<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: times]]></title>
    <link>http://securityratty.com/tag/times</link>
    <description></description>
    <pubDate>Thu, 25 Sep 2008 08:13:08 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Debunking the Latest Fear Mongering News on WPA security]]></title>
      <link>http://securityratty.com/article/db5c2f6d20bfbc204064e7ebc539557c</link>
      <guid>http://securityratty.com/article/db5c2f6d20bfbc204064e7ebc539557c</guid>
      <description><![CDATA[I had been meaning to write about recent exaggerated claims that WPA security had been hacked, but George Ou beat me to it . The buzz comes from Elcomsoft's Distributed Password Recovery . The...]]></description>
      <content:encoded><![CDATA[I had been meaning to write about recent exaggerated claims that WPA security had been hacked, but <a href="http://www.formortals.com/Home/tabid/36/EntryID/119/Default.aspx">George Ou beat me to it</a>.

The buzz comes from <a href="http://www.elcomsoft.com/edpr.html">Elcomsoft's Distributed Password Recovery</a>. The innovation is that they use NVIDIA GPU acceleration for password cracking and can distribute the crack across a network to multiple clients and their NVIDIA GPUs. The GPU acceleration, they claim, "reduces password recovery time by a factor of 20."

They also take the unfortunate approach, <a href="http://www.elcomsoft.com/PR/edpr_081009_en.pdf">in a press release</a>, of massive gains in cracking WPA and WPA2 protection, and that they can "...break Wi-Fi encryption up to 100 times faster than by using CPU only."

100 times! 2 orders of magnitude! That must be a lot, right? Well, probably not. This is where George Ou calls shenanigans.

First, he points out that this only affects password protection systems that rely on password complexity, and that, as a general rule, the time involved is proportional to the complexity of the password. So if your password would normally take a million years to crack, it would take 10,000 years with this system. Draw your own conclusions.

He also points out, just to get past the WPA buzzwordism, that this is a more general attack mechanism and could, for example, be used against certain VPN systems.

With respect to WPA/WPA2 specifically, the attack is generally useful only against home users, because they are generally the ones using PSK (Private Shared Key) authentication. "It has zero affect enterprise mode WPA deployments which use TLS protected authentication such as PEAP or EAP-TLS. Internal LAN authentication schemes such as NTLM and LDAP are also significantly weakened.  SSL authentication schemes are not vulnerable to this particular attack."

If you are relying on password complexity for protection then his advice, and mine, is old news: first, if you're a business, perhaps you should be using a TLS-based authentication system. Also, you should make sure that your passwords are sufficiently complex and changed often enough. Ou has some specific advice about this in his column, but as he says, there are usually easier ways to get passwords (like offering people chocolate for them) than to spend years cracking them with thousands of dollars of computing power.
<p><a href="http://feedads.googleadservices.com/~a/OvpRctfZEnjDyyEg3MByesn2KpY/a"><img src="http://feedads.googleadservices.com/~a/OvpRctfZEnjDyyEg3MByesn2KpY/i" border="0" ismap="true"></img></a></p><img src="http://feedproxy.google.com/~r/RSS/cheap_hack/~4/zhaPa_33ZEQ" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 13 Oct 2008 05:07:51 +0000</pubDate>
      <category domain="http://securityratty.com/tag/wpa">wpa</category>
      <category domain="http://securityratty.com/tag/password">password</category>
      <category domain="http://securityratty.com/tag/password recovery">password recovery</category>
      <category domain="http://securityratty.com/tag/password complexity">password complexity</category>
      <category domain="http://securityratty.com/tag/authentication">authentication</category>
      <category domain="http://securityratty.com/tag/authentication system">authentication system</category>
      <category domain="http://securityratty.com/tag/complexity">complexity</category>
      <category domain="http://securityratty.com/tag/wpa security">wpa security</category>
      <category domain="http://securityratty.com/tag/nvidia gpu acceleration">nvidia gpu acceleration</category>
      <source url="http://feeds.ziffdavisenterprise.com/~r/RSS/cheap_hack/~3/zhaPa_33ZEQ/debunking_the_latest_fear_mongering_news_on_wpa_security.html">Debunking the Latest Fear Mongering News on WPA security</source>
    </item>
    <item>
      <title><![CDATA[The Importance of Advance Planning in Executive Protection]]></title>
      <link>http://securityratty.com/article/e1d474ffbd2af02b7c262a8172d013f8</link>
      <guid>http://securityratty.com/article/e1d474ffbd2af02b7c262a8172d013f8</guid>
      <description><![CDATA[I was delighted to see the Herald Standard quoting an executive/close protection agent regarding the importance of Advance work

Sy Alli is an E.P./C.P. team leader for &quot;Limited Brands Inc.,&quot; and was...]]></description>
