<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: rock]]></title>
    <link>http://securityratty.com/tag/rock</link>
    <description></description>
    <pubDate>Thu, 04 Sep 2008 20:00:00 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Rock Phish-ing in December]]></title>
      <link>http://securityratty.com/article/d1eddfe52ced7cf231d9526475837380</link>
      <guid>http://securityratty.com/article/d1eddfe52ced7cf231d9526475837380</guid>
      <description><![CDATA[Nothing can warm up the hearth of a security researcher than a batch of currently active Rock Phish domains, fast-fluxing by using U.S based malware infected hosts as infrastructure provider. What is...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://1.bp.blogspot.com/_wICHhTiQmrA/STUqs5QOkBI/AAAAAAAACfw/_V_hnn5FsvY/s1600-h/rock_phishing_december_2008_4.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://1.bp.blogspot.com/_wICHhTiQmrA/STUqs5QOkBI/AAAAAAAACfw/_V_hnn5FsvY/s200/rock_phishing_december_2008_4.png" /></a>Nothing can warm up the hearth of a security researcher than a batch of currently active Rock Phish domains, fast-fluxing by using U.S based malware&nbsp; infected hosts as infrastructure provider. What is this assessment of currently active Rock Phish campaign aiming to achieve? In short, prove that the people that were Rock Phish-ing at the beginning of the year, are exactly the same people that continue Rock Phish-ing at the end of the year, thereby pointing out that as long as they're not where they're supposed to be, they are not going to stop innovating and working on a higher average online time for their campaigns.<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://3.bp.blogspot.com/_wICHhTiQmrA/STUurE2no7I/AAAAAAAACf4/knoqvo5_Ruk/s1600-h/rock_phishing_december_2008.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://3.bp.blogspot.com/_wICHhTiQmrA/STUurE2no7I/AAAAAAAACf4/knoqvo5_Ruk/s200/rock_phishing_december_2008.png" /></a>What's particularly interesting about this campaign, is that compared to previous ones targeting multiple brands, the thousands of malware infected hosts and domains are targeting Alliance &amp; Leicester and Abbey National only.<br />
<br />
Active Rock Phish Domains in fast-flux :<br />
<b>stgsfw7sr .com<br />
q06ciwt60 .com<br />
jnlyf96v4 .com<br />
neegzlh35 .com<br />
7azwmrsg5 .com<br />
pn3ekq976 .com<br />
2coxi8sb6 .com<br />
d8ri1iz5d .com<br />
&nbsp;</b><br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://2.bp.blogspot.com/_wICHhTiQmrA/STUwghNYQnI/AAAAAAAACgI/26zVuduDrUQ/s1600-h/rock_phishing_december_2008_5.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://2.bp.blogspot.com/_wICHhTiQmrA/STUwghNYQnI/AAAAAAAACgI/26zVuduDrUQ/s200/rock_phishing_december_2008_5.png" /></a><b>ki7wvgauf .com<br />
5nt5r3keh .com<br />
5nt29884j .com<br />
bgoryomek .com<br />
a725jv8ik .com<br />
fke5nnp8m .com<br />
stgsfw7sr .com<br />
10c0ka49t .com<br />
zp304ju3z .com<br />
j0rykafwn .cn<br />
2j1f .net<br />
<br />
confirm-updates .com<br />
paypal.confirm-updates .com<br />
user-data-confirmation .com<br />
paypal.user-data-confirmation .com<br />
capitalone.updating-informations .com</b><br />
<br />
Sample sub-domain structure :<br />
<b>mybank.alliance-leicester.co.uk.7azwmrsg5 .com<br />
mybank.alliance-leicester.co.uk.bgoryomek .com<br />
mybank.aliance-leicester.co.uk.stgsfw7sr .com<br />
mybank.alliance-leicester.co.uk.zp304ju3z .com<br />
mybank.alliance-leicester.co.uk.5nt29884j .com<br />
mybank.aliance-leicester.co.uk.bgoryomek .com<br />
mybank.alliance-leicester.co.uk.bgoryomek .com<br />
mybank.aliance-leicester.co.uk.stgsfw7sr .com<br />
mybank.alliance-leicester.co.uk.stgsfw7sr .com<br />
mybank.aliance-leicester.co.uk.zp304ju3z .com<br />
mybank.alliance-leicester.co.uk.zp304ju3z .com<br />
myonlineaccounts2.abbeynational.co.uk.pn3ekq976 .com<br />
myonlineaccounts1.abeynational.com.pn3ekq976 .com</b><br />
<br />
<a href="http://4.bp.blogspot.com/_wICHhTiQmrA/STUwTom6U0I/AAAAAAAACgA/EPxpvWuWNnY/s1600-h/rock_phishing_december_2008_3.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://4.bp.blogspot.com/_wICHhTiQmrA/STUwTom6U0I/AAAAAAAACgA/EPxpvWuWNnY/s200/rock_phishing_december_2008_3.png" /></a>DNS servers for the campaigns :<br />
<b>ns1.thecherrydns .com<br />
ns2.thecherrydns .com <br />
ns3.thecherrydns .com <br />
ns4.thecherrydns .com <br />
ns5.thecherrydns .com <br />
ns6.thecherrydns .com <br />
<br />
ns10.realgoodnameserver .com<br />
ns1.realgoodnameserver .com<br />
rens2.realgoodnameserver .com<br />
rns3.realgoodnameserver .com<br />
ns4.realgoodnameserver .com<br />
ns8.realgoodnameserver .com<br />
<br />
ns6.myboomdns .com<br />
ns4.myboomdns .com</b><br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://1.bp.blogspot.com/_wICHhTiQmrA/STUw5WuMSYI/AAAAAAAACgQ/VgFTgLTJK58/s1600-h/rock_phishing_december_2008_7.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://1.bp.blogspot.com/_wICHhTiQmrA/STUw5WuMSYI/AAAAAAAACgQ/VgFTgLTJK58/s200/rock_phishing_december_2008_7.png" /></a><b>Domains registrant :</b><br />
Name : Pan Wei wei<br />
Organization : Pan Wei wei<br />
Address : BaoChun Rd. 27, No. 3, 1F, Apt. 1903<br />
City : Bejing<br />
Province/State : Beijing<br />
Country : CN<br />
Postal Code : 100176<br />
Phone Number : 010-010-58022118-58022118<br />
Fax : 86-010-58022118-58022118<br />
Email : 127@126.com<br />
<br />
