<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: wave]]></title>
    <link>http://securityratty.com/tag/wave</link>
    <description></description>
    <pubDate>Wed, 02 Jul 2008 14:41:28 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Malware Served Through Flash Exploits By MSN Norway]]></title>
      <link>http://securityratty.com/article/c25b79517171b86fca0e1805e842d70e</link>
      <guid>http://securityratty.com/article/c25b79517171b86fca0e1805e842d70e</guid>
      <description><![CDATA[Morten Krakvik from the Norwegian Honeynet Project is reporting that MSN Norway is among the latest victims of malvertising, a practice where a bogus advertising provider tricks leading portals into...]]></description>
      <content:encoded><![CDATA[Morten Krakvik from the Norwegian Honeynet Project is reporting that MSN Norway is among the latest victims of malvertising, a practice where a bogus advertising provider tricks leading portals into accepting advertisements from its network, which often end up redirecting to live exploit URLs. The recent wave of malvertising that also targeted Digg, MSNBC and [...]]]></content:encoded>
      <pubDate>Thu, 28 Aug 2008 13:02:18 +0000</pubDate>
      <category domain="http://securityratty.com/tag/msn norway">msn norway</category>
      <category domain="http://securityratty.com/tag/norwegian honeynet project">norwegian honeynet project</category>
      <category domain="http://securityratty.com/tag/live exploit urls">live exploit urls</category>
      <category domain="http://securityratty.com/tag/recent wave">recent wave</category>
      <category domain="http://securityratty.com/tag/provider tricks">provider tricks</category>
      <category domain="http://securityratty.com/tag/network">network</category>
      <category domain="http://securityratty.com/tag/victims">victims</category>
      <category domain="http://securityratty.com/tag/msnbc">msnbc</category>
      <category domain="http://securityratty.com/tag/portals">portals</category>
      <source url="http://cyberinsecure.com/malware-served-through-flash-exploits-by-msn-norway/">Malware Served Through Flash Exploits By MSN Norway</source>
    </item>
    <item>
      <title><![CDATA[Gallery: Images From the 16th Annual DefCon]]></title>
      <link>http://securityratty.com/article/fb7d8c7afe69bef6c3f3ee2131da03a6</link>
      <guid>http://securityratty.com/article/fb7d8c7afe69bef6c3f3ee2131da03a6</guid>
      <description><![CDATA[Photo: Dave Bullock/Wired.com
LAS VEGAS -- Last weekend, more than 9,000 hackers, freaks, feds and geeks gathered for the 16th annual DefCon, the world's largest computer security convention
Wired.com...]]></description>
      <content:encoded><![CDATA[<img src='http://www.wired.com/images/slideshow/2008/08/gallery_defcon16/defcon_gallery_2_t.jpg'></img>: Photo: Dave Bullock/Wired.com<p>LAS VEGAS -- Last weekend, more than 9,000 hackers, freaks, feds and geeks gathered for the 16th annual DefCon, the world's largest computer security convention. </p>

<p>Wired.com brought you <a href="http://blog.wired.com/27bstroke6/defcon/index.html">live coverage</a> of the most newsworthy events at DefCon 16. Here are some photos from the lighter side of the conference.</p>

<p><strong>Left:</strong> South Korean hackers compete in the Capture the Flag competition. The goal is to hack into and keep control of targeted servers.</p>
<img src='http://www.wired.com/images/slideshow/2008/08/gallery_defcon16/defcon_gallery_3_t.jpg'></img>: Photo: Dave Bullock/Wired.com<p>Mr. Sinister and Dragon Cracker battle it out in a round of <cite>Guitar Hero</cite> -- one of DefCon's newest competitions.</p><img src='http://www.wired.com/images/slideshow/2008/08/gallery_defcon16/defcon_gallery_1_t.jpg'></img>: Photo: Dave Bullock/Wired.com<p>Bringing-your-own-booze supply ensures optimal buzz at DefCon. Shortly after this picture was taken, hotel security escorted this backpack-hacker to his room.</p><img src='http://www.wired.com/images/slideshow/2008/08/gallery_defcon16/defcon_gallery_4_t.jpg'></img>: Photo: Dave Bullock/Wired.com<p>Computer geeks from the National Institute of Standards and Technology set up a network secured with quantum encryption in a conference room at DefCon. The quantum-entangled photons are being used to encrypt a video stream across a line-of-site network.</p><img src='http://www.wired.com/images/slideshow/2008/08/gallery_defcon16/defcon_gallery_5_t.jpg'></img>: Photo: Dave Bullock/Wired.com<p>A compact optical bench and an atomic clock (left) are used to secure a network with quantum encryption.   </p><img src='http://www.wired.com/images/slideshow/2008/08/gallery_defcon16/defcon_gallery_6_t.jpg'></img>: Photo: Dave Bullock/Wired.com<p>In the Lock Pick Pavilion, DefCon attendees Dustin, Jennalynn and Kunfoozball practice their lock-picking skills. </p><img src='http://www.wired.com/images/slideshow/2008/08/gallery_defcon16/defcon_gallery_7_t.jpg'></img>: Photo: Dave Bullock/Wired.com<p>DefCon founder and organizer Jeff Moss, aka Dark Tangent, at the conference's closing ceremony Sunday.</p>

