<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: placement]]></title>
    <link>http://securityratty.com/tag/placement</link>
    <description></description>
    <pubDate>Thu, 27 Dec 2007 21:18:42 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Copycat Web Malware Exploitation Kit Comes with Disclaimer]]></title>
      <link>http://securityratty.com/article/f53d9a8c84706cb980c1a5fe00e3e2f8</link>
      <guid>http://securityratty.com/article/f53d9a8c84706cb980c1a5fe00e3e2f8</guid>
      <description><![CDATA[Such disclaimers make you wonder what's the point of including a notice forwarding the responsibility for the upcoming cybercrime activities to the buyer, when the seller himself is offering daily...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://1.bp.blogspot.com/_wICHhTiQmrA/SOPmoVr-3KI/AAAAAAAACNQ/L7Fxlk4j_Gg/s1600-h/1.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://1.bp.blogspot.com/_wICHhTiQmrA/SOPmoVr-3KI/AAAAAAAACNQ/IZ-phgyZJpY/s200-R/1.JPG" /></a>Such disclaimers make you wonder what's the point of including a notice forwarding the responsibility for the upcoming cybercrime activities to the buyer, when the seller himself is offering daily updates with undetected bots, and is promising to include new exploits within the kit.<br />
<br />
For the time being, this recently released copycat web exploitation malware kit, includes two PDF exploits, IE snapshot, and naturally MDAC, with a DIY builder for the binary. Here's the disclaimer, greatly reminding us of <a href="http://www.theregister.co.uk/2008/04/28/malware_copyright_notice/">Zeus's copyright notice</a> : <br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://1.bp.blogspot.com/_wICHhTiQmrA/SOQEl4WjyJI/AAAAAAAACNw/bup8hAFSOIA/s1600-h/3.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://1.bp.blogspot.com/_wICHhTiQmrA/SOQEl4WjyJI/AAAAAAAACNw/J0Uxe3C2IPI/s200-R/3.JPG" /></a>"<i>Purchasing this product, you hold the full responsibility for its usage and for consequences which may have been caused by incorrect usage or the usage with some evil intent or violation of the usage rules. The author excludes the placement of the scripts somewhere on the Internet, you can only place them on localhost, virtual machine or on a test botnet (minibotnet). WARNING! The usage of this product with evil intent leads to the criminal responsibility!</i>"<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://3.bp.blogspot.com/_wICHhTiQmrA/SOQE_GioZeI/AAAAAAAACN4/-TgImabe7zw/s1600-h/5.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://3.bp.blogspot.com/_wICHhTiQmrA/SOQE_GioZeI/AAAAAAAACN4/TC5-5hqbJ0I/s200-R/5.JPG" /></a>What happens when the buyer tries to resell the kit? - "<i>If you try to resell, decode, remove the boundaries, you will lose all the  support, updates and guarantees.</i>" which is surreal considering that the kit is open source one, and just like we've seen with a recent modification of Zeus if it were to include unique features -- which it doesn't -- others would build upon its foundations.<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://2.bp.blogspot.com/_wICHhTiQmrA/SOQFHcVCuhI/AAAAAAAACOA/gyW259ojaII/s1600-h/7.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://2.bp.blogspot.com/_wICHhTiQmrA/SOQFHcVCuhI/AAAAAAAACOA/XvJB5TF7UCE/s200-R/7.JPG" /></a><br />
Going through the exploitation statistics of a sample campaign, you can clearly see that out of the 859 unique visits 250 got exploited with outdated and already patched vulnerabilities. Therefore, diversifying the exploits set would have increased the number of exploited hosts.<br />
<br />
<a href="http://1.bp.blogspot.com/_wICHhTiQmrA/SOQFq13TnPI/AAAAAAAACOI/Ubkw74c4Wn0/s1600-h/9.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://1.bp.blogspot.com/_wICHhTiQmrA/SOQFq13TnPI/AAAAAAAACOI/nvO4FBQ3s3k/s200-R/9.JPG" /></a>With IE6 visitors exploited at 46% as a whole, it would be hard not to notice that just like Stormy Wormy's historical persistence of using outdated vulnerabilities, a great majority of today's botnets have been aggregated using old exploits.<br />
<br />
Trying to enforce the intellectual property of a malware kit means you're claiming ownership, and therefore the disclaimer becomes irrelevant.<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=7NZmM"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=7NZmM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=DOidM"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=DOidM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=7V8tm"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=7V8tm" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=wAlLm"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=wAlLm" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=6EqeM"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=6EqeM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=ZZ3BM"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=ZZ3BM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=0wv6m"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=0wv6m" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/409055131" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 01 Oct 2008 22:58:01 +0000</pubDate>
      <category domain="http://securityratty.com/tag/kit">kit</category>
      <category domain="http://securityratty.com/tag/usage rules">usage rules</category>
      <category domain="http://securityratty.com/tag/usage">usage</category>
      <category domain="http://securityratty.com/tag/exploits">exploits</category>
      <category domain="http://securityratty.com/tag/pdf exploits">pdf exploits</category>
      <category domain="http://securityratty.com/tag/incorrect usage">incorrect usage</category>
      <category domain="http://securityratty.com/tag/evil intent">evil intent</category>
      <category domain="http://securityratty.com/tag/evil intent leads">evil intent leads</category>
      <category domain="http://securityratty.com/tag/malware kit">malware kit</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/409055131/copycat-web-malware-exploitation-kit.html">Copycat Web Malware Exploitation Kit Comes with Disclaimer</source>
    </item>
    <item>
      <title><![CDATA[A Costly Crush]]></title>
      <link>http://securityratty.com/article/cafa2263c602a0dce807786d68e28098</link>
      <guid>http://securityratty.com/article/cafa2263c602a0dce807786d68e28098</guid>
      <description><![CDATA[I've seen a few blog posts over the last couple of days, with people complaining about an application on Facebook charging them crazy amounts of money. Certainly, there's a lot of angry Facebook users...]]></description>
      <content:encoded><![CDATA[
        I've seen a few <a href="http://www.sokhodom.com/2008-09-02-bad-facebook-application-lead-to-heavy-phone-bill/">blog posts</a> over the last couple of days, with people complaining about an application on Facebook charging them crazy amounts of money. Certainly, there's a lot of angry Facebook users out there:<br /><br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/crushtracker01.html" onclick="window.open('http://blog.spywareguide.com/images/crushtracker01.html','popup','width=387,height=448,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/crushtracker0-thumb-287x332.gif" alt="crushtracker0.gif" class="mt-image-none" style="" height="332" width="287" /></a></span>
<br />Click to Enlarge<br /></div><br />Some more complaints? Sure, I can do that:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="hugecrush1.gif" src="http://blog.spywareguide.com/images/hugecrush1.gif" class="mt-image-none" style="" height="347" width="309" /></span></div><br /><br /><div align="left">There are many, many more like the above comments out there. One slight problem with all of this is that the complaints are scattered across a whole range of different Crush application forums - in short, they're <i>all</i> being blamed, but they can't <i>all</i> be doing this, can they? What's the alternative, though?<br /><br />A short while ago, I wrote about <a href="http://blog.spywareguide.com/2008/07/interesting-advert-placements.html">deceptive advert placements</a> with regards another facebook application. It seems we have a similar situation here, where an "enterprising" Ad network is placing Facebook-style buttons onto installer pages and hoping people will be fooled. As it turns out, it seems to be working. While attempting to install one randomly selected Crush application, I noticed the following advert at the top of the installer splash (highlighted in red):<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/hugecrush3.html" onclick="window.open('http://blog.spywareguide.com/images/hugecrush3.html','popup','width=660,height=320,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/hugecrush3-thumb-360x174.gif" alt="hugecrush3.gif" class="mt-image-none" style="" height="174" width="360" /></a></span><br />Click to Enlarge<br /></div><br />It's easy to imagine a regular Facebook user thinking this is part of the application install and clicking "Ok". Do that, and you're taken to a site called Amazingchat(dot)net that throws up a fake message regarding you having "7 New Crush Messages" (and uses geolocational technology to point a targeted message your way). If you look like you're in the UK, you'll see this:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/hugecrush41.html" onclick="window.open('http://blog.spywareguide.com/images/hugecrush41.html','popup','width=662,height=404,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/hugecrush4-thumb-362x220.gif" alt="hugecrush4.gif" class="mt-image-none" style="" height="220" width="362" /></a></span><br />Click to Enlarge<br /></div><br />Wow, FOUR of my (fake and non-existent) messages are from Sheffield! How about if I look like I'm in the States? You've guessed it....<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="hugecrush5.gif" src="http://blog.spywareguide.com/images/hugecrush5.gif" class="mt-image-none" style="" height="42" width="318" /></span></div>
<br /><br />Windy City, here I come!<br /><br />Not. It's looking promising so far, though. If we can just go to the next screen and see something utterly useless advertised in exchange for lots of money....<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/hugecrush666.html" onclick="window.open('http://blog.spywareguide.com/images/hugecrush666.html','popup','width=552,height=371,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/hugecrush666-thumb-352x236.gif" alt="hugecrush666.gif" class="mt-image-none" style="" height="236" width="352" /></a></span><br />Click to Enlarge<br /></div><br />Horoscopes for only ?9 / $15 a week? WOW!<br /><br />Also, there go your savings.<br /><br />Could this be the site at the heart of so many complaints? Well, let's quickly check who runs it...<br /><br /><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="hugecrush7.gif" src="http://blog.spywareguide.com/images/hugecrush7.gif" class="mt-image-none" style="" height="140" width="587" /></span><br /><br />"Sms-helpdesk", eh? I do believe I've seen a <a href="http://www.facebook.com/topic.php?uid=4874299673&amp;topic=3908">long thread</a> concerning people having issues with large bills for phone messages. Indeed, a rep from sms-helpdesk actually appears to be posting there:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="hugecrush8.gif" src="http://blog.spywareguide.com/images/hugecrush8.gif" class="mt-image-none" style="" height="479" width="370" /></span></div><br /><br />Shame it seems some people can't even get through to the supposed helpline. Perhaps "Denise" would be better off tackling the deceptive placement of adverts made to look like installer buttons, not to mention non-existent crush messages based around geolocational targeting?<br /><br />Just a thought...<br /></div>
        
