Qantas is waiting until late 2009? This requires unwinding how OnAir gets its signal.</p>

<p>Aeromobile and OnAir both rely on Inmarsat satellites for their service. Both companies had several years ago staked their futures on the fourth-generation network Inmarsat was to inaugurate with three satellites that would use beamforming to allow precise delivery of nearly 500 Kbps per receiver, with hundreds or thousands of regions being able to be targeted from a single satellite. Inmarsat's third-gen network--don't confuse this with 3G cellular ground-based networks--can deliver about 64 Kbps per channel.</p>

<p>Now, unfortunately, Inmarsat was three years late on launching its trans-Pacific bird. While the company <a href="http://www.inmarsat.com/About/Newsroom/Press/00021465.aspx?language=EN&textonly=False"><strong>claims 85 percent coverage of the earth</strong></a> and 98 percent coverage of population, there's a big gap over the Pacific that also prevents them from having good overlap between the U.S. and Japan/China/Korea, as well as the southern Pacific, covering Australia. Since the biggest market for long-haul flights would likely be Australia, Japan, and China, traveling trans-Pacific or trans-hemispheric routes, that gap is rather large.</p>

<p>Aeromobile opted to build out a service, deployed only by Emirates airline as far as I can tell, that uses the 3G service since it was available, and most necessary equipment is already installed on most over-water planes. OnAir was waiting for 4G, which has necessitated a long wait, but allowed them to launch in Europe with a seemingly next-generation service. Given that OnAir is controlled by an airline-owned integration firm, SITA, and by Airbus, they're not going anywhere.</p>

<p>Inmarsat finally <a href="http://spaceflightnow.com/proton/i4f3/"><strong>lofted its third satellite on Baikonur Cosmodrome in Kazakhstan</strong></a> on 19-August-2008, and the launch and separation was reported as successful. Previously, the company has needed up to a year to verify and deploy its 4G satellites. (You can <a href="http://forum.nasaspaceflight.com/index.php?topic=12380.105"><strong>read extremely close coverage of the launch</strong></a> at a Web site devoted to space enthusiasm.)</p>

<p>However, the dirty little secret about Inmarsat's BGAN is that it costs a fortune to heft bandwidth across it. Thus, in-flight broadband over BGAN, if it's ever available, is going to be changed on an extremely high per-MB rate. None of the providers want to say this. This is in contrast to Row 44 (and, once, Connexion by Boeing), which relies on leased Ku-band transponders where they can fix costs and they require high volumes to keep per-bit costs efffectively low.</p>

