<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: ranks]]></title>
    <link>http://securityratty.com/tag/ranks</link>
    <description></description>
    <pubDate>Thu, 01 May 2008 02:56:21 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Compromised Cpanel Accounts For Sale]]></title>
      <link>http://securityratty.com/article/6228ebb081126296ff70b5f6268fd2a3</link>
      <guid>http://securityratty.com/article/6228ebb081126296ff70b5f6268fd2a3</guid>
      <description><![CDATA[Is the once popular in the second quarter of 2007, embedded malware tactic on the verge of irrelevance, and if so, what has contributed to its decline? Have SQL injections executed through botnets...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://4.bp.blogspot.com/_wICHhTiQmrA/SKlq1uSeDFI/AAAAAAAACDM/l4bxcru-BQk/s1600-h/cpanel_multiple_domains1.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://4.bp.blogspot.com/_wICHhTiQmrA/SKlq1uSeDFI/AAAAAAAACDM/ho301JgoMUs/s200-R/cpanel_multiple_domains1.png" /></a> Is the once popular in the second quarter of 2007, embedded malware tactic on the verge of irrelevance, and if so, what has contributed to its decline? Have SQL injections executed through botnets turned into the most efficient way to infect hundreds of thousands of legitimate web sites? Depends on who you're dealing with.<br />
<br />
A cyber criminal's position in the "underground food chain" can be easily tracked down on the basis of tools and tactics that he's taking advantage of, in fact, some would on purposely misinform on what their actual capabilities are in order not to attract too much attention to their real ones, consisting of high-profile compromises at hundreds of high-profile web sites.<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://3.bp.blogspot.com/_wICHhTiQmrA/SKmDVdDGnPI/AAAAAAAACDU/qNbLBUKlHp0/s1600-h/cpanel_multiple_domains3.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://3.bp.blogspot.com/_wICHhTiQmrA/SKmDVdDGnPI/AAAAAAAACDU/ZsmcK9HMeUs/s200-R/cpanel_multiple_domains3.jpg" /></a>Embedded malware may not be as hot as it used to be in the last quarter of 2007, but thanks to the oversupply of stolen accounting data, certain individuals within the underground ecosystem seem to be abusing entire portfolios of domains on the basis of purchasing access to the compromised accounts. In fact, the oversupply of compromised Cpanel accounts is logically resulting in their decreasing price, with the sellers differentiating their propositions, and charging premium prices based on the site's page ranks and traffic, measured through publicly available services, or through the internal statistics.<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://4.bp.blogspot.com/_wICHhTiQmrA/SKmMyr4CWEI/AAAAAAAACDc/UafOTCKAb-0/s1600-h/cpanel_multiple_domains22.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://4.bp.blogspot.com/_wICHhTiQmrA/SKmMyr4CWEI/AAAAAAAACDc/7IRBMNndy-w/s200-R/cpanel_multiple_domains22.JPG" /></a><br />
SQL injections may be the tactic of choice for the time being, but as long as stolen accounting data consisting of Cpanel logins, and web shells access to misconfigured web servers remain desired underground goods, goold old fashioned embedded malware will continue taking place.<br />
<br />
Interestingly, from an economic perspective, the way the seller markets his goods, can greatly influence the way they get abused given he continues offering after-sale services and support. It's blackhat search engine optimization I have in mind, sometimes the tactic of choice especially given its high liquidity in respect to monetizing the compromised access.<br />
<br />
The bottom line - for the time being, there's a higher probability that your web properties will get SQL injected, than IFRAME-ed, as it used to be half a year ago, and that's because what used to be a situation where malicious parties would aim at launching a targeted attack at high profile site and abuse the huge traffic it receives, is today's pragmatic reality where a couple of hundred low profile web sites can in fact return more traffic to the cyber criminals, and greatly extend the lifecycle of their campaign taking advantage of the fact the the low profile site owners would remain infected and vulnerable for months to come.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2008/03/embedding-malicious-iframes-through.html">Embedding Malicious IFRAMEs Through Stolen FTP Accounts</a><br />
<a href="http://ddanchev.blogspot.com/2008/03/injecting-iframes-by-abusing-input.html">Injecting IFRAMEs by Abusing Input Validation</a><br />
<a href="http://ddanchev.blogspot.com/2008/07/money-mule-recruiters-use-asproxs-fast.html">Money Mule Recruiters use ASProx's Fast-flux Services</a><br />
<a href="http://ddanchev.blogspot.com/2008/05/malware-domains-used-in-sql-injection.html">Malware Domains Used in the SQL Injection Attacks</a><br />
<a href="http://ddanchev.blogspot.com/2008/07/obfuscating-fast-fluxed-sql-injected.html">Obfuscating Fast-fluxed SQL Injected Domains</a><br />
<a href="http://ddanchev.blogspot.com/2008/07/sql-injecting-malicious-doorways-to.html">SQL Injecting Malicious Doorways to Serve Malware </a><br />
<a href="http://ddanchev.blogspot.com/2008/05/yet-another-massive-sql-injection.html">Yet Another Massive SQL Injection Spotted in the Wild</a><br />
<a href="http://ddanchev.blogspot.com/2008/05/malware-domains-used-in-sql-injection.html">Malware Domains Used in the SQL Injection Attacks</a><br />
<a href="http://ddanchev.blogspot.com/2007/07/sql-injection-through-search-engines.html">SQL Injection Through Search Engines Reconnaissance</a><br />
<a href="http://ddanchev.blogspot.com/2007/05/google-hacking-for-vulnerabilities.html">Google Hacking for Vulnerabilities</a><br />
<a href="http://blogs.zdnet.com/security/?p=1122">Fast-Fluxing SQL injection attacks executed from the Asprox botnet</a><br />
<a href="http://blogs.zdnet.com/security/?p=1394">Sony PlayStation's site SQL injected, redirecting to rogue security software</a><br />
<a href="http://blogs.zdnet.com/security/?p=1118">Redmond Magazine Successfully SQL Injected by Chinese Hacktivists</a><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=ExzKaK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=ExzKaK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=AgwoKK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=AgwoKK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=5JjO7k"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=5JjO7k" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=5Z85mk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=5Z85mk" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=s4xhGK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=s4xhGK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=ReebmK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=ReebmK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=T0yjTk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=T0yjTk" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/368194376" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 18 Aug 2008 06:42:50 +0000</pubDate>
      <category domain="http://securityratty.com/tag/sql">sql</category>
      <category domain="http://securityratty.com/tag/sql injections">sql injections</category>
      <category domain="http://securityratty.com/tag/sql injection attacks">sql injection attacks</category>
      <category domain="http://securityratty.com/tag/massive sql injection">massive sql injection</category>
      <category domain="http://securityratty.com/tag/profile site">profile site</category>
      <category domain="http://securityratty.com/tag/site">site</category>
      <category domain="http://securityratty.com/tag/site sql">site sql</category>
      <category domain="http://securityratty.com/tag/sql injection">sql injection</category>
      <category domain="http://securityratty.com/tag/tactic">tactic</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/368194376/compromised-cpanel-accounts-for-sale.html">Compromised Cpanel Accounts For Sale</source>
    </item>
    <item>
      <title><![CDATA[Automated Spim on Microblogging Site Via MSN Messenger]]></title>
      <link>http://securityratty.com/article/e5a1fb1ee8285e5dda0e9ae590ea20f2</link>
      <guid>http://securityratty.com/article/e5a1fb1ee8285e5dda0e9ae590ea20f2</guid>
      <description><![CDATA[There's been a fair amount of Twitter coverage recently, but it's worth noting that other countries have their own versions of Twittering and some of them have seem to be a little easier to use in...]]></description>
      <content:encoded><![CDATA[
        There's been a fair amount of <a href="http://blogs.zdnet.com/security/?p=1640">Twitter coverage</a> recently, but it's worth noting that other countries have their own versions of Twittering and some of them have seem to be a little easier to use in conjunction with Instant Messaging, whereas Twitter still seems to have a need for <a href="http://www.twittermsn.com/">third party services</a>, <a href="http://kunal.kundaje.net/twessenger/">add-ins</a> and <a href="http://www.theyagar.com/2008/01/30/twitter-bot-for-yahoo/">other tools</a> to get the job done if the service used is something other than Google Talk, Livejournal Chat or Jabber (if it's now more straightforward for other clients too, please let me know!)<br /><br />Either way, the below illustrates why adding Instant Messaging features to services such as Twitter can cause problems in the long run and needs to be considered carefully.<br /><br />We were alerted to the fact that a large amount of Spam seemed to be coming out of China in the last day or two (indeed, one contact mentioned to me that this particular message had been sent to their Honeypot around 29,000+ times, which is a lot of spamming for one URL however you look at it). The spam in question seemed to have been sent via a Spambot, and the only mentions of this URL so far in search engines seems to be related to China - shall we take a look?<br /><br />The URL in question (with part of it redacted) is<br /><br />http: //5834******/ ;)<br /><br />You'll notice the spam is short, snappy and also includes a little smiley-face thing at the end. In fact, it looks a little bit like the kind of link people send to their contacts on Twitter, doesn't it?<br /><br />Well, let's see - a quick search and we find this:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/fanf1.html" onclick="window.open('http://blog.spywareguide.com/images/fanf1.html','popup','width=780,height=584,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/fanf1-thumb-380x284.jpg" alt="fanf1.jpg" class="mt-image-none" style="" height="284" width="380" /></a></span>
<br /><br />Click to Enlarge<br /></div><br />A page from Fanfou.com, which I believe is a Chinese site "<a href="http://www.twittown.com/fanfou">inspired</a>" by Twitter with much of the same features and functionality. In fact, it has one feature working straight off the bat that Twitter users previously had to rely on <a href="http://kunal.kundaje.net/twessenger/">plugins</a> for - the ability to send messages to their page via MSN Messenger updates.<br /><br />http: //5834****** doesn't actually resolve anywhere - however, a quick Ping to that address and we have an IP:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/fanf3.html" onclick="window.open('http://blog.spywareguide.com/images/fanf3.html','popup','width=452,height=212,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/fanf3-thumb-352x165.jpg" alt="fanf3.jpg" class="mt-image-none" style="" height="165" width="352" /></a></span>
<br /><br />Click to Enlarge<br /></div><br />Type the IP address into the browser, and via some geolocational technology, you'll see a region specific version of the following dating website:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/fanf4.html" onclick="window.open('http://blog.spywareguide.com/images/fanf4.html','popup','width=780,height=564,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/fanf4-thumb-380x274.jpg" alt="fanf4.jpg" class="mt-image-none" style="" height="274" width="380" /></a></span>
<br /><br />Click to Enlarge<br /></div><br />Go back to the page on Fanfou.com, scroll down and select any of the clickable links and surprise - the same page appears. This particular account on Fanfou has something like 30+ pages devoted to endless Spim links via MSN. They link to placeholder pages, sites that look as though they've been suspended and / or deleted with no way to determine what content was there previously - all interspersed with "Twitter" style messages throughout such as this:<br /><br /><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="fanf5.jpg" src="http://blog.spywareguide.com/images/fanf5.jpg" class="mt-image-none" style="" height="27" width="208" /></span>
<br /><br />Again, note everything is coming via MSN. By this point, you're probably wondering exactly how they allow you to send messages to their Twitter-style pages. Well, the solution is quite clever - check out the <a href="http://help.fanfou.com/im.html">IM page</a>. You enter your MSN address, and when you login to your MSN account, you'll suddenly find you have a new IM buddy who wants to be a contact:<br /><br /><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="fanf6.jpg" src="http://blog.spywareguide.com/images/fanf6.jpg" class="mt-image-none" style="" height="189" width="475" /></span>
<br /><br />Add it, and whenever you want to put a message on your page, send it an <a href="http://blog.spywareguide.com/image/fanf7.jpg">instant message</a> and, lo and behold, your Tweet-style message has appeared on your page:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/fanf8.html" onclick="window.open('http://blog.spywareguide.com/images/fanf8.html','popup','width=541,height=241,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/fanf8-thumb-341x151.jpg" alt="fanf8.jpg" class="mt-image-none" style="" height="151" width="341" /></a></span><br /><br />Click to Enlarge<br /></div><br />In conclusion, the steps here appear to be<br /><br /><b>1)</b> Create a Spambot that infects users via MSN Messenger<br /><b>2)</b> Tailor the messages it sends to be short and sweet, just like a Twitter-style message<br /><b>3)</b> Set up an account on a service such as Fanfou.com that makes it easy to send messages to your page via MSN Messenger (or other IM services affected by your bot)<br /><b>4)</b> Infect the PC running your MSN Messenger account then watch as it spams the userpage with whatever messages you want it to send.<br /><br />Of course, the links can be anything from dating sites and ringtone adverts to infection files and exploits - all made so much more easier (and far less time consuming than manually typing in URLs to your userpage) by the functionality built into the site you happen to be using. It's also worth noting that the accounts sending the Spim don't <i>have</i> to be set up by the spammer - they could be compromised accounts that had been hijacked when clicking a rogue IM link, which is a great way of filling out the spamming ranks very quickly.<br /><br />This is definitely something Twitter - and any other site out there involved in <a href="http://en.wikipedia.org/wiki/Micro-blogging">microblogging</a> - need to keep an eye out for, and consider carefully when thinking of adding integration with popular Instant Messaging clients.<br /><br />We detect the file sending the weblinks via MSN as <a href="http://www.spywareguide.com/product_show.php?id=32320">Foubot</a>.<br /><br />Research and Writeup: Christopher Boyd, Director of Malware Research<br />Additional Research: Chris Mannon, Senior Threat Researcher<br /><div><br /></div>
        