    ]]></content:encoded>
      <pubDate>Tue, 02 Sep 2008 11:24:54 +0000</pubDate>
      <category domain="http://securityratty.com/tag/application">application</category>
      <category domain="http://securityratty.com/tag/facebook application">facebook application</category>
      <category domain="http://securityratty.com/tag/crush application">crush application</category>
      <category domain="http://securityratty.com/tag/facebook">facebook</category>
      <category domain="http://securityratty.com/tag/application install">application install</category>
      <category domain="http://securityratty.com/tag/regular facebook user">regular facebook user</category>
      <category domain="http://securityratty.com/tag/crush application forums">crush application forums</category>
      <category domain="http://securityratty.com/tag/angry facebook users">angry facebook users</category>
      <category domain="http://securityratty.com/tag/crush messages">crush messages</category>
      <source url="http://blog.spywareguide.com/2008/09/a-costly-crush.html">A Costly Crush</source>
    </item>
    <item>
      <title><![CDATA[Strange Digg.com Spamming]]></title>
      <link>http://securityratty.com/article/7756a909ad9e37edfadb259e480b7179</link>
      <guid>http://securityratty.com/article/7756a909ad9e37edfadb259e480b7179</guid>
      <description><![CDATA[I saw this in the security section earlier today






Click to Enlarge

Each one links to a page on a website called Tubeteases(dot)com, and each page streams a Youtube video - usually females...]]></description>
      <content:encoded><![CDATA[
        I saw this in the security section earlier today:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/diggspam1.html" onclick="window.open('http://blog.spywareguide.com/images/diggspam1.html','popup','width=699,height=579,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/diggspam1-thumb-399x330.jpg" alt="diggspam1.jpg" class="mt-image-none" style="" height="330" width="399" /></a></span><br /> </div><div><div align="center"><br />Click to Enlarge<br /></div><br />Each one links to a page on a website called Tubeteases(dot)com, and each page streams a Youtube video - usually females bouncing around in various states of undress.<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/diggspam2.html" onclick="window.open('http://blog.spywareguide.com/images/diggspam2.html','popup','width=715,height=612,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/diggspam2-thumb-315x269.jpg" alt="diggspam2.jpg" class="mt-image-none" style="" height="269" width="315" /></a></span><br /></div></div><div><div align="center"><br />Click to Enlarge<br /></div><br />Usually with spam like this, there's a financial incentive - however, I'm having a hard time working out what the motive is here. There are no clickable ads to make money from on the site - it's just page after page of miniaturised Youtube clips.<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/diggspam3.html" onclick="window.open('http://blog.spywareguide.com/images/diggspam3.html','popup','width=771,height=610,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/diggspam3-thumb-371x293.jpg" alt="diggspam3.jpg" class="mt-image-none" style="" height="293" width="371" /></a></span><br /></div></div><div><div align="center"><br />Click to Enlarge<br /></div><br />No popups, no flashing banners, no mousetraps.....nothing.<br /><br />I thought I'd worked it out when I scrolled down the page and saw a large advert for a webcam site. Aha! Obviously the gimmick is luring you to the above video site then get you to pay up for webcam access, right?<br /><br />Well, not exactly...<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/diggspam4.html" onclick="window.open('http://blog.spywareguide.com/images/diggspam4.html','popup','width=615,height=422,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/diggspam4-thumb-315x216.jpg" alt="diggspam4.jpg" class="mt-image-none" style="" height="216" width="315" /></a></span><br /></div></div><div><div align="center"><br />Click to Enlarge<br /></div><br />...."Free"? Oh dear, this isn't going well. They don't even have the advert for the webcam site at the top of the page, it's stuffed down at the bottom somewhere so I can't even claim "in-your-face" advertising.<br /><br />At the very bottom, I saw a set of weblinks to other sites - surely this is the gimmick then? Entice potential webmasters to pay up for links placed on-site? Well, as it turns out, no. Clicking the "free slots available" link simply takes you to a page offering a free link placement script.<br /><br />Normally spam = profit. Here though, I can't see that this follows the usual pattern. Perhaps someone woke up feeling philanthropic and randomly decided the best course of action for Digg.com users was watching hundreds of postage-stamp sized clips of semi-naked females.<br /><br />We can tell them off for spamming Digg though, so we've got them there...<br /></div>
        
