<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: park]]></title>
    <link>http://securityratty.com/tag/park</link>
    <description></description>
    <pubDate>Fri, 18 Jul 2008 05:18:07 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Ifoothills.org Registrants Personal data and credit card numbers possibly stolen in Foothills Park & Recreation facilities Breach]]></title>
      <link>http://securityratty.com/article/04d4867c3a3abee4dcf6b258cb0a9664</link>
      <guid>http://securityratty.com/article/04d4867c3a3abee4dcf6b258cb0a9664</guid>
      <description><![CDATA[Foothills Park &amp; Recreation District in South Jefferson County is working with the Jefferson County Sheriffs Office in the investigation of a theft of personal information from the districts computer...]]></description>
      <content:encoded><![CDATA[Foothills Park &#38; Recreation District in South Jefferson County is working with the Jefferson County Sheriff’s Office in the investigation of a theft of personal information from the district’s computer network. The information have been accessed through an illegal hacking and could contain credit card information and other personal information that could be used to [...]]]></content:encoded>
      <pubDate>Thu, 02 Oct 2008 16:51:30 +0000</pubDate>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/foothills park">foothills park</category>
      <category domain="http://securityratty.com/tag/credit card information">credit card information</category>
      <category domain="http://securityratty.com/tag/districts computer network">districts computer network</category>
      <category domain="http://securityratty.com/tag/south jefferson county">south jefferson county</category>
      <category domain="http://securityratty.com/tag/recreation district">recreation district</category>
      <category domain="http://securityratty.com/tag/illegal">illegal</category>
      <category domain="http://securityratty.com/tag/theft">theft</category>
      <source url="http://cyberinsecure.com/ifoothillsorg-registrants-personal-data-possibly-stolen-in-foothills-park-and-recreation-facilities-breach/">Ifoothills.org Registrants Personal data and credit card numbers possibly stolen in Foothills Park &amp; Recreation facilities Breach</source>
    </item>
    <item>
      <title><![CDATA[Sheraton Lounge with Free Wi-Fi in Central Park's Sheep Meadow]]></title>
      <link>http://securityratty.com/article/85bc48b364e027f67ed3da6a64247a80</link>
      <guid>http://securityratty.com/article/85bc48b364e027f67ed3da6a64247a80</guid>
      <description><![CDATA[Sheraton builds lounge in Central Park with Wi-Fi: It's a publicity stunt, but the hotel chain wants to promote the fact that it's updated its hotel lounges or some nonsense, so they've taken over the...]]></description>
      <content:encoded><![CDATA[<p><img src="http://wifinetnews.com/images/weefi.jpg" align="right" border="0" hspace="5" /><a href="http://www.1010wins.com/pages/2974788.php?contentType=4&contentId=2753225"><strong>Sheraton builds lounge in Central Park with Wi-Fi:</strong></a> It's a publicity stunt, but the hotel chain wants to promote the fact that it's updated its hotel lounges or some nonsense, so they've taken over the famous Sheep Meadow, blanketing it in free Wi-Fi through September, and offering snacks and such next Monday. Central Park <a href="http://www.nycgovparks.org/sub_your_park/wifi/index.html"><strong>already has some Wi-Fi</strong></a>, including at Sheep Meadow.<br />
</p>]]></content:encoded>
      <pubDate>Tue, 16 Sep 2008 05:49:57 +0000</pubDate>
      <category domain="http://securityratty.com/tag/sheep meadow">sheep meadow</category>
      <category domain="http://securityratty.com/tag/central park">central park</category>
      <category domain="http://securityratty.com/tag/free wi-fi">free wi-fi</category>
      <category domain="http://securityratty.com/tag/wi-fi">wi-fi</category>
      <category domain="http://securityratty.com/tag/famous sheep meadow">famous sheep meadow</category>
      <category domain="http://securityratty.com/tag/sheraton builds lounge">sheraton builds lounge</category>
      <category domain="http://securityratty.com/tag/hotel chain">hotel chain</category>
      <category domain="http://securityratty.com/tag/publicity stunt">publicity stunt</category>
      <category domain="http://securityratty.com/tag/hotel lounges">hotel lounges</category>
      <source url="http://wifinetnews.com/archives/008443.html">Sheraton Lounge with Free Wi-Fi in Central Park's Sheep Meadow</source>
    </item>
    <item>
      <title><![CDATA[Modelling Shoplifting]]></title>
      <link>http://securityratty.com/article/3943f3c70f24e801812a87cf0b0b61f8</link>
      <guid>http://securityratty.com/article/3943f3c70f24e801812a87cf0b0b61f8</guid>
      <description><![CDATA[The other day I was thinking that I should write about specific situation models and by coincident Marc Adler pens CEP and Shoplifting . In Marcs post, Marc begins to model shoplifting as if...]]></description>
      <content:encoded><![CDATA[<p>The other day I was thinking that I should write about specific situation models and by coincident Marc Adler pens <a href="http://magmasystems.blogspot.com/2008/09/cep-and-shoplifting.html" target="_blank">CEP and Shoplifting</a>.  In Marc&#8217;s post, Marc begins to model shoplifting as if shoplifting is &#8220;market data,&#8221; with Level 1 to Level 4 shoplifting &#8220;quotes&#8221; - the natural approach for a brilliant guy from Citi.   In reality, this model does not work very well, and I&#8217;ll touch on a few reasons why today.</p>
<p>Marc&#8217;s initial shoplifting model in his post is based on John <span id="SPELLING_ERROR_3" class="blsp-spelling-error">Colapinto&#8217;s concepts of matching a pattern of customer movements in the store with their estimated patterns of shoplifting behavioral patterns.    Marc&#8217;s asks how Coral8 might address this.   We are not ready to seek a vendor solution.  We do not yet have a workable detection model.</span></p>
<p><span class="blsp-spelling-error">As indicated above, I don&#8217;t think the example situation cited by John and Marc is a viable model for automated processing.    Tracking the behavior of customer&#8217;s movements, by machine, would require some very sophisticated image processing technology that would be too expensive compared to any possible loss at most retails stores.    This type of behavioral pattern recognition. in retail stores, is performed by people (security personnel), not machines, observing people.  </span></p>
<p><span class="blsp-spelling-error">To develop a machine pattern recognition application to detect retail shoplifting we need to build detection models that are economically feasible.  If we are going to use a model of shoplifting pattern recognition versus anomaly detection, we need to define the objects we must track.   </span></p>
<p><span class="blsp-spelling-error">In the most simple model, we have merchandise-objects.   Stores normally (physically) track merchandise-objects only at the exit/entry points of the store using some electromagnetic proximity detection technology.   In this model, the detection configuration is a combination of simple alerting with humans watching the store (&#8221;minding the store&#8221;).    This is not complex event processing.</span></p>
<p><span class="blsp-spelling-error">However, if we added another object to our model, the customer-object, then we start to get more &#8220;complex,&#8221; but we have not defined &#8220;complexity&#8221; yet because we have not defined the object properties, the possible states of the objects, and the relationships between the objects that are the basis for estimated situations.</span></p>
<p><span class="blsp-spelling-error">Hence, model building is constrained by available resources, simple economics and risk (cost-benefit).  If we are detecting shoplifting in Walmart the cost-benefit model for implementing an automated shoplifting detection system would be different than at a top diamond store on 5th Avenue in NYC.   Protecting loss at a weapons-grade uranium respository follows a different model than protecting loss at a handicraft shop, naturally.</span></p>