These well known Rock Phish campaigners, have been naturally multitasking on several different underground fronts throughout the year. For instance, their <b>2j1f .net</b> is known to have been <a href="http://www.bobbear.co.uk/morganinvestment.html">hosting money mule company's site</a>, and also, it was used in a previously analyzed <a href="http://ddanchev.blogspot.com/2008/06/phishing-campaign-spreading-across.html">phishing campaign that was spreading across Facebook</a> in June. Need more evidence on the consolidation that's been ongoing for over an year and half now? An infamous money mule recruiting company (<b>Cash-Transfers Inc.</b>) was also taking advantage of the <a href="http://ddanchev.blogspot.com/2008/07/money-mule-recruiters-use-asproxs-fast.html">fast-flux network offered by the ASProx botnet masters</a> in July.<br />
<br />
As a firm believer in that "the whole is greater than the sum of its parts", the popular "sitting duck" cybercrime infrastructure hosting model will be either replaced by a cybercrime infrastructure relying entirely on legitimate services, or one where the average malware infected Internet user would be temporarily used as a hosting provider.<br />
<br />
If millions were made by using the "sitting duck" hosting model, how many would be made using the others, given that they would inevitably increase the average online time for a malicious campaign?<br />
<br />
<b>Related Rock Phish research :</b><br />
<a href="http://ddanchev.blogspot.com/2007/09/209-host-locked.html">209 Host Locked</a><br />
<a href="http://ddanchev.blogspot.com/2007/12/2091-host-locked.html">209.1 Host Locked</a><br />
<a href="http://ddanchev.blogspot.com/2007/11/661-host-locked.html">66.1 Host Locked</a><br />
<a href="http://ddanchev.blogspot.com/2007/07/confirm-your-gullibility.html">Confirm Your Gullibility</a><br />
<a href="http://ddanchev.blogspot.com/2007/10/assessing-rock-phish-campaign.html">Assessing a Rock Phish Campaign</a><br />
<br />
<b>Related fast-flux research : </b><br />
<a href="http://ddanchev.blogspot.com/2007/10/fast-flux-spam-and-scams-increasing.html">Fast-Flux Spam and Scams Increasing</a><br />
<a href="http://ddanchev.blogspot.com/2007/10/fast-fluxing-yet-another-pharmacy-scam.html">Fast Fluxing Yet Another Pharmacy Scam</a><br />
<a href="http://ddanchev.blogspot.com/2007/09/storm-worms-fast-flux-networks.html">Storm Worm's Fast Flux Networks</a><br />
<b> </b><a href="http://ddanchev.blogspot.com/2007/11/managed-fast-flux-provider.html">Managed Fast Flux Provider</a><br />
<a href="http://ddanchev.blogspot.com/2008/10/managed-fast-flux-provider-part-two.html">Managed Fast Flux Provider - Part Two</a><br />
<a href="http://ddanchev.blogspot.com/2008/07/obfuscating-fast-fluxed-sql-injected.html">Obfuscating Fast Fluxed SQL Injected Domains</a><br />
<a href="http://ddanchev.blogspot.com/2008/05/storm-worm-hosting-pharmaceutical-scams.html">Storm Worm Hosting Pharmaceutical Scams</a><br />
<a href="http://blogs.zdnet.com/security/?p=1122">Fast-Fluxing SQL injection attacks executed from the Asprox botnet</a><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=kNW2O"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=kNW2O" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=zUymO"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=zUymO" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=gesYo"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=gesYo" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=RrC8o"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=RrC8o" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=w0L7O"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=w0L7O" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=hj0KO"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=hj0KO" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=P9KQo"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=P9KQo" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/472451974" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 02 Dec 2008 04:12:31 +0000</pubDate>
      <category domain="http://securityratty.com/tag/fast flux networks">fast flux networks</category>
      <category domain="http://securityratty.com/tag/fast">fast</category>
      <category domain="http://securityratty.com/tag/fast-flux spam">fast-flux spam</category>
      <category domain="http://securityratty.com/tag/fast-flux">fast-flux</category>
      <category domain="http://securityratty.com/tag/fast flux provider">fast flux provider</category>
      <category domain="http://securityratty.com/tag/mybank">mybank</category>
      <category domain="http://securityratty.com/tag/fast-flux research">fast-flux research</category>
      <category domain="http://securityratty.com/tag/rock phish-ing">rock phish-ing</category>
      <category domain="http://securityratty.com/tag/provider">provider</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/472451974/rock-phish-ing-in-december.html">Rock Phish-ing in December</source>
    </item>
    <item>
      <title><![CDATA[The Future of Ephemeral Conversation]]></title>
      <link>http://securityratty.com/article/1474b03de8a1d60cdf0aa28759ddce93</link>
      <guid>http://securityratty.com/article/1474b03de8a1d60cdf0aa28759ddce93</guid>
      <description><![CDATA[When he becomes president, Barack Obama will have to give up his BlackBerry. Aides are concerned that his unofficial conversations would become part of the presidential record, subject to subpoena and...]]></description>
      <content:encoded><![CDATA[<p>When he becomes president, Barack Obama will have to <a href="http://www.nytimes.com/2008/11/16/us/politics/16blackberry.html">give up</a> his BlackBerry.  Aides are concerned that his unofficial conversations would become part of the presidential record, subject to subpoena and eventually made public as part of the country's historical record.</p>