<img src='http://www.wired.com/images/slideshow/2008/08/gallery_defcon16/defcon_gallery_9_t.jpg'></img>: Photo: Dave Bullock/Wired.com<p>A collection of black badges awaits the winners of the various competitions. These badges give their holders lifetime entry to DefCon.</p><img src='http://www.wired.com/images/slideshow/2008/08/gallery_defcon16/defcon_gallery_11_t.jpg'></img>: Photo: Dave Bullock/Wired.com<p>One of DefCon's logos, the smiley-faced skull and crossbones, is welded inside a yellow sphere. The sphere is the primary stage of one of the most difficult competitions at DefCon: <a href="http://blog.wired.com/27bstroke6/2008/08/the-defcon-16-m.html">The Mystery Challenge</a>. </p><img src='http://www.wired.com/images/slideshow/2008/08/gallery_defcon16/defcon_gallery_15_t.jpg'></img>: Photo: Dave Bullock/Wired.com<p>Unbeknownst to attendees, this laptop is sniffing RFID tags and taking photos of their owners when they pass in front of the detectors. RFID tags are used in everything from building access to some credit cards.</p><img src='http://www.wired.com/images/slideshow/2008/08/gallery_defcon16/defcon_gallery_12_t.jpg'></img>: Photo: Dave Bullock/Wired.com<p>At the closing ceremony, DefCon organizers turn off the lights while the attendees wave their <a href="http://blog.wired.com/27bstroke6/2008/08/exclusive-defco.html">high-tech badges</a> back and forth.</p><br style="clear: both;"/>
      <a href="http://www.pheedo.com/click.phdo?s=68dd26e52adb5b467e7c3e6137cda635"><img alt="" style="border: 0;" border="0" src="http://www.pheedo.com/img.phdo?s=68dd26e52adb5b467e7c3e6137cda635"/></a>
  <img src="http://www.pheedo.com/feeds/tracker.php?i=68dd26e52adb5b467e7c3e6137cda635" style="display: none;" border="0" height="1" width="1" alt=""/><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=5LS6EK"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=5LS6EK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=K4FTfk"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=K4FTfk" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=IRLAWk"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=IRLAWk" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=NFFkrK"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=NFFkrK" border="0"></img></a>
 <a href="http://feeds.wired.com/~f/wired/politics/security?a=oS38eK"><img src="http://feeds.wired.com/~f/wired/politics/security?i=oS38eK" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=qIurlk"><img src="http://feeds.wired.com/~f/wired/politics/security?i=qIurlk" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=TG21wk"><img src="http://feeds.wired.com/~f/wired/politics/security?i=TG21wk" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=n3oFWK"><img src="http://feeds.wired.com/~f/wired/politics/security?i=n3oFWK" border="0"></img></a> </div><img src="http://feeds.feedburner.com/~r/wired/politics/privacy/~4/362249101" height="1" width="1"/><img src="http://feeds.wired.com/~r/wired/politics/security/~4/362249108" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 11 Aug 2008 14:30:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/defcon">defcon</category>
      <category domain="http://securityratty.com/tag/16th annual defcon">16th annual defcon</category>
      <category domain="http://securityratty.com/tag/defcon founder">defcon founder</category>
      <category domain="http://securityratty.com/tag/attendees wave">attendees wave</category>
      <category domain="http://securityratty.com/tag/attendees">attendees</category>
      <category domain="http://securityratty.com/tag/defcon organizers">defcon organizers</category>
      <category domain="http://securityratty.com/tag/defcon attendees dustin">defcon attendees dustin</category>
      <category domain="http://securityratty.com/tag/photo">photo</category>
      <category domain="http://securityratty.com/tag/dave">dave</category>
      <source url="http://feeds.wired.com/~r/wired/politics/security/~3/362249108/gallery_defcon16">Gallery: Images From the 16th Annual DefCon</source>
    </item>
    <item>
      <title><![CDATA[CNN Custom Alerts Spam]]></title>
      <link>http://securityratty.com/article/f544d5e769f123f7cc5f3036bac72fdd</link>
      <guid>http://securityratty.com/article/f544d5e769f123f7cc5f3036bac72fdd</guid>
      <description><![CDATA[In general, my anti-spam filters and tools are pretty effective. So when I start to see something like this







it's obvious that a huge spam wave is underway. These are, of course, related to the...]]></description>
      <content:encoded><![CDATA[
        In general, my anti-spam filters and tools are pretty effective. So when I start to see something like this....<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="cn1.jpg" src="http://blog.spywareguide.com/images/cn1.jpg" class="mt-image-none" style="" height="137" width="193" /></span></div><br /> <div><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="cn2.jpg" src="http://blog.spywareguide.com/images/cn2.jpg" class="mt-image-none" style="" height="247" width="214" /></span></div>
<br />....it's obvious that a huge spam wave is underway. These are, of course, related to the <a href="http://blog.spywareguide.com/2008/08/cnn-daily-top-10-videos-spam.html">fake CNN Spam</a> from a few days ago. Here, the emails take the form of "custom alerts":<br /><br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/cn32.html" onclick="window.open('http://blog.spywareguide.com/images/cn32.html','popup','width=613,height=352,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/cn3-thumb-313x179.jpg" alt="cn3.jpg" class="mt-image-none" style="" height="179" width="313" /></a></span><br /><br />Click to Enlarge<br /></div><br />I've seen two types of this mail - one links to a genuine CNN article from the headline text (with the smaller link underneath leading to an infection site), the other simply links to the infection site from both clickable links. As before, deleting these Emails is the best course of action. Interestingly, the format of these mails might not be working to the spammers advantage. Lots of people I've talked to who had one of these mails sent through simply deleted them without a second thought, thinking it was merely something on the real CNN they thought they'd signed up to and didn't actually want.<br /><br /></div><div><br /></div>
        
