<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: sony]]></title>
    <link>http://securityratty.com/tag/sony</link>
    <description></description>
    <pubDate>Fri, 28 Mar 2008 21:00:00 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Global Dispatches]]></title>
      <link>http://securityratty.com/article/876eac72ad1daf3d7aa7d30365d2a449</link>
      <guid>http://securityratty.com/article/876eac72ad1daf3d7aa7d30365d2a449</guid>
      <description><![CDATA[The airport in Manchester, England, tests a facial recognition system as part of a nationwide effort to better control the country's borders; and Sony recalls 438,000 laptops because of a problem that...]]></description>
      <content:encoded><![CDATA[The airport in Manchester, England, tests a facial recognition system as part of a nationwide effort to better control the country's borders; and Sony recalls 438,000 laptops because of a problem that could lead to overheating.<br style="clear: both;"/>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v2:c9a951b957e8b12072c44013e75a36f2:M8jzss81jfGxeSgjD%2B656K4rq0qckysMHtoiqxyMA%2B0KNj0e1yXN7LH%2FsrF34v0mMm3VXXaB6JybADbLPWqcBHUFszoqZUotS4uWWFDTX6c%3D'><img border='0' title='Add to digg' alt='Add to digg' src='http://www.pheedo.com/images/mm/digg.gif'/></a>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v2:4b367a32043103efecae8376744c83f5:xCMZxCTscbaF8r4LPmzeP0YrWH3utbAiG8Y6dOd2cam7SJRVzaX7DTXWgrhDcP%2BiRi28HEPLPs5kCu4uay4jO78FYJzuOKk45wHGUOLBuT0%3D'><img border='0' title='Add to StumbleUpon' alt='Add to StumbleUpon' src='http://www.pheedo.com/images/mm/stumbleit.gif'/></a>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v2:a9f5206edec5bf998c506f2e235c01c2:ztAH2G09vffLWLT%2BAuuLYgbFgcfu78jNNs9ioh8rUSAuFhWpakSi7DsNn%2FAlqpj9jpeid2cgIoPd8DxYER58cSMzXP4BTZqicOrekMHgv7Q%3D'><img border='0' title='Add to Twitter' alt='Add to Twitter' src='http://www.pheedo.com/images/mm/twitter.png'/></a>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v2:86d4da8561191c7a85413de35a71b751:o%2FGelIPd3G7fs%2FvB3Qjt1eFXTzdK%2BsH7yxWSkLksEh2xQbmCa44wRcYAGHVoE01DnvDM73oW8vt7BI7BoRpREf7U4K3vxulIa7mV2LE5wuw%3D'><img border='0' title='Add to Slashdot' alt='Add to Slashdot' src='http://www.pheedo.com/images/mm/slashdot.png'/></a>
<br style="clear: both;"/>  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=7630d167c4f0ae047a4c3d620435ae76" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=7630d167c4f0ae047a4c3d620435ae76" style="display: none;" border="0" height="1" width="1" alt=""/>]]></content:encoded>
      <pubDate>Mon, 08 Sep 2008 01:39:28 +0000</pubDate>
      <category domain="http://securityratty.com/tag/facial recognition system">facial recognition system</category>
      <category domain="http://securityratty.com/tag/nationwide effort">nationwide effort</category>
      <category domain="http://securityratty.com/tag/sony recalls">sony recalls</category>
      <category domain="http://securityratty.com/tag/country">country</category>
      <category domain="http://securityratty.com/tag/lead">lead</category>
      <category domain="http://securityratty.com/tag/laptops">laptops</category>
      <category domain="http://securityratty.com/tag/manchester">manchester</category>
      <category domain="http://securityratty.com/tag/airport">airport</category>
      <category domain="http://securityratty.com/tag/england">england</category>
      <source url="http://feeds.computerworld.com/click.phdo?i=7630d167c4f0ae047a4c3d620435ae76">Global Dispatches</source>
    </item>
    <item>
      <title><![CDATA[Compromised Cpanel Accounts For Sale]]></title>
      <link>http://securityratty.com/article/6228ebb081126296ff70b5f6268fd2a3</link>
      <guid>http://securityratty.com/article/6228ebb081126296ff70b5f6268fd2a3</guid>
      <description><![CDATA[Is the once popular in the second quarter of 2007, embedded malware tactic on the verge of irrelevance, and if so, what has contributed to its decline? Have SQL injections executed through botnets...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://4.bp.blogspot.com/_wICHhTiQmrA/SKlq1uSeDFI/AAAAAAAACDM/l4bxcru-BQk/s1600-h/cpanel_multiple_domains1.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://4.bp.blogspot.com/_wICHhTiQmrA/SKlq1uSeDFI/AAAAAAAACDM/ho301JgoMUs/s200-R/cpanel_multiple_domains1.png" /></a> Is the once popular in the second quarter of 2007, embedded malware tactic on the verge of irrelevance, and if so, what has contributed to its decline? Have SQL injections executed through botnets turned into the most efficient way to infect hundreds of thousands of legitimate web sites? Depends on who you're dealing with.<br />
<br />
A cyber criminal's position in the "underground food chain" can be easily tracked down on the basis of tools and tactics that he's taking advantage of, in fact, some would on purposely misinform on what their actual capabilities are in order not to attract too much attention to their real ones, consisting of high-profile compromises at hundreds of high-profile web sites.<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://3.bp.blogspot.com/_wICHhTiQmrA/SKmDVdDGnPI/AAAAAAAACDU/qNbLBUKlHp0/s1600-h/cpanel_multiple_domains3.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://3.bp.blogspot.com/_wICHhTiQmrA/SKmDVdDGnPI/AAAAAAAACDU/ZsmcK9HMeUs/s200-R/cpanel_multiple_domains3.jpg" /></a>Embedded malware may not be as hot as it used to be in the last quarter of 2007, but thanks to the oversupply of stolen accounting data, certain individuals within the underground ecosystem seem to be abusing entire portfolios of domains on the basis of purchasing access to the compromised accounts. In fact, the oversupply of compromised Cpanel accounts is logically resulting in their decreasing price, with the sellers differentiating their propositions, and charging premium prices based on the site's page ranks and traffic, measured through publicly available services, or through the internal statistics.<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://4.bp.blogspot.com/_wICHhTiQmrA/SKmMyr4CWEI/AAAAAAAACDc/UafOTCKAb-0/s1600-h/cpanel_multiple_domains22.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://4.bp.blogspot.com/_wICHhTiQmrA/SKmMyr4CWEI/AAAAAAAACDc/7IRBMNndy-w/s200-R/cpanel_multiple_domains22.JPG" /></a><br />
SQL injections may be the tactic of choice for the time being, but as long as stolen accounting data consisting of Cpanel logins, and web shells access to misconfigured web servers remain desired underground goods, goold old fashioned embedded malware will continue taking place.<br />
<br />
Interestingly, from an economic perspective, the way the seller markets his goods, can greatly influence the way they get abused given he continues offering after-sale services and support. It's blackhat search engine optimization I have in mind, sometimes the tactic of choice especially given its high liquidity in respect to monetizing the compromised access.<br />
<br />
