<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: six-month]]></title>
    <link>http://securityratty.com/tag/six-month</link>
    <description></description>
    <pubDate>Mon, 03 Nov 2008 13:11:25 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[A Diverse Portfolio of Fake Security Software - Part Fourteen]]></title>
      <link>http://securityratty.com/article/73e2f5bbd0d3a35e2885b12071151835</link>
      <guid>http://securityratty.com/article/73e2f5bbd0d3a35e2885b12071151835</guid>
      <description><![CDATA[You didn't even think for a second that the supply of typosqutted domains serving packed and triple crypted to the point where the binary is not longer executing, fake security software domains is...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://1.bp.blogspot.com/_wICHhTiQmrA/SS6gDFZUyYI/AAAAAAAACek/i5D-GnO-3xw/s1600-h/microav_rogue_november.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://1.bp.blogspot.com/_wICHhTiQmrA/SS6gDFZUyYI/AAAAAAAACek/i5D-GnO-3xw/s200/microav_rogue_november.png" /></a>You didn't even think for a second that the supply of typosqutted domains serving packed and triple crypted to the point where the binary is not longer executing, fake security software domains is declining? With the upcoming holidays and the usual peak of web traffic, malicious activity on all fronts is prone to increase during December. <b>YEWGATE LTD</b>, <b>Sawert Alliance</b>, and <b>Sagent Group</b>, personal favorites affiliate participants in a revenue sharing program for serving fake security software, try to maintain a decent rhythm in their typosquatting process, always worth taking a peek at. The very latest rogue security software additions include :<br />
<br />
<b>micro-antiv2009 .com</b> (91.208.0.223)<br />
<b>micro-antivir2009 .com</b><br />
<b>micro-antivirus-2009 .com </b><br />
<b>micro-av-2009 .com</b><br />
<br />
<i>Sawert Alliance<br />
Peltonen Martti&nbsp; <b>seodancer@gmail.com</b><br />
33 New Road, Upper Flat<br />
Belize City<br />
Belize<br />
Tel: +7.9602578790</i><br />
<br />
<div class="separator" style="clear: both; text-align: center;"><a href="http://2.bp.blogspot.com/_wICHhTiQmrA/SS6gYmAzMwI/AAAAAAAACes/C-aMLs7jDR0/s1600-h/spyware_remover_rogue_november.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://2.bp.blogspot.com/_wICHhTiQmrA/SS6gYmAzMwI/AAAAAAAACes/C-aMLs7jDR0/s200/spyware_remover_rogue_november.png" /></a></div><b>avmyscan .com</b> (91.203.92.186; 78.157.143.184)<br />
<b>go-your-scan .com</b><br />
<b>bestproscan .com</b><br />
<b>avproscan .com</b><br />
<b>goyourscan .com</b><br />
<b>iabestscan .com</b><br />
<b>avmyscan .com</b><br />
<b>best-scan-pro .com</b><br />
<b>avscan-pro .com</b><br />
<b>bestscanner-pro .com</b><br />
<b>avscanpro .com</b><br />
<b>iascannerpro .com</b><br />
<br />
<i>Jaroslav Voltz<br />
Email: <b>mensfult@gmail.com</b><br />
Organization: Private person<br />
Address: Biskupsk 9<br />
City: Praha<br />
State: Praha<br />
ZIP: 11000<br />
Country: CZ<br />
Phone: +420.2224811382</i><br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://4.bp.blogspot.com/_wICHhTiQmrA/SS6g2pEJdbI/AAAAAAAACe0/Xt2MaDdDgvk/s1600-h/sagent_group_rogue.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://4.bp.blogspot.com/_wICHhTiQmrA/SS6g2pEJdbI/AAAAAAAACe0/Xt2MaDdDgvk/s200/sagent_group_rogue.png" /></a><b>virus-labs2009 .com</b> (66.232.113.62)<br />
<b>virus-trigger .com<br />
virusresponse2009 .com<br />
virusresplab .com<br />
virus-response .com</b><br />
<br />
<i>Roman Spitsikov<br />
Uus-Sadama 12&nbsp; <br />
Tallinn, Tallinn 10120<br />
Estonia<br />
<b>Roman.Spitsikov@gmail.com</b></i><br />
<br />
<b>virusremover2008plus .com</b> (77.245.61.80; 93.190.139.229)<br />
<br />
<i>Sagent Group&nbsp; (<b>sergbelo@gmail.com</b>)<br />
Brignal Solutions<br />
P.O. Box 3469 Geneva Place, Waterfront drive <br />
Road town,&nbsp;&nbsp; BVI<br />
BZ<br />
+1.14193017015</i><br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://1.bp.blogspot.com/_wICHhTiQmrA/SS6g-80BKPI/AAAAAAAACe8/33Am0K6PBKI/s1600-h/sagent_group_rogue_2.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://1.bp.blogspot.com/_wICHhTiQmrA/SS6g-80BKPI/AAAAAAAACe8/33Am0K6PBKI/s200/sagent_group_rogue_2.png" /></a><b>antivirus-pro-scan.com</b> (84.243.197.183)<br />
<b>anti-virus-defence.com</b><br />
<b>protection-livescan.com</b><br />
<br />
<i>Aleksey Kononov <b>cndomainz@yahoo.com</b></i><br />
<i>+74954538435 fax: +74954538435</i><br />
<i>ul. Yakimanskay 34-56</i><br />
<i>Moskva Moskovskay oblast 112745</i><br />
<i>ru</i><br />
<br />
<b>rapidantivir .com</b><b> </b>(91.208.0.220)<b><br />
rapidantivirus-2009 .com<br />
securityscanner2009 .com<br />
rapidantivirus2009 .com<br />
rapid-antivir .com<br />
extraantivir .com<br />
rapid-antivirus .com<br />
rapidantivirus .com</b><br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://3.bp.blogspot.com/_wICHhTiQmrA/SS6hQRW910I/AAAAAAAACfE/Z4g-Irniuz0/s1600-h/sqscan_rogue_november.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://3.bp.blogspot.com/_wICHhTiQmrA/SS6hQRW910I/AAAAAAAACfE/Z4g-Irniuz0/s200/sqscan_rogue_november.JPG" /></a><i>Sawert Alliance<br />
Peltonen Martti&nbsp; <b>seodancer@gmail.com</b><br />
33 New Road, Upper Flat<br />
Belize City<br />
Belize<br />
Tel: +7.9602578790</i><br />
<br />
<b>sgscanner .com</b> (116.50.14.185)<br />
<b>sguardscan .com<br />
scansguard .com<br />
getsg2008 .com</b><br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://3.bp.blogspot.com/_wICHhTiQmrA/SS6hbmiwmxI/AAAAAAAACfM/XnmEK9R5m30/s1600-h/virus_response_rogue_november.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://3.bp.blogspot.com/_wICHhTiQmrA/SS6hbmiwmxI/AAAAAAAACfM/XnmEK9R5m30/s200/virus_response_rogue_november.png" /></a><i>Vrenk Tihomil<br />
Email: <b>gray444371@gmail.com</b><br />
Organization: Private person<br />
Address: Kolodvorska 73, Sl3270 Lasko<br />
City: Lasko<br />
State: LaskoLasko<br />
ZIP: Sl1355<br />
Country: SI<br />
Phone: +386.14588324</i><br />
<br />
<b>adwaredeluxe .com</b> (64.40.118.8) (private whois)<br />
<b>antivirusadvanced .com<br />
antivirusadvance .com<br />
spydestroy .com<br />
spywareremoval .ws</b><br />
<br />
Shipping them in batches means exposing them in batches.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2008/11/diverse-portfolio-of-fake-security_12.html">A Diverse Portfolio of Fake Security Software - Part Thirteen</a><br />
