<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: real-time]]></title>
    <link>http://securityratty.com/tag/real-time</link>
    <description></description>
    <pubDate>Wed, 12 Nov 2008 18:35:55 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[The Good Get Conned-When Trust is Biological]]></title>
      <link>http://securityratty.com/article/3190bf9fa3c48c293c4965ef526cb117</link>
      <guid>http://securityratty.com/article/3190bf9fa3c48c293c4965ef526cb117</guid>
      <description><![CDATA[Bruce Schnier linked to an interesting article a while back, discussing how brain chemistry causes you to trust people when demonstrate that they trust you, especially when theyre relying on you and...]]></description>
      <content:encoded><![CDATA[<p>Bruce Schnier<a rel="nofollow" target="_blank" href="http://www.schneier.com/blog/archives/2008/11/the_neuroscienc.html"> linked </a>to an interesting article a while back, discussing how brain chemistry causes you to trust people when demonstrate that they trust you, especially when they&#8217;re relying on you and may be vulnerable&#8230;interesting stuff:</p>
<blockquote><p>THOMAS is a powerful brain circuit that releases the neurochemical oxytocin when we are trusted and induces a desire to reciprocate the trust we have been shown&#8211;even with strangers. The key to a con is not that you trust the conman, <em>but that he shows he trusts you</em>. Conmen ply their trade by appearing fragile or needing help, by seeming vulnerable. Because of THOMAS, the human brain makes us feel good when we help others&#8211;this is the basis for attachment to family and friends and cooperation with strangers</p></blockquote>
<p>So my question: if real-life cons can easily<a rel="nofollow" target="_blank" href="http://blogs.psychologytoday.com/blog/the-moral-molecule/200811/how-run-a-con"> scam people</a> by appearing to depend on them, how does this affect the scams we see on the Net? Clearly some online cons rely on this method &#8212; the Nigerian bank scam being a prime example. It seems like social engineering scams particularly rely on this method &#8212; but not all scams. And of course many other vulnerabilities just seem to rely on people&#8217;s habits to just click links willy-nilly online, which is an impersonal event. If the net were a more personal place, we might see many more of those kinds of scams.</p>]]></content:encoded>
      <pubDate>Mon, 01 Dec 2008 11:00:35 +0000</pubDate>
      <category domain="http://securityratty.com/tag/trust">trust</category>
      <category domain="http://securityratty.com/tag/trust people">trust people</category>
      <category domain="http://securityratty.com/tag/online cons rely">online cons rely</category>
      <category domain="http://securityratty.com/tag/rely">rely</category>
      <category domain="http://securityratty.com/tag/scams">scams</category>
      <category domain="http://securityratty.com/tag/easily scam people">easily scam people</category>
      <category domain="http://securityratty.com/tag/nigerian bank scam">nigerian bank scam</category>
      <category domain="http://securityratty.com/tag/powerful brain circuit">powerful brain circuit</category>
      <category domain="http://securityratty.com/tag/impersonal event">impersonal event</category>
      <source url="http://feeds.feedburner.com/~r/itsecurity/~3/471798036/">The Good Get Conned-When Trust is Biological</source>
    </item>
    <item>
      <title><![CDATA[FBI Stoking Fear]]></title>
      <link>http://securityratty.com/article/42b3e4fb9c51c77ab790e583dada33f4</link>
      <guid>http://securityratty.com/article/42b3e4fb9c51c77ab790e583dada33f4</guid>
      <description><![CDATA[Another unsubstantiated terrorist plot: An internal memo obtained by The Associated Press says the FBI has received a &quot;plausible but unsubstantiated&quot; report that al-Qaida terrorists in late September...]]></description>
      <content:encoded><![CDATA[<p>Another <a href="http://www.google.com/hostednews/ap/article/ALeqM5j1NEBSpGCN1_9rZCXTwXBcnNXOxAD94MNT4O0">unsubstantiated</a> terrorist plot:</p>

<blockquote>An internal memo obtained by The Associated Press says the FBI has received a "plausible but unsubstantiated" report that al-Qaida terrorists in late September may have discussed attacking the subway system.

