<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: seal]]></title>
    <link>http://securityratty.com/tag/seal</link>
    <description></description>
    <pubDate>Thu, 04 Oct 2007 20:00:00 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Links List 9.29.08]]></title>
      <link>http://securityratty.com/article/48fee769715c390d500bbc1e0ea43623</link>
      <guid>http://securityratty.com/article/48fee769715c390d500bbc1e0ea43623</guid>
      <description><![CDATA[Trade shows, trade shows and more trade shows. VMworld and Interop dominated the stage a couple of weeks ago and then there was the annual Oracle blowout in SF last week. Has anyone gotten any work...]]></description>
      <content:encoded><![CDATA[<p><img style="border-right: 0px; border-top: 0px; margin: 5px; border-left: 0px; border-bottom: 0px" src="http://blog.sciencelogic.com/wp-content/uploads/2008/09/oracle.jpg" border="0" alt="oracle" width="240" height="164" align="left" /> Trade shows, trade shows and more trade shows. VMworld and Interop dominated the stage a couple of weeks ago and then there was the annual Oracle blowout in SF last week. Has anyone gotten any work done lately?? <em>(</em><a href="http://flickr.com/photos/cdye/sets/72157607458101608/" target="_blank"><em>image from cdye1</em></a><em>)</em></p>
<p>Does <a href="http://sfcitizen.com/blog/2008/09/24/its-oracles-world-were-just-living-in-it/" target="_blank">Oracle run the world</a>? I would have to say no but Raj (Larry Ellison is his idol) and the 40,000 Oracle customers that descended upon SF last week might beg to differ. What do James Carville and Mary Matalin have to do with enterprise software? Pretty much nothing, except for the fact that they delivered the opening keynote for <a href="http://www.oracle.com/openworld/2008/index.html" target="_blank">Oracle OpenWorld</a>. (And that’s the only and last politically-oriented thing you’ll hear from me as we run up to the election). For a surprisingly funny and extensive photo gallery of the eye-popping event, check out <a href="http://flickr.com/photos/cdye/sets/72157607458101608/" target="_blank">cdye1’s photostream</a> on Flickr.</p>
<p>But UB40, Elvis Costello and Seal aside, Oracle OpenWorld did offer training, certifications, and always entertaining speeches by Ellison. Ben Worthen’s favorite – “<a href="http://blogs.wsj.com/biztech/2008/09/25/larry-ellisons-brilliant-anti-cloud-computing-rant/?mod=djemTECH" target="_blank">Larry Ellison’s Brilliant Anti-Cloud Computing Rant</a>” delivered to analysts on Thursday. From Ben’s slightly-edited excerpt:</p>
<p>“The interesting thing about cloud computing is that we’ve redefined cloud computing to include everything that we already do. I can’t think of anything that isn’t cloud computing with all of these announcements. The computer industry is the only industry that is more fashion-driven than women’s fashion. Maybe I’m an idiot, but I have no idea what anyone is talking about. What is it? It’s complete gibberish. It’s insane. When is this idiocy going to stop?</p>
<p>“We’ll make cloud computing announcements. I’m not going to fight this thing. But I don’t understand what we would do differently in the light of cloud computing other than change the wording of some of our ads. That’s my view.”</p>
<p>So did everyone catch that? Cloud computing is complete gibberish and idiocy, but apparently Oracle’s already been doing enough around it to advertise the fact. I will have my cake and eat it too!</p>
<p>We’ve been pumping out the posts from the shows we went to – let me tell you, live-blogging is hard when you’re trying to share apparently miniscule amounts of bandwidth with 14,000 other attendees – and we have even more to share as we step back, contemplate and describe how some of the announcements, info and especially roadmaps fit into our overall picture over here at ScienceLogic.</p>
<p>For example, we released the results of our annual industry IT survey last week. Twice a year – at FOSE (for Government IT) and at Interop NY (for enterprises) – we take advantage of the fact that we have a big beautiful booth at these shows and offer a fabulous ScienceLogic t-shirt in return for a couple of minutes time with attendees living the <a href="http://blog.sciencelogic.com/why-we-l-o-v-e-tradeshows/03/2008" target="_blank">problems we try to solve</a>. Instead of telling people what their problems and priorities are, we like to ask.<br />
<a href="http://blog.sciencelogic.com/interop-ny-survey-top-it-challenges-trends-and-what-it-is-spending-money-on/09/2008?" target="_blank">Interop NY Survey - Trends and Challenges</a><br />
<a href="http://www.sciencelogic.com/pressrelease_20080925.htm" target="_blank">Detailed Reports on Trends and Comparison to Government IT</a></p>
<p>And I just had to share this one because it is so bizarre. Are VMware and Paul Maritz guilty of <a href="http://it20.info/blogs/main/archive/2008/09/21/143.aspx" target="_blank">plagiarism</a>? You have to check this out to get even part of the picture. Apparently this guy has posted his slides (we know they are from VMworld 2007 because it says so in the lower-right-hand corner…) which prove that the “virtual datacenter operating system” idea was his idea a year before it showed up on Maritz’s keynote this year. Hmmm. And then after posting all these slides and making all the connections between his presentation and Maritz’s, he says he’s just kidding about the plagiarism. Can anyone sort this out and let me know?</p>
<p>I’ll tell you who wasn’t kidding when I went by their booth at VMworld – a certain chargeback vendor and VMware “partner” who was quite shocked two months ago when they walked into a meeting with VMware about future roadmap. Apparently, the slides they saw (preview of VMware’s announcement re adding extended chargeback capability within vCenter management services) were mighty might similar to slides they had given in a presentation to VMware about their own roadmap. Coincidence? I’ll let you decide. And I’ll also say, their strategy to combat this – support for Hyper-V coming early in 2009.</p>