    ]]></content:encoded>
      <pubDate>Thu, 07 Aug 2008 17:12:09 +0000</pubDate>
      <category domain="http://securityratty.com/tag/msn messenger">msn messenger</category>
      <category domain="http://securityratty.com/tag/msn">msn</category>
      <category domain="http://securityratty.com/tag/message">message</category>
      <category domain="http://securityratty.com/tag/msn messenger account">msn messenger account</category>
      <category domain="http://securityratty.com/tag/twitter-style message">twitter-style message</category>
      <category domain="http://securityratty.com/tag/account">account</category>
      <category domain="http://securityratty.com/tag/msn account">msn account</category>
      <category domain="http://securityratty.com/tag/twitter-style pages">twitter-style pages</category>
      <category domain="http://securityratty.com/tag/pages">pages</category>
      <source url="http://blog.spywareguide.com/2008/08/automated-spim-on-microbloggin.html">Automated Spim on Microblogging Site Via MSN Messenger</source>
    </item>
    <item>
      <title><![CDATA[Learning GovieSpeak: The Plum Book]]></title>
      <link>http://securityratty.com/article/00ebddb106bd9d06b0ced5791155ab3c</link>
      <guid>http://securityratty.com/article/00ebddb106bd9d06b0ced5791155ab3c</guid>
      <description><![CDATA[You were thinking this was part of the rainbow series, along with the orange book, the red book, and the fuchsia book, werent you
Well, no, security dweebs, were on a public policy kick, probably will...]]></description>
      <content:encoded><![CDATA[<p>You were thinking this was part of the rainbow series, along with the orange book, the red book, and the fuchsia book, weren&#8217;t you?</p>
<p>Well, no, security dweebs, we&#8217;re on a public policy kick, probably will be until the end of the year (more on that to follow, stay tuned), so you wouldn&#8217;t be so lucky.</p>
<p>The Plum Book&#8217;s official title is Government Policy and Supporting Positions and basically it&#8217;s a huge staffing chart for the Senior Executive Service&#8211;the political appointees.  Congress publishes the Plum Book after each presidential election, so for those of us who remember our civics lessons in high school, that would be every 4 years, and the last one was published in 2004.</p>
<p>In fact, you can see the <a href="http://www.gpoaccess.gov/plumbook/2004/index.html" target="_blank">last edition here</a>.  Caveat:  it&#8217;s dry, like the uber-trocken Franken white wine that grows in the fields around where I used to live in Germany&#8211;so dry that it sucks the moisture right out of you.</p>
<p style="text-align: center;"><em><img src="http://farm1.static.flickr.com/78/168193936_5653574f7c.jpg?v=0" alt="Plum Pickin" width="500" height="329" /></em></p>
<p style="text-align: center;"><em>Plum Pickin photo by <a href="http://www.flickr.com/photos/tenerife/" target="_blank">Secret Tenerife</a></em></p>
<p>Now why do we care about the Plum Book?  Well, that&#8217;s a good question.  Have a look at some of the staffing plans in the plum book, and you&#8217;ll see something missing:  Agency CISOs.</p>
<p>Now, I&#8217;m not a rocket scientist on org charts, but it seems to me that unless you put CISOs up to where they&#8217;re answerable to the agency head, they&#8217;re just a cost center inside the IT department with no visibility to the decision-makers.  Once again, we&#8217;ve crippled our security staffs like the old-school way of doing things.</p>
<p>On another note, taking a quick straw poll of the agency CISOs that I know, I think about half of them are political appointees, and half of them are GS-15s.  So what&#8217;s the difference?</p>
<p>Well, political appointees (SES) are appointed by the President.  They make a better target because they have much more visibility from the higher-ups they are more political in nature.</p>
<p>GS-scale employees are civil service careerists.  Usually these are the guys who have moved up the ranks in the various agencies and know quite a bit of things.</p>
<p>Which is better?  Well, if you want survivability, then GS-scale is the way to go.  If you want to make the most difference, SES is the ticket.</p>
<p>Most of us will never get the choice. =)</p>
<!-- Social Bookmarks BEGIN --><div class="social_bookmark"><em>Bookmark to:</em><br /><a class="social_img" onclick="window.open(this.href, '_blank', 'scrollbars=yes,menubar=no,height=600,width=750,resizable=yes,toolbar=no,location=no,status=no'); return false;" href="http://del.icio.us/post?url=http://www.guerilla-ciso.com/archives/426&amp;title=Learning+GovieSpeak%3A++The+Plum+Book" title="Add 'Learning GovieSpeak:  The Plum Book' to Del.icio.us"><img src="http://www.guerilla-ciso.com/wp-content/plugins/social_bookmarks/delicious.png" border="0" title="Add 'Learning GovieSpeak:  The Plum Book' to Del.icio.us" alt="Add 'Learning GovieSpeak:  The Plum Book' to Del.icio.us" /></a><a class="social_img" onclick="window.open(this.href, '_blank', 'scrollbars=yes,menubar=no,height=600,width=750,resizable=yes,toolbar=no,location=no,status=no'); return false;" href="http://digg.com/submit?phase=2&amp;url=http://www.guerilla-ciso.com/archives/426&amp;title=Learning+GovieSpeak%3A++The+Plum+Book" title="Add 'Learning GovieSpeak:  The Plum Book' to digg"><img src="http://www.guerilla-ciso.com/wp-content/plugins/social_bookmarks/digg.png" border="0" title="Add 'Learning GovieSpeak:  The Plum Book' to digg" alt="Add 'Learning GovieSpeak:  The Plum Book' to digg" /></a><a class="social_img" onclick="window.open(this.href, '_blank', 'scrollbars=yes,menubar=no,height=600,width=750,resizable=yes,toolbar=no,location=no,status=no'); return false;" href="http://reddit.com/submit?url=http://www.guerilla-ciso.com/archives/426&amp;title=Learning+GovieSpeak%3A++The+Plum+Book" title="Add 'Learning GovieSpeak:  The Plum Book' to reddit"><img src="http://www.guerilla-ciso.com/wp-content/plugins/social_bookmarks/reddit.png" border="0" title="Add 'Learning GovieSpeak:  The Plum Book' to reddit" alt="Add 'Learning GovieSpeak:  The Plum Book' to reddit" /></a><a class="social_img" onclick="window.open(this.href, '_blank', 'scrollbars=yes,menubar=no,height=600,width=750,resizable=yes,toolbar=no,location=no,status=no'); return false;" href="http://feedmelinks.com/categorize?from=toolbar&amp;op=submit&amp;name=Learning+GovieSpeak%3A++The+Plum+Book&amp;url=http://www.guerilla-ciso.com/archives/426&amp;version=0.7" title="Add 'Learning GovieSpeak:  The Plum Book' to Feed Me Links"><img src="http://www.guerilla-ciso.com/wp-content/plugins/social_bookmarks/feedmelinks.png" border="0" title="Add 'Learning GovieSpeak:  The Plum Book' to Feed Me Links" alt="Add 'Learning GovieSpeak:  The Plum Book' to Feed Me Links" /></a><a class="social_img" onclick="window.open(this.href, '_blank', 'scrollbars=yes,menubar=no,height=600,width=750,resizable=yes,toolbar=no,location=no,status=no'); return false;" href="http://www.technorati.com/faves?add=http://www.guerilla-ciso.com/archives/426" title="Add 'Learning GovieSpeak:  The Plum Book' to Technorati"><img src="http://www.guerilla-ciso.com/wp-content/plugins/social_bookmarks/technorati.png" border="0" title="Add 'Learning GovieSpeak:  The Plum Book' to Technorati" alt="Add 'Learning GovieSpeak:  The Plum Book' to Technorati" /></a><a class="social_img" onclick="window.open(this.href, '_blank', 'scrollbars=yes,menubar=no,height=600,width=750,resizable=yes,toolbar=no,location=no,status=no'); return false;" href="http://myweb2.search.yahoo.com/myresults/bookmarklet?u=http://www.guerilla-ciso.com/archives/426&amp;t=Learning+GovieSpeak%3A++The+Plum+Book" title="Add 'Learning GovieSpeak:  The Plum Book' to Yahoo My Web"><img src="http://www.guerilla-ciso.com/wp-content/plugins/social_bookmarks/yahoo_myweb.png" border="0" title="Add 'Learning GovieSpeak:  The Plum Book' to Yahoo My Web" alt="Add 'Learning GovieSpeak:  The Plum Book' to Yahoo My Web" /></a><a class="social_img" onclick="window.open(this.href, '_blank', 'scrollbars=yes,menubar=no,height=600,width=750,resizable=yes,toolbar=no,location=no,status=no'); return false;" href="http://www.stumbleupon.com/refer.php?url=http://www.guerilla-ciso.com/archives/426&amp;title=Learning+GovieSpeak%3A++The+Plum+Book" title="Add 'Learning GovieSpeak:  The Plum Book' to Stumble Upon"><img src="http://www.guerilla-ciso.com/wp-content/plugins/social_bookmarks/stumbleupon.png" border="0" title="Add 'Learning GovieSpeak:  The Plum Book' to Stumble Upon" alt="Add 'Learning GovieSpeak:  The Plum Book' to Stumble Upon" /></a><a class="social_img" onclick="window.open(this.href, '_blank', 'scrollbars=yes,menubar=no,height=600,width=750,resizable=yes,toolbar=no,location=no,status=no'); return false;" href="http://www.google.com/bookmarks/mark?op=edit&amp;output=popup&amp;bkmk=http://www.guerilla-ciso.com/archives/426&amp;title=Learning+GovieSpeak%3A++The+Plum+Book" title="Add 'Learning GovieSpeak:  The Plum Book' to Google Bookmarks"><img src="http://www.guerilla-ciso.com/wp-content/plugins/social_bookmarks/google.png" border="0" title="Add 'Learning GovieSpeak:  The Plum Book' to Google Bookmarks" alt="Add 'Learning GovieSpeak:  The Plum Book' to Google Bookmarks" /></a><a class="social_img" onclick="window.open(this.href, '_blank', 'scrollbars=yes,menubar=no,height=600,width=750,resizable=yes,toolbar=no,location=no,status=no'); return false;" href="http://www.squidoo.com/lensmaster/bookmark?http://www.guerilla-ciso.com/archives/426" title="Add 'Learning GovieSpeak:  The Plum Book' to Squidoo"><img src="http://www.guerilla-ciso.com/wp-content/plugins/social_bookmarks/squidoo.png" border="0" title="Add 'Learning GovieSpeak:  The Plum Book' to Squidoo" alt="Add 'Learning GovieSpeak:  The Plum Book' to Squidoo" /></a><a class="social_img" onclick="window.open(this.href, '_blank', 'scrollbars=yes,menubar=no,height=600,width=750,resizable=yes,toolbar=no,location=no,status=no'); return false;" href="http://www.bloglines.com/sub/http://www.guerilla-ciso.com/archives/426" title="Add 'Learning GovieSpeak:  The Plum Book' to Bloglines"><img src="http://www.guerilla-ciso.com/wp-content/plugins/social_bookmarks/bloglines.png" border="0" title="Add 'Learning GovieSpeak:  The Plum Book' to Bloglines" alt="Add 'Learning GovieSpeak:  The Plum Book' to Bloglines" /></a></div>
<!-- Social Bookmarks END --><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/TheGuerillaCiso?a=crtENJ"><img src="http://feeds.feedburner.com/~f/TheGuerillaCiso?i=crtENJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/TheGuerillaCiso?a=LCQUPj"><img src="http://feeds.feedburner.com/~f/TheGuerillaCiso?i=LCQUPj" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/TheGuerillaCiso/~4/338011282" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 17 Jul 2008 08:53:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/plum book">plum book</category>
      <category domain="http://securityratty.com/tag/agency cisos">agency cisos</category>
      <category domain="http://securityratty.com/tag/political">political</category>
      <category domain="http://securityratty.com/tag/political appointees">political appointees</category>
      <category domain="http://securityratty.com/tag/cisos">cisos</category>
      <category domain="http://securityratty.com/tag/cost center inside">cost center inside</category>
      <category domain="http://securityratty.com/tag/public policy kick">public policy kick</category>
      <category domain="http://securityratty.com/tag/gs-scale">gs-scale</category>
      <category domain="http://securityratty.com/tag/germanyso dry">germanyso dry</category>
      <source url="http://feeds.feedburner.com/~r/TheGuerillaCiso/~3/338011282/426">Learning GovieSpeak: The Plum Book</source>
    </item>
    <item>
      <title><![CDATA[Colorado Division of Motor Vehicles cited in audit report]]></title>
      <link>http://securityratty.com/article/dbed3997c39ebff2c2a793a72849fb6e</link>
      <guid>http://securityratty.com/article/dbed3997c39ebff2c2a793a72849fb6e</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
7/9/08