<p><span class="blsp-spelling-error">Like Marc, I find models to automatically detect shoplifting interesting, so permit me to close with a general discussion of shoplifting in the context of our <a href="http://www.thecepblog.com/what-is-complex-event-processing/" target="_blank">CEP/EP reference model</a>.</span></p>
<p><span class="blsp-spelling-error"><span class="blsp-spelling-error">One approach would be do determine what objects will be represented in our model.   For example, if we are going to track merchandise, we need to model the &#8221;merchandise-object&#8221;.  If we are going to track people, we need to define the properties of this &#8220;person object.&#8221;  If we are going to represent the store layout, we need to define all these objects (store-object, table-object, shelf-object, entry-object and so forth).  The model can get &#8220;complex&#8221; quite quickly.  </span></span></p>
<blockquote><p><span class="blsp-spelling-error"><span class="blsp-spelling-error">Editorial Note:  <em>An object-oriented approach greatly assists complex model building because we can benefit from OO properties such as encapsulation and polymorphism.  For example, we can define a basic &#8220;person object class&#8221; and then create superclasses of this object for &#8220;customer-object&#8221;, &#8220;manager-object&#8221;, &#8220;or criminal-object.&#8221;</em></span></span></p></blockquote>
<p><span class="blsp-spelling-error"><span class="blsp-spelling-error">Generally speaking, each object we define will require a state-model, for example, in Marc&#8217;s example of a customer moving around the store, we would need to model the possible states (customer at the entrance, at table 1, at table 2, at shelf 1, in the bathroom, at the cashier, etc.)  Indeed Marc, this is complex event processing if we have modelled multiple objects and defined object-object relationships that indicate situations of interest.   For example, customer-object at table2 where merchandise-object has the property of  &#8221;very expensive, high risk&#8221; and then customer-object changes state to &#8220;in bathroom&#8221;.  Of course, we need more key indicators, but you get the idea.</span></span></p>
<p><span class="blsp-spelling-error"><span class="blsp-spelling-error">Right now, I am typing from the <a href="http://www.taste4heaven.com">Taste from Heaven Vegetarian Restaurant</a> in Chiang Mai and my battery is running low.  The owner of this excellent restaurant also runs the <a href="http://www.elephantnaturefoundation.org/" target="_blank">Elephant Nature Park</a>, a non-profit organization advocating and acting on behalf of the rights of the mighty elephants in Thailand.  Would be great if we could also automatically detect the situation of &#8220;elephant abuse&#8221; by poachers and other crimes against nature.   Time to get back to my delicious mushroom salad, Northeastern Thai style.</span></span></p>
<p><span class="blsp-spelling-error"><span class="blsp-spelling-error">As always, thanks for reading, time for me to get back to eating!</span></span></p>
<p> </p>
]]></content:encoded>
      <pubDate>Sun, 07 Sep 2008 03:30:15 +0000</pubDate>
      <category domain="http://securityratty.com/tag/store">store</category>
      <category domain="http://securityratty.com/tag/store-object">store-object</category>
      <category domain="http://securityratty.com/tag/complex">complex</category>
      <category domain="http://securityratty.com/tag/model canget complex">model canget complex</category>
      <category domain="http://securityratty.com/tag/model">model</category>
      <category domain="http://securityratty.com/tag/simple">simple</category>
      <category domain="http://securityratty.com/tag/simple economics">simple economics</category>
      <category domain="http://securityratty.com/tag/simple model">simple model</category>
      <category domain="http://securityratty.com/tag/object">object</category>
      <source url="http://www.thecepblog.com/2008/09/07/modelling-shoplifting/">Modelling Shoplifting</source>
    </item>
    <item>
      <title><![CDATA[A Diverse Portfolio of Fake Security Software - Part Five]]></title>
      <link>http://securityratty.com/article/38118a4a2d1022021197659857d63ff3</link>
      <guid>http://securityratty.com/article/38118a4a2d1022021197659857d63ff3</guid>
      <description><![CDATA[The &quot;campaign managers&quot; behind these fake security software propositions are not just starting to take park them at up to three different locations, localize the sites to different languages and...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://4.bp.blogspot.com/_wICHhTiQmrA/SL0JgRiDYeI/AAAAAAAACI8/6WOV1GjHRlY/s1600-h/fake_software_september1.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://4.bp.blogspot.com/_wICHhTiQmrA/SL0JgRiDYeI/AAAAAAAACI8/JMBr1bMh8no/s200-R/fake_software_september1.JPG" /></a>The "campaign managers" behind these <a href="http://ddanchev.blogspot.com/2008/08/diverse-portfolio-of-fake-security_25.html">fake security software propositions</a> are not just starting to take park them at up to three different locations, <a href="http://ddanchev.blogspot.com/2008/04/localized-fake-security-software.html">localize the sites</a> to different languages and introduce <a href="http://ddanchev.blogspot.com/2008/08/fake-security-software-domains-serving.html">client-side exploits</a>, just in case the end user gets suspicious and doesn't install it, but also, the natural evasive practices. For instance, once some of their domains get detected and blocked, they put them in a stand by mode and relaunch them online in a week or so, or ensure that only those coming to the domains from where they are supposed to come - yet another blackhat SEO or SQL injection attack - are the only ones getting to see the download screen.<br />
<br />
Some of the new additions parked at the same IPs offered by the "known suspects" include :<br />
<br />
<b>main-scanner .com</b> - (77.244.220.138; 78.159.97.247; 89.149.209.251; 212.95.37.154)<br />
<b>scanner-mainpro .com<br />
scanner-online1 .com<br />
alldiskscheck300 .com<br />
myscanners101 .com<br />
download-a1 .com<br />
scanner-online1 .com<br />
multilang1 .com<br />
ratemyblog1 .com<br />
multisearch1 .com<br />
filescheck-list303 .com<br />
woodst-sale .com<br />
scanner-mainpro .com<br />
main-scanner .com<br />
directrevisions .com</b><br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://2.bp.blogspot.com/_wICHhTiQmrA/SL0MwkX0VNI/AAAAAAAACJE/QObbQi3_9Ng/s1600-h/doctor_antivirus1.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="141" src="http://2.bp.blogspot.com/_wICHhTiQmrA/SL0MwkX0VNI/AAAAAAAACJE/vDM5gk_K5fc/s200-R/doctor_antivirus1.png" width="200" /></a><b>supersolution-freeantivirus .com</b> - (213.155.2.69)<br />
<b>antivirus-bestsolution .net<br />
antivirus4protection .net<br />
antivirusproxp .com<br />
freebest-antivirus .net<br />
goodantivirus-free .net<br />
noadwareantivirus .com<br />
pwrantivirus2009 .com<br />
solution-freeantivirus .com<br />
supersolution-antivirus .com<br />
supersolution-freeantivirus .com<br />
antivirusdwl .com<br />
securesoftdl .com<br />
viva-codec .com<br />
win-antivirus-protect .com<br />
avxp-2008 .net<br />
antivirusq .net<br />
antivirus2008b .net<br />
antivirus2008m .net<br />
antivirus2008n .net<br />
antivirus2008v .net<br />
antivirus777 .com<br />
antivirusq .net<br />
antivirusr .net<br />
antivirust .net<br />
antivirusw .net<br />
antivirusu .net<br />
expressantivirus2009 .com<br />
spywarezscan .net<br />
antispywareq .net<br />
free-anti-spywaree .net<br />
avcheckyourpc .net<br />
</b><br />
<br />
<a href="http://2.bp.blogspot.com/_wICHhTiQmrA/SL0NgVvxo5I/AAAAAAAACJM/zna4-YKQE_o/s1600-h/doctor_antivirus2.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://2.bp.blogspot.com/_wICHhTiQmrA/SL0NgVvxo5I/AAAAAAAACJM/4mda8Pv35yY/s200-R/doctor_antivirus2.png" /></a><b>software-for-me08 .com</b> - (78.157.143.250)<br />
<b>software-for-me-08 .com<br />
softwarefor-me2008 .com<br />
softwarefor-me-2008 .com<br />
software-forme08 .com</b><br />
<br />
<b>doctor2antivirus .com</b> - (217.112.94.226; 87.248.163.56)<br />