]]></content:encoded>
      <pubDate>Mon, 29 Sep 2008 23:00:14 +0000</pubDate>
      <category domain="http://securityratty.com/tag/oracle openworld">oracle openworld</category>
      <category domain="http://securityratty.com/tag/oracle">oracle</category>
      <category domain="http://securityratty.com/tag/cloud">cloud</category>
      <category domain="http://securityratty.com/tag/annual oracle blowout">annual oracle blowout</category>
      <category domain="http://securityratty.com/tag/vmware">vmware</category>
      <category domain="http://securityratty.com/tag/vmware partner">vmware partner</category>
      <category domain="http://securityratty.com/tag/industry">industry</category>
      <category domain="http://securityratty.com/tag/annual industry">annual industry</category>
      <category domain="http://securityratty.com/tag/apparently oracles">apparently oracles</category>
      <source url="http://blog.sciencelogic.com/links-list-92908/09/2008">Links List 9.29.08</source>
    </item>
    <item>
      <title><![CDATA[Hype Alert: Internet Shopping Carts Are Secure]]></title>
      <link>http://securityratty.com/article/6f0706e64d78d354492017803497a079</link>
      <guid>http://securityratty.com/article/6f0706e64d78d354492017803497a079</guid>
      <description><![CDATA[My blog reader fed me a nugget today that set off my hype monitor, specifically a post entitled Internet Shopping Carts are Secure
OMG...really
To be fair, I realize the author is speaking from the...]]></description>
      <content:encoded><![CDATA[My blog reader fed me a nugget today that set off my hype monitor, specifically a post entitled <a href="http://hubpages.com/hub/Internet-Shopping-Carts-Are-Secure" taget="_blank">Internet Shopping Carts are Secure</a>. <br />OMG...really?<br />To be fair, I realize the author is speaking from the eCommerce perspective, rather than that of an information security practitioner, but here's where the trouble begins:<br /><span style="font-style:italic;">"Shopping cart service providers have developed secure ecommerce shopping cart solutions for any business owner looking to enhance their current online store, or create a new one. Some ecommerce shopping cart solution providers are even receiving PABP (Payment Application Best Practice) certification which supports PCI compliance requirements for all businesses accepting credit card payments online."</span><br />This may be true in part, but it is by no means an all-inclusive claim. Shopping carts continue to be sieve-like, even when apparently reviewed per <a href="https://www.pcisecuritystandards.org/security_standards/pci_dss.shtml" target="_blank">PCI</a> standards.<br />Allow me to elaborate.<br />We'll kick off our hype eliminating effort with a simple Google dork: <a href="http://www.google.com/search?hl=en&q=inurl%3A%22cart.cfm%22&btnG=Search" target="_blank"{>inurl:"cart.cfm"</a> (picking on ColdFusion again, but man, they make it easy)<br /><a href="http://www.gmpartsdirect.com/cart.cfm" target="_blank">GM Parts Direct: Your Shopping Cart</a> jumped right out at me for a number of reasons.<br />First, I sensed XSS vulns lurking like a Geiger counter senses radiation. Sound <a href="http://www.ringelkater.de/Sounds/2geraeusche_gegenst/geigerzaehler.wav" target="_blank">effect</a> for edification. :-)<br />Second, the page contained one of the growing number of aforementioned conversion-driving website <a href="http://sealserver.trustwave.com/cert.php?customerId=w6ordzctHpqOVGcB1cmBsViTpDGC2k&size=105x54&style=normal&language=en" target="_blank">security</a> seals. <br /><br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://3.bp.blogspot.com/_kVOWaY1TAF0/SN1tYvapkkI/AAAAAAAAADg/6k1ncKqufL4/s1600-h/GMparts.png" target="_blank"><img style="cursor:pointer; cursor:hand;" src="http://3.bp.blogspot.com/_kVOWaY1TAF0/SN1tYvapkkI/AAAAAAAAADg/6k1ncKqufL4/s320/GMparts.png" border="0" alt=""id="BLOGGER_PHOTO_ID_5250473012396397122" /></a><br /><br />Tick, tick, click...the Gieger counter is getting louder. <br />Trustwave claims that the site operator "is enrolled in Trustwave's Trusted Commerce™ program to validate compliance with the Payment Card Industry Data Security Standard (PCI DSS) mandated by all the major credit card associations including: American Express, Diners Club, Discover, JCB, MasterCard Worldwide, Visa, Inc. and Visa Europe."<br />Methinks that <a href="https://www.trustwave.com/" target="_blank">Trustwave's</a> Trusted Commerce program is missing a few fundamental security checks. Remember, XSS in PCI regulated sites, according to the <a href="https://www.pcisecuritystandards.org/security_standards/pci_dss.shtml" target="_blank">PCI DSS</a>, indicates that a site is not compliant (see section 6.5.4) if vulnerable to XSS.<br />Uh-oh.<br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://2.bp.blogspot.com/_kVOWaY1TAF0/SN1wVI4q8FI/AAAAAAAAADo/ZzFA7u8xNCA/s1600-h/GMparts_xss_trustwave.png" target="_blank"><img style="cursor:pointer; cursor:hand;" src="http://2.bp.blogspot.com/_kVOWaY1TAF0/SN1wVI4q8FI/AAAAAAAAADo/ZzFA7u8xNCA/s320/GMparts_xss_trustwave.png" border="0" alt=""id="BLOGGER_PHOTO_ID_5250476249048608850" /></a><br />All it takes is a fake login page, as opposed to our friends at <a href="http://xssed.com/" target="_blank">XSSED.com</a>, and...well, you get the point.<br />Simply, this is one of an endless number of shopping cart not secure, and not PCI compliant. For shame. You need only browse the <a href="http://holisticinfosec.org/content/category/6/23/45/" target="_blank">Holisticinfosec.org Advisories</a> page to find multiple ecommerce platforms and shopping carts that are missing the mark. Trust me, these are a fraction of the <a href="http://secunia.com/advisories/search/?search=shopping+cart" target="_blank">problem</a>.<br />ecommerce<>security<br />ecommerce<><a href="http://msdn.microsoft.com/en-us/library/ms995349.aspx" target="_blank">SDL</a><br />ecommerce<>PCI<br />website security seal<>security<br />Sigh.]]></content:encoded>