<p>[...]</p>

<p>The internal bulletin says al-Qaida terrorists "in late September may have discussed targeting transit systems in and around New York City. These discussions reportedly involved the use of suicide bombers or explosives placed on subway/passenger rail systems," according to the document.</p>

<p>"We have no specific details to confirm that this plot has developed beyond aspirational planning, but we are issuing this warning out of concern that such an attack could possibly be conducted during the forthcoming holiday season," according to the warning dated Tuesday.</p>

<p>[...]</p>

<p>Rep. Peter King, the top Republican on the House Homeland Security Committee, said authorities "have very real specifics as to who it is and where the conversation took place and who conducted it."</p>

<p>"It certainly involves suicide bombing attacks on the mass transit system in and around New York and it's plausible, but there's no evidence yet that it's in the process of being carried out," King said.</p>

<p>Knocke, the DHS spokesman, said the warning was issued "out of an abundance of caution going into this holiday season."</blockquote></p>

<p>Got that:  "plausible but unsubstantiated," "may have discussed attacking the subway system," "specific details to confirm that this plot has developed beyond aspirational planning," "attack could possibly be conducted," "it's plausible, but there's no evidence yet that it's in the process of being carried out."</p>

<p>I have no specific details, but I want to warn everybody today that fiery rain might fall from the sky.  Terrorists may have discussed this sort of tactic, and while there is no evidence yet that it's in the process of being carried out, I want to be extra-cautious this holiday season.  Ho ho ho.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=uxqxN"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=uxqxN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=hww2N"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=hww2N" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Thu, 27 Nov 2008 09:27:35 +0000</pubDate>
      <category domain="http://securityratty.com/tag/holiday season">holiday season</category>
      <category domain="http://securityratty.com/tag/specific details">specific details</category>
      <category domain="http://securityratty.com/tag/al-qaida terrorists">al-qaida terrorists</category>
      <category domain="http://securityratty.com/tag/terrorists">terrorists</category>
      <category domain="http://securityratty.com/tag/terrorist plot">terrorist plot</category>
      <category domain="http://securityratty.com/tag/subway system">subway system</category>
      <category domain="http://securityratty.com/tag/plausible">plausible</category>
      <category domain="http://securityratty.com/tag/plot">plot</category>
      <category domain="http://securityratty.com/tag/mass transit system">mass transit system</category>
      <source url="http://www.schneier.com/blog/archives/2008/11/fbi_stoking_fea.html">FBI Stoking Fear</source>
    </item>
    <item>
      <title><![CDATA[Is That a Coffee Table or a Munition?]]></title>
      <link>http://securityratty.com/article/bcc3ebc100f5b51c419148587e587e92</link>
      <guid>http://securityratty.com/article/bcc3ebc100f5b51c419148587e587e92</guid>
      <description><![CDATA[One of the standard software security prescriptions for the SDLC is to data classification and enforce least privilege. From a security perspective this sounds fantastic, especially on a whiteboard....]]></description>
      <content:encoded><![CDATA[<p>One of the standard software security prescriptions for the SDLC is to data classification and enforce least privilege. From a security perspective this sounds fantastic, especially on a whiteboard. When the rubber meets the real world road, things often turn out slightly different.&#0160;</p><br /><div>It turns out that it is hard to conduct business with excessive granularity.</div><div><a href="http://1raindrop.typepad.com/.a/6a00d83451c75869e201053619a7a7970b-pi" style="display: inline;"><a href="http://www.economist.com/displaystory.cfm?story_id=11965352"><img alt="D3408BB1" class="at-xid-6a00d83451c75869e201053619a7a7970b " src="http://1raindrop.typepad.com/.a/6a00d83451c75869e201053619a7a7970b-320wi" /></a></a><span style="font-family: &#39;Trebuchet MS&#39;; ">
</span> <br /></div><br /><div>Here is an <a href="http://www.economist.com/displaystory.cfm?story_id=11965352">article</a> from The Economist on the challenges of space technology, commercialization and information sharing. This is widely applicable to corporate information security policies:</div><br /><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: Verdana; font-weight: bold; line-height: normal; ">Gravity is not the main obstacle for America’s space business. Government is</span></p><p><span style="font-family: Verdana; line-height: normal; ">IN THE spring of 2006 Robert Bigelow needed to take a stand on a trip to Russia to keep a satellite off the floor. The stand was made of aluminium. It had a circular base and legs. It was, says the entrepreneur and head of Bigelow Aerospace in Nevada, “indistinguishable from a common coffee table”. Nonetheless, the American authorities told Mr Bigelow that this coffee table was part of a satellite assembly and so counted as a munition. During the trip it would have to be guarded by two security officers at all times.</span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: Verdana; line-height: normal;"><br /></span><span style="font-family: Verdana; line-height: normal; ">Exporting technology has always presented a dilemma for America. The country leads the world in most technologies and some of these give it a military advantage. If export rules are too lax, foreign powers will be able to put American technology in their systems, or copy it. But if the rules are too tight, then it will stifle the industries that depend upon sales to create the next generation of technology.</span><br /><span style="font-family: Verdana; line-height: normal; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: Verdana; line-height: normal; ">It is a difficult balance to strike and critics charge that America has erred on the side of stifling. They claim that overly strict export controls have so damaged the space industry that America’s national security is now threatened by its dwindling leadership in space technology. The system, they complain, fails to distinguish between militarily sensitive hardware that should be controlled and widely available commercial technologies, such as lithium-ion batteries and solar cells. The zealous application of the export rules is the American space industry’s biggest handicap.</span></p></blockquote><div><span style="font-family: Verdana; font-weight: bold; line-height: normal;"><br /></span></div><div><span style="font-family: Verdana; line-height: normal; ">Read the whole thing its fascinating. So what started off as well intentioned asset protection eventually compromised the most important asset of all - strategic advantage.