    ]]></content:encoded>
      <pubDate>Sun, 10 Aug 2008 13:28:40 +0000</pubDate>
      <category domain="http://securityratty.com/tag/links">links</category>
      <category domain="http://securityratty.com/tag/clickable links">clickable links</category>
      <category domain="http://securityratty.com/tag/simply links">simply links</category>
      <category domain="http://securityratty.com/tag/simply">simply</category>
      <category domain="http://securityratty.com/tag/custom alerts">custom alerts</category>
      <category domain="http://securityratty.com/tag/infection site">infection site</category>
      <category domain="http://securityratty.com/tag/fake cnn spam">fake cnn spam</category>
      <category domain="http://securityratty.com/tag/genuine cnn article">genuine cnn article</category>
      <category domain="http://securityratty.com/tag/huge spam wave">huge spam wave</category>
      <source url="http://blog.spywareguide.com/2008/08/cnn-custom-alerts.html">CNN Custom Alerts Spam</source>
    </item>
    <item>
      <title><![CDATA[Traditional Disaster Recovery Services Are Dead]]></title>
      <link>http://securityratty.com/article/91a8e062482df48ac9d61748458d67d9</link>
      <guid>http://securityratty.com/article/91a8e062482df48ac9d61748458d67d9</guid>
      <description><![CDATA[If you still subscribe to fixed site recovery services using shared IT infrastructure from the likes of HP, IBM BCRS, or SunGard, among others, you will quickly become a dinosaur in the next 1 to 2...]]></description>
      <content:encoded><![CDATA[<p><img border="0" title="Stephanie Balaouras" alt="Stephanie Balaouras" src="http://www.forrester.com/role_based/images/author/imported/forresterDotCom/Analyst_Photos/Silhouette/Color/Stephanie-Balaouras.gif" style="margin: 0px 5px 5px 0px; float: left;" /></p>

<p><span style="font-size: 10pt; font-family: Arial;">If you still subscribe to fixed site recovery services using shared IT infrastructure from the likes of HP, IBM BCRS, or SunGard, among others, you will quickly become a dinosaur in the next 1 to 2 years. </span></p>

<p><span style="font-size: 10pt; font-family: Arial;">These types of shared infrastructure services involve lengthy restores from tape and a recovery time objective of 72 hours, at best. Plus, you'll be lucky if you recover at all because chances are, you've had trouble scheduling a test with your service provider and it's been a LONG time since the last one, if indeed you’ve ever tested. </span></p>

<p><span style="font-size: 10pt; font-family: Arial;"><a href="http://www.forrester.com/go?docid=46270">72 hours recovery just doesn't cut it anymore</a>. And frankly, understanding your provider's oversubscription ratio to shared infrastructure to determine the risk of multiple invocations, or attempting to negotiate exclusions zones and availability guarantees is a time suck. Most companies are either taking DR back in-house or, if they still rely on a DR service provider, they are using dedicated infrastructure.</span></p>

<p><span style="font-size: 10pt; font-family: Arial;">A dedicated infrastructure is attractive as it enables replication to improve recovery objectives. But it’s expensive, and puts advanced IT recovery out of the reach of many companies who can't measure downtime in millions of dollars.</span></p>



<p><span style="font-size: 10pt; font-family: Arial;">But, there are new services on the horizon that will make advanced IT recovery affordable for the masses. This month SunGard announced the availability of its new Virtual Server Replication Service. As I discussed in my most recent <a href="http://www.forrester.com/go?docid=44878">Forrester Wave™ of DR Service Providers</a> and <a href="http://www.forrester.com/go?docid=42944">other reports</a>, server virtualization is transforming IT recovery. With replication to a virtualized server infrastructure and shared storage infrastructure, customers can enjoy improved recovery-time and recovery-point objectives without the cost of dedicated and custom IT recovery solutions from the <span class="hilite">DR</span> services provider.SunGard is the first DR service provider to productize these virtual services. I expect other DR service providers to follow suit. <br /></span></p>