      <pubDate>Fri, 26 Sep 2008 11:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/ecommerce">ecommerce</category>
      <category domain="http://securityratty.com/tag/multiple ecommerce platforms">multiple ecommerce platforms</category>
      <category domain="http://securityratty.com/tag/ecommerce sdl">ecommerce sdl</category>
      <category domain="http://securityratty.com/tag/ecommerce perspective">ecommerce perspective</category>
      <category domain="http://securityratty.com/tag/pci">pci</category>
      <category domain="http://securityratty.com/tag/pci dss">pci dss</category>
      <category domain="http://securityratty.com/tag/cart solutions">cart solutions</category>
      <category domain="http://securityratty.com/tag/cart">cart</category>
      <category domain="http://securityratty.com/tag/ecommerce security">ecommerce security</category>
      <source url="http://holisticinfosec.blogspot.com/2008/09/hype-alert-internet-shopping-carts-are.html">Hype Alert: Internet Shopping Carts Are Secure</source>
    </item>
    <item>
      <title><![CDATA[Privacy Policies: Perception vs. Reality]]></title>
      <link>http://securityratty.com/article/c6ab13c8f9798b25208b85a3756682eb</link>
      <guid>http://securityratty.com/article/c6ab13c8f9798b25208b85a3756682eb</guid>
      <description><![CDATA[New paper: &quot;What Californians Understand About Privacy Online,&quot; by Chris Jay Hoofnagle and Jennifer King. From the abstract : A gulf exists between California consumers' understanding of online rules...]]></description>
      <content:encoded><![CDATA[<p>New paper: "What Californians Understand About Privacy Online," by Chris Jay Hoofnagle and Jennifer King.  From the <a href="http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1262130">abstract</a>:</p>

<blockquote>A gulf exists between California consumers' understanding of online rules and common business practices. For instance, Californians who shop online believe that privacy policies prohibit third-party information sharing. A majority of Californians believes that privacy policies create the right to require a website to delete personal information upon request, a general right to sue for damages, a right to be informed of security breaches, a right to assistance if identity theft occurs, and a right to access and correct data.

<p>These findings show that California consumers overvalue the mere fact that a website has a privacy policy, and assume that websites carrying the label have strong, default rules to protect personal data. In a way, consumers interpret "privacy policy" as a quality seal that denotes adherence to some set of standards. Website operators have little incentive to correct this misperception, thus limiting the ability of the market to produce outcomes consistent with consumers' expectations. Drawing upon earlier work, we conclude that because the term "privacy policy" has taken on a specific meaning in the minds of consumers, its use should be limited to contexts where businesses provide a set of protections that meet consumers' expectations.</blockquote></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=aTdqhL"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=aTdqhL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=xVYLkL"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=xVYLkL" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Thu, 04 Sep 2008 09:15:54 +0000</pubDate>
      <category domain="http://securityratty.com/tag/california consumers overvalue">california consumers overvalue</category>
      <category domain="http://securityratty.com/tag/consumers">consumers</category>
      <category domain="http://securityratty.com/tag/california consumers">california consumers</category>
      <category domain="http://securityratty.com/tag/privacy policy">privacy policy</category>
      <category domain="http://securityratty.com/tag/consumers interpret">consumers interpret</category>
      <category domain="http://securityratty.com/tag/website">website</category>
      <category domain="http://securityratty.com/tag/privacy policies">privacy policies</category>
      <category domain="http://securityratty.com/tag/website operators">website operators</category>
      <category domain="http://securityratty.com/tag/delete personal information">delete personal information</category>
      <source url="http://www.schneier.com/blog/archives/2008/09/privacy_policie.html">Privacy Policies: Perception vs. Reality</source>
    </item>
    <item>
      <title><![CDATA[Interview with Paul Cannon, Mozy Software Engineer]]></title>
      <link>http://securityratty.com/article/0cc76ea91cbf8ad59a01671da9da1295</link>
      <guid>http://securityratty.com/article/0cc76ea91cbf8ad59a01671da9da1295</guid>
      <description><![CDATA[Mozy Awesome Process
Sometimes people come up to me and say, Paul, how is it that Mozy has created such an unrelenting output of Awesome
Today I have been authorized to share with you some of the...]]></description>
      <content:encoded><![CDATA[<p><span style="font-size: small;"><span style="font-weight: bold;">Mozy Awesome Process</span></span><br />
Sometimes people come up to me and say, &#8220;Paul, how is it that Mozy has created such an unrelenting output of Awesome?&#8221;</p>
<p>Today I have been authorized to share with you some of the unique facets of the Mozy Awesome Process that until now have been tightly controlled trade secrets of Mozy, Inc. It all starts with giant robots (virtually perpetual sources of raw Awesome). We attach them to special Awesome Siphons of our own design and pipe the yield directly into our engineers&#8217; development workstations. Further, peripheral Awesome needs are farmed from old He-Man reruns, a roomful of ninjas wailing on electric guitars, and our captive Happy Fun Ball.</p>