<p>OnAir's launch of calling on Air France's service involves paying a few euros per minute for calls, which might help you understand what data costs could ultimately run.</p>]]></content:encoded>
      <pubDate>Thu, 18 Sep 2008 06:33:20 +0000</pubDate>
      <category domain="http://securityratty.com/tag/satellite coverage">satellite coverage</category>
      <category domain="http://securityratty.com/tag/coverage">coverage</category>
      <category domain="http://securityratty.com/tag/service">service</category>
      <category domain="http://securityratty.com/tag/service involves">service involves</category>
      <category domain="http://securityratty.com/tag/internet service">internet service</category>
      <category domain="http://securityratty.com/tag/in-flight broadband plans">in-flight broadband plans</category>
      <category domain="http://securityratty.com/tag/plans">plans</category>
      <category domain="http://securityratty.com/tag/inmarsat satellites">inmarsat satellites</category>
      <category domain="http://securityratty.com/tag/inmarsat">inmarsat</category>
      <source url="http://wifinetnews.com/archives/008448.html">Sorry, Qantas, No Unfettered Broadband</source>
    </item>
    <item>
      <title><![CDATA[RealNetworks patches four critical bugs in multimedia player]]></title>
      <link>http://securityratty.com/article/586869ad6db9c84dbadee74bdf3f69f8</link>
      <guid>http://securityratty.com/article/586869ad6db9c84dbadee74bdf3f69f8</guid>
      <description><![CDATA[RealNetworks has issued four critical patches for several versions of its RealPlayer running on Windows, Linux and Apple's Mac OS...]]></description>
      <content:encoded><![CDATA[RealNetworks has issued four critical patches for several versions of its RealPlayer running on Windows, Linux and Apple's Mac OS X.]]></content:encoded>
      <pubDate>Sun, 27 Jul 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/critical patches">critical patches</category>
      <category domain="http://securityratty.com/tag/realnetworks">realnetworks</category>
      <category domain="http://securityratty.com/tag/apple">apple</category>
      <category domain="http://securityratty.com/tag/windows">windows</category>
      <category domain="http://securityratty.com/tag/linux">linux</category>
      <category domain="http://securityratty.com/tag/versions">versions</category>
      <category domain="http://securityratty.com/tag/realplayer">realplayer</category>
      <category domain="http://securityratty.com/tag/mac">mac</category>
      <source url="http://www.networkworld.com/news/2008/072808-realnetworks-patches-four-critical-bugs.html?fsrc=rss-security">RealNetworks patches four critical bugs in multimedia player</source>
    </item>
    <item>
      <title><![CDATA[Apple releases QuickTime 7.5 with bug fixes]]></title>
      <link>http://securityratty.com/article/fab324f932ded1ec9874efd2f9aad90b</link>
      <guid>http://securityratty.com/article/fab324f932ded1ec9874efd2f9aad90b</guid>
      <description><![CDATA[Apple has again released a new version of QuickTime, its multimedia player that has been plagued by software...]]></description>
      <content:encoded><![CDATA[Apple has again released a new version of QuickTime, its multimedia player that has been plagued by software vulnerabilities.<p><A href="http://ad.doubleclick.net/jump/idg.us.nwf.rss/security;sz=468x60;ord=45440?">
<IMG src="http://ad.doubleclick.net/ad/idg.us.nwf.rss/security;sz=468x60;ord=45440?" border="0" width="468" height="60"></A>
</p>]]></content:encoded>
      <pubDate>Mon, 09 Jun 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/multimedia player">multimedia player</category>
      <category domain="http://securityratty.com/tag/quicktime">quicktime</category>
      <category domain="http://securityratty.com/tag/apple">apple</category>
      <category domain="http://securityratty.com/tag/software vulnerabilities">software vulnerabilities</category>
      <category domain="http://securityratty.com/tag/version">version</category>
      <source url="http://www.networkworld.com/news/2008/061008-apple-releases-quicktime-75-with.html?fsrc=rss-security">Apple releases QuickTime 7.5 with bug fixes</source>
    </item>
    <item>
      <title><![CDATA[Blackhat SEO Redirects to Malware and Rogue Software]]></title>
      <link>http://securityratty.com/article/2199017f7c1af4461b71026dc303b308</link>
      <guid>http://securityratty.com/article/2199017f7c1af4461b71026dc303b308</guid>
      <description><![CDATA[A black SEO farm with built-in redirection to a multitude of sites serving rogue codecs (Zlob malware variants) and fake security software phoning back to UkrTeleGroup Ltd's network - could it get...]]></description>
      <content:encoded><![CDATA[<div><a href="http://bp3.blogger.com/_wICHhTiQmrA/SEe1DIDe2DI/AAAAAAAABxI/dNKrE60D00g/s1600-h/pornotubedirect1.JPG"><img id="BLOGGER_PHOTO_ID_5208330559383590962" style="margin: 0px 10px 10px 0px; float: left;" alt="" src="http://bp3.blogger.com/_wICHhTiQmrA/SEe1DIDe2DI/AAAAAAAABxI/dNKrE60D00g/s200/pornotubedirect1.JPG" border="0" /></a>A black SEO farm with built-in redirection to a multitude of sites serving rogue codecs (Zlob malware variants) and <a href="http://ddanchev.blogspot.com/2008/05/got-your-xpshield-up-and-running.html">fake security software</a> phoning back to <a href="http://ddanchev.blogspot.com/2008/02/geolocating-malicious-isps.html">UkrTeleGroup Ltd's</a> network - could it get even more interesting? Of course, as the current state of Zlob malware serving tactics can be seperated in two distinct groups, those abusing the <a href="http://ddanchev.blogspot.com/2008/05/malware-attack-exploiting-flash-zero.html">"sort of" zero day Flash exploit</a>, as the currently <a href="http://ddanchev.blogspot.com/2008/05/yet-another-massive-sql-injection.html">active SQL injection attacks</a> are all taking advantage of it, and those still relying on plain simple redirect to multimedia sites requiring you to install the fake codec.<br /><br /><br /><div><div><a href="http://bp0.blogger.com/_wICHhTiQmrA/SEe3eSO6t8I/AAAAAAAABxQ/GtMaVRNVy4E/s1600-h/blackhat_SEO_visualized.JPG"><img id="BLOGGER_PHOTO_ID_5208333224995633090" style="margin: 0px 10px 10px 0px; float: left;" alt="" src="http://bp0.blogger.com/_wICHhTiQmrA/SEe3eSO6t8I/AAAAAAAABxQ/GtMaVRNVy4E/s200/blackhat_SEO_visualized.JPG" border="0" /></a>While tracking down the <a href="http://ddanchev.blogspot.com/2008/03/massive-iframe-seo-poisoning-attack.html">massive blackhat SEO poisoning campaigns</a> that took place in March, 2008, as well as the countless number of embedded/injected malware campaigns targeting high profile sites that we've been seeing recently, it's becoming increasingly common to come across a repeating malicious pattern. Basically, a <a href="http://ddanchev.blogspot.com/2008/03/portfolio-of-fake-video-codecs.html">domain portfolio of typosquatted domains</a> looking like legitimate codec sites is created, several bogus video, mostly p0rn related sites with no content start acting as a frontend to the codecs, where traffic is driven through blackhat SEO doorways. Moreover, rogue codec sites are increasing because the templates for the p0rn and codec sites are turning into a commodity, just like phishing pages and DIY phishing page generators lowering down the entry barriers into these practices.</div><br /><div><br /></div><div><a href="http://bp3.blogger.com/_wICHhTiQmrA/SEfKn96fT7I/AAAAAAAABxY/kbygMpNzS54/s1600-h/blackhat_seo_codecs3.png"><img id="BLOGGER_PHOTO_ID_5208354282060861362" style="margin: 0px 10px 10px 0px; float: left;" alt="" src="http://bp3.blogger.com/_wICHhTiQmrA/SEfKn96fT7I/AAAAAAAABxY/kbygMpNzS54/s200/blackhat_seo_codecs3.png" border="0" /></a>Let's assess a sample redirection doorway, a visualization and sample traffic of which you can see in the attached screenshots. At <strong>porntubedirect.info </strong>we have a fake counter <strong>porntubedirect.info/stat/count.php</strong> loading the redirection script from <strong>216.240.139.234/sutra/in.cgi?3</strong> which is a javascript serving a different site on-the-fly, courtesy of a well known blackhat SEO campaign tool. The output of this redirection is a new domain serving Zlob variants in the form of fake codecs hosted under the following domains :</div><br /><div><strong>antivirus-scanonline.com</strong><br /></div><div><strong>indafuckfuck.com</strong></div><strong>newcontents2008.com</strong><br /><div><strong>avwav.com</strong></div><strong>anykindclips.com</strong><br /><div><strong>dirtyxxxvids.com</strong></div><strong>clipsmachines.com</strong><br /><div><strong>thesoft-portal-08.com</strong></div><br /><div>Sample detecton rates for the codecs obtained :<br /></div><div><br /></div><div>Scanners Result: 8/32 (25%)</div><span style="font-weight: bold;">W32/PolyZlob!tr.dldr; Trojan:Win32/Tibs.gen!lds</span><br /><div>File size: 119296 bytes </div>MD5...: dc5538af557cb4c311cb86d6574400ba<br /><div>SHA1..: 5cf1602db8c4fdd3c5ac5101e5a6c5daa77f5ff1</div><br /><div>Scanners Result: 6/32 (18.75%)<br /></div><div style="font-weight: bold;">Trojan-Downloader.Win32.FraudLoad.axa; Trojan.Dldr.FraudLoad.axa</div>File size: 60416 bytes<br /><div>MD5...: 14938bfe35128687e05f7f8ccbd29c7d </div>SHA1..: cf651e959fff945c9659321e79ba2788062b721d<br /><div><br /></div><div>Scanners Result: 14/32 (43.75%)</div><span style="font-weight: bold;">Trojan-Downloader.Win32.Zlob.lps; TrojanDownloader:Win32/Zlob.IB</span><br /><div>File size: 18432 bytes</div>MD5...: 9b3bbcd4549970a92eb1b11c46a451bb<br /><div>SHA1..: 