The bottom line - for the time being, there's a higher probability that your web properties will get SQL injected, than IFRAME-ed, as it used to be half a year ago, and that's because what used to be a situation where malicious parties would aim at launching a targeted attack at high profile site and abuse the huge traffic it receives, is today's pragmatic reality where a couple of hundred low profile web sites can in fact return more traffic to the cyber criminals, and greatly extend the lifecycle of their campaign taking advantage of the fact the the low profile site owners would remain infected and vulnerable for months to come.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2008/03/embedding-malicious-iframes-through.html">Embedding Malicious IFRAMEs Through Stolen FTP Accounts</a><br />
<a href="http://ddanchev.blogspot.com/2008/03/injecting-iframes-by-abusing-input.html">Injecting IFRAMEs by Abusing Input Validation</a><br />
<a href="http://ddanchev.blogspot.com/2008/07/money-mule-recruiters-use-asproxs-fast.html">Money Mule Recruiters use ASProx's Fast-flux Services</a><br />
<a href="http://ddanchev.blogspot.com/2008/05/malware-domains-used-in-sql-injection.html">Malware Domains Used in the SQL Injection Attacks</a><br />
<a href="http://ddanchev.blogspot.com/2008/07/obfuscating-fast-fluxed-sql-injected.html">Obfuscating Fast-fluxed SQL Injected Domains</a><br />
<a href="http://ddanchev.blogspot.com/2008/07/sql-injecting-malicious-doorways-to.html">SQL Injecting Malicious Doorways to Serve Malware </a><br />
<a href="http://ddanchev.blogspot.com/2008/05/yet-another-massive-sql-injection.html">Yet Another Massive SQL Injection Spotted in the Wild</a><br />
<a href="http://ddanchev.blogspot.com/2008/05/malware-domains-used-in-sql-injection.html">Malware Domains Used in the SQL Injection Attacks</a><br />
<a href="http://ddanchev.blogspot.com/2007/07/sql-injection-through-search-engines.html">SQL Injection Through Search Engines Reconnaissance</a><br />
<a href="http://ddanchev.blogspot.com/2007/05/google-hacking-for-vulnerabilities.html">Google Hacking for Vulnerabilities</a><br />
<a href="http://blogs.zdnet.com/security/?p=1122">Fast-Fluxing SQL injection attacks executed from the Asprox botnet</a><br />
<a href="http://blogs.zdnet.com/security/?p=1394">Sony PlayStation's site SQL injected, redirecting to rogue security software</a><br />
<a href="http://blogs.zdnet.com/security/?p=1118">Redmond Magazine Successfully SQL Injected by Chinese Hacktivists</a><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=ExzKaK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=ExzKaK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=AgwoKK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=AgwoKK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=5JjO7k"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=5JjO7k" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=5Z85mk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=5Z85mk" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=s4xhGK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=s4xhGK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=ReebmK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=ReebmK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=T0yjTk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=T0yjTk" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/368194376" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 18 Aug 2008 06:42:50 +0000</pubDate>
      <category domain="http://securityratty.com/tag/sql">sql</category>
      <category domain="http://securityratty.com/tag/sql injections">sql injections</category>
      <category domain="http://securityratty.com/tag/sql injection attacks">sql injection attacks</category>
      <category domain="http://securityratty.com/tag/massive sql injection">massive sql injection</category>
      <category domain="http://securityratty.com/tag/profile site">profile site</category>
      <category domain="http://securityratty.com/tag/site">site</category>
      <category domain="http://securityratty.com/tag/site sql">site sql</category>
      <category domain="http://securityratty.com/tag/sql injection">sql injection</category>
      <category domain="http://securityratty.com/tag/tactic">tactic</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/368194376/compromised-cpanel-accounts-for-sale.html">Compromised Cpanel Accounts For Sale</source>
    </item>
    <item>
      <title><![CDATA[Summarizing Zero Day's Posts for July]]></title>
      <link>http://securityratty.com/article/8dcef74e51c669037abd743dd3beb89d</link>
      <guid>http://securityratty.com/article/8dcef74e51c669037abd743dd3beb89d</guid>
      <description><![CDATA[Different audience provokes different approach for communicating a particular event. In case you aren't reading ZDNet's Zero Day , where I blog next to Ryan Naraine and Nathan McFeters - join us
...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="text-align: center; clear: both;"></div><a href="http://1.bp.blogspot.com/_wICHhTiQmrA/SJyNk-jjwHI/AAAAAAAACBM/TzBiD3_WOw0/s1600-h/zero_day.png" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://1.bp.blogspot.com/_wICHhTiQmrA/SJyNk-jjwHI/AAAAAAAACBM/CewQ6GCj8yE/s200-R/zero_day.png" style="border: 0pt none ;" /></a>Different audience provokes different approach for communicating a particular event. In case you aren't reading <a href="http://blogs.zdnet.com/security">ZDNet's Zero Day</a>, where I blog next to Ryan Naraine and Nathan McFeters - join us.<br />
<br />
Also, consider subscribing yourself to <a href="http://updates.zdnet.com/tags/dancho+danchev.html?t=0&amp;s=0&amp;o=1&amp;mode=rss">my personal RSS feed</a>, or Zero Day's main feed <a href="http://feeds.feedburner.com/zdnet/security">in order to read all the posts</a>. Here's a quick summary of my posts for last month :<br />
<br />
<b>01.</b> <a href="http://blogs.zdnet.com/security/?p=1378">Blizzard introducing two-factor authentication for WoW gamers</a><br />
<b>02.</b> <a href="http://blogs.zdnet.com/security/?p=1394">Sony PlayStation's site SQL injected, redirecting to rogue security software</a><br />
<b>03.</b> <a href="http://blogs.zdnet.com/security/?p=1408">300 Lithuanian sites hacked by Russian hackers</a><br />
<b>04.</b> <a href="http://blogs.zdnet.com/security/?p=1412">Antivirus vendor introducing virtual keyboard for secure Ebanking</a><br />
<b>05.</b> <a href="http://blogs.zdnet.com/security/?p=1418">Gmail, Yahoo and Hotmail's CAPTCHA broken by spammers</a><br />
<b>06.</b> <a href="http://blogs.zdnet.com/security/?p=1440">Storm Worm's Independence Day campaign</a><br />
<b>07.</b> <a href="http://blogs.zdnet.com/security/?p=1445">Approximately 800 vulnerabilities discovered in antivirus products</a><br />
<b>08.</b> <a href="http://blogs.zdnet.com/security/?p=1448">$1 Million prize offered for cracking an encryption algorithm</a><br />
<b>09.</b> <a href="http://blogs.zdnet.com/security/?p=1453">U.K's most spammed person receives 44,000 spam emails daily</a><br />
<b>10.</b> <a href="http://blogs.zdnet.com/security/?p=1462">Storm Worm says the U.S have invaded Iran</a><br />
<b>11.</b> <a href="http://blogs.zdnet.com/security/?p=1473">Gmail, PayPal and Ebay embrace DomainKeys to fight phishing emails</a><br />
<b>12.</b> <a href="http://blogs.zdnet.com/security/?p=1476">Verizon, Telecom Italia, and Brasil Telecom top the botnet charts in Q2 of 2008</a><br />
<b>13.</b> <a href="http://blogs.zdnet.com/security/?p=1487">XSS worm at Justin.tv infects 2,525 profiles</a><br />
<b>14.</b> <a href="http://blogs.zdnet.com/security/?p=1492">Remote code execution through Intel CPU bugs</a><br />
