<![CDATA[[SecurityRatty] tag: prolific]]> http://securityratty.com/tag/prolific Sun, 03 Feb 2008 21:00:00 +0000 iRatty Engine http://blogs.law.harvard.edu/tech/rss <![CDATA[Linux experiences 'prolific' growth, says Linux Foundation's Zemlin]]> http://securityratty.com/article/8405dbdb8edb5d41554ad942141593fe http://securityratty.com/article/8405dbdb8edb5d41554ad942141593fe ]]> Mon, 30 Jun 2008 12:29:30 +0000 linux foundation linux mobile applications jim zemlin increasingly central two-horse race kinds microsoft Linux experiences 'prolific' growth, says Linux Foundation's Zemlin <![CDATA[Linux experiences 'prolific' growth, says Linux Foundation's Zemlin]]> http://securityratty.com/article/80e1ad2612b3e808bafaf4a8b7335e06 http://securityratty.com/article/80e1ad2612b3e808bafaf4a8b7335e06 ]]> Mon, 30 Jun 2008 12:29:30 +0000 linux foundation linux mobile applications jim zemlin increasingly central two-horse race kinds microsoft Linux experiences 'prolific' growth, says Linux Foundation's Zemlin <![CDATA[EU bloggers under assault by the European Parliament - they need your help]]> http://securityratty.com/article/42471dd2ecc3d3795053ea76949e5eeb http://securityratty.com/article/42471dd2ecc3d3795053ea76949e5eeb

One of the nice things about having started the SBN was that I have gotten to meet (mostly virtually) many security bloggers from around the world.  Some of the most prolific contributors to the content of the SBN has been the members of the Belgian Security Bloggers Network.  I received word today from one of the authors of one of the blogs, belsec, that they are under assault by the EU government.  It seems in their wisdom, the European Parliament has decided that in the interests of "media pluralism", all blog owners should declare their ownership, affiliations and status of weblog authors.

The explanatory notes of the proposed regulation says this:

In this context the report points out that the undetermined and unindicated status of authors and publishers of weblogs causes uncertainties regarding impartiality, reliability, source protection, applicability of ethical codes and the assignment of liability in the event of lawsuits.
It recommends clarification of the legal status of different categories of weblog authors and publishers as well as disclosure of interests and voluntary labelling of weblogs.

As the belsec author points out, disclosure of their identities would effectively silence their voices.  There is no first amendment freedom of speech or freedom of press constitutional right in Europe. Of course if forced to do so, the Belgian authors could take up blogs based here in the US and escape the disclosure laws of the EU, but why should they have too.  The EU is a democratic, progressive entity.  Forcing these bloggers to make their "status and identity" public should not be mandatory here.

Blogs are todays pamphlets.  Basic freedom of expression, speech and press have been protected for hundreds of years. Forcing these bloggers to identify themselves is a violation of their rights.  What would Thomas Paine and others like him think of this restriction?

If you feel that this is an unfair and unjust restriction on bloggers rights, blog about it. It is our right and to do so and we should use the medium to do so.  If you are a EU citizen write to your representative and demand that this proposed regulation does not go into effect!

Do not take your right to blog lightly.  If you don't stand up for it, it can be taken away from you.

"The world is my country, all mankind are my brethren, and to do good is my religion." - Thomas Paine

Zemanta Pixie
]]> Thu, 12 Jun 2008 05:38:11 +0000 bloggers weblog authors authors bloggers rights freedom legal status blog owners basic freedom status EU bloggers under assault by the European Parliament - they need your help <![CDATA[EU bloggers under assault by the European Parliament - they need your help]]> http://securityratty.com/article/495d89a1106383a495fba74b3adf8fdb http://securityratty.com/article/495d89a1106383a495fba74b3adf8fdb

One of the nice things about having started the SBN was that I have gotten to meet (mostly virtually) many security bloggers from around the world.  Some of the most prolific contributors to the content of the SBN has been the members of the Belgian Security Bloggers Network.  I received word today from one of the authors of one of the blogs, belsec, that they are under assault by the EU government.  It seems in their wisdom, the European Parliament has decided that in the interests of "media pluralism", all blog owners should declare their ownership, affiliations and status of weblog authors.

The explanatory notes of the proposed regulation says this:

In this context the report points out that the undetermined and unindicated status of authors
and publishers of weblogs causes uncertainties regarding impartiality, reliability, source
protection, applicability of ethical codes and the assignment of liability in the event of
lawsuits.
It recommends clarification of the legal status of different categories of weblog authors and
publishers as well as disclosure of interests and voluntary labelling of weblogs.