679508aba4e547935d5e4104a735c754b40de49e</div><br /><div>Scanners Result: 18/32 (56.25%)<br /></div><div style="font-weight: bold;">Trojan-Downloader.Win32.Delf.ilx; TrojanDownloader:Win32/Chengtot.A</div>File size: 91683 bytes<br /><div>MD5...: 727e3f353281229128fdb1728d6ef345</div>SHA1..: 3f9c9000b273e8bf75db322382fbaabf333faf26<br /><div><br />Once we've managed to obtain several of the fake codec domains, passive DNS monitoring and using third-party tools helps us expose a huge portfolio of rogue domains such as :</div><br /><div><a href="http://bp3.blogger.com/_wICHhTiQmrA/SEfM81C3WTI/AAAAAAAABxo/whvBq4dE_sE/s1600-h/blackhat_seo_codecs1.png"><img id="BLOGGER_PHOTO_ID_5208356839480580402" style="margin: 0px 10px 10px 0px; float: left;" alt="" src="http://bp3.blogger.com/_wICHhTiQmrA/SEfM81C3WTI/AAAAAAAABxo/whvBq4dE_sE/s200/blackhat_seo_codecs1.png" border="0" /></a><span style="font-weight: bold;">funfuckporn.com</span> <span style="font-weight: bold;"><br />musicpo</span><span style="font-weight: bold;">rtalfree.com</span> <span style="font-weight: bold;"><br />online-dvdrip.com</span> <span style="font-weight: bold;"><br />widget-porn.com</span> <span style="font-weight: bold;"><br />gt-funny.com</span> <span style="font-weight: bold;"><br />gt-movies.com</span><br /><span style="font-weight: bold;">gt-stars.com</span> <span style="font-weight: bold;"><br />hot-sextube.com</span> <span style="font-weight: bold;"><br />hot-pornotube-2008.com</span> <span style="font-weight: bold;"><br />hot-pornotube08.com</span> <span style="font-weight: bold;"><br />hotpornotube08.com</span> <span style="font-weight: bold;"><br />porn-youtube-08.org</span> <span style="font-weight: bold;"><br />uriy.org</span> <span style="font-weight: bold;"><br />sextube20008.com</span> <span style="font-weight: bold;"><br /></span><span style="font-weight: bold;">streamxxxvideo.com</span><br /><span style="font-weight: bold;">xxxgirlsgirls.com</span> <span style="font-weight: bold;"><br />porno-tube20008.com</span> <span style="font-weight: bold;"><br />2008adultstreamportal2008.com</span> <span style="font-weight: bold;"><br />2008adults2008.com</span> <span style="font-weight: bold;"><br />adult18tube2008.com</span> <span style="font-weight: bold;"><br />sextube18adult.com</span> <span style="font-weight: bold;"><br />all-videos-home.com</span><br /><span style="font-weight: bold;">adultstreamportal2008.com</span> <span style="font-weight: bold;"><br />onlinestreamvide.com</span> <span style="font-weight: bold;"><br />adultvideos4all.com</span> <span style="font-weight: bold;"><br />sex18tube2008.com</span> <span style="font-weight: bold;"><br />adultxx-18.com</span> <span style="font-weight: bold;"><br />mymediasex.com</span><br /><span style="font-weight: bold;">ladyxxxworld.com</span><br /><span style="font-weight: bold;">adultstreamportal.com</span> <span style="font-weight: bold;"><br />young-girls-board.com</span> <span style="font-weight: bold;"><br />porn-youtube08.net</span><br /><span style="font-weight: bold;">adultfreemarket.info</span> <span style="font-weight: bold;"><br />adult-codec08.com  </span> <span style="font-weight: bold;"><br />adult-tubecodec08.com   </span> <span style="font-weight: bold;"><br />adult-tubecodec2008.com   </span> <span style="font-weight: bold;"><br />adulthot-codec08.com   </span> <span style="font-weight: bold;"><br />adulttubecodec2008.com </span> <span style="font-weight: bold;"><br />hot-tubecodec20.com </span> <a href="http://bp2.blogger.com/_wICHhTiQmrA/SEfMyTsY63I/AAAAAAAABxg/ZtiCEo6OWi8/s1600-h/blackhat_seo_codecs2.png"><img id="BLOGGER_PHOTO_ID_5208356658729249650" style="margin: 0px 10px 10px 0px; float: left;" alt="" src="http://bp2.blogger.com/_wICHhTiQmrA/SEfMyTsY63I/AAAAAAAABxg/ZtiCEo6OWi8/s200/blackhat_seo_codecs2.png" border="0" /></a><span style="font-weight: bold;"><br />media-tubecodec2008.com </span> <span style="font-weight: bold;"><br />porn-tubecodec20.com</span> <span style="font-weight: bold;"><br />hot-sextubecodec.com</span> <span style="font-weight: bold;"><br />sexporntubecodec14.com </span> <span style="font-weight: bold;"><br />sexporntubecodec32.com</span> <span style="font-weight: bold;"><br />sexporntubecodec77.com </span> <span style="font-weight: bold;"><br />sexporntubecodec98.com </span> <span style="font-weight: bold;"><br />adult-codec08.com</span><br /><span style="font-weight: bold;">adult-codec2008.com</span> <span style="font-weight: bold;"><br />adult-tubecodec08.com</span> <span style="font-weight: bold;"><br />adult-tubecodec2008.com</span> <span style="font-weight: bold;"><br />adulthot-codec08.com</span> <span style="font-weight: bold;"><br />adulthot-codec20008.com</span> <span style="font-weight: bold;"><br />adulthot-codec2008.com</span> <span style="font-weight: bold;"><br />adulthotcodec032008.com</span> <span style="font-weight: bold;"><br />adulthotcodec072008.com</span> <span style="font-weight: bold;"><br />adulthotcodec092008.com</span> <span style="font-weight: bold;"><br />adulthotcodec29018.com</span> <span style="font-weight: bold;"><br />adulthotcodec29098.com</span> <span style="font-weight: bold;"><br />adulttubecodec2008.com</span> <span style="font-weight: bold;"><br />media-tubecodec2008.com</span> <span style="font-weight: bold;"><br />sexhotcodec09.com</span> <span style="font-weight: bold;"><br />sexhotcodec1.com</span> <span style="font-weight: bold;"><br />sexhotcodec11.com</span> <span style="font-weight: bold;"><br />sexhotcodec12.com</span> <span style="font-weight: bold;"><br />sexhotcodec90.com</span> <span style="font-weight: bold;"><br />thehotcodec21.com</span> <span style="font-weight: bold;"><br />thehotcodecgt.com</span> <span style="font-weight: bold;"><br />thehotcodechq.com</span><br /><span style="font-weight: bold;">thehotcodeclk.com</span> <span style="font-weight: bold;"><br />thehotcodecrt.com</span><br /><span style="font-weight: bold;">thehotcodecxx.com</span><br /><span style="font-weight: bold;">thehotcodeczz.com</span><br /><br />What you see is not always what you get online, however, the infrastructure providers in the majority of malware campaigns tend to remain the same.<br /></div><div> </div></div></div><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=NNJ0dI"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=NNJ0dI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=4fngtI"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=4fngtI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=sC7SZi"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=sC7SZi" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=GqEr0i"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=GqEr0i" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=ZhU6uI"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=ZhU6uI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=uOADsI"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=uOADsI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=337i4i"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=337i4i" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/305310836" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 05 Jun 2008 03:59:47 +0000</pubDate>
      <category domain="http://securityratty.com/tag/sites">sites</category>
      <category domain="http://securityratty.com/tag/profile sites">profile sites</category>
      <category domain="http://securityratty.com/tag/multimedia sites">multimedia sites</category>
      <category domain="http://securityratty.com/tag/codec sites">codec sites</category>
      <category domain="http://securityratty.com/tag/zlob variants">zlob variants</category>
      <category domain="http://securityratty.com/tag/zlob">zlob</category>
      <category domain="http://securityratty.com/tag/zlob malware variants">zlob malware variants</category>
      <category domain="http://securityratty.com/tag/rogue codec sites">rogue codec sites</category>
      <category domain="http://securityratty.com/tag/domains">domains</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/305310836/blackhat-seo-redirects-to-malware-and.html">Blackhat SEO Redirects to Malware and Rogue Software</source>
    </item>
    <item>
      <title><![CDATA[Wayport Tops 10,000 McDonald's Locations]]></title>
      <link>http://securityratty.com/article/f8771881a38c1fc7d001b68fa32359dc</link>
      <guid>http://securityratty.com/article/f8771881a38c1fc7d001b68fa32359dc</guid>
      <description><![CDATA[Ten thousand is an arbitrary place to put a stick in the sand, but significant nonetheless: The milestone of 10,000 McDonald's wired up--a few hundred have back access only, due to being stores within...]]></description>
      <content:encoded><![CDATA[<p><strong><a href="http://www.wayport.com/NewsReleases.aspx?id=1832">Ten thousand is an arbitrary place to put a stick in the sand, but significant nonetheless:</a></strong> The milestone of 10,000 McDonald's wired up--a few hundred have back access only, due to being stores within WalMart centers--is a vindication of Wayport's long-term strategy, dating back to 2004. Wayport switched at that point from a slightly more public-faced, public-access company to one that understood that back-office operations could be just as valuable, if less sexy, than front-facing consumer networks. Dan Lowden, Wayport's long-time marketing and business development chief, said yesterday, "In a lot of these venues, the back office comes first. The Wi-Fi public access for some is a big priority, but for others it's a nice to have, great thing to have, but the priority is the back office."</p>

