<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: severe]]></title>
    <link>http://securityratty.com/tag/severe</link>
    <description></description>
    <pubDate>Mon, 28 Jul 2008 20:00:00 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Stop Me if This Sounds Familiar]]></title>
      <link>http://securityratty.com/article/07468c09eca48cc8bfe532a83b3d394a</link>
      <guid>http://securityratty.com/article/07468c09eca48cc8bfe532a83b3d394a</guid>
      <description><![CDATA[My favorite book from last year was Charlie Munger's &quot;Poor Charlie's Almanack&quot; , there are so many fascinating parts in the book I can't go into them all here. Charlie Munger is Warren Buffett's...]]></description>
      <content:encoded><![CDATA[<p><a href="http://www.poorcharliesalmanack.com/index.html" style="float: left;"><img alt="Cover3rd" class="at-xid-6a00d83451c75869e2010535d3d4a3970c " src="http://1raindrop.typepad.com/.a/6a00d83451c75869e2010535d3d4a3970c-120wi" style="margin: 0px 5px 5px 0px;" /></a>
 My favorite book from last year was Charlie Munger&#39;s <a href="http://www.poorcharliesalmanack.com/index.html">&quot;Poor Charlie&#39;s Almanack&quot;</a>, there are so many fascinating parts in the book I can&#39;t go into them all here. Charlie Munger is Warren Buffett&#39;s partner at Berkshire Hathaway, the book is a collection of a number of his speeches, and serves as a great backdrop for today&#39;s events, an &#0160;investing education, and a way to think through complex problems (&quot;invert! always invert!&quot;). It goes without saying that I think you should buy this book.&#0160;</p><br /><div>Chapter Three is a collection of Munger&#39;s unscripted remarks at Berkshire Hathaway and Wesco annual meetings. The below sections were transcribed by <a href="http://www.tilsonfunds.com/">Whitney Tilson</a>, &#0160;from annual meetings around the 2003-4 time period, and are pretty interesting given our current financial predicament.</div><br /><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-weight: bold; ">Warnings About Financial Institutions and Derivatives</span></p><p><span style="font-weight: bold; ">Risks of Financial Institutions</span><br />The nature of a financial institution is that there are a lot of ways to go to hell in a bucket. You can push credit too far, do a dumb acquisition, leverage yourself excessively---its not just derivatives [that can bring about your downfall].</p><p>Maybe it&#39;s unique to us, but we&#39;re quite sensitive to financial risks. Financial institutions make us nervous when they&#39;re trying to do well.</p><p>We&#39;re exceptionally goosey of leveraged financial institutions. If they start talking about how good their risk management is, it makes us nervous.</p><p>We fret way earlier than other people. We&#39;ve left a lot of money on the table through early fretting. It&#39;s the way we are -- you&#39;ll just have to live with it.</p><p><span style="font-weight: bold; ">Derivatives</span><br />The system is almost insanely irresponsible. and what people think are fixes aren&#39;t realy fixes. It&#39;s so complicated I can&#39;t do it justice here - but you can&#39;t believe the trillions of dollars involved. You can&#39;t believe the complexity. You can&#39;t believe how difficult it is to do the accounting. You can&#39;t believe how big the incentives are to have wishful thinking about values and wishful thinking about ability to clear.</p><p>People don&#39;t think about the consequences of the consequences. People start by trying to hedge against interest rate changes, which is very difficult and complicated. Then, the hedges make the [reported profits] lumpy. So they use the new derivatives to smooth this. Well, now you&#39;ve morphed into lying. This turns into a Mad Hatter&#39;s Tea Party. This happens to vast, sophisticated corporations.</p><p>Somebody has to step in and say, &quot;We&#39;re not going to do it - it&#39;s just too hard.&quot;</p><p>I think a good litmus test of the mental and moral quality at any large institutions [with significant derivative exposure] would be to ask them, &quot;Do you really understand your derivatives book?&quot; Anyone who says yes is either crazy or lying.</p><p>It&#39;s easy to see [the dangers] when you talk about [what happened with] the energy derivatives - they went kerflooey. When [the companies] reached for the assets that were on their books, the money wasn&#39;t there. When it comes to financial assets, we haven&#39;t had any such denouement and the accountings hasn&#39;t changed so the denouement is ahead of us.</p><p>Derivatives are full of clauses that say if one party&#39;s credit gets downgraded then it has to put up collateral. It&#39;s like margin - you can go broke [just putting up more margin]. In an attempt to protect themselves, they&#39;ve introduced instability. Nobody seems to recognize what a disaster of a system they&#39;ve created. It&#39;s a demented system.