    ]]></content:encoded>
      <pubDate>Wed, 06 Aug 2008 03:51:10 +0000</pubDate>
      <category domain="http://securityratty.com/tag/page">page</category>
      <category domain="http://securityratty.com/tag/page streams">page streams</category>
      <category domain="http://securityratty.com/tag/video site">video site</category>
      <category domain="http://securityratty.com/tag/site">site</category>
      <category domain="http://securityratty.com/tag/on-site">on-site</category>
      <category domain="http://securityratty.com/tag/webcam site">webcam site</category>
      <category domain="http://securityratty.com/tag/digg">digg</category>
      <category domain="http://securityratty.com/tag/enlarge">enlarge</category>
      <category domain="http://securityratty.com/tag/click">click</category>
      <source url="http://blog.spywareguide.com/2008/08/strange-diggcom-spamming.html">Strange Digg.com Spamming</source>
    </item>
    <item>
      <title><![CDATA[Long Island Proposal Snags Again, on Poles]]></title>
      <link>http://securityratty.com/article/479733758aebc5a0eefa89ed8a473de2</link>
      <guid>http://securityratty.com/article/479733758aebc5a0eefa89ed8a473de2</guid>
      <description><![CDATA[Long Island proposal still mired: The plan to put Wi-Fi up across two Long Island counties has seemed doomed to me from the start. The company that won the bid was untested, and its other...]]></description>
      <content:encoded><![CDATA[<p><img src="http://wifinetnews.com/images/muni_icon.jpg" align="right" border="0" hspace="5" /><a href="http://www.newsday.com/news/local/ny-liwifi0728,0,7393890.story?track=rss"><strong>Long Island proposal still mired:</strong></a> The plan to put Wi-Fi up across two Long Island counties has seemed doomed to me from the start. The company that won the bid was untested, and its other in-deployment or in-proposal networks are off the table. Expertise aside, it needs tens of millions to build such a network, and financing for company-funded metro-scale projects is not available. The counties involved have pledged no purchases of services. And, perhaps the final stroke, the local utility says that E-Path doesn't meet the test of being a telecom and paying less than $10 per year for pole placement, but instead must pay the all-comer rate of $50 per year.</p>

<p>This is a critical distinction. Telecoms are covered under the Telecom Act of 1996 that requires non-discriminatory access to utility poles to avoid incumbent local exchange carriers (ILECs) and utilities from being gatekeepers that prevent competitive service from emerging. There are a series of tests in the law and local qualifications, too, that allow a firm to be a registered telecom. An FCC decision last year ruled that companies that mix telecom and unregulated information services on the same wires aren't disqualified from getting the Telecom Act deal, however. </p>

<p>But E-Path seems to meet none of the criteria except their desire to pay $10 instead of $50 per year per pole. Utility poles have held up many other municipal networks. We're not hearing more about them these days because such networks are now being built on a smaller scale for different purposes, where the number of nodes and their placement is rather different than networks built with the intent of providing indoor coverage.</p>

<p>Cablevision, by the way, qualifies as a telecom, this article states, which helps them in placing nodes for their planned $300m network across their coverage territory. They can also mount nodes in-line with their cable lines, using power from their cable plant on the lines already.</p>

<p>E-Path appears to have a variety of communication problems as well. The article notes, "Tortoretti said his Washington, D.C., attorneys disagree with LIPA's interpretation. But the attorney Tortoretti said represents E-Path, Charles Rohe, said he couldn't speak about the company or the dispute."</p>

<p>Later, E-Path's "chief executive said he hopes the county will help with his LIPA dispute." But an aide to the Suffolk County executive said, "That's not really our issue. That's out of our control."</p>

<p>Correspondent Craig Plunkett, quoted near the end, points out that if the counties were to change their minds and want to buy services on the network, the proposal would have to be rebid (appears as the sound-alike "rebuild" by accident in the online article at this moment).</p>]]></content:encoded>
      <pubDate>Mon, 28 Jul 2008 07:07:26 +0000</pubDate>
      <category domain="http://securityratty.com/tag/telecom act">telecom act</category>
      <category domain="http://securityratty.com/tag/telecom act deal">telecom act deal</category>
      <category domain="http://securityratty.com/tag/telecom">telecom</category>
      <category domain="http://securityratty.com/tag/proposal">proposal</category>
      <category domain="http://securityratty.com/tag/island proposal">island proposal</category>
      <category domain="http://securityratty.com/tag/e-path">e-path</category>
      <category domain="http://securityratty.com/tag/networks">networks</category>
      <category domain="http://securityratty.com/tag/represents e-path">represents e-path</category>
      <category domain="http://securityratty.com/tag/municipal networks">municipal networks</category>
      <source url="http://wifinetnews.com/archives/008403.html">Long Island Proposal Snags Again, on Poles</source>
    </item>
    <item>
      <title><![CDATA["Interesting" Advert Placements On Facebook]]></title>
      <link>http://securityratty.com/article/4f9bc22c08b786a8bf666570e4748df3</link>
      <guid>http://securityratty.com/article/4f9bc22c08b786a8bf666570e4748df3</guid>
      <description><![CDATA[I've had a few people mention &quot;odd things&quot; happening when trying to install an application on Facebook called &quot;Gridview&quot;. Well, I decided to try it out. On the install screen, you see this




