<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: p2p]]></title>
    <link>http://securityratty.com/tag/p2p</link>
    <description></description>
    <pubDate>Mon, 14 Jul 2008 13:08:21 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Will Code Malware for Financial Incentives]]></title>
      <link>http://securityratty.com/article/30eebfa1383ce3a671879e2f1f0af37d</link>
      <guid>http://securityratty.com/article/30eebfa1383ce3a671879e2f1f0af37d</guid>
      <description><![CDATA[A couple of hundred dollars can indeed get you state of the art undetectable piece of malware with post-purchase service in the form of automatic lower detection rate for sure, but what happens when...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://4.bp.blogspot.com/_wICHhTiQmrA/SSLQOaWm71I/AAAAAAAACdM/nHHgxqAJn-4/s1600-h/malware_hire_sample_1.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://4.bp.blogspot.com/_wICHhTiQmrA/SSLQOaWm71I/AAAAAAAACdM/nHHgxqAJn-4/s200/malware_hire_sample_1.JPG" /></a>A couple of hundred dollars can indeed get you state of the art <a href="http://ddanchev.blogspot.com/2008/07/coding-spyware-and-malware-for-hire.html">undetectable piece of malware with post-purchase service</a> in the form of automatic lower detection rate for sure, but what happens when the vendors of such releases start vertically integrating just like everyone else, and start offering OS-independent spamming, flooding, modifications and tweaking of popular crimeware kits in the very same fashion? The quality assurance process gets centralized into the hands of experienced programmers that have been developing cybercrime facilitating tools for years.<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://3.bp.blogspot.com/_wICHhTiQmrA/SSLcUHXGAoI/AAAAAAAACdU/wnzsUHFHSrg/s1600-h/malware_hire_sample_2.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://3.bp.blogspot.com/_wICHhTiQmrA/SSLcUHXGAoI/AAAAAAAACdU/wnzsUHFHSrg/s200/malware_hire_sample_2.JPG" /></a>It's interesting to monitor the pricing schemes that they implement. For instance, the modularity of a particular malware, that is the additional functions that a buyer may want or not want, increase or decrease the price respectively. Others, tend to leave the price open topic by only mentioning the starting price for their services and they increasing it again in open topic fashion.<br />
<br />
Let's take look at some recently advertised (translated) "malware coding for hire" propositions, highlighting some of the latest developments in their pricing strategies :<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://4.bp.blogspot.com/_wICHhTiQmrA/SSMEwnRgU6I/AAAAAAAACdc/bFEBpsTalQQ/s1600-h/malware_hire_sample_3.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://4.bp.blogspot.com/_wICHhTiQmrA/SSMEwnRgU6I/AAAAAAAACdc/bFEBpsTalQQ/s200/malware_hire_sample_3.JPG" /></a><b>Proposition 1</b> : <br />
"<i>Programs and scripts under the following categories are accepted : </i><br />
<i>grabbers; spamming tools for forums, spamming tools for social networking sites, modifications of admin panels for (popular crimeware kits), phishing pages</i><br />
<br />
<i>Platform: software running on MAC OS to Windows  </i><br />
<i>Multitasking: have the capacity to work on multiple projects</i><br />
<i>Speed and responsibility: at the highest level  </i><br />
<i>Pre-payment for new customers: 50% of the whole price, 30% pre-pay of the whole price for repreated customers  </i><br />
<i>Support: Paid  </i><br />
<i>Rates: starting from 100 euros</i><br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://1.bp.blogspot.com/_wICHhTiQmrA/SSMGg5E49_I/AAAAAAAACds/lWtlV3eYu4s/s1600-h/malware_hire_sample_4.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://1.bp.blogspot.com/_wICHhTiQmrA/SSMGg5E49_I/AAAAAAAACds/lWtlV3eYu4s/s200/malware_hire_sample_4.JPG" /></a><i>If, after speaking ultimate price, you decide to add to your order something else - the price change. Prepare the job immediately, which will understand what to do and how much it will cost you, if you have any suggestions for a price, then lays them immediately and not after the work is completed. If you order something that requires parsing your logs, and their continued use, you agree to provide "a significant portion of the logs, so that after putting the project did not raise misunderstandings due to the fact that some logs are no longer "fresh", because of their "uniqueness". In this case, for the finalization of the project will be charged an additional fee.</i>"<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://2.bp.blogspot.com/_wICHhTiQmrA/SSMKeg8y5SI/AAAAAAAACd0/ekeV4Us8PwY/s1600-h/malware_hire_sample_5.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://2.bp.blogspot.com/_wICHhTiQmrA/SSMKeg8y5SI/AAAAAAAACd0/ekeV4Us8PwY/s200/malware_hire_sample_5.JPG" /></a>This is an example of an "open topic pricing scheme" with the vendor offering the possibility to code the malware or the tool for any price above 100 euro based on what he perceives as features included within worth the price.<br />
<br />
<b>Proposition 2</b>:<br />
"<i>Starting price for my malware is 250 EUR. Additional modules like P2P features, source code for a particular module go for an additional 50 EUR. If you're paying in another currency the price is 200 GBP or 395 dollars. I sell only ten copies of the builder so hurry up. The trading process is simple - a password protected file with the malware is sent to you so you can see the files inside. You then sent the money and I mail you back the password. If you don't like this way you lose.&nbsp;</i><br />
<br />
<i>I can also offer you another deal, I will share the complete source code in exchange to access to a botnet with at least 4000 infected hosts because I don't have time to play around with me bot right now.</i> <br />