Organization
State of Colorado

Contractor/Consultant/Branch
Department of Revenue
Division of Motor Vehicles

Victims
Residents

Number...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/coloradodmv.jpg" width="200" align="right" height="101"><font size="2"><strong>Date Reported: </strong><br>7/9/08<br><br><strong>Organization: </strong><br><a href="http://www.colorado.gov/">State of Colorado</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://www.revenue.state.co.us/main/home.asp">Department of Revenue</a> <br><a href="http://www.revenue.state.co.us/mv_dir/home.asp">Division of Motor Vehicles</a> <br><br><span style="font-weight: bold;">Victims:</span><br>Residents<br><br><span style="font-weight: bold;">Number Affected:</span><br>~3,400,000<br><br><span style="font-weight: bold;">Types of Data:</span><br>"names, addresses, dates of birth and Social Security numbers"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"The Division of Motor Vehicles put 3.4 million Coloradans at risk of identity theft due to flaws in the way driver's-license information is handled, lawmakers learned Tuesday at an interim transportation committee hearing."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://origin.denverpost.com/headlines/ci_9822063">The Denver Post</a> <br><a href="http://www.leg.state.co.us/OSA/coauditor1.nsf/All/2732807492E26F3387257464005FCB5D/$FILE/1912%20DriverLicense%20Perf%20May%202008.pdf">Report of The State Auditor, Driver's License and Identification (ID) Card Security</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Jessica Fender, The Denver Post - Brought to the attention of The Breach Blog by an informed reader.<br><br><span style="font-weight: bold;">Response:</span><br>From the online source cited above:<br><br>The Division of Motor Vehicles put 3.4 million Coloradans at risk of identity theft due to flaws in the way driver's-license information is handled, lawmakers learned Tuesday at an interim transportation committee hearing.<br><br>The DMV regularly sends large batches of personal information over the Internet without encryption and has failed to properly limit access to its database, according to a recent audit.<br><em>[Evan] The audit report is <a href="http://www.leg.state.co.us/OSA/coauditor1.nsf/All/2732807492E26F3387257464005FCB5D/$FILE/1912%20DriverLicense%20Perf%20May%202008.pdf">here</a>.</em><br><br>At one point, 33 former DMV employees could access names, addresses, dates of birth and Social Security numbers — some workers more than a year after their departure<br><br>Revenue Department leaders who oversee the division say they are working to hire internal watchdogs and build up their technological defenses.<br><span style="font-style: italic;">[Evan] This is putting the cart before the horse.&nbsp; After reading some of the audit results it is clear to me that there is no information security strategy, no effective information security management, and no formal information security program.&nbsp; These administrative issues need to be addressed well before "technological defenses" should be.&nbsp; Addressing "technological defenses" first is often times wasteful and disjointed.</span><br><br>But the state, facing a budget shortfall, will have no additional money in the foreseeable future for new computer systems.<br><span style="font-style: italic;">[Evan] Then get creative!&nbsp; No or little money is a poor excuse for not doing the right thing.&nbsp; Many times, we find that an organization actually saves money through effective information security management.&nbsp; Fix the administrative issues and formalize the information security program first.&nbsp; I don't know much about the Colorado state government, but I do know that other state governments are wasteful and disorganized.&nbsp; Information security, when aligned with organizational goals and objectives (not IT) can help organize and cut waste.</span><br><br>Cyber security alone is a $1.5 million problem that will be tough to solve, said Roxy Huber, Revenue Department executive director.<br><span style="font-style: italic;">[Evan] I wonder where the $1.5 million dollar figure comes from.&nbsp; We can secure a heckuva lot of infrastructure (and information) with that kind of money.&nbsp; I get a kick out of "Cyber security".</span><br><br>"To tell you that I'm going to have the tools to do what I need to do, I don't know where they're going to come from," Huber said. "But we will continue to do the best with the tools that we have."<br><span style="font-style: italic;">[Evan] Where do I start with this comment?&nbsp; The first tool to use is the one between your ears.</span><br><br>Colorado ranks eighth in the nation in identity-theft complaints per person and first in the nation when it comes to general fraud reports.<br><span style="font-style: italic;">[Evan] This should tell you something!&nbsp; It is even more troubling if your own state government contributes to the problem.</span><br><br>On average, those frauds cost victims $4,041 each for a total of $41.3 million in 2007<br><br>Auditors said the DMV's method for handling sensitive information was "fragmented, disorganized and poorly planned," <br><span style="font-style: italic;">[Evan] Yeah, ya think?</span><br><br>No one person is responsible for security<br><span style="font-style: italic;">[Evan] Or is it no one is responsible for security?</span><br><br>High turnover - 60 percent of entry-level workers leave during their first year - and low, $26,280-a-year starting salaries make fraud more attractive and management more difficult, DMV officials said.<br><span style="font-style: italic;">[Evan] This is another problem that contributes significantly to the risk.</span><br><br>While employees have been caught issuing hundreds of fraudulent licenses, there are no known instances of identity theft or information security breaches, said Department of Revenue spokesman Mark Couch.<br><span style="font-style: italic;">[Evan] Come on.&nbsp; Not that we know of anyway.&nbsp; Don't you think that the risk is much higher if a person has already demonstrated that he/she is willing to step over the line?</span><br><br>"It's not like we have a completely defenseless system," Couch said. The audit "says that we need to take more steps."<br><span style="font-style: italic;">[Evan] Not completely defenseless, but like protecting a bicycle with a rope.</span><br><br>"Without the appropriate resources, there's no way we can hold you accountable for doing some of the things you're expected to do," said Sen. Nancy Spence, R-Centennial.<br><span style="font-style: italic;">[Evan] This kind of talk does not help the cause and does little to serve constituents.&nbsp; I am not close to this issue, but so many of the things I have read about this breach point to mismanagement more than a lack of appropriate resources.</span><br><br>Some problems already have been fixed.<br><br>The 33 former employees with database access immediately had their passwords deactivated once auditors identified them, and the DMV now compiles monthly lists of departed workers to prevent future lapses<br><br>The division has a long-standing policy of redacting the last four digits of Social Security numbers before they're transmitted, and the division plans to encrypt all transmitted information by June 2009. <br><span style="font-style: italic;">[Evan] What?&nbsp; A year?&nbsp; This exposure is now public knowledge and will continue for a year?</span><br><br><span style="font-weight: bold;">Commentary:</span><br>Due to the fact that I was a little more critical in my comments above, I should express that these are my opinions and beliefs based on my experiences and knowledge.&nbsp; Take the comments for what they are worth.<br><br>There seems like there is a lot of work that needs to be done at the Colorado Department of Revenue and Division of Motor Vehicles.&nbsp; The work must start at the top.&nbsp; Somebody needs to step up and fill the role as the "person responsible for security". <br><br><span style="font-weight: bold;">Past Breaches:</span><br><span style="font-weight: bold;">State of Colorado:</span><br>April, 2008 - <a href="http://breachblog.com/2008/04/30/collegeinvest.aspx">CollegeInvest external hard drive goes missing </a><br></font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/07/11/coloradodmv.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Fri, 11 Jul 2008 05:18:07 +0000</pubDate>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/information security">information security</category>
      <category domain="http://securityratty.com/tag/information security breaches">information security breaches</category>
      <category domain="http://securityratty.com/tag/sensitive information">sensitive information</category>
      <category domain="http://securityratty.com/tag/information security strategy">information security strategy</category>
      <category domain="http://securityratty.com/tag/information security program">information security program</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/cyber security">cyber security</category>
      <source url="http://breachblog.com/2008/07/11/coloradodmv.aspx">Colorado Division of Motor Vehicles cited in audit report</source>
    </item>
    <item>
      <title><![CDATA[Vengeance]]></title>
      <link>http://securityratty.com/article/e735bc3ded97e2908f3138b40b6495d6</link>
      <guid>http://securityratty.com/article/e735bc3ded97e2908f3138b40b6495d6</guid>
      <description><![CDATA[Jared Diamond on vengeance and human nature: This question of state government's recent origins, and, conversely, of its long failure to originate throughout most of human history, is a fundamental...]]></description>
      <content:encoded><![CDATA[<p>Jared Diamond on <a href="http://www.newyorker.com/reporting/2008/04/21/080421fa_fact_diamond">vengeance</a> and human nature:</p>