</span></div><div><span style="font-family: Verdana; line-height: normal;"><br /></span></div><div><span style="font-family: Verdana; line-height: normal;">So what&#39;s a better model? I am partial to think about these sorts of problems as free trade agreements. Each integration point should have a set of policies, and enforcement mechanisms that also include compensating transactions.</span></div><div><span style="font-family: Verdana; line-height: normal;"><br /></span></div><div><span style="font-family: Verdana; line-height: normal;">For example, did you know that in the US you can buy companies that trade on other exchanges through ADRs? You buy the ADR of say a French Telco which trades on a European exchange only you buy the ADR on the NYSE or Nasdaq. Then the French Telco issues you a dividend because you are a shareholder, but the French government withholds the dividend for foreign owners. Yet because there is a free trade agreement between the two countries, the US lets you write off the unreceived portion of the dividend on your taxes. (this may or may not be the case in US-France just an example). Anyway, its not a silver bullet but its an interesting strategy.</span></div><div><span style="font-family: Verdana; line-height: normal;"><br /></span></div>]]></content:encoded>
      <pubDate>Tue, 25 Nov 2008 09:40:20 +0000</pubDate>
      <category domain="http://securityratty.com/tag/coffee table">coffee table</category>
      <category domain="http://securityratty.com/tag/technology">technology</category>
      <category domain="http://securityratty.com/tag/american technology">american technology</category>
      <category domain="http://securityratty.com/tag/free trade agreement">free trade agreement</category>
      <category domain="http://securityratty.com/tag/trade">trade</category>
      <category domain="http://securityratty.com/tag/space technology">space technology</category>
      <category domain="http://securityratty.com/tag/french telco issues">french telco issues</category>
      <category domain="http://securityratty.com/tag/common coffee table">common coffee table</category>
      <category domain="http://securityratty.com/tag/information security policies">information security policies</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/11/is-that-a-coffee-table-or-a-munition.html">Is That a Coffee Table or a Munition?</source>
    </item>
    <item>
      <title><![CDATA[Schoolteacher Julie Amero Released, Felony Charges Dropped]]></title>
      <link>http://securityratty.com/article/611d98bfbfc8499b8666035962d050e9</link>
      <guid>http://securityratty.com/article/611d98bfbfc8499b8666035962d050e9</guid>
      <description><![CDATA[One of the real danger of technology, the reason for so much IT-Insecurity, is that many people dont understand it well
Case in point is the jury trial of Julie Amero, a schoolteacher who was charged...]]></description>
      <content:encoded><![CDATA[<p>One of the real danger of technology, the reason for so much IT-Insecurity, is that many people don&#8217;t understand it well.</p>
<blockquote><p>Case in point is the jury trial of <a rel="nofollow" target="_blank" href="http://voices.washingtonpost.com/securityfix/2008/11/ct_drops_felony_spywareporn_ch.html">Julie Amero, </a>a schoolteacher who was charged with felony for allegedly showing porn to her class&#8211;when in fact the porn sites were popups caused by malware on the classroom computers that popped up <a rel="nofollow" target="_blank" href="http://techbuddha.wordpress.com/2008/11/22/injustice-served-the-julie-amero-case-is-finally-over/">while she was teaching</a>:</p></blockquote>
<blockquote><p>a series of incompetent computer experts and overzealous prosecutors tried to claim that the pornography that appeared on the school computer browser was deliberately viewed. In reality the computer was infected with a browser hijack or other form of malware nastiness that launched a flood of porn pop-ups. There was an outpouring of support and some technical folks like Alex Eckleberry, who led an effort to prove that Julie was innocent of the charges</p></blockquote>
<p>After a long trial, Amero has finally been vindicated. But she has still lost those years of her life spent on the case, her teaching credential, and is being charged a $100 fine. While her trial might be over, her personal troubles aren&#8217;t.</p>]]></content:encoded>
      <pubDate>Mon, 24 Nov 2008 10:35:14 +0000</pubDate>
      <category domain="http://securityratty.com/tag/julie amero">julie amero</category>
      <category domain="http://securityratty.com/tag/julie">julie</category>
      <category domain="http://securityratty.com/tag/computer">computer</category>
      <category domain="http://securityratty.com/tag/incompetent computer experts">incompetent computer experts</category>
      <category domain="http://securityratty.com/tag/amero">amero</category>
      <category domain="http://securityratty.com/tag/porn sites">porn sites</category>
      <category domain="http://securityratty.com/tag/porn">porn</category>
      <category domain="http://securityratty.com/tag/trial">trial</category>
      <category domain="http://securityratty.com/tag/jury trial">jury trial</category>
      <source url="http://feeds.feedburner.com/~r/itsecurity/~3/464364814/">Schoolteacher Julie Amero Released, Felony Charges Dropped</source>
    </item>
    <item>
      <title><![CDATA[Links for 2008-11-20 [del.icio.us]]]></title>
      <link>http://securityratty.com/article/f0421d3d712a177576a6940fd9181128</link>
      <guid>http://securityratty.com/article/f0421d3d712a177576a6940fd9181128</guid>
      <description><![CDATA[Got SIEM? - Part IV eIQviews Customers tend to use SIEM technologies for more reactive efforts, such as post-event forensics, rather than as a true correlation solution to determine unusual behavior...]]></description>
      <content:encoded><![CDATA[<ul>
<li><a href="http://blog.eiqnetworks.com/2008/11/20/got-siem-part-iv/">Got SIEM? - Part IV &laquo; eIQviews</a><br/>
Customers tend to use SIEM technologies for more reactive efforts, such as post-event forensics, rather than as a true correlation solution to determine unusual behavior or policy violations before they have a chance to affect systems and data.</li>
<li><a href="http://siemblog.com/?p=13">SIEM Blog &raquo; Unrestricted Data Collection for Maximum Compliance and Forensic Visibility</a></li>
<li><a href="http://beastorbuddha.com/2008/11/19/so-we-own-your-client-database-and-everything-important-to-you/">Beast Or Buddha &raquo; Blog Archive &raquo; So we own your client database and everything important to you&hellip;</a><br/>
Web Developer: “Just because you can do that doesn’t mean we have a major problem like you say it is. It’s just you that did it!”