      <content:encoded><![CDATA[I was delighted to see the <a href="http://www.heraldstandard.com/site/news.cfm?newsid=20151834&BRD=2280&PAG=461&dept_id=480247&rfi=6">Herald Standard </a>quoting an executive/close protection agent regarding the importance of Advance work.<br /><span id="fullpost"><br />Sy Alli is an E.P./C.P. team leader for "Limited Brands Inc.," and was speaking at the California University of Pennsylvania's 2nd annual conference on Corporate and Homeland Security.<br /><br />Mr. Alli was describing a previous trip to Indonesia where he was in charge of the advance to make sure everything was in place before the Principal arrived out with the other protective agents.  Very accurately, he described the need to cover every minute detail from the routes of travel to the alternative routes and to include such important features as local hospitals should medical treatment be needed.<br /><br />Another important point highlighted was the need for agents to have access to contacts in different countries who could assist with logistics, general and specialized support on the ground, current political situations, etc.  <br /><br />Far too often I am approached by security persons (and not even all are qualified/trained in executive or close protection)who find out that we may have overseas work and want to be included.  On some occassions, those requesting to be included on the detail did not even have a current passport!<br /><br />If you are serious about making a career out of this line of work, you owe it to yourself to do your homework.  Over the years I have developed hundreds of contacts all over the world who will respond immediately and who can be trusted to support us in any number of situations and scenarios.  <br /><br />This took a lot of preparing and involved constant contact.  It is not something that you throw together a day before your client is scheduled to arrive in a country.  If you have people in different parts of the country, or world if you wish to work globally, who can assist when you are in need, you will be able to facilitate your client in a way that will not only gain his/her admiration, but will undoubtedly cement your position in that client's security detail.<br /><br />In these unsure times, there is a lot to be said for knowing your job is safe for the foreseeable future.<div class="blogger-post-footer">Visit Sexton Executive Security at www.sextonsecurity.com</div>]]></content:encoded>
      <pubDate>Sun, 12 Oct 2008 16:10:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/detail">detail</category>
      <category domain="http://securityratty.com/tag/security detail">security detail</category>
      <category domain="http://securityratty.com/tag/current political situations">current political situations</category>
      <category domain="http://securityratty.com/tag/advance">advance</category>
      <category domain="http://securityratty.com/tag/situations">situations</category>
      <category domain="http://securityratty.com/tag/2nd annual conference">2nd annual conference</category>
      <category domain="http://securityratty.com/tag/gain hisher admiration">gain hisher admiration</category>
      <category domain="http://securityratty.com/tag/agents">agents</category>
      <category domain="http://securityratty.com/tag/routes">routes</category>
      <source url="http://www.thebulletproofblog.com/2008/10/importance-of-advance-planning-in.html">The Importance of Advance Planning in Executive Protection</source>
    </item>
    <item>
      <title><![CDATA[New Tool For Graphics Cards Threaten Wireless Networks Encryption]]></title>
      <link>http://securityratty.com/article/688234d0938b4b5ba6845db8abbe776e</link>
      <guid>http://securityratty.com/article/688234d0938b4b5ba6845db8abbe776e</guid>
      <description><![CDATA[Russian firm ElcomSoft has applied GPU acceleration technology to a new password recovery tool that allows PCs or servers running supported NVIDIA video cards to break Wi-Fi encryption up to 100 times...]]></description>
      <content:encoded><![CDATA[Russian firm ElcomSoft has applied GPU acceleration technology to a new password recovery tool that allows PCs or servers running supported NVIDIA video cards to break Wi-Fi encryption up to 100 times faster than is possible by using conventional microprocessors. Recovery times for Wi-Fi keys are increased by a factor between 10 to 15 in [...]]]></content:encoded>
      <pubDate>Fri, 10 Oct 2008 19:19:36 +0000</pubDate>
      <category domain="http://securityratty.com/tag/nvidia video cards">nvidia video cards</category>
      <category domain="http://securityratty.com/tag/password recovery tool">password recovery tool</category>
      <category domain="http://securityratty.com/tag/gpu acceleration technology">gpu acceleration technology</category>
      <category domain="http://securityratty.com/tag/russian firm elcomsoft">russian firm elcomsoft</category>
      <category domain="http://securityratty.com/tag/conventional microprocessors">conventional microprocessors</category>
      <category domain="http://securityratty.com/tag/times faster">times faster</category>
      <category domain="http://securityratty.com/tag/recovery times">recovery times</category>
      <category domain="http://securityratty.com/tag/wi-fi keys">wi-fi keys</category>
      <category domain="http://securityratty.com/tag/wi-fi encryption">wi-fi encryption</category>
      <source url="http://cyberinsecure.com/new-tool-for-graphics-cards-threaten-wireless-networks-encryption/">New Tool For Graphics Cards Threaten Wireless Networks Encryption</source>
    </item>
    <item>
      <title><![CDATA[Expanding Response: Deeper Analysis for Incident Handlers]]></title>
      <link>http://securityratty.com/article/3bd8455fedce6ac873ea3b9f63cd7b90</link>
      <guid>http://securityratty.com/article/3bd8455fedce6ac873ea3b9f63cd7b90</guid>
      <description><![CDATA[To achieve my GCIH Gold, I recently completed a paper called Expanding Response: Deeper Analysis for Incident Handlers , now available in the SANS Reading Room . The premise was to further expand on...]]></description>