<blockquote>This question of state government's recent origins, and, conversely, of its long failure to originate throughout most of human history, is a fundamental concern for social scientists. Until fifty-five hundred years ago, there were no state governments anywhere in the world. Even as late as 1492, all of North America, sub-Saharan Africa, Australia, New Guinea, and the Pacific islands, and most of Central and South America didn't have states and instead operated under simpler forms of societal organization (chiefdoms, tribes, and bands). Today, though, the whole world map is divided into states. Of course, most of that extension of state government has involved existing states from elsewhere imposing their government on stateless societies, as happened in New Guinea. But the first state in world history, at least, must have arisen de novo, and we now know that states arose independently in many parts of the world. How did it happen?

<p>[...]</p>

<p>...anthropologists, historians, and archeologists tell us that state governments have arisen independently under one of two sets of circumstances. Sometimes external pressure from an encroaching state has placed a people under such duress that it ceded individual rights to a government of its own that would be capable of offering effective resistance. For instance, about two centuries ago, the formerly separate Cherokee chiefdoms gradually formed a unified Cherokee government in a desperate attempt to resist pressure from whites. More frequently, chronic competition among warring non-state entities has ended when one gained a military advantage over the others by developing proto-state institutions: one example is the formation of the Zulu state by a particularly talented chief named Dingiswayo, in the early nineteenth century, out of an assortment of chiefdoms fighting each other.</p>

<p>[...]</p>

<p>We regularly ignore the fact that the thirst for vengeance is among the strongest of human emotions. It ranks with love, anger, grief, and fear, about which we talk incessantly. Modern state societies permit and encourage us to express our love, anger, grief, and fear, but not our thirst for vengeance. We grow up being taught that such feelings are primitive, something to be ashamed of and to transcend.</p>

<p>There is no doubt that state acceptance of every individual's right to exact personal vengeance would make it impossible for us to coexist peacefully as fellow-citizens of the same state. Otherwise, we, too, would be living under the conditions of constant warfare prevailing in non-state societies like those of the New Guinea Highlands.</blockquote></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=iO3MBH"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=iO3MBH" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=tp7lvH"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=tp7lvH" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Thu, 29 May 2008 09:07:04 +0000</pubDate>
      <category domain="http://securityratty.com/tag/vengeance">vengeance</category>
      <category domain="http://securityratty.com/tag/cherokee government">cherokee government</category>
      <category domain="http://securityratty.com/tag/government">government</category>
      <category domain="http://securityratty.com/tag/exact personal vengeance">exact personal vengeance</category>
      <category domain="http://securityratty.com/tag/world map">world map</category>
      <category domain="http://securityratty.com/tag/world">world</category>
      <category domain="http://securityratty.com/tag/societies">societies</category>
      <category domain="http://securityratty.com/tag/stateless societies">stateless societies</category>
      <category domain="http://securityratty.com/tag/individual">individual</category>
      <source url="http://www.schneier.com/blog/archives/2008/05/vengeance.html">Vengeance</source>
    </item>
    <item>
      <title><![CDATA[A new blog on the block]]></title>
      <link>http://securityratty.com/article/c6eda6c5c1c23f51c5d135737ae9a1fb</link>
      <guid>http://securityratty.com/article/c6eda6c5c1c23f51c5d135737ae9a1fb</guid>
      <description><![CDATA[This one is not all security related, but is the ScienceLogic Blog . One of my favorite persons in the IT field Dave Link is the CEO and founder of ScienceLogic. Several other friends from Interliant...]]></description>
      <content:encoded><![CDATA[<p>This one is not all security related, but is the <a href="http://blog.sciencelogic.com/">ScienceLogic Blog</a>. One of my favorite persons in the IT field Dave Link is the CEO and founder of ScienceLogic. Several other friends from Interliant including Louis Dimiglio (sorry if I messed up the spelling Lou!), Richard Chart and Chris Cordray are also part of the team. They have done a great job of creating a network management product and in a hyper-competitive industry carving out a place for themselves. I am running into them more and more at shows, conferences and in the field. Now they have joined the blogging ranks and it looks like there will be several contributers. They are all smart folks and I am sure will have good things to say, so be sure to check out the blog!<br><br>In one article responding to <a href="http://www.stillsecureafteralltheseyears.com/ashimmy/2008/05/is-interop-abou.html">a post I did</a> about where is the interoperational in interop, Dave says that he and the ScienceLogic team had a very different experience at Interop this year. Due to their participation in the InteropNet and ILabs project, ScienceLogic was very involved in making sure the network at Interop was up and running and showing off the many different products and vendors working together. Certainly the work of the many people at Interop Labs and Interop Net show how heterogeneous equipment and technology can work together, but where those labs and network used to be the center of the show, I am not so sure that is the case any more. Many folks walk by the NOC at Interop, peak inside at the folks at the stations, smile and move on. How many actually take the tour compared to how many walk the floor or sit in on presentations. I think in Dave's view it is a case of when you are a hammer, everything looks like a nail. <br><br>More importantly though Dave challenges me to answer his questions of what StillSecure has done to promote interoperability with other vendors that we can promote. Great question and it deserves an answer. So at the risk of giving StillSecure a shameless plug, let me give you the three foundations that we have built our products on that allow us to excel at interoperability:<br><br>1. Using open standard software and hardware - All StillSecure products run on off the shelf x86 hardware or in VMware virtual machines. Additionally, our products all run on top of the StillSecure OS which is a hardened and stripped version of Linux, but still provides that standard command line programs and interoperability that the Linux OS allows. Additionally, we use standard and open databases such as MySQL and PostgresSQL that are SQL and ODBC compliant. Additionally, we have open data base schema's. Also, we use Java webservers and similar types of open standard software that makes it easier for us to work with other products and for our customers to feel comfortable with what is under the hood.<br><br>2. Support of industry frameworks and standards - Whether it be TCG/TNC or NAP in the NAC world or CVE and FDCC in vulnerability management, we support industry wide standards and frameworks which allow products to work with each other. SNMP traps, SMTP email alerts are all standard in StillSecure products. <br><br>3. Enterprise Integration Frameworks- StillSecure products all ship with our enterprise integration frameworks. These are a complete set of fully documented and functional APIs in XML and Java that allow for the bi-directional exchange of data with many 3rd party products. This is perhaps our greatest means of interoperabitility and integration.<br><br>Dave, I hope that answered the question for you. Now that we know about the blog, we will be reading. Good Luck!</p>
<p><a href="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?a=XJ9nCZ"><img src="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?i=XJ9nCZ" border="0"></img></a></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=J4boaH"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=J4boaH" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=qxf5IH"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=qxf5IH" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=M6zc3H"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=M6zc3H" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=FOtHhH"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=FOtHhH" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=OvhO7h"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=OvhO7h" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=aMYMph"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=aMYMph" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~4/292083057" height="1" width="1"/>]]></content:encoded>
      <pubDate>Fri, 16 May 2008 19:36:19 +0000</pubDate>
      <category domain="http://securityratty.com/tag/blog">blog</category>
      <category domain="http://securityratty.com/tag/stillsecure products">stillsecure products</category>
      <category domain="http://securityratty.com/tag/products">products</category>
      <category domain="http://securityratty.com/tag/stillsecure">stillsecure</category>
      <category domain="http://securityratty.com/tag/3rd party products">3rd party products</category>
      <category domain="http://securityratty.com/tag/labs">labs</category>
      <category domain="http://securityratty.com/tag/interop labs">interop labs</category>
      <category domain="http://securityratty.com/tag/interop">interop</category>
      <category domain="http://securityratty.com/tag/dave">dave</category>
      <source url="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~3/292083057/a-new-blog-on-t.html">A new blog on the block</source>
    </item>
    <item>
      <title><![CDATA[Personal information from two Colorado mortgage companies found in dumpsters]]></title>
      <link>http://securityratty.com/article/7ae56d34b365648af4041ccd173db81f</link>
      <guid>http://securityratty.com/article/7ae56d34b365648af4041ccd173db81f</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
4/28/08