<b>15.</b> <a href="http://blogs.zdnet.com/security/?p=1502">Ringleader of cybercrime group to be offered a job as cybercrime fighter</a><br />
<b>16.</b> <a href="http://blogs.zdnet.com/security/?p=1514">Spam coming from free email providers increasing</a><br />
<b>17.</b> <a href="http://blogs.zdnet.com/security/?p=1516">Kaspersky's Malaysian site hacked by Turkish hacker</a><br />
<b>18.</b> <a href="http://blogs.zdnet.com/security/?p=1533">Georgia President's web site under DDoS attack from Russian hackers</a><br />
<b>19.</b> <a href="http://blogs.zdnet.com/security/?p=1536">75% of online banking sites found vulnerable to security design flaws</a><br />
<b>20.</b> <a href="http://blogs.zdnet.com/security/?p=1538">McAfee debunks recent vulnerabilities in AV software research, n.runs restates its position</a><br />
<b>21.</b> <a href="http://blogs.zdnet.com/security/?p=1555">Click fraud in 2nd quarter of 2008 more sophisticated, botnets to blame</a><br />
<b>22.</b> <a href="http://blogs.zdnet.com/security/?p=1562">How OpenDNS, PowerDNS and MaraDNS remained unaffected by the DNS cache poisoning vulnerability</a><br />
<b>23.</b> <a href="http://blogs.zdnet.com/security/?p=1590">DNS cache poisoning attacks exploited in the wild</a><br />
<b>24.</b> <a href="http://blogs.zdnet.com/security/?p=1598">The Neosploit cybercrime group abandons its web malware exploitation kit</a><br />
<b>25.</b> <a href="http://blogs.zdnet.com/security/?p=1603">OS fingerprinting Apple's iPhone 2.0 software - a "trivial joke"</a><br />
<b>26.</b> <a href="http://blogs.zdnet.com/security/?p=1608">HD Moore pwned with his own DNS exploit, vulnerable AT&amp;T DNS servers to blame</a><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=2aIHIK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=2aIHIK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=gWQX0K"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=gWQX0K" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=yKKS6k"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=yKKS6k" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=HJ2jlk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=HJ2jlk" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=1CE30K"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=1CE30K" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=6ODqHK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=6ODqHK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=fiaybk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=fiaybk" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/359698181" height="1" width="1"/>]]></content:encoded>
      <pubDate>Fri, 08 Aug 2008 10:35:52 +0000</pubDate>
      <category domain="http://securityratty.com/tag/day">day</category>
      <category domain="http://securityratty.com/tag/software">software</category>
      <category domain="http://securityratty.com/tag/rogue security software">rogue security software</category>
      <category domain="http://securityratty.com/tag/spam emails daily">spam emails daily</category>
      <category domain="http://securityratty.com/tag/cybercrime">cybercrime</category>
      <category domain="http://securityratty.com/tag/cybercrime fighter">cybercrime fighter</category>
      <category domain="http://securityratty.com/tag/independence day campaign">independence day campaign</category>
      <category domain="http://securityratty.com/tag/emails">emails</category>
      <category domain="http://securityratty.com/tag/posts">posts</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/359698181/summarizing-zero-days-posts-for-july.html">Summarizing Zero Day's Posts for July</source>
    </item>
    <item>
      <title><![CDATA[Smells Like a Copycat SQL Injection In the Wild]]></title>
      <link>http://securityratty.com/article/ae553b37ba0ec150b5a4c344ba27652b</link>
      <guid>http://securityratty.com/article/ae553b37ba0ec150b5a4c344ba27652b</guid>
      <description><![CDATA[In between the massive SQL injections , that as a matter of fact remain ongoing, copycats taking advantage of the very same SQL injection tools using public search engine's indexes as a reconnaissance...]]></description>
      <content:encoded><![CDATA[<a href="http://bp0.blogger.com/_wICHhTiQmrA/SI2ac7mO18I/AAAAAAAAB9c/usiNWVgrooU/s1600-h/chinese_sql_injection.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp0.blogger.com/_wICHhTiQmrA/SI2ac7mO18I/AAAAAAAAB9c/97ckqqWaQ14/s200-R/chinese_sql_injection.JPG" style="border: 0pt none ;" /></a>In between the <a href="http://ddanchev.blogspot.com/2008/07/ayyildiz-turkish-hacking-group-vs.html">massive SQL injections</a>, that as a matter of fact remain ongoing, copycats taking advantage of the very same SQL injection tools using public search engine's indexes as a reconnaissance tools, are also starting to take advantage of <a href="http://ddanchev.blogspot.com/2008/07/obfuscating-fast-fluxed-sql-injected.html">localized and targeted attacks</a>, attacking specific online communities. Among these is <b>mx.content-type.cn /day.js </b>using <b>day.js</b> to attempt multiple exploitation using publicly obtainlable exploits such as Adodb.Stream, MPS.StormPlayer, DPClient.Vod, IERPCtl.IERPCtl.1, GLIEDown.IEDown.1, and targeting primarily Chinese web communities.<br />
<br />
Compared to a bit more sophisticated <a href="http://ddanchev.blogspot.com/2008/04/diy-exploit-embedding-tool-proprietary.html">attack tactics applied by Chinese hackers</a>, taking advantage of <a href="http://ddanchev.blogspot.com/2007/10/mpack-and-icepack-localized-to-chinese.html">localized versions</a> of the <a href="http://ddanchev.blogspot.com/2008/05/firepack-exploitation-kit-localized-to.html">de facto web malware exploitation kits</a>, those who don't have access to such continue using cybercrime 1.0 <a href="http://ddanchev.blogspot.com/2007/09/diy-exploits-embedding-tools.html">DIY exploit embedding tools</a> at large. The rest of the SQL injected domains as well as the exploits themselves are parked on the same plaee - <b>222.216.28.25</b>, also responding to :<br />
<br />
<b>down.goodnetads .org<br />
ads.goodnetads .org<br />
real.kav2008 .com<br />
hk.www404 .cn<br />
err.www404 .cn<br />
mx.content-type .cn<br />
sun.63afe561 .info<br />
ads.633f94d3 .info<br />
ads.1234214 .info<br />
ad.50db34d5 .info<br />
ads.50db34d5 .info<br />
ad.8d77b42a .info<br />
web.adsidc .info<br />
free.idcads .info<br />
free.cjads .info<br />
ads.adslooks .info<br />
list.adslooks .info<br />
ad.5iyy .info</b><br />
<br />
The SQL injected domains :<br />
<b>ads.633f94d3.info/day .js<br />
ad.8d77b42a.info/day .js<br />
ad.5iyy.info/day .js<br />
free.idcads.info/day .js<br />
efreesky.com/day .js<br />
v.freefl.info/day .js</b><br />
<br />
The internal structure :<br />
<b>free.idcads.info/f/index .htm<br />
free.idcads.info/014 .htm<br />
free.idcads.info/real11 .htm<br />
free.idcads.info/real10 .htm<br />
free.idcads.info/lz .htm<br />
free.idcads.info/bf .htm<br />
free.idcads.info/kong .htm<br />
free.idcads.info/f/swfobject .js<br />
ad.50db34d5.info//rm%5C/rm .exe</b><br />
<br />
Parked domains responding to the command and control locations, <b>60.191.223.76 </b>and <b>222.216.28.100</b> :<br />
<b>ftp.gggjjj .info<br />