<p>The crude Awesome is skillfully transformed by Mozy engineers into powerful software and hardware configurations, then carefully inspected and regulated according to a host of eldritch acronyms: SWAGs, PMQs, PRDs, and the ever-inspiring CFRRCs. Once a successful creation is stamped with the Seal of Acronymic Approval for Mozy (SAAM), it is subjected to final endorsement by the mystical, revered Mozy Leprecorn*. Finally, a highly trained team of Box Monks put the new Awesomery into place in the Mozy systems, where it becomes available to you, the user.</p>
<p>Our rigorous Awesome Enforcement Policies and Magical Oversight have brought us to what we believe is the most Awesome-efficient development process in the world of backup software.</p>
<p>Be safe,<br />
Paul Cannon<br />
Mozy Software Engineer</p>
<p>*Leprecorn (noun): a rare but phenomenal creature; half Unicorn, half Leprechaun, and all magical.</p>
<p><a title="Mozy" href="http://www.mozy.com/?ref=3f9a896b&amp;kbid=38419&amp;m=4&amp;i=77" target="_blank">Visit Mozy now for a great reliable online backup service, I use it myself.</a></p>
<p><img src="file:///C:/Users/SPYWAR~1/AppData/Local/Temp/moz-screenshot.jpg" alt="" /></p>
<p><img src="file:///C:/Users/SPYWAR~1/AppData/Local/Temp/moz-screenshot-1.jpg" alt="" /></p>
<p><img src="file:///C:/Users/SPYWAR~1/AppData/Local/Temp/moz-screenshot-2.jpg" alt="" /></p>
<p><span style="font-size: small;"><span style="font-weight: bold;">Vote for Mozy</span></span><br />
Lifehacker is currently holding an online backup showdown. Show your love for Mozy. <a title="Vote for Mozy on Lifehacker.com" href="http://click.news.mozy.com/?ju=fe3415747265057c761075&amp;ls=fdf011757767027476137173&amp;m=fef012747c6103&amp;l=fe881576736c01787d&amp;s=fe601679776d007d7014&amp;jb=ffcf14&amp;t=">Vote now</a>.</p>
]]></content:encoded>
      <pubDate>Wed, 16 Jul 2008 11:00:49 +0000</pubDate>
      <category domain="http://securityratty.com/tag/mozy">mozy</category>
      <category domain="http://securityratty.com/tag/mozy systems">mozy systems</category>
      <category domain="http://securityratty.com/tag/visit mozy">visit mozy</category>
      <category domain="http://securityratty.com/tag/mozy awesome process">mozy awesome process</category>
      <category domain="http://securityratty.com/tag/mozy software engineer">mozy software engineer</category>
      <category domain="http://securityratty.com/tag/awesome">awesome</category>
      <category domain="http://securityratty.com/tag/special awesome siphons">special awesome siphons</category>
      <category domain="http://securityratty.com/tag/mozy leprecorn">mozy leprecorn</category>
      <category domain="http://securityratty.com/tag/raw awesome">raw awesome</category>
      <source url="http://spywarebiz.com/spywarebizblog/?p=504">Interview with Paul Cannon, Mozy Software Engineer</source>
    </item>
    <item>
      <title><![CDATA[PC Universe is shrinking thanks to McAfee Secure's cluelessness]]></title>
      <link>http://securityratty.com/article/9d21b4916ac492044bfde2858ae4d650</link>
      <guid>http://securityratty.com/article/9d21b4916ac492044bfde2858ae4d650</guid>
      <description><![CDATA[My web app sec friends know exactly how to push my red buttons. &quot;Heh-heh, send it to Russ, he'll go off.&quot; Yep. ;-) Thanks, Rafal . Now I'm all spun up. I was sent two moronic gems this morning; one on...]]></description>
      <content:encoded><![CDATA[My web app sec friends know exactly how to push my red buttons. "Heh-heh, send it to Russ, he'll go off." Yep. ;-) Thanks, <a href="http://preachsecurity.blogspot.com/">Rafal</a>. Now I'm all spun up. I was sent two moronic gems this morning; one on the merits of McAfee Secure / Hacker Safe and the <a href="http://www.internetretailer.com/dailyNews.asp?id=24742">109%</a> sales increase it resulted in for <a href="http://pcuniverse.com/">PC Universe</a>, the other an interview with the Internet's single biggest dillweed, <a href="http://www.websharedesign.com/on-the-spot-with-webshare-hackersafe-sr-director-of-business-development-cresta-pillsbury.html">Cresta Pillsbury</a>. These articles are both a bit dated, but they equally embrace the premise of "trust" logos as a predominant sales driver, rather than any actual motivation to secure a site and protect consumers. <br />
An example:<br />
<span style="font-style:italic;">"If you’re doing conversion marketing and statistical testing on your website and you haven’t explored trust logos yet, then you’re missing out."</span><br />
I must be the most naive person in the world; this enrages me. When will the idiots who write this crap get a clue? They've bought right into the hype the <a href="http://holisticinfosec.blogspot.com/2008/05/saas-snake-oil-top-ten-with-video.html">snake oil salesmen</a> hoped they would and are now complicit in their failures. <br />
Case in point, as seen in the Internet Retailer piece. By the way, I realize that Internet Retailer and basic web application security practices are completely at odds, but this one deserves direct abuse.<br />
<span style="font-style:italic;">"PC Universe first tested Hacker Safe on its own site in an A/B split test in which half the visitors saw the Hacker Safe seal and half did not. During that test, 7.3% more orders came from Hacker Safe shoppers than from the control group. PC Universe, which operates on the web at PCUniverse.com, is No. 360 in the Internet Retailer Top 500 Guide."</span><br />
Really? Let's see what McAfee Secure / Hacker Safe has done to actually provide any measurable <span style="font-weight:bold;">security</span> benefit. <br />
How about absolutely nothing.<br />
Here's PC Universe's very current, verified McAfee Hacker Safe <a href="https://www.mcafeesecure.com/RatingVerify?ref=www.pcuniverse.com">cert</a>.<br />