<p><span style="font-size: 10pt; font-family: Arial;">So, the next time your contract is up for renewal, you need to completely rethink your approach to IT recovery. Get off tape and move to these new virtual services. It will improve your recovery capabilities and you don't have to worry about the oversubscription issue with shared virtual infrastructure -- the DR provider can manage capacity much more easily in this environment. In fact, SunGard is offering an RTO SLA of 6 hours as part of the offering. To my knowledge, this is the first time a DR service provider is offering this as part of a standard contract. I'm looking forward to the day when vendors will offer most services with transparent, subscription-based pricing, and standard contract terms that don't take a team of procurement professionals to negotiate.<span face="Times New Roman">&nbsp;</span><span style="font-size: 10pt; font-family: Arial;"><street w:st="on"></street></span></span></p>]]></content:encoded>
      <pubDate>Wed, 06 Aug 2008 13:06:37 +0000</pubDate>
      <category domain="http://securityratty.com/tag/recovery">recovery</category>
      <category domain="http://securityratty.com/tag/recovery time objective">recovery time objective</category>
      <category domain="http://securityratty.com/tag/recovery-time">recovery-time</category>
      <category domain="http://securityratty.com/tag/services">services</category>
      <category domain="http://securityratty.com/tag/recovery affordable">recovery affordable</category>
      <category domain="http://securityratty.com/tag/recovery capabilities">recovery capabilities</category>
      <category domain="http://securityratty.com/tag/recovery solutions">recovery solutions</category>
      <category domain="http://securityratty.com/tag/provider">provider</category>
      <category domain="http://securityratty.com/tag/recovery-point objectives">recovery-point objectives</category>
      <source url="http://blogs.forrester.com/srm/2008/08/traditional-dis.html">Traditional Disaster Recovery Services Are Dead</source>
    </item>
    <item>
      <title><![CDATA[Money Mule Recruiters use ASProx's Fast Fluxing Services]]></title>
      <link>http://securityratty.com/article/56322fa6d09fc3127cbaf772115cd182</link>
      <guid>http://securityratty.com/article/56322fa6d09fc3127cbaf772115cd182</guid>
      <description><![CDATA[Just consider this scheme for a second. A well known money mule recruitment site Cash Transfers is maintaining a fast-flux infrastructure on behalf of the Asprox botnet, that is also providing hosting...]]></description>
      <content:encoded><![CDATA[<a href="http://bp3.blogger.com/_wICHhTiQmrA/SIB2JwZOw4I/AAAAAAAAB7c/c7TMX064n4w/s1600-h/cash_transfers_money_mule_recruitment.png" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp3.blogger.com/_wICHhTiQmrA/SIB2JwZOw4I/AAAAAAAAB7c/CaeHtWn_06M/s200-R/cash_transfers_money_mule_recruitment.png" style="border: 0pt none ;" /></a>Just consider this scheme for a second. A well known <a href="http://www.docep.wa.gov.au/ConsumerProtection/scamnet/Scams/Cash-Transfers_Inc.html">money mule recruitment site Cash Transfers</a> is maintaining a fast-flux infrastructure on behalf of the Asprox botnet, that is also providing hosting services for several hundred domains used on the last wave of SQL injection attacks. Ironically, <a href="http://www.banksafeonline.org.uk/moneymule_explained.html">the money mule recruitment site</a> is sharing IPs with many of them. Who are these money launderers (<b>cashtransfers.tk</b>; <b>cashtransfers.eu; type53.eu</b>; <b>sid57.tk</b>; <b>catdbw.mobi</b>; <b>cdrpoex.com </b>etc.&nbsp; ) anyway?<br />
<br />
<div style="text-align: left;">"<i>Cash-Transfers Inc. is an online-to-offline international money transfer service. We offer a secure, fast, and inexpensive means of sending money from the UK to offline recipients worldwide. Recipients do not require a bank account or Internet connection to receive funds. We have teamed with select local disbursement partners to provide a convenient, secure, and cost-effective means of sending money to family, friends and business partners abroad. The basic requirements to send money/transfer money are:</i></div><i><br />
1) Senders must have Internet access and a bank account or credit/debit card to transfer money. However, recipients do not require either a bank account or Internet connection.<br />
<br />
2) Money sent through Cash-Transfers Inc. is available for pick up at the distribution partner instantly, or, in most countries, money can be delivered to the recipient in a matter of hours.<br />
<br />
3) Our local agents will call your recipient (during local business hours) to provide additional details, including: forms of identification required, hours of operation, and other locations. The sender will also receive an email confirmation with transaction details and tracking information.</i>"<br />
<br />
<div class="separator" style="text-align: left; clear: both;"><a href="http://bp0.blogger.com/_wICHhTiQmrA/SIB3agOgfJI/AAAAAAAAB7k/qtHLcMs6sVs/s1600-h/cash_transfers_asprox_SQL_injection.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp0.blogger.com/_wICHhTiQmrA/SIB3agOgfJI/AAAAAAAAB7k/y-aSv2_Sztk/s200-R/cash_transfers_asprox_SQL_injection.JPG" style="border: 0pt none ;" /></a></div>The fast-flux infrastructure they're currently using is also providing services to domains that are currently used, or have been used in previous SQL injection attacks. Some info on the current DNS servers used in the fast-flux :<br />
<br />
<b>ns10.cashtransfers.tk<br />
ns11.cashtransfers.tk<br />
ns1.cashtransfers.tk<br />
ns12.cashtransfers.tk<br />
ns2.cashtransfers.tk<br />
ns13.cashtransfers.tk<br />
ns3.cashtransfers.tk<br />
ns14.cashtransfers.tk<br />
ns4.cashtransfers.tk<br />
ns15.cashtransfers.tk<br />
ns5.cashtransfers.tk<br />
ns16.cashtransfers.tk<br />
ns6.cashtransfers.tk<br />
ns17.cashtransfers.tk<br />
ns7.cashtransfers.tk<br />
ns8.cashtransfers.tk</b><br />
<br />
With the distributed and dynamic hosting infrastructure courtesy of the malware infected user, scammers, spammers, phishers and malware authors are only starting to experiment with the potential abuses of such an underground ecosystem build on the foundations of compromises hosts.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2007/09/storm-worms-fast-flux-networks.html">Storm Worm's Fast Flux Networks</a><br />
<b> </b><a href="http://ddanchev.blogspot.com/2007/11/managed-fast-flux-provider.html">Managed Fast Flux Provider</a><br />
<a href="http://ddanchev.blogspot.com/2007/10/fast-flux-spam-and-scams-increasing.html">Fast Flux Spam and Scams Increasing</a><br />
<a href="http://ddanchev.blogspot.com/2007/10/fast-fluxing-yet-another-pharmacy-scam.html">Fast Fluxing Yet Another Pharmacy Spam</a><br />
<a href="http://ddanchev.blogspot.com/2008/07/obfuscating-fast-fluxed-sql-injected.html">Obfuscating Fast Fluxed SQL Injected Domains</a><br />
<a href="http://ddanchev.blogspot.com/2008/05/storm-worm-hosting-pharmaceutical-scams.html">Storm Worm Hosting Pharmaceutical Scams</a><br />
<a href="http://blogs.zdnet.com/security/?p=1122">Fast-Fluxing SQL injection attacks executed from the Asprox botnet</a><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=aMnYfJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=aMnYfJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=wo8AkJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=wo8AkJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=22rmej"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=22rmej" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=ec2OKj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=ec2OKj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=LfbMJJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=LfbMJJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=2LYf9J"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=2LYf9J" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=2LO3zj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=2LO3zj" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/338919917" height="1" width="1"/>]]></content:encoded>
      <pubDate>Fri, 18 Jul 2008 02:23:49 +0000</pubDate>
      <category domain="http://securityratty.com/tag/fast">fast</category>
      <category domain="http://securityratty.com/tag/fast flux networks">fast flux networks</category>
      <category domain="http://securityratty.com/tag/money">money</category>
      <category domain="http://securityratty.com/tag/fast-flux">fast-flux</category>
      <category domain="http://securityratty.com/tag/cashtransfers">cashtransfers</category>
      <category domain="http://securityratty.com/tag/fast flux provider">fast flux provider</category>
      <category domain="http://securityratty.com/tag/fast flux spam">fast flux spam</category>
      <category domain="http://securityratty.com/tag/transfer money">transfer money</category>
      <category domain="http://securityratty.com/tag/fast-flux infrastructure">fast-flux infrastructure</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/338919917/money-mule-recruiters-use-asproxs-fast.html">Money Mule Recruiters use ASProx's Fast Fluxing Services</source>
    </item>
    <item>
      <title><![CDATA[The Ayyildiz Turkish Hacking Group VS Everyone]]></title>