<a href="http://ddanchev.blogspot.com/2008/11/diverse-portfolio-of-fake-security.html">A Diverse Portfolio of Fake Security Software - Part Twelve</a><br />
<a href="http://ddanchev.blogspot.com/2008/10/diverse-portfolio-of-fake-security_28.html">A Diverse Portfolio of Fake Security Software - Part Eleven</a><br />
<a href="http://ddanchev.blogspot.com/2008/10/diverse-portfolio-of-fake-security_22.html">A Diverse Portfolio of Fake Security Software - Part Ten</a><br />
<a href="http://ddanchev.blogspot.com/2008/10/diverse-portfolio-of-fake-security_16.html">A Diverse Portfolio of Fake Security Software - Part Nine</a><br />
<a href="http://ddanchev.blogspot.com/2008/10/diverse-portfolio-of-fake-security.html">A Diverse Portfolio of Fake Security Software - Part Eight</a><br />
<a href="http://ddanchev.blogspot.com/2008/09/diverse-portfolio-of-fake-security_30.html">A Diverse Portfolio of Fake Security Software - Part Seven</a><br />
<a href="http://ddanchev.blogspot.com/2008/09/diverse-portfolio-of-fake-security_24.html">A Diverse Portfolio of Fake Security Software - Part Six</a><br />
<a href="http://ddanchev.blogspot.com/2008/09/diverse-portfolio-of-fake-security.html">A  Diverse Portfolio of Fake Security Software - Part Five</a> <br />
<a href="http://ddanchev.blogspot.com/2008/08/diverse-portfolio-of-fake-security_25.html">A  Diverse Portfolio of Fake Security Software - Part Four</a><br />
<a href="http://ddanchev.blogspot.com/2008/08/diverse-portfolio-of-fake-security_20.html">A  Diverse Portfolio of Fake Security Software - Part Three</a><b> </b><br />
<a href="http://ddanchev.blogspot.com/2008/08/diverse-portfolio-of-fake-security.html">A  Diverse Portfolio of Fake Security Software - Part Two</a><br />
<a href="http://ddanchev.blogspot.com/2007/12/diverse-portfolio-of-fake-security.html">Diverse  Portfolio of Fake Security Software</a><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=9h0BN"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=9h0BN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=x78xN"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=x78xN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=SX1Dn"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=SX1Dn" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=n7eun"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=n7eun" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=xmqRN"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=xmqRN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=4Ga4N"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=4Ga4N" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=5Lo1n"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=5Lo1n" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/467329268" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 27 Nov 2008 04:47:55 +0000</pubDate>
      <category domain="http://securityratty.com/tag/fake security software">fake security software</category>
      <category domain="http://securityratty.com/tag/diverse portfolio">diverse portfolio</category>
      <category domain="http://securityratty.com/tag/sawert alliance">sawert alliance</category>
      <category domain="http://securityratty.com/tag/road town">road town</category>
      <category domain="http://securityratty.com/tag/martti seodancergmail">martti seodancergmail</category>
      <category domain="http://securityratty.com/tag/upper flat">upper flat</category>
      <category domain="http://securityratty.com/tag/city">city</category>
      <category domain="http://securityratty.com/tag/road">road</category>
      <category domain="http://securityratty.com/tag/sl3270 lasko">sl3270 lasko</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/467329268/diverse-portfolio-of-fake-security_27.html">A Diverse Portfolio of Fake Security Software - Part Fourteen</source>
    </item>
    <item>
      <title><![CDATA[The Future of Ephemeral Conversation]]></title>
      <link>http://securityratty.com/article/1474b03de8a1d60cdf0aa28759ddce93</link>
      <guid>http://securityratty.com/article/1474b03de8a1d60cdf0aa28759ddce93</guid>
      <description><![CDATA[When he becomes president, Barack Obama will have to give up his BlackBerry. Aides are concerned that his unofficial conversations would become part of the presidential record, subject to subpoena and...]]></description>
      <content:encoded><![CDATA[<p>When he becomes president, Barack Obama will have to <a href="http://www.nytimes.com/2008/11/16/us/politics/16blackberry.html">give up</a> his BlackBerry.  Aides are concerned that his unofficial conversations would become part of the presidential record, subject to subpoena and eventually made public as part of the country's historical record.</p>

<p>This reality of the information age might be particularly stark for the president, but it's no less true for all of us.  Conversation used to be ephemeral.  Whether face-to-face or by phone, we could be reasonably sure that what we said disappeared as soon as we said it. Organized crime bosses worried about phone taps and room bugs, but that was the exception.  Privacy was just assumed.</p>

<p>This has changed.  We chat in e-mail, over SMS and IM, and on social networking websites like Facebook, MySpace, and LiveJournal.  We blog and we Twitter.  These conversations -- with friends, lovers, colleagues, members of our cabinet -- are not ephemeral; they <a href="http://www.schneier.com/essay-109.html">leave their own electronic trails</a>.</p>

<p>We know this intellectually, but we haven't truly internalized it.  We type on, engrossed in conversation, forgetting we're being recorded and those recordings might come back to haunt us later.</p>

<p>Oliver North learned this, way back in 1987, when messages he thought he had deleted were saved by the White House PROFS system, and then subpoenaed in the Iran-Contra affair.  Bill Gates learned this in 1998 when his conversational e-mails were provided to opposing counsel as part of the antitrust litigation discovery process.  Mark Foley learned this in 2006 when his instant messages were <a href="http://abcnews.go.com/WNT/BrianRoss/story?id=2509586">saved and made public</a> by the underage men he talked to.  Paris Hilton learned this in 2005 when her cell phone account was <a href="http://www.washingtonpost.com/wp-dyn/content/article/2005/05/19/AR2005051900711.html">hacked</a>, and Sarah Palin learned it earlier this year when her Yahoo e-mail account was hacked.  Someone in George W. Bush's administration learned this, and <a href="http://www.cnn.com/2007/POLITICS/04/13/white.house.email/index.html">millions of e-mails</a> went mysteriously and conveniently missing.</p>