<br />
This proposition is particularly interesting because the seller is introducing basic understanding of exchange rates, but most of all because he's in fact offering a direct bargain in the form of access to a botnet in exchange for a complete source code of his malware bot. Both propositions are also great examples that vendors engage by keeping their current and potential customers up-to-date with <a href="http://ddanchev.blogspot.com/2008/04/botnet-masters-to-do-list.html">TODO lists of features to come</a> next to the usual CHANGELOGS, and, of course,&nbsp; establish trust by allowing potential customers to take a peek at the source code of the malware they're about to purchase.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2008/07/coding-spyware-and-malware-for-hire.html">Coding Spyware and Malware for Hire </a><br />
<a href="http://ddanchev.blogspot.com/2007/03/underground-economys-supply-of-goods.html">The Underground Economy's Supply of Goods and Services</a><br />
<a href="http://ddanchev.blogspot.com/2007/10/dynamics-of-malware-industry.html">The Dynamics of the Malware Industry - Proprietary Malware Tools</a><br />
<a href="http://ddanchev.blogspot.com/2008/06/using-market-forces-to-disrupt-botnets.html">Using Market Forces to Disrupt Botnets</a><br />
<a href="http://ddanchev.blogspot.com/2007/10/multiple-firewalls-bypassing.html">Multiple Firewalls Bypassing Verification on Demand</a><br />
<a href="http://ddanchev.blogspot.com/2007/10/managed-spamming-appliances-future-of.html">Managed Spamming Appliances - The Future of Spam</a><br />
<a href="http://ddanchev.blogspot.com/2008/02/localizing-cybercrime-cultural.html">Localizing Cybercrime - Cultural Diversity on Demand</a><br />
<a href="http://ddanchev.blogspot.com/2008/01/e-crime-and-socioeconomic-factors.html">E-crime and Socioeconomic Factors</a><br />
<a href="http://ddanchev.blogspot.com/2007/12/russias-fsb-vs-cybercrime.html">Russia's FSB vs Cybercrime</a><br />
<a href="http://ddanchev.blogspot.com/2007/08/malware-as-web-service.html">Malware as a Web Service</a><br />
<a href="http://ddanchev.blogspot.com/2007/09/localizing-open-source-malware.html">Localizing Open Source Malware</a><br />
<a href="http://ddanchev.blogspot.com/2008/04/quality-and-assurance-in-malware.html">Quality and Assurance in Malware Attacks</a><br />
<a href="http://ddanchev.blogspot.com/2006/09/benchmarking-and-optimising-malware.html">Benchmarking and Optimising Malware</a><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=a8huN"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=a8huN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=sEoBN"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=sEoBN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=Rj24n"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=Rj24n" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=W4aen"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=W4aen" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=7YAqN"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=7YAqN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=rEDhN"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=rEDhN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=rpNUn"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=rpNUn" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/457569401" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 18 Nov 2008 10:57:55 +0000</pubDate>
      <category domain="http://securityratty.com/tag/malware">malware</category>
      <category domain="http://securityratty.com/tag/code">code</category>
      <category domain="http://securityratty.com/tag/source malware">source malware</category>
      <category domain="http://securityratty.com/tag/malware attacks">malware attacks</category>
      <category domain="http://securityratty.com/tag/malware bot">malware bot</category>
      <category domain="http://securityratty.com/tag/proprietary malware tools">proprietary malware tools</category>
      <category domain="http://securityratty.com/tag/source code">source code</category>
      <category domain="http://securityratty.com/tag/complete source code">complete source code</category>
      <category domain="http://securityratty.com/tag/tools">tools</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/457569401/will-code-malware-for-financial.html">Will Code Malware for Financial Incentives</source>
    </item>
    <item>
      <title><![CDATA[P2P legislation forcing university IT to get tough on piracy]]></title>
      <link>http://securityratty.com/article/ce474834bcbcbf28fb06a36647808e4f</link>
      <guid>http://securityratty.com/article/ce474834bcbcbf28fb06a36647808e4f</guid>
      <description><![CDATA[A new law aimed at stopping illegal peer-to-peer file-sharing of digital entertainment content, such as music and videos, requires the nation's colleges and universities to educate students that P2P...]]></description>
      <content:encoded><![CDATA[A new law aimed at stopping illegal peer-to-peer file-sharing of digital entertainment content, such as music and videos, requires the nation's colleges and universities to educate students that P2P piracy is illegal and strongly encourages the use of technology to monitor and block illegal P2P.]]></content:encoded>
      <pubDate>Wed, 22 Oct 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/illegal">illegal</category>
      <category domain="http://securityratty.com/tag/block illegal p2p">block illegal p2p</category>
      <category domain="http://securityratty.com/tag/illegal peer-to-peer">illegal peer-to-peer</category>
      <category domain="http://securityratty.com/tag/digital entertainment content">digital entertainment content</category>
      <category domain="http://securityratty.com/tag/law aimed">law aimed</category>