<b>doctor5antivirus .com<br />
doctor6antivirus .com<br />
doctor7antivirus .com<br />
doctor8antivirus .com<br />
doctorantivirus2008a .com<br />
doctor-antivirus .com<br />
bcodecnow .net</b><br />
<br />
<b>mysoftwarefreezone .com</b> - (91.203.92.97)<br />
<b>hotvid44 .com<br />
totsec2009 .com<br />
getdefender2009 .com<br />
totalsecure2009 .com<br />
myveryprivatevid .com<br />
mustseethatvid .com<br />
onlythebestvid .com<br />
ie-antivirus-order .com<br />
ie-anti-virus .com<br />
secure-order-box .com</b><br />
<br />
<b>secureexpertcleaner .com</b> - (89.149.227.50)<br />
<b>bestxpclean2008 .com<br />
virusremover2008 .com<br />
registrydoctor2008 .com<br />
securefileshredder .com<br />
hypersecurefileshredder .com<br />
bestsecureexpertcleaner .com</b><br />
<br />
<b>getdefender2009 .com</b> - (58.65.238.34)<br />
<b>malwarebell .com<br />
free-viruscan .com<br />
tmptmpservvv .com<br />
cometoseemyshow .com</b><br />
<br />
<b>getneededsoftware .com</b> - (91.203.93.25)<br />
<b>gettotalsec2008 .com<br />
thedownloadvid .com<br />
scan.pc-antispyware-scanner .com<br />
totalsecure2009 .com</b><br />
<br />
<b>wista-antivirus2009 .com</b> - (216.255.179.203)<br />
<b>usawindowsupdates .com</b> - (85.17.143.213)<br />
<b>mswindowsupdates .com</b><br />
<br />
The campaigns and the hosting providers are continuously monitored, especially taking into consideration the fact that the domains are already appearing in Alexa's web rankings with sudden peaks of traffic.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2008/08/fake-security-software-domains-serving.html">Fake Security Software Domains Serving Exploits</a><br />
<b> </b><a href="http://ddanchev.blogspot.com/2008/08/diverse-portfolio-of-fake-security_25.html">A Diverse Portfolio of Fake Security Software - Part Four</a><br />
<b> </b><a href="http://ddanchev.blogspot.com/2008/08/diverse-portfolio-of-fake-security_20.html">A Diverse Portfolio of Fake Security Software - Part Three</a><b> </b><br />
<a href="http://ddanchev.blogspot.com/2008/08/diverse-portfolio-of-fake-security.html">A Diverse Portfolio of Fake Security Software - Part Two</a><br />
<a href="http://ddanchev.blogspot.com/2008/04/localized-fake-security-software.html">Localized Fake Security Software</a><br />
<a href="http://ddanchev.blogspot.com/2007/12/diverse-portfolio-of-fake-security.html">Diverse Portfolio of Fake Security Software</a><br />
<a href="http://ddanchev.blogspot.com/2008/05/got-your-xpshield-up-and-running.html">Got Your XPShield Up and Running?</a><br />
<a href="http://ddanchev.blogspot.com/2008/05/fake-pestpatrol-security-software.html">Fake PestPatrol Security Software</a><br />
<a href="http://ddanchev.blogspot.com/2007/10/rbns-fake-security-software.html">RBN's Fake Security Software</a><br />
<a href="http://ddanchev.blogspot.com/2008/07/lazy-summer-days-at-ukrtelegroup-ltds.html">Lazy Summer Days at UkrTeleGroup Ltd</a><br />
<a href="http://ddanchev.blogspot.com/2008/02/geolocating-malicious-isps.html">Geolocating Malicious ISPs</a><br />
<a href="http://ddanchev.blogspot.com/2008/06/malicious-isps-you-rarely-see-in-any.html">The Malicious ISPs You Rarely See in Any Report</a><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=9RKAnL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=9RKAnL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=S4YvYL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=S4YvYL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=J1kcWl"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=J1kcWl" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=q4Iwql"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=q4Iwql" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=Cbh1CL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=Cbh1CL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=b89bjL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=b89bjL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=t2D6Bl"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=t2D6Bl" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/381234025" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 02 Sep 2008 01:04:58 +0000</pubDate>
      <category domain="http://securityratty.com/tag/fake security software">fake security software</category>
      <category domain="http://securityratty.com/tag/net">net</category>
      <category domain="http://securityratty.com/tag/diverse portfolio">diverse portfolio</category>
      <category domain="http://securityratty.com/tag/introduce client-side exploits">introduce client-side exploits</category>
      <category domain="http://securityratty.com/tag/malicious isps">malicious isps</category>
      <category domain="http://securityratty.com/tag/exploits">exploits</category>
      <category domain="http://securityratty.com/tag/sql injection attack">sql injection attack</category>
      <category domain="http://securityratty.com/tag/lazy summer days">lazy summer days</category>
      <category domain="http://securityratty.com/tag/domains">domains</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/381234025/diverse-portfolio-of-fake-security.html">A Diverse Portfolio of Fake Security Software - Part Five</source>
    </item>
    <item>
      <title><![CDATA[Let's Play Two]]></title>
      <link>http://securityratty.com/article/83bf8d018a7d0aa80e3dc49adab30013</link>
      <guid>http://securityratty.com/article/83bf8d018a7d0aa80e3dc49adab30013</guid>
      <description><![CDATA[Every year my Dad and I go to see a Red Sox series. Last weekend was this year's trip and we went to Chicago to see the World Champion Boston Red Sox (saying that never gets old) play the White Sox....]]></description>
      <content:encoded><![CDATA[<p>Every year my Dad and I go to see a Red Sox series. Last weekend was this year&#39;s trip and we went to Chicago to see the World Champion Boston Red Sox (saying that never gets old) play the White Sox. Of course, while you are in Chicago you have to see Wrigley Field, and we really lucked out. This weekend was Red Sox versus the White Sox (the battle of the Soxes they used to call it on Channel 38) on the southside and northside featured Cubs versus Cardinals! The last four World Series winners in town on the same weekend (Red Sox 04, 07, White Sox 05, Cards 06).</p><br /><div>We learned several things- first in heaven the Cubs play the Red Sox in the World Series. Those ballparks are true gems. (In hell its probably the Yankees versus Phillies). Also, the people on the southside and northside *really* have a rivalry going. Its basically Boston v NY but they live in the same town! Here is one example from the southside</div><br /><div><a href="http://1raindrop.typepad.com/.a/6a00d83451c75869e200e553fc0c9d8834-pi" style="display: inline;"><img alt="IMG_0597" border="0" class="at-xid-6a00d83451c75869e200e553fc0c9d8834 " src="http://1raindrop.typepad.com/.a/6a00d83451c75869e200e553fc0c9d8834-800wi" title="IMG_0597" /></a>
<br /></div><br /><div>One of the great things about Wrigley (and there are many despite what southsiders say), is that its in the middle of a real neighborhood</div><div><a href="http://1raindrop.typepad.com/.a/6a00d83451c75869e200e553e0bbb38833-pi" style="display: inline;"><img alt="IMG_0486" border="0" class="at-xid-6a00d83451c75869e200e553e0bbb38833 " src="http://1raindrop.typepad.com/.a/6a00d83451c75869e200e553e0bbb38833-800wi" title="IMG_0486" /></a>
<br /></div><br /><div>Epicenter of Cub universe</div><br /><div><a href="http://1raindrop.typepad.com/.a/6a00d83451c75869e200e553e0bbf68833-pi" style="display: inline;"><img alt="IMG_0487" border="0" class="at-xid-6a00d83451c75869e200e553e0bbf68833 " src="http://1raindrop.typepad.com/.a/6a00d83451c75869e200e553e0bbf68833-800wi" title="IMG_0487" /></a>&#160;</div><br /><div>Lots of action before and after game time, lots of people wandering around with gloves catching batting practices homers outside the stadium...err Field. Key point - Wrigley is a field, not a Stadium. Also Fenway is a Park. The Greek root of the word &quot;paradise&quot;, means &quot;enclosed green space&quot;, not concreteopolis</div><br /><div><a href="http://1raindrop.typepad.com/.a/6a00d83451c75869e200e553fc0ed98834-pi" style="display: inline;"><img alt="IMG_0489" border="0" class="at-xid-6a00d83451c75869e200e553fc0ed98834 " src="http://1raindrop.typepad.com/.a/6a00d83451c75869e200e553fc0ed98834-800wi" title="IMG_0489" /></a>