      <link>http://securityratty.com/article/e5949393a0e7be6e2ea6b20dadaba58c</link>
      <guid>http://securityratty.com/article/e5949393a0e7be6e2ea6b20dadaba58c</guid>
      <description><![CDATA[Certain hacktivist groups often come and go by the time the momentum of their particular cause is long gone. Excluding the hardcore hacktivists who are obliged to defend their country's infrastructure...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="text-align: center; clear: both;"></div><div style="text-align: left;"></div><div class="" style="clear: both;"><a href="http://bp0.blogger.com/_wICHhTiQmrA/SH-6Lbjq6XI/AAAAAAAAB7M/dn0skav9XIg/s1600-h/AYYILDIZ_TEAM.jpg" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp0.blogger.com/_wICHhTiQmrA/SH-6Lbjq6XI/AAAAAAAAB7M/mYlVgqX-mVU/s200-R/AYYILDIZ_TEAM.jpg" style="border: 0pt none ;" /></a>Certain hacktivist groups often come and go by the time the momentum of their particular cause is long gone. Excluding the hardcore hacktivists who are obliged to defend their country's infrastructure and reputation on the international scene, smart enough to do on one front, there are certain hacktivist groups who ensure their future existence by declaring war and every single country that has ever made statements in contradiction with their vision. Quite a stimulating factor for ensuring the future of your script kiddies group, isn't it?<br />
<br />
One of these groups is the AYYILDIZ TEAM, a group of Turkish script kiddies who've been pretty active as of recently, targeting everyone, everywhere, leaving statements like the following :</div><br />
"<i>Me, as AYT-Admin Barbaros, swear to everything which is lovely and holy to me, that you will pay for your actions. We, AYT, as a Cyber Attacking Army will make it sure. Read right, what will we do:<br />
<br />
* The government websites will be inaccessible an all lawsuits will be manipulated</i><br />
<i>* We will infiltrate the server of inland revenues for the manipulation of the data which are there.</i><br />
<i>* At the same time we will insist into the server of banks and will care for chaos</i><br />
<i>* Websites of the press will be extinguished.</i><br />
<i>* If the offence of our prophet (s.a.v.) called your press freedom, we will show you this press freedom</i><br />
<i>* Websites of divers shops will be hacked. Databank information's and the dates which are there, for example credit card dates, will be policed in this page. (Don't worry, we wouldn't taste one cent of your moneys, we aren't thieves like you. However we don't take care of what happens, if other hackers see this dates and empty your account)</i>"<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="text-align: center; clear: both;"></div><a href="http://bp0.blogger.com/_wICHhTiQmrA/SIBtXRQhuII/AAAAAAAAB7U/WwX3npoBZvI/s1600-h/SQL_turkz.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp0.blogger.com/_wICHhTiQmrA/SIBtXRQhuII/AAAAAAAAB7U/saIYE3fxpdA/s200-R/SQL_turkz.JPG" style="border: 0pt none ;" /></a>While this may sound inspiring, <b>some of the group's members are also involved in SQL injections in between the web site defacements</b>, which are naturally done by exploiting web application vulnerabilities. For instance, right after the defacement messages, they are also injecting the following fast-fluxed domains, part of the latest wave of SQL injections attacks.<b></b><br />
<br />
<b>bkpadd.mobi /ngg.js<br />
usaadw.com /ngg.js<br />
cliprts.com /ngg.js</b><br />
<br />
They are monetizing their defacements by either compiling lists of sites known to be SQL injectable since they've managed to defaced them, then reselling these to the SQL injectors, or are in fact part of the whole process in this scammy ecosystem. Speaking of SQL injections, here's the most recent list of fast-fluxed SQL injected domains participating in the last wave that I've been keeping track of for a while :<br />
<br />
<b>pyttco .com/ngg.js<br />
butdrv .com/ngg.js<br />
gitporg .com/ngg.js<br />
brcporb .ru/ngg.js<br />
korfd .ru/ngg.js<br />
adwnetw .com/ngg.js<br />
wowofmusiopl .com.cn/456.js<br />
adwbn .ru/ngg.js<br />
btoperc .ru/ngg.js<br />
nudk .ru/ngg.js<br />
bkpadd .mobi/ngg.js<br />
cliprts .com/ngg.js<br />
adwr .ru/ngg.js<br />
bnrc .ru/ngg.js<br />
adpzo .com/ngg.js<br />
iogp .ru/ngg.js<br />
lodse .ru/ngg.js<br />
usabnr .com/ngg.js<br />
vcre .ru/ngg.js<br />
sdkj .ru/ngg.js<br />
rcdplc .ru/ngg.js<br />
7maigol .cn/ri.js<br />
j8heisi .cn/ri.js<br />
usaadp .com/ngg.js<br />
gbradp .com/ngg.js<br />
cdrpoex .com/ngg.js<br />
rrcs .ru/ngg.js<br />
gbradw .com/ngg.js<br />
hiwowpp .cn/ri.js<br />
cdport .eu/ngg.js<br />
nopcls .com/ngg.js<br />
loopadd .com/ngg.js<br />
tertad .mobi/ngg.js<br />
gbradde .tk/ngg.js<br />
tctcow .com/ngg.js<br />
ausbnr .com/ngg.js<br />
movaddw .com/ngg.js<br />
grtsel .ru/ngg.js<br />
sslwer .ru/ngg.js<br />
destad .mobi/ngg.js<br />
hdrcom .com/ngg.js<br />
addrl .com/ngg.js<br />
porttw .mobi/ngg.js<br />
bnsdrv .com/ngg.js<br />
drvadw .com/ngg.js<br />
crtbond .com/ngg.js<br />
usaadw .com/ngg.js</b><br />
<br />
What used to be plain simple cooperating among every single participant in the underground marketplace, seems to be evolving into long-term business relationships.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2008/07/monetizing-compromised-web-sites.html">Monetizing Compromised Web Sites</a><br />
<a href="http://ddanchev.blogspot.com/2008/06/monetizing-web-site-defacements.html">Monetizing Web Site Defacements</a><br />
<a href="http://ddanchev.blogspot.com/2008/06/underground-multitasking-in-action.html">Underground Multitasking in Action</a><br />
<a href="http://ddanchev.blogspot.com/2008/06/right-wing-israeli-hackers-deface.html">Right Wing Israeli Hackers Deface Hamas's Site</a><br />
<a href="http://ddanchev.blogspot.com/2008/05/pro-serbian-hacktivists-attacking.html">Pro-Serbian Hacktivists Attacking Albanian Web Sites</a><br />
<a href="http://ddanchev.blogspot.com/2008/04/rise-of-kosovo-defacement-groups.html">The Rise of Kosovo Defacement Groups</a><br />
<a href="http://ddanchev.blogspot.com/2008/04/commercial-web-site-defacement-tool.html">A Commercial Web Site Defacement Tool</a><br />
<a href="http://ddanchev.blogspot.com/2008/04/phishing-tactics-evolving.html">Phishing Tactics Evolving</a><br />
<a href="http://ddanchev.blogspot.com/2008/04/web-site-defacement-groups-going.html">Web Site Defacement Groups Going Phishing</a><br />
<a href="http://ddanchev.blogspot.com/2006/02/hacktivism-tensions.html">Hacktivism Tensions</a><br />
<a href="http://ddanchev.blogspot.com/2006/07/hacktivism-tensions-israel-vs.html">Hacktivism Tensions - Israel vs Palestine Cyberwars</a><br />
<a href="http://ddanchev.blogspot.com/2007/11/mass-defacement-by-turkish-hacktivists.html">Mass Defacement by Turkish Hacktivists</a><br />
<a href="http://ddanchev.blogspot.com/2007/11/overperforming-turkish-hacktivists.html">Overperforming Turkish Hacktivists</a><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=727PxJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=727PxJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=JwIAWJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=JwIAWJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=RvHRWj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=RvHRWj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=ZamBlj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=ZamBlj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=YzU9yJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=YzU9yJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=2kBf4J"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=2kBf4J" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=LV5ldj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=LV5ldj" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/338894561" height="1" width="1"/>]]></content:encoded>
      <pubDate>Fri, 18 Jul 2008 01:48:38 +0000</pubDate>
      <category domain="http://securityratty.com/tag/comngg">comngg</category>
      <category domain="http://securityratty.com/tag/sql injections attacks">sql injections attacks</category>
      <category domain="http://securityratty.com/tag/sql injections">sql injections</category>
      <category domain="http://securityratty.com/tag/rungg">rungg</category>
      <category domain="http://securityratty.com/tag/sql">sql</category>
      <category domain="http://securityratty.com/tag/web sites">web sites</category>
      <category domain="http://securityratty.com/tag/web site defacement">web site defacement</category>
      <category domain="http://securityratty.com/tag/site">site</category>
      <category domain="http://securityratty.com/tag/sites">sites</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/338894561/ayyildiz-turkish-hacking-group-vs.html">The Ayyildiz Turkish Hacking Group VS Everyone</source>
    </item>
    <item>
      <title><![CDATA[More Websites Asking For MSN Logins...]]></title>
      <link>http://securityratty.com/article/8933e1d4f2a6adfb89d280a81cd3955d</link>
      <guid>http://securityratty.com/article/8933e1d4f2a6adfb89d280a81cd3955d</guid>
      <description><![CDATA[A fresh wave of spam messages related to the website covered here have started popping up on MSN Messenger clients. Avoid the following domains