      <category domain="http://securityratty.com/tag/p2p piracy">p2p piracy</category>
      <category domain="http://securityratty.com/tag/strongly encourages">strongly encourages</category>
      <category domain="http://securityratty.com/tag/nation">nation</category>
      <category domain="http://securityratty.com/tag/monitor">monitor</category>
      <source url="http://www.networkworld.com/news/2008/102308-p2p-college-legislation.html?fsrc=rss-security">P2P legislation forcing university IT to get tough on piracy</source>
    </item>
    <item>
      <title><![CDATA[In-Flight VoIP Ban: Against FCC Rules? Highly Desirable?]]></title>
      <link>http://securityratty.com/article/04edfe3e5a28bd63c48bc3f4ded28db4</link>
      <guid>http://securityratty.com/article/04edfe3e5a28bd63c48bc3f4ded28db4</guid>
      <description><![CDATA[Think-tank wonders whether banning in-flight VoIP constitutes a violation of FCC rules about blocking services: The Progress and Freedom Foundation's Barbara Espin uses the ban on in-flight VoIP by...]]></description>
      <content:encoded><![CDATA[<p><img src="http://wifinetnews.com/images/plane.jpg" align="right" border="0" hspace="5" /><a href="http://blog.pff.org/archives/2008/09/does_disclosure.html"><strong>Think-tank wonders whether banning in-flight VoIP constitutes a violation of FCC rules about blocking services:</strong></a> The Progress and Freedom Foundation's Barbara Espin uses the ban on in-flight VoIP by American Airlines (facilitated by provider Aircell) to make a broader argument about what she calls the FCC's "ad hoc approach to broadband network management issues." It's clever. American discloses that calling isn't allowed, and VoIP isn't even technically within the FAA or FCC's purview, as far as I can determine. The FAA could choose to regulate it as a safety issue. PFF generally tilts anti-regulation, and has as what it calls its "supporters" a broad area of multiple system cable operators and telecom firms, including Comcast, which was singled out and fined by the FCC for its undisclosed network disruption of P2P connections.</p>

<p><a href="http://www.nytimes.com/2008/09/14/business/14essay.html?_r=2&ei=5070&emc=eta1&oref=slogin&oref=slogin"><strong>Espin references Joe Sharkey's excellent column on in-flight calling in Sunday's New York Times:</strong></a> Sharkey, a veteran travel writer, who survived a mid-air collision over the Brazilian Amazon a few years ago, looks at varying attitudes about calls made during flights. He quotes Aircell's Jack Blumenstein saying what I've telling folks for months: Aircell has a lot of techniques to block VoIP calls already, and "as we identify new ways that people are trying to do voice calls on the airplane, we just kind of zero in and knock those off." Many geeks have assumed Aircell is a bunch of unsavvy folks who wouldn't be able to figure out how to disrupt their clever workarounds for making VoIP. (I keep noting that introducing jitter for suspicious data connections wouldn't disrupt legitimate applications, but would destroy VoIP call quality.)</p>]]></content:encoded>
      <pubDate>Tue, 16 Sep 2008 05:50:22 +0000</pubDate>
      <category domain="http://securityratty.com/tag/voip">voip</category>
      <category domain="http://securityratty.com/tag/in-flight voip constitutes">in-flight voip constitutes</category>
      <category domain="http://securityratty.com/tag/in-flight">in-flight</category>
      <category domain="http://securityratty.com/tag/in-flight voip">in-flight voip</category>
      <category domain="http://securityratty.com/tag/block voip calls">block voip calls</category>
      <category domain="http://securityratty.com/tag/fcc rules">fcc rules</category>
      <category domain="http://securityratty.com/tag/fcc">fcc</category>
      <category domain="http://securityratty.com/tag/voice calls">voice calls</category>
      <category domain="http://securityratty.com/tag/calls">calls</category>
      <source url="http://wifinetnews.com/archives/008444.html">In-Flight VoIP Ban: Against FCC Rules? Highly Desirable?</source>
    </item>
    <item>
      <title><![CDATA[Relax, the Net Backbone Has Space for Your Lolcats]]></title>
      <link>http://securityratty.com/article/b00a463d2bb0a5e64116bda67d599849</link>
      <guid>http://securityratty.com/article/b00a463d2bb0a5e64116bda67d599849</guid>
      <description><![CDATA[Many people have feared that lolcats and other traffic are going to block the tubes, but Ars says today that the net backbone bandwidth is in fact growing and plenty prepared to swallow those cats....]]></description>
      <content:encoded><![CDATA[<p>Many people have feared that lolcats and other traffic are going to block the &#8216;tubes, but Ars says today that the net backbone bandwidth is in fact growing and plenty prepared to swallow those cats. Actually they use a prettier analogy&#8211;</p>
<blockquote><p>Given recent media coverage, it&#8217;s easy to believe that P2P and streaming video traffic is a rising hurricane battering upon ISP levees, that ISPs are frantically sandbagging their systems against disaster, that throttling, bandwidth caps, and traffic management are urgent and absolute necessities to keep the storm surge at bay. But new research from Telegeography only confirms what we&#8217;ve been saying for some time: the Internet backbone isn&#8217;t drowning beneath any kind of exaflood. In fact, backbone capacity has grown faster than Internet traffic in the last year—for the second year in a row.</p></blockquote>