Now, here are a few ridiculous examples of reality from the <span style="font-style:italic;">this</span> universe as opposed to the McAfee-twisted alternate universe. Please note, this is the "accountid" variable, and the fact that the marquee is rendered no less than eight times.<br />
1) <a href="http://pcuniverse.resultspage.com/search.php?w=test&accountid=%22%3E%3Cmarquee%3E%3Ch%31%3EThis_site_is_NOT_McAfee_Secure%3C%2Fh%31%3E%3C%2Fmarquee%3E&p=Q&ts=custom&available=available%3Ainstock&image1.x=0&image1.y=0&image1=Submit+search">Marquee</a>  <br />
2) <a href="http://pcuniverse.resultspage.com/search.php?w=test&accountid=%22%3E%3Cscript%20src%3Dhttp%3A//holisticinfosec.org/js/pleasefixme.js%3E%3C/script%3E&p=Q&ts=custom&available=available%3Ainstock&image1.x=0&image1.y=0&image1=Submit+search">XSS Deface</a> <br />
3) <a href="http://pcuniverse.resultspage.com/search.php?w=test&accountid=%22%3E%3CSCRIPT%3Ealert%28document%2Ecookie%29%3C%2FSCRIPT%3E&p=Q&ts=custom&available=available%3Ainstock&image1.x=0&image1.y=0&image1=Submit+search">Cookie</a><br />
If you rather just see a video of these vulns, it's <a href="http://holisticinfosec.org/video/pcuniverse/pcuniverse.html">here</a>.<br />
PC Universe, rather than lauding your sales increases thanks to some POS logo, try securing your site code. I guarantee you have other issues.<br />
McAfee Secure, once more, you are simply fraudulent to the core.<br />
<br />
<a href="http://del.icio.us/post?url=http://holisticinfosec.blogspot.com/2008/06/pc-universe-is-shrinking-thanks-to.html&title=PC%20Universe%20is%20shrinking%20thanks%20to%20McAfee%20Secure's%20cluelessness " title="PC Universe is shrinking thanks to McAfee Secure's cluelessness ">del.icio.us</a> | <a href="http://digg.com/submit?phase=2&amp;url=http://holisticinfosec.blogspot.com/2008/06/pc-universe-is-shrinking-thanks-to.html" title="PC Universe is shrinking thanks to McAfee Secure's cluelessness ">digg</a>]]></content:encoded>
      <pubDate>Fri, 27 Jun 2008 06:11:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/internet retailer piece">internet retailer piece</category>
      <category domain="http://securityratty.com/tag/internet retailer">internet retailer</category>
      <category domain="http://securityratty.com/tag/secure">secure</category>
      <category domain="http://securityratty.com/tag/mcafee secure">mcafee secure</category>
      <category domain="http://securityratty.com/tag/universe">universe</category>
      <category domain="http://securityratty.com/tag/internet retailer top">internet retailer top</category>
      <category domain="http://securityratty.com/tag/hacker safe seal">hacker safe seal</category>
      <category domain="http://securityratty.com/tag/hacker safe">hacker safe</category>
      <category domain="http://securityratty.com/tag/hacker safe shoppers">hacker safe shoppers</category>
      <source url="http://holisticinfosec.blogspot.com/2008/06/pc-universe-is-shrinking-thanks-to.html">PC Universe is shrinking thanks to McAfee Secure's cluelessness</source>
    </item>
    <item>
      <title><![CDATA[Online intruder makes off with SwimwearBoutique.com customer data]]></title>
      <link>http://securityratty.com/article/ce68ee3873573126adbe70597b391085</link>
      <guid>http://securityratty.com/article/ce68ee3873573126adbe70597b391085</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
4/16/08

Organization
Swimwear Boutique (&quot;SWB

Contractor/Consultant/Branch
None

Victims
Customers

Number Affected
Unknown

Types of Data
Name,...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/swimwear.jpg" align="right" height="69" width="200"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>4/16/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.swimwearboutique.com/">Swimwear Boutique ("SWB")</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Customers<br><br><span style="font-weight: bold;">Number Affected:</span><br>Unknown<br><br><span style="font-weight: bold;">Types of Data:</span><br>Name, address, email address, SWB account password, and credit card information<br><br><span style="font-weight: bold;">Breach Description:</span><br>SwimwearBoutique.com "recently discovered that a person may have illegally gained unauthorized access to your personal information stored in your SWB account.&nbsp; We believe that this person unlawfully accessed the SWB Internet site between March 26, 2008 and March 28, 2008.&nbsp; The information accessed varied, but could have included your name, address, email address, SWB account password, and credit card account number"<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://doj.nh.gov/consumer/pdf/swimwear.pdf">New Hampshire State Attorney General breach notification</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>The New Hampshire State Attorney General<br><br><span style="font-weight: bold;">Response:</span><br>From the online source cited above:<br><br>I am writing to you on behalf of my client SwimwearBoutique.com ("SWB") because it determined on March 28, 2008 that it was the victim of an illegal intrusion into its systems.<br><br>Criminals unlawfully obtained access to certain databases containing various information, which could have included names, addresses, and credit card information of approximately 37 residents of New Hampshire, who were SWB customers.<br><span style="font-style: italic;">[Evan] 37 residents in New Hampshire alone.&nbsp; I assume that the number nation/worldwide would be much higher.</span><br><br>We believe that this person unlawfully accessed the SWB Internet site between March 26, 2008 and March 28, 2008.<br><br>These criminals also corrupted data maintained by SWB, rendering certain data unreadable and unusable.<br><span style="font-style: italic;">[Evan] Could this be the purpose behind the SWB note on their Sign In page?