<p>Although several other quick-service restaurants like McDonald's lack any comprehensive Wi-Fi plan--Burger King, Wendy's, and Subway to name three of the largest--Wayport is locked out of working with direct competitors. This opens the potential for another firm to handle a several-thousand-location network. Wayport has worked with both McDonald's corporate-owned stores (about 2/3rds of stores in the U.S.), as well as reaching out to franchisees, who Lowden noted pay a predetermined flat rate for the service via McDonald's. "It's made them incredibly efficient to be able to offer this to their franchisees at one price, instead of variable pricing," he noted. Wayport acts as the layer between various telecom providers, applications and services, and the stores.</p>

<p>Wayport provides several kinds of back-office services, although credit-card processing was the first thing htey rolled out. They've extended to remote video feeds for security, Redbox DVD rental systems that are found in some McDonald's, and kiosks used for job applications. Lowden said Wayport offers things as straightforward but critical as a dial-up fail-safe when a broadband connection drops. </p>

<p>Wayport also manages AT&T's hotspot network, which puts them in the unwiring seat for the 7,000-odd Starbucks stores that will converted from T-Mobile to AT&T service during 2008. Wayport was once the clear leader in the hotspot builder market, with T-Mobile in the second position. Now, Wayport will be operating through a direct contract or management agreement over 18,000 hotspots in the U.S.; T-Mobile will likely be the second biggest with a couple thousand locations (Borders and FedEx/Kinko's tops among them). The No. 3 player is hard to figure. Panera? </p>

<p>I've been predicting for some time that media on the edge--music, videos, movies, and games stored on servers on the local Wi-Fi network--will be the next big development in venue-oriented Wi-Fi, with Starbucks likely far in the lead. Lowden wouldn't comment on any specific plans in the works, of course, but said generally, "Storing and caching all that content on the edge...hasn't been leveraged in the past, but it will be in the future to create a very unique experience." At Barnes & Noble, Wayport caches some multimedia data that's available to customers in the stores.</p>

<p>The advantage for in-store media storage is that you can leverage the speed of the local network, and add additional access points to distribute network load. The choke point is no longer the Internet connection, but local network speed. I expect--though Wayport, AT&T, and Starbucks haven't said it--that Starbucks infrastructure will be all 802.11n for this reason, likely with both 2.4 GHz and 5 GHz support for the best throughput in the higher-frequency band for media transactions. (In fact, I wouldn't be surprised if you could only buy movies via 5 GHz.)</p>

<p>Lowden also noted that the proliferation of mobile devices with Wi-Fi built in have led to them reaching out to venues that wouldn't have made sense for them to work with previously, and for unlikely candidates to reach out to them, too. Wayport is now working with a number of healthcare facilities that, while they have their own network infrastructure, wanted to outsource public access Wi-Fi (whether they choose to charge or underwrite it), and certain applications that they're not as experienced with running themselves.</p>

<p><strong>A little history:</strong> In 2001 and again in 2004, the heat seemed to be on the public side of Wi-Fi: lots of money to be made, ostensibly, lots of partnerships and venues to be built, and an overcrowded supply of infrastructure builders. The year before, Wayport looked to be an also-ran in the hotspot provider business. </p>

<p>Despite being one of the earliest firms to put Ethernet and then Wi-Fi into hotels, and build out hotspots in airports; and despite their survival of the first hotspot meltdown in 2001 during the dotcom crash and brief venture capital shortage; and despite their early entrance into allowing wholesale pricing for hotspot aggregators; the firm seemed about to be eclipsed by apparently deep-pocketed Cometa (with AT&T, IBM, and Intel in various capital and support roles), Toshiba's mom-and-pop focused turnkey system, and T-Mobile, which had the Starbucks contract. What a difference a year makes.</p>

<p>Cometa, Toshiba, and Wayport contended for the contract to build out back-office and public-access service at McDonald's in the U.S., and Wayport won. Within a few weeks, Toshiba passed its few hundred locations to Cometa, which shut its doors in May 2004. Wayport, meanwhile, had <a href="http://wifinetnews.com/archives/003377.html">cooked up a strategy</a> for McDonald's that it announced later that month. </p>

<p>Their approach involved a fixed-rate charged for unlimited access by retail network partners for all the locations in their pool. This meant that partners had a fixed cost, instead of a per-session cost, and Wayport could obtain specific revenue even before usage by a partner ramped up. Wayport hasn't discussed the details of this arrangement in depth since, but has partnered with Sony with its Mylo, Nintendo with its DS game player, and ZipIt with its wireless messaging appliance. </p>

<p>The McDonald's deal also apparently gave Wayport a way to extend its work with SBC-later-AT&T; Wayport had earlier in 2004 <a href="http://wifinetnews.com/archives/003151.html">became the managed-services contractor</a> for SBC to build out The UPS Store/Mailboxes Etc. nationwide. (UPS <a href="http://wifinetnews.com/archives/007770.html">dropped AT&T as its partner</a> in mid-2007, although that didn't appear to have anything to do with Wayport's role.)</p>