<p>Check out the <a rel="nofollow" target="_blank" href="http://arstechnica.com/news.ars/post/20080903-what-exaflood-net-backbone-shows-no-signs-of-osteoporosis.html">full article</a>, it even has some shiny graphs. It also reminds me of <a rel="nofollow" target="_blank" href="http://xkcd.com/470/">XKCD</a> the other day&#8230; header: &#8220;I get in trouble for showing up contented to protests,&#8221; and the stick figure&#8217;s holding signs: &#8220;Things are pretty OK!&#8221; and &#8220;Anyone for Scrabble later?&#8221;</p>]]></content:encoded>
      <pubDate>Wed, 03 Sep 2008 06:21:16 +0000</pubDate>
      <category domain="http://securityratty.com/tag/traffic">traffic</category>
      <category domain="http://securityratty.com/tag/internet traffic">internet traffic</category>
      <category domain="http://securityratty.com/tag/video traffic">video traffic</category>
      <category domain="http://securityratty.com/tag/traffic management">traffic management</category>
      <category domain="http://securityratty.com/tag/net backbone bandwidth">net backbone bandwidth</category>
      <category domain="http://securityratty.com/tag/recent media coverage">recent media coverage</category>
      <category domain="http://securityratty.com/tag/isp levees">isp levees</category>
      <category domain="http://securityratty.com/tag/lolcats">lolcats</category>
      <category domain="http://securityratty.com/tag/grown faster">grown faster</category>
      <source url="http://feeds.feedburner.com/~r/itsecurity/~3/382565188/">Relax, the Net Backbone Has Space for Your Lolcats</source>
    </item>
    <item>
      <title><![CDATA[Monitoring P2P Networks]]></title>
      <link>http://securityratty.com/article/e2525ed966d30506e3fee3375e62db16</link>
      <guid>http://securityratty.com/article/e2525ed966d30506e3fee3375e62db16</guid>
      <description><![CDATA[Interesting paper: &quot; Challenges and Directions for Monitoring P2P File Sharing Networks or Why My Printer Received a DMCA Takedown Notice &quot;: Abstract -- We reverse engineer copyright enforcement in...]]></description>
      <content:encoded><![CDATA[<p>Interesting paper: "<a href="http://dmca.cs.washington.edu/dmca_hotsec08.pdf">Challenges and Directions for Monitoring P2P File Sharing Networks or Why My Printer Received a DMCA Takedown Notice</a>":</p>

<blockquote>Abstract -- We reverse engineer copyright enforcement in the popular BitTorrent file sharing network and find that a common approach for identifying infringing users is not conclusive. We describe simple techniques for implicating arbitrary network endpoints in illegal content sharing and demonstrate the effectiveness of these techniques experimentally, attracting real DMCA complaints for nonsense devices, e.g., IP printers and a wireless access point. We then step back and evaluate the challenges and possible future directions for pervasive monitoring in P2P file sharing networks.</blockquote>

<p><a href="http://dmca.cs.washington.edu/">Webpage</a> on the research.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=puuvpK"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=puuvpK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=3GKIiK"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=3GKIiK" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Fri, 22 Aug 2008 08:08:57 +0000</pubDate>
      <category domain="http://securityratty.com/tag/network">network</category>
      <category domain="http://securityratty.com/tag/describe simple techniques">describe simple techniques</category>
      <category domain="http://securityratty.com/tag/networks">networks</category>
      <category domain="http://securityratty.com/tag/techniques">techniques</category>
      <category domain="http://securityratty.com/tag/p2p file">p2p file</category>
      <category domain="http://securityratty.com/tag/arbitrary network endpoints">arbitrary network endpoints</category>
      <category domain="http://securityratty.com/tag/dmca takedown notice">dmca takedown notice</category>
      <category domain="http://securityratty.com/tag/popular bittorrent file">popular bittorrent file</category>
      <category domain="http://securityratty.com/tag/real dmca complaints">real dmca complaints</category>
      <source url="http://www.schneier.com/blog/archives/2008/08/monitoring_p2p.html">Monitoring P2P Networks</source>
    </item>
    <item>
      <title><![CDATA[Fog of the Future: Cloud Computings on the Horizon]]></title>
      <link>http://securityratty.com/article/b0444080036cffd2f313acaf1bcf9b99</link>
      <guid>http://securityratty.com/article/b0444080036cffd2f313acaf1bcf9b99</guid>
      <description><![CDATA[If you trust the media and are looking to the future, you might be thinking a good deal about Cloud Computing according to ComputerWorld, this could be the next big movement
Ive heard the buzzwords...]]></description>
      <content:encoded><![CDATA[<p>If you trust the media and are looking to the future, you might be thinking a good deal about <a rel="nofollow" target="_blank" href="http://blogs.computerworld.com/forecast_calls_for_clouds_are_we_ready">Cloud Computing</a> &#8212; according to ComputerWorld, this could be the next big movement.</p>
<p>I&#8217;ve heard the buzzwords but wasn&#8217;t exactly sure what they meant&#8211;luckily, when there&#8217;s media hype, there are definitions, too. According to <a rel="nofollow" target="_blank" href="http://www.thestandard.com/news/2008/08/04/quicker-path-clouds">this article</a>, cloud computing is exemplified by Software as a Service &#8212; outsourced, hosted platforms and software that perform services for companies. </p>
<p>Another <a rel="nofollow" target="_blank" href="http://www.computerworld.com/action/article.do?command=viewArticleBasic&#038;articleId=9111689">article </a>puts it slightly differently:</p>