      <content:encoded><![CDATA[To achieve my GCIH Gold, I recently completed a paper called <a href="http://www.sans.org/reading_room/whitepapers/incident/32904.php">Expanding Response: Deeper Analysis for Incident Handlers</a>, now available in the <a href="http://www.sans.org/reading_room/">SANS Reading Room</a>. The premise was to further expand on the topics discussed in my <a href="http://holisticinfosec.blogspot.com/2007/12/malware-analysis-tools.html">Malware analysis tools</a> post. This paper includes tools discussed at various times in my <a href="http://holisticinfosec.org/content/view/12/26/">toolsmith</a> column in the <a href="http://issa.org/Members/Journal.html">ISSA Journal</a>, and includes details on <a href="http://qosient.com/argus/">Argus</a>, <a href="http://www.rawpacket.org/projects/hex/hex-livecd/version-20-release">HeX</a>, <a href="http://writequit.org/projects/nsm-console/">NSM-Console</a>, and <a href="http://sourceforge.net/projects/networkminer/">NetworkMiner</a>.<br /><br />Abstract:<br />    <span style="font-style:italic;">"The perspective embraced for this discussion is that of an analyst who is working a process to determine the exact nature of malicious software on his network. He is in receipt of the above mentioned .exe and .pcap files and seeks to further his understanding with the use of less typical tools. She begins the process with the network capture, and then takes a closer look at the binary to see what can be learned and what the impacts of an outbreak on her network might be."</span><br /><br /><a href="http://del.icio.us/post?url=http://holisticinfosec.blogspot.com/2008/10/expanding-response-deeper-analysis-for.html&title=Expanding%20Response:%20Deeper%20Analysis%20for%20Incident%20Handlers " title="Expanding Response: Deeper Analysis for Incident Handlers ">del.icio.us</a> | <a href="http://digg.com/submit?phase=2&amp;url=http://holisticinfosec.blogspot.com/2008/10/expanding-response-deeper-analysis-for.html" title="Expanding Response: Deeper Analysis for Incident Handlers ">digg</a> | <a href="http://slashdot.org/submit.pl?url=http://holisticinfosec.blogspot.com/2008/10/expanding-response-deeper-analysis-for.html">Submit to Slashdot</a>]]></content:encoded>
      <pubDate>Fri, 10 Oct 2008 04:38:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/network">network</category>
      <category domain="http://securityratty.com/tag/paper includes tools">paper includes tools</category>
      <category domain="http://securityratty.com/tag/incident handlers">incident handlers</category>
      <category domain="http://securityratty.com/tag/network capture">network capture</category>
      <category domain="http://securityratty.com/tag/deeper analysis">deeper analysis</category>
      <category domain="http://securityratty.com/tag/paper">paper</category>
      <category domain="http://securityratty.com/tag/gcih gold">gcih gold</category>
      <category domain="http://securityratty.com/tag/includes details">includes details</category>
      <category domain="http://securityratty.com/tag/pcap files">pcap files</category>
      <source url="http://holisticinfosec.blogspot.com/2008/10/expanding-response-deeper-analysis-for.html">Expanding Response: Deeper Analysis for Incident Handlers</source>
    </item>
    <item>
      <title><![CDATA[Innovators, Imitators and Idiots]]></title>
      <link>http://securityratty.com/article/9f0fb5a40e7304e54d82bd150f69993b</link>
      <guid>http://securityratty.com/article/9f0fb5a40e7304e54d82bd150f69993b</guid>
      <description><![CDATA[Charlie Rose interviews Warren Buffett


Charlie Rose
And so when you look at where we are going, there seems to be two issues that are apparent to me at least, risk and leverage. We just lost sight...]]></description>
      <content:encoded><![CDATA[<p><span style="font-family: Verdana; font-size: 12px; line-height: normal; "><strong><div><span style="font-weight: normal;">Charlie Rose <a href="http://www.cnbc.com/id/26982338/page/2/">interviews</a> Warren Buffett:</span></div><div><span style="font-weight: normal;"><br /></span></div></strong></span></p><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: Verdana; font-size: 12px; line-height: normal; "><strong>Charlie Rose:</strong>&#0160;&#0160;</span><br /><span style="font-family: Verdana; font-size: 12px; line-height: normal; ">And so when you look at where we are going, there seems to be two issues that are apparent to me at least, risk and leverage.&#0160; We just lost sight of risk and leverage of what was appropriate?</span></p><p><span style="font-family: Verdana; font-size: 12px; line-height: normal; "><strong>Warren Buffett:</strong>&#0160;&#0160;</span><br /><span style="font-family: Verdana; font-size: 12px; line-height: normal; ">Yeah.&#0160; Again, because it pays off for a while.&#0160; You know, you can lose leverage, and it&#39;s the only way a smart guy can go broke.&#0160; If you owe money, you can&#39;t pay them out.&#0160; You just pay for everything, you do smart things, you eventually get very rich.&#0160; If you do smart things and use leverage and do one wrong thing along the way, it could wipe you out, because anything times zero is zero.&#0160; But it&#39;s reinforcing when the people around you are doing it successfully, you&#39;re doing it successfully, and it&#39;s a lot like Cinderella at the ball.&#0160; I mean you know at midnight everything is going to turn to pumpkins and mice; right?