<br /></div><br /><div>Wrigley is baseball Mecca</div><div><a href="http://1raindrop.typepad.com/.a/6a00d83451c75869e200e553fc15338834-pi" style="display: inline;"><img alt="IMG_0507" border="0" class="at-xid-6a00d83451c75869e200e553fc15338834 " src="http://1raindrop.typepad.com/.a/6a00d83451c75869e200e553fc15338834-800wi" title="IMG_0507" /></a>
<br /></div><br /><div><a href="http://1raindrop.typepad.com/.a/6a00d83451c75869e200e553e0bebd8833-pi" style="display: inline;"><img alt="IMG_0515" border="0" class="at-xid-6a00d83451c75869e200e553e0bebd8833 " src="http://1raindrop.typepad.com/.a/6a00d83451c75869e200e553e0bebd8833-800wi" title="IMG_0515" /></a>
<br /></div><br /><div><a href="http://1raindrop.typepad.com/.a/6a00d83451c75869e200e553e0bef48833-pi" style="display: inline;"><img alt="IMG_0533" border="0" class="at-xid-6a00d83451c75869e200e553e0bef48833 " src="http://1raindrop.typepad.com/.a/6a00d83451c75869e200e553e0bef48833-800wi" title="IMG_0533" /></a>
<br /></div><br /><div><span style="color: #0000ff; text-decoration: underline;"><br /></span></div><div>The greatest Cub of all, Ernie Banks, was our touchstone for the day - &quot;Let&#39;s Play Two.&quot; we started at Wrigley for the day game (Zambrano got shelled) and then got crosstown for the night game.</div><br /><div><a href="http://1raindrop.typepad.com/.a/6a00d83451c75869e200e553e0bce68833-pi" style="display: inline;"><img alt="IMG_0496" border="0" class="at-xid-6a00d83451c75869e200e553e0bce68833 " src="http://1raindrop.typepad.com/.a/6a00d83451c75869e200e553e0bce68833-800wi" title="IMG_0496" /></a>
<br /></div><div>To pull this off the L is your friend. As several Chicagoans pointed out, they are the only city that can have a true subway series, because the Red Line services both the White Sox and Cubs, whereas Mets-Yankees involves numerous transfers and so on.</div><br /><div><a href="http://1raindrop.typepad.com/.a/6a00d83451c75869e200e553fc0e988834-pi" style="display: inline;"><img alt="IMG_0488" border="0" class="at-xid-6a00d83451c75869e200e553fc0e988834 " src="http://1raindrop.typepad.com/.a/6a00d83451c75869e200e553fc0e988834-800wi" title="IMG_0488" /></a>
<br /></div><br /><div>We got to US Cellular Field which is fine but a shadow of Wrigley and absolutely nothing good to <a href="http://www.nytimes.com/interactive/2008/06/08/travel/20080608_BALLPARK_GRAPHIC.html">eat</a>. Luckily we had Daisuke Matsuzaka on the hill</div><br /><div><a href="http://1raindrop.typepad.com/.a/6a00d83451c75869e200e553fc187a8834-pi" style="display: inline;"><img alt="IMG_0569" border="0" class="at-xid-6a00d83451c75869e200e553fc187a8834 " src="http://1raindrop.typepad.com/.a/6a00d83451c75869e200e553fc187a8834-800wi" title="IMG_0569" /></a>
<br /></div><br /><div><a href="http://1raindrop.typepad.com/.a/6a00d83451c75869e200e553fc18a88834-pi" style="display: inline;"><img alt="IMG_0573" border="0" class="at-xid-6a00d83451c75869e200e553fc18a88834 " src="http://1raindrop.typepad.com/.a/6a00d83451c75869e200e553fc18a88834-800wi" title="IMG_0573" /></a>
<br /></div><br /><div>Before every game, Big Papi holds court in center with some players from the other team, he is to be a very popular guy. Ozzie Guillen told him before the series that with Manny gone, he wouldn&#39;t see a pitch to hit all weekend (ps. he did and crushed a bases loaded double)</div><br /><div><a href="http://1raindrop.typepad.com/.a/6a00d83451c75869e200e553e0bfa78833-pi" style="display: inline;"><img alt="IMG_0581" border="0" class="at-xid-6a00d83451c75869e200e553e0bfa78833 " src="http://1raindrop.typepad.com/.a/6a00d83451c75869e200e553e0bfa78833-800wi" title="IMG_0581" /></a>
<br /></div><br /><br /><div>The question we got most was - what about the Manny trade? His replacement strikes out a lot, but is otherwise a promising player</div><br /><div><a href="http://1raindrop.typepad.com/.a/6a00d83451c75869e200e553e0bb978833-pi" style="display: inline;"><img alt="IMG_0468" border="0" class="at-xid-6a00d83451c75869e200e553e0bb978833 " src="http://1raindrop.typepad.com/.a/6a00d83451c75869e200e553e0bb978833-800wi" title="IMG_0468" /></a>
<br /></div><br /><div>The Red Sox and White Sox share a little history, most especially Pudge Fisk who hit the famous homer in the 75 world series for the Red Sox and then had a great career for the White Sox (actually played more games for Chicago than Boston, but went into Cooperstown with a B on his hat)</div><br /><div><a href="http://1raindrop.typepad.com/.a/6a00d83451c75869e200e553e0bb778833-pi" style="display: inline;"><img alt="IMG_0456" border="0" class="at-xid-6a00d83451c75869e200e553e0bb778833 " src="http://1raindrop.typepad.com/.a/6a00d83451c75869e200e553e0bb778833-800wi" title="IMG_0456" /></a></div><div>
<br /></div><div>Red Sox won, hanging out in Wrigley was an even bigger highlight, and Chicago is a beautiful city to visit, by far the most accessible of the big US cities. Also, lots of good places to eat courtesy of <a href="http://www.matasano.com/log/">Thomas Ptacek</a>.</div><div><a href="http://1raindrop.typepad.com/.a/6a00d83451c75869e200e553e0c08f8833-pi" style="display: inline;"><img alt="IMG_0591" border="0" class="at-xid-6a00d83451c75869e200e553e0c08f8833 " src="http://1raindrop.typepad.com/.a/6a00d83451c75869e200e553e0c08f8833-800wi" title="IMG_0591" /></a>
<br /></div>]]></content:encoded>
      <pubDate>Tue, 12 Aug 2008 08:47:51 +0000</pubDate>
      <category domain="http://securityratty.com/tag/world series winners">world series winners</category>
      <category domain="http://securityratty.com/tag/world series">world series</category>
      <category domain="http://securityratty.com/tag/red sox versus">red sox versus</category>
      <category domain="http://securityratty.com/tag/red sox">red sox</category>
      <category domain="http://securityratty.com/tag/red sox series">red sox series</category>
      <category domain="http://securityratty.com/tag/series">series</category>
      <category domain="http://securityratty.com/tag/white sox">white sox</category>
      <category domain="http://securityratty.com/tag/white sox share">white sox share</category>
      <category domain="http://securityratty.com/tag/play">play</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/08/lets-play-two.html">Let's Play Two</source>
    </item>
    <item>
      <title><![CDATA[Meru Networks erects a "cone of silence"]]></title>
      <link>http://securityratty.com/article/2b9b51efaeb059be63332e84e9b51781</link>
      <guid>http://securityratty.com/article/2b9b51efaeb059be63332e84e9b51781</guid>
      <description><![CDATA[Who doesn't remember the cone of silence from the original Get Smart TV series. Whenever Max and the Chief had something important to discuss they would lower the cone of silence so that no one else...]]></description>
      <content:encoded><![CDATA[
<div xmlns="http://www.w3.org/1999/xhtml"><p><a onclick="window.open(this.href, '_blank', 'width=376,height=261,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false" href="http://www.stillsecureafteralltheseyears.com/.shared/image.html?/photos/uncategorized/2008/07/30/coneofsilence.jpg"><img title="Coneofsilence" height="173" alt="Coneofsilence" src="http://www.stillsecureafteralltheseyears.com/ashimmy/images/2008/07/30/coneofsilence.jpg" width="249" border="0" style="FLOAT: right; MARGIN: 0px 0px 5px 5px" /></a> Who doesn't remember <a class="zem_slink" title="Cone of Silence" href="http://en.wikipedia.org/wiki/Cone_of_Silence" rel="wikipedia">the cone of silence</a> from the original Get Smart TV series.&nbsp; Whenever Max and the Chief had something important to discuss they would lower the cone of silence so that no one else could hear them or eavesdrop. So it is only fitting with the recent release of the <a class="zem_slink" title="Get Smart (film)" href="http://getsmartmovie.warnerbros.com/" rel="homepage">Get Smart movie</a>, <a href="http://news.zdnet.co.uk/communications/0,1000000085,39453788,00.htm">Meru Networks has released a wireless cone of silence</a>. </p>

