<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: responsibility]]></title>
    <link>http://securityratty.com/tag/responsibility</link>
    <description></description>
    <pubDate>Mon, 07 Jul 2008 23:24:00 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Compromised Web Servers Serving Fake Flash Players]]></title>
      <link>http://securityratty.com/article/df22299b279b6326bc0fb82a62ea61b9</link>
      <guid>http://securityratty.com/article/df22299b279b6326bc0fb82a62ea61b9</guid>
      <description><![CDATA[The tactic of abusing web servers whose vulnerable web applications allow a malicious attacker to locally host a malicious campaign is nothing new. In fact, malicious attackers have been building so...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="text-align: center; clear: both;"></div><a href="http://bp0.blogger.com/_wICHhTiQmrA/SJiClCFucVI/AAAAAAAAB_0/SSFpGnP3wvA/s1600-h/fake_flash1.png" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp0.blogger.com/_wICHhTiQmrA/SJiClCFucVI/AAAAAAAAB_0/qKqvrWeAN3s/s200-R/fake_flash1.png" style="border: 0pt none ;" /></a>The tactic of abusing web servers whose vulnerable web applications allow a malicious attacker to locally host a malicious campaign is nothing new. In fact, malicious attackers have been building so much confidence in this risk-forwarding process of hosting their campaigns, that they would start actively spamming the links residing within low-profile legitimate sites across the web.<br />
<br />
This campaign serving fake flash players is getting so prevalent these days due to the multiple spamming approaches used, that it's hard not to notice it - and expose it. From a strategic perspective, having a legitimate low-profile site -- of course with the obvious exceptions being on purposely registered for malicious purposes within the participating sites -- hosting your malicious campaign is pretty creative in terms of forwarding the responsibility, and the eventual blocking of a legitimate site to the its owner. As far as the owner's are concerned, it appears that some of them are already seeing the malware page popping-up on the top of their daily traffic stats, and have taken measures to remove it.<br />
<br />
Moreover, <a href="http://blogs.adobe.com/psirt/2008/08/verifying_installers.html">Adobe's Product Security Incident Response Team (PSIRT) issued a warning notice about the attack yesterday</a>, which could come handy if the <a href="http://www.infoworld.com/article/08/08/05/Adobe_warns_of_bogus_Flash_Player_installers_1.html">attackers weren't taking advantage of client-side vulnerabilities</a>, putting the unware end user is a situation where he <a href="http://blogs.stopbadware.org/articles/2008/08/05/same-dogs-new-tricks">wouldn't even receive a download dialog</a> :<br />
<br />
<a href="http://bp1.blogger.com/_wICHhTiQmrA/SJiP_0v81lI/AAAAAAAACAM/LuFjz3rFLAc/s1600-h/fake_flash3_exploit.jpg" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp1.blogger.com/_wICHhTiQmrA/SJiP_0v81lI/AAAAAAAACAM/GXwA3Ai1LLY/s200-R/fake_flash3_exploit.jpg" style="border: 0pt none ;" /></a>"<i>We have seen coverage from the security community of a worm on popular social networking sites that is using social engineering lures to get users to install a piece of malware. According to the reports, the worm posts comments on these sites that include links to a fake site. If the link is followed, users are told they need to update their Flash Player. The installer, posted on a malicious site, of course installs malware instead of Flash Player.We’d like to take this opportunity to reiterate the importance of validating installers and updates before installing them. First off, do not download Flash Player from a site other than adobe.com – you can find the link for downloading Flash Player here. This goes for any piece of software (Reader, Windows Media Player, Quicktime, etc.) – if you get a notice to update, it’s not a bad idea to go directly to the site of the software vendor and download the update directly from the source. If the download is from an unfamiliar URL or an IP address, you should be suspicious.</i>"<br />
<br />
<a href="http://bp2.blogger.com/_wICHhTiQmrA/SJiGkBrMqII/AAAAAAAAB_8/6PfKZxTNQao/s1600-h/fake_flash2.png" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp2.blogger.com/_wICHhTiQmrA/SJiGkBrMqII/AAAAAAAAB_8/ADBheDs2hkk/s200-R/fake_flash2.png" style="border: 0pt none ;" /></a>The structure of the malware campaign is pretty static, with several exceptions where they also take advange of client-side vulnerabilities (Real player exploit) attempting to automatically deliver the fake flash update or player depending on the campaign. On each and every site, there are <b>dnd.js</b> and <b>master.js</b> scripts shich serve the rogue download window, and another .html file, where an IFRAME attempts to access the traffic management command and control, in a random URL it was <b>207.10.234.217/cgi-bin/index.cgi?user200</b>. A sample list of participating URLs, most of which are still active and running :<br />
<br />
<div style="text-align: left;"><b>joseantoniobaltanas .com</b></div><b>automoviliaria .es/hotnews.html<br />
risasnc .it/fresh.html<br />
carpe-diem .com.mx/fresh.html<br />
kotilogullari .com.tr/hotnews.html<br />
ferrariclubpesaro .it/hotnews.html<br />
imobiliariacom .com.br/default.html<br />
misoares .com<br />
osniehus .de/fresh.html<br />
mydirecttube .com/1/5098/<br />
madosma .com/default.html<br />
tutotic .com/checkit.html<br />
veit-team .si/default.html<br />
antigewaltkurse .de/stream.html<br />
kwhgs .ca/topnews.html<br />
vorgo .com/stream.html<br />
ankaraspor .com.tr/default.html<br />
xxxdnn0314 .locaweb.com.br/watchit.html<br />
ossuzio .com/watchit.html<br />
cit-inc .net/default.html<br />
negocioindependiente .biz/default.html<br />
ambermarketing .com/topnews.html<br />
web27 .login-7.loginserver.ch/stream.html<br />
moretewebdesign .br-web.com/stream.html<br />
omdconsulting .es/topnews.html<br />
parapendiolestreghe .it/hotnews.html<br />
campodifiori .it/topnews.html<br />
212.50.55.81 /stream.html<br />
logisigns .net/fresh.html<br />
intimaescorts .com/default.html<br />
ghioautotre .it/live.html<br />
geckert .de/stream.html<br />
yuricardinali .com/watchit.html<br />
retder .com/fresh.html<br />
valdaran .es/default.html<br />
getadultaccess .com/movie/?aff=5274<br />
bauelemente-giering .de/stream.html<br />
newyork-hebergement .com/watchit.html<br />
allevatoritrotto .it/live.html<br />
exoss2 .com/hotnews.html<br />
soundandlightkaraoke .com/stream.html<br />
land-kan .com/stream.html<br />
grimaldi.nexenservices .com/watchit.html<br />
inconstancia .com.br/watchit.html <br />
gretelstudio .com/stream.html<br />
sumacyl .com/watchit.html<br />
mysna .net/fresh.html<br />
gimnasioyx .com.ar/watchit.html<br />
lagalbana .com/watchit.html<br />
bielizna.tgory .pl/topnews.html<br />
bcs92.imingo .net/stream.html<br />
lapiramidecoslada .es/topnews.html<br />
raulortega .com/stream.html<br />
go-art-morelli .de/hotnews.html<br />
wowhard.baewha .ac.kr/watchit.html<br />
dianagraf .es/default.html<br />
komma10-thueringen .de/hotnews.html<br />
miavassilev .com/stream.html<br />
swampgiants .com/watchit.html<br />
compagniedephalsbourg .com/fresh.html<br />
arla-rc .net/hotnews.html<br />
salacopernico .es/watchit.html<br />
drfinster .de/checkit.html<br />
healthylifehypnotherapy .com/stream.html<br />
ecotrike-bg .com/fresh.html<br />
paoepalavra .org/watchit.html<br />
jureplaninc-sp .com/topnews.html<br />
fichte-lintfort .de/default.html<br />
hergert-band .de/checkit.html<br />
izliyorum .org/topnews.html<br />
lideka .com/stream.html<br />
athena-digitaldesign .com.tw/hotnews.html<br />
e-paso .pl/stream.html<br />
colombeblanche .org/stream.html<br />
teatromalasa .es/watchit.html<br />
mesporte.digiweb.com .br/stream.html<br />
bistrodavila.com .br/watchit.html<br />
hausfeld-solar .de/topnews.html<br />
nakedinbed.co .uk/topnews.html<br />
csr.imb .br/stream.html<br />
herion-architekten .de/default.html<br />
jbhumet .com/default.html<br />
gruppouni .com/hotnews.html<br />
francex .net/fresh.html<br />
galvatoledo .com/topnews.html<br />
cmeedilizia .eu/topnews.html<br />
kroenert .name/default.html<br />
textilhogarnovadecor .com/topnews.html<br />
keithcrook .com/stream.html<br />
elpatiodejesusmaria .com/checkit.html<br />
neticon .pl/hotnews.html<br />
malerbetrieb-pelzer .de/hotnews.html<br />
easterstreet .de/fresh.html<br />
piogiovannini .com.ar/watchit.html<br />
ser-all .com/topnews.html<br />
petzold-dieter .de/checkit.html<br />
beatmung-brandenburg .de/checkit.html<br />
ossuzio .com/watchit.html<br />
teatromalasa .es/watchit.html<br />
vuelosultimahora .com/topnews.html<br />
zelenaratolest .cz/pornotube/index1.htm<br />
ambulatoriovirtuale .it/topnews.html<br />
10a3 .ru/index1.php<br />
izliyorum .org/topnews.html<br />