get-that-stuff.info
imagefrosty.info...]]></description>
      <content:encoded><![CDATA[
        A fresh wave of spam messages related to the website covered <a href="http://blog.spywareguide.com/2008/06/another-site-asking-for-msn-lo.html">here</a> have started popping up on MSN Messenger clients. Avoid the following domains:<br /><br />get-that-stuff.info<br />imagefrosty.info<br />hostapic.info<br /> 
        
    ]]></content:encoded>
      <pubDate>Wed, 09 Jul 2008 12:04:40 +0000</pubDate>
      <category domain="http://securityratty.com/tag/info">info</category>
      <category domain="http://securityratty.com/tag/msn messenger clients">msn messenger clients</category>
      <category domain="http://securityratty.com/tag/fresh wave">fresh wave</category>
      <category domain="http://securityratty.com/tag/spam messages">spam messages</category>
      <category domain="http://securityratty.com/tag/get-that-stuff">get-that-stuff</category>
      <category domain="http://securityratty.com/tag/website">website</category>
      <category domain="http://securityratty.com/tag/avoid">avoid</category>
      <category domain="http://securityratty.com/tag/imagefrosty">imagefrosty</category>
      <category domain="http://securityratty.com/tag/domains">domains</category>
      <source url="http://blog.spywareguide.com/2008/07/more-websites-asking-for-msn-l.html">More Websites Asking For MSN Logins...</source>
    </item>
    <item>
      <title><![CDATA[Storm Botnet Celebrates The Independence Day With New Wave Of Malware Spam]]></title>
      <link>http://securityratty.com/article/21d109b062a0ef9971503608914e93d8</link>
      <guid>http://securityratty.com/article/21d109b062a0ef9971503608914e93d8</guid>
      <description><![CDATA[The group behind the Storm Botnet has always been conscious of timing and this time a new malware spam wave had started, dedicated to Independence day of course. This spam wave directs the user to...]]></description>
      <content:encoded><![CDATA[The group behind the Storm Botnet has always been conscious of timing and this time a new malware spam wave had started, dedicated to Independence day of course. This spam wave directs the user to click on a link that encourages the intended victim to download an infected fireworks.exe file.
The Storm botnet launched the latest [...]]]></content:encoded>
      <pubDate>Fri, 04 Jul 2008 12:39:45 +0000</pubDate>
      <category domain="http://securityratty.com/tag/storm botnet">storm botnet</category>
      <category domain="http://securityratty.com/tag/independence day">independence day</category>
      <category domain="http://securityratty.com/tag/malware spam wave">malware spam wave</category>
      <category domain="http://securityratty.com/tag/spam wave directs">spam wave directs</category>
      <category domain="http://securityratty.com/tag/exe file">exe file</category>
      <category domain="http://securityratty.com/tag/encourages">encourages</category>
      <category domain="http://securityratty.com/tag/link">link</category>
      <category domain="http://securityratty.com/tag/time">time</category>
      <category domain="http://securityratty.com/tag/conscious">conscious</category>
      <source url="http://cyberinsecure.com/storm-botnet-celebrates-the-independence-day-with-new-wave-of-malware-spam/">Storm Botnet Celebrates The Independence Day With New Wave Of Malware Spam</source>
    </item>
    <item>
      <title><![CDATA[U.S. Arms Dealer Tests Legal Bounds in Middle East Arms Bazaar]]></title>
      <link>http://securityratty.com/article/a494b708fadf3d4f453c6495d8064dc2</link>
      <guid>http://securityratty.com/article/a494b708fadf3d4f453c6495d8064dc2</guid>
      <description><![CDATA[Former congressman Curt Weldon is helping broker deals between Russian and Ukranian weapons suppliers and the Iraqi and Libyan governments as part of his new job with a private American defense...]]></description>
      <content:encoded><![CDATA[<p>
Former congressman Curt Weldon is helping broker deals between Russian and Ukranian weapons suppliers and the Iraqi and Libyan governments as part of his new job with a private American defense consulting firm, Wired.com has learned. 
</p>