Organization
Cove Creek Mortgage
Front Range Mortgage, LLC

Contractor/Consultant/Branch
None

Victims
Customers

Number Affected
Unknown

Types...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/covecreek.jpg" align="right" height="82" width="167"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>4/28/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.covecreekmortgage.com/">Cove Creek Mortgage</a> <br><a href="http://www.frontrangemortgage.com/">Front Range Mortgage, LLC</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Customers<br><br><span style="font-weight: bold;">Number Affected:</span><br>Unknown<br><br><span style="font-weight: bold;">Types of Data:</span><br>Mortgage files, tax returns, pay stubs, Social Security numbers, and other personal information<br><br><span style="font-weight: bold;">Breach Description:</span><br>"ENGLEWOOD, Colo. -- The Arapahoe County District Attorney's Office is advising anyone who has used Cove Creek Mortgage to watch out for identity theft after hundreds of mortgage files were dumped in a public trash bin over the weekend."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.thedenverchannel.com/news/16038972/detail.html">Denver Channel 7 News</a> <br><a href="http://www.thedenverchannel.com/news/16064711/detail.html">Denver Channel 7 News (update)</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Denver Channel 7 News<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>ENGLEWOOD, Colo. -- The Arapahoe County District Attorney's Office is advising anyone who has used Cove Creek Mortgage to watch out for identity theft after hundreds of mortgage files were dumped in a public trash bin over the weekend.<br><span style="font-style: italic;">[Evan] Cove Creek Mortgage joins the ranks of other mortgage companies reported for similar breaches on The Breach Blog.&nbsp; The others are </span><a style="font-style: italic;" href="http://breachblog.com/2008/03/19/affordable.aspx">Affordable Realty</a><span style="font-style: italic;"> and </span><a style="font-style: italic;" href="http://breachblog.com/2008/02/29/unionmortgage.aspx">Union Mortgage Services of Cleveland, Inc.</a><span style="font-style: italic;">. </span><br><br>Cove Creek's owner had abandoned his Englewood office in January, and property managers had not been able to find him<br><i>[Evan] What kind of businessman just abandons an office full of confidential files and equipment?</i><br><br>On Saturday, the property manager had a crew clean out his office and throw all items from the office -- including complete mortgage files -- into two Dumpsters.<br><i>[Evan] Maybe the property manager should pay a little closer attention to the things they throw in the dumpster.&nbsp; Having said this, the property manager is not really at fault.</i><br><br>David Peters who works in the same complex found the files Monday morning.<br><br>"I was taking some other trash out to the garbage can and opened the lid and on there was a couple of laptops,"<br><br>"Directly underneath them were files with people's names on it and I was like, 'Well, this is not right.'"<br><br>"There were tax returns, pay stubs, everything in there," he said. "And as I looked at the different files I realized that it was mortgage files, which was kind of scary, because who do you disclose the most information to or all of your information? That is when you are getting a mortgage loan."<br><i>[Evan] According to the news report, Mr. Peters contacted authorities.&nbsp; This could have easily been much worse for victims.</i><br><br>The Dumpsters were not secured and located at 88 Inverness Drive East, Bldg. F.<br><br>Sheriff's investigators finally found the owner of Cove Creek and talked him into retrieving the files, many of which had private information, including Social Security numbers and credit history.<br><span style="font-style: italic;">[Evan] Mr. owner guy, will you please come get your stuff and the personal information that was entrusted to you?&nbsp; According to </span><a style="font-style: italic;" href="http://www.zoominfo.com/Search/PersonDetail.aspx?PersonID=41991084">zoominfo</a><span style="font-style: italic;"> a guy named Charlie Cartwright is/was the president of Cove Creek Mortgage.&nbsp; I have no idea if this is the same guy that is referred to in the news article.</span><br><br>The district aAttorney's office got a tip about numerous mortgage files and two laptop computers in a Dumpster behind offices formerly used by Cove Creek Mortgage and Front Range Mortgage.<br><i>[Evan] Now Front Range Mortgage joins the ranks.&nbsp; Front Range Mortgage offers <a href="http://www.frontrangemortgage.com/credit_consultants.html">credit repair services</a> too! Do you suppose they could have repaired the damage that could have been done?</i><br><br>"With a name, Social Security number and bank account number, they can clean you out before you even know," said Arapahoe County District Attorney Carol Chambers.<br><br>The files and computers contained sensitive information on many former customers of Front Range Mortgage, including names and addresses, Social Security numbers and bank, credit card and investment account information.<br><br>While there are civil laws against dumping such documentation, Chambers said it is not against the law.<br><i>[Evan] It's too bad that we have to write and enforce laws to protect us from idiots.</i><br><br>"I think it is a matter of legislation not catching up with the realities of identity theft," said Chambers. "And absolutely, we think recklessly disposing or negligently disposing of this kind of information should maybe carry a criminal penalty, just to get people's attention that you can't just leave this information or leave it out in a Dumpster."<br><br>"The district attorney recommends that any former customers of Front Range or Cove Creek should place a fraud alert on their credit reports and monitor any bank, credit card or investment accounts that might have been included on a mortgage application with that firm."<br><br>For further information, assistance or questions, call the District Attorney's Fraud Assistance Line at 720-874-8547.<br><br><b>Commentary:</b><br>What is with these mortgage companies?&nbsp; The 90's and early 2000's was a wild ride for mortgage brokers, real estate agents, and investors.&nbsp; The money attracted people from all walks of life and a lot of poor decisions were made.&nbsp; Now that the bubble has burst, we start to see the true colors of some of these "professionals".<br><br>I don't know much if anything about the owners of these companies, but I do know that securing personal information poorly is bad business. <br><br><b>Past Breaches:</b><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/05/07/covecreek.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Wed, 07 May 2008 18:20:50 +0000</pubDate>
      <category domain="http://securityratty.com/tag/mortgage files">mortgage files</category>
      <category domain="http://securityratty.com/tag/numerous mortgage files">numerous mortgage files</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/complete mortgage files">complete mortgage files</category>
      <category domain="http://securityratty.com/tag/personal information poorly">personal information poorly</category>
      <category domain="http://securityratty.com/tag/files">files</category>
      <category domain="http://securityratty.com/tag/cove creek mortgage">cove creek mortgage</category>
      <category domain="http://securityratty.com/tag/cove creek">cove creek</category>
      <source url="http://breachblog.com/2008/05/07/covecreek.aspx">Personal information from two Colorado mortgage companies found in dumpsters</source>
    </item>
    <item>
      <title><![CDATA[Health care practices and UCSF patient records exposed]]></title>
      <link>http://securityratty.com/article/7cab17fdc352275114a54ec17a2e2887</link>
      <guid>http://securityratty.com/article/7cab17fdc352275114a54ec17a2e2887</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
5/1/08

Organization
University of California

Contractor/Consultant/Branch
University of California at San Francisco (&quot;UCSF
Target America Inc