<p>Ephemeral conversation is dying.</p>

<p>Cardinal Richelieu famously said, :If one would give me six lines written by the hand of the most honest man, I would find something in them to have him hanged."  When all our ephemeral conversations can be saved for later examination, different rules have to apply.  Conversation is not the same thing as correspondence.  Words uttered in haste over morning coffee, whether spoken in a coffee shop or thumbed on a Blackberry, are not official pronouncements.  Discussions in a meeting, whether held in a boardroom or a chat room, are not the same as answers at a press conference.  And privacy isn't just about having something to hide; it <a href="http://www.schneier.com/essay-114.html">has enormous value</a> to democracy, liberty, and our basic humanity.</p>

<p>We can't turn back technology; electronic communications are here to stay and <a href="http://en.wikipedia.org/wiki/NSA_warrantless_surveillance_controversy">even our voice conversations are threatened</a>.  But as technology makes our conversations less ephemeral, we need laws to step in and safeguard ephemeral conversation.  We need a comprehensive data privacy law, protecting our data and communications regardless of where it is stored or how it is processed. We need laws forcing companies to keep it private and delete it as soon as it is no longer needed.  Laws requiring ISPs to store e-mails and other personal communications are exactly what we don't need.</p>

<p>Rules pertaining to government need to be different, because of the <a href="http://www.schneier.com/essay-208.html">power differential</a>.  Subjecting the president's communications to eventual public review increases liberty because it reduces the government's power with respect to the people.  Subjecting our communications to government review decreases liberty because it reduces our power with respect to the government.  The president, as well as other members of government, need some ability to converse ephemerally -- just as they're allowed to have unrecorded meetings and phone calls -- but more of their actions need to be subject to public scrutiny.</p>

<p>But laws can only go so far.  Law or no law, when something is made public it's too late.  And many of us like having complete records of all our e-mail at our fingertips; it's like our offline brains.</p>

<p>In the end, this is cultural.</p>

<p>The Internet is the greatest generation gap since rock and roll.  We're now witnessing one aspect of that generation gap: the younger generation chats digitally, and the older generation treats those chats as written correspondence.  Until our CEOs blog, our Congressmen Twitter, and our world leaders send each other LOLcats &ndash; until we have a Presidential election where both candidates have a complete history on social networking sites from before they were teenagers&ndash; we aren't fully an information age society.</p>

<p>When everyone leaves a public digital trail of their personal thoughts since birth, no one will think twice about it being there.  Obama might be on the younger side of the generation gap, but the rules he's operating under were written by the older side.  It will take another generation before society's tolerance for digital ephemera changes.</p>

<p>This essay <a href="http://online.wsj.com/article/SB122722381368945937.html">previously appeared</a> on <ui>The Wall Street Journal</a> website (not the print newspaper), and is an update of <a href="http://www.schneier.com/essay-129.html">something I wrote previously</a>.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=jPWiN"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=jPWiN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=hlUTN"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=hlUTN" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Mon, 24 Nov 2008 11:06:41 +0000</pubDate>
      <category domain="http://securityratty.com/tag/ephemeral conversation">ephemeral conversation</category>
      <category domain="http://securityratty.com/tag/conversation">conversation</category>
      <category domain="http://securityratty.com/tag/safeguard ephemeral conversation">safeguard ephemeral conversation</category>
      <category domain="http://securityratty.com/tag/ephemeral">ephemeral</category>
      <category domain="http://securityratty.com/tag/ephemeral conversations">ephemeral conversations</category>
      <category domain="http://securityratty.com/tag/conversations">conversations</category>
      <category domain="http://securityratty.com/tag/generation">generation</category>
      <category domain="http://securityratty.com/tag/generation gap">generation gap</category>
      <category domain="http://securityratty.com/tag/public scrutiny">public scrutiny</category>
      <source url="http://www.schneier.com/blog/archives/2008/11/the_future_of_e.html">The Future of Ephemeral Conversation</source>
    </item>
    <item>
      <title><![CDATA[Surveillance system helps police snare shooters]]></title>
      <link>http://securityratty.com/article/a87fd90ee6280810156a68598558cc10</link>
      <guid>http://securityratty.com/article/a87fd90ee6280810156a68598558cc10</guid>
      <description><![CDATA[A network of electronic ears is quietly monitoring more than six square miles of high-crime Boston neighborhoods, listening for the telltale sounds of gunfire ripping, booming or crackling through the...]]></description>
      <content:encoded><![CDATA[A network of electronic ears is quietly monitoring more than six square miles of high-crime Boston neighborhoods, listening for the telltale sounds of gunfire ripping, booming or crackling through the air.]]></content:encoded>
      <pubDate>Sun, 23 Nov 2008 21:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/high-crime boston neighborhoods">high-crime boston neighborhoods</category>
      <category domain="http://securityratty.com/tag/electronic ears">electronic ears</category>