SG dude: “Well more than likely, others have….we didn’t do anything fancy…”.
Web Developer: “Well nothing has ever happened so it’s just you guys!”
SG dude: “You have no logging”.
Web Developer: “We’ve never been hacked!”</li>
<li><a href="http://ondlp.com/2008/10/13/my-wife-finally-knows-what-i-do/">On Data Loss Prevention (DLP) &raquo; My Wife Finally Knows What I Do</a></li>
<li><a href="http://securosis.com/2008/11/10/the-two-kinds-of-security-threats-and-how-they-affect-your-life/">The Two Kinds Of Security Threats, And How They Affect Your Life | securosis.com</a><br/>
We get money for noisy threats, and get called paranoid freaks for trying to prevent quiet threats (which can still lose our organizations a boatload of money, but don’t interfere with the married CEO’s ability to flirt with the new girl in marketing over email).</li>
<li><a href="http://www.csoonline.com/article/461422/Marcus_Ranum_on_Network_Security">Marcus Ranum on Network Security - CSO Online - Security and Risk</a><br/>
The real best practices have been the same since the 1970s: know where your data is, who has access to what, read your logs, guard your perimeter, minimize complexity, reduce access to &quot;need only&quot; and segment your networks.</li>
</ul><img src="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~4/460414088" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 20 Nov 2008 21:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/data">data</category>
      <category domain="http://securityratty.com/tag/data collection">data collection</category>
      <category domain="http://securityratty.com/tag/web developer">web developer</category>
      <category domain="http://securityratty.com/tag/siem">siem</category>
      <category domain="http://securityratty.com/tag/data loss prevention">data loss prevention</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/siem blog">siem blog</category>
      <category domain="http://securityratty.com/tag/security threats">security threats</category>
      <category domain="http://securityratty.com/tag/network security">network security</category>
      <source url="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~3/460414088/anton18">Links for 2008-11-20 [del.icio.us]</source>
    </item>
    <item>
      <title><![CDATA[Mamma.com: Insider trading and XSS]]></title>
      <link>http://securityratty.com/article/56fd5d403c630cbec7e9ec62becaafc5</link>
      <guid>http://securityratty.com/article/56fd5d403c630cbec7e9ec62becaafc5</guid>
      <description><![CDATA[Mamma.com 's got issues other than Mark Cuban's insider trading allegations. As a point of reference for this conversation, Mamma.com is ranked 4064 on Alexa as of today
I won't profess to following...]]></description>
      <content:encoded><![CDATA[<a href="http://mamma.com/" target="_blank">Mamma.com</a>'s got issues other than Mark Cuban's insider trading allegations. As a point of reference for this conversation, Mamma.com is ranked <a href="http://www.alexa.com/search?q=mamma.com" target="_blank">4064</a> on <a href="http://www.alexa.com" target="_blank">Alexa</a> as of today.<br />I won't profess to following Mr. Cuban's public life and the occasional antics. Obviously, he's a colorful and popular figure; certainly in Dallas, if not nationally. <br />What follows is not a judgment of Mr. Cuban or his pending legal challenges. I'm sure the process will play itself out accordingly.<br />A quick summary and some reference material:<br />The SEC has <a href="http://www.businessweek.com/the_thread/blogspotting/archives/2008/11/sec_hits_mark_c.html?chan=technology_technology+index+page_top+stories" target="_blank">filed</a> insider trading charges against Mr. Cuban. "According to the SEC, Cuban dumped 600,000 shares, or all of his 6.3% stake, in the search engine Mamma.com (The Mother of All Search Engines), in June 2004 after learning about private financing that the company was proposing. By selling, he avoided losing $750,000, the SEC alleges."<br />The whole issue for Mr. Cuban was <a href="http://blogmaverick.com/2008/11/17/the-sec/" target="_blank">PIPE</a> financing because it's "dilutive to existing shareholders’ stakes."<br />That's the long and the short of the current issue, and again, not my real interest here, with the exception of the bet I made with myself regarding the probable web application security posture of mamma.com. <br />All this talk about a popular site immediately sets off the little bell in my head (I hear it a lot). <span style="font-weight:bold;"><br />"What's wrong with the site?" is always the first question I ask myself.</span> <br /><br />I was not disappointed. <br /><br />Mamma.com exhibits the following issues:<br />1) XSS vulnerability in the <span style="font-style:italic;">utfout<span style="font-weight:bold;"><span style="font-style:italic;"></span></span></span> variable.<br /><br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://1.bp.blogspot.com/_kVOWaY1TAF0/SSNDBtG5jhI/AAAAAAAAAEs/rIT7buzVsao/s1600-h/mamma1.png" target="_blank"><img style="cursor:pointer; cursor:hand;width: 320px; height: 184px;" src="http://1.bp.blogspot.com/_kVOWaY1TAF0/SSNDBtG5jhI/AAAAAAAAAEs/rIT7buzVsao/s320/mamma1.png" border="0" alt=""id="BLOGGER_PHOTO_ID_5270129685521075730" /></a><br /><br />2) XSS vulnerability in the <span style="font-style:italic;">qtype</span> variable.