collectedthoughts .co.uk/index12.html<br />
afg .es/topnews.html<br />
albertruiz .net/topnews.html<br />
bielizna.tgory .pl/topnews.html<br />
blueseven.com .br/topnews.html<br />
bollettinogiuridicosanitario .it/topnews.html<br />
caprilchamonix.com .br/topnews.html<br />
carlolongarini .it/topnews.html<br />
champimousse .com/topnews.html<br />
cheviot.org .nz/topnews.html<br />
contrapie .com/topnews.html<br />
gruppouni .com/topnews.html<br />
hausfeld-solar .de/topnews.html<br />
herbatele .com/topnews.html<br />
houseincostaricaforsale .com/topnews.html<br />
alim.co .il/topnews.html<br />
allevatoritrotto .it/topnews.html<br />
amafe .org/topnews.html<br />
ambulatoriovirtuale .it/topnews.html<br />
atelier-de-loulou .fr/topnews.html<br />
automoviliaria .es/topnews.html<br />
autoreserve .fr/topnews.html<br />
izliyorum .org/topnews.html<br />
jureplaninc-sp .com/topnews.html<br />
kwhgs .ca/topnews.html<br />
lapiramidecoslada .es/topnews.html<br />
last-minute-reisen-4u .de/topnews.html<br />
marcadina .fr/topnews.html<br />
maremax .it/topnews.html<br />
corradiproject .info/topnews.html<br />
dantealighieriasturias .es/topnews.html<br />
deliriuslaspalmas .com/topnews.html<br />
ecchoppers .co.za/topnews.html<br />
elianacaminada .net/topnews.html<br />
fonavistas .com/topnews.html<br />
fraemma .com/topnews.html<br />
fundmyira .com/topnews.html<br />
galvatoledo .com/topnews.html<br />
grafisch-ontwerpburo .nl/topnews.html<br />
markmaverick .com/topnews.html<br />
micela .info/topnews.html<br />
motoclubnosvamos .com/topnews.html<br />
nebottorrella .com/topnews.html<br />
negozistore .it/topnews.html<br />
neticon .pl/topnews.html<br />
norbert-leifheit.gmxhome .de/topnews.html<br />
segelclub-honau .de/topnews.html<br />
snmobilya .com/topnews.html<br />
splashcor .com.br/topnews.html<br />
stephanmager .gmxhome.de/topnews.html<br />
svcanvas .com/topnews.html<br />
tautau.web .simplesnet.pt/topnews.html<br />
textilhogarnovadecor .com/topnews.html<br />
theflorist4u .com/topnews.html<br />
thewindsorhotel .it/topnews.html<br />
vuelosultimahora .com/topnews.html<br />
aliarzani .de/topnews.html<br />
ambermarketing .com/topnews.html<br />
arnold82.gmxhome .de/topnews.html<br />
ocoartefatos.com .br/topnews.html<br />
omdconsulting .es/topnews.html<br />
parapendiolestreghe .it/topnews.html<br />
positive-begegnungen .de/topnews.html<br />
projetsoft .net/topnews.html<br />
rbc.gmxhome .de/topnews.html<br />
beatmung-sachsen .eu/topnews.html<br />
campodifiori .it/topnews.html<br />
clickjava .net/topnews.html<br />
cmeedilizia .eu/topnews.html<br />
dammer .info/topnews.html<br />
embedded-silicon .de/topnews.html<br />
ferrariclubpesaro .it/topnews.html<br />
fgwiese .de/topnews.html<br />
fswash.site .br.com/topnews.html<br />
fytema .es/topnews.html<br />
gildas-saliou. com/topnews.html<br />
go-art-morelli .de/topnews.html<br />
go-siegmund .de/topnews.html<br />
guerrero-tuning .com/topnews.html<br />
gut-barbarastein .de/topnews.html<br />
japansec .com/topnews.html<br />
komma10-thueringen .de/topnews.html<br />
koon-design .de/topnews.html<br />
lanz-volldiesel .de/topnews.html<br />
lauscher-staat .de/topnews.html<br />
losnaranjos.com .es/topnews.html<br />
medical-service-krause .de/topnews.html<br />
nakedinbed.co .uk/topnews.html<br />
nepi.si/topnews .html<br />
radieschenhein. de/topnews.html<br />
residenceflora .it/topnews.html<br />
sabuha .de/topnews.html<br />
ser-all .com/topnews.html<br />
siemieniewicz .de/topnews.html<br />
viajesk .es/topnews.html<br />
allevatoritrotto .it/live.html<br />
bollettinogiuridicosanitario .it/live.html<br />
carlolongarini .it/topnews.html<br />
maremax .it/topnews.html<br />
negozistore .it/topnews.html<br />
parapendiolestreghe .it/live.html<br />
www.donlisander .it/stream.html<br />
aerogenesis .net/watchit.html<br />
allevatoritrotto .it/live.html<br />
atelier-de-loulou .fr/topnews.html<br />
bistrodavila.com .br/watchit.html<br />
bollettinogiuridicosanitario .it/live.html<br />
caprilchamonix.com .br/topnews.html<br />
cheviot.org .nz/live.html<br />
condorautocenter .com.br/watchit.html<br />
dantealighieriasturias .es/live.html<br />
ecchoppers .co.za/topnews.html<br />
elianacaminada .net/live.html<br />
fonavistas .com/topnews.html<br />
fundmyira .com/topnews.html<br />
g6esporte .com.br/stream.html<br />
grafisch-ontwerpburo .nl/topnews.html<br />
gretelstudio .com/stream.html<br />
gutierrezymoralo .com/watchit.html<br />
healthylifehypnotherapy .com/stream.html<br />
herbatele .com/live.html<br />
jureplaninc-sp .com/topnews.html<br />
lacomercialsrl .com.ar/stream.html<br />
lagalbana .com/watchit.html<br />
lapuertaestrecha .com.es/watchit.html<br />
marcadina .fr/topnews.html<br />
maremax .it/topnews.html<br />
myadultcube .com/flash//aff=5176<br />
myadultcube .com/flash//aff=5810<br />
myadultcube .com/movie//aff=5155<br />
newyork-hebergement .com/watchit.html<br />
norbert-leifheit.gmxhome .de/topnews.html<br />
omdconsulting .es/topnews.html<br />
oyakatakent46537 .com/stream.html<br />
parapendiolestreghe .it/live.html<br />
regesh. co.il/watchit.html<br />
rikkeroenneberg .dk/watchit.html<br />
s215847279 .onlinehome.fr/stream.html<br />
salacopernico .es/watchit.html<br />
seekzones .com/watchit.html<br />
seicomsl .es/watchit.html<br />
sigma-lux .ro/watchit.html<br />
soundandlightkaraoke .com/stream.html<br />
stephanmager.gmxhome .de/topnews.html<br />
tartuinstituut .ca/watchit.html<br />
teatromalasa .es/watchit.html<br />
vuelosultimahora .com/topnews.html<br />
wowhard.baewha .ac.kr/watchit.html<br />
aliarzani .de/topnews.html<br />
ambermarketing. com/live.html<br />
bilbondo .com/watchit.html<br />
bollettinogiuridicosanitario .it/live.html<br />
colombeblanche .org/stream.html<br />
donlisander .it/stream.html<br />
fgwiese .de/topnews.html<br />
geckert .de/stream.html<br />
helene-taucher .de/watchit.html<br />
lanz-volldiesel .de/topnews.html<br />
mairie-margnylescompiegne .fr/watchit.html<br />
medical-service-krause .de/topnews.html<br />
nakedinbed.co .uk/topnews.html<br />
ossuzio .com/watchit.html<br />
piogiovannini .com.ar/watchit.html<br />
sabuha .de/topnews.html<br />
sumacyl .com/watchit.html<br />
swampgiants .com/watchit.html<br />
xn--glland-3ya .de/stream.html<br />
yuricardinali .com/watchit.html</b><br />
<b>nepi .si/topnews.html<br />
dammer .info/topnews.html<br />
atelier-de-loulou .fr/topnews.html<br />
galvatoledo .com/topnews.html<br />
allevatoritrotto .it/topnews.html<br />
hausfeld-solar .de/topnews.html<br />
micela .info/topnews.html<br />
bistrodavila .com.br/watchit.html<br />
hausfeld-solar .de/topnews.html<br />
csr.imb .br/stream.html<br />
herion-architekten .de/default.html<br />
gruppouni .com/hotnews.html<br />
galvatoledo .com/topnews.html<br />
kroenert .name/default.html<br />
keithcrook .com/stream.html<br />
elpatiodejesusmaria .com/checkit.html<br />
malerbetrieb-pelzer .de/hotnews.html<br />
dantealighieriasturias .es/topnews.html<br />
oyakatakent46537 .com/stream.html<br />
89.19.29 .13/stream.html<br />
slobodandjakovic .com/fresh.html<br />
cqcs.com .br/stream.html<br />
seekzones .com/watchit.html<br />
pascosa .it/stream.html<br />
caprilchamonix .com.br/topnews.html<br />
positive-begegnungen .de/topnews.html<br />
ferien-urlaub-lastminute .de/default.html<br />
mueggelpark .info/watchit.html<br />
hillner-online .de/fresh.html<br />
guiasaojose .net/default.html<br />
deliriuslaspalmas .com/topnews.html<br />
fraemma .com/topnews.html<br />
morsbaby .net/default.html<br />
vickywhite .com/fresh.html<br />
micela .info/topnews.html<br />
corradiproject .info/topnews.html<br />
liguehavraise .com/live.html<br />
capacitacaoemlideranca .com.br/fresh.html<br />
materialesyacabados .com.mx/stream.html<br />
208.112.7.68 /checkit.html<br />
152.10.1.37 /1.html<br />
carlolongarini .it/topnews.html<br />
splashcor.com .br/topnews.html<br />
lobpreisstrasse .org/1.html<br />
motoclubnosvamos .com/hotnews.html<br />
hk-rc.com /1.html<br />
taaf.re /stream.html<br />
dulceysalao .com/default.html<br />
amafe .org/topnews.html <br />
</b><br />
<div style="text-align: left;"></div><div class="separator" style="text-align: center; clear: both;"></div><a href="http://bp3.blogger.com/_wICHhTiQmrA/SJiNeb1AJDI/AAAAAAAACAE/MTxnF1XLDCw/s1600-h/fake_flash3_rogue_software.png" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp3.blogger.com/_wICHhTiQmrA/SJiNeb1AJDI/AAAAAAAACAE/3Dgh4x23dRs/s200-R/fake_flash3_rogue_software.png" style="border: 0pt none ;" /></a>Sample detection rate : <span id="status_nombre">flashupdate.exe</span><br />
<span id="status_nombre"><b>Scanners Result</b>: 35/36 (97.23%)</span><br />
<span id="status_nombre">Trojan-Downloader.Win32.Exchanger.hk; Troj/Cbeplay-A</span><br />
<b>File size</b>: 78848 bytes<br />
<b>MD5</b>...: c81b29a3662b6083e3590939b6793bb8<br />
<b>SHA1</b>..: d513275c276840cb528ce11dd228eae46a74b4b4<br />
<br />