&#0160; But if the evening goes along, I mean, you know, the guys look better all the time, the music sounds better, it&#39;s more and more fun, you think why the hell should I leave at quarter of 12.&#0160; I&#39;ll leave at two minutes to 12.&#0160; But the trouble is, there are no clocks on the wall.&#0160; And everybody thinks they&#39;re going to leave at two minutes to 12.</span></p></blockquote><p><span style="font-family: Verdana; font-size: 12px; line-height: normal; "><strong><div><span style="font-weight: normal;"><br /></span></div><div><span style="font-weight: normal;">Its effectively the job of leadership to know when to take the punch bowl away and to have the credibility to do this. This is also the risk-reward balance that infosec must try to strike, part of the answer is differentiating <a href="http://1raindrop.typepad.com/1_raindrop/2007/11/dhandho-infosec.html">risk and uncertainty</a>. As our current financial situation shows, its a hard thing to pull off</span></div><div><span style="font-weight: normal;"><br /></span></div></strong></span></p><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: Verdana; font-size: 12px; line-height: normal; "><strong>Charlie Rose:</strong>&#0160;&#0160;</span><br /><span style="font-family: Verdana; font-size: 12px; line-height: normal; ">And should wise people have known better?</span></p><p><span style="font-family: Verdana; font-size: 12px; line-height: normal; "><strong>Warren Buffett:</strong>&#0160;&#0160;</span><br /><span style="font-family: Verdana; font-size: 12px; line-height: normal; ">People should always know better.</span></p><p><span style="font-family: Verdana; font-size: 12px; line-height: normal; "><strong>Charlie Rose:</strong>&#0160;&#0160;</span><br /><span style="font-family: Verdana; font-size: 12px; line-height: normal; ">Yeah.</span></p><p><span style="font-family: Verdana; font-size: 12px; line-height: normal; "><strong>Warren Buffett:</strong>&#0160;&#0160;</span><br /><span style="font-family: Verdana; font-size: 12px; line-height: normal; ">I mean people -- people don&#39;t get -- they don&#39;t get smarter about things that get as basic as greed and you can&#39;t stand to see your neighbor getting rich.&#0160; You know you&#39;re smarter than he is, and he&#39;s doing these things, you know, and he&#39;s getting rich, and your spouse is getting unhappy with you because you aren&#39;t doing -- pretty soon you start doing it.&#0160; And so you get what I call the natural progression, the three Is.&#0160; The innovators, the imitators, and the idiots.&#0160; And that&#39;s what happens.&#0160; Everybody just kind of goes along.&#0160; And you look kind of silly if you disagree.&#0160; I mean, you know, you could have these crazy Internet valuations in the late 1990s, but they prove themselves out in the market.&#0160; The next day they were selling for more than they were the day before, and people said, you know, you&#39;re crazy if you don&#39;t get in on this.&#0160; So it&#39;s very human.&#0160; Now, with housing it&#39;s something even more dramatic than that, because most people aspire to own their own home.&#0160; And if you really think that houses prices are going to go up next year and the year after, you feel if I don&#39;t buy it this year, I&#39;m going to have to buy it next year.&#0160; That&#39;s not true of an Internet stock.&#0160; But it&#39;s true of a home.&#0160; And when somebody makes it very easy for you to do it by saying you don&#39;t really have to put up my money, you can lie about your income a little, or we&#39;ll give you 100 percent mortgage, you&#39;re going to do it, because everybody that&#39;s done it has been proven right.&#0160; You have what they call social tools, and, you know, you&#39;re going to feel like an idiot if you didn&#39;t do it, because the house cost more.</span></p></blockquote><p><span style="font-family: Verdana; font-size: 12px; line-height: normal; "><strong><div><span style="font-weight: normal;"><br /></span></div><div><span style="font-weight: normal;">And this is why its hard to pull off. There is a lot of human emotion and envy (*). I think the point Buffett raises about innovators, imitators and idiots is a useful one for infosec. We see all kinds of new projects and technologies that have risks and rewards associated with them, its helpful to categorize these under innovation (high risk but possible game changer), imitators (so called best practices), and idiots (sheep mode - blind risk acceptance). We can get some traction here to use these concepts to understand what to do when assessing say the architectural and oeprational risk of a system.</span></div><div><span style="font-weight: normal;"><br /></span></div><div><span style="font-weight: normal;">Finally, we should always spend some time to consider infosec decisions in a broader long term economic context and this is also true of our current financial crisis</span></div><div><span style="font-weight: normal;"><br /></span></div></strong></span></p><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: Verdana; font-size: 12px; line-height: normal; "><strong>Warren Buffett:</strong>&#0160;&#0160;</span><br /><span style="font-family: Verdana; font-size: 12px; line-height: normal; ">Oh, I think confidence will come back.&#0160; I will tell you this.&#0160; This country is going -- be living better ten years from now than it is now.&#0160; It will be living better in 20 years from now than ten years from now.&#0160; The ingredients that made this country, you know, the miracle of the world -- I mean we had a seven for one improvement in the average American standard of living in the 20th century.