<p>This reality of the information age might be particularly stark for the president, but it's no less true for all of us.  Conversation used to be ephemeral.  Whether face-to-face or by phone, we could be reasonably sure that what we said disappeared as soon as we said it. Organized crime bosses worried about phone taps and room bugs, but that was the exception.  Privacy was just assumed.</p>

<p>This has changed.  We chat in e-mail, over SMS and IM, and on social networking websites like Facebook, MySpace, and LiveJournal.  We blog and we Twitter.  These conversations -- with friends, lovers, colleagues, members of our cabinet -- are not ephemeral; they <a href="http://www.schneier.com/essay-109.html">leave their own electronic trails</a>.</p>

<p>We know this intellectually, but we haven't truly internalized it.  We type on, engrossed in conversation, forgetting we're being recorded and those recordings might come back to haunt us later.</p>

<p>Oliver North learned this, way back in 1987, when messages he thought he had deleted were saved by the White House PROFS system, and then subpoenaed in the Iran-Contra affair.  Bill Gates learned this in 1998 when his conversational e-mails were provided to opposing counsel as part of the antitrust litigation discovery process.  Mark Foley learned this in 2006 when his instant messages were <a href="http://abcnews.go.com/WNT/BrianRoss/story?id=2509586">saved and made public</a> by the underage men he talked to.  Paris Hilton learned this in 2005 when her cell phone account was <a href="http://www.washingtonpost.com/wp-dyn/content/article/2005/05/19/AR2005051900711.html">hacked</a>, and Sarah Palin learned it earlier this year when her Yahoo e-mail account was hacked.  Someone in George W. Bush's administration learned this, and <a href="http://www.cnn.com/2007/POLITICS/04/13/white.house.email/index.html">millions of e-mails</a> went mysteriously and conveniently missing.</p>

<p>Ephemeral conversation is dying.</p>

<p>Cardinal Richelieu famously said, :If one would give me six lines written by the hand of the most honest man, I would find something in them to have him hanged."  When all our ephemeral conversations can be saved for later examination, different rules have to apply.  Conversation is not the same thing as correspondence.  Words uttered in haste over morning coffee, whether spoken in a coffee shop or thumbed on a Blackberry, are not official pronouncements.  Discussions in a meeting, whether held in a boardroom or a chat room, are not the same as answers at a press conference.  And privacy isn't just about having something to hide; it <a href="http://www.schneier.com/essay-114.html">has enormous value</a> to democracy, liberty, and our basic humanity.</p>

<p>We can't turn back technology; electronic communications are here to stay and <a href="http://en.wikipedia.org/wiki/NSA_warrantless_surveillance_controversy">even our voice conversations are threatened</a>.  But as technology makes our conversations less ephemeral, we need laws to step in and safeguard ephemeral conversation.  We need a comprehensive data privacy law, protecting our data and communications regardless of where it is stored or how it is processed. We need laws forcing companies to keep it private and delete it as soon as it is no longer needed.  Laws requiring ISPs to store e-mails and other personal communications are exactly what we don't need.</p>

<p>Rules pertaining to government need to be different, because of the <a href="http://www.schneier.com/essay-208.html">power differential</a>.  Subjecting the president's communications to eventual public review increases liberty because it reduces the government's power with respect to the people.  Subjecting our communications to government review decreases liberty because it reduces our power with respect to the government.  The president, as well as other members of government, need some ability to converse ephemerally -- just as they're allowed to have unrecorded meetings and phone calls -- but more of their actions need to be subject to public scrutiny.</p>

<p>But laws can only go so far.  Law or no law, when something is made public it's too late.  And many of us like having complete records of all our e-mail at our fingertips; it's like our offline brains.</p>

<p>In the end, this is cultural.</p>

<p>The Internet is the greatest generation gap since rock and roll.  We're now witnessing one aspect of that generation gap: the younger generation chats digitally, and the older generation treats those chats as written correspondence.  Until our CEOs blog, our Congressmen Twitter, and our world leaders send each other LOLcats &ndash; until we have a Presidential election where both candidates have a complete history on social networking sites from before they were teenagers&ndash; we aren't fully an information age society.</p>

<p>When everyone leaves a public digital trail of their personal thoughts since birth, no one will think twice about it being there.  Obama might be on the younger side of the generation gap, but the rules he's operating under were written by the older side.  It will take another generation before society's tolerance for digital ephemera changes.</p>