The downloader then "phones back home" at <b>72.9.98.234 port 443 </b>which is responding to the rogue security software AntiSpy Spider (<b>antispyspider.net</b>) :<br />
<br />
"<i>AntiSpy Spider is a cutting-edge anti-spyware solution.This revolutionary anti-spyware program was created by the industry's top spyware experts in order to protect your computer and your privacy.html, while ensuring optimal system performance.With the ability to locate, eliminate and prevent the widest range of spyware threats, AntispyStorm is able to offer its users a safe, spyware-free computing experience; and with it's convenient automatic update feature, AntispyStorm ensures continuous up-to-date protection.</i>" <br />
<br />
Sample detection rate : antispyspider.msi<br />
<b>Scanners Result</b>: 11/35 (31.43%)<br />
FraudTool.Win32.AntiSpySpider.b;&nbsp; <br />
<b>File size</b>: 1851904 bytes<br />
<b>MD5</b>...: 2f1389e445f65e8a9c1a648b42a23827<br />
<b>SHA1</b>..: e32aa6aa791e98fe6fdef451bd3b8a45bad0acd8<br />
<br />
The bottom line - over a thousand domains are participating, with many other apparently joining the party proportionally with the web site owner's actions to get rid of the malware campaign hosted on their servers.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2008/07/lazy-summer-days-at-ukrtelegroup-ltds.html">Lazy Summer Days at UkrTeleGroup Ltd</a><br />
<a href="http://ddanchev.blogspot.com/2008/07/fake-porn-sites-serving-malware-part.html">Fake Porn Sites Serving Malware - Part Two</a><br />
<a href="http://ddanchev.blogspot.com/2008/06/fake-porn-sites-serving-malware.html">Fake Porn Sites Serving Malware</a><br />
<a href="http://ddanchev.blogspot.com/2008/06/underground-multitasking-in-action.html">Underground Multitasking in Action</a><br />
<a href="http://ddanchev.blogspot.com/2008/06/fake-celebrity-video-sites-serving.html">Fake Celebrity Video Sites Serving Malware</a><br />
<a href="http://ddanchev.blogspot.com/2008/06/blackhat-seo-redirects-to-malware-and.html">Blackhat SEO Redirects to Malware and Rogue Software</a><br />
<a href="http://ddanchev.blogspot.com/2008/06/malicious-doorways-redirecting-to.html">Malicious Doorways Redirecting to Malware</a><br />
<a href="http://ddanchev.blogspot.com/2008/03/portfolio-of-fake-video-codecs.html">A Portfolio of Fake Video Codecs</a><b> <br />
</b><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=BvcTqK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=BvcTqK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=onawHK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=onawHK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=4fa1ek"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=4fa1ek" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=5nQAgk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=5nQAgk" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=sqdHIK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=sqdHIK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=mq3LKK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=mq3LKK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=8zplkk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=8zplkk" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/356677080" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 05 Aug 2008 10:50:04 +0000</pubDate>
      <category domain="http://securityratty.com/tag/file">file</category>
      <category domain="http://securityratty.com/tag/html file">html file</category>
      <category domain="http://securityratty.com/tag/html">html</category>
      <category domain="http://securityratty.com/tag/comtopnews">comtopnews</category>
      <category domain="http://securityratty.com/tag/detopnews">detopnews</category>
      <category domain="http://securityratty.com/tag/windows media player">windows media player</category>
      <category domain="http://securityratty.com/tag/player">player</category>
      <category domain="http://securityratty.com/tag/web">web</category>
      <category domain="http://securityratty.com/tag/real player exploit">real player exploit</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/356677080/compromised-web-servers-serving-fake.html">Compromised Web Servers Serving Fake Flash Players</source>
    </item>
    <item>
      <title><![CDATA[Wee-Fi: Mumbai Blast Leads to Open Network; NullRiver's App Nullified; Copper Substitute]]></title>
      <link>http://securityratty.com/article/321165af2aaf7769bf8ef8224af4125c</link>
      <guid>http://securityratty.com/article/321165af2aaf7769bf8ef8224af4125c</guid>
      <description><![CDATA[Mumbai man's open wireless network used to send bomb claim: An American expatriate, Kenneth Haywood, left his Wi-Fi network open in Mumbai, and police allege it was used to send email claiming...]]></description>
      <content:encoded><![CDATA[<p><img src="http://wifinetnews.com/images/weefi.jpg" align="right" border="0" hspace="5" /><a href="http://www.guardian.co.uk/world/2008/jul/29/india.terrorism"><strong>Mumbai man's open wireless network used to send bomb claim:</strong></a> An American expatriate, Kenneth Haywood, left his Wi-Fi network open in Mumbai, and police allege it was used to send email claiming responsibility for a bomb blast that killed 42 people. The Guardian reports that Haywood says his email account was also hacked. Police say that someone would need to be within two floors of the 15th-floor apartment Haywood and others occupy, but they may be disregarding high-gain antennas. Haywood's installer demanded he not change his network password.</p>

<p><a href="http://www.infoworld.com/article/08/08/04/Apple_resurrects_iPhone_tethering_app_then_kills_it_again_1.html?source=rss&url=http://www.infoworld.com/article/08/08/04/Apple_resurrects_iPhone_tethering_app_then_kills_it_again_1.html"><strong>iPhone tethering application up, down, up, down:</strong></a> The NetShare connection-sharing application from NullRiver has made a couple of appearances on Apple's App Store, the only authorized place from which owners of iPod touch and iPhone devices can purchase software for uncracked equipment. NetShare appears to violate the terms of service for AT&T, although this wouldn't be the case with all carriers worldwide, by bridging 2.5G and 3G network traffic via the Wi-Fi connection on the iPhone. A laptop or desktop needs special configuration to connect to the iPhone, but various reports show it works fine. AT&T offers tethering with other smartphones - but not the iPhone - for typically about $20 more per month, comparable to a national hotspot aggregated subscription.</p>

<p><a href="http://www.usatoday.com/tech/products/2008-07-31-att-tries-to-stay-ahead-of-tech_N.htm?loc=interstitialskip"><strong>Speaking of AT&T, they like WiMax as a wire alternative:</strong></a> AT&T is bullish on WiMax, but the fixed kind used to replace wires in places they have no cable.</p>]]></content:encoded>
      <pubDate>Mon, 04 Aug 2008 05:56:36 +0000</pubDate>
      <category domain="http://securityratty.com/tag/haywood">haywood</category>
      <category domain="http://securityratty.com/tag/kenneth haywood">kenneth haywood</category>
      <category domain="http://securityratty.com/tag/iphone">iphone</category>
      <category domain="http://securityratty.com/tag/iphone devices">iphone devices</category>
      <category domain="http://securityratty.com/tag/att">att</category>
      <category domain="http://securityratty.com/tag/15th-floor apartment haywood">15th-floor apartment haywood</category>
      <category domain="http://securityratty.com/tag/att offers">att offers</category>
      <category domain="http://securityratty.com/tag/mumbai">mumbai</category>
      <category domain="http://securityratty.com/tag/police">police</category>
      <source url="http://wifinetnews.com/archives/008409.html">Wee-Fi: Mumbai Blast Leads to Open Network; NullRiver's App Nullified; Copper Substitute</source>
    </item>
    <item>
      <title><![CDATA[Terrorists Using Open Wireless Networks]]></title>
      <link>http://securityratty.com/article/67e6c4f7c84b1dfcaac21ded06af4fdf</link>
      <guid>http://securityratty.com/article/67e6c4f7c84b1dfcaac21ded06af4fdf</guid>
      <description><![CDATA[Remember when I said that I keep my home wireless network open ? Here's a reason not to listen to me: When Indian police investigating bomb blasts which killed 42 people traced an email claiming...]]></description>
      <content:encoded><![CDATA[<p>Remember when I said that I <a href="http://www.schneier.com/blog/archives/2008/01/my_open_wireles.html">keep my home wireless network open</a>?  <a href="http://www.guardian.co.uk/world/2008/jul/29/india.terrorism">Here's</a> a reason not to listen to me:</p>

<blockquote>When Indian police investigating bomb blasts which killed 42 people traced an email claiming responsibility to a Mumbai apartment, they ordered an immediate raid.