Victims...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/ucsf.jpg" align="right" height="54" width="79"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>5/1/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.universityofcalifornia.edu/">University of California</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://www.ucsf.edu/">University of California at San Francisco ("UCSF")</a> <br><a href="http://www.tgtam.com">Target America Inc.</a> <br><br><span style="font-weight: bold;">Victims:</span><br>Patients<br><br><span style="font-weight: bold;">Number Affected:</span><br>6,313<br><br><span style="font-weight: bold;">Types of Data:</span><br>"The information included names, addresses, medical departments and some patient medical record numbers"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"(05-01) 17:22 PDT San Francisco -- Information on thousands of UCSF patients was accessible on the Internet for more than three months last year, a possible violation of federal privacy regulations that might have exposed the patients to medical identity theft"<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.sfgate.com/cgi-bin/article.cgi?f=/c/a/2008/05/02/MNKE10DRGN.DTL">San Francisco Chronicle</a> <br><a href="http://www.news.com/8301-10784_3-9934612-7.html">CNET</a> <br><a href="http://www.upi.com/NewsTrack/Science/2008/05/03/hospital_data_left_open_online/2530/">United Press International</a> <br><a href="http://pub.ucsf.edu/newsservices/releases/200805051/">UCSF News Release</a> <br><br><b>Report Credit:</b><br>Elizabeth Fernandez, San Francisco Chronicle<br><br><b>Response:</b><br>From the online sources cited above:<br><br>Information on thousands of UCSF patients was accessible on the Internet for more than three months last year, a possible violation of federal privacy regulations that might have exposed the patients to medical identity theft, The Chronicle has learned.<br><br>The information accessible online included names and addresses of patients along with names of the departments where medical care was provided.<br><br>Some patient medical record numbers and the names of the patients' physicians also were available online.<br><br>The breach was discovered Oct. 9, but the medical institution did not send out notification letters to the 6,313 affected patients until early April, nearly six months later.<br><br>Sensitive information can be used by employers, health insurers and other entities to discriminate<br><br>thieves can use purloined information to obtain medical treatment and prescription drugs and to file false medical claims.<br><i>[Evan] Purloined is a funny word.&nbsp; </i><br><br>"This is a large and very significant data breach," said Pam Dixon, executive director of the World Privacy Forum<br><br>"To commit medical identity theft, all you need is a patient's name, address and the name of the hospital. If you have a doctor's name and the medical department where the patient was being treated, it is gold. If you add a medical record number, it is a disaster for patients."<br><i>[Evan] I don't think most people know this.&nbsp; Many people think that they are fine if there were no Social Security numbers or credit card numbers exposed.</i><br><br>Hospital officials say there's no indication of identity theft to date.<br><br>UCSF had shared information on its patients with a vendor, Target America Inc., which mines electronic databases amassing information about a nonprofit's potential or existing donors.<br><br>Target America, whose Web site says it maintains "the highest standards of security," tunnels through millions of electronic records to help nonprofits identify and cultivate future donors as well as current donors "who could be giving you more." Additionally, it unearths financial information about donor friends and business acquaintances - even offering maps of a donor's neighborhood.<br><i>[Evan] Seems wrong, doesn't it?&nbsp; You go to the clinic, the clinic farms out your information to a company that determines whether or not you are a good candidate to hit up for money (you probably don't pay enough in health insurance, deductibles and co-pays).&nbsp; If you are a deemed a good donor candidate, you get emails and letters that you never signed up for.&nbsp; The purpose of the emails and letters is to build a rapport with you with the intention of getting you to donate money.&nbsp; Personally, I would be more willing to donate if an organization were straight with me.</i><br><br>The breach was discovered, said UCSF officials, when the hospital was alerted that a patient's name had been queried on the Internet "and it was listed in association with UCSF."<br><br>Corinna Kaarlela, UCSF director of news services, said immediate action was taken to close off the information. Ten days after the breach's discovery, UCSF ended its business agreement with Target America.<br><br>Nancy Johnson, president of Target America, said she could not discuss the matter because of client confidentiality.<br><i>[Evan] There is no mention of this breach anywhere on Target America's site either.&nbsp; Sweep it under the rug and maybe it will go away?</i><br><br>The breach spotlights a little-known practice among medical institutions to plow the ranks of patients for fundraising purposes.<br><br>Hospitals and other health care providers are turning patients into "fundraising free-fire zones," said Dr. Arthur Caplan, chairman of the department of medical ethics at the University of Pennsylvania School of Medicine.<br><br>"The breach is a symptom, but the real ethics challenge is the extent to which health care institutions are tracking patients and their families for nonmedical reasons - for fundraising, marketing, advertising," Caplan said. "I don't think people are aware of the degree to which this is occurring, whether it's by a hospital or a nursing home or a hospice."<br><br>Since 2004, UCSF said it provided the names and addresses of 30,590 patients to Target America, paying the company $12,000 a year.<br><br>Hospital officials said it contracted with the company to assist "with identifying names of individuals who could potentially receive communications from UCSF."<br><i>[Evan] Why not say it like it is.&nbsp; The true motive?</i><br><br>"These opportunities included upcoming events, developments in specific UCSF programs, and opportunities to support the University."<br><i>[Evan] Closer.</i><br><br>After the breach was discovered, the hospital said it required Target America to hire "an objective third-party firm" to investigate. UCSF received the forensic analysis report March 26. It showed that information was potentially accessible from July 1 to Oct. 9 last year "if a query for a specific name was made." Notification letters were mailed to patients April 4.<br><br>While UCSF officials stressed that the breach did not involve Social Security numbers, Dixon said that patients could nonetheless be at risk for harm.<br><br>"With medical identity theft, there is so much on the line - only minimal information needs to go out for there to be a problem," she said.<br><br>Linking patients to the departments where they were treated, for instance, is problematic because it can serve as a key identifier of a patient's health condition.<br><i>[Evan] Don't think that this doesn't happen.&nbsp; Insurance companies are not in business to help people, they are in business to make money.&nbsp; They want to identify as many pre-existing conditions as possible.</i><br><br>UCSF officials say the use of a department's name is not prohibited under HIPAA. But it acknowledged that such a disclosure is against its own "best practice" policy.<br><i>[Evan] I think that this is open to interpretation.&nbsp; HIPAA is not clear (nor can it be) in all circumstances, and some people would argue this claim with UCSF officials.</i><br><br>"Steps have been taken to reinforce this practice," <br><i>[Evan] Like what?&nbsp; Are "steps" enough?</i><br><br>For one outraged UCSF patient whose name was part of the online data disclosure, the incident involved an alarming breach of medical trust.<br><br>"They told a fundraising company that I'm a patient - morally this should not ever be done by any health care provider," said the patient, a retired executive living in San Francisco. He asked that his name not be published. <br><br>"Medical records are supposed to be of utmost privacy," he said. "The University of California is high up in the totem pole for quality medical care. When you go there, the first thing you see are notices regarding patient privacy. Why in the world would they give out my private information? It boils down to monetary greed."<br><i>[Evan] There is no doubt that UCSF Medical Center is an outstanding health provider in terms of providing innovative medical care and saving lives.&nbsp; One of the best from what I read.</i><br><br>UCSF is committed to maintaining the privacy of patient information and takes any compromise of patient information very seriously. When patients are seen at UCSF, they are provided with a Notice of Privacy Practice (NOPP), which describes how UCSF may use and disclose their medical information in accordance with the Federal HIPAA Privacy Rule.<br><br>UCSF continually modifies systems and practices to enhance the security of patient information.<br><br><b>Commentary:</b><br>Hmm.