      <category domain="http://securityratty.com/tag/telltale sounds">telltale sounds</category>
      <category domain="http://securityratty.com/tag/square miles">square miles</category>
      <category domain="http://securityratty.com/tag/network">network</category>
      <category domain="http://securityratty.com/tag/quietly">quietly</category>
      <category domain="http://securityratty.com/tag/gunfire">gunfire</category>
      <category domain="http://securityratty.com/tag/air">air</category>
      <source url="http://www.networkworld.com/news/2008/112408-surveillance-system-helps-police-snare.html?fsrc=rss-security">Surveillance system helps police snare shooters</source>
    </item>
    <item>
      <title><![CDATA[Links List 11.17.08]]></title>
      <link>http://securityratty.com/article/85b0ee0a0390b793b97cc896d3067a94</link>
      <guid>http://securityratty.com/article/85b0ee0a0390b793b97cc896d3067a94</guid>
      <description><![CDATA[Wow. I think we all know that we can take or leave surveys numbers dont mean a lot without context. In this case the context is the current economic meltdown. The Society for Information Management...]]></description>
      <content:encoded><![CDATA[<p>Wow. I think we all know that we can take or leave surveys – numbers don’t mean a lot without context. In this case the “context” is the current economic meltdown. The Society for Information Management (SIM) released the results of their 2008 IT Trends Survey – predicting an “upbeat” forecast for IT jobs; the HUGE caveat here is that the study was conducted before all the recent economic woes. Apparently organizations are using IT to <a href="http://blogs.zdnet.com/BTL/?p=10765" target="_blank">drive efficiencies, streamline operations, and cut costs</a> rather than just slashing the IT budget to save money during the downturn. What would be a nice follow-up: a quick second survey comparing responses before and after. Regardless Jerry Luftman, SIM vice president of academic affairs, still says the survey results demonstrate “that the overall state of IT remains very strong.”</p>
<p><img style="margin: 5px" src="http://images.google.com/url?q=http://disney-clipart.com/Chicken-Little/Disney-Chicken-Little.jpg&amp;usg=AFQjCNGA4kajmvy1h_lrcRnuywgV7_X0aQ" alt="" width="198" height="201" align="left" />The sky is falling! Trip Chowdhry, the analyst with Global Equities Research who claimed Red Hat was ‘rubbish and the entire LAMP stack is potty, too’ published some eye-opening predictions, predominantly negative, about tech business in Silicon Valley. Now <a href="http://news.cnet.com/8301-13505_3-10094221-16.html?part=rss&amp;subj=news&amp;tag=2547-1_3-0-20" target="_blank">Chowdhry claims that “almost every VC funded open-source company</a> is struggling and will run out of money within the next six months.” (Probably not the most unbiased guy about open source) Matt Asay argues that organizations in general are struggling, but open-source companies are not that high on the list. (But are they high on the VC “axe” list??) He notes Alfresco, Pentaho and JasperSoft are some of the players with ‘millions in the bank and growing revenue.’ Asay also says Chowdhry has a responsibility to do real due diligence and not create myths. Take that, Chicken Little! (<a href="http://disney-clipart.com/Chicken-Little/Disney-Chicken-Little.jpg" target="_blank"><em>img from Disney-Clipart</em></a>)</p>
<p>We’re not as far behind as we thought we were. Google presented the results of a study they conducted about how IPv6- capable “ordinary users” are at the RIPE meeting in Dubai a few weeks ago. Turns out Apple Macs drive IPv6 penetration in the US. <a href="http://arstechnica.com/news.ars/post/20081113-google-more-macs-mean-higher-ipv6-usage-in-us.html" target="_blank">Fifty-two percent of all IPv6 users in the U.S. own a Mac</a> and use 6to4 (creating IPv6 addresses from an IPv4 address and tunneling packets) – making the US fifth in the list of countries using IPv6. Russia and France took first and second place with .76 and .65 percent IPv6-enabled traffic . The US is at .45 percent. Worldwide, 0.238 percent of Google users’ systems are IPv6-enabled and prefer to use IPv6 over IPv4.</p>
<p>Obama’s win = Google’s win? Apparently Google <a href="http://blogs.cioinsight.com/biztech30/content/2008_campaign/google_vs_microsoft_the_obama_factor.html?kc=rss" target="_blank">CEO Eric Schmidt and President-Elect Obama are very good buddies</a> and “this terrifies Microsoft”. Now competitors are more on guard against Google’s growing empire and popularity. Although Schmidt was mentioned as a possible candidate for the country’s new national CTO position, he said he would not accept the post if asked. I guess that’s one less thing Microsoft has to worry about.</p>
]]></content:encoded>
      <pubDate>Mon, 17 Nov 2008 19:35:52 +0000</pubDate>
      <category domain="http://securityratty.com/tag/list">list</category>
      <category domain="http://securityratty.com/tag/survey results">survey results</category>
      <category domain="http://securityratty.com/tag/results">results</category>
      <category domain="http://securityratty.com/tag/ipv6 addresses">ipv6 addresses</category>
      <category domain="http://securityratty.com/tag/ipv6">ipv6</category>
      <category domain="http://securityratty.com/tag/percent">percent</category>
      <category domain="http://securityratty.com/tag/open-source company">open-source company</category>
      <category domain="http://securityratty.com/tag/source">source</category>
      <category domain="http://securityratty.com/tag/fifty-two percent">fifty-two percent</category>
      <source url="http://blog.sciencelogic.com/links-list-111708/11/2008">Links List 11.17.08</source>
    </item>
    <item>
      <title><![CDATA[Mozilla fixes 11 new flaws in Firefox, six critical]]></title>
      <link>http://securityratty.com/article/a18a8c554ba3730c699f5a2b2577779a</link>
      <guid>http://securityratty.com/article/a18a8c554ba3730c699f5a2b2577779a</guid>
      <description><![CDATA[Mozilla has patched 11 vulnerabilities in Firefox 3.0 -- and 12 bugs in the older Firefox 2.0 -- that could be used to compromise computers and steal...]]></description>