<p>But at the address, rather than seizing militants from the Islamist group which said it carried out the attack, they found a group of puzzled American expats.</p>

<p>In a cautionary tale for those still lax with their wireless internet security, police believe the email about the explosions on Saturday in the west Indian city of Ahmedabad was sent after someone hijacked the network belonging to one of the Americans, 48-year-old Kenneth Haywood.</blockquote></p>

<p>Of course, the terrorists could have sent the e-mail from anywhere.  But life is easier if the police don't raid <i>your</i> apartment.</p>

<p>EDITED TO ADD (8/1):  My wireless network is still open.  But, honestly, the terrorists are more likely to use the open network at the coffee shop up the street and around the corner.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=6VvG3K"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=6VvG3K" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=ZlSeyK"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=ZlSeyK" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Fri, 01 Aug 2008 02:46:41 +0000</pubDate>
      <category domain="http://securityratty.com/tag/home wireless network">home wireless network</category>
      <category domain="http://securityratty.com/tag/wireless network">wireless network</category>
      <category domain="http://securityratty.com/tag/network">network</category>
      <category domain="http://securityratty.com/tag/police">police</category>
      <category domain="http://securityratty.com/tag/indian police">indian police</category>
      <category domain="http://securityratty.com/tag/terrorists">terrorists</category>
      <category domain="http://securityratty.com/tag/wireless internet security">wireless internet security</category>
      <category domain="http://securityratty.com/tag/apartment">apartment</category>
      <category domain="http://securityratty.com/tag/mumbai apartment">mumbai apartment</category>
      <source url="http://www.schneier.com/blog/archives/2008/08/terrorists_usin.html">Terrorists Using Open Wireless Networks</source>
    </item>
    <item>
      <title><![CDATA[Seven steps to managing IT Risk]]></title>
      <link>http://securityratty.com/article/3cc491d771b5e862de257f98f7667692</link>
      <guid>http://securityratty.com/article/3cc491d771b5e862de257f98f7667692</guid>
      <description><![CDATA[Came across this overview read from a Gartner research note recently. It lays out seven recommended steps managing risk


Implement a framework for risk assessment and mapping
Establish the...]]></description>
      <content:encoded><![CDATA[Came across this <a href="http://www.pmportal.co.uk/content.asp?id=1812">overview read from a Gartner</a> research note recently.  It lays out seven recommended steps managing risk. <br /><br /><ul><li>Implement a framework for risk assessment and mapping.</li><li>Establish the responsibilities of risk managers with their areas of responsibility.</li><li>Identify and define the risks to which the business is exposed and what constitutes a risk event or "near miss" so that incidents can be mapped to specific risks.</li><li>Determine the threat level, and focus on those risks with the highest impact on performance.</li><li>Establish levels of controls for processes commensurate with the perceived threat.</li><li>Record and retain risk incident and near-miss information.</li><li>Conduct periodic risk assessments to determine changes in the operations risk profile and assess control performance.</li></ul>Great advice.  These seven steps are precisely what IT-GRC solutions should help an Enterprise accomplish.  They provide the construct (aka think configuration wizard) for establishing and maintaining a quality risk management program.   If you have on your company priority list advancing the the risk mitigation/management capabilities or if you've recently been burned, take the time and check out some of our new product demonstration videos.  We strive to be transparent around what we offer with our software.  That's why our marketing isn't really "marketing" it's live product in action.  <a href="http://security-works.com/metrics.html">Come check it out</a>.<img src="http://feeds.feedburner.com/~r/PracticalRiskManagement/~4/341936763" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 21 Jul 2008 17:34:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/risk">risk</category>
      <category domain="http://securityratty.com/tag/risk event">risk event</category>
      <category domain="http://securityratty.com/tag/risk assessment">risk assessment</category>
      <category domain="http://securityratty.com/tag/risk managers">risk managers</category>
      <category domain="http://securityratty.com/tag/operations risk profile">operations risk profile</category>
      <category domain="http://securityratty.com/tag/retain risk incident">retain risk incident</category>
      <category domain="http://securityratty.com/tag/specific risks">specific risks</category>
      <category domain="http://securityratty.com/tag/steps">steps</category>
      <category domain="http://securityratty.com/tag/risks">risks</category>
      <source url="http://feeds.feedburner.com/~r/PracticalRiskManagement/~3/341936763/seven-steps-to-managing-it-risk.html">Seven steps to managing IT Risk</source>
    </item>
    <item>
      <title><![CDATA[A Culture of Compliance]]></title>
      <link>http://securityratty.com/article/6117c5f2f3744f6336d6a64b32ac58f3</link>
      <guid>http://securityratty.com/article/6117c5f2f3744f6336d6a64b32ac58f3</guid>
      <description><![CDATA[For those of you that arent familiar with it, Ethisphere is generally a great source for interesting news about corporate ethics violations, insider trading, bribery, fraud, and other embarrassing...]]></description>
      <content:encoded><![CDATA[<p>For those of you that aren’t familiar with it, <a href="http://ethisphere.com/">Ethisphere </a>is generally a great source for interesting news about corporate ethics violations, insider trading, bribery, fraud, and other embarrassing news stories. <a href="http://ethisphere.com/man-earns-nearly-47-million-for-not-firing-employees/">This recent article</a> has a much more pleasant ending than most, with a former general manager of a waste collection company earning nearly $47 million for obeying the law. After repeatedly refusing to fire three of his employees over the age of 60 despite ongoing pressure from his superiors, he was wrongfully terminated, according to the jury. Partly responsible for the large settlement were actions taken by his employers after he was terminated, including tampering with memos related to his performance review. The good-guy-comes-out-on-top stories are always nice to see. But <a href="http://www.irs.gov/compliance/article/0,,id=180171,00.html">while it may work for the IRS </a>(which reminds me, I have this colleague...) and the occasional waste collection company, most organizations can’t rely on the promise of riches to entice staff to behave appropriately and report wrongdoing. This quarter I will be writing a report on how compliance professionals work to create a culture of compliance and responsibility in their organizations. I have seen very interesting videos, training programs, and other awareness campaigns to drive the message home, and there are certainly examples of reward and punishment, but I’d like to hear from you as well... any good examples of how your company distributes or enforces policies, or maybe stories of a colleague who was singled out and embarrassed for not following the rules?</p>]]></content:encoded>
      <pubDate>Fri, 18 Jul 2008 10:12:01 +0000</pubDate>
      <category domain="http://securityratty.com/tag/compliance">compliance</category>
      <category domain="http://securityratty.com/tag/news stories">news stories</category>
      <category domain="http://securityratty.com/tag/news">news</category>
      <category domain="http://securityratty.com/tag/stories">stories</category>
      <category domain="http://securityratty.com/tag/compliance professionals">compliance professionals</category>
      <category domain="http://securityratty.com/tag/waste collection company">waste collection company</category>
      <category domain="http://securityratty.com/tag/recent article">recent article</category>
      <category domain="http://securityratty.com/tag/message home">message home</category>
      <category domain="http://securityratty.com/tag/examples">examples</category>
      <source url="http://blogs.forrester.com/srm/2008/07/a-culture-of-co.html">A Culture of Compliance</source>
    </item>
    <item>
      <title><![CDATA[Williamson County Schools learns of breach reported nine months ago]]></title>
      <link>http://securityratty.com/article/ab879007319944481d6c7e5668489293</link>
      <guid>http://securityratty.com/article/ab879007319944481d6c7e5668489293</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
7/11/08

Organization
Williamson County Schools

Contractor/Consultant/Branch
None

Victims
Students