<blockquote><p>OK, let us look at what form of computing in being provided via the cloud. In this model, all IT applications and facilities (i.e. compute, storage and network) are provided as a service rather than dedicated infrastructure. This is intended to allow any user, independent of client platform, to access IT services without knowledge or concern of their location or form. Sound familiar &#8212; it&#8217;s a service-oriented architecture (SOA)!</p>
<p>In addition, cloud computing incorporates almost every computing manifestation within the IT world: distributed, grid, utility, on-demand, open-source, Web services, P2P, Web 2.0 and, last but not least, software as a service.</p>
<p>It also accommodates thin, thick and mobile clients and allows integration of corporate, commercial and service provider cloud-accessed resources. As an example, in this model, storage is a service resource that is accessed via the cloud, not a dedicated user resource.</p></blockquote>
<p>Honestly I read that last one first and found the definition a bit dense. It sounds like a summation of everything that makes up our Internet infrastructure already, so how is that different than the Internet itself? Well, cloud computing isn&#8217;t about what service or devices are being supported &#8212; it&#8217;s more about how it&#8217;s being provided&#8211; it is a location-independent style of computing. The first article calls it &#8220;platform as a service.&#8221;</p>
<p>Have you heard better definitions of what cloud computing is and does? Share them in the comments below. Thanks!</p>]]></content:encoded>
      <pubDate>Thu, 14 Aug 2008 08:56:26 +0000</pubDate>
      <category domain="http://securityratty.com/tag/cloud">cloud</category>
      <category domain="http://securityratty.com/tag/service">service</category>
      <category domain="http://securityratty.com/tag/service provider">service provider</category>
      <category domain="http://securityratty.com/tag/service resource">service resource</category>
      <category domain="http://securityratty.com/tag/services">services</category>
      <category domain="http://securityratty.com/tag/perform services">perform services</category>
      <category domain="http://securityratty.com/tag/web services">web services</category>
      <category domain="http://securityratty.com/tag/internet infrastructure">internet infrastructure</category>
      <category domain="http://securityratty.com/tag/internet">internet</category>
      <source url="http://feeds.feedburner.com/~r/itsecurity/~3/365101308/">Fog of the Future: Cloud Computings on the Horizon</source>
    </item>
    <item>
      <title><![CDATA[Proactive Education: Remedying the 'Strain' of Compliance]]></title>
      <link>http://securityratty.com/article/fd8c75c1b98a515b5ea3bc2571d11031</link>
      <guid>http://securityratty.com/article/fd8c75c1b98a515b5ea3bc2571d11031</guid>
      <description><![CDATA[A recent survey confirmed that internal threats continue to grow and to represent a challenge to organizations' security postures. It revealed that, in scans of 100,000 PCs and servers in many...]]></description>
      <content:encoded><![CDATA[A recent <a href="http://www.darkreading.com/document.asp?doc_id=160154">survey</a> confirmed that internal threats continue to grow and to represent a challenge to organizations' security postures.  It revealed that, in scans of 100,000 PCs and servers in many industries: 12% of infected computers had a missing or disabled anti-virus program, 10.7% had unauthorized personal storage such as USB sticks or external hard drives, 9.1% had unauthorized peer-to-peer (P2P) applications installed, 8.5% had a missing 3rd party desktop agent, 2.6% had unprotected shared folders, 2.2% had unauthorized remote control software, and 2% had missing Microsoft service packs.  These results continue to resonate with the conclusions of the <a href="http://www.gocsi.com/forms/csi_survey.jhtml">CSI FBI survey</a> that reported in 2007 that <b>internal threats have now outpaced viruses in terms of risk to organizations...</b>  

]]></content:encoded>
      <pubDate>Thu, 07 Aug 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/internal threats">internal threats</category>
      <category domain="http://securityratty.com/tag/internal threats continue">internal threats continue</category>
      <category domain="http://securityratty.com/tag/csi fbi survey">csi fbi survey</category>
      <category domain="http://securityratty.com/tag/remote control software">remote control software</category>
      <category domain="http://securityratty.com/tag/microsoft service packs">microsoft service packs</category>
      <category domain="http://securityratty.com/tag/usb sticks">usb sticks</category>
      <category domain="http://securityratty.com/tag/recent survey">recent survey</category>
      <category domain="http://securityratty.com/tag/personal storage">personal storage</category>
      <category domain="http://securityratty.com/tag/security postures">security postures</category>
      <source url="http://www.rsa.com/blog/blog_entry.aspx?id=1327">Proactive Education: Remedying the 'Strain' of Compliance</source>
    </item>
    <item>
      <title><![CDATA[Storm Worm's Lazy Summer Campaigns]]></title>
      <link>http://securityratty.com/article/e155e33c098c672d2c7846d029362254</link>
      <guid>http://securityratty.com/article/e155e33c098c672d2c7846d029362254</guid>
      <description><![CDATA[The Storm Worm-ers seem to be lacking their usual creativity in respect to the usual social engineering attacks taking advantage of the momentum we're used to seeing. These days they're not...]]></description>