&nbsp; I agree with Dr. Caplan when he stated that "The breach is a symptom, but the real ethics challenge is the extent to which health care institutions are tracking patients and their families for nonmedical reasons - for fundraising, marketing, advertising,".&nbsp; There is not much discussion surrounding the details of the actual breach itself.&nbsp; I have also read concern of the length of time it took before patients were notified.<br><br>From Target America's "<a href="http://www.tgtam.com/why.php">Why Target America?</a>" page:<br>"Target America data base, culled from 75 data sources, contains more than 7 million records of the wealthiest and most generous people in the nation -- the top 5 percent in terms of income, assets, and philanthropic history. Ninety-four percent of the individuals on the data base give more than $5,000 a year to charities. The breadth of our data is unique: we focus not only on high-profile, corporate America, but include emerging sources of wealth such as minority-owned business and women entrepreneurs."<br>Looks like a pretty important database to me.&nbsp; <br><br>There are no apologies made by UCSF or Target America for the breach. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>University of California:<br>April, 2008 - <a href="http://breachblog.com/2008/04/10/uci.aspx">University of California Irvine students are hit with mysterious breach</a> </font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/05/07/ucsf.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Wed, 07 May 2008 12:10:17 +0000</pubDate>
      <category domain="http://securityratty.com/tag/ucsf">ucsf</category>
      <category domain="http://securityratty.com/tag/ucsf patient">ucsf patient</category>
      <category domain="http://securityratty.com/tag/ucsf patients">ucsf patients</category>
      <category domain="http://securityratty.com/tag/patients">patients</category>
      <category domain="http://securityratty.com/tag/patient">patient</category>
      <category domain="http://securityratty.com/tag/sensitive information">sensitive information</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/patient information">patient information</category>
      <category domain="http://securityratty.com/tag/ucsf medical center">ucsf medical center</category>
      <source url="http://breachblog.com/2008/05/07/ucsf.aspx">Health care practices and UCSF patient records exposed</source>
    </item>
    <item>
      <title><![CDATA[Blackhat SEO Campaign at The Millennium Challenge Corporation]]></title>
      <link>http://securityratty.com/article/ec2c6865148c07bfe81830fa39e7e4e3</link>
      <guid>http://securityratty.com/article/ec2c6865148c07bfe81830fa39e7e4e3</guid>
      <description><![CDATA[Among the very latest victims of a successful blackhat SEO campaign that has managed to inject and locally host 1,370 pharmaceutical pages, is the Millennium Challenge Corporation ( mcc.gov ) - a...]]></description>
      <content:encoded><![CDATA[<a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://bp1.blogger.com/_wICHhTiQmrA/SCFovdDpjaI/AAAAAAAABrU/QxHGsXApvyI/s1600-h/MCC_blackhat_SEO1.jpg"><img style="margin: 0pt 10px 10px 0pt; float: left; cursor: pointer;" src="http://bp1.blogger.com/_wICHhTiQmrA/SCFovdDpjaI/AAAAAAAABrU/QxHGsXApvyI/s200/MCC_blackhat_SEO1.jpg" alt="" id="BLOGGER_PHOTO_ID_5197550609425337762" border="0" /></a>Among the very latest victims of a successful blackhat SEO campaign that has managed to inject and locally host 1,370 pharmaceutical pages, is the Millennium Challenge Corporation (<span style="font-weight: bold;">mcc.gov</span>) - a United States Government  corporation designed to work with some of the poorest countries in the world.<br /><br />The injected pages are loading remote images from what looks like a secondary compromised site, in this case <span style="font-weight: bold;">ttv-bit.nl</span> which is a legitimate Dutch table tennis association. Compared to previous blackhat SEO campaigns that I've assessed in the past taking advantage of redirection only, the layout of the embedded pages in this one is sticking the remotely loading images at the top of the page, and placing the original at the bottom.<br /><br />The campaign's main URl is <span style="font-weight: bold;">ttv-bit.nl/rr/c.php</span> where a redirector is forwarding to <span style="font-weight: bold;">canadiandiscountsmeds.com, </span>and these are some of the remotely loading images <span style="font-weight: bold;">ttv-bit.nl/rr/s.JPG</span>; <span style="font-weight: bold;">ttv-bit.nl/rr/l.JPG</span>; <span style="font-weight: bold;">ttv-bit.nl/rr/c.JPG</span>; <span style="font-weight: bold;">ttv-bit.nl/rr/v.JPG</span><br /><span style="font-weight: bold;"><br /></span><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://bp1.blogger.com/_wICHhTiQmrA/SCFqVdDpjbI/AAAAAAAABrc/zZ6fEDQH7-M/s1600-h/MCC_blackhat_SEO2.JPG"><img style="margin: 0pt 10px 10px 0pt; float: left; cursor: pointer;" src="http://bp1.blogger.com/_wICHhTiQmrA/SCFqVdDpjbI/AAAAAAAABrc/zZ6fEDQH7-M/s200/MCC_blackhat_SEO2.JPG" alt="" id="BLOGGER_PHOTO_ID_5197552361771994546" border="0" /></a>Moreover, as in the recent massive SEO poisoning attacks, the referrer is checked, and given that the campaign URL is dedicated to <span style="font-weight: bold;">mcc.gov</span> only, only <span style="font-weight: bold;">mcc.gov</span> referrers are directed to the spam pages.  These blackhat SEO incidents targeting sites with high page ranks, are either the result of the automated process of searching for vulnerable such high page rank-ed sites, or direct abuse of purchased access to the already compromised hosts via web shells or web backdoors.<br /><span style="font-weight: bold;"><br />Related posts:<br /></span><a href="http://ddanchev.blogspot.com/2008/03/massive-iframe-seo-poisoning-attack.html">Massive IFRAME SEO Poisoning Attack Continuing</a><br /><a href="http://ddanchev.blogspot.com/2008/02/massive-blackhat-seo-targeting-blogspot.html">Massive  Blackhat SEO Targeting Blogspot</a><br /><a href="http://ddanchev.blogspot.com/2008/01/invisible-blackhat-seo-campaign.html">The  Invisible Blackhat SEO Campaign</a><br /><a href="http://ddanchev.blogspot.com/2007/01/attack-of-seo-bots-on-edu-domain.html">Attack  of the SEO Bots on the .EDU Domain</a><br /><a href="http://ddanchev.blogspot.com/2007/11/p0rngov-ongoing-blackhat-seo-operation.html">p0rn.gov  - The Ongoing Blackhat SEO Operation</a><br /><a href="http://ddanchev.blogspot.com/2008/02/continuing-gov-blackat-seo-campaign.html">The Continuing .Gov Blackat SEO Campaign</a><br /><a href="http://ddanchev.blogspot.com/2008/02/continuing-gov-blackat-seo-campaign_25.html">The Continuing .Gov Blackhat SEO Campaign - Part Two</a><br /><a href="http://ddanchev.blogspot.com/2007/10/compromised-sites-serving-malware-and.html">Compromised Sites Serving Malware and Spam</a><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=WK4nDH"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=WK4nDH" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=7FqKBH"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=7FqKBH" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=ot1mth"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=ot1mth" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=8Mugih"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=8Mugih" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=dVELpH"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=dVELpH" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=Jc4P0H"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=Jc4P0H" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=HquZDh"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=HquZDh" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/285235999" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 06 May 2008 23:57:19 +0000</pubDate>
      <category domain="http://securityratty.com/tag/images">images</category>
      <category domain="http://securityratty.com/tag/images ttv-bit">images ttv-bit</category>
      <category domain="http://securityratty.com/tag/sites">sites</category>
      <category domain="http://securityratty.com/tag/page rank-ed sites">page rank-ed sites</category>
      <category domain="http://securityratty.com/tag/ttv-bit">ttv-bit</category>
      <category domain="http://securityratty.com/tag/spam pages">spam pages</category>
      <category domain="http://securityratty.com/tag/spam">spam</category>
      <category domain="http://securityratty.com/tag/campaign">campaign</category>
      <category domain="http://securityratty.com/tag/pages">pages</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/285235999/blackhat-seo-campaign-at-millennium.html">Blackhat SEO Campaign at The Millennium Challenge Corporation</source>
    </item>
    <item>
      <title><![CDATA[Heroin vs. Terrorism]]></title>
      <link>http://securityratty.com/article/7064e04b2c65417229b7a9a8d2678d22</link>
      <guid>http://securityratty.com/article/7064e04b2c65417229b7a9a8d2678d22</guid>
      <description><![CDATA[A nice essay on security trade-offs: The mismatch between the resources devoted to fighting organised crime compared with those directed towards counter-terrorism is unnerving. Government says that...]]></description>
      <content:encoded><![CDATA[<p>A nice <a href="http://www.timesonline.co.uk/tol/comment/columnists/guest_contributors/article3835351.ece">essay</a> on security trade-offs:</p>