<p>This essay <a href="http://online.wsj.com/article/SB122722381368945937.html">previously appeared</a> on <ui>The Wall Street Journal</a> website (not the print newspaper), and is an update of <a href="http://www.schneier.com/essay-129.html">something I wrote previously</a>.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=jPWiN"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=jPWiN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=hlUTN"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=hlUTN" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Mon, 24 Nov 2008 11:06:41 +0000</pubDate>
      <category domain="http://securityratty.com/tag/ephemeral conversation">ephemeral conversation</category>
      <category domain="http://securityratty.com/tag/conversation">conversation</category>
      <category domain="http://securityratty.com/tag/safeguard ephemeral conversation">safeguard ephemeral conversation</category>
      <category domain="http://securityratty.com/tag/ephemeral">ephemeral</category>
      <category domain="http://securityratty.com/tag/ephemeral conversations">ephemeral conversations</category>
      <category domain="http://securityratty.com/tag/conversations">conversations</category>
      <category domain="http://securityratty.com/tag/generation">generation</category>
      <category domain="http://securityratty.com/tag/generation gap">generation gap</category>
      <category domain="http://securityratty.com/tag/public scrutiny">public scrutiny</category>
      <source url="http://www.schneier.com/blog/archives/2008/11/the_future_of_e.html">The Future of Ephemeral Conversation</source>
    </item>
    <item>
      <title><![CDATA[Going Green]]></title>
      <link>http://securityratty.com/article/ecd5282a2817d16f8ff330457ec3dde5</link>
      <guid>http://securityratty.com/article/ecd5282a2817d16f8ff330457ec3dde5</guid>
      <description><![CDATA[Last year, IBM pledged to spend $1 Billion per year to figure out ways to make computing more energy efficient and environmentally friendly and named the plan Product Big Green . Of course, that...]]></description>
      <content:encoded><![CDATA[<p>Last year, IBM pledged to spend $1 Billion per year to figure out ways to make <a href="http://www.informationweek.com/news/hardware/windows_servers/showArticle.jhtml?articleID=199501024" target="_blank">computing more energy efficient</a> and environmentally friendly and named the plan “<a href="http://www-03.ibm.com/press/us/en/presskit/21440.wss" target="_blank">Product Big Green</a>.” Of course, that pledge was in far better financial circumstances for everyone involved, but you have to think that <a href="http://blogs.zdnet.com/green/?p=1432" target="_blank">pointing out ways for companies</a> to save is something you should actually be spending time and money (for IBM, a whole lot of it) on right about now.</p>
<p>Of course, virtualization can do its bit to help companies save on hardware, power and cooling costs. We have this straight from a customer’s mouth – <a href="http://blog.sciencelogic.com/green-it-and-virtualization-management-one-service-providers-tale/05/2008" target="_blank">see the video here</a>. And having your data center be 100% wind-powered certainly does its bit as well.</p>
<p>But the winner – according to <a href="http://www.eweek-digital.com/eweek-open/20081027/?pg=36" target="_blank">eWeek and and an EMA study in September</a> – is to turn equipment off when they’re not in use. I would say this is a no-brainer, but apparently we all need to be reminded…</p>
<p>Who remembers that line from the Schoolhouse Rock video on Energy? “So don’t get cross, when momma says turn that extra light off.” The full video for your viewing pleasure <a href="http://www.youtube.com/watch?v=o3nvDJe6PU0" target="_blank">here.</a></p>
<p><img style="border-right: 0px; border-top: 0px; border-left: 0px; border-bottom: 0px" src="http://blog.sciencelogic.com/wp-content/uploads/2008/11/mm830schoolhouse-rock-posters-1.jpg" border="0" alt="MM830~Schoolhouse-Rock-Posters-1" width="240" height="169" /></p>
<p><em>(</em><a href="http://images.google.com/imgres?imgurl=http://bp0.blogger.com/_ufCikM8JCvU/R5Kiu3PRq-I/AAAAAAAABJ8/5OmoalQJSlU/s400/MM830~Schoolhouse-Rock-Posters.jpg&amp;imgrefurl=http://freedomroadproject.blogspot.com/2008/01/school-house-rocks-rocks.html&amp;h=282&amp;w=400&amp;sz=57&amp;hl=en&amp;start=1&amp;um=1&amp;usg=__ex95lyi479W1oiH5FyLZQXb_088=&amp;tbnid=B8u199t8_1yXHM:&amp;tbnh=87&amp;tbnw=124&amp;prev=/images%3Fq%3Dschool%2Bhouse%2Brock%2Benergy%2Bblues%26um%3D1%26hl%3Den%26sa%3DG" target="_blank"><em>image from freedomroadproject</em></a><em>)</em></p>
]]></content:encoded>
      <pubDate>Fri, 07 Nov 2008 15:25:16 +0000</pubDate>
      <category domain="http://securityratty.com/tag/video">video</category>
      <category domain="http://securityratty.com/tag/schoolhouse rock video">schoolhouse rock video</category>
      <category domain="http://securityratty.com/tag/companies save">companies save</category>
      <category domain="http://securityratty.com/tag/companies">companies</category>
      <category domain="http://securityratty.com/tag/save">save</category>
      <category domain="http://securityratty.com/tag/energy">energy</category>
      <category domain="http://securityratty.com/tag/energy efficient">energy efficient</category>
      <category domain="http://securityratty.com/tag/bit">bit</category>
      <category domain="http://securityratty.com/tag/financial circumstances">financial circumstances</category>
      <source url="http://blog.sciencelogic.com/going-green/11/2008">Going Green</source>
    </item>
    <item>
      <title><![CDATA[DIY Phishing Pages With Command and Control Interfaces]]></title>
      <link>http://securityratty.com/article/78a81ce667063a0a1268788bb3f66128</link>
      <guid>http://securityratty.com/article/78a81ce667063a0a1268788bb3f66128</guid>
      <description><![CDATA[The day when DIY phishing pages start coming with manuals is the day when consciously or subconsciously a phisher is lowering down the entry barriers into phishing for yet another time. A much more...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://2.bp.blogspot.com/_wICHhTiQmrA/SRIwl6hmo2I/AAAAAAAACa8/_1fYFgW0kzk/s1600-h/rapidshare_phishing_admin_panel.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://2.bp.blogspot.com/_wICHhTiQmrA/SRIwl6hmo2I/AAAAAAAACa8/_1fYFgW0kzk/s200/rapidshare_phishing_admin_panel.jpg" /></a>The day when DIY phishing pages start coming with manuals is the day when consciously or subconsciously a phisher is lowering down the entry barriers into phishing for yet another time. A much more user-friendly compared to the old-fashioned -- yet effective -- <a href="http://ddanchev.blogspot.com/2007/09/209-host-locked.html">rock phish directory listing</a>, a recently released command and control interface for Rapidshare phishing campaigns aims to empower its users with easy dynamic link generation for their campaigns.<br />