3,052 ACT students and 2,117 students who took the...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/wcs.jpg" width="109" align="right" height="123"><font size="2"><b>Date Reported: </b><br>7/11/08<br><br><b>Organization: </b><br><a href="http://www.wcs.edu/">Williamson County Schools</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Students*<br><br><font size="1">*"3,052 ACT students and 2,117 students who took the second grade test were affected", Source: <a href="http://www.wcs.edu/student_information_conf.htm%20">Student Information News Conference Text 7/11/08</a><br></font> <br><span style="font-weight: bold;">Number Affected:</span><br>5,169<br><br><span style="font-weight: bold;">Types of Data:</span><br>Names, testing scores, and Social Security numbers<br><br><span style="font-weight: bold;">Breach Description:</span><br>"FRANKLIN, Tenn.- It now appears a security breach at Williamson County schools was much worse than expected. School officials now say more than 5,000 students may have been affected when a school employee accidently posted their personal information online."<br><br>Reference URL:<br><a href="http://www.wcs.edu/student_information_conf.htm">Williamson County Student Information News Conference</a> <br><a href="http://www.newschannel5.com/Global/story.asp?S=8662746">News Channel 5</a> <br><a href="http://www.wreg.com/Global/story.asp?S=8657599">WREG Channel 3 News</a> <br><a href="http://www.wsmv.com/news/16843341/detail.html#-">WSMV Channel 4 News</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Liberty Coalition<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>FRANKLIN, Tenn.- It now appears a security breach at Williamson County schools was much worse than expected. School officials now say more than 5,000 students may have been affected when a school employee accidently posted their personal information online.<br><br>Now the county could lose some federal funding because of the mistake.<br><span style="font-style: italic;">[Evan] Do you really think that this will happen?&nbsp; If we looked deeper into the way the public school systems handle confidential information, half of the school districts would lose funding.&nbsp; Williamson County is in good company across the country.</span><br style="font-style: italic;"><br>The school district had to notify the Department of Education because this was a federal violation.<br><br>Director of Schools, Rebecca Sharber is taking on the responsibility of fixing the problem.<br><br>"I'm the head of the school system. I'm accountable," said Sharber.<br><span style="font-style: italic;">[Evan] What a fantastic statement.&nbsp; Corporate CEOs, non-profit executive directors, etc. ARE ultimately responsible for the protection of information.&nbsp; Ms. Sharber just earned my respect.</span><br style="font-style: italic;"><br>"It certainly is distressing to me that information was ever out there," said Sharber.<br><br>According to school officials, former assessment specialist, Chris Nugent is responsible for the computer mix-up.<br><br>He resigned Friday.<br><br>"Mr. Nugent has resigned his position as Assessment Specialist, effective immediately."<br><br>It was August last year when Nugent mistakenly loaded the info on a personal web page, but he never alerted the district.<br><br>They only found out a couple of weeks ago.<br><br>"A principal who had been contacted by a parent brought this to our attention on June 26th."<br><br>"The information given to us indicated that our assessment specialist, Chris Nugent, was involved. This was the first we had heard of this situation."<br><br>"We began our investigation immediately asking Mr. Nugent to gather all data that could possibly be associated with this situation."<br><br>"We thought at that time he would be able to supply the names of students possibly involved in the most timely manner."<br><br>"When Mr. Nugent was unable to get that information for us, our attorney Jason Golden contacted the Liberty Coalition, the organization that had posted the Internet report presented to us by the principal."<br><span style="font-style: italic;">[Evan] The Liberty Coalition posted the information surrounding the breach in October, 2007, many months before the victims were ever made aware.</span><br style="font-style: italic;"><br>"Yesterday afternoon, the Liberty Coalition was able to provide the names of the students affected."<br><br>"Our investigation indicates that the student information was posted on a private website created by Mr. Nugent sometime during the month of August, 2007."<br><br>"On August 28, 2007, the Liberty Coalition notified Mr. Nugent that private student information was on his web site."<br><br>"On August 29, 2007, the web site was shut down."<br><br>"Mr. Nugent did not notify school authorities."<br><br>"Our investigation has established that Mr. Nugent had confidential student files on the same thumb-drive with his personal files."<br><br>"We believe that when Mr. Nugent uploaded his personal files to a web site he created, he inadvertently uploaded our student files."<br><br>Sharber said the first step will be to look at revising policies on student information.<br><br>They will also pay for fraud alerts for the students.<br><br>It could cost the district hundreds of thousands of dollars to pay for those fraud alerts.<br><br>"I would say to other school districts they need to really, really check their policies and procedures on how student data is being used," said Sharber.<br><span style="font-style: italic;">[Evan] Again, did I mention that I respect Ms. Sharber?&nbsp; This statement is very good advice.</span><br><br>More than 5,000 students had their security information posted.<br><br>Most of those are high school students who took the ACT in the 2006-2007 school year, and second graders who took the TCAP the same year.<br><br>"We have learned that most students who took the second grade TCAP achievement test and most students who took the ACT test during the 2006-07 school year had social security numbers on a private website during August of 2007."<br><span style="font-style: italic;">[Evan] Is there some kind of legal requirement that states that a Social Security number must be tied to test scores, or was this just poor judgment?&nbsp; Are/were Social Security numbers used as student IDs at the district?</span><br style="font-style: italic;"><br>"Our review of the records shows that 3,052 ACT students and 2,117 students who took the second grade test were affected."<br><br>The information was on the internet for about a month.<br><br>"I want to thank the parents of Williamson County Schools for their patience and understanding and the positive suggestions they have shared as we have conducted our investigation and gone public with this information.", said Sharber<br><span style="font-style: italic;">[Evan] The Liberty Coalition went public with </span><a style="font-style: italic;" href="https://www.ssnbreach.org/release.php?g=13">this breach</a><span style="font-style: italic;"> in October, 2007.&nbsp; I appreciate the motives of the Liberty Coalition, but I am not pleased with the way they report breaches.&nbsp; I'll elaborate below in the commentary section.</span><br style="font-style: italic;"><br>"I understand the anxiety that our parents are experiencing.", said Sharber<br><br>"On Monday, we will be calling all parents of students whose social security numbers were exposed to let them know their child was affected, and we will follow up that phone call with a letter."<br><br>"We are working to locate a security company, and at our expense, we will cover the cost of fraud protection for the students affected."<br><span style="font-style: italic;">[Evan] I hope that the school locates a good "security company".&nbsp; Of course </span><a style="font-style: italic;" href="http://www.frsecure.com">FRSecure</a><span style="font-style: italic;"> would be glad to help.&nbsp; I promise to keep the plugs to a minimum <img src="http://breachblog.com/emoticons/smile.png" border="0" />.</span><br style="font-style: italic;"><br><span style="font-weight: bold;">Commentary:</span><br>OK.&nbsp; We all know that a breach affecting kids is especially bad.&nbsp; We all know that we are all human and all humans make mistakes.&nbsp; I presume that there are a number of risky information security behaviors at Williamson County Schools.&nbsp; This risky behavior just so happened to expose personal information online.&nbsp; What other risky behaviors will be addressed at the school district?<br><br>Now about the Liberty Coalition's role.&nbsp; I appreciate the motives of Aaron Titus and the Liberty Coalition.&nbsp; He maintains the SSNBreach.org web site where he publicizes information security breaches that his organization finds (or is informed about).&nbsp; My attention was first drawn to Aaron Titus in August 2007, when he reported the <a href="https://www.ssnbreach.org/release.php?g=1">Louisiana Board of Regents breach</a> affecting ~200,000 people.&nbsp; What drew my attention to his report was not the breach itself, but the way in which it he proceeded to report it.&nbsp; Lyger at Attrition.org covers it well <a href="http://attrition.org/security/rant/z/privacy.html">here</a>.<br><br>In this case, the Liberty Coalition publicly posted this breach in October, 2007 which is more than 9 months before the victims were ever made aware!&nbsp; According to the Liberty Coalition press release; "We updated this press release after becoming aware of Mr. Nugent's relationship with the school district. The Liberty Coalition also worked directly with district officials to help them notify the affected individuals."&nbsp; It would have been nice if the victims were notified prior to a public press release.&nbsp; I wonder why Mr. Nugent's relationship with the school district wasn't known earlier.&nbsp; I don't have the details that the Liberty Coalition does surrounding this breach, so I can only speculate.<br><br>The fact that some breaches are reported on SSNBreach.org prior to notification (in this case nine months), I chose to generally not report them here at The Breach Blog. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown<br></font><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/07/12/wcs.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Sat, 12 Jul 2008 20:12:01 +0000</pubDate>