<p>AT&T through Wayport developed its large resold/managed footprint that incorporated resale of Wayport's McDonald's locations with the UPS Store and a few hundred other managed locations, including a handful of airports. The Cingular acquisition of AT&T Wireless put more airports in SBC's hands, too. (SBC was once the 60 percent majority owner of Cingular; when SBC and BellSouth, the other owner, merged that put the newly rebranded AT&T in charge of Cingular which it relabeled as AT&T. Confusing, huh?)</p>]]></content:encoded>
      <pubDate>Tue, 29 Apr 2008 05:25:32 +0000</pubDate>
      <category domain="http://securityratty.com/tag/wayport">wayport</category>
      <category domain="http://securityratty.com/tag/wi-fi">wi-fi</category>
      <category domain="http://securityratty.com/tag/comprehensive wi-fi plan">comprehensive wi-fi plan</category>
      <category domain="http://securityratty.com/tag/local wi-fi network">local wi-fi network</category>
      <category domain="http://securityratty.com/tag/att service">att service</category>
      <category domain="http://securityratty.com/tag/service">service</category>
      <category domain="http://securityratty.com/tag/wayport offers">wayport offers</category>
      <category domain="http://securityratty.com/tag/network">network</category>
      <category domain="http://securityratty.com/tag/wayport caches">wayport caches</category>
      <source url="http://wifinetnews.com/archives/008294.html">Wayport Tops 10,000 McDonald's Locations</source>
    </item>
    <item>
      <title><![CDATA[Researcher finds new flaw in QuickTime for Windows]]></title>
      <link>http://securityratty.com/article/60e48e44f419c6fa228016570aa0d100</link>
      <guid>http://securityratty.com/article/60e48e44f419c6fa228016570aa0d100</guid>
      <description><![CDATA[A security think tank says it has found a vulnerability in Apple's QuickTime multimedia player that can be exploited remotely to compromise Windows Vista PCs upgraded to Service Pack 1, as well as XP...]]></description>
      <content:encoded><![CDATA[A security think tank says it has found a vulnerability in Apple's QuickTime multimedia player that can be exploited remotely to compromise Windows Vista PCs upgraded to Service Pack 1, as well as XP SP2.<p><NOLAYER>
<IFRAME id="rss" src="http://ad.doubleclick.net/adi/idg.us.nwf.rss/security;sz=468x60;ord=20469?" width="468" height="60" frameborder="no" border="0" marginwidth="0" marginheight="0" scrolling="no">
<A href="http://ad.doubleclick.net/jump/idg.us.nwf.rss/security;sz=468x60;ord=20469?">
<IMG src="http://ad.doubleclick.net/ad/idg.us.nwf.rss/security;sz=468x60;ord=20469?" border="0" width="468" height="60"></A>
</IFRAME>
</NOLAYER></p>]]></content:encoded>
      <pubDate>Sun, 27 Apr 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/quicktime multimedia player">quicktime multimedia player</category>
      <category domain="http://securityratty.com/tag/service pack">service pack</category>
      <category domain="http://securityratty.com/tag/apple">apple</category>
      <category domain="http://securityratty.com/tag/tank">tank</category>
      <category domain="http://securityratty.com/tag/remotely">remotely</category>
      <category domain="http://securityratty.com/tag/vulnerability">vulnerability</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/sp2">sp2</category>
      <source url="http://www.networkworld.com/news/2008/042808-researcher-finds-new-flaw-in.html?fsrc=rss-security">Researcher finds new flaw in QuickTime for Windows</source>
    </item>
    <item>
      <title><![CDATA[Apple plugs QuickTime with 11 patches]]></title>
      <link>http://securityratty.com/article/f4f3c6d4cda0d607504f5b05cc5275dc</link>
      <guid>http://securityratty.com/article/f4f3c6d4cda0d607504f5b05cc5275dc</guid>
      <description><![CDATA[Apple released 11 patches for its QuickTime multimedia program on Wednesday, fixing a variety of problems that could allow a hacker to execute malicious code on a...]]></description>
      <content:encoded><![CDATA[Apple released 11 patches for its QuickTime multimedia program on Wednesday, fixing a variety of problems that could allow a hacker to execute malicious code on a machine.]]></content:encoded>
      <pubDate>Wed, 02 Apr 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/execute malicious code">execute malicious code</category>
      <category domain="http://securityratty.com/tag/quicktime multimedia program">quicktime multimedia program</category>
      <category domain="http://securityratty.com/tag/apple">apple</category>
      <category domain="http://securityratty.com/tag/patches">patches</category>
      <category domain="http://securityratty.com/tag/variety">variety</category>
      <category domain="http://securityratty.com/tag/hacker">hacker</category>
      <category domain="http://securityratty.com/tag/wednesday">wednesday</category>
      <category domain="http://securityratty.com/tag/machine">machine</category>
      <source url="http://www.networkworld.com/news/2008/040308-apple-plugs-quicktime-with-11.html?fsrc=rss-security">Apple plugs QuickTime with 11 patches</source>
    </item>
    <item>
      <title><![CDATA[A Portfolio of Fake Video Codecs]]></title>
      <link>http://securityratty.com/article/da5a9cbd10567ad678797555887c3267</link>
      <guid>http://securityratty.com/article/da5a9cbd10567ad678797555887c3267</guid>
      <description><![CDATA[Shall we expose a huge domains portfolio of fake/rogue video codecs hosting the same Zlob variant on each and every of the domains, thereby acting as a great example of what malicious economies of...]]></description>
      <content:encoded><![CDATA[<a href="http://bp1.blogger.com/_wICHhTiQmrA/R-GFkl280xI/AAAAAAAABeY/2elbkYQIiXE/s1600-h/zlob_variant_codec_IFRAME.jpg"><img id="BLOGGER_PHOTO_ID_5179567910137156370" style="margin: 0px 10px 10px 0px; float: left;" alt="" src="http://bp1.blogger.com/_wICHhTiQmrA/R-GFkl280xI/AAAAAAAABeY/2elbkYQIiXE/s200/zlob_variant_codec_IFRAME.jpg" border="0" /></a>Shall we expose a huge domains portfolio of fake/rogue video codecs hosting the same Zlob variant on each and every of the domains, thereby acting as a great example of what malicious economies of scale means? But of course. As I've pointed out in a previous post, on the tactical warfare front the output of a malicious IFRAME campaign is often neglected from the perspective of lacking the two/three layered IFRAME-ing and redirection that the malicious parties usually implement at the beginning of the campaign. Basically, the over twenty fake video codecs domains are hosting the same binary in the form of a Zlob malware downloader, <a href="http://ddanchev.blogspot.com/2008/03/rogue-rbn-software-pushed-through.html">infrastructure courtesy of the RBN's used ATRIVO</a> (64.28.176.0/20). Currently active domains hosting the" DVDAccess codec", namely a Zlob malware variant :<br /><div></div><strong><br />pornqaz.com</strong><div><strong>uinsex.com</strong></div><div><strong>qazsex.com</strong></div><div><strong>sexwhite.net</strong></div><div><strong>lightporn.net</strong></div><div><strong>xeroporn.com</strong></div><div><strong>brakeporn.net</strong></div><div><strong>sexclean.net</strong></div><div><strong>delfiporn.net</strong></div><div><strong>pornfire.net</strong></div><div><strong>redcodec.net</strong></div><div><strong>democodec.com</strong></div><div><strong><a