<br />
<a href="http://3.bp.blogspot.com/_wICHhTiQmrA/SRLdeRIJEbI/AAAAAAAACbE/ta5F-iiF2gg/s1600-h/DIY_phishing_scripts.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://3.bp.blogspot.com/_wICHhTiQmrA/SRLdeRIJEbI/AAAAAAAACbE/ta5F-iiF2gg/s200/DIY_phishing_scripts.JPG" /></a>What they've managed to achieve is another trust factor since Rapidshare generates a second dynamic link upon clicking on the original one. The script not only generates a dynamically looking link, but also, actually logs in the victim into their account in order to avoid suspicion whereas it still logs all the accounting data.<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="http://3.bp.blogspot.com/_wICHhTiQmrA/SRLhzGDKcrI/AAAAAAAACbM/5-CHdeukArk/s1600-h/rapidshare_phishing_insecure_directory_permissions.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://3.bp.blogspot.com/_wICHhTiQmrA/SRLhzGDKcrI/AAAAAAAACbM/5-CHdeukArk/s200/rapidshare_phishing_insecure_directory_permissions.JPG" /></a></div>Scammers also tend to be ironic every then and now. For instance, in this particular case, one of the users finds it ironic that the Rapidshare phishing page is hosted at Rapidshare itself. Is the script actually working? It appears so at least going through a misconfigured accounting data dump left by one of the phishers.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2008/03/phishing-pages-for-every-bank-are.html">Phishing Pages for Every Bank are a Commodity</a><br />
<a href="http://ddanchev.blogspot.com/2007/08/diy-phishing-kits.html">DIY Phishing Kits</a><br />
<a href="http://ddanchev.blogspot.com/2007/09/diy-phishing-kit-goes-20.html">DIY Phishing Kit Goes 2.0</a><br />
<a href="http://ddanchev.blogspot.com/2008/05/diy-phishing-kits-introducing-new.html">DIY Phishing Kits Introducing New Features</a><br />
<a href="http://ddanchev.blogspot.com/2007/09/209-host-locked.html">209 Host Locked</a><br />
<a href="http://ddanchev.blogspot.com/2007/12/2091-host-locked.html">209.1 Host Locked</a><br />
<a href="http://ddanchev.blogspot.com/2007/11/661-host-locked.html">66.1 Host Locked</a><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=5kY3N"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=5kY3N" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=r8EaN"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=r8EaN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=Qtrtn"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=Qtrtn" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=qM6qn"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=qM6qn" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=T3U6N"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=T3U6N" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=YwrRN"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=YwrRN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=nQNrn"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=nQNrn" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/444324371" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 06 Nov 2008 03:31:43 +0000</pubDate>
      <category domain="http://securityratty.com/tag/diy">diy</category>
      <category domain="http://securityratty.com/tag/pages">pages</category>
      <category domain="http://securityratty.com/tag/rapidshare">rapidshare</category>
      <category domain="http://securityratty.com/tag/data dump">data dump</category>
      <category domain="http://securityratty.com/tag/data">data</category>
      <category domain="http://securityratty.com/tag/campaigns">campaigns</category>
      <category domain="http://securityratty.com/tag/dynamic link">dynamic link</category>
      <category domain="http://securityratty.com/tag/pages start">pages start</category>
      <category domain="http://securityratty.com/tag/link">link</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/444324371/diy-phishing-pages-with-command-and.html">DIY Phishing Pages With Command and Control Interfaces</source>
    </item>
    <item>
      <title><![CDATA[Are There Recession-Proof IT Products?]]></title>
      <link>http://securityratty.com/article/14ee1965cb0a5c1de3818f96fa79e8c8</link>
      <guid>http://securityratty.com/article/14ee1965cb0a5c1de3818f96fa79e8c8</guid>
      <description><![CDATA[You have to live under a rock not to know that the financial crisis is having (and will continue to have for some time yet) a major impact on buying decisions, both corporate and personal. Gartner cut...]]></description>
      <content:encoded><![CDATA[<p>You have to live under a rock not to know that the financial crisis is having (and will continue to have for some time yet) a major impact on buying decisions, both corporate and personal. <a href="http://www.eweek.com/c/a/IT-Infrastructure/With-the-Financial-Crisis-Looming-Gartner-Forrester-Trim-IT-Spending-Forecasts/?kc=EWWHNEMNL10232008STR1" target="_blank">Gartner cut its 2009 IT spending growth forecast</a> to 2.3%, less than half of the 5.8% it originally predicted just in August. And in <a href="http://www.crncanada.ca/index.php/VARBusiness/Gartner-lowers-2009-IT-spending-outlook.html?np=2" target="_blank">North America</a>, even more drastic cuts – growth will be only 0.5%, way down from the original 5.3% predicted.
<p>“Developed economics, especially in the United States and Western Europe, will be the worst affected, but emerging regions will not be immune,” said Peter Sondergaard, the global head of research at Gartner. “Europe will experience negative growth in 2009, the United States and Japan will be flat.”
<p>Forrester is more optimistic (so far). Back in September, the analyst firm revised their prediction downward to an <a href="http://www.techcareers.com/articles/i/ad3910/blogs/information-technology/wall-street-crisis-not-deterring-it-spending-forecasts.htm" target="_blank">increase of 6.1%</a> instead of the original 9.4%.
<p>But both firms agree that the first IT purchases to feel the cut are in hardware – PCs, servers, storage devices, communications equipment, etc. Next up, software purchases and IT servers.
<p>So are <a href="http://www.networkworld.com/newsletters/branch/2008/102008branch1.html" target="_blank">MSPs immune to the economic slow down</a>? With expected layoffs and certainly hiring freezes across the board, turning to MSPs to pick up part of the load is starting to look better and better. At the recent MSP Alliance conference in Chicago, attending MSPs had a rosy view about growth in their industry, with sales cycles actually shortening from 6-12 months down to 2-6 months and 25% of them actually increasing prices in the past six months. It’s a good time to be a MSP.</p>
]]></content:encoded>
      <pubDate>Thu, 23 Oct 2008 18:50:35 +0000</pubDate>
      <category domain="http://securityratty.com/tag/growth">growth</category>
      <category domain="http://securityratty.com/tag/experience negative growth">experience negative growth</category>