&#0160;</p><p>In engineering people have a big margin of safety. But in the financial world, people don&#39;t give a damn about safety. They let it balloon and balloon and balloon. It&#39;s aided by false accounting. I&#39;m more pessimistic about this than Warren is.</p><p><span style="font-weight: bold; ">Accounting for Derivatives</span><br />I hate with a passion GAAP [Generally Accepted Accounting Principles] as applied to derivatives and swaps. JP Morgan sold out to this type of accounting to front-end revenues. I think it&#39;s a disgrace.</p><p>It&#39;s bonkers, and the accountants sold out. Everyone caved, adopted loose [accounting] standards, and created exotic derivatives linked to theoretical models. As a result, all kinds of earnings, blessed by accountants, are not really being earned. When you reach for the money, it melts away. It was never there.</p><p>It [accounting for derivatives] is just disgusting. It is a sewer, and if I&#39;m right, there will be hell to pay in due course. All of you will have to prepare to deal with a blowup of derivative books.</p><p><span style="font-weight: bold; ">Likelihood of a Derivatives Blowup</span><br />We tried to sell Gen Re&#39;s derivatives operations and couldn&#39;t, so we started liquidating it. We had to take big markdowns. I would confidently predict that most of the derivatives books of [this country&#39;s] major banks cannot be liquidated for anything like what they&#39;re carried on the books at. When the denouement will happen and how severe it will be, I don&#39;t know. But I fear the consequences could be fearsome. I think there are major problems, worse than in the energy field, and look at the destruction there.</p><p>I&#39;ll be amazed if we don&#39;t have some kind of significant [derivatives-related] blowup in the next five to ten years.</p><p>I think we&#39;re he only big corporation in America to be running off its derivative book.</p><p>It&#39;s a crazy idea for people who are already rich - &#0160;like Berkshire - to be in this business. It&#39;s a crazy business for big banks to be in.</p><p>Yo would be disgusted if you had a fair mind and spent a month really delving into a big derivative operation. You would think it was Lewis Carroll. You would think it was the Mad Hatter&#39;s Tea Party. And the false precision of these people is just unbelievable. They make the worst economics professors look like gods. Moreover, there is depravity augmenting the folly. Read the book F.I.A.S.C.O., by law professor and former derivative trader Frank Partnoy, an insider account of the depravity of derivative trading at one of the biggest and best-regarded Wall Street firms. This book will turn your stomach.</p></blockquote><br /><div>These are very blunt warnings from a legendary investor over many years, yet no one listened. It does explain why it is so hard for Infosec to make its case for building margins of safety into the system.</div><br /><br /><br />]]></content:encoded>
      <pubDate>Sun, 02 Nov 2008 19:30:30 +0000</pubDate>
      <category domain="http://securityratty.com/tag/derivatives book">derivatives book</category>
      <category domain="http://securityratty.com/tag/book">book</category>
      <category domain="http://securityratty.com/tag/derivatives">derivatives</category>
      <category domain="http://securityratty.com/tag/derivative books">derivative books</category>
      <category domain="http://securityratty.com/tag/books">books</category>
      <category domain="http://securityratty.com/tag/derivatives blowup">derivatives blowup</category>
      <category domain="http://securityratty.com/tag/derivatives operations">derivatives operations</category>
      <category domain="http://securityratty.com/tag/blowup">blowup</category>
      <category domain="http://securityratty.com/tag/favorite book">favorite book</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/11/stop-me-if-this-sounds-familiar.html">Stop Me if This Sounds Familiar</source>
    </item>
    <item>
      <title><![CDATA[Critical Flaws Patched In Opera 9.61, New Zero-day Vulnerability Remains Unpatched]]></title>
      <link>http://securityratty.com/article/08b28c8efcd3e5bd944c65c603c869da</link>
      <guid>http://securityratty.com/article/08b28c8efcd3e5bd944c65c603c869da</guid>
      <description><![CDATA[New Opera 9.61 makers correct an issue where History Search could be used to reveal browser history (rated extremely severe). Also fixed: a Fast Forward bug that allows cross-site scripting (highly...]]></description>
      <content:encoded><![CDATA[New Opera 9.61 makers correct an issue where History Search could be used to reveal browser history (rated extremely severe). Also fixed: a Fast Forward bug that allows cross-site scripting (highly severe) and an information disclosure flaw in news feeds (also highly severe). On the same day Opera shipped a browser update with patches for [...]]]></content:encoded>
      <pubDate>Thu, 23 Oct 2008 07:24:30 +0000</pubDate>
      <category domain="http://securityratty.com/tag/opera">opera</category>
      <category domain="http://securityratty.com/tag/browser">browser</category>