<br /><br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://3.bp.blogspot.com/_kVOWaY1TAF0/SSNDSxiGVeI/AAAAAAAAAE0/E-McmPqvoDQ/s1600-h/mamma2.png" target="_blank"><img style="cursor:pointer; cursor:hand;width: 320px; height: 201px;" src="http://3.bp.blogspot.com/_kVOWaY1TAF0/SSNDSxiGVeI/AAAAAAAAAE0/E-McmPqvoDQ/s320/mamma2.png" border="0" alt=""id="BLOGGER_PHOTO_ID_5270129978766677474" /></a><br /><br />3) XSS vulnerability in their Mammajobs site at the <span style="font-style:italic;">pid</span> variable. This one's weirder still; if you drop an IFRAME in, it simply redirects to any URL you include in the IFRAME string.<br /><br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://4.bp.blogspot.com/_kVOWaY1TAF0/SSNDd-U7c0I/AAAAAAAAAE8/GCrCAoYom5k/s1600-h/mamma3.png" target="_blank"><img style="cursor:pointer; cursor:hand;width: 320px; height: 99px;" src="http://4.bp.blogspot.com/_kVOWaY1TAF0/SSNDd-U7c0I/AAAAAAAAAE8/GCrCAoYom5k/s320/mamma3.png" border="0" alt=""id="BLOGGER_PHOTO_ID_5270130171179660098" /></a><br /><br />4) The prospect of CSRF (rather pointless here given that its just a search engine, but but still defies best practices) appears likely given that mamma.com blindly accepts updates via GET and POST with no sign of a formkey (canary) in sight.<br /><br />I figured it best to stop there, and have submitted all these to Copernic (the Momma parent company). <br />I am however truly disappointed that an enterprise as ambitious and motivated as Momma/Copernic seems to have thrown the baby out with the bath water when it comes to web application security.<br />With regard to Mark Cuban dumping his shares: maybe he was afraid of getting pwned. ;-) All kidding aside, it's a shame that the whimsical and pessimistic thoughts regarding web site security that bounce around in my head inevitably bear themselves out.<br /><br /><a href="http://del.icio.us/post?url=http://holisticinfosec.blogspot.com/2008/11/mammacom-insider-trading-and-xss.html&title=Mamma.com:%20Insider%20trading%20and%20XSS " title="Mamma.com: Insider trading and XSS ">del.icio.us</a> | <a href="http://digg.com/submit?phase=2&amp;url=http://holisticinfosec.blogspot.com/2008/11/mammacom-insider-trading-and-xss.html" title="Mamma.com: Insider trading and XSS ">digg</a> | <a href="http://slashdot.org/submit.pl?url=http://holisticinfosec.blogspot.com/2008/11/mammacom-insider-trading-and-xss.html">Submit to Slashdot</a>]]></content:encoded>
      <pubDate>Tue, 18 Nov 2008 06:55:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/mamma">mamma</category>
      <category domain="http://securityratty.com/tag/mark cuban">mark cuban</category>
      <category domain="http://securityratty.com/tag/cuban">cuban</category>
      <category domain="http://securityratty.com/tag/engine">engine</category>
      <category domain="http://securityratty.com/tag/engine mamma">engine mamma</category>
      <category domain="http://securityratty.com/tag/xss vulnerability">xss vulnerability</category>
      <category domain="http://securityratty.com/tag/site">site</category>
      <category domain="http://securityratty.com/tag/insider">insider</category>
      <category domain="http://securityratty.com/tag/web site security">web site security</category>
      <source url="http://holisticinfosec.blogspot.com/2008/11/mammacom-insider-trading-and-xss.html">Mamma.com: Insider trading and XSS</source>
    </item>
    <item>
      <title><![CDATA[Links List 11.17.08]]></title>
      <link>http://securityratty.com/article/85b0ee0a0390b793b97cc896d3067a94</link>
      <guid>http://securityratty.com/article/85b0ee0a0390b793b97cc896d3067a94</guid>
      <description><![CDATA[Wow. I think we all know that we can take or leave surveys numbers dont mean a lot without context. In this case the context is the current economic meltdown. The Society for Information Management...]]></description>
      <content:encoded><![CDATA[<p>Wow. I think we all know that we can take or leave surveys – numbers don’t mean a lot without context. In this case the “context” is the current economic meltdown. The Society for Information Management (SIM) released the results of their 2008 IT Trends Survey – predicting an “upbeat” forecast for IT jobs; the HUGE caveat here is that the study was conducted before all the recent economic woes. Apparently organizations are using IT to <a href="http://blogs.zdnet.com/BTL/?p=10765" target="_blank">drive efficiencies, streamline operations, and cut costs</a> rather than just slashing the IT budget to save money during the downturn. What would be a nice follow-up: a quick second survey comparing responses before and after. Regardless Jerry Luftman, SIM vice president of academic affairs, still says the survey results demonstrate “that the overall state of IT remains very strong.”</p>