Makes...]]></description>
      <content:encoded><![CDATA[
        I've had a few people mention "odd things" happening when trying to install an application on Facebook called "Gridview". Well, I decided to try it out. On the install screen, you see this:<br /><br /><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="gview7.jpg" src="http://blog.spywareguide.com/images/gview7.jpg" class="mt-image-none" style="" height="103" width="461" /></span><br /> <div><br />Makes sense so far. Here's the install screen where you agree to let the application loose on your profile:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/gview8.html" onclick="window.open('http://blog.spywareguide.com/images/gview8.html','popup','width=397,height=411,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/gview8-thumb-300x310.jpg" alt="gview8.jpg" class="mt-image-none" style="" height="310" width="300" /></a></span><br /><br />Click to Enlarge<br /></div><br />Once done, you see the following screen and this is where it all starts to go a bit wrong:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/gview6.html" onclick="window.open('http://blog.spywareguide.com/images/gview6.html','popup','width=906,height=581,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/gview6-thumb-306x196.gif" alt="gview6.gif" class="mt-image-none" style="" height="196" width="306" /></a></span><br /><br />Click to Enlarge<br /></div><br />Note that the application is ALREADY installed by this point, because the Gridview icon is on your list of current applications (highlighted by the red box on the left).<br /><br />However, top right (also highlighted) is a box made to look like a standard Facebook "continue" button. When installing the application for the first time, this caught me out too - I didn't notice the app was already installed and (naturally enough) clicked the "continue" button, thinking there was something else I needed to do to complete the installation.<br /><br />Imagine my confusion, then, when I was suddenly presented by this:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/gview2.html" onclick="window.open('http://blog.spywareguide.com/images/gview2.html','popup','width=731,height=460,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/gview2-thumb-331x208.jpg" alt="gview2.jpg" class="mt-image-none" style="" height="208" width="331" /></a></span><br /></div></div><div><div align="center"><br />Click to Enlarge<br /></div><br />A page asking me to download "Mothers Day E-cards", via IAC (creators of Smiley Central, amongst other things). By this point, you've left the Facebook network completely and are sitting on a page served up by an advertising network - go back to the Facebook screenshot above and check out the URL at the bottom of the browser. That's the actual destination of the "Continue" button.<br /><br />That's a pretty sneaky tactic, if you ask me.<br /><br />What needs to be established is, who is responsible for the placement of the fake "Continue" button? Is it the creator of the application, or is it legitimate advertising space on Facebook being subverted in a rather creative fashion by an advertising agency promoting IAC products?<br /><br /> I've tried reinstalling the application a few times, and the graphic displayed sometimes changes to more overt "this is an advert" style banners leading to other sites offering similar downloads / offers. Other applications installed don't seem to display sneaky adverts like that in the same location, but every application install is somewhat different so that's not really a conclusive answer.<br /><br />At any rate, be wary of what you click on when installing Facebook applications...<br /></div>
        