      <category domain="http://securityratty.com/tag/reveal browser history">reveal browser history</category>
      <category domain="http://securityratty.com/tag/history">history</category>
      <category domain="http://securityratty.com/tag/highly severe">highly severe</category>
      <category domain="http://securityratty.com/tag/day opera">day opera</category>
      <category domain="http://securityratty.com/tag/fast forward bug">fast forward bug</category>
      <category domain="http://securityratty.com/tag/information disclosure flaw">information disclosure flaw</category>
      <category domain="http://securityratty.com/tag/news feeds">news feeds</category>
      <source url="http://cyberinsecure.com/critical-flaws-patched-in-opera-961-new-zero-day-vulnerability-remains-unpatched/">Critical Flaws Patched In Opera 9.61, New Zero-day Vulnerability Remains Unpatched</source>
    </item>
    <item>
      <title><![CDATA[If a tree falls in someone else's silo...]]></title>
      <link>http://securityratty.com/article/16a8e8bbe75a3994d655d2737adf90ce</link>
      <guid>http://securityratty.com/article/16a8e8bbe75a3994d655d2737adf90ce</guid>
      <description><![CDATA[Must read post by Iang

In the case of phishing, it is relatively clear. The developers believe the PKI book. The PKI people believe in the efficacy of digital signatures to prove stuff. The...]]></description>
      <content:encoded><![CDATA[<p>&#160;Must read <a href="https://financialcryptography.com/mt/archives/001093.html">post</a> by Iang:</p><br /><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #666666; font-family: georgia; line-height: 19px; ">In the case of phishing, it is relatively clear. The developers believe the PKI book. The PKI people believe in the efficacy of digital signatures to prove stuff. The cryptographers believe in the perfection of mathematics, and the security world believes in the completeness of their own learning. They are all wrong, but only at the large level of generalisations, not at the detailed level of particular claims. Any one of the claims,&#160;<em>in isolation</em>&#160;can be shown to be true. But, generalising these brittle claims to be solid building blocks is a completely different question. Few of the claims are strong enough to partake in a general model without severe support; the general model of secure browsing is the best evidence of how it is secure in name only.</span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #666666; font-family: georgia; line-height: 19px;"><br /></span><span style="color: #666666; font-family: georgia; line-height: 19px; ">How then is it built? By accident or by design, a series of claims meet together in a holy ring of righteous architecture. Each of the proponents claim loudly that their part is strong, but the ring has no strength. Eventually, one of the claims in the links is broken. For phishing, the browsers never did have the potential to show authenticity; not only did they not have the security strength to do it (c.f., Skype v.&#160;<a href="http://en.wikipedia.org/wiki/Cross-site_request_forgery" style="color: #003366; font-weight: normal; text-decoration: underline; ">CSRF</a>), they didn&#39;t even do it in practice (recall the lost padlock?), and their recent efforts to show authenticity (c.f. colour debate) reveal how far they are from understanding even the goal, let alone the implementation. Once that link was broken, and money was made, all the others revealed their weaknesses, as crooks systematically worked to breach the lot.</span><br /><span style="color: #666666; font-family: georgia; line-height: 19px; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #666666; font-family: georgia; line-height: 19px; ">If we look at the wider financial collapse, now underscored by the nationalisation of the worlds biggest financiers of mortgages ($ 5.3 trillion.... or is it $ 5.4 ?), we see the same pattern. The bankers believed in their product. The originators believed in their origination, the securitizers believed in their free market and accurate price, and the holders believed in the assets. The CDO, the subprime, the other 100 special names, each was a contract. Each was clear in and of itself. But, when placed end-to-end, in a line, with a bunch of other agreements, the claims that were good in isolation were not strong enough to participate in the super-claim made of the overall edifice.</span><br /><span style="color: #666666; font-family: georgia; line-height: 19px; ">The financial system was built like a bridge; each piece rested on the previous one. And then, the clever architects bent the bridge around ... and around again, until the first piece met the last. The elegant keystone of finance was to finally lift up the first one to rest on the last.</span><br /><span style="color: #666666; font-family: georgia; line-height: 19px; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #666666; font-family: georgia; line-height: 19px; ">Thus, the banks themselves invested their capital in their own product.