</span><br><br><img src="http://images.quickblogcast.com/95781-88451/swimwear2.jpg" border="0" width="497"><br><br>We reported this crime to the Dallas office of the United States Secret Service, and are assisting with the investigation.<br><br>We hope that the criminals responsible will be apprehended and prosecuted to the fullest extent of the law.<br><span style="font-style: italic;">[Evan] Geez.&nbsp; I think we all hope for this, but the reality is that online intruders are rarely caught and prosecuted.</span><br><br>SWB also worked with its existing Internet security provider, McAfee, to determine how these criminals gained access to this information and immediately implemented measures to counter such unlawful conduct.<br><br>We are monitoring the site for further attempts to break into the site and we continue to work with McAfee to maintain the security of the site.<br><span style="font-style: italic;">[Evan] Although I don't see the "Hacker Safe" seal anywhere on the site today, this is the McAfee service that SwimwearBoutique.com uses.&nbsp; In January, 2008 we reported the Geeks.com (also a Hacker Safe customer) </span><a style="font-style: italic;" href="http://breachblog.com/2008/01/07/geeks.aspx">breach</a><span style="font-style: italic;">.</span><br><br>We already have notified our merchant bank and are cooperating with it to provide a list of the affected individuals to it.<br><br>Notification letters will be sent out on April 23, 2008.<br><br>Affected customers also can contact us for more information at 1-866-SWIMWEAR.<br><br>In addition, to any affected customer requesting assistance from us, SWB will offer a year's subscription to the LoudSiren Identity Protection Network.<br><span style="font-style: italic;">[Evan] This statement is included in the letter to the New Hampshire State Attorney General.&nbsp; I did NOT see any reference to this in the letter that went to affected customers.&nbsp; Huh.</span><br><br>We are committed to helping our customers affected by these criminal acts.<br><br>We deeply regret that a valued customer like you may have been affected by the criminals.<br><br><span style="font-weight: bold;">Commentary:</span><br>People like simple solutions and quick fixes which often seem to lead to shortcuts and a false sense of security.&nbsp; Does a "Hacker Safe" seal or PCI compliance mean that your credit card information will be safe?&nbsp; No, it certainly doesn't.&nbsp; Understand these for what they are, a baseline level of security that only meets a certain number of requirements.&nbsp; There is a heckuva lot more to information security.&nbsp; Don't get me wrong, I think that requirements and baselines are important, but they are not more than a cog in a complex machine.<br><br>A tip for online consumers:<br>Check out <a href="http://www.paypal.com/cgi-bin/webscr?cmd=xpt/cps/account/VDCFrequentlyAskedQuestions-outside">PayPal's Virtual Debit Card</a>.&nbsp; "PayPal Virtual Debit Card generates a virtual card number each time you make a transaction online so you don't have to use your personal debit or credit card number."&nbsp; A one time credit card number.&nbsp; If your card number is compromised, it only affects the one transaction.&nbsp; Fraudsters are unable to rack up additional charges. Cool.<br><br><span style="font-weight: bold;">Past Breaches:</span><br>None</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/04/27/swimwear.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Sat, 26 Apr 2008 20:22:24 +0000</pubDate>
      <category domain="http://securityratty.com/tag/credit card account">credit card account</category>
      <category domain="http://securityratty.com/tag/credit card">credit card</category>
      <category domain="http://securityratty.com/tag/time credit card">time credit card</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/information security">information security</category>
      <category domain="http://securityratty.com/tag/credit card information">credit card information</category>
      <category domain="http://securityratty.com/tag/customers">customers</category>
      <category domain="http://securityratty.com/tag/swb customers">swb customers</category>
      <source url="http://breachblog.com/2008/04/27/swimwear.aspx">Online intruder makes off with SwimwearBoutique.com customer data</source>
    </item>
    <item>
      <title><![CDATA[Personal information of 103,000 doctors from 11 states posted to web site]]></title>
      <link>http://securityratty.com/article/c39a492ceda48e204ec0a4cb7f58700e</link>
      <guid>http://securityratty.com/article/c39a492ceda48e204ec0a4cb7f58700e</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
2/27/08

Organization
Health Net, Inc

Contractor/Consultant/Branch
Health Net Federal Services

Victims
Doctors in eleven states

The states involved...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/hn.jpg" align="right" height="56" width="198">
<font size="2"><span style="font-weight: bold;">Date Reported: </span><br>2/27/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="https://www.healthnet.com/portal/member/home.do">Health Net, Inc.</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="https://www.hnfs.net/common/home/">Health Net Federal Services</a> <br><br><span style="font-weight: bold;">Victims:</span><br>Doctors in eleven states*<br><br><font size="1">*The states involved include Wisconsin, Michigan, Illinois, Indiana, Ohio, Pennsylvania, Tennessee, Iowa, Missouri, Kentucky and West Virginia.</font><br><br><span style="font-weight: bold;">Number Affected:</span><br>103,000<br><br><span style="font-weight: bold;">Types of Data:</span><br>Names, Social Security numbers, work addresses, and national insurance identification numbers.<br><br><span style="font-weight: bold;">Breach Description:</span><br>Heath Net Federal Services inadvertently posted sensitive personal information to a publicly accessible web server.&nbsp; The breach affects as many as 103,000 doctors from eleven states.