<p>Meru is one of few stand alone wireless companies still hanging on out there.&nbsp; So they need to be innovative to survive.&nbsp; Their latest product, RF Barrier puts antennas around a physical plant to dampen and make it impossible to to listen in on wireless data exchanges.&nbsp; They claim this is a first of its kind.&nbsp; Thinking about it though, I don't see a big barrier to other companies having similar technology. I don't think you have to be a genius to broadcast traffic that puts out &quot;noise&quot; to hide legit traffic. I think the real special sauce is that this works in conjunction with Meru's other security products like wireless firewalls and secure access points.</p>

<p>With Motorola's recent purchase of AirDefense is having wireless IPS soon going to be table stakes in the wireless provider game?&nbsp; I think it is and while Meru's RF barrier is a nice story, they are going to need to have some sort of IDS/IPS in their product line to keep up.</p>

<fieldset class="zemanta-related"><legend class="zemanta-related-title">Related articles by Zemanta</legend><ul class="zemanta-article-ul"><li class="zemanta-article-ul-li"><a href="http://www.itweek.co.uk/itweek/news/2222765/motorola-acquire-airdefense">Motorola to acquire AirDefense</a></li>

<li class="zemanta-article-ul-li"><a href="http://www.itweek.co.uk/itweek/news/2222643/meru-locks-car-park-hackers">Meru locks out car park hackers</a></li></ul></fieldset> <div class="zemanta-pixie" style="MARGIN-TOP: 10px; HEIGHT: 15px"><a class="zemanta-pixie-a" title="Zemified by Zemanta" href="http://reblog.zemanta.com/zemified/5a77977d-6e3b-40f2-b9f2-737ba115b05b/"><img class="zemanta-pixie-img" alt="Zemanta Pixie" src="http://img.zemanta.com/reblog_e.png?x-id=5a77977d-6e3b-40f2-b9f2-737ba115b05b" style="BORDER-RIGHT: medium none; BORDER-TOP: medium none; FLOAT: right; BORDER-LEFT: medium none; BORDER-BOTTOM: medium none" /></a></div></div>
]]></content:encoded>
      <pubDate>Wed, 30 Jul 2008 04:05:48 +0000</pubDate>
      <category domain="http://securityratty.com/tag/meru">meru</category>
      <category domain="http://securityratty.com/tag/meru networks">meru networks</category>
      <category domain="http://securityratty.com/tag/cone">cone</category>
      <category domain="http://securityratty.com/tag/silence">silence</category>
      <category domain="http://securityratty.com/tag/meru locks">meru locks</category>
      <category domain="http://securityratty.com/tag/wireless cone">wireless cone</category>
      <category domain="http://securityratty.com/tag/product line">product line</category>
      <category domain="http://securityratty.com/tag/hide legit traffic">hide legit traffic</category>
      <category domain="http://securityratty.com/tag/wireless provider game">wireless provider game</category>
      <source url="http://www.stillsecureafteralltheseyears.com/ashimmy/2008/07/meru-networks-e.html">Meru Networks erects a "cone of silence"</source>
    </item>
    <item>
      <title><![CDATA[Meru Networks erects a "cone of silence"]]></title>
      <link>http://securityratty.com/article/b76f30b52c9fc47905da9e8e714fa2b2</link>
      <guid>http://securityratty.com/article/b76f30b52c9fc47905da9e8e714fa2b2</guid>
      <description><![CDATA[Who doesn't remember the cone of silence from the original Get Smart TV series. Whenever Max and the Chief had something important to discuss they would lower the cone of silence so that no one else...]]></description>
      <content:encoded><![CDATA[
<div xmlns="http://www.w3.org/1999/xhtml"><p><a onclick="window.open(this.href, '_blank', 'width=376,height=261,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false" href="http://www.stillsecureafteralltheseyears.com/.shared/image.html?/photos/uncategorized/2008/07/30/coneofsilence.jpg"><img title="Coneofsilence" height="173" alt="Coneofsilence" src="http://www.stillsecureafteralltheseyears.com/ashimmy/images/2008/07/30/coneofsilence.jpg" width="249" border="0" style="FLOAT: right; MARGIN: 0px 0px 5px 5px" /></a> Who doesn't remember <a class="zem_slink" title="Cone of Silence" href="http://en.wikipedia.org/wiki/Cone_of_Silence" rel="wikipedia">the cone of silence</a> from the original Get Smart TV series.&nbsp; Whenever Max and the Chief had something important to discuss they would lower the cone of silence so that no one else could hear them or eavesdrop. So it is only fitting with the recent release of the <a class="zem_slink" title="Get Smart (film)" href="http://getsmartmovie.warnerbros.com/" rel="homepage">Get Smart movie</a>, <a href="http://news.zdnet.co.uk/communications/0,1000000085,39453788,00.htm">Meru Networks has released a wireless cone of silence</a>. </p>