&#0160; Now, we had the great depression, we had two world wars, we had the flu epidemic.&#0160; You know, we had oil shock.&#0160; You know, we had all these terrible things happen.&#0160; But something about the American system unleashed more and of a potential to human beings over that hundred years so that we had a seven for one improvement in -- there&#39;s never been any -- I mean, you have centuries where if you&#39;ve got a 1 percent improvement, then it&#39;s something.&#0160; So we&#39;ve got a great system.&#0160; And we&#39;ve got more productive capacity now than we ever have.&#0160; The American worker is more productive than he&#39;s ever been.&#0160; We&#39;ve got more people to do it.&#0160; We&#39;ve got all the ingredients for a sensational future.&#0160; It&#39;s just that right now the athlete&#39;s on the floor.&#0160; But we -- this is a super athlete.</span></p></blockquote><div><span style="font-family: Verdana; font-size: 12px; line-height: normal;"><br /></span></div><div><span style="font-family: Verdana; font-size: 12px; line-height: normal;">Again, we want to look at risk events in a broader, long term context. In Buffett&#39;s words its - &quot;be fearful when others are greedy and greedy when others are fearful.&quot; As the world panics and Jim Cramer is melting down on TV, Buffett is quietly writing checks with both hands, buying $3B of GE, $5B of Goldman, $6.5 of Wrigley/Mars and so on. Uncertainty is one thing, it could be 6 months it could be 5 years until this thing turns around, but risk is another - you hedge your risk with price and long term advantages, i.e. moats. People will still eat candy in a bad economy.</span></div><div><span style="font-family: Verdana; font-size: 12px; line-height: normal;"><br /></span></div><div><span style="font-family: Verdana; font-size: 12px; line-height: normal;">* Buffett&#39;s partner Charlie Munger calls envy the stupidest of the seven deadly sins, because only you feel bad, there is an upside to all the others. He said you can pay someone on Wall St $2 million a year and they will be perfectly happy until they find out someone across the hall is making $2.1 million and then they will be miserable. Which is an insane way tolive.</span></div>]]></content:encoded>
      <pubDate>Tue, 07 Oct 2008 04:32:33 +0000</pubDate>
      <category domain="http://securityratty.com/tag/risk">risk</category>
      <category domain="http://securityratty.com/tag/oeprational risk">oeprational risk</category>
      <category domain="http://securityratty.com/tag/risk events">risk events</category>
      <category domain="http://securityratty.com/tag/risk-reward balance">risk-reward balance</category>
      <category domain="http://securityratty.com/tag/wise people">wise people</category>
      <category domain="http://securityratty.com/tag/people">people</category>
      <category domain="http://securityratty.com/tag/buffett raises">buffett raises</category>
      <category domain="http://securityratty.com/tag/buffett">buffett</category>
      <category domain="http://securityratty.com/tag/blind risk acceptance">blind risk acceptance</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/10/innovators-imitators-and-idiots.html">Innovators, Imitators and Idiots</source>
    </item>
    <item>
      <title><![CDATA[Acceptable risk in changing economic times]]></title>
      <link>http://securityratty.com/article/ee8f63aa101c338d080c6e08ab4cc3a0</link>
      <guid>http://securityratty.com/article/ee8f63aa101c338d080c6e08ab4cc3a0</guid>
      <description><![CDATA[You know the game &quot;chicken&quot;? That describes what it feels like as companies push for more growth and innovation in a time of increasing economic uncertainty. Today's business landscape is like a...]]></description>
      <content:encoded><![CDATA[You know the game "chicken"? That describes what it feels like as companies push for more growth and innovation in a time of increasing economic uncertainty. Today's business landscape is like a volcanic field, with eruptions taking place left and right. Rising fuel and commodities costs have changed the equation for many businesses. The effects ripple from suppliers through layers of the value chain to businesses that might not initially have thought they were at risk.<p><A href="http://ad.doubleclick.net/jump/idg.us.nwf.rss/security;sz=468x60;ord=95113?">
<IMG src="http://ad.doubleclick.net/ad/idg.us.nwf.rss/security;sz=468x60;ord=95113?" border="0" width="468" height="60"></A>
</p>]]></content:encoded>
      <pubDate>Sun, 05 Oct 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/commodities costs">commodities costs</category>
      <category domain="http://securityratty.com/tag/companies push">companies push</category>
      <category domain="http://securityratty.com/tag/economic uncertainty">economic uncertainty</category>
      <category domain="http://securityratty.com/tag/effects ripple">effects ripple</category>
      <category domain="http://securityratty.com/tag/businesses">businesses</category>
      <category domain="http://securityratty.com/tag/volcanic field">volcanic field</category>
      <category domain="http://securityratty.com/tag/business landscape">business landscape</category>
      <category domain="http://securityratty.com/tag/risk">risk</category>
      <category domain="http://securityratty.com/tag/fuel">fuel</category>
      <source url="http://www.networkworld.com/news/2008/100608-acceptable-risk-in-changing-economic.html?fsrc=rss-security">Acceptable risk in changing economic times</source>
    </item>
    <item>