      <category domain="http://securityratty.com/tag/drastic cuts growth">drastic cuts growth</category>
      <category domain="http://securityratty.com/tag/msps immune">msps immune</category>
      <category domain="http://securityratty.com/tag/immune">immune</category>
      <category domain="http://securityratty.com/tag/msps">msps</category>
      <category domain="http://securityratty.com/tag/gartner cut">gartner cut</category>
      <category domain="http://securityratty.com/tag/cut">cut</category>
      <category domain="http://securityratty.com/tag/purchases">purchases</category>
      <source url="http://blog.sciencelogic.com/are-there-recession-proof-it-products/10/2008">Are There Recession-Proof IT Products?</source>
    </item>
    <item>
      <title><![CDATA[TIBCO BusinessEvents 3.0]]></title>
      <link>http://securityratty.com/article/de1f0c5b81d2a653775eaade21547299</link>
      <guid>http://securityratty.com/article/de1f0c5b81d2a653775eaade21547299</guid>
      <description><![CDATA[I was pleased to read the Paul Vincents post, TIBCO BusinessEvents 3.0 . TIBCO has always had a forward thinking vision for distributed computing and this release of BE 3.0 is another step in the...]]></description>
      <content:encoded><![CDATA[<p>I was pleased to read the Paul Vincent&#8217;s post, <a title="Permalink" href="http://tibcoblogs.com/cep/2008/09/22/tibco-businessevents-30/">TIBCO BusinessEvents 3.0</a>.    TIBCO has always had a forward thinking vision for distributed computing and this release of BE 3.0 is another step in the right direction.  TIBCO now has the only commercial-off-the-shelf (COTS) event processing platform on the market that supports distributed event processing, multi-agent architectures, distributed object caching, extensibility, continuous queries, state management and state-of-the-art rules.</p>
<p>Even thought TIBCO&#8217;s BusinessEvents does not yet support Bayesian Classifiers, Artificial Neural Networks and other advanced decision support algorithms, it is just a matter of time before TIBCO will add these advanced features &#8220;out of the box&#8221;.  On the other hand, the extensible nature of TIBCO&#8217;s BE makes it possible to add probabalistic computing functionality, however this requires quite a lot of programming and integration work.</p>
<p>When I see a great release like this for TIBCO, it makes me a little nostalgic for &#8220;the good old days&#8221; travelling the world in the front of the aircraft for TIBCO.   TIBCO has a rich and diverse customer base.  This customer base includes financial services companies; however, TIBCO is much less dependent on financial services than other event processing companies.   So, with TIBCO you not only get great technology, but rock-solid stability in an unstable and uncertain business world.</p>
<p>As a side note, an S&amp;P analyst recently <a href="http://www.thecepblog.com/2008/09/18/sp-downgrades-tibco-to-sell-on-financial-services-exposure/" target="_blank">downgraded</a> TIBCO&#8217;s stock <a href="http://online.barrons.com/quotes/main.html?symbol=tibx">(TIBX)</a>, primarily due to chao in the financial services sector.    Because of TIBCO&#8217;s global reach and stability, plus forward vision, advanced technologies and many years of commericial success, the S&amp;P downgrade will create a buying opportunity for TIBCO stock.</p>
]]></content:encoded>
      <pubDate>Wed, 24 Sep 2008 01:54:39 +0000</pubDate>
      <category domain="http://securityratty.com/tag/tibco businessevents">tibco businessevents</category>
      <category domain="http://securityratty.com/tag/tibco">tibco</category>
      <category domain="http://securityratty.com/tag/tibco stock">tibco stock</category>
      <category domain="http://securityratty.com/tag/tibcos">tibcos</category>
      <category domain="http://securityratty.com/tag/tibcos businessevents">tibcos businessevents</category>
      <category domain="http://securityratty.com/tag/tibcos global reach">tibcos global reach</category>
      <category domain="http://securityratty.com/tag/financial services">financial services</category>
      <category domain="http://securityratty.com/tag/financial services sector">financial services sector</category>
      <category domain="http://securityratty.com/tag/vision">vision</category>
      <source url="http://www.thecepblog.com/2008/09/24/tibco-businessevents-30/">TIBCO BusinessEvents 3.0</source>
    </item>
    <item>
      <title><![CDATA[VMworld 2008 Keynote with Paul Maritz]]></title>
      <link>http://securityratty.com/article/27088f9fffd4d9e8619b6768dd0513fa</link>
      <guid>http://securityratty.com/article/27088f9fffd4d9e8619b6768dd0513fa</guid>
      <description><![CDATA[Traveling towards VMworld 2008
I, along with thousands of others, wended my way through a vast dimly lit cavern of a place helped along by the strangely surreal sight of ushers in black waving wispy...]]></description>
      <content:encoded><![CDATA[<p><em><img style="border-top-width: 0px; border-left-width: 0px; border-bottom-width: 0px; margin: 5px; border-right-width: 0px" height="160" alt="paulmaritzvmware" src="http://blog.sciencelogic.com/wp-content/uploads/2008/09/paulmaritzvmware.jpg" width="240" align="left" border="0" /> Traveling towards VMworld 2008</em></p>
<p>I, along with thousands of others, wended my way through a vast dimly lit cavern of a place helped along by the strangely surreal sight of ushers in black waving wispy red flags to guide us not to the empty seats in front of us, but to the ones 50 yards on. (Ah Vegas, my feet hurt already.) Perhaps the point was to live in the moment, soak in the pre-rock concert atmosphere complete with a hip and cool soundtrack ripped off from Apple commercials. (Do they all use the same ad firm?) A better way to build the anticipation for, yes, the kickoff keynote session at <a href="http://www.vmworld.com/conferences/2008/" target="_blank">VMworld 2008</a>. (<em><a href="http://www.flickr.com/photos/jumpingshark/2862470725/" target="_blank">photo credit: lodev</a>)</em></p>
<p>To the sounds of <a href="http://www.youtube.com/watch?v=PEinqCHPY08" target="_blank">Hey Ya</a> (Shake it like a Polaroid picture), we shifted forward in our uncomfortable temporary seating placed, as at all tech conferences, too close for all but the skinny girls. The moment was here &#8211; one of those videos started playing on the dozen or so huge monitors floating above the convention crowd. You know this video; you&#8217;ve probably seen it before from HP or someone like that. One of those videos with instrumental Coldplay music in the background with time <a href="http://www.hp.com/hpinfo/newsroom/hpads/" target="_blank">lapse/speeded-up video</a> of people in motion and floating captions dropping into the images that leave you with a slight smile on your face as you &#8220;get&#8221; the relationship between image and text. (Do they all use the same ad firm?)</p>