<p>
Weldon, who is currently being investigated by the FBI over alleged corruption during his time in office, visited Libya in March to discuss a possible military deal, according to a letter describing the trip from Weldon to <a href="http://www.ds-pa.com/">Defense Solutions</a> CEO Timothy Ringgold. In May, Weldon, together with Ringgold and another company representative, traveled to Moscow to discuss working with Russia's weapons-export agency on arms sales to the Middle East.
</p>

<p>
Both trips were part of the company's effort to tap into the growing -- and often legally murky -- market for selling weapons from former Eastern Bloc countries to the Middle East and Afghanistan.
</p>



<div id="embed" style="margin: 0px 0px 15px 15px; float: right; width: 250px; height: auto;">

<img src="http://www.wired.com/images/article/full/2008/07/weldon_350px.jpg" width="250px" alt="Curt Weldon">

<div id="caption">

Ex-Rep. Curt Weldon, R-Penn., is helping broker deals between Russian weapons suppliers and the Iraqi and Libyan governments through his company, Defense Solutions.<br />
<em>Photo: H. Rumph Jr/AP</em>

</div> 

</div>

<p>
The Russians want to sell weapons to Iraq directly, but "must go slow on Iraq because of political reasons" and want to work with an "intermediary" like Defense Solutions, CEO Ringgold subsequently wrote to colleagues. "They have not spoken with any American company that can offer the quid pro quo that we can or that has the connections in Russia that we have," he boasted.
</p>



<p>
A few years ago, an American company proposing to sell weapons to Libya might have triggered a congressional hearing. So, too, would have a proposal to conduct arms deals with Russia, which the United States has accused of selling high-tech weapons to Syria and Iran. 
</p>

<p>However, U.S. government efforts to rapidly equip countries like Afghanistan and Iraq -- which have largely Soviet-origin weapons -- have created legal ambiguities and loopholes in export controls that didn't exist in years past and given rise to a new class of arms trade middlemen. So, even though both Libya and the Russian arms export agency are on official U.S. blacklists, government officials and analysts involved in weapons sales say the rules have become unclear as the push to equip allies in the global war on terror has blazed new but uncertain legal ground. 
</p>




<p>
Eagerly stepping into that virgin territory is <a href="http://www.ds-pa.com/">Defense Solutions</a>, a Pennsylvania-based company that is carving out a small but lucrative niche in a new international arms bazaar. The firm boasts as its advisors a number of influential Washington insiders, such as retired General Barry McCaffrey, the former White House drug czar.
</p>

<p>
Helping the firm make key connections is Curt Weldon, a former Republican congressman from Pennsylvania at the center of an FBI investigation into alleged conflicts of interest during his time in office.  Weldon, now a key executive at Defense Solutions, is working with the company to set up these weapons deals.
</p>

<div id="embed" style="margin: 0px 0px 15px 15px; float: right; width: 350px; height: auto;">

<img src="http://www.wired.com/images/article/full/2008/07/btr_60_350px.jpg" alt="">

<div id="caption">

Defense Solutions has also proposed refurbishing Libya's BTR-60 armored personnel carriers, according to a sales proposal seen by Wired.com. Defense Solutions denies drafting a sales proposal to Libya.

</div> 

</div>

<p>
It's an unusual, if not an entirely unexpected chapter for Weldon, whose time in office included frequent trips to Russia. As an influential member of the House Armed Services Committee, Weldon pushed for multibillion-dollar defense programs, like ballistic missile defense, and earned a reputation as a foreign policy gadfly, boasting of his contacts with officials in nations labeled by the administration as "rogue states" such as Libya and North Korea. Weldon's wild claims about a 9/11 cover-up and his sensationalist book warning of an Iranian terror plot, sometimes earned him official scorn and public ridicule, but it was accusations that he steered contracts to Eastern European businesses linked to his daughter's lobbying firm that drew the government's attention.
</p>


<!--pagebreak-->
<p>
Weldon was voted out of office in 2006 just weeks after the FBI raided his daughter's home, and that of one of her associates.
</p>