As the belsec author points out, disclosure of their identities would effectively silence their voices.  There is no first amendment freedom of speech or freedom of press constitutional right in Europe. Of course if forced to do so, the Belgian authors could take up blogs based here in the US and escape the disclosure laws of the EU, but why should they have too.  The EU is a democratic, progressive entity.  Forcing these bloggers to make their "status and identity" public should not be mandatory here. 

If you feel that this is a restriction on bloggers rights, blog about it. It is our right and to do so and we should use the medium to do so.  If you are a EU citizen write to your representative and demand that this proposed regulation does not go into effect!

Do not take your right to blog lightly.  If you don't stand up for it, it can be taken away from you.

"The world is my country, all mankind are my brethren, and to do good is my religion." - Thomas Paine

]]> Thu, 12 Jun 2008 04:38:35 +0000 bloggers weblog authors authors legal status blog owners status blog bloggers rights european parliament EU bloggers under assault by the European Parliament - they need your help <![CDATA[Detection Rates for Malware in the Wild]]> http://securityratty.com/article/6c1f7d34659a1e926821a4fa36eeaf9a http://securityratty.com/article/6c1f7d34659a1e926821a4fa36eeaf9a Yet another Early Warning Security Event System has been made available to the public, earlier this month. The Malware Threat Center is currently generating automated tracking reports in the following sections :

- Most Aggressive Malware Attack Source and Filters
- Most Effective Malware-Related Snort Signatures
- Most Prolific BotNet Command and Control Servers and Filters
- Most Observed Malware-Related DNS Names
- Most Effective Antivirus Tools Against New Malware Binaries
- Most Aggressively Spreading Malware Binaries

I was particularly interested in the rankings in the "Most Effective Antivirus Tools Against New Malware Binaries" section, especially its emphasis on malware that's currently in the wild. Furthermore, to prove my point, you can see the top 10 list of Anti virus vendors as it were on the 20th, and the top 10 list of anti virus vendors as it were yesterday? Can you find the differences? Grisoft, Avira, Secure Computing and Quick Heal remain on the same
positions, whereas the rest of the vendors are in a different rank, although on the 20th they were exposed to 1030 binaries only, and on the 29th to 1759.

So what? In respect to signatures based malware scanning, every vendor has its 15 minutes of fame, however, as I pointed out two years ago :

"Avoid the signatures hype and start rethinking the concept of malware on demand, open source malware, and the growing trend of malicious software to disable an anti virus scanner, or its ability to actually obtain the latest signatures available."

What has changed? The DIY nature of malware building, the managed undetected binaries as a service coming with the purchase of proprietary malware tools, the fact that malware is tested against all the anti virus vendors and the most popular personal firewalls before it starts participating in a campaign, and is also getting benchmarked and optimized against the objectives set for its lifecycle. Moreover, with malware authors waging tactical warfare on the vendors infrastructure by supplying more malware variants than then can timely analyze, this tactical warfare on behalf of the malicious parties is only going to get more efficient.
]]> Wed, 30 Apr 2008 00:58:01 +0000 malware signatures based malware malware authors source malware malware threat center malware binaries binaries vendors vendors infrastructure Detection Rates for Malware in the Wild <![CDATA[Rock Phish gang adds second punch to phishing attacks]]> http://securityratty.com/article/aed2d81782037816d0a6af49b0d2feb7 http://securityratty.com/article/aed2d81782037816d0a6af49b0d2feb7 Sun, 20 Apr 2008 20:00:00 +0000 notorious online gang personal data operations attack users risk prolific Rock Phish gang adds second punch to phishing attacks <![CDATA[UNICEF Too IFRAME Injected and SEO Poisoned]]> http://securityratty.com/article/452a90ccfc35d6ad6a998c60113508e2 http://securityratty.com/article/452a90ccfc35d6ad6a998c60113508e2 The very latest, and hopefully very last, high profile site to successfully participate in the recently exposed massive SEO poisoning, is UNICEF's official site. In fact the campaign is so successful, where successful means that each and every poisoned result loads the injected IFRAME using UNICEF.org as a doorway to pharmaceutical spam and scams, that one of the most prolific domains within the IFRAMES (highjar.info) is already returning "Bandwidth Limit Exceeded. The server is temporarily unable to service your request due to the site owner reaching his/her bandwidth limit. Please try again later" messages.

This is the perfect moment to point out that as of yesterday's afternoon the search engines that were indexing the SEO poisoned pages have implemented filters so that the malicious pages no longer appear in their indexes, thereby undermining the critical success factor for this campaign - hijacking search traffic. Case closed? At least for now, and even though the black hat SEO is taken care of the last time I checked, some of the sites originally mentioned, and many others still need to take care of the web application vulnerabilities.