<p>Meru is one of few stand alone wireless companies still hanging on out there.&nbsp; So they need to be innovative to survive.&nbsp; Their latest product, RF Barrier puts antennas around a physical plant to dampen and make it impossible to to listen in on wireless data exchanges.&nbsp; They claim this is a first of its kind.&nbsp; Thinking about it though, I don't see a big barrier to other companies having similar technology. I don't think you have to be a genius to broadcast traffic that puts out &quot;noise&quot; to hide legit traffic. I think the real special sauce is that this works in conjunction with Meru's other security products like wireless firewalls and secure access points.</p>

<p>With Motorola's recent purchase of AirDefense is having wireless IPS soon going to be table stakes in the wireless provider game?&nbsp; I think it is and while Meru's RF barrier is a nice story, they are going to need to have some sort of IDS/IPS in their product line to keep up.</p>

<fieldset class="zemanta-related"><legend class="zemanta-related-title">Related articles by Zemanta</legend><ul class="zemanta-article-ul"><li class="zemanta-article-ul-li"><a href="http://www.itweek.co.uk/itweek/news/2222765/motorola-acquire-airdefense">Motorola to acquire AirDefense</a></li>

<li class="zemanta-article-ul-li"><a href="http://www.itweek.co.uk/itweek/news/2222643/meru-locks-car-park-hackers">Meru locks out car park hackers</a></li></ul></fieldset> <div class="zemanta-pixie" style="MARGIN-TOP: 10px; HEIGHT: 15px"><a class="zemanta-pixie-a" title="Zemified by Zemanta" href="http://reblog.zemanta.com/zemified/06efb3dd-b510-48f6-9ae4-02c84dfa1733/"><img class="zemanta-pixie-img" alt="Zemanta Pixie" src="http://img.zemanta.com/reblog_e.png?x-id=06efb3dd-b510-48f6-9ae4-02c84dfa1733" style="BORDER-RIGHT: medium none; BORDER-TOP: medium none; FLOAT: right; BORDER-LEFT: medium none; BORDER-BOTTOM: medium none" /></a></div></div>

<p><a href="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?a=SgUnLX"><img src="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?i=SgUnLX" border="0"></img></a></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=wTWkpJ"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=wTWkpJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=lUKurJ"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=lUKurJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=dT8cBJ"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=dT8cBJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=FZVwRJ"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=FZVwRJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=D6AdHj"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=D6AdHj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=ZLCydj"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=ZLCydj" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~4/350429290" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 30 Jul 2008 03:05:48 +0000</pubDate>
      <category domain="http://securityratty.com/tag/meru">meru</category>
      <category domain="http://securityratty.com/tag/meru networks">meru networks</category>
      <category domain="http://securityratty.com/tag/cone">cone</category>
      <category domain="http://securityratty.com/tag/silence">silence</category>
      <category domain="http://securityratty.com/tag/meru locks">meru locks</category>
      <category domain="http://securityratty.com/tag/wireless cone">wireless cone</category>
      <category domain="http://securityratty.com/tag/product line">product line</category>
      <category domain="http://securityratty.com/tag/hide legit traffic">hide legit traffic</category>
      <category domain="http://securityratty.com/tag/wireless provider game">wireless provider game</category>
      <source url="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~3/350429290/meru-networks-e.html">Meru Networks erects a "cone of silence"</source>
    </item>
    <item>
      <title><![CDATA[Anti-Terrorism Stupidity at Yankee Stadium]]></title>
      <link>http://securityratty.com/article/dfb361bbe6338d8abaf924431ba80dfb</link>
      <guid>http://securityratty.com/article/dfb361bbe6338d8abaf924431ba80dfb</guid>
      <description><![CDATA[They's at Yankee Stadium: The team contends that sunscreen has long been on the list of stadium contraband, but there is no mention of it on the Yankee Web site
Four weeks ago, Stadium officials...]]></description>
      <content:encoded><![CDATA[<p>They's <a href="http://www.nypost.com/seven/07222008/news/regionalnews/sunblockheads__at_the_stadium_120930.htm"confiscating sunscreen</a> at Yankee Stadium:</p>

<blockquote>The team contends that sunscreen has long been on the list of stadium contraband, but there is no mention of it on the Yankee Web site. 

<p>Four weeks ago, Stadium officials decided that sunscreen of all sizes and varieties would not be permitted, a security supervisor told The Post before last night's game. </p>

<p>"There have been a lot of complaints," he said. "We tell them to apply once and then throw it out." </p>

<p>For fans who bring babies or young children to cheer on the home team, the guard had suggested they "beg" to take the sunblock in. </p>

<p>Seeing the giant bag full of confiscated sunscreen Saturday, one steaming Yankee fan asked whether he could take one of the tubes and apply it before heading into the park. </p>

<p>"Absolutely not," the guard told him. "What if you get a rash? You might sue the Yankees."</blockquote></p>

<p>Next, I suppose, is <a href="http://www.schneier.com/blog/archives/2008/06/liquid_ban_gone.html">confiscating liquids at pools</a>.  </p>