</span></p></blockquote><p><span style="color: #666666; font-family: georgia; line-height: 19px;"><br /></span></p><div><span style="color: #666666; font-family: georgia; line-height: 19px;"><span style="color: #000000; font-family: &#39;Trebuchet MS&#39;; line-height: 15px; ">Maybe computer security failures won&#39;t ever result in $6 trillion worth of failures, but every day we bet more and more of our economy on networked computer systems. And those architectures are built on the precise mindsets that Iang portrays.</span><br /></span></div><br /><div>Banks are apt to comply with their auditor&#39;s request to run scans their resources, but what they do not do is build systems with architectural integrity. Why do you log in with a username and password? Why are the <a href="http://1raindrop.typepad.com/1_raindrop/2008/09/your-companies-biggest-security-hole---what-is-the-bgp-style-vuln-lurking-in-software-security.html">messaging systems not locked down</a>? Where are the strong identity tokens and claims? Do banks know that they are <a href="http://1raindrop.typepad.com/1_raindrop/2008/08/mainframe-mindset.html">not on a mainframe any more</a>?&#160;</div><br /><div>Sadly, they don&#39;t - they build a web silo and then they hook it up the legacy silo and put a wide open messaging system in between. There is no end to end security design, just silos. The banks build distributed systems, they operate distributed systems, but they don&#39;t design distributed systems.</div><br /><div>It is too bad, its never been a core competency of banks to design systems, but it never mattered before because IBM just drew up the plan and the banks followed it. Now everyone has their own plan, but the security architecture reflects an auditor&#39;s checklist and manager&#39;s <a href="http://1raindrop.typepad.com/1_raindrop/2008/08/golf-driven-security.html">golf games</a> not risk management decisions or security architecture.</div><br /><div>If a tree falls in someone else&#39;s silo, your system doesn&#39;t hear until their silo knocks yours over...</div>]]></content:encoded>
      <pubDate>Mon, 08 Sep 2008 08:29:57 +0000</pubDate>
      <category domain="http://securityratty.com/tag/silo">silo</category>
      <category domain="http://securityratty.com/tag/design">design</category>
      <category domain="http://securityratty.com/tag/design systems">design systems</category>
      <category domain="http://securityratty.com/tag/systems">systems</category>
      <category domain="http://securityratty.com/tag/brittle claims">brittle claims</category>
      <category domain="http://securityratty.com/tag/claims">claims</category>
      <category domain="http://securityratty.com/tag/computer systems">computer systems</category>
      <category domain="http://securityratty.com/tag/legacy silo">legacy silo</category>
      <category domain="http://securityratty.com/tag/banks">banks</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/09/if-a-tree-falls-in-someone-elses-silo.html">If a tree falls in someone else's silo...</source>
    </item>
    <item>
      <title><![CDATA[Cyber-threat environment becoming increasingly severe]]></title>
      <link>http://securityratty.com/article/557b0d6b8f31a95d72bea42c8e7b1d61</link>
      <guid>http://securityratty.com/article/557b0d6b8f31a95d72bea42c8e7b1d61</guid>
      <description><![CDATA[Today's cyber-threat environment is increasingly severe, compounded by the emergence of new types of...]]></description>
      <content:encoded><![CDATA[Today's cyber-threat environment is increasingly severe, compounded by the emergence of new types of attacks.]]></content:encoded>
      <pubDate>Mon, 25 Aug 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/increasingly severe">increasingly severe</category>
      <category domain="http://securityratty.com/tag/cyber-threat environment">cyber-threat environment</category>
      <category domain="http://securityratty.com/tag/emergence">emergence</category>
      <category domain="http://securityratty.com/tag/attacks">attacks</category>
      <category domain="http://securityratty.com/tag/types">types</category>
      <source url="http://www.networkworld.com/news/2008/082608-cyber-threat-environment-becoming-increasingly.html?fsrc=rss-security">Cyber-threat environment becoming increasingly severe</source>
    </item>
    <item>
      <title><![CDATA[7 Vulnerabilities, Some Are Extremely Severe, Patched In New Opera 9.52]]></title>
      <link>http://securityratty.com/article/459b1b5515522cfdf2d66a70c98f89cf</link>
      <guid>http://securityratty.com/article/459b1b5515522cfdf2d66a70c98f89cf</guid>
      <description><![CDATA[Opera Software has updated its Web browser with fixes for at least seven documented security problems. Details on one more vulnerability, a cross-site scripting issue reported by Chris Weber,...]]></description>
      <content:encoded><![CDATA[Opera Software has updated its Web browser with fixes for at least seven documented security problems. Details on one more vulnerability, a cross-site scripting issue reported by Chris Weber, currently remains classified.