live.ads002 .net<br />
log.goodnetads .org<br />
dat.goodnetads .org<br />
root.51113 .com<br />
sun.update999 .cn<br />
abb.633f94d3 .info<br />
up.50db34d5 .info</b><br />
<b>web.cn3721 .org&nbsp;&nbsp;&nbsp; <br />
dat.goodnetads .org<br />
cs.rm510 .com<br />
sb.sb941 .com<br />
k.sb941 .com<br />
info.sb941 .com<br />
day.sb941 .com<br />
post.ad9178 .com<br />
v.91tg .net</b><br />
<br />
Centralizing their scammy ecosystem always makes it easier to monitor, keep track of, and of course, expose. <br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2008/07/sql-injecting-malicious-doorways-to.html">SQL Injecting Malicious Doorways to Serve Malware </a><br />
<a href="http://ddanchev.blogspot.com/2008/05/yet-another-massive-sql-injection.html">Yet Another Massive SQL Injection Spotted in the Wild</a><br />
<a href="http://ddanchev.blogspot.com/2008/05/malware-domains-used-in-sql-injection.html">Malware Domains Used in the SQL Injection Attacks</a><br />
<a href="http://ddanchev.blogspot.com/2007/07/sql-injection-through-search-engines.html">SQL Injection Through Search Engines Reconnaissance</a><br />
<a href="http://ddanchev.blogspot.com/2007/05/google-hacking-for-vulnerabilities.html">Google Hacking for Vulnerabilities</a><br />
<a href="http://blogs.zdnet.com/security/?p=1122">Fast-Fluxing SQL injection attacks executed from the Asprox botnet</a><br />
<a href="http://blogs.zdnet.com/security/?p=1394">Sony PlayStation's site SQL injected, redirecting to rogue security software</a><br />
<a href="http://blogs.zdnet.com/security/?p=1118">Redmond Magazine Successfully SQL Injected by Chinese Hacktivists</a><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=9XdgSJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=9XdgSJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=3nv7jJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=3nv7jJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=3DXSvj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=3DXSvj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=exadYj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=exadYj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=kp9u0J"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=kp9u0J" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=y5pfDJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=y5pfDJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=Lkbwwj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=Lkbwwj" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/348288922" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 28 Jul 2008 01:51:23 +0000</pubDate>
      <category domain="http://securityratty.com/tag/sql">sql</category>
      <category domain="http://securityratty.com/tag/tools">tools</category>
      <category domain="http://securityratty.com/tag/sql injection tools">sql injection tools</category>
      <category domain="http://securityratty.com/tag/massive sql injections">massive sql injections</category>
      <category domain="http://securityratty.com/tag/attacks">attacks</category>
      <category domain="http://securityratty.com/tag/sql injection attacks">sql injection attacks</category>
      <category domain="http://securityratty.com/tag/sql injection">sql injection</category>
      <category domain="http://securityratty.com/tag/massive sql injection">massive sql injection</category>
      <category domain="http://securityratty.com/tag/site sql">site sql</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/348288922/smells-like-copycat-sql-injection-in.html">Smells Like a Copycat SQL Injection In the Wild</source>
    </item>
    <item>
      <title><![CDATA[Obfuscating Fast-fluxed SQL Injected Domains]]></title>
      <link>http://securityratty.com/article/274149f12bf7d146a0527dd85513a6a5</link>
      <guid>http://securityratty.com/article/274149f12bf7d146a0527dd85513a6a5</guid>
      <description><![CDATA[It's all a matter of how you put it, and putting it like represents a good example of tactical warfare, namely, combining different tactics for the sake of making it harder to keep track of the impact...]]></description>
      <content:encoded><![CDATA[<a href="http://bp0.blogger.com/_wICHhTiQmrA/SH-jQi_d3HI/AAAAAAAAB60/xkYP_cMkqC0/s1600-h/obfuscated_SQL_injection_fast_flux.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp0.blogger.com/_wICHhTiQmrA/SH-jQi_d3HI/AAAAAAAAB60/heB4xfAF32k/s320-R/obfuscated_SQL_injection_fast_flux.JPG" style="border: 0pt none ;" /></a>It's all a matter of how you put it, and putting it like represents a good example of tactical warfare, namely, combining different tactics for the sake of making it harder to keep track of the impact of a particular SQL injection campaign. Consider the following examples of obfuscated domains, naturally being in a fast-flux in the time of the SQL injection that several Chinese script kiddies were taking advantage of :<br />
<br />
%6b%6b%36%2e%75%73 - <b>kk6.us</b><br />
%73%61%79%38%2E%75%73 - <b>s.see9.us </b><br />
%66%75%63%6B%75%75%2E%75%73 - <b>fuckuu.us </b><br />
%61%2E%6B%61%34%37%2E%75%73 - <b>a.ka47.us</b><br />
%61%31%38%38%2E%77%73 - <b>a188.ws</b><br />
%33%2E%74%72%6F%6A%61%6E%38%2E%63%6F%6D - <b>3.trojan8.com</b><br />
%6D%31%31%2E%33%33%32%32%2E%6F%72%67 - <b>m11.3322.org</b><br />
<br />
As always, these obfuscations are just the tip of the iceberg considering the countless number of other URL obfuscations techniques that spammers and phishers used to take advantage of on a large scale. For the time being, one of the main reasons we're not seeing massive SQL injections using such obfuscations is mostly because the feature hasn't been implemented in popular SQL injectors for copycat script kiddies to take advantage of. However, with the potential for evasion of common detection approaches, it's only a matter of personal will for someone to add this extra layer to ensure the survivability of the campaign.<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="text-align: center; clear: both;"></div><a href="http://bp1.blogger.com/_wICHhTiQmrA/SH-rWx8Z7QI/AAAAAAAAB68/ELjRSL8Bobw/s1600-h/real_player_exploit.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp1.blogger.com/_wICHhTiQmrA/SH-rWx8Z7QI/AAAAAAAAB68/kWffly78SVM/s200-R/real_player_exploit.JPG" style="border: 0pt none ;" /></a>The folks behind these obfuscations are naturally <a href="http://ddanchev.blogspot.com/2008/06/underground-multitasking-in-action.html">multitasking on several different underground fronts</a>. Take for instance <b>3.trojan8.com </b>(58.18.33.248) also responding to <b>w2.xnibi.com </b>which is also injected at several domains, <b>w2.xnibi.com/index.gif</b> to be precise.<b> </b>The fake .gif file in the spirit of <a href="http://ddanchev.blogspot.com/2008/04/fake-directory-listings-acquiring.html">fake directory listings for acquiring traffic in order to serve malware</a>, is actually attempting to exploit a RealPlayer vulnerability - JS/RealPlr.LB!exploit. The deeper you go, the uglier it gets.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2008/05/yet-another-massive-sql-injection.html">Yet Another Massive SQL Injection Spotted in the Wild</a><br />
<a href="http://ddanchev.blogspot.com/2008/05/malware-domains-used-in-sql-injection.html">Malware Domains Used in the SQL Injection Attacks</a><br />