      <content:encoded><![CDATA[<div class="separator" style="text-align: left; clear: both;"><a href="http://bp1.blogger.com/_wICHhTiQmrA/SJGcBUK9GWI/AAAAAAAAB-s/q19bj3vUnhc/s1600-h/ff.gif" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp1.blogger.com/_wICHhTiQmrA/SJGcBUK9GWI/AAAAAAAAB-s/r6me1CKXkVc/s200-R/ff.gif" style="border: 0pt none ;" /></a></div>The Storm Worm-ers seem to be lacking their usual creativity in respect to the usual social engineering attacks taking advantage of the momentum we're used to seeing. These days they're not piggybacking on real news items, <a href="http://honeyblog.org/archives/197-New-Storm-Campaign-Amero.html">they're starting to come up with new ones</a>.<br />
<br />
Storm's latest "FBI vs Facebook" campaign is an example of very badly executed one, lacking their usual fast-flux, any kind of social engineering common sense,&nbsp; as well as client side exploits next to centralizing all the participating domains on a single nameserver.<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="text-align: center; clear: both;"></div>Domains used :<br />
<b>wapdailynews .com<br />
smartnewsradio .com<br />
bestvaluenews .com<br />
toplessnewsradio .com<br />
companynewsnetwork .com<br />
goodnewsgames .com<br />
marketgoodnews .com<br />
fednewsworld .com<br />
toplessdailynews .com<br />
stocklownews .com</b><br />
<a href="http://bp3.blogger.com/_wICHhTiQmrA/SJGc5mMmHPI/AAAAAAAAB-0/YX-edkoIqeU/s1600-h/stormworm_fbi_facebook.png" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp3.blogger.com/_wICHhTiQmrA/SJGc5mMmHPI/AAAAAAAAB-0/ZkZhjt1csUA/s200-R/stormworm_fbi_facebook.png" style="border: 0pt none ;" /></a><br />
DNS servers :<br />
<b>NS.BRPRBGOK6 .COM</b><br />
<b>NS2.BRPRBGOK6 .COM</b><br />
<b>NS3.BRPRBGOK6 .COM&nbsp;</b><br />
<b>NS4.BRPRBGOK6 .COM</b><br />
<b>NS5.BRPRBGOK6 .COM</b><br />
<b>NS6.BRPRBGOK6 .COM</b><br />
<br />
Strangely, the domain has been registered using an email hosted on a known Storm fast-flux node used in the recent <a href="http://blogs.zdnet.com/security/?p=1440">4th of July campaign</a> and the <a href="http://ddanchev.blogspot.com/2008/07/storm-worms-us-invasion-of-iran.html">U.S's invasion of Iran</a> :<br />
<br />
<i>Administrative Contact:<br />
<b>Lee Chung lee@likethisone1.com</b><br />
+13205897845 fax: <br />
1743, 34<br />
Los-Angeles CA 321458<br />
us</i><br />
<br />
This Storm Worm sample is also "phoning back home" over HTTP next to the P2P traffic, and trying to obtain the rootkit from the now down, <b>policy-studies.cn /getbackup.php</b> using already known Storm nameservers :<br />
<br />
<b>ns2.verynicebank .com</b><br />
<b>ns3.verynicebank .com</b><br />
<b>ns.likethisone1 .com</b><br />
<b>ns2.likethisone1 .com</b><br />
<b>ns3.lollypopycandy .com</b><br />
<b>ns4.lollypopycandy .com</b><br />
<br />
Someone's bored, definitely, making it look like it's almost someone else managing a Storm Worm campaign on behalf of them.<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=X5UfaJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=X5UfaJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=UdrqvJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=UdrqvJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=5V52Cj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=5V52Cj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=vMsoHj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=vMsoHj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=CVV77J"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=CVV77J" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=3J26GJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=3J26GJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=OzKbLj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=OzKbLj" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/351463114" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 31 Jul 2008 02:39:35 +0000</pubDate>
      <category domain="http://securityratty.com/tag/storm">storm</category>
      <category domain="http://securityratty.com/tag/campaign">campaign</category>
      <category domain="http://securityratty.com/tag/storm worm campaign">storm worm campaign</category>
      <category domain="http://securityratty.com/tag/storm nameservers">storm nameservers</category>
      <category domain="http://securityratty.com/tag/storm worm sample">storm worm sample</category>
      <category domain="http://securityratty.com/tag/storm fast-flux node">storm fast-flux node</category>
      <category domain="http://securityratty.com/tag/brprbgok6">brprbgok6</category>
      <category domain="http://securityratty.com/tag/usual social">usual social</category>
      <category domain="http://securityratty.com/tag/lee chung leelikethisone1">lee chung leelikethisone1</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/351463114/storm-worms-lazy-summer-campaigns.html">Storm Worm's Lazy Summer Campaigns</source>
    </item>
    <item>
      <title><![CDATA[PET Award 2008]]></title>
      <link>http://securityratty.com/article/545a9a5c54156c491856c14204db6c2a</link>
      <guid>http://securityratty.com/article/545a9a5c54156c491856c14204db6c2a</guid>
      <description><![CDATA[At last years Privacy Enhancing Technologies Symposium (PETS) , I presented the paper Sampled Traffic Analysis by Internet-Exchange-Level Adversaries, co-authored with Piotr Zieliński . In it, we...]]></description>
      <content:encoded><![CDATA[<p>At last year&#8217;s <a href="http://www.petsymposium.org/">Privacy Enhancing Technologies Symposium (PETS)</a>, I presented the paper &#8220;Sampled Traffic Analysis by Internet-Exchange-Level Adversaries&#8221;, co-authored with <a href="http://www.cl.cam.ac.uk/~pz215/">Piotr Zieliński</a>. In it, we discussed the risk of traffic-analysis at Internet exchanges (IXes). We then showed that given even a small fraction of the data passing through an IX it was still possible to track a substantial proportion of anonymous communications. Our results are summarized in a previous <a href="http://www.lightbluetouchpaper.org/2007/05/28/sampled-traffic-analysis-by-internet-exchange-level-adversaries/">blog post</a> and full details are in the <a href="http://www.cl.cam.ac.uk/~sjm217/papers/pet07ixanalysis.pdf">paper</a>.</p>