Opera warned that one of the seven flaws is rated &#8220;extremely severe&#8221; because of the risk of arbitrary code execution.
Improvements and fixes included in [...]]]></content:encoded>
      <pubDate>Wed, 20 Aug 2008 19:24:54 +0000</pubDate>
      <category domain="http://securityratty.com/tag/opera">opera</category>
      <category domain="http://securityratty.com/tag/extremely severe">extremely severe</category>
      <category domain="http://securityratty.com/tag/arbitrary code execution">arbitrary code execution</category>
      <category domain="http://securityratty.com/tag/opera software">opera software</category>
      <category domain="http://securityratty.com/tag/chris weber">chris weber</category>
      <category domain="http://securityratty.com/tag/web browser">web browser</category>
      <category domain="http://securityratty.com/tag/fixes">fixes</category>
      <category domain="http://securityratty.com/tag/issue">issue</category>
      <category domain="http://securityratty.com/tag/remains">remains</category>
      <source url="http://cyberinsecure.com/7-vulnerabilities-patched-in-opera-9-52/">7 Vulnerabilities, Some Are Extremely Severe, Patched In New Opera 9.52</source>
    </item>
    <item>
      <title><![CDATA[Links List 8.15.08]]></title>
      <link>http://securityratty.com/article/803e2f6db1563e98882d0a71faf66398</link>
      <guid>http://securityratty.com/article/803e2f6db1563e98882d0a71faf66398</guid>
      <description><![CDATA[Cloud Computing will also cure the common cold! Not really. But amidst all the hype and overly-used marketing speak its hard to tell the difference. Researchers from the University of Michigan...]]></description>
      <content:encoded><![CDATA[<p>Cloud Computing will also cure the common cold! Not really. But amidst all the hype and overly-used marketing speak it&#8217;s hard to tell the difference. Researchers from the University of Michigan announced CloudAV, a network service using the <a href="http://www.infoworld.com/article/08/08/08/Researchers_look_to_cloud_computing_to_fight_malware_1.html?source=NLC-TB&amp;cgd=2008-08-08">&#8220;cloud-computing&#8221; concept to fight malware</a>. Please stop the insanity! I&#8217;m just waiting for someone to put &#8220;my&#8221; and &#8220;cloud computing&#8221; together&#8230;</p>
<p>Here&#8217;s an interesting post on High Earth Orbit about the usage and promotion of <a href="http://highearthorbit.com/open-source-in-defense/">open source software for defense</a> contracts. As a developer of open source tools, Andrew Turner of course brings up some &#8220;pros&#8221; for the government to push open source, but it&#8217;s the &#8220;cons&#8221; that are really interesting. A big &#8220;con&#8221; &#8211; the US government having something called &#8220;<a href="http://tech.slashdot.org/article.pl?sid=08/08/04/2253246">sovereign immunity</a>&#8221; which apparently means something like it can&#8217;t be sued unless it consents to be sued. Hunh &#8211; the Republic of ScienceLogic-Land? Closing the loop here, a federal appeals court just boosted open-source software licenses by saying that any infringements can now get more <a href="http://weblog.infoworld.com/openresource/archives/2008/08/court_rules_tha.html?source=rss">severe remedies under copyright law</a> (instead of contract law); here&#8217;s the case, <a href="http://blawgletter.typepad.com/bbarnett/2008/08/can-you-copyrig.html">Jacobsen v Katzer</a>. But apparently not if it&#8217;s the <a href="http://arstechnica.com/news.ars/post/20080804-air-force-cracks-software-carpet-bombs-dmca.html">US government</a>?? Who knows more?</p>
<p>Does Linus Torvalds hate everyone except for developers? You have to check out this article on an email exchange he had with Network World this week, talking about how fed up he is with the &#8220;<a href="http://www.infoworld.com/article/08/08/14/Torvalds_Fed_up_with_the_security_circus_1.html">security circus</a>&#8221;. Over the course of the exchange and some other comments from last month, he manages to blast security folk, OpenBSD (on security) in particular, vendors and PR people (of course). In the midst of the barrage of colorful language, it&#8217;s difficult to really get his point &#8211; which if you can dig it out, ends up being surprisingly sensible.</p>