<a href="http://ddanchev.blogspot.com/2007/07/sql-injection-through-search-engines.html">SQL Injection Through Search Engines Reconnaissance</a><br />
<a href="http://ddanchev.blogspot.com/2007/05/google-hacking-for-vulnerabilities.html">Google Hacking for Vulnerabilities</a><br />
<a href="http://blogs.zdnet.com/security/?p=1122">Fast-Fluxing SQL injection attacks executed from the Asprox botnet</a><br />
<a href="http://blogs.zdnet.com/security/?p=1394">Sony PlayStation's site SQL injected, redirecting to rogue security software</a><br />
<a href="http://blogs.zdnet.com/security/?p=1118">Redmond Magazine Successfully SQL Injected by Chinese Hacktivists</a><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=qerf8J"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=qerf8J" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=M97n6J"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=M97n6J" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=bexghj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=bexghj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=7Q82Qj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=7Q82Qj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=zZiRyJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=zZiRyJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=X0fmeJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=X0fmeJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=ntQNRj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=ntQNRj" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/338377430" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 17 Jul 2008 11:31:06 +0000</pubDate>
      <category domain="http://securityratty.com/tag/sql">sql</category>
      <category domain="http://securityratty.com/tag/massive sql injections">massive sql injections</category>
      <category domain="http://securityratty.com/tag/sql injection campaign">sql injection campaign</category>
      <category domain="http://securityratty.com/tag/sql injection attacks">sql injection attacks</category>
      <category domain="http://securityratty.com/tag/popular sql injectors">popular sql injectors</category>
      <category domain="http://securityratty.com/tag/massive sql injection">massive sql injection</category>
      <category domain="http://securityratty.com/tag/site sql">site sql</category>
      <category domain="http://securityratty.com/tag/sql injection">sql injection</category>
      <category domain="http://securityratty.com/tag/campaign">campaign</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/338377430/obfuscating-fast-fluxed-sql-injected.html">Obfuscating Fast-fluxed SQL Injected Domains</source>
    </item>
    <item>
      <title><![CDATA[Scareware runs amok on PlayStation site]]></title>
      <link>http://securityratty.com/article/6b01d9820d267b9d897eeba33a3fb5e7</link>
      <guid>http://securityratty.com/article/6b01d9820d267b9d897eeba33a3fb5e7</guid>
      <description><![CDATA[Gamers visiting the US Sony PlayStation website risk malware infection after the site was hit by...]]></description>
      <content:encoded><![CDATA[Gamers visiting the US Sony PlayStation website risk malware infection after the site was hit by hackers.]]></content:encoded>
      <pubDate>Thu, 03 Jul 2008 11:28:35 +0000</pubDate>
      <category domain="http://securityratty.com/tag/site">site</category>
      <category domain="http://securityratty.com/tag/gamers">gamers</category>
      <category domain="http://securityratty.com/tag/hit">hit</category>
      <category domain="http://securityratty.com/tag/hackers">hackers</category>
      <source url="http://www.enn.ie/article/10124589.html">Scareware runs amok on PlayStation site</source>
    </item>
    <item>
      <title><![CDATA[Sony USA PlayStation Website SQL Injected And Redirects Visitors To Fake Anti-Virus Scam]]></title>
      <link>http://securityratty.com/article/1fbc74fb24da220cb5a30810eab4d198</link>
      <guid>http://securityratty.com/article/1fbc74fb24da220cb5a30810eab4d198</guid>
      <description><![CDATA[Sonys USA PlayStation website, a website with a very large number of daily visitors according to Alexa, had been the victim of an SQL injection attack. Sony PlayStations site is another high...]]></description>
      <content:encoded><![CDATA[Sony’s USA PlayStation website, a website with a very large number of daily visitors according to Alexa, had been the victim of an SQL injection attack. Sony PlayStation’s site is another high trafficked web site that fall victim into the continuing waves of massive botnets (ASProx botnet for example) SQL injections.
The purpose of this wave [...]]]></content:encoded>
      <pubDate>Wed, 02 Jul 2008 14:41:28 +0000</pubDate>
      <category domain="http://securityratty.com/tag/sql injection attack">sql injection attack</category>
      <category domain="http://securityratty.com/tag/sony playstations site">sony playstations site</category>
      <category domain="http://securityratty.com/tag/website">website</category>
      <category domain="http://securityratty.com/tag/massive botnets">massive botnets</category>
      <category domain="http://securityratty.com/tag/sql injections">sql injections</category>
      <category domain="http://securityratty.com/tag/web site">web site</category>
      <category domain="http://securityratty.com/tag/asprox botnet">asprox botnet</category>
      <category domain="http://securityratty.com/tag/daily visitors">daily visitors</category>
      <category domain="http://securityratty.com/tag/victim">victim</category>
      <source url="http://cyberinsecure.com/sony-usa-playstation-website-sql-injected-and-redirects-visitors-to-fake-anti-virus-scam/">Sony USA PlayStation Website SQL Injected And Redirects Visitors To Fake Anti-Virus Scam</source>
    </item>
    <item>
      <title><![CDATA[Eye-Fi Adds Geotagging, Splits Up Product Line]]></title>
      <link>http://securityratty.com/article/5f2f9ea858e0fb2fc115487b16b2b185</link>
      <guid>http://securityratty.com/article/5f2f9ea858e0fb2fc115487b16b2b185</guid>
      <description><![CDATA[The folks who brought us simple Wi-Fi for digital cameras add locations, modify pricing: Eye-Fi developed a supremely simple 2 GB Secure Digital card that can work with any digital camera and transfer...]]></description>
      <content:encoded><![CDATA[<p><a href="http://www.flickr.com/photos/69628725@N00/1907044776" title="View 'Eye-Fi 1' on Flickr.com"><img src="http://farm3.static.flickr.com/2228/1907044776_17c82ba821_s.jpg" alt="Eye-Fi 1" border="0" width="75" height="75" align="right"/></a><strong><a href="http://www.eye.fi/a-wireless-memory-card/">The folks who brought us simple Wi-Fi for digital cameras add locations, modify pricing:</a></strong> Eye-Fi developed a supremely simple 2 GB Secure Digital card that can work with any digital camera and transfer photos over known Wi-Fi networks with no effort. Now they've split their original $99 product offering into three items differentiated by features: Eye-Fi Explore, with Wi-Fi-based geotagging ($129); Eye-Fi Share, for uploading to photo-sharing systems ($99); and Eye-Fi Home, which is a cable-replacement service ($79). The Eye-Fi Explore will be available starting 9-June-2008.</p>