<p>We've collectively lost our minds.</p>

<p>This story has a happy ending, though.  A day after <i>The New York Post</i> published this story, Yankee Stadium <a href="http://www.salon.com/sports/daily/?last_story=/sports/daily/feature/2008/07/23/sunblock/">reversed</a> its ban.  Now, if only the Post had that same affect on airport security.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=EgeecJ"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=EgeecJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=TjuhOJ"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=TjuhOJ" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Thu, 24 Jul 2008 02:50:24 +0000</pubDate>
      <category domain="http://securityratty.com/tag/yankee stadium">yankee stadium</category>
      <category domain="http://securityratty.com/tag/post">post</category>
      <category domain="http://securityratty.com/tag/york post">york post</category>
      <category domain="http://securityratty.com/tag/yankee web site">yankee web site</category>
      <category domain="http://securityratty.com/tag/giant bag">giant bag</category>
      <category domain="http://securityratty.com/tag/yankee fan">yankee fan</category>
      <category domain="http://securityratty.com/tag/collectively lost">collectively lost</category>
      <category domain="http://securityratty.com/tag/guard">guard</category>
      <category domain="http://securityratty.com/tag/airport security">airport security</category>
      <source url="http://www.schneier.com/blog/archives/2008/07/antiterrorism_s.html">Anti-Terrorism Stupidity at Yankee Stadium</source>
    </item>
    <item>
      <title><![CDATA[Lazy Summer Days at UkrTeleGroup Ltd]]></title>
      <link>http://securityratty.com/article/6215851b79c397250e5f1b5a07d047b4</link>
      <guid>http://securityratty.com/article/6215851b79c397250e5f1b5a07d047b4</guid>
      <description><![CDATA[The result of building extra confidence into your malicious hosting provider's ability to remain online , is a scammy ecosystem that's constantly jumping from one netblock to another, whose very...]]></description>
      <content:encoded><![CDATA[<a href="http://bp0.blogger.com/_wICHhTiQmrA/SIXAHtEXmGI/AAAAAAAAB8c/T7J6WUyV9a4/s1600-h/avxp08.png" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp0.blogger.com/_wICHhTiQmrA/SIXAHtEXmGI/AAAAAAAAB8c/qDKYv6DcETA/s200-R/avxp08.png" style="border: 0pt none ;" /></a>The result of building extra confidence into your <a href="http://ddanchev.blogspot.com/2008/06/malicious-isps-you-rarely-see-in-any.html">malicious hosting provider's ability to remain online</a>, is a scammy ecosystem that's constantly jumping from one netblock to another, whose very latest exploit URLs and rogue security software nexto to the codecs served, always represent a decent sample of malicious activities to analyze.<br />
<br />
<a href="http://ddanchev.blogspot.com/2008/02/geolocating-malicious-isps.html">UkrTeleGroup Ltd</a> (<i>85.255.112.0-85.255.127.255 UkrTeleGroup UkrTeleGroup Ltd. 27595 ASN ATRIVO</i>), a personal favorite due to its historical connection with the Russian Business Network, and hosting provider for a countless of number of injected and malware embedded campaigns during the last two years, is still keeping it as lazy as possible, a laziness allowing you to easily expose a great deal of the malicious activities going on there, and establish the connections between the hosting provider, its current and historical customers.<br />
<br />
<a href="http://bp0.blogger.com/_wICHhTiQmrA/SIXJBRIoucI/AAAAAAAAB8k/r9Y6CPtAE0Y/s1600-h/rogue_software_codecs_UkrTeleGroup.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp0.blogger.com/_wICHhTiQmrA/SIXJBRIoucI/AAAAAAAAB8k/cHCoWY8V1RY/s200-R/rogue_software_codecs_UkrTeleGroup.JPG" style="border: 0pt none ;" /></a>Take <b>microsoftcodecs.com</b> (88.214.198.220) for instance, and <b>avxp08.com</b> where it redirects the user into yet another rogue security software. <b>avxp08.com</b> is responding to 194.110.162.114; 216.195.41.11; 216.195.41.11; 216.240.139.169, and to UkrTeleGroup Ltd's 85.255.117.163.<br />
<br />
Each of these IPs are also being shared by other rogue software and fake codecs simultaneously :<br />
<br />
(216.195.41.11)<br />
<b>antivirusxp2008 .com<br />
malwareprotector2008 .com<br />
antivirxp08 .com<br />
antivirusxp08 .com<br />
avxp08 .com<br />
youpornztube .com<br />
winifixer .com<br />
advancedxpfixer .com<br />
encountertracker .ws</b><br />
<br />
It gets even more UkrTeleGroup Ltd related upon the malware (Trojan:Win32/Tibs.HK) served at the <b>avxp08.com </b>gets sandboxed. The malware phones back home <b>stat.avxp08 .com </b>(85.255.118.172)<b> </b>announcing the successful infection <b>winifixer .com/log2.php?affid=980382bdb4e7b779ff6308b0b706571c&amp;uid=06f80eaf-94d7-4b8b-9cf0-5c6f75d2c69f&amp;tm=1211198022</b> (85.255.118.171), and the scammy ecosystem continues using the same hosting provider. The rest of the rogue tools are also using the same subdomain structure, and IP, <b>stat.antivirusxp2008 .com</b> (85.255.118.172), <b>stat.antivirxp08 .com</b> (85.255.118.172), <b>stat.antivirusxp08 .com</b> (85.255.118.172) in order to phone back home.<br />
<br />
<div class="separator" style="text-align: left; clear: both;"><a href="http://bp3.blogger.com/_wICHhTiQmrA/SIXMeEAQTmI/AAAAAAAAB8s/bax-CAw9xJ8/s1600-h/fake_windows_media_player.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp3.blogger.com/_wICHhTiQmrA/SIXMeEAQTmI/AAAAAAAAB8s/_hv8u7SKjP8/s200-R/fake_windows_media_player.JPG" style="border: 0pt none ;" /></a></div><b>winifixer .com</b>, a well known rogue software, is entirely relying on UkrTeleGroup's hosting services hosted at 85.255.117.163; 85.255.118.171; 85.255.120.115; 85.255.120.139; 216.195.41.11 pinpoing several other obvious and well known netblocks hosting anything starting from fake celebrity video sites serving fake Windows Media Player videos, to rogue security software and live exploit URLs. Take for instance their efficiency centered approach to park numerous malicious domains on a single IP, like 85.255.117.218 in this case :<br />
<br />
<b>bestfunnyvids .com<br />
celebs69 .com<br />
celebsnofake .com<br />
celebstape .com<br />
celebsvidsonline .com<br />
codecservice1 .com<br />
freevidshardcore .com<br />
newfunnyvideo .com<br />
sexlookupworld .com<br />
starfeed1 .com<br />
starfeed2 .com<br />
topdirectdownload .com&nbsp;&nbsp;&nbsp; <br />
topsearchresults1 .com<br />
topsoftupdate .com<br />
yourfavoritetube .com</b><br />
<br />
Now that it's becoming clear who's providing the hosting infrastructure, it's perhaps also worth pointing out who's using the hosting infrastructure to serve rogue security software and fake codecs on the basis of participating in an affiliate program? A great number of domains used by the rogue security software are registered by <b>krab@thekrab.com</b> behind which is supposidely Mishakov Viktor Ivanovich <b>support@tobesoftware.com</b>, and ironically <b>tobesoftware.com</b> is again hosting within UkrTeleGroup (85.255.120.115). The personal efforts into the number of the typosquatted domains and the persistence applied when registered and spamming them across the web, is the result of the incentives provided to them by the affiliate program they participate in.<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=CNeYgJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=CNeYgJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=UZqVKJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=UZqVKJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=FhKPZj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=FhKPZj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=6DFhuj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=6DFhuj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=pxNm7J"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=pxNm7J" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=cYGFFJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=cYGFFJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=S2jU9j"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=S2jU9j" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/342489167" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 22 Jul 2008 03:12:02 +0000</pubDate>
      <category domain="http://securityratty.com/tag/ukrtelegroup">ukrtelegroup</category>
      <category domain="http://securityratty.com/tag/codecs">codecs</category>
      <category domain="http://securityratty.com/tag/fake codecs simultaneously">fake codecs simultaneously</category>
      <category domain="http://securityratty.com/tag/rogue security software">rogue security software</category>
      <category domain="http://securityratty.com/tag/ukrtelegroup ukrtelegroup">ukrtelegroup ukrtelegroup</category>
      <category domain="http://securityratty.com/tag/fake codecs">fake codecs</category>
      <category domain="http://securityratty.com/tag/home">home</category>
      <category domain="http://securityratty.com/tag/home stat">home stat</category>
      <category domain="http://securityratty.com/tag/scammy ecosystem">scammy ecosystem</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/342489167/lazy-summer-days-at-ukrtelegroup-ltds.html">Lazy Summer Days at UkrTeleGroup Ltd</source>
    </item>
    <item>
      <title><![CDATA[Mailing error at the University of Maryland exposes student information]]></title>
      <link>http://securityratty.com/article/a51262d40f98a67474833c65ff29621e</link>
      <guid>http://securityratty.com/article/a51262d40f98a67474833c65ff29621e</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
7/17/08