<p>Sharon Taylor, Chief Architect of ITIL V3, recently wrote that with the release of the latest version of ITIL<a href="http://itmanagersinbox.com/345/itil-v3-and-business-service-management/">, BSM is now an &#8216;ITIL best practice</a>.&#8217; You say potato&#8230; &#8220;The distinction between IT and the business has blurred, and the language of IT has been replaced with the language of the business.&#8221;</p>
]]></content:encoded>
      <pubDate>Fri, 15 Aug 2008 16:04:33 +0000</pubDate>
      <category domain="http://securityratty.com/tag/source software">source software</category>
      <category domain="http://securityratty.com/tag/open-source software licenses">open-source software licenses</category>
      <category domain="http://securityratty.com/tag/source">source</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/blast security folk">blast security folk</category>
      <category domain="http://securityratty.com/tag/colorful language">colorful language</category>
      <category domain="http://securityratty.com/tag/language">language</category>
      <category domain="http://securityratty.com/tag/itil">itil</category>
      <category domain="http://securityratty.com/tag/email exchange">email exchange</category>
      <source url="http://blog.sciencelogic.com/links-list-81508/08/2008">Links List 8.15.08</source>
    </item>
    <item>
      <title><![CDATA[Hundreds Of UCLA Medical Employees Abused Privilege And Looked Into Celebrities Medical Records]]></title>
      <link>http://securityratty.com/article/fea55b84111bf15eac312f51d1f08d63</link>
      <guid>http://securityratty.com/article/fea55b84111bf15eac312f51d1f08d63</guid>
      <description><![CDATA[More than 120 workers at a Los Angeles hospital looked at celebrities medical records and other personal information without permission between January 2004 and June 2006, nearly double the number...]]></description>
      <content:encoded><![CDATA[More than 120 workers at a Los Angeles hospital looked at celebrities&#8217; medical records and other personal information without permission between January 2004 and June 2006, nearly double the number initially reported earlier this year, according to a state report.
Even after UCLA Medical Center warned employees about severe measures against unauthorized access to medical records, [...]]]></content:encoded>
      <pubDate>Wed, 06 Aug 2008 19:26:33 +0000</pubDate>
      <category domain="http://securityratty.com/tag/medical records">medical records</category>
      <category domain="http://securityratty.com/tag/celebrities medical records">celebrities medical records</category>
      <category domain="http://securityratty.com/tag/los angeles hospital">los angeles hospital</category>
      <category domain="http://securityratty.com/tag/ucla medical center">ucla medical center</category>
      <category domain="http://securityratty.com/tag/employees">employees</category>
      <category domain="http://securityratty.com/tag/severe measures">severe measures</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/access">access</category>
      <category domain="http://securityratty.com/tag/workers">workers</category>
      <source url="http://cyberinsecure.com/hundreds-of-ucla-medical-employees-abused-privilege-and-looked-into-celebrities-medical-records/">Hundreds Of UCLA Medical Employees Abused Privilege And Looked Into Celebrities Medical Records</source>
    </item>
    <item>
      <title><![CDATA[IE6 more vulnerable to unpatched Microsoft flaw, Symantec says]]></title>
      <link>http://securityratty.com/article/26568b22f8a97912ecdec92597e6fde9</link>
      <guid>http://securityratty.com/article/26568b22f8a97912ecdec92597e6fde9</guid>
      <description><![CDATA[An unpatched Microsoft vulnerability poses a more severe threat to Internet Explorer 6 users than it does to those running a newer version of the...]]></description>
      <content:encoded><![CDATA[An unpatched Microsoft vulnerability poses a more severe threat to Internet Explorer 6 users than it does to those running a newer version of the browser.