<p>The Eye-Fi Explore product relies on Skyhook Wireless's system of analyzing the signal strength of nearby Wi-Fi networks to extrapolate latitude and longitude. Eye-Fi ties that into their system to stamp images with locations. This deal also ties into Wayport's domestic network of 10,000 hotspots, most of which are McDonald's outlets, allowing free uploading via those systems. The purchase price covers one year of hotspot service. You can upgrade an existing Eye-Fi to the new feature for a fee. All three products work with Mac OS X Tiger and Leopard, and Windows XP/Vista.</p>

<p>Because Skyhook needs a live Web connection to look up the Wi-Fi environment, Eye-Fi can store the Wi-Fi snapshot when the picture is taken, and manage inserting the appropriate photo metadata (EXIF format) at upload for <a href="http://flickr.com/help/organizr/#199">Flickr</a> and other services that support geotagging.</p>

<p>Geotagging is a very popular idea, something that I'm quite taken with because it pairs the act of taking a photograph with the location at which the picture is taken, making a digital photograph seem a little less untied to reality. But until now, it's been generally quite involved to match a picture with coordinates. A handful of specialized cameras embed GPS chips, and there's software to facilitate other methods, but the cost and battery drain of GPS chips have apparently so far kept it from being a widely deployed feature, while the wonkiness of alternatives doesn't appeal to mainstream users.</p>