      <content:encoded><![CDATA[Mozilla has patched 11 vulnerabilities in Firefox 3.0 -- and 12 bugs in the older Firefox 2.0 -- that could be used to compromise computers and steal information.<br style="clear: both;"/>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:cf08f0c5563137391e24cab21121a0f3:q4vS%2F5edGIT6mK7SxbS6QsaqEeeFvWygLlcmb%2FNasNtpjFZikFyCDXJeIFqr4zmxS%2Bh%2B7kUL4lGs'><img border='0' title='Add to digg' alt='Add to digg' src='http://www.pheedo.com/images/mm/digg.gif'/></a>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:5a8abb23899446eaa11b8249ab3985c3:YbwTxC3XCHLL1M9Uu40UUZxVLGh3xz6dwRrWBcZ0tItQc6WCrAwzvCMhhBeN83ksZ4YUm0I5as8EqA%3D%3D'><img border='0' title='Add to StumbleUpon' alt='Add to StumbleUpon' src='http://www.pheedo.com/images/mm/stumbleit.gif'/></a>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:728522c00fb4071725c9756f19f8af5a:1%2B3QbCv0CQsFJ4kgUcMO%2Fq4e955S67vpEKxlC1Vg1x6zkz88qITWQJZZez2xffZWpztlAo8YGxO%2FBQ%3D%3D'><img border='0' title='Add to Twitter' alt='Add to Twitter' src='http://www.pheedo.com/images/mm/twitter.png'/></a>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:5e91ad34ddcb53436e071e23365ac6c8:xIPHmGY0aHpihGq2KTHZuqPz5XK71SzkG7DmPnbTYsli5Ee35AtdRWo7g917Hvv0xbB3OH1h3G8lhA%3D%3D'><img border='0' title='Add to Slashdot' alt='Add to Slashdot' src='http://www.pheedo.com/images/mm/slashdot.png'/></a>
<br style="clear: both;"/>  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=1ac6ad125b130743917577d9026d0635" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=1ac6ad125b130743917577d9026d0635" style="display: none;" border="0" height="1" width="1" alt=""/>]]></content:encoded>
      <pubDate>Thu, 13 Nov 2008 02:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/firefox">firefox</category>
      <category domain="http://securityratty.com/tag/compromise computers">compromise computers</category>
      <category domain="http://securityratty.com/tag/mozilla">mozilla</category>
      <category domain="http://securityratty.com/tag/vulnerabilities">vulnerabilities</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/bugs">bugs</category>
      <source url="http://feeds.computerworld.com/click.phdo?i=1ac6ad125b130743917577d9026d0635">Mozilla fixes 11 new flaws in Firefox, six critical</source>
    </item>
    <item>
      <title><![CDATA[Mozilla fixes 11 new flaws in Firefox, six critical]]></title>
      <link>http://securityratty.com/article/2252473c0d17cce48f2fb9276bfd9515</link>
      <guid>http://securityratty.com/article/2252473c0d17cce48f2fb9276bfd9515</guid>
      <description><![CDATA[Mozilla on Wednesday patched 11 vulnerabilities in Firefox 3.0 -- and 12 bugs in the older Firefox 2.0 -- that could be used to compromise computers and steal...]]></description>
      <content:encoded><![CDATA[Mozilla on Wednesday patched 11 vulnerabilities in Firefox 3.0 -- and 12 bugs in the older Firefox 2.0 -- that could be used to compromise computers and steal information.]]></content:encoded>
      <pubDate>Wed, 12 Nov 2008 21:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/firefox">firefox</category>
      <category domain="http://securityratty.com/tag/compromise computers">compromise computers</category>
      <category domain="http://securityratty.com/tag/mozilla">mozilla</category>
      <category domain="http://securityratty.com/tag/vulnerabilities">vulnerabilities</category>
      <category domain="http://securityratty.com/tag/wednesday">wednesday</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/bugs">bugs</category>
      <source url="http://www.networkworld.com/news/2008/111308-mozilla-fixes-11-new-flaws.html?fsrc=rss-security">Mozilla fixes 11 new flaws in Firefox, six critical</source>
    </item>
    <item>
      <title><![CDATA[A Diverse Portfolio of Fake Security Software - Part Thirteen]]></title>
      <link>http://securityratty.com/article/f98a08c6e830a559db2ccd85e32f048e</link>
      <guid>http://securityratty.com/article/f98a08c6e830a559db2ccd85e32f048e</guid>
      <description><![CDATA[What is the difference between a reactive and proactive threat intell? A reactive threat intell is assessing a campaign, individual, a group of individuals, how are they related to one another, and...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://3.bp.blogspot.com/_wICHhTiQmrA/SRri0cTxwTI/AAAAAAAACb0/G9gmDkGawOk/s1600-h/fake_security_software_powerfull.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://3.bp.blogspot.com/_wICHhTiQmrA/SRri0cTxwTI/AAAAAAAACb0/G9gmDkGawOk/s200/fake_security_software_powerfull.png" /></a>What is the difference between a reactive and proactive threat intell? A reactive threat intell is assessing a campaign, individual, a group of individuals, how are they related to one another, and what have they been doing in the past, based exclusively on a lead that's been found within the past couple of hours.<br />
<br />
Try the very latest rogue security domains courtesy of three domainers (<b>Fedor Ibragimov cndomainz@yahoo.com, Anton Golovayk gpdomains@yahoo.com</b> and <b>Ivan Durov idomains.admin@gmail.com</b> ) whose portfolios can always keep you updated about the latest releases of such popular software as The Best Antivirus Cleaner 2008.<br />
<br />
<b>powerfullantivirusscan .com</b> (78.159.118.217; 89.149.253.215; 208.72.168.185)<br />
<b>protection-update .com</b><br />
<b>updatepcprotection .com</b><br />
<b>updateyourprotection .com</b><br />
<b>mac-imunizator .net</b> (67.205.75.10)<br />
<b>avproinstall .com</b> (78.157.141.26)<br />
<b>winavpro .com</b> (92.241.163.30)<br />
<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://4.bp.blogspot.com/_wICHhTiQmrA/SRtYLfJhw0I/AAAAAAAACcM/NIA5Cb8GMjI/s1600-h/fake_security_software_november_.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://4.bp.blogspot.com/_wICHhTiQmrA/SRtYLfJhw0I/AAAAAAAACcM/NIA5Cb8GMjI/s200/fake_security_software_november_.png" /></a>As far as proactive threat intell is concerned, try the following "upcoming fake security software domains" :<br />
<br />
<b>spywaredefender2009 .com<br />
spywaredestroyer2009 .com<br />
spywareeliminator2009 .com<br />
spywareprotector2009 .com</b><br />
<br />