<p><img style="margin: 5px" src="http://images.google.com/url?q=http://disney-clipart.com/Chicken-Little/Disney-Chicken-Little.jpg&amp;usg=AFQjCNGA4kajmvy1h_lrcRnuywgV7_X0aQ" alt="" width="198" height="201" align="left" />The sky is falling! Trip Chowdhry, the analyst with Global Equities Research who claimed Red Hat was ‘rubbish and the entire LAMP stack is potty, too’ published some eye-opening predictions, predominantly negative, about tech business in Silicon Valley. Now <a href="http://news.cnet.com/8301-13505_3-10094221-16.html?part=rss&amp;subj=news&amp;tag=2547-1_3-0-20" target="_blank">Chowdhry claims that “almost every VC funded open-source company</a> is struggling and will run out of money within the next six months.” (Probably not the most unbiased guy about open source) Matt Asay argues that organizations in general are struggling, but open-source companies are not that high on the list. (But are they high on the VC “axe” list??) He notes Alfresco, Pentaho and JasperSoft are some of the players with ‘millions in the bank and growing revenue.’ Asay also says Chowdhry has a responsibility to do real due diligence and not create myths. Take that, Chicken Little! (<a href="http://disney-clipart.com/Chicken-Little/Disney-Chicken-Little.jpg" target="_blank"><em>img from Disney-Clipart</em></a>)</p>
<p>We’re not as far behind as we thought we were. Google presented the results of a study they conducted about how IPv6- capable “ordinary users” are at the RIPE meeting in Dubai a few weeks ago. Turns out Apple Macs drive IPv6 penetration in the US. <a href="http://arstechnica.com/news.ars/post/20081113-google-more-macs-mean-higher-ipv6-usage-in-us.html" target="_blank">Fifty-two percent of all IPv6 users in the U.S. own a Mac</a> and use 6to4 (creating IPv6 addresses from an IPv4 address and tunneling packets) – making the US fifth in the list of countries using IPv6. Russia and France took first and second place with .76 and .65 percent IPv6-enabled traffic . The US is at .45 percent. Worldwide, 0.238 percent of Google users’ systems are IPv6-enabled and prefer to use IPv6 over IPv4.</p>
<p>Obama’s win = Google’s win? Apparently Google <a href="http://blogs.cioinsight.com/biztech30/content/2008_campaign/google_vs_microsoft_the_obama_factor.html?kc=rss" target="_blank">CEO Eric Schmidt and President-Elect Obama are very good buddies</a> and “this terrifies Microsoft”. Now competitors are more on guard against Google’s growing empire and popularity. Although Schmidt was mentioned as a possible candidate for the country’s new national CTO position, he said he would not accept the post if asked. I guess that’s one less thing Microsoft has to worry about.</p>
]]></content:encoded>
      <pubDate>Mon, 17 Nov 2008 19:35:52 +0000</pubDate>
      <category domain="http://securityratty.com/tag/list">list</category>
      <category domain="http://securityratty.com/tag/survey results">survey results</category>
      <category domain="http://securityratty.com/tag/results">results</category>
      <category domain="http://securityratty.com/tag/ipv6 addresses">ipv6 addresses</category>
      <category domain="http://securityratty.com/tag/ipv6">ipv6</category>
      <category domain="http://securityratty.com/tag/percent">percent</category>
      <category domain="http://securityratty.com/tag/open-source company">open-source company</category>
      <category domain="http://securityratty.com/tag/source">source</category>
      <category domain="http://securityratty.com/tag/fifty-two percent">fifty-two percent</category>
      <source url="http://blog.sciencelogic.com/links-list-111708/11/2008">Links List 11.17.08</source>
    </item>
    <item>
      <title><![CDATA[Do you know who your employees are?]]></title>
      <link>http://securityratty.com/article/912fccde5dd0e4681c49ad021e6f3b01</link>
      <guid>http://securityratty.com/article/912fccde5dd0e4681c49ad021e6f3b01</guid>
      <description><![CDATA[Do you really

The Financial Times in London ran an article which illustrates the risks posed by disgruntled IT professionals. According to a recent survey, 88% of redundant IT administrators claimed...]]></description>
      <content:encoded><![CDATA[Do you really?<br /><span id="fullpost"><br />The Financial Times in London ran an article which illustrates the risks posed by disgruntled IT professionals.  According to a recent survey, 88% of redundant IT administrators claimed they would steal valuable and sensitive information from their company if they were ever fired.    <br /></span><br />A real-life example of this is the systems administrator with the Dept. of Technology who earlier this year created a password which locked officials out of the network because he feared he was losing his job.<br /><br />While it is very difficult to know if an employee is thinking this way, proper background checking and screening would likely discover if they ever did anything like this to a previous employer.<br /><br />When a termination is imminent, employers should close all of the employee's accounts and recover devices such as Blackberries, laptops, elctronic key cards and I.D.  When we are called in to assist with terminations, we always advise emloyers and supervisors of the need to do this.<br /><br />Surprisingly, many employers are not in a rush to get back laptops and other devices as they fear "upsetting" the termianted employee. If this is the case, turn over the responsibility to a professional outsourced security consultant who can take care of these duties and the company does not have to worry about being right in the "middle" of the process.<div class="blogger-post-footer">Visit Sexton Executive Security at www.sextonsecurity.com</div>]]></content:encoded>
      <pubDate>Sat, 15 Nov 2008 15:18:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/devices">devices</category>
      <category domain="http://securityratty.com/tag/elctronic key cards">elctronic key cards</category>
      <category domain="http://securityratty.com/tag/recover devices">recover devices</category>