<p>Sony once sold this wacky <a href="http://www.sonystyle.com/webapp/wcs/stores/servlet/ProductDisplay?catalogId=10551&amp;storeId=10151&amp;langId=-1&amp;partNumber=GPSCS1KA">GPS companion</a> (which I just found out isn't available in either released model) that would track your location over time, and use that information to geotag images via a special software program that let you pair its stream of data with your photographs. </p>

<p>Eye-Fi and Skyhook are doing something almost the same, since the camera isn't capturing the GPS data, and the Eye-Fi isn't applying the information live, much of the time. But it's eminently more usable than the Sony system, because the Eye-Fi handles the assembly seamlessly for you. </p>

<p>Now there's just one thing to worry about. Think about this: McDonald's are everywhere, and nearly all of the U.S. locations have Wi-Fi. The Eye-Fi uploads whenever it can, as long as the camera is turned on. You're geotagging images without any effort. Okay, got it? So...you call in sick to work, and run off to take some photos. Your boss, using RSS to subscribe to your Flickr feed, not only sees your pictures as you wander the town, unknowningly promiscuously uploading them via quick-serve restaurants' networks, but also knows precisely where you are.</p>

<p>This makes me suggest that you might set your Flickr upload preferences to keep images private and your geotagging preferences the same. You can then expose the images you want for public consumption. The <a href="http://www.cartome.org/panopticon1.htm">Panoptican</a> is...us!</p>]]></content:encoded>
      <pubDate>Fri, 09 May 2008 10:07:15 +0000</pubDate>
      <category domain="http://securityratty.com/tag/eye-fi">eye-fi</category>
      <category domain="http://securityratty.com/tag/wi-fi">wi-fi</category>
      <category domain="http://securityratty.com/tag/simple wi-fi">simple wi-fi</category>
      <category domain="http://securityratty.com/tag/wi-fi networks">wi-fi networks</category>
      <category domain="http://securityratty.com/tag/eye-fi ties">eye-fi ties</category>
      <category domain="http://securityratty.com/tag/eye-fi home">eye-fi home</category>
      <category domain="http://securityratty.com/tag/eye-fi handles">eye-fi handles</category>
      <category domain="http://securityratty.com/tag/wi-fi environment">wi-fi environment</category>
      <category domain="http://securityratty.com/tag/eye-fi explore">eye-fi explore</category>
      <source url="http://wifinetnews.com/archives/008314.html">Eye-Fi Adds Geotagging, Splits Up Product Line</source>
    </item>
    <item>
      <title><![CDATA[Wayport Tops 10,000 McDonald's Locations]]></title>
      <link>http://securityratty.com/article/f8771881a38c1fc7d001b68fa32359dc</link>
      <guid>http://securityratty.com/article/f8771881a38c1fc7d001b68fa32359dc</guid>
      <description><![CDATA[Ten thousand is an arbitrary place to put a stick in the sand, but significant nonetheless: The milestone of 10,000 McDonald's wired up--a few hundred have back access only, due to being stores within...]]></description>
      <content:encoded><![CDATA[<p><strong><a href="http://www.wayport.com/NewsReleases.aspx?id=1832">Ten thousand is an arbitrary place to put a stick in the sand, but significant nonetheless:</a></strong> The milestone of 10,000 McDonald's wired up--a few hundred have back access only, due to being stores within WalMart centers--is a vindication of Wayport's long-term strategy, dating back to 2004. Wayport switched at that point from a slightly more public-faced, public-access company to one that understood that back-office operations could be just as valuable, if less sexy, than front-facing consumer networks. Dan Lowden, Wayport's long-time marketing and business development chief, said yesterday, "In a lot of these venues, the back office comes first. The Wi-Fi public access for some is a big priority, but for others it's a nice to have, great thing to have, but the priority is the back office."</p>

<p>Although several other quick-service restaurants like McDonald's lack any comprehensive Wi-Fi plan--Burger King, Wendy's, and Subway to name three of the largest--Wayport is locked out of working with direct competitors. This opens the potential for another firm to handle a several-thousand-location network. Wayport has worked with both McDonald's corporate-owned stores (about 2/3rds of stores in the U.S.), as well as reaching out to franchisees, who Lowden noted pay a predetermined flat rate for the service via McDonald's. "It's made them incredibly efficient to be able to offer this to their franchisees at one price, instead of variable pricing," he noted. Wayport acts as the layer between various telecom providers, applications and services, and the stores.</p>

<p>Wayport provides several kinds of back-office services, although credit-card processing was the first thing htey rolled out. They've extended to remote video feeds for security, Redbox DVD rental systems that are found in some McDonald's, and kiosks used for job applications. Lowden said Wayport offers things as straightforward but critical as a dial-up fail-safe when a broadband connection drops. </p>

<p>Wayport also manages AT&T's hotspot network, which puts them in the unwiring seat for the 7,000-odd Starbucks stores that will converted from T-Mobile to AT&T service during 2008. Wayport was once the clear leader in the hotspot builder market, with T-Mobile in the second position. Now, Wayport will be operating through a direct contract or management agreement over 18,000 hotspots in the U.S.; T-Mobile will likely be the second biggest with a couple thousand locations (Borders and FedEx/Kinko's tops among them). The No. 3 player is hard to figure. Panera? </p>

<p>I've been predicting for some time that media on the edge--music, videos, movies, and games stored on servers on the local Wi-Fi network--will be the next big development in venue-oriented Wi-Fi, with Starbucks likely far in the lead. Lowden wouldn't comment on any specific plans in the works, of course, but said generally, "Storing and caching all that content on the edge...hasn't been leveraged in the past, but it will be in the future to create a very unique experience." At Barnes & Noble, Wayport caches some multimedia data that's available to customers in the stores.</p>