<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.weau.com/news/headlines/16061387.html">WEAU Channel 13 News</a> <br><a href="http://www.wdtn.com/Global/story.asp?S=7944162">WDTN Channel 2 News</a> <br><a href="http://www.radioiowa.com/gestalt/go.cfm?objectid=66210F30-C6BB-1F10-839844AFE4B66F7B">Radio Iowa news story</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>WEAU Channel 13 News<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>Health Net Federal Services representatives told us Wednesday night the company notified 103-thousand doctors in eleven states that their personal information was openly posted on a company website.<br><span style="font-style: italic;">[Evan] I assume that this was a publicly accessible web site, but this isn't clear.</span><br><br>The company is a government contractor that deals with health insurance for military families and veterans.<br><br>The states involved include Wisconsin, Michigan, Illinois, Indiana, Ohio, Pennsylvania, Tennessee, Iowa, Missouri, Kentucky and West Virginia.<br><br>Director of Communications, Molly Tuttle, says the information was accidently posted to the website for about two months, and involved doctors who had filed a claim with the company between September of 2005, and September of 2006.<br><span style="font-style: italic;">[Evan] I wonder how it was detected.&nbsp; Two months is plenty of time for search bots to index the site if it was publicly accessible.</span><br style="font-style: italic;"><br>The mistake was attributed to human error and software problems.<br><span style="font-style: italic;">[Evan] Both?</span><br><br>Health Net Federal Services is now paying for a year's worth of credit monitoring for the doctors involved, and is not aware of any circumstances where the personal information of any doctor has been obtained or used illegally.<br><span style="font-style: italic;">[Evan] Monitoring for one year, Social Security number for life.</span><br><br>"Protecting the privacy of our providers’ personal information is a critical priority at Health Net Federal Services. Unfortunately, in late December 2007, we were notified of potential vulnerability for us that provider data was accessible through our Web site that included social security numbers of a limited group of network and non-network providers.<br><br>Since that time, Health Net has sealed this data gap, notified the providers whose data was potentially accessible, and reported the incident to our customer.<br><span style="font-style: italic;">[Evan] What "data gap"?&nbsp; They didn't "seal" the employee that made the mistake, did they?</span><br><br>In an abundance of caution, Health Net hired outside IT security experts to test our security measures and found them sound.<br><br>We regret any alarm this may have caused<br><br>Some doctors have complained in emails obtained by NewsCenter 13, that credit monitoring for a year isn't enough.<br><br><span style="font-weight: bold;">Commentary:</span><br>In the WEAU article, the Medical Director for the Western Division of Marshfield Clinic, Dr. Greg Burnett mentions how the clinic is pushing for the use of national insurance numbers (NPIs) instead of Social Security numbers and other personal information.&nbsp; This is a great idea!&nbsp; Today, doctors are required to give their personal information to insurance companies.<br><br>Also, Burnett now says in light of the recent online mistake, Marshfield Clinic is trying to decide if ending the business relationship with Health Net Federal Services, would better protect its doctors in the future.<br><br>According to the report there were two causes to this breach, "human error and software problems".&nbsp; It's hard to believe that it was both at the same time.&nbsp; Humans will always be humans, and we will always make mistakes. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>January, 2008 - <a href="http://breachblog.com/2008/01/05/hn.aspx">5,000 Health Net employees affected by stolen laptop</a></font><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/03/03/hn.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Mon, 03 Mar 2008 06:19:48 +0000</pubDate>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/sensitive personal information">sensitive personal information</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/providers personal information">providers personal information</category>
      <category domain="http://securityratty.com/tag/doctors">doctors</category>
      <category domain="http://securityratty.com/tag/health net">health net</category>
      <category domain="http://securityratty.com/tag/health net employees">health net employees</category>
      <category domain="http://securityratty.com/tag/103-thousand doctors">103-thousand doctors</category>
      <category domain="http://securityratty.com/tag/social security">social security</category>
      <source url="http://breachblog.com/2008/03/03/hn.aspx">Personal information of 103,000 doctors from 11 states posted to web site</source>
    </item>
    <item>
      <title><![CDATA[Using EV Certificates OverStock.com Sees Less Shopping Cart Abandonment]]></title>
      <link>http://securityratty.com/article/88edf740c950a18ec4fb68d5b0442e88</link>
      <guid>http://securityratty.com/article/88edf740c950a18ec4fb68d5b0442e88</guid>
      <description><![CDATA[Source: Verisign) Overstock.com deployed the VeriSign Secured Seal and VeriSign Extended Validation SSL Certificates to further enhance customers' confidence when transacting on its Web site. As a...]]></description>
      <content:encoded><![CDATA[<b>(Source: Verisign)</b>  Overstock.com deployed the VeriSign Secured Seal and VeriSign&reg; Extended Validation SSL Certificates to further enhance customers' confidence when transacting on its Web site. As a result of the enhancement, site visitors with browsers that support the new certificate now abandon their shopping cart 8.6% less than other site visitors.