    ]]></content:encoded>
      <pubDate>Thu, 03 Jul 2008 14:45:10 +0000</pubDate>
      <category domain="http://securityratty.com/tag/facebook">facebook</category>
      <category domain="http://securityratty.com/tag/application install">application install</category>
      <category domain="http://securityratty.com/tag/application">application</category>
      <category domain="http://securityratty.com/tag/standard facebook">standard facebook</category>
      <category domain="http://securityratty.com/tag/network">network</category>
      <category domain="http://securityratty.com/tag/facebook network completely">facebook network completely</category>
      <category domain="http://securityratty.com/tag/applications">applications</category>
      <category domain="http://securityratty.com/tag/facebook applications">facebook applications</category>
      <category domain="http://securityratty.com/tag/application loose">application loose</category>
      <source url="http://blog.spywareguide.com/2008/07/interesting-advert-placements.html">"Interesting" Advert Placements On Facebook</source>
    </item>
    <item>
      <title><![CDATA[Communicating about risk - part 2]]></title>
      <link>http://securityratty.com/article/2085e5b786e567ff679b1ab4b7ea429f</link>
      <guid>http://securityratty.com/article/2085e5b786e567ff679b1ab4b7ea429f</guid>
      <description><![CDATA[The trouble with likelihood
Its common to see charts similar to the one below used to communicate risk. On one axis we have Impact, and on the other we have Likelihood. Well save a discussion...]]></description>
      <content:encoded><![CDATA[<p><span><strong>The trouble with likelihood</strong></span></p>
<p><span>It’s common to see charts similar to the one below used to communicate risk.  On one axis we have Impact, and on the other we have Likelihood.  We’ll save a discussion regarding Impact for another post, but in this post I’d like to point out a couple of subtle but important limitations with the term “likelihood”.</span></p>
<p><img src="http://riskmanagementinsight.com/riskanalysis/wp-content/uploads/2008/05/likelihood-chart.tiff" alt="" /></p>
<p><span>Likelihood connotes the probability of an event occurring.  In fact, you may see explicit probability ranges assigned to each qualitative label (e.g., “<em>Very High = 90% to 100% probable</em>”).   And, while this seems to be on the right track, there are two problems with it:</span></p>
<ul>
<li>It often doesn’t include a timeframe reference.  In other words, does the likelihood statement refer to the probability of the event occurring this week, this year, in this lifetime?  </li>
<li>It doesn’t provide the means to differentiate between something that may happen once vs. something that may happen multiple times.  For example, a statement; “<em>The likelihood of a virus infection is Very High</em>” doesn’t differentiate whether the event is likely to happen once or many times.</li>
</ul>
<p><span>These two limitations become critical when we’re trying to quantify and/or compare risk issues.  </span></p>
<p><span>Using frequency, we can account for events that occur many times within the defined timeframe as well as those that occur fewer than once in the timeframe (e.g., .01 times per year, or once in one hundred years).  Of course, this raises the question of how we determine frequency, particularly for infrequent events.  In the interest of keeping this post to a reasonable length, I’ll cover that another time (soon).</span></p>
<p><span><strong>Drawing lines</strong></span></p>
<p><span>You may have seen charts like the ones below, with lines drawn to differentiate High from Medium, etc.  </span></p>
<p><img src="http://riskmanagementinsight.com/riskanalysis/wp-content/uploads/2008/05/lines-charts-1.tiff" alt="" /></p>
<p><span><em>(NOTE:  Magnitude scales will vary based on the risk capacity/tolerance of the organization)</em></span></p>
<p>These can be useful, but a few challenges I’ve encountered with this approach include:</p>
<ul>
<li>If the risk point falls barely on one side of the line or the other, do the lines really serve a useful purpose, at least from the perspective of being able to assign a qualitative value?</li>
<li>Who drew the lines?  At one place I’ve worked, I couldn’t get management to provide guidance on where to draw the lines so I took a stab at drawing them based on what I thought management’s risk tolerance was given their earlier decisions.  This seemed to work okay, as I didn’t experience much push-back from management, but you need to constantly look for evidence that the lines need to be changed.</li>
<li>Particularly in larger companies with multiple affiliates or subsidiaries, line placement will vary because each part of the enterprise will have its own risk tolerance.  A “critical” loss at the subsidiary level might not equate to a rounding error at the enterprise level.  I’ve dealt with this by plotting results on two charts; one scaled to the enterprise risk tolerance, and another drawn to the subsidiary’s tolerance.</li>
</ul>
<p><span>Of course, the fact that the point isn’t really a point at all, but the intersection of two ranges or distributions further affects the utility of lines.  </span></p>
<p><span>I’ve found two ways of charting risk that seem to be well received by management (below).  </span></p>
<p><img src="http://riskmanagementinsight.com/riskanalysis/wp-content/uploads/2008/05/risk-charts.tiff" alt="" /></p>
<p><em>(NOTE: These charts were created using Monte Carlo analyses within FAIR-based applications)</em></p>
<p><span>My preference is the scatter plot, which does a nice job of visualizing the uncertainty that is a part of any risk analysis.  A couple of things to note:</span></p>
<ul>
<li>No lines have been drawn to label the result &#8220;High&#8221;, &#8220;Medium&#8221;, etc.  </li>
<li>I haven&#8217;t used a green-to-red background on the charts.</li>
</ul>
<p>I will use those illustrative tools if requested by management, but I tend not to use them otherwise.  Besides the challenges I noted above regarding lines, my rationale is that lines and colors tend to bias interpretation of the results.  In other words, if someone sees a risk point plotted in a red background or in the &#8220;High&#8221; section of the chart, they equate those results as &#8220;unacceptable&#8221;.  The fact is, the acceptability of a risk condition is often dependent on the value proposition of the situation, the cost to mitigate risk, etc.  I&#8217;ve found management is intelligent enough to know that the upper-right part of the chart means more risk than the lower-left.</p>
<p> </p>
<p> </p>
]]></content:encoded>
      <pubDate>Tue, 20 May 2008 12:22:24 +0000</pubDate>
      <category domain="http://securityratty.com/tag/risk">risk</category>
      <category domain="http://securityratty.com/tag/managements risk tolerance">managements risk tolerance</category>
      <category domain="http://securityratty.com/tag/enterprise risk tolerance">enterprise risk tolerance</category>
      <category domain="http://securityratty.com/tag/risk tolerance">risk tolerance</category>
      <category domain="http://securityratty.com/tag/likelihood">likelihood</category>