<p>The advantage for in-store media storage is that you can leverage the speed of the local network, and add additional access points to distribute network load. The choke point is no longer the Internet connection, but local network speed. I expect--though Wayport, AT&T, and Starbucks haven't said it--that Starbucks infrastructure will be all 802.11n for this reason, likely with both 2.4 GHz and 5 GHz support for the best throughput in the higher-frequency band for media transactions. (In fact, I wouldn't be surprised if you could only buy movies via 5 GHz.)</p>

<p>Lowden also noted that the proliferation of mobile devices with Wi-Fi built in have led to them reaching out to venues that wouldn't have made sense for them to work with previously, and for unlikely candidates to reach out to them, too. Wayport is now working with a number of healthcare facilities that, while they have their own network infrastructure, wanted to outsource public access Wi-Fi (whether they choose to charge or underwrite it), and certain applications that they're not as experienced with running themselves.</p>

<p><strong>A little history:</strong> In 2001 and again in 2004, the heat seemed to be on the public side of Wi-Fi: lots of money to be made, ostensibly, lots of partnerships and venues to be built, and an overcrowded supply of infrastructure builders. The year before, Wayport looked to be an also-ran in the hotspot provider business. </p>

<p>Despite being one of the earliest firms to put Ethernet and then Wi-Fi into hotels, and build out hotspots in airports; and despite their survival of the first hotspot meltdown in 2001 during the dotcom crash and brief venture capital shortage; and despite their early entrance into allowing wholesale pricing for hotspot aggregators; the firm seemed about to be eclipsed by apparently deep-pocketed Cometa (with AT&T, IBM, and Intel in various capital and support roles), Toshiba's mom-and-pop focused turnkey system, and T-Mobile, which had the Starbucks contract. What a difference a year makes.</p>

<p>Cometa, Toshiba, and Wayport contended for the contract to build out back-office and public-access service at McDonald's in the U.S., and Wayport won. Within a few weeks, Toshiba passed its few hundred locations to Cometa, which shut its doors in May 2004. Wayport, meanwhile, had <a href="http://wifinetnews.com/archives/003377.html">cooked up a strategy</a> for McDonald's that it announced later that month. </p>

<p>Their approach involved a fixed-rate charged for unlimited access by retail network partners for all the locations in their pool. This meant that partners had a fixed cost, instead of a per-session cost, and Wayport could obtain specific revenue even before usage by a partner ramped up. Wayport hasn't discussed the details of this arrangement in depth since, but has partnered with Sony with its Mylo, Nintendo with its DS game player, and ZipIt with its wireless messaging appliance. </p>

<p>The McDonald's deal also apparently gave Wayport a way to extend its work with SBC-later-AT&T; Wayport had earlier in 2004 <a href="http://wifinetnews.com/archives/003151.html">became the managed-services contractor</a> for SBC to build out The UPS Store/Mailboxes Etc. nationwide. (UPS <a href="http://wifinetnews.com/archives/007770.html">dropped AT&T as its partner</a> in mid-2007, although that didn't appear to have anything to do with Wayport's role.)</p>

<p>AT&T through Wayport developed its large resold/managed footprint that incorporated resale of Wayport's McDonald's locations with the UPS Store and a few hundred other managed locations, including a handful of airports. The Cingular acquisition of AT&T Wireless put more airports in SBC's hands, too. (SBC was once the 60 percent majority owner of Cingular; when SBC and BellSouth, the other owner, merged that put the newly rebranded AT&T in charge of Cingular which it relabeled as AT&T. Confusing, huh?)</p>]]></content:encoded>
      <pubDate>Tue, 29 Apr 2008 05:25:32 +0000</pubDate>
      <category domain="http://securityratty.com/tag/wayport">wayport</category>
      <category domain="http://securityratty.com/tag/wi-fi">wi-fi</category>
      <category domain="http://securityratty.com/tag/comprehensive wi-fi plan">comprehensive wi-fi plan</category>
      <category domain="http://securityratty.com/tag/local wi-fi network">local wi-fi network</category>
      <category domain="http://securityratty.com/tag/att service">att service</category>
      <category domain="http://securityratty.com/tag/service">service</category>
      <category domain="http://securityratty.com/tag/wayport offers">wayport offers</category>
      <category domain="http://securityratty.com/tag/network">network</category>
      <category domain="http://securityratty.com/tag/wayport caches">wayport caches</category>
      <source url="http://wifinetnews.com/archives/008294.html">Wayport Tops 10,000 McDonald's Locations</source>
    </item>
    <item>
      <title><![CDATA[With Vista breached, Linux unbeaten in hacking contest]]></title>
      <link>http://securityratty.com/article/11a1924c4fdd8b721e93fa7577b363a5</link>
      <guid>http://securityratty.com/article/11a1924c4fdd8b721e93fa7577b363a5</guid>
      <description><![CDATA[The MacBook Air went first; a tiny Fujitsu laptop running Vista was hacked on the last day of the contest; but it was Linux, running on a Sony Vaio, that remained undefeated as conference organizers...]]></description>
      <content:encoded><![CDATA[The MacBook Air went first; a tiny Fujitsu laptop running Vista was hacked on the last day of the contest; but it was Linux, running on a Sony Vaio, that remained undefeated as conference organizers ended a three-way computer hacking challenge Friday at the CanSecWest conference.]]></content:encoded>
      <pubDate>Fri, 28 Mar 2008 21:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/tiny fujitsu laptop">tiny fujitsu laptop</category>
      <category domain="http://securityratty.com/tag/conference">conference</category>
      <category domain="http://securityratty.com/tag/conference organizers">conference organizers</category>
      <category domain="http://securityratty.com/tag/sony vaio">sony vaio</category>
      <category domain="http://securityratty.com/tag/three-way computer">three-way computer</category>
      <category domain="http://securityratty.com/tag/linux">linux</category>
      <category domain="http://securityratty.com/tag/vista">vista</category>
      <category domain="http://securityratty.com/tag/challenge friday">challenge friday</category>
      <category domain="http://securityratty.com/tag/macbook air">macbook air</category>
      <source url="http://www.networkworld.com/news/2008/032908-with-vista-breached-linux-unbeaten.html?fsrc=rss-security">With Vista breached, Linux unbeaten in hacking contest</source>
    </item>
  </channel>
</rss>