      <category domain="http://securityratty.com/tag/employee">employee</category>
      <category domain="http://securityratty.com/tag/risks posed">risks posed</category>
      <category domain="http://securityratty.com/tag/recent survey">recent survey</category>
      <category domain="http://securityratty.com/tag/proper background">proper background</category>
      <category domain="http://securityratty.com/tag/previous employer">previous employer</category>
      <category domain="http://securityratty.com/tag/systems administrator">systems administrator</category>
      <source url="http://www.thebulletproofblog.com/2008/11/do-you-know-who-your-employees-are.html">Do you know who your employees are?</source>
    </item>
    <item>
      <title><![CDATA[Pentagon Clears Flying Car Project for Take-Off]]></title>
      <link>http://securityratty.com/article/f4c95dc7fa4408ae3530ac9f052608b7</link>
      <guid>http://securityratty.com/article/f4c95dc7fa4408ae3530ac9f052608b7</guid>
      <description><![CDATA[Pentagon mad science division Darpa is helping build thought-controlled robotic limbs, artificial pack mules, real-life laser guns, and &quot;kill-proof&quot; soldiers. So it comes as no surprise, really, that...]]></description>
      <content:encoded><![CDATA[Pentagon mad science division Darpa is helping build thought-controlled robotic limbs, artificial pack mules, real-life laser guns, and "kill-proof" soldiers. So it comes as no surprise, really, that the agency is now getting into the flying car business, too.<br style="clear: both;"/>
  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=b16f5ab1eb540c8488f27d5fd8e67493" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=b16f5ab1eb540c8488f27d5fd8e67493" style="display: none;" border="0" height="1" width="1" alt=""/><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=cctLN"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=cctLN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=60vAn"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=60vAn" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=BrbJn"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=BrbJn" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=ztXfN"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=ztXfN" border="0"></img></a>
 <a href="http://feeds.wired.com/~f/wired/politics/security?a=LNnEN"><img src="http://feeds.wired.com/~f/wired/politics/security?i=LNnEN" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=sJryn"><img src="http://feeds.wired.com/~f/wired/politics/security?i=sJryn" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=vhASn"><img src="http://feeds.wired.com/~f/wired/politics/security?i=vhASn" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=c6BWN"><img src="http://feeds.wired.com/~f/wired/politics/security?i=c6BWN" border="0"></img></a> </div><img src="http://feeds.feedburner.com/~r/wired/politics/privacy/~4/451846886" height="1" width="1"/><img src="http://feeds.wired.com/~r/wired/politics/security/~4/451846888" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 13 Nov 2008 11:12:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/real-life laser guns">real-life laser guns</category>
      <category domain="http://securityratty.com/tag/artificial pack mules">artificial pack mules</category>
      <category domain="http://securityratty.com/tag/robotic limbs">robotic limbs</category>
      <category domain="http://securityratty.com/tag/car business">car business</category>
      <category domain="http://securityratty.com/tag/kill-proof">kill-proof</category>
      <category domain="http://securityratty.com/tag/soldiers">soldiers</category>
      <category domain="http://securityratty.com/tag/agency">agency</category>
      <category domain="http://securityratty.com/tag/surprise">surprise</category>
      <source url="http://feeds.wired.com/~r/wired/politics/security/~3/451846888/darpas-flying-c.html">Pentagon Clears Flying Car Project for Take-Off</source>
    </item>
    <item>
      <title><![CDATA[Hosting Meets the Cloud Debate Part II]]></title>
      <link>http://securityratty.com/article/3a3393b304f09ea17d212e2f5b730d65</link>
      <guid>http://securityratty.com/article/3a3393b304f09ea17d212e2f5b730d65</guid>
      <description><![CDATA[I have to say that Part II of this session was much anticipated after the lively interaction yesterday. It turned out to be less of a debate and more like a fireside chat. (image from pro.corbis.com...]]></description>
      <content:encoded><![CDATA[<p><img style="border-top-width: 0px; border-left-width: 0px; border-bottom-width: 0px; border-right-width: 0px" height="220" alt="clip_image002" src="http://blog.sciencelogic.com/wp-content/uploads/2008/11/clip-image0024.jpg" width="323" align="left" border="0" />I have to say that Part II of this session was much anticipated after the lively interaction yesterday. It turned out to be less of a debate and more like a fireside chat. <a href="http://pro.corbis.com/images/CB042667.jpg?size=572&amp;uid=%7bDA13F798-FDA1-4B54-BFA9-4B15492E024F%7d" target="_blank">(image from pro.corbis.com)</a></p>
<p>The analysts paired up today:   <br />Antonio Piraino (<a href="http://www.t1r.com/" target="_blank">Tier1 Research</a>)    <br /><a href="http://the451group.com/about/bio_detail.php?eid=113" target="_blank">William Fellows</a> (<a href="http://the451group.com/" target="_blank">The 451 Group</a>)</p>