<p><a href="http://feeds.computerworld.com/~a/Computerworld/Security/News?a=fLOVgN"><img src="http://feeds.computerworld.com/~a/Computerworld/Security/News?i=fLOVgN" border="0"></img></a></p><img src="http://feeds.computerworld.com/~r/Computerworld/Security/News/~4/355409791" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 04 Aug 2008 09:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/microsoft vulnerability poses">microsoft vulnerability poses</category>
      <category domain="http://securityratty.com/tag/severe threat">severe threat</category>
      <category domain="http://securityratty.com/tag/internet explorer">internet explorer</category>
      <category domain="http://securityratty.com/tag/version">version</category>
      <category domain="http://securityratty.com/tag/browser">browser</category>
      <category domain="http://securityratty.com/tag/users">users</category>
      <source url="http://feeds.computerworld.com/~r/Computerworld/Security/News/~3/355409791/article.do">IE6 more vulnerable to unpatched Microsoft flaw, Symantec says</source>
    </item>
    <item>
      <title><![CDATA[Oracle issues warning over dangerous WebLogic flaw]]></title>
      <link>http://securityratty.com/article/23d58b8820f7a59c4ee565c335ac90f6</link>
      <guid>http://securityratty.com/article/23d58b8820f7a59c4ee565c335ac90f6</guid>
      <description><![CDATA[Oracle is scrambling to create an emergency patch for a severe vulnerability in the company's WebLogic server, as exploit code is circulating on the...]]></description>
      <content:encoded><![CDATA[Oracle is scrambling to create an emergency patch for a severe vulnerability in the company's WebLogic server, as exploit code is circulating on the Web.
<p><a href="http://feeds.computerworld.com/~a/Computerworld/Security/News?a=3kPF9J"><img src="http://feeds.computerworld.com/~a/Computerworld/Security/News?i=3kPF9J" border="0"></img></a></p><img src="http://feeds.computerworld.com/~r/Computerworld/Security/News/~4/349348883" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 29 Jul 2008 09:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/severe vulnerability">severe vulnerability</category>
      <category domain="http://securityratty.com/tag/weblogic server">weblogic server</category>
      <category domain="http://securityratty.com/tag/exploit code">exploit code</category>
      <category domain="http://securityratty.com/tag/emergency patch">emergency patch</category>
      <category domain="http://securityratty.com/tag/oracle">oracle</category>
      <category domain="http://securityratty.com/tag/web">web</category>
      <category domain="http://securityratty.com/tag/company">company</category>
      <source url="http://feeds.computerworld.com/~r/Computerworld/Security/News/~3/349348883/article.do">Oracle issues warning over dangerous WebLogic flaw</source>
    </item>
    <item>
      <title><![CDATA[Oracle issues warning over dangerous WebLogic flaw]]></title>
      <link>http://securityratty.com/article/07f20e6fd064f1823a9ebab95f361739</link>
      <guid>http://securityratty.com/article/07f20e6fd064f1823a9ebab95f361739</guid>
      <description><![CDATA[Oracle is scrambling to create an emergency patch for a severe vulnerability in the company's WebLogic server, as exploit code is circulating on the...]]></description>
      <content:encoded><![CDATA[Oracle is scrambling to create an emergency patch for a severe vulnerability in the company's WebLogic server, as exploit code is circulating on the Web.<p><A href="http://ad.doubleclick.net/jump/idg.us.nwf.rss/security;sz=468x60;ord=90098?">
<IMG src="http://ad.doubleclick.net/ad/idg.us.nwf.rss/security;sz=468x60;ord=90098?" border="0" width="468" height="60"></A>
</p>]]></content:encoded>
      <pubDate>Mon, 28 Jul 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/severe vulnerability">severe vulnerability</category>
      <category domain="http://securityratty.com/tag/weblogic server">weblogic server</category>
      <category domain="http://securityratty.com/tag/exploit code">exploit code</category>
      <category domain="http://securityratty.com/tag/emergency patch">emergency patch</category>
      <category domain="http://securityratty.com/tag/oracle">oracle</category>
      <category domain="http://securityratty.com/tag/web">web</category>
      <category domain="http://securityratty.com/tag/company">company</category>
      <source url="http://www.networkworld.com/news/2008/072908-oracle-issues-warning-over-dangerous.html?fsrc=rss-security">Oracle issues warning over dangerous WebLogic flaw</source>
    </item>
  </channel>
</rss>