      <title><![CDATA[Article in the Irish Times ]]></title>
      <link>http://securityratty.com/article/4e9cafb5fe2c61d7c5c0da36d56833ef</link>
      <guid>http://securityratty.com/article/4e9cafb5fe2c61d7c5c0da36d56833ef</guid>
      <description><![CDATA[On Wednesday I was interviewed by the Irish...]]></description>
      <content:encoded><![CDATA[<p>On Wednesday I was <a href="http://www.irishtimes.com/newspaper/finance/2008/1003/1222959300589.html">interviewed</a> by the <i>Irish Times</i>.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=wT3JM"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=wT3JM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=6ZwLM"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=6ZwLM" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Fri, 03 Oct 2008 09:43:49 +0000</pubDate>
      <category domain="http://securityratty.com/tag/irish times">irish times</category>
      <category domain="http://securityratty.com/tag/wednesday">wednesday</category>
      <source url="http://www.schneier.com/blog/archives/2008/10/article_in_the.html">Article in the Irish Times </source>
    </item>
    <item>
      <title><![CDATA[Modelling The Global Financial Meltdown]]></title>
      <link>http://securityratty.com/article/15c8ebf58fa47d569eb7cdbc4039c683</link>
      <guid>http://securityratty.com/article/15c8ebf58fa47d569eb7cdbc4039c683</guid>
      <description><![CDATA[Yesterday I received a call from Penny Grosman , Senior Editor, Wall Street &amp; Technology . Penny was interested in my opinion, Will risk management applications be the next killer app for CEP on Wall...]]></description>
      <content:encoded><![CDATA[<p>Yesterday I received a call from <a href="http://www.wallstreetandtech.com/penny-crosman/" target="_blank">Penny Grosman</a>, Senior Editor, <a href="http://www.wallstreetandtech.com/" target="_blank">Wall Street &amp; Technology</a>.   Penny was interested in my opinion, &#8220;Will risk management applications be the next killer app for CEP&#8221; on Wall Street.    I enjoyed talking with Penny.  She caught up with me leaving a tailor&#8217;s shop in Chiang Mai, so I hope she did not mind hearing my stories of buying unique Northern Thai cotton fabric and designing my own casual shirts in the economic turndown.</p>
<p>We read many stories on the net where folks claim that the current financial crisis could have been avoided with more or better use of technology.     This is expected, as software companies and IT professionals will often try to piggy-backtheir business development strategy on the &#8220;crisis of the day&#8221; to sell more goods and services.    Honestly, in this current situation, the main technology that we needed was simple, accurate financial models.</p>
<p>For example, in the chart above, the US economy was doing quite well with US federal funds rates low.   Housing prices in the US were skyrocketing and there was a concern about inflation.    There was an understandable concern the sustainability of that economy.</p>
<p style="text-align: center;"><img class="aligncenter" style="vertical-align: bottom;" src="http://www.thewrittenblog.com/main_1/images/97kcpv16xjh0uvsi8k7kdhaw.gif" alt="" width="277" height="415" /></p>
<p>So, in perhaps one the most ill-advised Federal Reserve actions of many decades, the folks at the helm of the Fed decided to raise their lending rates around 500 percent over a two year period.</p>
<p>As we all know, primarily because of the action by the Fed, the world faces perhaps the worst economic disaster in modern times, while the US Executive Branch and the Congress fight over how to spend $700 Billion taxpayer dollars to inject liquidity into the markets to try to head off a global financial disaster.</p>
<p>It is amazing to me that the US Federal Government, or their advisors, does not have simple financial models with cause-and-effect analysis such as:</p>
<ul>
<li>Homeowners with adjustable rate mortuages will not be able to make payments;and</li>
<li>Housing prices will fall dramatically; then</li>
<li>Homeowners will default on loans where the collateral is much less than the asset value, and</li>
<li>Banks will suffer great losses, and</li>
<li>Lending will come to a halt, then</li>
<li>Banks will collapse, then</li>
<li>Wall Street will exit the markets in panic</li>
<li>&#8230; and more trouble&#8230;.. !!</li>
</ul>
<p>There are and continue to be a lot of discussion and opinions about how risk management needs improvement. and I agree.   We will also read folks talk about how technology can be used to help solve this problem, including CEP/EP and related software (see also <!-- This wrapper class appears only on Page and Single Post pages. --><a title="Capital Market CEP Fantasy Land" rel="bookmark" href="../2008/06/23/capital-market-cep-fantasy-land/">Capital Market CEP Fantasy Land</a>). However, as much I would be pleased to see more CEP/EP applications and use cases, I do not believe that event processing technology is really very useful to solve the core problem of the current financial crisis.</p>
<p>The core problem is, seemingly, that our &#8220;financial experts&#8221; do not even have simple models that will illustrate what will or could happen when you raise the fed lending rates 500 percent in two years in an economy pregnant with adjustable rate mortgages.</p>
<p>To me, this does not appear to be rocket science.  The negligence by the US Federal Reserve and their advisors is astonishing.</p>
]]></content:encoded>
      <pubDate>Thu, 02 Oct 2008 02:33:20 +0000</pubDate>
      <category domain="http://securityratty.com/tag/simple financial models">simple financial models</category>