Organization
University of Maryland

Contractor/Consultant/Branch
Department of Transportation Services

Victims
All students registered for...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/umd.jpg" width="88" align="right" height="83"><font size="2"><b>Date Reported: </b><br>7/17/08<br><br><b>Organization: </b><br><a href="http://www.umd.edu/">University of Maryland</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://www.transportation.umd.edu/index.html">Department of Transportation Services</a> <br><br><span style="font-weight: bold;">Victims:</span><br>All students registered for Fall 2008 classes<br><br><span style="font-weight: bold;">Number Affected:</span><br>23,727<br><br><span style="font-weight: bold;">Types of Data:</span><br>Names, addresses, and Social Security numbers<br><br><span style="font-weight: bold;">Breach Description:</span><br>On July 1st, 2008, the University of Maryland Department of Transportation Services mailed an </font><font size="2">on-campus parking </font><font size="2">brochure to all students </font><font size="2">registered for Fall 2008 classes</font><font size="2"> as of June 15, 2008.&nbsp; Recipient Social Security numbers were inadvertently exposed on the mailing labels.<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.transportation.umd.edu/parkingmailer/">University of Maryland</a> <br><a href="http://www.wjla.com/news/stories/0708/536794.html">ABC Channel 7 News</a> <br><a href="http://www.wtop.com/?sid=1442585&amp;nid=25">WTOP FM 103.5 News</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>University of Maryland<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>On July 1st, 2008, the University of Maryland’s Department of Transportation Services sent all students registered at the time, by U.S. mail, a brochure with on-campus parking information.<br><br>On July 8, 2008, the University discovered that the labels on that mailing included the addressees’ Social Security numbers.<br><span style="font-style: italic;">[Evan] Sheesh, a fraudster doesn't even have to tamper with the mail if the Social Security number is on the label.</span><br><br>The error was discovered on the morning of July 8 when calls were made to the University.<br><br>This parking mailer was sent to all individuals registered for Fall 2008 classes at the University of Maryland as of June 15, 2008.<br><br>The mailing list numbered 23,727 individuals.<br><br>In our annual effort to provide parking and transportation information to the University community, the names and addresses of all registered students was requested internally at the Department of Transportation Services for the purpose of creating mailing labels for a brochure.<br><br>This information was generated by a computer query and included names, addresses and what was believed to be University identification numbers (UIDs).<br><span style="font-style: italic;">[Evan] When writing and executing database queries, isn't it a good idea to check the results and see if the information displayed is the information you were looking for?&nbsp; I wonder if UIDs are also nine digits long like Social Security numbers are.</span><br><br>Our normal process is to remove the University ID numbers prior to mailing.<br><span style="font-style: italic;">[Evan] Is it safe to assume that "normal process" was not followed in this instance?&nbsp; If so, then why not?&nbsp; There is no mention in the school's response.</span><br><br>It was not apparent to departmental staff that these numbers not only still existed within the file, but were Social Security numbers, and not University ID numbers.<br><span style="font-style: italic;">[Evan] Not apparent?&nbsp; They were on the labels!</span><br><br>The numbers were not identified as Social Security numbers and did not show the normal spacing between digits.<br><span style="font-style: italic;">[Evan] So it would be xxxxxxxxx instead of xxx-xx-xxxx.&nbsp; What percentage of people would recognize the first set of nine digits as a SSN?</span><br><br>This mailer was sent using third class, bulk mail delivery and may not have been delivered to you yet.<br><br>Currently, there is no evidence that anyone's Social Security number has been misused.<br><br>The University apologizes and deeply regrets this unfortunate mistake.<br><br>We are initiating immediate action to ensure that this error does not recur.<br><span style="font-style: italic;">[Evan] Like what?&nbsp; Maybe train people to review their query results and follow "normal process"?</span><br><br>The University of Maryland values the critical importance of your personal information.<br><br>We strongly recommend that you take appropriate precautions to mask, black out or destroy this document after use.<br><br>In unfortunate situations like this, it is possible that dishonest people may contact you asking for personal information in the guise of offering assistance from the University.<br><span style="font-style: italic;">[Evan] Equally unfortunate is the fact that there are a lot of dishonest people.</span><br><br>Please note that the University WILL NOT contact you by phone, e-mail or in any other way requesting personal information regarding this incident.<br><br>Please do not release any personal information in response to contacts claiming to be from the University.<br><br>In response to this incident, the University, and specifically the Department of Transportation Services, has moved to severely restrict access to sensitive student and faculty/staff information; we believe the fewer individuals who have access to this data will only increase our ability to protect sensitive information.<br><br>If individuals feel that they would like to take extra steps beyond the fraud alert, the University has arranged with Equifax to make available, at no cost to them, a 12-month service that includes credit monitoring, customer care, fraud expense reimbursement insurance and access to their credit report.<br><br>If you have not received this mailer and are unsure if you are included in the affected group, please call toll-free 1(877) 935-2428, Monday - Friday, 8:30 a.m. - 5 p.m. EST.<br><br><span style="font-weight: bold;">You may contact us in one of the following ways:</span><br>By telephone: Toll-free 1(877) 935-2428, Monday-Friday, 8:30 a.m. - 5 p.m. EST<br>Via e-mail: parkingmailer@umd.edu<br>Mailing address: Regents Drive Garage, Building #202, College Park, MD 20742<br><br><span style="font-weight: bold;">Commentary:</span><br>The lack of attention to detail coupled with lack of control leads to an increase of risk of confidential information disclosure.&nbsp; Not all that uncommon. <br><br><b>Past Breaches:</b><br>Unknown<br></font><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/07/18/umd.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Fri, 18 Jul 2008 05:18:07 +0000</pubDate>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/university">university</category>
      <category domain="http://securityratty.com/tag/maryland">maryland</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/university identification">university identification</category>
      <category domain="http://securityratty.com/tag/university community">university community</category>
      <category domain="http://securityratty.com/tag/social security">social security</category>
      <category domain="http://securityratty.com/tag/addressees social security">addressees social security</category>
      <category domain="http://securityratty.com/tag/recipient social security">recipient social security</category>
      <source url="http://breachblog.com/2008/07/18/umd.aspx">Mailing error at the University of Maryland exposes student information</source>
    </item>
  </channel>
</rss>