It would be interesting to monitor whether or not the well known non-existent security software brands we've monitoring throughout 2008, will be basically typosquatted in a 2009 like fashion, or would they simply introduce new brands. With their business model under pressure, I'm starting to see evidence of schemes involving the illegal advertisement of affiliate links to legitimate security software, where the cybercriminals are actual resellers of it. There's also no shortage of surreal situations, where a fake security software is taking advantage of blackhat SEO practices promising the removal of competing fake security software brands.<br />
<br />
Last week, the <b>noadware .net </b>(69.20.71.82; 69.20.104.139) software was persistently advertised in such a way, mostly by generating Wordpress accounts promising to remove competing software :<br />
<br />
<b>antiviruspro2009.wordpress .com<br />
ultraantivirus2009.wordpress .com<br />
smartantivirus.wordpress .com<br />
antiviruslab2009.wordpress .com<br />
antivirusvip.wordpress .com<br />
personaldefender2009.wordpress .com<br />
malwareremoval.wordpress .com</b><br />
<br />
Naturally, it didn't take long before blackhat SEO farms were created for the purpose, like these very latest ones :<br />
<br />
<b>removal-tool.blogspot .com<br />
cgidoctor .com<br />
spywareremoval .net<br />
spyware-adware-remover .com<br />
spywarestop .com<br />
zero-adware .net<br />
adware-remove .com<br />
antispywaresecrets .com<br />
protectyourcomputerfromspyware .info<br />
cleanpcfree .net<br />
spyware-bot&nbsp; .com<br />
spywarezapper.co .uk<br />
thepcsecurity .com<br />
noadware-official-site .com<br />
spywaredoctorfavor .cn<br />
removespywareedge .cn<br />
thespywareremover .com<br />
virusremovalguru .com<br />
virusremovalguide .org</b> <br />
<br />
The day when fake security software sites start attracting traffic by promising to remove other fake security software, is the day when we have clear evidence that an ecosystem has emerged.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2008/11/diverse-portfolio-of-fake-security.html">A Diverse Portfolio of Fake Security Software - Part Twelve</a><br />
<a href="http://ddanchev.blogspot.com/2008/10/diverse-portfolio-of-fake-security_28.html">A Diverse Portfolio of Fake Security Software - Part Eleven</a><br />
<a href="http://ddanchev.blogspot.com/2008/10/diverse-portfolio-of-fake-security_22.html">A Diverse Portfolio of Fake Security Software - Part Ten</a><br />
<a href="http://ddanchev.blogspot.com/2008/10/diverse-portfolio-of-fake-security_16.html">A Diverse Portfolio of Fake Security Software - Part Nine</a><br />
<a href="http://ddanchev.blogspot.com/2008/10/diverse-portfolio-of-fake-security.html">A Diverse Portfolio of Fake Security Software - Part Eight</a><br />
<a href="http://ddanchev.blogspot.com/2008/09/diverse-portfolio-of-fake-security_30.html">A Diverse Portfolio of Fake Security Software - Part Seven</a><br />
<a href="http://ddanchev.blogspot.com/2008/09/diverse-portfolio-of-fake-security_24.html">A Diverse Portfolio of Fake Security Software - Part Six</a><br />
<a href="http://ddanchev.blogspot.com/2008/09/diverse-portfolio-of-fake-security.html">A  Diverse Portfolio of Fake Security Software - Part Five</a> <br />
<a href="http://ddanchev.blogspot.com/2008/08/diverse-portfolio-of-fake-security_25.html">A  Diverse Portfolio of Fake Security Software - Part Four</a><br />
<a href="http://ddanchev.blogspot.com/2008/08/diverse-portfolio-of-fake-security_20.html">A  Diverse Portfolio of Fake Security Software - Part Three</a><b> </b><br />
<a href="http://ddanchev.blogspot.com/2008/08/diverse-portfolio-of-fake-security.html">A  Diverse Portfolio of Fake Security Software - Part Two</a><br />
<a href="http://ddanchev.blogspot.com/2007/12/diverse-portfolio-of-fake-security.html">Diverse  Portfolio of Fake Security Software</a><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=AqTIN"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=AqTIN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=GqbtN"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=GqbtN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=AwMMn"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=AwMMn" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=wYg3n"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=wYg3n" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=xmYvN"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=xmYvN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=lK1GN"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=lK1GN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=uEj3n"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=uEj3n" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/451194751" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 12 Nov 2008 13:57:26 +0000</pubDate>
      <category domain="http://securityratty.com/tag/security software">security software</category>
      <category domain="http://securityratty.com/tag/software">software</category>
      <category domain="http://securityratty.com/tag/fake security software">fake security software</category>
      <category domain="http://securityratty.com/tag/popular software">popular software</category>
      <category domain="http://securityratty.com/tag/diverse portfolio">diverse portfolio</category>
      <category domain="http://securityratty.com/tag/wordpress">wordpress</category>
      <category domain="http://securityratty.com/tag/wordpress accounts">wordpress accounts</category>
      <category domain="http://securityratty.com/tag/proactive threat intell">proactive threat intell</category>
      <category domain="http://securityratty.com/tag/net">net</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/451194751/diverse-portfolio-of-fake-security_12.html">A Diverse Portfolio of Fake Security Software - Part Thirteen</source>
    </item>
    <item>
      <title><![CDATA[Six Security Vulnerabilities Updated By Adobe In Flash Player 9]]></title>
      <link>http://securityratty.com/article/86fa944e76baa9f405fe667870f911f2</link>
      <guid>http://securityratty.com/article/86fa944e76baa9f405fe667870f911f2</guid>
      <description><![CDATA[Adobe has released another Flash Player 9 update to cover at least six documented security vulnerabilities that could expose users to a wide range of hacker attacks. The patch, rated critical by...]]></description>
      <content:encoded><![CDATA[Adobe has released another Flash Player 9 update to cover at least six documented security vulnerabilities that could expose users to a wide range of hacker attacks.