      <category domain="http://securityratty.com/tag/financial models">financial models</category>
      <category domain="http://securityratty.com/tag/current financial crisis">current financial crisis</category>
      <category domain="http://securityratty.com/tag/crisis">crisis</category>
      <category domain="http://securityratty.com/tag/simple">simple</category>
      <category domain="http://securityratty.com/tag/technology">technology</category>
      <category domain="http://securityratty.com/tag/wall street">wall street</category>
      <category domain="http://securityratty.com/tag/main technology">main technology</category>
      <category domain="http://securityratty.com/tag/folks">folks</category>
      <source url="http://www.thecepblog.com/2008/10/02/modelling-the-global-financial-meltdown/">Modelling The Global Financial Meltdown</source>
    </item>
    <item>
      <title><![CDATA[John McCain: Desperate and Reckless]]></title>
      <link>http://securityratty.com/article/a299c2b37dd8172588b5324124b6f3cd</link>
      <guid>http://securityratty.com/article/a299c2b37dd8172588b5324124b6f3cd</guid>
      <description><![CDATA[Normally I would not blog about political topics here, but this is an extraordinary time in history and extraordinary times call for extraordinary posts from time-to-time
John McCain is, objectively,...]]></description>
      <content:encoded><![CDATA[<p>Normally I would not blog about political topics here, but this is an extraordinary time in history and extraordinary times call for extraordinary posts from time-to-time.</p>
<p>John McCain is, objectively, a bad decision maker, desperate and reckless.   He knows that his party is in trouble and that the Democrats have the advantage; so what does he do?</p>
<p>First, he picks a very conservative, inexperienced female governor from Alaska who, until recently, did not even have a US passport, as his running mate.  This was an obvious act of desperation, thinking that he could pull the Hillary votes in the election.  A heartbeat from the US Presidency at a time when there are two ongoing wars and our country on the verge of economic collapse and he gambles with a &#8220;Hail Mary&#8221; touchdown pass?  This is not the man we need as President.</p>
<p>Then, not even a member of the Banking committee in the Senate, and self-described &#8220;not knowledgeable on economic issues&#8221;, John McCain tries another &#8220;Hail Mary&#8221; pass by rushing off to DC to &#8220;save the world&#8221; and tries to demand Obama suspend his campaign and the debates?    The US is on the brink of economic collapse and McCain puts politics and election desperation above the future of the country?   This is not the man we need as President.</p>
<p>During the same period, Barack Obama has proven to be cool, intelligent, and a good decision maker.   This should be obvious to anyone with the mind to actually think what is good for the country and not about politics.</p>
<p>John McCain is desperate and reckless.   We don&#8217;t need desperate and reckless people leading this country.</p>
]]></content:encoded>
      <pubDate>Fri, 26 Sep 2008 14:54:27 +0000</pubDate>
      <category domain="http://securityratty.com/tag/mccain">mccain</category>
      <category domain="http://securityratty.com/tag/john mccain">john mccain</category>
      <category domain="http://securityratty.com/tag/reckless">reckless</category>
      <category domain="http://securityratty.com/tag/bad decision maker">bad decision maker</category>
      <category domain="http://securityratty.com/tag/decision maker">decision maker</category>
      <category domain="http://securityratty.com/tag/economic collapse">economic collapse</category>
      <category domain="http://securityratty.com/tag/extraordinary time">extraordinary time</category>
      <category domain="http://securityratty.com/tag/time">time</category>
      <category domain="http://securityratty.com/tag/election desperation">election desperation</category>
      <source url="http://www.thecepblog.com/2008/09/26/john-mccain-desperate-and-reckless/">John McCain: Desperate and Reckless</source>
    </item>
    <item>
      <title><![CDATA[250k of Harvested Hotmail Emails Go For?]]></title>
      <link>http://securityratty.com/article/efaf965e7dacf43f06479ec7778d04e6</link>
      <guid>http://securityratty.com/article/efaf965e7dacf43f06479ec7778d04e6</guid>
      <description><![CDATA[50 in this particular case, however, keeping in mind that the email harvester is anything but ethical, this very same database will be sold and re-sold more times than the original buyer would like to...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://4.bp.blogspot.com/_wICHhTiQmrA/SNuLDFWiz9I/AAAAAAAACLo/fQ_TqPImTk0/s1600-h/harvested_hotmail_sale.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="113" src="http://4.bp.blogspot.com/_wICHhTiQmrA/SNuLDFWiz9I/AAAAAAAACLo/YJqc75ZUQgE/s200-R/harvested_hotmail_sale.png" width="200" /></a>$50 in this particular case, however, keeping in mind that the email harvester is anything but ethical, this very same database will be sold and re-sold more times than the original buyer would like to know about. Moreover, what someone is offering for sale, may in fact be already available as a value-added addition to a managed spamming service.<br />
<br />