<p>Our paper has now been announced as a runner-up for the <a href="http://petworkshop.org/award/">Privacy Enhancing Technologies Award</a>. The prize is presented annually, for research which makes an outstanding contribution to the field. Microsoft, the sponsor of the award, have further details and summaries of the papers in their <a href="http://www.microsoft.com/emea/presscentre/pressreleases/23072008_PETSFS.mspx">press release</a>.</p>
<p>Congratulations to the winners, Arvind Narayanan and Vitaly Shmatikov, for <a href="http://www.cs.utexas.edu/~shmat/shmat_oak08netflix.pdf">&#8220;Robust De-Anonymization of Large Sparse Datasets&#8221;</a>; and the other runner-ups, Mira Belenkiy, Melissa Chase, C. Chris Erway, John Jannotti, Alptekin Küpçü, Anna Lysyanskaya and Erich Rachlin, for <a href="http://www.cs.brown.edu/~mira/papers/wpes07.pdf">&#8220;Making P2P Accountable without Losing Privacy&#8221;</a>.</p>
]]></content:encoded>
      <pubDate>Thu, 24 Jul 2008 06:50:23 +0000</pubDate>
      <category domain="http://securityratty.com/tag/award">award</category>
      <category domain="http://securityratty.com/tag/previous blog post">previous blog post</category>
      <category domain="http://securityratty.com/tag/privacy">privacy</category>
      <category domain="http://securityratty.com/tag/technologies award">technologies award</category>
      <category domain="http://securityratty.com/tag/paper">paper</category>
      <category domain="http://securityratty.com/tag/erich rachlin">erich rachlin</category>
      <category domain="http://securityratty.com/tag/mira belenkiy">mira belenkiy</category>
      <category domain="http://securityratty.com/tag/p2p accountable">p2p accountable</category>
      <category domain="http://securityratty.com/tag/technologies symposium">technologies symposium</category>
      <source url="http://www.lightbluetouchpaper.org/2008/07/24/pet-award-2008/">PET Award 2008</source>
    </item>
    <item>
      <title><![CDATA[P2P-related breach affects high-profile clients from Wagner Resource Group]]></title>
      <link>http://securityratty.com/article/989cd0c39e1e8d8d99a391e92dc0fb1d</link>
      <guid>http://securityratty.com/article/989cd0c39e1e8d8d99a391e92dc0fb1d</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
7/9/08

Organization
Wagner Resource Group

Contractor/Consultant/Branch
None

Victims
Clients

Most notably Supreme Court Justice Stephen G. Breyer,...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/wagner.jpg" width="200" align="right" height="120"><font size="2"><b>Date Reported: </b><br>7/9/08<br><br><b>Organization: </b><br><a href="http://www.wagnerrg.com/new/invest-taxfree/gate.asp">Wagner Resource Group</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Clients*<br><br><font size="1">*Most notably Supreme Court Justice Stephen G. Breyer, which has been well publicized.</font><br><br><span style="font-weight: bold;">Number Affected:</span><br>~2,000<br><br><span style="font-weight: bold;">Types of Data:</span><br>"names, dates of birth and Social Security numbers"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"The Washington Post today ran a story I wrote on a data breach of a local investment firm that exposed the names, birth dates and Social Security numbers of some of the Washington area's most powerful attorneys, including Supreme Court Justice Stephen Breyer."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://blog.washingtonpost.com/securityfix/">SecurityFix</a> <br><a href="http://www.washingtonpost.com/wp-dyn/content/article/2008/07/08/AR2008070802997.html">Washington Post</a> <br><a href="http://www.upi.com/Top_News/2008/07/09/Justices_data_breached_in_file-sharing/UPI-14191215609364/">United Press International</a> <br><a href="http://www.nbc4.com/news/16832357/detail.html">NBC Universal, Inc</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Brian Krebs, Washington Post<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>Sometime late last year, an employee of a McLean investment firm decided to trade some music, or maybe a movie, with like-minded users of the online file-sharing network LimeWire while using a company computer<br><span style="font-style: italic;">[Evan] P2P file sharing and other client software use can pose a very significant risk in most companies.&nbsp; It is typically an easy risk to address however.&nbsp; A mixture of any one or more of the following controls can help to mitigate the risk; information security training and awareness, egress traffic monitoring and filtering, intrusion detection/prevention, and hardened workstations (i.e. removal of administrative access) to name a few.</span><br style="font-style: italic;"><br>In doing so, he inadvertently opened the private files of his firm, Wagner Resource Group, to the public.<br><span style="font-style: italic;">[Evan] This is a common oversight.&nbsp; LimeWire and other P2P file sharing applications are wonderful tools for doing what they are designed to do.&nbsp; Before allowing their use (or any other software), an organization must evaluate the risks in doing so.&nbsp; If you intend to use or allow the use of LimeWire in your organization, understand how the software works and how it is configured.&nbsp; During the install you will be prompted for the "Save Folder and Shared Folders".&nbsp; Be careful what you choose, and be careful about what information you put in these locations in the future.&nbsp; Most organizations that are aware of risks just choose not to allow P2P use.