      <category domain="http://securityratty.com/tag/risk analysis">risk analysis</category>
      <category domain="http://securityratty.com/tag/likelihood connotes">likelihood connotes</category>
      <category domain="http://securityratty.com/tag/lines">lines</category>
      <category domain="http://securityratty.com/tag/likelihood statement refer">likelihood statement refer</category>
      <source url="http://riskmanagementinsight.com/riskanalysis/?p=354">Communicating about risk - part 2</source>
    </item>
    <item>
      <title><![CDATA[OnStar Offers a Model for IT Security]]></title>
      <link>http://securityratty.com/article/c41d8b202e7ddfec3a4ae2d7f3f68cac</link>
      <guid>http://securityratty.com/article/c41d8b202e7ddfec3a4ae2d7f3f68cac</guid>
      <description><![CDATA[At the recent Gartner Mobile and Wireless Conference, Sanjay Khunger, the chief technologist of GM's OnStar unit, gave a presentation on the history of OnStar's satellite-based remote safety, security...]]></description>
      <content:encoded><![CDATA[At the recent Gartner Mobile and Wireless Conference, Sanjay Khunger, the chief technologist of GM's OnStar unit, gave a presentation on the history of OnStar's satellite-based remote safety, security and diagnostic service. GM looks at auto safety as being in three distinct phases: before the crash, during the crash and after the crash. Another way to look at this is preventing/avoiding the crash, surviving the crash and recovering after the crash. GM designs features into cars in each of those phases (anti-lock brakes to avoid crashes, chassis design and airbags that reduce injury during the crash, and so on). I always thought of OnStar as a "push the button to call for help" service, but Khunger explained how it was an integrated part of GM's overall safety strategy. <br />
<br />
Beyond the obvious capabilities to call for help after a crash, OnStar has features that also apply to the first two phases. Hands- and eyes-free navigation and cell phone capabilities minimize driver distraction and reduce accidents. Remote proactive diagnostics and remote door unlock services reduce the time a driver spends standing next to a dead car on the side of the road. Multiple sensors in the vehicle provide information on the type of crash and the number of occupants so that emergency personnel have more information to ensure that EMTs have the right equipment to best save lives at the crash scene.<br />
<br />
This isn't meant to be a commercial for OnStar - if you watch sports on TV, you've already seen plenty of those. However, GM's placement of a security-related service in the larger context of customer safety really hits home on a larger point: Security and, just as importantly, safety need to be worked into all the critical business and IT processes at your business. The biggest bang for the buck comes from avoiding incidents - minimizing vulnerabilities in applications, not just by having secure development life cycles but by thinking about user safety. What are the abuse cases where a user or customer might accidentally put themselves in danger? What features are built into your business applications to avoid those situations? <br />
<br />
Financially, OnStar makes more money by helping its customers avoid accidents. But stuff happens, and building in instrumentation, response and recovery features to minimize damage during an incident and speed to ensure swift resumption of business after an incident is important, as well. This applies as much to car crashes as it does to identity theft incidents, insider attacks and every other IT security "crash." Build security into your critical business processes, and keep your customers safe. ]]></content:encoded>
      <pubDate>Fri, 07 Mar 2008 08:08:35 +0000</pubDate>
      <category domain="http://securityratty.com/tag/processes">processes</category>
      <category domain="http://securityratty.com/tag/critical business processes">critical business processes</category>
      <category domain="http://securityratty.com/tag/onstar">onstar</category>
      <category domain="http://securityratty.com/tag/critical business">critical business</category>
      <category domain="http://securityratty.com/tag/crash">crash</category>
      <category domain="http://securityratty.com/tag/remote safety">remote safety</category>
      <category domain="http://securityratty.com/tag/crash scene">crash scene</category>
      <category domain="http://securityratty.com/tag/safety">safety</category>
      <category domain="http://securityratty.com/tag/auto safety">auto safety</category>
      <source url="http://blog.gartner.com/blog/security.php?x=0&amp;itemid=3186">OnStar Offers a Model for IT Security</source>
    </item>
    <item>
      <title><![CDATA[ZDNet Asia and TorrentReactor IFRAME-ed]]></title>
      <link>http://securityratty.com/article/df74c86ba5fb18bfbd0b35c3905e5f21</link>
      <guid>http://securityratty.com/article/df74c86ba5fb18bfbd0b35c3905e5f21</guid>
      <description><![CDATA[This currently ongoing malware embedded attack aimed at ZDNet Asia and TorrentReactor is very creative at the strategic level, whereas the IFRAME-ing tactic remains the same. The sites' search engines...]]></description>
      <content:encoded><![CDATA[<a href="http://bp3.blogger.com/_wICHhTiQmrA/R81SAwsZynI/AAAAAAAABao/PzDWIlVlYaI/s1600-h/zdnet_asia_iframe.jpg"><img id="BLOGGER_PHOTO_ID_5173881719943187058" style="margin: 0px 10px 10px 0px; float: left;" alt="" src="http://bp3.blogger.com/_wICHhTiQmrA/R81SAwsZynI/AAAAAAAABao/PzDWIlVlYaI/s200/zdnet_asia_iframe.jpg" border="0" /></a><div>This currently ongoing malware embedded attack aimed at ZDNet Asia and TorrentReactor is very creative at the strategic level, whereas the IFRAME-ing tactic remains the same. The sites' search engines seem to have been exploited to have the IFRAME injected, not embedded, within the last 24 hours, redirecting to known Russian Business Network's IPs and ex-customers in the face of rogue anti-virus and anti-spyware applications. For the time being, <strong>zdnetasia.com has 11,200 cached pages loading the IFRAME</strong>, and <strong>torrentreactor.net - 29,300 cached</strong><strong> pages loading the IFRAME</strong>. Even worse, the IFRAME embedded search results hosted on their sites, are appearing between the first ten to twenty search results, thanks to the sites high page ranks. Sample search queries :<br /><br /><em>jamie presley</em><br /><div><em>mari misato</em></div><em>risa coda</em><br /><div><em>kasumi tokumoto</em></div><div><em>jill criscuolo</em></div><br /><div><a href="http://bp0.blogger.com/_wICHhTiQmrA/R81SoAsZyoI/AAAAAAAABaw/38ezpy_-PGQ/s1600-h/zdnet_asia_obfuscation.jpg"><img id="BLOGGER_PHOTO_ID_5173882394253052546" style="margin: 0px 10px 10px 0px; float: left;" alt="" src="http://bp0.blogger.com/_wICHhTiQmrA/R81SoAsZyoI/AAAAAAAABaw/38ezpy_-PGQ/s200/zdnet_asia_obfuscation.jpg" border="0" /></a>The IFRAME is loading <strong>72.232.39.252/a</strong> also responding to <strong>themaleks.net</strong>. The link itself is loading an obfuscated javascript, which once deobfuscated attempts to load <strong>a-n-d-the.com/wtr/router.php</strong> (216.255.185.82 - INTERCAGE-NETWORK-GROUP2) also responding to <strong>ppcan.info</strong>, with two more domains sharing nameservers, <strong>findhowto.net</strong>, <strong>searchhowto.net</strong>. Ppcan.net has already been assessed by <a href="http://research.microsoft.com/users/shuochen/HM.doc">Microsoft's Security Team</a> :</div><div><br /></div>"<em>The advantage gained by faking the Referer field is nullified when pages use client-side cloaking to distinguish between fake and real Referer field data by running a script in the client’s browser to check the document.referrer variable. Example 1 shows a script used by the spam URL naha.org/old/tmp/evans-sara-real-fine-place/index.html. The script checks whether the document.referrer string contains the name of any major search engines. If successful the browser redirects to ppcan.info/mp3re.php and eventually to spam; otherwise, the browser stays at the current doorway page. To defeat the simple client-side cloaking, issuing a query of the form “url:link1” is sufficient. This allows us to fake a click through from a real search engine page.