href="http://bp1.blogger.com/_wICHhTiQmrA/R-GMil280yI/AAAAAAAABeg/BNuHgUi6Tng/s1600-h/fake_videocodecs_zlob.jpg"><img id="BLOGGER_PHOTO_ID_5179575572358812450" style="margin: 0px 10px 10px 0px; float: left;" alt="" src="http://bp1.blogger.com/_wICHhTiQmrA/R-GMil280yI/AAAAAAAABeg/BNuHgUi6Tng/s200/fake_videocodecs_zlob.jpg" border="0" /></a>delficodec.com</strong></div><div><strong>turbocodec.net</strong></div><div><strong>gamecodec.com</strong></div><div><strong>blackcodec.net</strong></div><div><strong>xerocodec.com</strong></div><div><strong>ixcodec.net</strong></div><div><strong>codecdemo.com</strong></div><div><strong>ixcodec.com</strong></div><div><strong>citycodec.com</strong></div><div><strong>codecthe.com</strong></div><div><strong>codecnitro.com</strong></div><div><strong>codecbest.com</strong></div><div><strong>codecspace.com</strong></div><div><strong>popcodec.net</strong></div><div><strong>uincodec.com</strong></div><div><strong>xhcodec.com</strong></div><div><strong>stormcodec.net</strong></div><div><strong>codecmega.com</strong></div><div><strong>whitecodec.com</strong></div><div><strong>jetcodec.com</strong></div><div><strong>endcodec.com<br />abccodec.com</strong></div><div><strong>codecred.net</strong></div><div><strong>cleancodec.com</strong></div><div><strong>herocodec.com</strong></div><div><strong>nicecodec.com</strong></div><div> </div><div><br />DVDaccess's pitch : "<em>DVDaccess is a multimedia software that allowa access to Windows collection of multimedia drivers and integrates with any application using DirectShow and Microsoft Video for Windows. DVDaccess will highly increase quality of video files you play. DVDaccess enhances your music listening experience by improving the sound quality of video files sound, MP3, internet radio, Windows Media and other music files. Renew stereo depth, add 3D surround sound, restore sound clarity, boost your audio levels, and produce deep, rich bass sounds.</em>"</div><div> </div><div><strong><br />Scanner results</strong> : 39% Scanner (14/36) found malware!</div><div><a href="http://ddanchev.blogspot.com/2008/03/more-high-profile-sites-iframe-injected.html">Trojan-Downloader.Win32.Zlob.eie</a></div><div><strong>File Size</strong> : 74823 byte</div><div><strong>MD5</strong> : 30965fdbd893990dd24abda2285d9edc</div><div><strong>SHA1</strong> : 53eacbb9cdf42394bd455d9bd2275f05730332f7</div><div> </div><div><br />Why are the malicious parties so KISS oriented at the end of every campaign, compared to the complexity and tactical warfare tricking automated malware harvesting approaches within the beginning of the campaign? Because they're not even considering the possibility of proactively detecting the output of the many other malware campaigns to come, which will inevitable be ending up to these very same domains serving a single Zlob variant. Just like the recent massive IFRAME attacks, where in between the live exploit URLs and rogue security software, the end users were redirected to DVDaccess as well. In fact, the <a href="http://ddanchev.blogspot.com/2008/03/more-high-profile-sites-iframe-injected.html">massive IFRAME attack campaign</a> was, and continues to redirect to one of the domains in the portfolio I've just provided you with.<br /></div><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=N5nRWnF"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=N5nRWnF" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=WyFJnOF"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=WyFJnOF" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=uoN5Tzf"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=uoN5Tzf" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=Dpxg3Zf"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=Dpxg3Zf" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=lHyCclF"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=lHyCclF" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=pu6sSYF"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=pu6sSYF" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=vBNz9Af"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=vBNz9Af" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/254547002" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 19 Mar 2008 14:27:56 +0000</pubDate>
      <category domain="http://securityratty.com/tag/single zlob variant">single zlob variant</category>
      <category domain="http://securityratty.com/tag/zlob variant">zlob variant</category>
      <category domain="http://securityratty.com/tag/zlob">zlob</category>
      <category domain="http://securityratty.com/tag/zlob malware variant">zlob malware variant</category>
      <category domain="http://securityratty.com/tag/net">net</category>
      <category domain="http://securityratty.com/tag/malware">malware</category>
      <category domain="http://securityratty.com/tag/domains">domains</category>
      <category domain="http://securityratty.com/tag/huge domains portfolio">huge domains portfolio</category>
      <category domain="http://securityratty.com/tag/dvdaccess">dvdaccess</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/254547002/portfolio-of-fake-video-codecs.html">A Portfolio of Fake Video Codecs</source>
    </item>
    <item>
      <title><![CDATA[Terror on the Internet - Conflict of Interest]]></title>
      <link>http://securityratty.com/article/4d84e41b4c977b7092f8d353c8e6895e</link>
      <guid>http://securityratty.com/article/4d84e41b4c977b7092f8d353c8e6895e</guid>
      <description><![CDATA[Insightful article by Greg Goth, discussing various aspects of the pros and cons of monitoring cyber jihadist sites next to shutting them down, as well as mentioning my analysis of the Mujahideen...]]></description>
      <content:encoded><![CDATA[<div><a href="http://bp0.blogger.com/_wICHhTiQmrA/R9G7dU-0F6I/AAAAAAAABcQ/1bS4lvI4w-M/s1600-h/terrorist_database_hoax.jpg"><img id="BLOGGER_PHOTO_ID_5175123559348180898" style="margin: 0px 10px 10px 0px; float: left;" alt="" src="http://bp0.blogger.com/_wICHhTiQmrA/R9G7dU-0F6I/AAAAAAAABcQ/1bS4lvI4w-M/s200/terrorist_database_hoax.jpg" border="0" /></a>Insightful article by Greg Goth, discussing various aspects of the pros and cons of monitoring cyber jihadist sites next to shutting them down, as well as mentioning <a href="http://ddanchev.blogspot.com/2008/01/mujahideen-secrets-2-encryption-tool.html">my analysis</a> of the <a href="http://ddanchev.blogspot.com/2007/04/mujahideen-secrets-encryption-tool.html">Mujahideen Secrets encryption tool v1.0</a> and v2.0. <a href="http://dsonline.computer.org/portal/pages/dsonline/2008/03/o3003news.html">Terror on the Internet: A Complex Issue, and Getting Harder</a> :</div><br />"<em>Indeed, politicians around the world call at regular intervals for terrorist websites to be removed from their host sites’ servers or for search engines to block access to them. They also call for laws that would make posting instructions on how to kill or maim people or destroy property punishable by law. Franco Frattini, the European Commission’s Vice President for Freedom, Justice, and Security, </em><a href="http://europa.eu/rapid/pressReleasesAction.do?reference=SPEECH/07/505&amp;format=HTML&amp;aged=0&amp;language=EN&amp;guiLanguage=en"><em>called for a prohibition on websites that post bomb-making instructions in September 2007</em></a><em>. And just as quickly, he rushed to announce that in doing so he was not trying to impinge on freedom of speech or information access or to inhibit law enforcement agencies from monitoring sites.