</span><br><br><img src="http://images.quickblogcast.com/95781-88451/limewire.jpg" width="576" border="0"><br><br>That exposed the names, dates of birth and Social Security numbers of about 2,000 of the firm's clients, including a number of high-powered lawyers and Supreme Court Justice Stephen G. Breyer.<br><span style="font-style: italic;">[Evan] The high-profile nature of this breach is what has grabbed headlines all last week.</span><br><br>Of the 2,000 records from Wagner Resource Group that were found online, 700 included Social Security numbers, names and birth dates, while other records included only one or two of those details. <br><br>The breach was not discovered for nearly six months.<br><span style="font-style: italic;">[Evan] This is another danger posed by information leaked through P2P.&nbsp; Once information has leaked, how does an organization detect that it has been leaked?&nbsp; There is no longer any control.</span><br style="font-style: italic;"><br>A reader of washingtonpost.com's Security Fix blog found the information while searching LimeWire in June.<br><span style="font-style: italic;">[Evan] I wonder why the reader did not notify the authorities and/or Wagner at the time of its discovery.&nbsp; Maybe he/she did.&nbsp; I don't know.</span><br style="font-style: italic;"><br>Robert Boback, chief executive of Tiversa, the company hired by Wagner to help contain the data breach, said such breaches are hardly rare.<br><br>About 40 to 60 percent of all data leaks take place outside of a company's secured network, usually as a result of employees or contractors installing file-sharing software on company computers.<br><span style="font-style: italic;">[Evan] Really?!&nbsp; I would have not guessed that the percentage would be so high.&nbsp; Interesting.</span><br><br>"We've seen a lot of instances where a company will be working on a product that's not even released yet, and the diagrams for that product are already out on the Net," Boback said.<br><span style="font-style: italic;">[Evan] Very good point.&nbsp; It isn't just personally identifiable information that is leaked, there are plenty of instances where intellectual property (IP) is exposed.&nbsp; I have read estimates that as much as 80% or organizational assets globally are intangible (information, knowledge, etc.).</span><br style="font-style: italic;"><br>"This case is unique because of the high profile of the targets. The individuals on this list are at a very high risk, almost imminent, of identity theft." <br><br>Tiversa officials found that more than a dozen LimeWire users in places as far away as Sri Lanka and Colombia downloaded the list of personal data from the Wagner network.<br><br>"To me, this was devastating," said Phylyp Wagner, founder of the investment firm. "I didn't even know what peer-to-peer was. I do now."<br><span style="font-style: italic;">[Evan] This is a big problem!&nbsp; Corporate leaders must be made aware of the risks surrounding the information for which they are ultimately responsible for.</span><br style="font-style: italic;"><br>Wagner said his company has contracted with FirstAdvantage of Poway, Calif., which last week sent out letters notifying affected clients of the breach and offering each six months of free credit-report monitoring.<br><br>He emphasized that the peer-to-peer disclosure never endangered his clients' financial records, which are stored by a separate company.<br><span style="font-style: italic;">[Evan] Maybe not their financial records, but it did affect some people's financial status (at least temporarily).</span><br><br>But that may be small consolation to several lawyers on the list who said they recently experienced unexplained financial activity.<br><br>"This may explain why two weeks ago I got a $9,000 cellphone bill from AT&amp;T," said Steven Agresta, a partner with the law firm Alston &amp; Bird.<br><br>Someone had opened a phone account using his date of birth and Social Security number, but with a different address.<br><br>this morning I heard from reader Christopher Lynt, a patent attorney from Virginia whose personal data was included in the file exposed via P2P.<br><br>He told me that last July, an identity thief used his SSN and birth date to have $1,000 wired to Mexico from Lynt's bank and credit accounts.<br><br><span style="font-weight: bold;">Commentary:</span><br>This certainly isn't the first time we have read about P2P file sharing network exposures.&nbsp; If your organization can find a way to use the technology without posing an unacceptable risk, then fine.&nbsp; If not, then don't allow the technology to be used.&nbsp; Seems pretty plain and simple.<br><br>There is much work to be done.&nbsp; At Wagner and elsewhere. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown<br></font><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/07/14/wagner.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Mon, 14 Jul 2008 13:08:21 +0000</pubDate>
      <category domain="http://securityratty.com/tag/wagner">wagner</category>
      <category domain="http://securityratty.com/tag/p2p">p2p</category>
      <category domain="http://securityratty.com/tag/investment firm">investment firm</category>
      <category domain="http://securityratty.com/tag/evan p2p file">evan p2p file</category>
      <category domain="http://securityratty.com/tag/mclean investment firm">mclean investment firm</category>
      <category domain="http://securityratty.com/tag/p2p file">p2p file</category>
      <category domain="http://securityratty.com/tag/breach">breach</category>
      <category domain="http://securityratty.com/tag/wagner network">wagner network</category>
      <category domain="http://securityratty.com/tag/wagner resource">wagner resource</category>
      <source url="http://breachblog.com/2008/07/14/wagner.aspx">P2P-related breach affects high-profile clients from Wagner Resource Group</source>
    </item>
  </channel>
</rss>