</em>"</div><div> </div><br /><div>So the malicious parties are implementing simple referrer techniques to verify that the end users coming to their IP, are the ones they expect to come from the campaign, and not client-side honeypots or even security researchers. And if you're not coming from you're supposed to come, you get a 404 error message, deceptive to the very end of it. Sample redirects upon visiting the IFRAME-ed pages at ZDNet Asia with the right referrer :</div><br /><div> </div><strong>xpantivirus2008.com </strong>(69.50.173.10)<br /><div><strong>scanner.spyshredderscanner.com </strong>(77.91.229.106)</div><strong>hot-porn</strong><strong>otube-2008.com </strong>(206.51.229.67)<br /><div><strong>porn-tubecodec20.com </strong>(195.93.218.43)</div><br /><div> </div>Once the junkware inventory is empty, all pages redirect to <strong>requestedlinks.com</strong> (216.255.185.82). Let's take a peek at the codec :<br /><div> </div><br /><div><strong>Scanner results</strong> : 11% Scanner (4/36) found malware!</div><strong>File Size</strong> : 85008 byte<br /><div><strong>MD5</strong> : 6b325c53987c488c89636670a25d5664</div><strong>SHA1</strong> : c6aeeafffe10e70973a45e5b6af97304ca20b3bd<br /><div><strong>Fortinet</strong> - Suspicious</div><strong>Norman</strong> - Tibs.gen200<br /><div><strong>Prevx</strong> - TROJAN.DOWNLOADER.GEN</div><strong>Quick Heal</strong> - Suspicious - DNAScan<br /><div> </div><br /><div>Even more interesting is the fact that literally minutes before posting this, another such campaign got launched at ZDNet Asia, this time having just 24 pages locally cached, and loading another IFRAME to <strong>89.149.243.201/a</strong> redirecting to <strong>cialis2men.com/product/61 </strong>(92.241.162.154).<br /><div><br /></div><div><a href="http://bp0.blogger.com/_wICHhTiQmrA/R81UBAsZypI/AAAAAAAABa4/vm4-rYcZreI/s1600-h/torrentreactor_IFRAME.jpg"><img id="BLOGGER_PHOTO_ID_5173883923261409938" style="margin: 0px 10px 10px 0px; float: left;" alt="" src="http://bp0.blogger.com/_wICHhTiQmrA/R81UBAsZypI/AAAAAAAABa4/vm4-rYcZreI/s200/torrentreactor_IFRAME.jpg" border="0" /></a>What is going on, have the sites been compromised, or the attackers are in fact smarter than those who would even bother to scan for remotely exploitable web application vulnerabilities, next to remote file inclusion? ZDNet Asia and TorrentReactor themselves aren't compromised, their SEO practices of locally caching any search queries submitted are abused. Basically, whenever the malicious attacker is feeding the search engine with popular quaries, the sites are caching the search results, so when the malicious party is also searching for the IFRAME in an "loadable state" next to the keyword, it loads. Therefore, relying on the high page ranks of both sites, the probability to have the cached pages with the popular key words easy to find on the major search engines, with the now "creative" combination of the embedded IFRAME, becomes a reality if you even take a modest sample, mostly names.</div><br /><div><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://bp0.blogger.com/_wICHhTiQmrA/R81mmAsZyqI/AAAAAAAABbA/dW0kdjnXWHs/s1600-h/zdnet_asia_fake_codec.jpg"><img style="margin: 0pt 10px 10px 0pt; float: left; cursor: pointer;" src="http://bp0.blogger.com/_wICHhTiQmrA/R81mmAsZyqI/AAAAAAAABbA/dW0kdjnXWHs/s200/zdnet_asia_fake_codec.jpg" alt="" id="BLOGGER_PHOTO_ID_5173904350125869730" border="0" /></a>The bottom line is that ZDNet Asia and TorrentReactor SEO practices of caching the search queriesAnd given that the malicius parties can now easily tweak popular keywords to appear on ZDNet Asia and TorrentReactor's sites, thereby getting a front placement on search engines, they can pretty much shift the SEO campaign to a malware campaign by taking advantage of "event-based social engineering".</div></div><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=VBVN8pF"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=VBVN8pF" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=yOvop1F"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=yOvop1F" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=1opAYZf"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=1opAYZf" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=ZCVuVtf"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=ZCVuVtf" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=tr11tjF"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=tr11tjF" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=Bg9LMHF"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=Bg9LMHF" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=2H9xyyf"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=2H9xyyf" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/245530489" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 04 Mar 2008 06:15:20 +0000</pubDate>
      <category domain="http://securityratty.com/tag/iframe">iframe</category>
      <category domain="http://securityratty.com/tag/zdnet asia">zdnet asia</category>
      <category domain="http://securityratty.com/tag/pages">pages</category>
      <category domain="http://securityratty.com/tag/pages redirect">pages redirect</category>
      <category domain="http://securityratty.com/tag/iframe-ed pages">iframe-ed pages</category>
      <category domain="http://securityratty.com/tag/torrentreactor">torrentreactor</category>
      <category domain="http://securityratty.com/tag/iframe-ing tactic remains">iframe-ing tactic remains</category>
      <category domain="http://securityratty.com/tag/seo practices">seo practices</category>
      <category domain="http://securityratty.com/tag/torrentreactor seo practices">torrentreactor seo practices</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/245530489/zdnet-asia-and-torrentreactor-iframe-ed.html">ZDNet Asia and TorrentReactor IFRAME-ed</source>
    </item>
    <item>
      <title><![CDATA[Central Bank of the UAE reports ATM fraud to lenders]]></title>
      <link>http://securityratty.com/article/769f868188d32458387e4934be5665b5</link>
      <guid>http://securityratty.com/article/769f868188d32458387e4934be5665b5</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
2/27/08