</em>"<br /><br /><div>There're three perspectives related to cyber jihad, should the virtual communities be shut down, monitored, or censored so that they cannot be accessed by people who would potentially get radicalized and brainwashed by the amazingly well created propaganda in the form of interactive multimedia? Given the different mandates given to different intelligence services and independent researchers, is where the conflict of interest begins. Moreover, don't forget that independent researchers sometimes come up with the final piece of the puzzle to have an intelligence agency come up with the big picture in a cost-effective and timely manner, given they actually believe in OSINT and trust the source of the intell data of course. Now, picture the situation where an intelligence agency is shutting down cyber jihadist sites on a large scale not believing in the value that the intelligence data they they could provide, another one given a mandate to censor cyber jihadist communities compiling reports stating that someone's shutting them down before they could even censor them, and a third one who would have to again play cat and mouse game the locate them once they've shut down by the first intel agency already. Ironic or not, different mandates and empowerment is where the contradiction begins. Let's discuss the three mandates and go in-depth into the pros and cons of each of them to come up with a philosophic solution to the problem, as I belive it's perhaps the only way to provoke some thought on the best variant.</div><br /><div></div><strong>Shutting the communities down</strong> -<br /><div>Before shuting them down you need to know where they are, their neighbourhood of supporters who will indirectly tip you on the their latest location once they have their previous domain shut down. Personal experience and third party research indicates that over 90% of the cyber jihadist communities/blogs are hosted by U.S based not owned companies. And with the lack of real-time intell sharing between the agencies themselves, the first who picks up the community will be responsible for its faith, literally. But in reality, preserving the integrity of a cyber jihadist community, and convincing the right people that balanced monitoring next to shutting it down is more beneficial, remains an idea yet to be considered. Back in 2007, I did an experiment, namely I <a href="http://ddanchev.blogspot.com/2007/08/analyses-of-cyber-jihadist-forums-and.html">crawled ten cyber jihadist forums and blogs and extracted all the outgoing links from these communities</a> to see their preferred choice for online video and files hosting. A couple of months later, the communities got shut down, so when the same thing happened while I was crawling the Global Islamic Media Front's, and Inshallahshaheed's web presence, it became clear that while some are crawling, and others censoring, third parties are shutting them down.</div><br /><div> </div>The bottom line - shutting them down doesn't mean that they'll dissapear and will never come back, exactly the opposite. Personal experience while handling the Global Islamic Media Front is perhaps the perfect and best hands-on experience on the benefits of shutting them down, given you've built enough convidence in your abilities to locate their new location. If you think that the cyber jihadist site or community you're currently monitoring is a star, look above, it's full of starts everywhere, once you start drawing the lines between them, a figure of something known emerges, in this case once a cyber jihadist community is shut down, its most loyal and closely connected cyber jihadist communities will expose their intimate connection not by just starting to promote their new location online, but even better, you'll have them use the second cyber jihadist community to directly reach their audience by the time they set up the new location and resume the propaganda and radicalization.<br /><div> </div><br /><div>There's no shortage of cyber jihadist blogs, forums and sites, and personal experience shows that upon having a cyber jihadist community shut down, they re-appear at another location. It's shut down again, it re-appears for a second time. I've seen this situation with Instahaleed and GIMF, and each and every time they had their blogs and sites removed from their hosting providers, mainly because it's rather disturbing that the majority of such communities are hosted on U.S servers, it's this short time frame which will either lead you to their new location, you risk loosing their tracks. However, the vivid supporters of PSYOPs are logically visionary enough to understand what does undermining their audiences' confidence in the community's capability to remain online means.</div><br /><div> </div><strong>Monitoring the communities</strong> -<br /><div>In order to reach the "shut it down or monitor it" stage in your analysis process, you really need to know where the cyber jihadists forums and sites are, else, you will be wasting your time, money and energy to create <a href="http://ddanchev.blogspot.com/2007/03/cyber-traps-for-wannabe-jihadists.html">fake cyber jihadist communities in the form of web honeypots for jihadist communication</a>. Monitoring is tricky, especially when you don't know what you're looking for, don't prioritize, don't have a contingency plan or an offline copy of the communitiy and wrongly building confidence in its ability to remain online. Moreover, <a href="http://cryptome.org/able-danger-ig-02.jpg">monitoring for too long</a> results in terrabytes of noise, and from a psychological perspective sometimes <a href="http://en.wikipedia.org/wiki/Able_Danger">the rush for yet another fancy social networking graph</a> to better communicate <a href="http://cryptome.org/able-danger-ig-01.jpg">the collected data</a>, ends up in the worst possible way - you miss the tipping point moment.</div><br /><div> </div><strong>Censoring the communities -</strong><br /><div>I often come across wishful comments in the lines of "blocking access to bomb and poison making tutorials", missing a very important point, namely, that these very same manuals, and jihadist magazines are not residing in a cyber-jihad.com/bomb-making-guide.zip domain and file extension form, making the process a bit more complex to realize. Unless of course the censorship systems figures out ways to detect the content in password encrypted archive files served with random file names and hosted on one of the hundreds free web space providers. Then again, given the factual evidence that cyber jihadists are encouraging the use of Internet anonymization services and software, your censorship efforts will remain futile.</div><br /><div> </div>As I'm posting this overview of various ways of handling cyber jihadist communities, yet another community is starting to attract cyber jihadists, thanks to their understanding of noise generation by teaching the novice cyber jihadists on the basics of running and maintaing such a community. What's perhaps most important to keep in mind is that, what you're currently analyzing, trying to shut down or censor whatsoever, is the public web, the Dark Web, the one closed behind authentication and invite-only access yet remains to be located and properly analyzed. If cyber jihad is really a priority, then there's nothing more effective than the combination of independent researchers and intelligence analysts.