Tracking this campaign in a detailed manner inevitably results in a quality actionable intelligence data, in between the added value out of the historical preservation of evidence. The malicious parties behind this know what they're doing, they've been doing it in the past, and will continue doing it, therefore it's extremely important to document what was going on at a particular moment in time. It's all a matter of perspective, some care about the type of vulnerability exploited, others care who's hosting the rogue security applications and the malware, others want to establish the RBN connection, and others want to know who's behind this. Virtual situational awareness through CYBERINT is what I care about.

Let's close the case by assessing UNICEF.org's IFRAME injection state as of yesterday's afternoon. What is highjar.info/error (75.127.104.26) anyway? Before it felt the "UNICEF effect" in terms of traffic, it used to be a "Easy SEO | A Coaching Site For BEGINNING webmasters". And the last time it was active, the injected redirect was forwarding to ravepills.com/?TOPQUALITY (69.50.196.63) and RavePills is what looks like a "legal alternative to Ecstasy" :

"On the other hand, Rave is the safest option available to you without the fear of nasty side-effects or a long time in jail. Rave gives you the same buzz that the illegal ones do but without any proven side-effects. It's absolutely non-addictive & is legal to possess in every country. Rave gives you the freedom to carry it anywhere you go as it also comes in a mini-pack of 10 capsules."

IFRAMES injected within UNICEF.org :

highjar.info (75.127.104.26)
viagrabest.info (81.222.139.184)
pharmacytop.net (216.98.148.6)
grabest.info

Now that the entire campaign received the necessary attention and raised awareness on its impact, let's move onto the next one(s), shall we?
]]> Tue, 01 Apr 2008 03:42:20 +0000 seo unicef easy seo site site owner iframe unicef effect massive seo campaign UNICEF Too IFRAME Injected and SEO Poisoned <![CDATA[The Continuing Slide Towards Thoughtcrime]]> http://securityratty.com/article/b7d75e490b04e1212ea1dd6092ffd22b http://securityratty.com/article/b7d75e490b04e1212ea1dd6092ffd22b A suggestion from the UK of putting primary-school children in a DNA database "exhibit behaviour indicating they may become criminals in later life."

Pugh's call for the government to consider options such as placing primary school children who have not been arrested on the database is supported by elements of criminological theory. A well-established pattern of offending involves relatively trivial offences escalating to more serious crimes. Senior Scotland Yard criminologists are understood to be confident that techniques are able to identify future offenders.

A recent report from the think-tank Institute for Public Policy Research (IPPR) called for children to be targeted between the ages of five and 12 with cognitive behavioural therapy, parenting programmes and intensive support. Prevention should start young, it said, because prolific offenders typically began offending between the ages of 10 and 13. Julia Margo, author of the report, entitled 'Make me a Criminal', said: 'You can carry out a risk factor analysis where you look at the characteristics of an individual child aged five to seven and identify risk factors that make it more likely that they would become an offender.' However, she said that placing young children on a database risked stigmatising them by identifying them in a 'negative' way.

Thankfully, the article contains some reasonable reactions:

Shami Chakrabarti, director of the civil rights group Liberty, denounced any plan to target youngsters. 'Whichever bright spark at Acpo thought this one up should go back to the business of policing or the pastime of science fiction novels,' she said. 'The British public is highly respectful of the police and open even to eccentric debate, but playing politics with our innocent kids is a step too far.'

Chris Davis, of the National Primary Headteachers' Association, said most teachers and parents would find the suggestion an 'anathema' and potentially very dangerous. 'It could be seen as a step towards a police state,' he said. 'It is condemning them at a very young age to something they have not yet done. They may have the potential to do something, but we all have the potential to do things. To label children at that stage and put them on a register is going too far.'

]]> Tue, 18 Mar 2008 11:12:43 +0000 database dna database risk factor analysis individual child aged recent report public policy research report whichever bright spark cognitive behavioural therapy The Continuing Slide Towards Thoughtcrime <![CDATA[Russia becomes 'spam superpower': survey]]> http://securityratty.com/article/2405c8ada9b9915a8db653bebd2d7fab http://securityratty.com/article/2405c8ada9b9915a8db653bebd2d7fab Tue, 12 Feb 2008 08:11:38 +0000 computer security firm russia prolific country junk emails spam e-mail superpower monday Russia becomes 'spam superpower': survey <![CDATA[Storm worm dethroned by sex botnet]]> http://securityratty.com/article/fd5351907140bee12ee262a81e9db916 http://securityratty.com/article/fd5351907140bee12ee262a81e9db916 Sun, 03 Feb 2008 21:00:00 +0000 mega-dik botnet prolific sender infamous storm security experts sex spam romance Storm worm dethroned by sex botnet