Organization
Central Bank of the UAE

Contractor/Consultant/Branch
Unknown lender

Victims
ATM customers

Number Affected
Unknown

Types of...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/cbou.jpg" align="right" height="40" width="198"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>2/27/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.centralbank.ae/index.php">Central Bank of the UAE</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>Unknown lender<br><br><span style="font-weight: bold;">Victims:</span><br>ATM customers<br><br><span style="font-weight: bold;">Number Affected:</span><br>Unknown<br><br><span style="font-weight: bold;">Types of Data:</span><br>Bank card and account details, PIN numbers, and possible other related information.<br><br><span style="font-weight: bold;">Breach Description:</span><br>The Central Bank of the UAE has issued a statement claiming that criminals installed a card skimming device and video camera on at least one ATM in the UAE.&nbsp; Bank card details and PIN numbers were exposed in the attack that lasted from February 19th - 25th, 2008.&nbsp; Every customer that used the compromised ATM(s) during the time in question has been affected.<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.arabianbusiness.com/512710-thousands-hit-by-card-fraud?ln=en">ArabianBusiness.com news story</a> <br><a href="http://www.centralbank.ae//pdf/notices/1302-2008.pdf">The Central Bank of the UAE press release</a> <br><a href="http://www.itp.net/news/512718-uae-bank-card-details-stolen-from-hacked-atm">ITP News online story</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>The Central Bank of the UAE<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>The card details of potentially thousands of UAE residents have been stolen by a gang of fraudsters who hacked into a bank's ATM machine<br><br>We have been informed by one of the banks operating in the UAE that a gang of computer professionals has managed to insert an electronic reader into the card reader of one of its ATMs, which enabled them to copy the data of all the cards used in the said ATM during the period 19-25 February 2008.<br><span style="font-style: italic;">[Evan] Obviously I don't use ATM machines in UAE much, but aren't there controls in place to prevent most tampering?&nbsp; The ATMs around here in Minnesota (US) would be very difficult (not impossible) to mess with.</span><br><br>They have also managed to compromise the PIN through a small video camera placed above the ATM.<br><br>We attach herewith the list of ATM cards belonging to your customers who have used the ATM Machines belonging to the bank which has advised us of the ATM fraud.<br><span style="font-style: italic;">[Evan] Judging from this statement, this appears to be a copy of the letter sent to the banks affected.&nbsp; I think it would be wise for the Central Bank to disclose the banks to the public so that affected customers can be better prepared.</span><br><br>We, therefore, advise you to:<br>1-&nbsp; Block the usage of the attached ATM cards;<br>and<br>2-&nbsp; Either to replace the cards or change the Pin numbers as deemed appropriate.<br>3-&nbsp; Fully checking all you ATMs to make sure there are no traces on ATM skimming devices or tampering on the ATM.<br><br>It is not known whether the gang has been caught, how much money had been stolen or the exact number of people affected.<br><br>Please report to the Central Bank - UAESWITCH any losses on the attached card numbers and the transactions originating country immediately.<br><br>For any clarifications, banks should contact the UAESWITCH immediately on Tel. No.: (02)6915395, Fax No.:&nbsp; (02)6674521 or email xxxxx@ebuae.go.ae attention Mr. Aden Omar, for action.<br><br><span style="font-weight: bold;">Interesting Comments on the ArabianBusiness.com Story:</span><br></font><span class="medium"></span><font size="2"><a class="blue-d small" href="http://www.arabianbusiness.com/512710#comment-10573">Posted by KANDARP BAXI, DUBAI, UAE  on 3 March 2008 at 16:50 UAE time</a><br></font><font size="2">"<span class="medium">
Also it is high time one gets to know which bank / where etc rather
than wait to go to the ATM and find out your account has been 'swiped'
out.<br><br>All the more reasons for this information to be given ASAP, considering the pathetic customer service in most banks."<br><br></span><a class="blue-d small" href="http://www.arabianbusiness.com/512710#comment-10572">Posted by Avikul Hemmad, Dubai, UAE  on 3 March 2008 at 16:38 UAE time</a><br>"<span class="medium">
The idea of publishing such news should be to inform the public about the modus operandi and ways to detect and avoid problems.<br>
<br>
How would the layman identify "skimming machines" or whatever they are
called, if they don't know what to look for? Why don't you give more
details so bank customers and the general public can be wary???<br>
<br>
Incomplete reporting only adds to the confusion."</span><br></font><span class="medium"><font size="2"><br><i>[Evan] I agree with these two commenters.&nbsp; I don't understand why the Central Bank of the UAE even decided to make anything public if there is nothing actionable for the people affected.&nbsp; There is not enough information to help anyone.&nbsp; <br><br>It is often very (and I mean VERY) difficult to notice good card skimmers and cameras.&nbsp; Here is an example borrowed from the University of Texas.</i></font><br><br><br><img src="http://images.quickblogcast.com/95781-88451/atm1.jpg" border="0" width="451"><br><br></span><font size="1"><span class="medium">Card skimmer being installed</span></font><br><span class="medium"><br><img src="http://images.quickblogcast.com/95781-88451/atm2.jpg" border="0" width="449"><br><br><font size="1">Card skimmer after installation</font><br><br><img src="http://images.quickblogcast.com/95781-88451/atm3.jpg" border="0" width="448"><br><br><font size="1">Camera to capture PIN numbers hidden in an innocent looking brochure box</font><br><br><img src="http://images.quickblogcast.com/95781-88451/atm4.jpg" border="0" width="443"><br><br><font size="1">Camera is now installed.</font><br><br>This is only an example.&nbsp; There are more sophisticated skimmers and cameras out there.&nbsp; Diebold has a pretty good whitepaper <a href="http://www.diebold.com/rd/whitepapers/atmfraud&amp;security.pdf"> ATM Fraud and Security</a>.<br><br></span><font size="2"><span style="font-weight: bold;">Commentary:</span><br>Good commentary from ArabianBusiness.com:<br>"Skimming attacks normally involve the placement of a fake card reader over the regular card reader in an ATM, which reads and records the data from the card's magnetic strip, while either a hidden camera or a nearby observer, known as a ‘shoulder surfer', steals the PIN."<br><br>"The stolen details can then be used to create fake cards or make purchases online, or the data may be sold on to other gangs of fraudsters. <br><br>Skimming fraud has been seen in most regions of the world, and banks usually take measures to protect machines, such as installing plastic guards to prevent the installation of illicit card readers, camera monitoring of ATMs and regular inspections of machines."<br><br>"Most skimming attempts now either target high usage ATMs for a very short period of time to steal the maximum number of card details in a short amount of time, or machines in out-of-the-way locations where the reader will not be detected as quickly."<br><br><span style="font-style: italic;">[Evan] It is unusual that a skimming device and video camera were installed for such a long period of time.&nbsp; It is important as bank customers to be cognizant of anything that seems a little out of place when using ATMs.&nbsp; If something is noticed, report it to the bank as soon as possible.&nbsp; Personally, I prefer to use ATMs at bank branches and ones located in buildings or rooms that require card access. </span><br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/03/03/cbou.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Mon, 03 Mar 2008 08:41:37 +0000</pubDate>
      <category domain="http://securityratty.com/tag/bank card details">bank card details</category>
      <category domain="http://securityratty.com/tag/card details">card details</category>
      <category domain="http://securityratty.com/tag/bank">bank</category>
      <category domain="http://securityratty.com/tag/bank card">bank card</category>
      <category domain="http://securityratty.com/tag/atm">atm</category>
      <category domain="http://securityratty.com/tag/regular card reader">regular card reader</category>
      <category domain="http://securityratty.com/tag/reader">reader</category>
      <category domain="http://securityratty.com/tag/customers">customers</category>
      <category domain="http://securityratty.com/tag/bank customers">bank customers</category>
      <source url="http://breachblog.com/2008/03/03/cbou.aspx">Central Bank of the UAE reports ATM fraud to lenders</source>
    </item>
    <item>
      <title><![CDATA[Off the wire: Online advertising vs. personal privacy]]></title>
      <link>http://securityratty.com/article/aa4d564b8c818eec659c339def220756</link>
      <guid>http://securityratty.com/article/aa4d564b8c818eec659c339def220756</guid>
      <description><![CDATA[Google cleared an important regulatory hurdle when the Federal Trade Commission last week approved its $3.1 billion merger with ad placement giant DoubleClick, but congressional hearings on privacy...]]></description>
      <content:encoded><![CDATA[Google cleared an important regulatory hurdle when the Federal Trade Commission last week approved its $3.1 billion merger with ad placement giant DoubleClick, but congressional hearings on privacy ar...]]></content:encoded>
      <pubDate>Thu, 27 Dec 2007 21:18:42 +0000</pubDate>
      <category domain="http://securityratty.com/tag/placement giant doubleclick">placement giant doubleclick</category>
      <category domain="http://securityratty.com/tag/federal trade commission">federal trade commission</category>
      <category domain="http://securityratty.com/tag/congressional hearings">congressional hearings</category>
      <category domain="http://securityratty.com/tag/billion merger">billion merger</category>
      <category domain="http://securityratty.com/tag/regulatory hurdle">regulatory hurdle</category>
      <category domain="http://securityratty.com/tag/privacy">privacy</category>
      <category domain="http://securityratty.com/tag/google">google</category>
      <category domain="http://securityratty.com/tag/week">week</category>
      <source url="http://feeds.feedburner.com/~r/HelpNetSecurity/~3/207249150/news.php">Off the wire: Online advertising vs. personal privacy</source>
    </item>
  </channel>
</rss>