<p><em>My usual disclaimers on live-blogging: doesn&#8217;t include everything covered (just what was most interesting to me) and had to paraphrase some answers because I simply cannot type that fast. </em></p>
<p><strong>Quick definition of Cloud Computing     <br /></strong><strong>WF:</strong> The cloud is a continuum of grid, virtualization and utility done right. It is about provisioning services instead of servers; flexible computing instead of fixed assets. Done right, the cloud abstracts users from the complexity of grid. <a href="http://www.the451group.com/images/content/ice/ice_iceberg.jpg">Cloud computing is IT as a service</a>. Cloud computing is the Third Way &#8211; not entirely in-house or outsourced, but an optimized hybridized version of both. In light of the Goldman Sachs report out resetting IT spending forecast from up 6% to down 1%, don&#8217;t underestimate the ability for enterprises to move from capex to opex by buying cloud computing instead of building it themselves.</p>
<p>The 451 Group conducted a survey on cloud computing in March, and then revisited it a month ago. Some interesting results:</p>
<ul>
<li>84% have no plans to develop an internal cloud. 5% had no answer to this question. And for the 10% who did answer &#8211; the uses for a private/internal cloud were the same as those for a public cloud. </li>
<li>Top 6 vendors they look to help them develop an internal cloud: <a href="http://www.alleyinsider.com/2008/11/microsoft-s-smart-cloud-catch-up-plan-three-years-of-free-software-msft-" target="_blank">Microsoft</a>, <a href="http://topnews.in/ibm-expand-its-cloud-computing-efforts-285364" target="_blank">IBM</a>, Cisco, HP, Oracle, VMware </li>
</ul>
<p><strong><em>Is it all &#8220;upside&#8221; when it comes to cloud computing?       <br /></em></strong><strong>     <br />WF:</strong> Watch out for the Trojan horse, the red flag. What about the software needed to manage all this stuff? Any management software needs to take a holistic approach to solve the problem.</p>
<p><strong>AP:</strong> Increased management requirements and capability &#8211; this is actually a great story for managed hosters who can hold your hand while getting you up into the cloud. Hosters alleviate the pain points, and this is why we&#8217;re going to see continued growth and focus in the managed hosting sector.</p>
<p><strong>WF:</strong> I would argue that they&#8217;re too expensive. <a href="http://tech.blorge.com/Structure:%20/2008/10/25/amazons-ec2-cloud-moves-into-production/" target="_blank">Look at Amazon</a> &#8211; 10 cents a hit adds up.</p>
<p><strong>AP:</strong> It&#8217;s almost impossible to do an apples-to-apples comparison between cloud providers. One reason is that they charge differently. I&#8217;d say that when you&#8217;re talking about the big cloud providers, you are right &#8211; that they are expensive over the long-term, but for use in the short-term, they can be optimal.</p>
<p><strong>WF:</strong> The cloud is setting big expectations. Can IT deliver? It&#8217;s nice to talk about &#8220;shared resources for the greater good&#8221; but in any organization, you will still run into issues of power and control! Plus it&#8217;s still early days for resolution of regulatory issues and compliance around the cloud.</p>
<p><strong>Final Thoughts</strong></p>
<p><strong>AP:</strong> Think of the opportunities of using cloud computing resources in the areas of testing and pre-production &#8211; short-term use/environment (quick up/quick down), inexpensive, opex not capex. We&#8217;re already seeing the cloud fostering much innovation.</p>
<p><strong>WF:</strong> &#8220;It&#8217;s okay to fall in love with the term.&#8221; It is real but keep the expectations lower and realistic.</p>
<p><strong>AP:</strong> I agree with you. The reality is that the cloud is driving a very fundamental underlying platform change. This is not just a term or something that will fall out of fashion. There&#8217;s a real need to build trust in the cloud and leveraging shared resources in this way &#8211; so use the cloud computing term cautiously; don&#8217;t abuse it and make the cloud seem like IT&#8217;s new toy.</p>
]]></content:encoded>
      <pubDate>Wed, 12 Nov 2008 18:35:55 +0000</pubDate>
      <category domain="http://securityratty.com/tag/cloud">cloud</category>
      <category domain="http://securityratty.com/tag/public cloud">public cloud</category>
      <category domain="http://securityratty.com/tag/cloud providers">cloud providers</category>
      <category domain="http://securityratty.com/tag/cloud abstracts users">cloud abstracts users</category>
      <category domain="http://securityratty.com/tag/privateinternal cloud">privateinternal cloud</category>
      <category domain="http://securityratty.com/tag/internal cloud">internal cloud</category>
      <category domain="http://securityratty.com/tag/term">term</category>
      <category domain="http://securityratty.com/tag/pre-production short-term useenvironment">pre-production short-term useenvironment</category>
      <category domain="http://securityratty.com/tag/short-term">short-term</category>
      <source url="http://blog.sciencelogic.com/hosting-meets-the-cloud-debate-part-ii/11/2008">Hosting Meets the Cloud Debate Part II</source>
    </item>
  </channel>
</rss>