The patch, rated “critical” by Adobe, affects Flash Player 9.0.124.0 on all platforms. The latest Flash Player vulnerabilities include:
CVE-2008-4818: This update includes a change to the way Flash Player [...]]]></content:encoded>
      <pubDate>Thu, 06 Nov 2008 20:24:16 +0000</pubDate>
      <category domain="http://securityratty.com/tag/flash player">flash player</category>
      <category domain="http://securityratty.com/tag/affects flash player">affects flash player</category>
      <category domain="http://securityratty.com/tag/security vulnerabilities">security vulnerabilities</category>
      <category domain="http://securityratty.com/tag/adobe">adobe</category>
      <category domain="http://securityratty.com/tag/wide range">wide range</category>
      <category domain="http://securityratty.com/tag/expose users">expose users</category>
      <category domain="http://securityratty.com/tag/hacker attacks">hacker attacks</category>
      <category domain="http://securityratty.com/tag/platforms">platforms</category>
      <category domain="http://securityratty.com/tag/change">change</category>
      <source url="http://cyberinsecure.com/six-security-vulnerabilities-updated-by-adobe-in-flash-player-9/">Six Security Vulnerabilities Updated By Adobe In Flash Player 9</source>
    </item>
    <item>
      <title><![CDATA[Microsofts Report Shows Vista More Secure Than XP]]></title>
      <link>http://securityratty.com/article/8c020de2de57de95126f6f412ddf5547</link>
      <guid>http://securityratty.com/article/8c020de2de57de95126f6f412ddf5547</guid>
      <description><![CDATA[Microsofts latest security report shows that the number of new vulnerabilities found in its software was lower in first half of the year than the last half of 2007, with the Windows Vista OS proving...]]></description>
      <content:encoded><![CDATA[Microsoft&#8217;s latest security report shows that the number of new vulnerabilities found in its software was lower in first half of the year than the last half of 2007, with the Windows Vista OS proving more resistant to exploits than XP.
Microsoft reported 77 vulnerabilities from January to June compared to 116 for the last six [...]]]></content:encoded>
      <pubDate>Wed, 05 Nov 2008 01:41:59 +0000</pubDate>
      <category domain="http://securityratty.com/tag/windows vista">windows vista</category>
      <category domain="http://securityratty.com/tag/half">half</category>
      <category domain="http://securityratty.com/tag/microsofts">microsofts</category>
      <category domain="http://securityratty.com/tag/security report">security report</category>
      <category domain="http://securityratty.com/tag/vulnerabilities">vulnerabilities</category>
      <category domain="http://securityratty.com/tag/exploits">exploits</category>
      <category domain="http://securityratty.com/tag/microsoft">microsoft</category>
      <category domain="http://securityratty.com/tag/software">software</category>
      <category domain="http://securityratty.com/tag/june">june</category>
      <source url="http://cyberinsecure.com/microsofts-report-shows-vista-more-secure-than-xp/">Microsofts Report Shows Vista More Secure Than XP</source>
    </item>
    <item>
      <title><![CDATA[A Diverse Portfolio of Fake Security Software - Part Twelve]]></title>
      <link>http://securityratty.com/article/d462bee817ac892232f1b929608cd422</link>
      <guid>http://securityratty.com/article/d462bee817ac892232f1b929608cd422</guid>
      <description><![CDATA[These very latest rogue security software domains have been in circulation -- blackhat SEO, SQL injections, traffic redirection scripts -- since Friday and remain active

premium-pc-scan .com...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://1.bp.blogspot.com/_wICHhTiQmrA/SQ9py9LcidI/AAAAAAAACaU/fQfM4EAzuKo/s1600-h/rogue_security_software_portfolio_november.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://1.bp.blogspot.com/_wICHhTiQmrA/SQ9py9LcidI/AAAAAAAACaU/dLsxwtYrDik/s200-R/rogue_security_software_portfolio_november.png" /></a>These very latest rogue security software domains have been in circulation -- blackhat SEO, SQL injections, traffic redirection scripts -- since Friday and remain active : <br />
<br />
<b>premium-pc-scan .com</b> (78.159.118.217; 89.149.253.215; 91.203.92.47)<br />
<b>antivirus-pc-scan .com</b> (208.72.169.100)<br />
<b>securityfullscan .com</b> (84.243.197.184)<br />
<b>antivirus-live-scan .com</b> (84.243.196.136; 89.149.227.196)<br />
<b>windefender-2009 .com</b> - (200.63.45.55)<br />
<b>windefender2009 .com</b><br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://4.bp.blogspot.com/_wICHhTiQmrA/SQ9q3PPub7I/AAAAAAAACac/4qLyQ0P9_iY/s1600-h/rogue_security_software_portfolio_november_1.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://4.bp.blogspot.com/_wICHhTiQmrA/SQ9q3PPub7I/AAAAAAAACac/mxOldlIx5B4/s200-R/rogue_security_software_portfolio_november_1.png" /></a>What these domains have in common, excluding the last two WinDefender ones, is the domain registrant, the DNS servers used, and that despite the fact that it has already been featured in several malicious doorways, meaning these are receiving traffic already, they forgot to upload the binaries on all of the active domains : <br />
<br />
"<i>Not Found. The requested URL /2009/download/trial/A9installer_.exe was not found on this server.</i>"<br />
<br />
<i>Registrant:&nbsp;</i><br />
<i>Vladimir Polilov&nbsp;</i><br />
<i>Email: gpdomains@yahoo.com</i><br />
<i>Organization: Private person</i><br />
<i>Address: ul. Bauma 13-76</i><br />
<i>City: Moskva</i><br />
<i>State: Moskovskaya oblast</i><br />
<i>ZIP: 112621</i><br />
<i>Country: RU</i><br />
<i>Phone: +7.9031609536 </i><br />
<br />