<blockquote>The mismatch between the resources devoted to fighting organised crime compared with those directed towards counter-terrorism is unnerving. Government says that there are millions of pounds in police budgets that should be devoted to dealing with organised crime. In truth, only a handful of British police forces know how to tackle it. The ridiculous Victorian patchwork of shire constabularies means that most are too small to tackle serious criminality that doesn't recognise country, never mind county, borders.

<p>The Serious Organised Crime Agency (Soca) was launched two years ago as Britain's equivalent of the FBI, with the remit of taking on the Mr Bigs of international crime. But ministers have trimmed Soca's budget this year. Far from expanding to counter the ever-growing threat, the agency is shrinking and there is smouldering unhappiness in the ranks. Soca's budget for taking the fight to the cartels and syndicates is £400 million -- exactly the same amount that the Government intends to spend overseas in countries such as Pakistan on workshops and seminars to counter al-Qaeda's ideology.</blockquote></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=3WNrwH"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=3WNrwH" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=jzaRYH"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=jzaRYH" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Thu, 01 May 2008 02:56:21 +0000</pubDate>
      <category domain="http://securityratty.com/tag/crime">crime</category>
      <category domain="http://securityratty.com/tag/international crime">international crime</category>
      <category domain="http://securityratty.com/tag/crime agency">crime agency</category>
      <category domain="http://securityratty.com/tag/agency">agency</category>
      <category domain="http://securityratty.com/tag/government intends">government intends</category>
      <category domain="http://securityratty.com/tag/soca">soca</category>
      <category domain="http://securityratty.com/tag/government">government</category>
      <category domain="http://securityratty.com/tag/british police forces">british police forces</category>
      <category domain="http://securityratty.com/tag/ridiculous victorian patchwork">ridiculous victorian patchwork</category>
      <source url="http://www.schneier.com/blog/archives/2008/05/heroin_vs_terro.html">Heroin vs. Terrorism</source>
    </item>
  </channel>
</rss>