<p>And here he is, announced like a Vegas headliner, <a href="http://vmblog.com/archive/2008/07/23/forbes-interviews-vmware-ceo-paul-maritz-after-financial-analyst-call.aspx" target="_blank">Paul Maritz, the new CEO of VMware</a>. Hmm. After all that hype, I rather expected someone in a black turtleneck and jeans to come out. Instead here&#8217;s this guy with pleat-front pants and an admittedly cool accent (New Zealand?) who looks a little like Al from Home Improvement. Not that there&#8217;s anything wrong with that &#8211; everyone likes Al.</p>
<p><em>And then the real fun begins.</em></p>
<ul>
<li>30 years ago, Paul Maritz started off his business career as a developer </li>
<li>10 years ago, VMware was founded by <a href="http://blog.sciencelogic.com/diane-greene-ousted-from-vmware/07/2008" target="_blank">Diane</a> <a href="http://virtualization.com/news/2008/07/08/diane-greene-vmware-paul-maritz/" target="_blank">Greene</a> and <a href="http://www.cio-weblog.com/50226711/found_rosenblum_leaves_vmware.php" target="_blank">Mendel</a> <a href="http://blog.sciencelogic.com/another-vmware-founder-leaves/09/2008" target="_blank">Rosenblum</a> (BTW, 10 seconds spent showing a slide with cartoon-ized images of the founders, &#8220;thanks for what you did for the company for the past 10 years&#8221;. 10 seconds after 10 years&#8230;but maybe more would have been hypocritical&#8230;) </li>
<li>a retrospective of centralized vs. decentralized computing initiatives from the 1960&#8217;s to today </li>
<li>of course VMware milestones from 1998 to today </li>
<li>and then an analyst-ready diagram showing the product roadmap (to be delivered in 2009) with, you guessed it, finally a connection between <a href="http://advice.cio.com/laurianne_mclaughlin/vmworld_ceo_maritz_outlines_broad_plans_for_cloud_and_client" target="_blank">VMware and cloud computing</a> (remember Maritz&#8217;s cloud-computing company was bought by EMC just a couple of years ago and that&#8217;s the section he headed up at EMC before being brought into VMware). </li>
</ul>
<p><em>Forward Looking</em></p>
<p>2008 (and probably much of 2009) will be a very busy year for VMware. If you believe the roadmap, <a href="http://www.uberpulse.com/us/2008/09/vmwares_ambitious_expansion_plan.php" target="_blank">VMware seems to be taking on the management of everything</a> &#8211; from chargeback and capacity planning to virtual storage and virtual networking (more to come on just what the planned vStorage and vNetwork will deliver) &#8211; but all of it VMware-centric. As <a href="http://blog.sciencelogic.com/vmware-is-better-than-microsoft/09/2008" target="_blank">we said in an earlier post,</a> they&#8217;ve moved away from &#8220;defending&#8221; the hypervisor business proposition to focusing on management services on top of their own hypervisor platform. Revenue pressures must be excruciating &#8211; who wants to be a public company these days?</p>
<p>The best part of that new &#8220;Virtual Data Center Operating System&#8221; <a href="http://www.vmware.com/technology/virtual-datacenter-os/" target="_blank">diagram/roadmap</a> was the addition (and I mean addition) of something called <a href="http://vmetc.com/2008/09/16/vmwares-vcloud-iniatives-the-vision-for-the-next-10-years/" target="_blank">Cloud vServices</a>. (Did anyone else find it odd that <a href="http://virtualization.com/news/2008/09/15/vcloud-vmware-to-be-cloud-computing-provider-too-but-inside-your-private-dc-and-not-tomorrow/" target="_blank">Cloud vServices</a> is kind of on its own in the Infrastructure vServices area? AND, I&#8217;ll have to get the other version of the diagram/roadmap I actually saw at the show because that one shows an inexplicable 4<sup>th</sup> box in the Application vServices area titled &#8220;&#8230;&#8221;. Really. Maybe to balance out the addition of <a href="http://www.itpro.co.uk/606237/vmwares-paul-maritz-goes-on-offence" target="_blank">Cloud vServices?</a>)</p>
<p>What was clear is that the move from VirtualCenter to vCenter &#8211;and the new vServices for rolled-up management of <a href="http://www.virtualization.info/2008/09/live-from-vmworld-2008-day-2-vmware.html" target="_blank">virtualization components</a>/capability to span multiple <a href="http://blogs.zdnet.com/virtualization/?p=542" target="_blank">VirtualCenters</a> (or future vCenters) for reporting, monitoring and management at scale &#8211; has been in the works for a bit (but in tech time, that could mean 6 months), but the cloud stuff&#8230;not so much.</p>
<p>Beyond the very high-level speak appropriate to a keynote (100+ service provider partners for off-premise cloud&#8230;suspended VM&#8217;s that you don&#8217;t have to pay for until you need it), the details are uber-fuzzy. There was a session that Dave went to which was supposed to shed more light, but when questions were asked about how it really works, the answers seemed to be TBD. Does anyone know more? If VMware really has figured out practical cloud computing for enterprises, kudos to them. But I fear they&#8217;re <a href="http://news.cnet.com/8301-13505_3-10042463-16.html?part=rss&amp;subj=news&amp;tag=2547-1_3-0-20" target="_blank">like everyone else</a> (except maybe AT&amp;T) and are still working out the details.</p>
]]></content:encoded>
      <pubDate>Wed, 17 Sep 2008 15:00:53 +0000</pubDate>
      <category domain="http://securityratty.com/tag/vservices">vservices</category>
      <category domain="http://securityratty.com/tag/infrastructure vservices">infrastructure vservices</category>
      <category domain="http://securityratty.com/tag/cloud vservices">cloud vservices</category>
      <category domain="http://securityratty.com/tag/cloud">cloud</category>
      <category domain="http://securityratty.com/tag/vmware">vmware</category>
      <category domain="http://securityratty.com/tag/vmware milestones">vmware milestones</category>
      <category domain="http://securityratty.com/tag/keynote">keynote</category>
      <category domain="http://securityratty.com/tag/vmware-centric">vmware-centric</category>
      <category domain="http://securityratty.com/tag/paul maritz">paul maritz</category>
      <source url="http://blog.sciencelogic.com/vmworld-2008-keynote-with-paul-maritz/09/2008">VMworld 2008 Keynote with Paul Maritz</source>
    </item>
    <item>
      <title><![CDATA[News from the Rock Phish Gang]]></title>
      <link>http://securityratty.com/article/dc125c8b2486a48f9daca3db254eb1ea</link>
      <guid>http://securityratty.com/article/dc125c8b2486a48f9daca3db254eb1ea</guid>
      <description><![CDATA[Definitely interesting : Based in Europe, the Rock Phish group is a criminal collective that has been targeting banks and other financial institutions since 2004. According to RSA, they are...]]></description>
      <content:encoded><![CDATA[<p><a href="http://www.rsa.com/blog/blog_entry.aspx?id=1338">Definitely</a> <a href="http://www.theregister.co.uk/2008/09/05/rock_phish_and_asprox_team_up/">interesting</a>:</p>