      <category domain="http://securityratty.com/tag/school">school</category>
      <category domain="http://securityratty.com/tag/school students">school students</category>
      <category domain="http://securityratty.com/tag/schools">schools</category>
      <category domain="http://securityratty.com/tag/williamson county schools">williamson county schools</category>
      <category domain="http://securityratty.com/tag/williamson county">williamson county</category>
      <category domain="http://securityratty.com/tag/county">county</category>
      <category domain="http://securityratty.com/tag/breach">breach</category>
      <category domain="http://securityratty.com/tag/school authorities">school authorities</category>
      <category domain="http://securityratty.com/tag/school district">school district</category>
      <source url="http://breachblog.com/2008/07/12/wcs.aspx">Williamson County Schools learns of breach reported nine months ago</source>
    </item>
    <item>
      <title><![CDATA[Work-place violence kills many U.S. workers every year.]]></title>
      <link>http://securityratty.com/article/766e9fdd3353f7725aa107f42061b0ab</link>
      <guid>http://securityratty.com/article/766e9fdd3353f7725aa107f42061b0ab</guid>
      <description><![CDATA[Our company is hired regularly to make sure that fired employees do not come back to work and kill a supervisor or fellow colleagues

When people hear that Corporations hire bodyguards to work in...]]></description>
      <content:encoded><![CDATA[Our company is hired regularly to make sure that fired employees do not come back to work and kill a supervisor or fellow colleagues.  <br /><br /><span id="fullpost">When people hear that Corporations hire bodyguards to work in their Corporations pending and following company terminations they are surprised.  This surprises me.  Every year, workplace violence makes the "top ten" list of serious concerns facing U.S. businesses.   <br /><br /></span>Yesterday, on WTOP radio station I heard the phrase; "Desk Rage" for the first time.  Unfortunately it is very appropriate.  Some people have very bad tempers and an argument or decision at work can lead to them getting a weapon and committing homicide.  This was evidenced a couple of weeks ago in Kentucky when five factory workers were killed by an employee who had been slightly reprimanded.<br /><br />Employers do have a responsibility to ensure a safe work place environment.  That is the reason companies hire us.  If we are called in and are onsite when a violent worker returns intent on hurting people, we will be the ones to stop him or her from committing the act.  <br /><br />Fellow workers should report incidents involving any type of inappropriate behavior, especially instances where people are likely to get hurt, or worse.  Very rarely does an employee just go ballistic or "postal" for no reason.  The most common cause of work place homicides are domestic situations.  An employee with a dangerous spouse/significant other who has just been arrested on domestic violence charges or has been served with a protective should be brought to a supervisor's attention immediately.<br /><br />With so much rage in schools, on the road and in the home, the Police have their hands full just reacting to situations where many times the SWAT team will be called in.  Private security companies are a great resource to the business community as Police do not have the resources to sit for days and wait to see if something will happen.  <br /><br />Be part of the solution.  Report all potentially dangerous situations in the workplace to a supervisor.<div class="blogger-post-footer">Visit Sexton Executive Security at www.sextonsecurity.com</div>]]></content:encoded>
      <pubDate>Sat, 12 Jul 2008 14:28:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/domestic situations">domestic situations</category>
      <category domain="http://securityratty.com/tag/situations">situations</category>
      <category domain="http://securityratty.com/tag/corporations hire bodyguards">corporations hire bodyguards</category>
      <category domain="http://securityratty.com/tag/dangerous situations">dangerous situations</category>
      <category domain="http://securityratty.com/tag/reason">reason</category>
      <category domain="http://securityratty.com/tag/people">people</category>
      <category domain="http://securityratty.com/tag/reason companies hire">reason companies hire</category>
      <category domain="http://securityratty.com/tag/corporations">corporations</category>
      <category domain="http://securityratty.com/tag/report incidents">report incidents</category>
      <source url="http://www.thebulletproofblog.com/2008/07/work-place-violence-kills-many-us.html">Work-place violence kills many U.S. workers every year.</source>
    </item>
    <item>
      <title><![CDATA[Wee-Fi: Germans Can Leave Networks Open; Belkin Announces Wireless High-Def]]></title>
      <link>http://securityratty.com/article/ab835f6a5c216960e3543aadfe5ce5d5</link>
      <guid>http://securityratty.com/article/ab835f6a5c216960e3543aadfe5ce5d5</guid>
      <description><![CDATA[A German appeals court says an open Wi-Fi network isn't equivalent to the owner's responsibility for actions over that network: This decisions overturns a lower court's ruling in a peer-to-peer file...]]></description>
      <content:encoded><![CDATA[<p><img src="http://wifinetnews.com/images/weefi.jpg" align="right" border="0" hspace="5" /><a href="http://arstechnica.com/news.ars/post/20080710-open-wifi-network-viable-defense-against-infringement-chargeat-least-in-germany.html"><strong>A German appeals court says an open Wi-Fi network isn't equivalent to the owner's responsibility for actions over that network:</strong></a> This decisions overturns a lower court's ruling in a peer-to-peer file sharing copyright infringement case that the owner of a Wi-Fi network was de facto culpable for any activity that could be tracked back to the network's IP address. The appeals court said without specific evidence that the person charged had committed the infringement there's no case--and no requirement to lock down the network to avoid such lawsuits. If the decision had been upheld, it would have likely led to more broadside charges worldwide, as well as a vast reduction in open networks.</p>

<p><a href="http://www.businesswire.com/portal/site/home/permalink/?ndmViewId=news_view&newsId=20080710005104&newsLang=en"><strong>Belkin gives us plenty of time to get ready for streaming high def:</strong></a> FlyWire uses an adapted form of Wi-Fi in the 5 GHz band to stream HD without having the HD set in close proximity. They're not shipping until October, which could give you some time to get used to the price tag. A $1,000 model is designed to cover a home, and has various infrared and wireless options to control current A/V gear, some of which might be hidden in cabinets away from view. A cheaper $700 option covers just one room, Belkin says, and excludes the IR help. The transmitter has 3 HDMI jacks, including DVI support with audio inputs, along with two component and one composite video and audio input panels. The receiver has a single HDMI output. All HD resolutions are supported. These devices are aimed at people who buy large HDTVs and want to wall mount them.</p>]]></content:encoded>
      <pubDate>Fri, 11 Jul 2008 10:01:39 +0000</pubDate>
      <category domain="http://securityratty.com/tag/wi-fi">wi-fi</category>
      <category domain="http://securityratty.com/tag/wi-fi network">wi-fi network</category>
      <category domain="http://securityratty.com/tag/network">network</category>
      <category domain="http://securityratty.com/tag/appeals court">appeals court</category>
      <category domain="http://securityratty.com/tag/german appeals court">german appeals court</category>
      <category domain="http://securityratty.com/tag/belkin">belkin</category>
      <category domain="http://securityratty.com/tag/audio input panels">audio input panels</category>
      <category domain="http://securityratty.com/tag/broadside charges worldwide">broadside charges worldwide</category>
      <category domain="http://securityratty.com/tag/infringement">infringement</category>
      <source url="http://wifinetnews.com/archives/008392.html">Wee-Fi: Germans Can Leave Networks Open; Belkin Announces Wireless High-Def</source>
    </item>
    <item>
      <title><![CDATA[ISP Clickstream Betrayal Part 2 - The Double-Reverse Masquerade]]></title>
      <link>http://securityratty.com/article/e661e39609e1d49aa05c3910d57264a6</link>
      <guid>http://securityratty.com/article/e661e39609e1d49aa05c3910d57264a6</guid>
      <description><![CDATA[Techno-Geek Warning *** The following lengthy article discusses technical details that may cause your head to explode. I take no responsibility for cleaning the walls after you read this....]]></description>
      <content:encoded><![CDATA[*** Techno-Geek Warning ***
The following lengthy article discusses technical details that may cause your head to explode. I take no responsibility for cleaning the walls after you read this.