<br /><div> </div><br /><div><strong>Related posts:<br /><a href="http://ddanchev.blogspot.com/2007/12/inshallahshaheed-come-out-come-out.html"><span style="font-weight: normal;">Inshallahshaheed - Come Out, Come Out Wherever You Are</span></a><br /></strong><a href="http://ddanchev.blogspot.com/2007/07/gimf-switching-blogs.html">GIMF Switching Blogs</a><br /><a href="http://ddanchev.blogspot.com/2007/08/gimf-now-permanently-shut-down.html">GIMF Now Permanently Shut Down</a><br /><a href="http://ddanchev.blogspot.com/2007/08/gimf-we-will-remain.html">GIMF - "We Will Remain"</a><br /><strong><a href="http://ddanchev.blogspot.com/2007/10/wisdom-of-anti-cyber-jihadist-crowd.html"><span style="font-weight: normal;">Wisdom of the Anti Cyber Jihadist Crowd</span></a><br /><a href="http://ddanchev.blogspot.com/2007/11/cyber-jihadist-blogs-switching.html"><span style="font-weight: normal;">Cyber Jihadist Blogs Switching Locations</span></a><br /></strong></div><div><a href="http://ddanchev.blogspot.com/2006/09/internet-psyops-psychological.html">Internet PSYOPS - Psychological Operations</a><br /><div><a href="http://ddanchev.blogspot.com/2007/11/electronic-jihad-v30-what-cyber-jihad.html">Electronic Jihad v3.0 - What Cyber Jihad Isn't</a></div><div><a href="http://ddanchev.blogspot.com/2007/11/electronic-jihads-targets-list.html">Electronic Jihad's Targets List</a></div><div><a href="http://ddanchev.blogspot.com/2007/11/teaching-cyber-jihadists-how-to-hack.html">Teaching Cyber Jihadists How to Hack</a></div><a href="http://ddanchev.blogspot.com/2007/11/botnet-of-infected-terrorists.html">A Botnet of Infected Terrorists?</a><br /><a href="http://ddanchev.blogspot.com/2007/09/infecting-terrorist-suspects-with.html">Infecting Terrorist Suspects with Malware</a><br /><a href="http://ddanchev.blogspot.com/2007/09/dark-web-and-cyber-jihad.html">The Dark Web and Cyber Jihad</a><br /><a href="http://ddanchev.blogspot.com/2007/12/cyber-jihadist-hacking-teams.html">Cyber Jihadist Hacking Teams</a><br /><a href="http://ddanchev.blogspot.com/2005/12/cyberterrorism-dont-stereotype-and-its.html">Cyberterrorism - don't stereotype and it's there</a><br /><a href="http://ddanchev.blogspot.com/2006/06/tracking-down-internet-terrorist.html">Tracking Down Internet Terrorist Propaganda</a><br /><a href="http://ddanchev.blogspot.com/2006/05/arabic-extremist-group-forum-messages.html">Arabic Extremist Group Forum Messages' Characteristics</a><br /><a href="http://ddanchev.blogspot.com/2006/08/cyber-terrorism-communications-and_22.html">Cyber Terrorism Communications and Propaganda</a><br /><a href="http://ddanchev.blogspot.com/2006/05/techno-imperialism-and-effect-of.html">Techno Imperialism and the Effect of Cyberterrorism</a><br /><a href="http://ddanchev.blogspot.com/2006/10/cost-benefit-analysis-of-cyber.html">A Cost-Benefit Analysis of Cyber Terrorism</a><br /><a href="http://ddanchev.blogspot.com/2006/12/current-state-of-internet-jihad.html">Current State of Internet Jihad</a><br /><a href="http://ddanchev.blogspot.com/2007/02/characteristics-of-islamist-websites.html">Characteristics of Islamist Websites</a><br /><a href="http://ddanchev.blogspot.com/2006/09/hezbollahs-dns-service-providers-from.html">Hezbollah's DNS Service Providers from 1998 to 2006</a><br /><a href="http://ddanchev.blogspot.com/2006/12/full-list-of-hezbollahs-internet-sites.html">Full List of Hezbollah's Internet Sites</a><br /><a href="http://ddanchev.blogspot.com/2007/03/cyber-traps-for-wannabe-jihadists.html">Cyber Traps for Wannabe Jihadists</a><br /><a href="http://ddanchev.blogspot.com/2007/04/mujahideen-secrets-encryption-tool.html">Mujahideen Secrets Encryption Tool</a><br /><a href="http://ddanchev.blogspot.com/2006/12/analysis-of-technical-mujahid-issue-one.html">An Analysis of the Technical Mujahid Issue One</a><br /><a href="http://ddanchev.blogspot.com/2007/06/analysis-of-technical-mujahid-issue-two.html">An Analysis of the Technical Mujahid Issue Two</a><br /><a href="http://ddanchev.blogspot.com/2007/07/terrorist-groups-brand-identities.html">Terrorist Groups' Brand Identities</a><br /><a href="http://ddanchev.blogspot.com/2007/06/list-of-terrorists-blogs.html">A List of Terrorists' Blogs</a><br /><a href="http://ddanchev.blogspot.com/2007/05/jihadists-anonymous-internet-surfing.html">Jihadists' Anonymous Internet Surfing Preferences</a><br /><a href="http://ddanchev.blogspot.com/2007/05/sampling-jihadists-ips.html">Samping Jihadist IPs</a><br /><a href="http://ddanchev.blogspot.com/2007/07/cyber-jihadists-and-tor.html">Cyber Jihadists' and TOR</a><br /><a href="http://ddanchev.blogspot.com/2007/08/cyber-jihadist-dos-tool.html">A Cyber Jihadist DoS Tool</a><br /><a href="http://ddanchev.blogspot.com/2007/08/gimf-now-permanently-shut-down.html">GIMF Now Permanently Shut Down</a><br /><a href="http://ddanchev.blogspot.com/2006/08/steganography-and-cyber-terrorism.html">Steganography and Cyber Terrorism Communications</a><br /></div><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=9ODTvnF"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=9ODTvnF" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=glFBi8F"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=glFBi8F" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=D198AFf"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=D198AFf" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=z0vTnMf"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=z0vTnMf" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=sALMAMF"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=sALMAMF" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=LlGGhJF"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=LlGGhJF" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=GIrrUWf"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=GIrrUWf" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/253973814" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 18 Mar 2008 16:58:23 +0000</pubDate>
      <category domain="http://securityratty.com/tag/cyber jihadist">cyber jihadist</category>
      <category domain="http://securityratty.com/tag/cyber jihadist communities">cyber jihadist communities</category>
      <category domain="http://securityratty.com/tag/novice cyber jihadists">novice cyber jihadists</category>
      <category domain="http://securityratty.com/tag/jihadists">jihadists</category>
      <category domain="http://securityratty.com/tag/cyber jihadist forums">cyber jihadist forums</category>
      <category domain="http://securityratty.com/tag/cyber jihadist sites">cyber jihadist sites</category>
      <category domain="http://securityratty.com/tag/attract cyber jihadists">attract cyber jihadists</category>
      <category domain="http://securityratty.com/tag/internet">internet</category>
      <category domain="http://securityratty.com/tag/cyber jihadists">cyber jihadists</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/253973814/terror-on-internet-conflict-of-interest.html">Terror on the Internet - Conflict of Interest</source>
    </item>
  </channel>
</rss>