<blockquote>Based in Europe, the Rock Phish group is a criminal collective that has been targeting banks and other financial institutions since 2004. According to RSA, they are responsible for half of the worldwide phishing attacks and have siphoned tens of millions of dollars from individuals' bank accounts. The group got its name from a now discontinued quirk in which the phishers used directory paths that contained the word "rock."

<p>The first sign the group was expanding operations came in April, when it introduced a trojan known alternately as Zeus or WSNPOEM, which steals sensitive financial information in transit from a victim's machine to a bank. Shortly afterward, the gang added more crimeware, including a custom-made botnet client that was spread, among other means, using the Neosploit infection kit.</p>

<p>[...]</p>

<p>Soon, additional signs appeared pointing to a partnership between Rock Phishers and Asprox. Most notably, the command and control server for the custom Rock Phish crimeware had exactly the same directory structure of many of the Asprox servers, leading RSA researchers to believe Rock Phish and Asprox attacks were using at least one common server. (Researchers from Damballa were able to confirm this finding after observing malware samples from each of the respective botnets establish HTTP proxy server connections to a common set of destination IPs.)</blockquote> </p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=DDIkL"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=DDIkL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=LsDIL"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=LsDIL" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Wed, 10 Sep 2008 03:47:38 +0000</pubDate>
      <category domain="http://securityratty.com/tag/rock">rock</category>
      <category domain="http://securityratty.com/tag/rock phish">rock phish</category>
      <category domain="http://securityratty.com/tag/phishers">phishers</category>
      <category domain="http://securityratty.com/tag/rock phishers">rock phishers</category>
      <category domain="http://securityratty.com/tag/attacks">attacks</category>
      <category domain="http://securityratty.com/tag/asprox attacks">asprox attacks</category>
      <category domain="http://securityratty.com/tag/asprox">asprox</category>
      <category domain="http://securityratty.com/tag/rsa researchers">rsa researchers</category>
      <category domain="http://securityratty.com/tag/rsa">rsa</category>
      <source url="http://www.schneier.com/blog/archives/2008/09/news_from_the_r.html">News from the Rock Phish Gang</source>
    </item>
    <item>
      <title><![CDATA[Is Rock Phish cybergang set for a comeback?]]></title>
      <link>http://securityratty.com/article/8370aa031a7cb6076a96831b3d8587c0</link>
      <guid>http://securityratty.com/article/8370aa031a7cb6076a96831b3d8587c0</guid>
      <description><![CDATA[East European cybercrime gang Rock Phish is linking its Command &amp; Control server to the Asprox botnet in an apparent effort to boost its ability to propogate phishing...]]></description>
      <content:encoded><![CDATA[East European cybercrime gang Rock Phish is linking its Command & Control server to the Asprox botnet in an apparent effort to boost its ability to propogate phishing attacks.<br style="clear: both;"/>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v2:7ebf6151ec02f86388ab1eda96e5a6a0:sC5Wjp9RnqsaldSCZp0Fqb5js0iheRPoGLiirPGAHDBMhj%2FEch69tl2EvoE%2FA1yY8IWK%2FeLsDwP2IRGvEIuNo%2BPe6H5w4LCoOliSg50u9oo%3D'><img border='0' title='Add to digg' alt='Add to digg' src='http://www.pheedo.com/images/mm/digg.gif'/></a>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v2:7102e0dfd28df00a63029df0800b8885:5rdtUwwSS44Ik%2B3kZZpJAdnGrqW%2F5i5pWbiaiBnFrfL5waXdz%2B8JOYCbNKTvCo1rJ%2BSeTtcAlv2Ngd1ZIo5pndi8Z%2FhG6tQiP50WOUc%2Bt6Y%3D'><img border='0' title='Add to StumbleUpon' alt='Add to StumbleUpon' src='http://www.pheedo.com/images/mm/stumbleit.gif'/></a>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v2:8c1a06634e6a88ed03760f66a2ca4331:%2FNQxnY6rrW01zgRd%2BZtF%2BqG6QRdj6S8c38EcTrci6LnEtsObjaAi1yfkqfzVvfwtVd2cccSyG%2FP7W4bXzIGlTzCVQbhzjMalREHTwxTBM6o%3D'><img border='0' title='Add to Twitter' alt='Add to Twitter' src='http://www.pheedo.com/images/mm/twitter.png'/></a>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v2:b7656eb84262ca1e7cb269ee1c34557d:c9zOu0fnAKZj4Udynma6dYx3e2xJsvEBNS%2F6PadbYj1zgjwSd9W%2F58BzUznlmYespyIaz0M5qy3FBKyDHyQMMMJlDcDeTaRcJzQHYd6zPl0%3D'><img border='0' title='Add to Slashdot' alt='Add to Slashdot' src='http://www.pheedo.com/images/mm/slashdot.png'/></a>
<br style="clear: both;"/>  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=3423b84814d0d7ad728a067a057882ea" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=3423b84814d0d7ad728a067a057882ea" style="display: none;" border="0" height="1" width="1" alt=""/>]]></content:encoded>
      <pubDate>Fri, 05 Sep 2008 09:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/apparent effort">apparent effort</category>
      <category domain="http://securityratty.com/tag/control server">control server</category>
      <category domain="http://securityratty.com/tag/asprox botnet">asprox botnet</category>
      <category domain="http://securityratty.com/tag/attacks">attacks</category>
      <category domain="http://securityratty.com/tag/boost">boost</category>
      <category domain="http://securityratty.com/tag/ability">ability</category>
      <category domain="http://securityratty.com/tag/command">command</category>
      <source url="http://feeds.computerworld.com/click.phdo?i=3423b84814d0d7ad728a067a057882ea">Is Rock Phish cybergang set for a comeback?</source>
    </item>
    <item>
      <title><![CDATA[Is Rock Phish cybergang set for a comeback?]]></title>
      <link>http://securityratty.com/article/8788a9f50f1ce57294af2327b1e6eba2</link>
      <guid>http://securityratty.com/article/8788a9f50f1ce57294af2327b1e6eba2</guid>
      <description><![CDATA[RSA warns that the Rock Phish cybergang is upgrading its botnet for nefarious...]]></description>
      <content:encoded><![CDATA[RSA warns that the Rock Phish cybergang is upgrading its botnet for nefarious purposes.]]></content:encoded>
      <pubDate>Thu, 04 Sep 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/rock phish cybergang">rock phish cybergang</category>
      <category domain="http://securityratty.com/tag/rsa warns">rsa warns</category>
      <category domain="http://securityratty.com/tag/nefarious purposes">nefarious purposes</category>
      <category domain="http://securityratty.com/tag/botnet">botnet</category>
      <source url="http://www.networkworld.com/news/2008/090508-rock-phish.html?fsrc=rss-security">Is Rock Phish cybergang set for a comeback?</source>
    </item>
  </channel>
</rss>