With metrics and quality assurance applied in a growing number of spam and phishing campaigns, filling in the niche of email harvesting by distinguishing between different types of obfuscated emails by releasing an easily embeddable module, was an anticipated move. What's to come? <a href="http://ddanchev.blogspot.com/2008/05/harvesting-youtube-usernames-for.html">Spam and malware campaigns across social networks</a> "as usual" will propagate faster thanks to the ongoing harvesting of usernames within social networks, that would later on get imported in Web 2.0 "marketing" tools targeting the high-trafficked sites and automatically spamming them.<br />
<br />
From a spammer's perspective, geolocating these 250k emails could increase their selling prices since the buyers would be able to launch localized attacks with messages in the native languages of the receipts. Is the demand for quality email databases fueling the developments of this market segment, or are the spammers self-serving themselves and cashing-in by reselling what they've already abused a log time ago? That seems to be the case, since there's no way a buyer could verify the freshness of the harvested emails database and whether or not it has already been abused. <br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://3.bp.blogspot.com/_wICHhTiQmrA/SNvGk2eGKcI/AAAAAAAACL4/yhy61idSl6I/s1600-h/segmented_harvested_emails.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="200" src="http://3.bp.blogspot.com/_wICHhTiQmrA/SNvGk2eGKcI/AAAAAAAACL4/xFYzYTCaDes/s200-R/segmented_harvested_emails.JPG" width="152" /></a>For the time being, we've got several developed and many other developing market segments within spamming and phishing as different markets with different players. On one hand are the legitimately looking spamming providers offering "direct marketing services" working with lone spammers who find a reliable business partner in the face of the spamming vendor whose customers drive both side's business models. On the other hand, you've got the <a href="http://blogs.zdnet.com/security/?p=1835">spammers excelling in outsourcing the automatic account registration process</a>, coming up with ways to build a spamming infrastructure -- already available as a module to integrate in <a href="http://blogs.zdnet.com/security/?p=1899">managed spamming services</a> -- using legitimate services as a provider of the infrastructure.<br />
<br />
Despite that the arms race seems to be going on at several different fronts, spammers VS the industry and spammers VS spammers fighting for market share, the entire underground ecosystem is clearly allocating a lot of resources for research and development in order to ensure that they are always a step ahead of the industry.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2008/05/harvesting-youtube-usernames-for.html">Harvesting  Youtube Usernames for Spamming</a><b>&nbsp;</b><br />
<a href="http://ddanchev.blogspot.com/2007/10/thousands-of-im-screen-names-in-wild.html">Thousands  of IM Screen Names in the Wild</a><br />
<a href="http://ddanchev.blogspot.com/2008/08/automatic-email-harvesting-20.html">Automatic  Email Harvesting 2.0</a><br />
<a href="http://ddanchev.blogspot.com/2008/07/dissecting-managed-spamming-service.html">Dissecting a Managed Spamming Service</a><br />
<a href="http://ddanchev.blogspot.com/2007/10/managed-spamming-appliances-future-of.html">Managed Spamming Appliances - the Future of Spam</a><br />
<a href="http://ddanchev.blogspot.com/2007/01/inside-email-harvesters-configuration.html">Inside an Email Harvester's Configuration File</a><br />
<a href="http://ddanchev.blogspot.com/2008/05/segmenting-and-localizing-spam.html">Segmenting and Localizing Spam Campaigns</a><br />
<a href="http://ddanchev.blogspot.com/2007/04/shots-from-malicious-wild-west-sample.html">Shots from the Malicious Wild West - Sample Four</a><br />
<b> </b><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=De2zL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=De2zL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=CYcFL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=CYcFL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=OQPDl"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=OQPDl" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=Lhexl"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=Lhexl" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=sZRFL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=sZRFL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=ifNGL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=ifNGL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=BYibl"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=BYibl" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/402968423" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 25 Sep 2008 08:13:08 +0000</pubDate>
      <category domain="http://securityratty.com/tag/emails">emails</category>
      <category domain="http://securityratty.com/tag/email">email</category>
      <category domain="http://securityratty.com/tag/email harvester">email harvester</category>
      <category domain="http://securityratty.com/tag/spam campaigns">spam campaigns</category>
      <category domain="http://securityratty.com/tag/spam">spam</category>
      <category domain="http://securityratty.com/tag/lone spammers">lone spammers</category>
      <category domain="http://securityratty.com/tag/spammers">spammers</category>
      <category domain="http://securityratty.com/tag/250k emails">250k emails</category>
      <category domain="http://securityratty.com/tag/automatic email">automatic email</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/402968423/250k-of-harvested-hotmail-emails-go-for.html">250k of Harvested Hotmail Emails Go For?</source>
    </item>
  </channel>
</rss>