************************
As promised, Steve Gibson has published his explanation of what Phorm Inc. is doing to enable &#8220;Behavioral Targeting&#8221; for its advertising network that leverages equipment it installs [...]]]></content:encoded>
      <pubDate>Thu, 10 Jul 2008 13:36:24 +0000</pubDate>
      <category domain="http://securityratty.com/tag/leverages equipment">leverages equipment</category>
      <category domain="http://securityratty.com/tag/enable behavioral">enable behavioral</category>
      <category domain="http://securityratty.com/tag/steve gibson">steve gibson</category>
      <category domain="http://securityratty.com/tag/network">network</category>
      <category domain="http://securityratty.com/tag/phorm">phorm</category>
      <category domain="http://securityratty.com/tag/head">head</category>
      <category domain="http://securityratty.com/tag/responsibility">responsibility</category>
      <category domain="http://securityratty.com/tag/explode">explode</category>
      <category domain="http://securityratty.com/tag/techno-geek">techno-geek</category>
      <source url="http://securityviews.com/blog/2008/07/10/isp-clickstream-betrayal-part-2-the-double-reverse-masquerade/">ISP Clickstream Betrayal Part 2 - The Double-Reverse Masquerade</source>
    </item>
    <item>
      <title><![CDATA[Fake Porn Sites Serving Malware - Part Two]]></title>
      <link>http://securityratty.com/article/86e13cf5a3ac03ff0da9f40355440a24</link>
      <guid>http://securityratty.com/article/86e13cf5a3ac03ff0da9f40355440a24</guid>
      <description><![CDATA[What we've go here is the same malware gang using the very same malicious ISP among the ones you rarely see in any report , continuing to crunch out domain redirectors using the same templates for...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div>
<div class="separator" style="text-align: center; clear: both;"></div>
<a href="http://bp3.blogger.com/_wICHhTiQmrA/SHHrzCPIfDI/AAAAAAAAB4E/7qxOVh8ZjQQ/s1600-h/fake_porn_malware_domains_farm.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp3.blogger.com/_wICHhTiQmrA/SHHrzCPIfDI/AAAAAAAAB4E/JTiTcBU_mq4/s200-R/fake_porn_malware_domains_farm.JPG" style="border: 0pt none ;" /></a>What we've go here is the same malware gang using the very same <a href="http://ddanchev.blogspot.com/2008/06/malicious-isps-you-rarely-see-in-any.html">malicious ISP among the ones you rarely see in any report</a>, continuing to crunch out domain redirectors using the same templates for fake porn sites. And since some of the fake sites are actual redirectors, periodically revisting them leads to more fake codecs and even more actionable intelligence into the nature of their practices, and which are the ISPs proving them with hosting services for several consecutive years.<br />
<br />
The main redirector in this campaign <b>popular-adult.com</b> is also responding to :<br />
<br />
<div style="text-align: left;"><b>basic-adult .com<br />
business-adult .com<br />
center-adult .com<br />
comp-adult .com<br />
compadult .com<br />
controladult .com<br />
cruiseporn .com<br />
drive-adult .com<br />
ebony-adult-video .com</b></div>
<div style="text-align: left;"><b>ebony-pornmovie .com</b></div>
<a href="http://bp3.blogger.com/_wICHhTiQmrA/SHICb9Bw1GI/AAAAAAAAB4U/vHROBrIH6vM/s1600-h/popular_adult_CERNEL_ATRIVO.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp3.blogger.com/_wICHhTiQmrA/SHICb9Bw1GI/AAAAAAAAB4U/jIZzb-nymvc/s200-R/popular_adult_CERNEL_ATRIVO.JPG" style="border: 0pt none ;" /></a><b>ebony-video-xxx .com<br />
engine-adult .com<br />
fat-</b>a<b>dult-video .com<br />
fat-pornmovie .com<br />
fat-video-xxx .com<br />
global-adult .com<br />
inc-adult .com<br />
name-adult .com<br />
nameadult .com<br />
other-adult .com<br />
partadult .com<br />
pleasureadult .com<br />
porn-abc .com<br />
porn-contact .com<br />
porn-global .net<br />
porn-go .net<br />
porn-group .net<br />
porn-party .net<br />
porn-play .net<br />
porn-plus .net<br />
porn-power .net<br />
porn-room .net<br />
pornabout .com<br />
porndrive .net<br />
pornhelp .net<br />
pornname .net<br />
pornstar-adult-video .com<br />
pornstar-pornmovie .com<br />
pornstar-video-xxx .com<br />
room-adult .com<br />
scan-adult .com<br />
seek-adult .com<br />
u-adult .com</b><br />
<br />
The secondary redirectors going out of popular-adult.com :<br />
<br />
<div style="text-align: left;"></div>
<div class="separator" style="text-align: center; clear: both;"></div>
<a href="http://bp1.blogger.com/_wICHhTiQmrA/SHIFY0buIsI/AAAAAAAAB4k/NE0nt-J_MWg/s1600-h/fake_porn_redirectors.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp1.blogger.com/_wICHhTiQmrA/SHIFY0buIsI/AAAAAAAAB4k/55mFJcgdujQ/s200-R/fake_porn_redirectors.JPG" style="border: 0pt none ;" /></a><b>pornname .net/ted/382634557/1/<br />
porn-abc .com/ike/1666520193/1/<br />
pornhelp .net/dense/876421348/1/<br />
porn-play .net/cristina/1970565499/1/<br />
porn-global .net/percival/330780624/1/<br />
porn-contact .com/cisse/854714304/1/<br />
porn-play .net/honora/888715608/1/<br />
pornname .net/deidre/1964468519/1/<br />
pornhelp .net/pip/1977382266/1/<br />
porndrive .net/shelton/767217618/1/<br />
pornhelp .net/mat/354381578/1/<br />
pornabout .com/tobe/1436617289/1/<br />
porn-go .net/samson/7633197/1/<br />
porn-contact .com/teresa/409084583/1/<br />
porn-party .net/basil/1305549820/1/<br />
porn-contact .com/ed/1067772053/1/<br />
porn-contact .com/frish/1287341391/1/<br />
pornname .net/mariah/53967973/1/<br />
pornname .net/jacobus/291129748/1/<br />
porn-plus .net/beverly/2122167311/1/<br />
porn-party .net/lulu/917088357/1/<br />
pornabout .com/boetius/1991451664/1/<br />
cruiseporn .com/padde/1296397392/1/<br />
porn-power .net/arch/334137732/1/<br />
cruiseporn .com/meta/377489795/1/<br />
porn-room .net/lynette/1518855371/1/<br />
porn-play .net/link/1975737157/1/<br />
hporn-global .net/vin/1241430020/1/<br />
porndrive .net/dunk/1245242641/1/<br />
porn-go .net/louisa/1685718172/1/<br />
pornhelp .net/dunk/1859215260/1/<br />
porn-contact .com/celia/1805798677/1/<br />
porn-play .net/anabelle/987641695/1/<br />
porn-room .net/rille/815076192/1/<br />
pornabout.com/hodge/1040019816/1/<br />
porn-abc .com/claes/1130748100/1/<br />
pornabout .com/frederick/1987458246/1/<br />
porn-go .net/fredde/1153431432/1/<br />
porn-party .net/felicity/705720374/1/<br />
porndrive .net/ginne/1183690031/1/<br />
porn-group .net/kimberle/706468800/1/<br />
porn-room .net/helen/565953612/1/<br />
porn-party .net/arche/1387111363/1/<br />
porn-contact .com/kingston/232354071/1/<br />
pornhelp .net/mima/1024064014/1/<br />
porn-power .net/gretchen/152347961/1/<br />
porn-contact .com/ophelia/840853119/1/<br />
porn-play .net/eleanor/88926029/1/<br />
porn-power .net/bella/1712681771/1/<br />
porn-global .net/melchizedek/1823498218/1/<br />
pornabout .com/gabbe/1478560492/1/<br />
porn-party .net/obedience/1540587230/1/<br />
porndrive .net/rod/1177331120/1/<br />
porn-play .net/gee/1314369182/1/<br />
pornname .net/phineas/975226015/1/<br />
porn-global .net/reynold/131075998/1/<br />
porndrive .net/bat/1542809624/1/<br />
porn-global .net/hans/400396810/1/<br />
porn-contact .com/mock/1738069316/1/<br />
porn-plus .net/tryphosia/354085313/1/<br />
porn-room .net/bazaleel/1417267786/1/<br />
porn-contact .com/joyce/353938308/1/<br />
porn-power .net/laine/780004499/1/<br />
pornhelp .net/mille/988856007/1/<br />
cruiseporn .com/dare/258399427/1/<br />
porn-global .net/nat/2039108680/1/<br />
pornname .net/eudora/2132399934/1/<br />
porn-go .net/ana/277211595/1/<br />
pornhelp .net/auge/1990287956/1/<br />
porn-contact .com/danial/1195423348/1/<br />
porn-abc .com/teresa/1787982397/1/<br />
porn-go .net/lawrence/1575543567/1/<br />
porn-go .net/sherre/1066718744/1/<br />
porn-contact .com/jack/657185819/1/<br />
porn-abc .com/manda/216390544/1/<br />
porn-party .net/chuck/1533427157/1/<br />
porndrive .net/lucille/215841052/1/<br />
cruiseporn .com/rodney/1024994863/1/<br />
pornname .net/sheldon/669324635/1/<br />
porn-global .net/janet/1677642355/1/<br />
porn-global .net/basil/635902337/1/<br />
porn-party .net/adela/980553444/1/<br />
cruiseporn .com/charles/2038221862/1/<br />
pornabout .com/sid/644600064/1/<br />
porn-abc .com/eloise/1882289515/1/<br />
porndrive .net/bryant/724023427/1/<br />
porn-party .net/bonne/305120344/1/<br />
porn-play .net/susan/826151266/1/<br />
porn-room .net/sheila/439221958/1/<br />
porn-go .net/valere/1498454342/1/<br />
porn-contact .com/asenath/1036530205/1/<br />
porn-plus .net/marcus/51947065/1/<br />
porn-party .net/bridgit/518065759/1/<br />
porn-plus.net/shawn/1427002427/1/<br />