DNS servers used - <i>ns1.freefastdns.com; ns2.freefastdns.com</i><br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://2.bp.blogspot.com/_wICHhTiQmrA/SQ9uoEsQJ9I/AAAAAAAACak/3NBPR8SZ5q0/s1600-h/rogue_security_software_portfolio_november_2.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://2.bp.blogspot.com/_wICHhTiQmrA/SQ9uoEsQJ9I/AAAAAAAACak/rpBUB4rPmgI/s200-R/rogue_security_software_portfolio_november_2.png" /></a>Moreover, the following domains are also parked at the same IPs, but are currently in stand-by mode, yet they're also using the same DNS servers with the only difference in the registrant who seems to have been running a very extensive portfolio of bogus domains, potentially making hundreds of thousands in the process :<br />
<br />
<b>save-my-pc-now .com<br />
real-antivirus .com<br />
liveantivirustest .com<br />
antiviruspctest .com<br />
premium-live-scan .com<br />
liveantivirustest .com<br />
antiviruspersonaltest .com<br />
mysecuritysupport .com<br />
updateyourprotection .com<br />
antivirus-premiumscan .com<br />
securitylivescan .com<br />
security-full-scan .com<br />
secured-liveupdate .com<br />
livepcupdate .com<br />
protection-update .com<br />
antivirus-scan-online .com<br />
xpsoftupgrade .com<br />
live-virus-defence .com</b><br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://1.bp.blogspot.com/_wICHhTiQmrA/SQ9xN8GkbcI/AAAAAAAACas/ebLo_gyI2Mg/s1600-h/rogue_software_phones_back_home.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://1.bp.blogspot.com/_wICHhTiQmrA/SQ9xN8GkbcI/AAAAAAAACas/olFP5HLvCFg/s200-R/rogue_software_phones_back_home.JPG" /></a><i>Registrant:<br />
Shestakov Yuriy <br />
alexey@cocainmail.com/alexeyvas@safe-mail.net <br />
+7.9218839910<br />
Lenina 21 16<br />
Mirniy,MSK,RU 102422</i><br />
<br />
The sampled WinDefender binaries phone back to <b>megauplinkbindinstaller .com/cfg1.php</b> (91.203.92.99) with the entire netblock clearly a bad neighborhood. Here are some sample command and control locations :<br />
<br />
<b>91.203.92.101 /admin/cd.php?userid=19102008_184429_260953 <br />
91.203.92.25 /dmn/domen.txt<br />
91.203.92.135 /alligator/cfg.bin<br />
91.203.92.132 /c.bin</b><br />
<br />
This operation is being monitored, results will be posted as they emerge.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2008/10/diverse-portfolio-of-fake-security_28.html">A Diverse Portfolio of Fake Security Software - Part Eleven</a><br />
<a href="http://ddanchev.blogspot.com/2008/10/diverse-portfolio-of-fake-security_22.html">A Diverse Portfolio of Fake Security Software - Part Ten</a><br />
<a href="http://ddanchev.blogspot.com/2008/10/diverse-portfolio-of-fake-security_16.html">A Diverse Portfolio of Fake Security Software - Part Nine</a><br />
<a href="http://ddanchev.blogspot.com/2008/10/diverse-portfolio-of-fake-security.html">A Diverse Portfolio of Fake Security Software - Part Eight</a><br />
<a href="http://ddanchev.blogspot.com/2008/09/diverse-portfolio-of-fake-security_30.html">A Diverse Portfolio of Fake Security Software - Part Seven</a><br />
<a href="http://ddanchev.blogspot.com/2008/09/diverse-portfolio-of-fake-security_24.html">A Diverse Portfolio of Fake Security Software - Part Six</a><br />
<a href="http://ddanchev.blogspot.com/2008/09/diverse-portfolio-of-fake-security.html">A  Diverse Portfolio of Fake Security Software - Part Five</a> <br />
<a href="http://ddanchev.blogspot.com/2008/08/diverse-portfolio-of-fake-security_25.html">A  Diverse Portfolio of Fake Security Software - Part Four</a><br />
<a href="http://ddanchev.blogspot.com/2008/08/diverse-portfolio-of-fake-security_20.html">A  Diverse Portfolio of Fake Security Software - Part Three</a><b> </b><br />
<a href="http://ddanchev.blogspot.com/2008/08/diverse-portfolio-of-fake-security.html">A  Diverse Portfolio of Fake Security Software - Part Two</a><br />
<a href="http://ddanchev.blogspot.com/2007/12/diverse-portfolio-of-fake-security.html">Diverse  Portfolio of Fake Security Software</a><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=KFegN"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=KFegN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=uDICN"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=uDICN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=g1W6n"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=g1W6n" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=V2Qnn"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=V2Qnn" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=HZkbN"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=HZkbN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=1Md6N"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=1Md6N" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=IxBRn"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=IxBRn" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/441437574" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 03 Nov 2008 13:11:25 +0000</pubDate>
      <category domain="http://securityratty.com/tag/fake security software">fake security software</category>
      <category domain="http://securityratty.com/tag/diverse portfolio">diverse portfolio</category>
      <category domain="http://securityratty.com/tag/windefender binaries phone">windefender binaries phone</category>
      <category domain="http://securityratty.com/tag/active domains">active domains</category>
      <category domain="http://securityratty.com/tag/domains">domains</category>
      <category domain="http://securityratty.com/tag/dns servers">dns servers</category>
      <category domain="http://securityratty.com/tag/phone">phone</category>
      <category domain="http://securityratty.com/tag/registrant">registrant</category>
      <category domain="http://securityratty.com/tag/domain registrant">domain registrant</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/441437574/diverse-portfolio-of-fake-security.html">A Diverse Portfolio of Fake Security Software - Part Twelve</source>
    </item>
  </channel>
</rss>