<p><a href="http://feeds.computerworld.com/~a/Computerworld/Security/News?a=4HbRWm"><img src="http://feeds.computerworld.com/~a/Computerworld/Security/News?i=4HbRWm" border="0"></img></a></p><img src="http://feeds.computerworld.com/~r/Computerworld/Security/News/~4/227441000" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 14 Feb 2008 11:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/site visitors">site visitors</category>
      <category domain="http://securityratty.com/tag/verisign">verisign</category>
      <category domain="http://securityratty.com/tag/overstock">overstock</category>
      <category domain="http://securityratty.com/tag/web site">web site</category>
      <category domain="http://securityratty.com/tag/enhance customers">enhance customers</category>
      <category domain="http://securityratty.com/tag/validation ssl">validation ssl</category>
      <category domain="http://securityratty.com/tag/cart">cart</category>
      <category domain="http://securityratty.com/tag/support">support</category>
      <category domain="http://securityratty.com/tag/seal">seal</category>
      <source url="http://feeds.computerworld.com/~r/Computerworld/Security/News/~3/227441000/whitepapers.do">Using EV Certificates OverStock.com Sees Less Shopping Cart Abandonment</source>
    </item>
    <item>
      <title><![CDATA['Hacker Safe' seal: Web site shield, or target?]]></title>
      <link>http://securityratty.com/article/306d0f47ef1d47d2150011e4b2d6cbf9</link>
      <guid>http://securityratty.com/article/306d0f47ef1d47d2150011e4b2d6cbf9</guid>
      <description><![CDATA[More than 80,000 Web sites worldwide display a small green logo that proclaims them to be &quot;Hacker Safe.&quot; The logo is provided to them by ScanAlert, a vendor that scans the sites of its clients daily...]]></description>
      <content:encoded><![CDATA[More than 80,000 Web sites worldwide display a small green logo that proclaims them to be "Hacker Safe." The logo is provided to them by ScanAlert, a vendor that scans the sites of its clients daily in search of security vulnerabilities.]]></content:encoded>
      <pubDate>Mon, 21 Jan 2008 21:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/hacker safe">hacker safe</category>
      <category domain="http://securityratty.com/tag/logo">logo</category>
      <category domain="http://securityratty.com/tag/security vulnerabilities">security vulnerabilities</category>
      <category domain="http://securityratty.com/tag/clients daily">clients daily</category>
      <category domain="http://securityratty.com/tag/sites">sites</category>
      <category domain="http://securityratty.com/tag/scanalert">scanalert</category>
      <category domain="http://securityratty.com/tag/scans">scans</category>
      <category domain="http://securityratty.com/tag/proclaims">proclaims</category>
      <category domain="http://securityratty.com/tag/vendor">vendor</category>
      <source url="http://www.networkworld.com/news/2008/012208-hacker-safe-seal-web-site.html?fsrc=rss-security">'Hacker Safe' seal: Web site shield, or target?</source>
    </item>
    <item>
      <title><![CDATA[PCI certification on Websites]]></title>
      <link>http://securityratty.com/article/8dc644b095af374b45616dec3bf68230</link>
      <guid>http://securityratty.com/article/8dc644b095af374b45616dec3bf68230</guid>
      <description><![CDATA[A reader recently asked me about obtaining a seal of compliance for websites that have passed a PCI audit. This is an interesting topic, because many merchants have expressed interest in this....]]></description>
      <content:encoded><![CDATA[A reader recently asked me about obtaining a seal of compliance for websites that have passed a PCI audit. This is an interesting topic, because many merchants have expressed interest in this. Currently, there is no official seal or website logo for merchants that are PCI DSS compliant. However, there are a number of popular seals that web merchants may use to represent good security practices. These include:...]]></content:encoded>
      <pubDate>Thu, 04 Oct 2007 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/web merchants">web merchants</category>
      <category domain="http://securityratty.com/tag/merchants">merchants</category>
      <category domain="http://securityratty.com/tag/seal">seal</category>
      <category domain="http://securityratty.com/tag/official seal">official seal</category>
      <category domain="http://securityratty.com/tag/pci dss compliant">pci dss compliant</category>
      <category domain="http://securityratty.com/tag/popular seals">popular seals</category>
      <category domain="http://securityratty.com/tag/website logo">website logo</category>
      <category domain="http://securityratty.com/tag/pci audit">pci audit</category>
      <category domain="http://securityratty.com/tag/websites">websites</category>
      <source url="http://www.rsa.com/blog/blog_entry.aspx?id=1231">PCI certification on Websites</source>
    </item>
  </channel>
</rss>