cruiseporn.com/alicia/1252994155/1/<br />
porn-abc.com/arminda/975985679/1/<br />
porn-party.net/lionel/929052416/1/<br />
porn-contact .com/ande/1755833202/1/<br />
porn-power .net/cyrus/732691977/1/<br />
aboutadultsex .com/heloise/1008109638/1/<br />
adultzoneworld .com/barne/506956701/1/<br />
superporncity .com/roberta/1239682918/1/<br />
pornhelp .net/eurydice/1944564451/1/<br />
theadultpost .com/volodia/543769984/1/<br />
porn-play .net/bird/760635633/1/<br />
coolbestporn .com/bradford/578099145/1/<br />
porn-plus .net/delilah/465854735/1/<br />
porn-power .net/pheney/698426424/1/<br />
porn-party .net/cristina/940229631/1/<br />
porn-party .net/justin/1913395886/1/<br />
porn-contact .com/lotte/1794233444/1/<br />
porn-party .net/nowell/850070721/1/<br />
worldbestadult .com/parthenia/1858633626/1/<br />
funpornsite .com/patience/188018581/1/<br />
adultsexpro .com/isse/1981168802/1/<br />
adultsexpro .com/isabelle/683364151/1/<br />
porndrive .net/erne/906935790/1/<br />
porn-power .net/delpha/178727494/1/<br />
porn-plus .net/chesley/1261676752/1/<br />
porn-plus .net/selina/11889629/1/<br />
porntimeguide .com/arnold/1555784224/1/<br />
aboutadultsex .com/doug/1975246767/1/<br />
porn-global .net/clum/1615653087/1/<br />
funxxxporn .com/kym/739810260/1/<br />
porn-plus .net/roxane/2022633909/1/<br />
worldbestadult .com/vicke/955775101/1/<br />
porn-play .net/jane/1396714471/1/<br />
pornname .net/nicole/1695768032/1/<br />
adultvideodot .com/bela/96070992/1/<br />
porn-room .net/carre/1310194786/1/<br />
adultsexpro .com/azubah/141802741/1/<br />
theadulteye .com/pheney/1077328499/1/<br />
porn-party .net/chick/1522449297/1/<br />
aboutadultsex .com/elbert/1300176621/1/<br />
findadultsex .com/lorre/2057361400/1/<br />
teenporntop .com/aristotle/901956477/1/<br />
coolbestporn .com/bartel/94175118/1/<br />
porn-plus .net/deanne/70540201/1/<br />
coolbestporn .com/appe/1679745028/1/<br />
findadultsex .com/asaph/1439353641/1/<br />
pornxxxfilm .com/tone/904077420/1/<br />
funxxxporn .com/india/476477713/1/<br />
adultvideodot .com/ed/879863981/1/<br />
bestpriceporn .com/babbe/1457040435/1/<br />
superliveporn .com/russell/56570486/1/</b><br />
<br />
More fake porn video sites using similar site templates, and using the same redirection infrastructure :<br />
<br />
<a href="http://bp1.blogger.com/_wICHhTiQmrA/SHIFIM-11XI/AAAAAAAAB4c/TWE3MI4BkNk/s1600-h/best-codec_crawled.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp1.blogger.com/_wICHhTiQmrA/SHIFIM-11XI/AAAAAAAAB4c/tmD1w9q0Ct0/s200-R/best-codec_crawled.JPG" style="border: 0pt none ;" /></a><b>porntubev20 .com<br />
clearpornurlssite .com<br />
mypornmovies .net<br />
getyourfreemovie .com<br />
tubescollection .com<br />
free-best-porn .com/videos/<br />
pornmovieshare .com<br />
clipslab .com<br />
mybestvideosite .com<br />
avwav .com</b><b> </b><br />
<br />
The fake codecs download locations in this campaign :<b>&nbsp;</b><br />
<br />
<b>aviutility .com<br />
18x-adult2008 .com<br />
2008x-adult-2008 .com<br />
best-codec .com<br />
hq-codec .net<br />
mpegsystem .com<br />
bestsoft-ware08 .com</b><br />
<br />
<b>The registrant and hosting provider :</b><br />
<br />
Cernel Inc, Legal Department&nbsp; (support@cernel.net)<br />
23404 W. Lyons Ave #223, Santa Clarita, Ca,91321<br />
US, Tel. +1.6613470577<br />
<br />
Historically, the same gang has been using the same hosting provider for many other fake codecs, which remain parked on the same netblock in a standby mode :<br />
<br />
<b>Fire-ticket .com</b> - 64.28.184.162<br />
<b>Fire-codec .com</b> - 64.28.184.163<br />
<b>Light-ticket .com</b> - 64.28.184.163<br />
<b>Braketicket .com</b> -&nbsp; 64.28.184.164<br />
<b>Mooncodec .net </b>- 64.28.184.164<br />
<b>Light-codec .com</b> - 64.28.184.165<br />
<b>Turbo-ticket .com</b> - 64.28.184.165<br />
<b>Space-codec .com</b> - 64.28.184.166<br />
<b>Ultra-ticket .com</b> - 64.28.184.166<br />
<b>Brakecodec .com</b> - 64.28.184.167<br />
<b>Demo-ticket .com</b> - 64.28.184.167<br />
<b>Demoticket .net</b> - 64.28.184.168<br />
<b>Hq-ticket .com</b> - 64.28.184.168<br />
<b>Turbo-codec .com</b> - 64.28.184.168<br />
<b>Hqticket .com</b> - 64.28.184.169<br />
<b>End-ticket .com</b> - 64.28.184.169<br />
<b>Nitro-codec .com</b> - 64.28.184.169<br />
<b>Hqticket .net</b> - 64.28.184.170<br />
<b>Clean-ticket .com</b> - 64.28.184.170<br />
<b>Red-codec .com</b> - 64.28.184.170<br />
<b>Black-codec .com</b> - 64.28.184.171<br />
<b>Viva-ticket .com</b> - 64.28.184.171<br />
<b>Niceticket .net</b> - 64.28.184.171<br />
<b>Endticket .com</b> - 64.28.184.172<br />
<b>Ultra-codec .com</b> - 64.28.184.172<br />
<b>Wot-ticket .com</b> - 64.28.184.172<br />
<b>Mega-codec .net</b> - 64.28.184.173<br />
<b>Storm-ticket .com</b> - 64.28.184.173<br />
<b>Megaz-ticket .com</b> - 64.28.184.174<br />
<b>Vipcodec .net</b> - 64.28.184.174<br />
<b>Democodec .net</b> - 64.28.184.175<br />
<b>Giga-ticket .com</b> - 64.28.184.175<br />
<b>Demo-codec .net</b> - 64.28.184.176<br />
<b>Uin-ticket .com</b> - 64.28.184.176<br />
<b>Hopeticket .com</b> - 64.28.184.177<br />
<b>Hq-codec .net</b> - 64.28.184.177<br />
<b>Best-codec .com</b> - 64.28.184.178<br />
<b>Hope-ticket .com</b> - 64.28.184.178<br />
<b>Endcodec .net</b> - 64.28.184.179<br />
<b>Zero-ticket .com</b> - 64.28.184.179<br />
<b>End-codec .net</b> - 64.28.184.180<br />
<b>Pop-ticket .com</b> - 64.28.184.180<br />
<b>Cleancodec .net</b> - 64.28.184.181<br />
<b>Yupticket .com</b> - 64.28.184.181<br />
<br />
The deeper you go the more interesting it gets, malware command and controls located on the same network, fake banks, money mule recruitment sites, pharmaceutical scams and spam hosting - they or their customers if they are to forward the responsibility are definitely multitasking.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2008/06/fake-porn-sites-serving-malware.html">Fake Porn Sites Serving Malware</a><br />
<a href="http://ddanchev.blogspot.com/2008/06/underground-multitasking-in-action.html">Underground Multitasking in Action</a><br />
<a href="http://ddanchev.blogspot.com/2008/06/fake-celebrity-video-sites-serving.html">Fake Celebrity Video Sites Serving Malware</a><br />
<a href="http://ddanchev.blogspot.com/2008/06/blackhat-seo-redirects-to-malware-and.html">Blackhat SEO Redirects to Malware and Rogue Software</a><br />
<a href="http://ddanchev.blogspot.com/2008/06/malicious-doorways-redirecting-to.html">Malicious Doorways Redirecting to Malware</a><br />
<a href="http://ddanchev.blogspot.com/2008/03/portfolio-of-fake-video-codecs.html">A Portfolio of Fake Video Codecs</a> <br />
<div style="text-align: left;"></div>
<div class="separator" style="text-align: center; clear: both;"></div><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=TrZhTJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=TrZhTJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=WEgFzJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=WEgFzJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=feuAKj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=feuAKj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=sTFsEj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=sTFsEj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=yitXlJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=yitXlJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=Zk1jsJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=Zk1jsJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=qQDKaj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=qQDKaj" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/329627841" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 07 Jul 2008 23:24:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/net">net</category>
      <category domain="http://securityratty.com/tag/malware">malware</category>
      <category domain="http://securityratty.com/tag/porn-party">porn-party</category>
      <category domain="http://securityratty.com/tag/porn-contact">porn-contact</category>
      <category domain="http://securityratty.com/tag/fake porn sites">fake porn sites</category>
      <category domain="http://securityratty.com/tag/porn-play">porn-play</category>
      <category domain="http://securityratty.com/tag/porn-plus">porn-plus</category>
      <category domain="http://securityratty.com/tag/porndrive">porndrive</category>
      <category domain="http://securityratty.com/tag/pornhelp">pornhelp</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/329627841/fake-porn-sites-serving-malware-part.html">Fake Porn Sites Serving Malware - Part Two</source>
    </item>
  </channel>
</rss>