<p>
Weldon did not respond to e-mails and phone requests to be interviewed or comment for this article. But in a 2006 interview, before the FBI probe was public, Weldon spoke enthusiastically about setting up a "front company" to work with the Russian arms agency, Rosoboronexport. Weldon hoped this company could sell weapons to the Middle East, and other regions, particularly to countries where the U.S. has strained relations. He claimed the director of Rosoboronexport approached him to work with "an American company that would act as a front for weapons these nations want to buy."
</p>

<p>
Weldon called the proposal an "unbelievable offer."
</p>

<p>
The administration, he acknowledged at the time, did not welcome the idea of an American company selling Russian weapons to potentially unfriendly countries. But two years later, Weldon, now a private citizen and chief strategic officer for Defense Solutions, appears to be working on precisely that sort of deal. And whether illegal or not, Defense Solutions' business represents a new phenomenon in the international arms trade business.
</p>

<p>
In years past arms brokers -- firms or individuals who serve as middlemen to facilitate weapons sales between countries -- were largely the stuff of spy thrillers. Unlike traditional American defense companies, like Lockheed Martin or Boeing, which typically sell weapons directly to NATO countries or other governments regarded as friendly to the United States, brokers are often small outfits run by people with sometimes questionable experience and reputations they will sell to anyone. One of the most infamous arms brokers, a Russian named <a href="http://en.wikipedia.org/wiki/Victor_Bout">Viktor Bout</a>, is charged by the United States, United Nations, Interpol and others of funneling arms to terrorists and rebels around the world. He was recently arrested in Thailand. The United States is requesting his extradition on charges of supplying arms to a terrorist organization.
</p>

<div id="embed" style="margin: 0px 0px 15px 15px; float: right; width: 350px; height: auto;">

<img src="http://www.wired.com/images/article/full/2008/07/bmp_1_350px.jpg" alt="" />

<div id="caption">

Two Marines lower the trim vane on the front of an Iraqi BMP-1 mechanized infantry combat vehicle that was captured during Operation Desert Storm. The American defense consulting firm Defense Solutions has proposed refurbishing Libya's aging fleet of BMP-1s. Defense Solutions denies drafting a sales proposal to Libya.

</div> 

</div>

<p>
But ironically, Iraq has fueled a new market for these professional middlemen; the United States is funneling billions of dollars into modernizing Iraq's army so that the country's government can fend for itself after coalition troops withdraw. And Iraq's largely Soviet-equipped military is a natural market for Eastern European countries brimming with old or out-of-date equipment they would like to unload. The middlemen, in these cases, serve a key role by allowing the U.S. government to do business with an American company, which in turn buys equipment from Eastern Bloc countries in deals worth hundreds of millions of dollars, much of it financed with U.S. taxpayer dollars.
</p>

<p>
One of Defense Solutions' sales -- a deal to sell Hungarian-owed T-72 tanks to Iraq in 2005 -- was typical of these new foreign military sales. But on the more questionable side is the company's plans to work with Rosoboronexport, which is barred from doing business with the U.S. government, and Libya, which is still on the State Department's arms embargo list. 
</p>

<p>
The Eastern European-Middle East arms-brokering business, while in some cases sanctioned by the U.S. government, has run into problems, including outright corruption and quality. Defense contractor Dale Stoffel, the president of Wye Oak Technology, and another American were gunned down in Iraq in December 2004 after Stoffel alleged that the Iraqi Ministry of Defense was involved in a kickback scheme. Like Defense Solutions, the company Stoffel worked for was refurbishing the Iraq's army Eastern Bloc equipment.
</p>

<p>
Another problem is quality. Weapons from the former Soviet Bloc, which the U.S. military euphemistically calls "nonstandard equipment," have been flagged as substandard, acknowledges Brigadier General Charles Luckey, who is in charge of security assistance at <a href="http://www.mnstci.iraq.centcom.mil/">Multi-National Security Transition Command-Iraq</a>. In an interview from Iraq, Brigadier General Luckey said: "One of the frustrating things about buying nonstandard [weapons], is that I'm the guy who has to deal with the fact that some broker I've never heard of allowed weapons to get to Iraq before they were inspected."
</p>

<div id="embed" style="margin: 0px 0px 15px 15px; float: right; width: 350px; height: auto;">

<img src="http://www.wired.com/images/article/full/2008/07/tank_350px.jpg" alt="" />

<div id="caption">

Defense Solutions is carving a new niche in the arms trade, selling Soviet-made weapons to Middle Eastern countries like Afghanistan and Iraq. Defense Solutions sold Hungarian-owed T-72 tanks to Iraq in 2005.

</div> 

</div>


<p>
In one high-profile case, Iraqi officials alleged that a corrupt firm sold them $400 million in shoddy helicopters from Poland. More recently, a company led by a 21-year-old and a former masseur was offered a U.S. government contract worth nearly $300 million to sell ammunition to Afghanistan. The ammunition turned out to be outdated and of dubious origin and several people connected with the company have been indicted. A congressional investigation concluded that the company, which was on a State Department watch list, was able to take advantage of regulatory loopholes by using middlemen.
</p>

<p>
For those concerned about illicit arms trade, this new wave of weapons deals is rife with the potential for corruption and abuse, but for companies eager to pursue markets once regarded as dubious, it represents a lucrative business opportunity.  The problem in these cases, according to those familiar with arms sales, is that it's no longer clear what's legal and what's not.
</p>
<!--pagebreak-->
<p>
Rachel Stohl, an expert on international arms trade and a senior analyst at Center for Defense Information, says that in many ways, the rush to equip Iraq has led the United States to throw caution to the wind. She points to a report by the Government Accountability Office last year that found that some 190,000 weapons sold to Iraq have gone missing. "I think the reality is we won't know, until way after the fact, about all of these irregularities with the Iraq weapons provision program," she said. "We were providing them all these assault rifles that have gone missing. Why? They were not following the standard procedures that were in place."
</p>

<p>
But Iraq and Afghanistan aren't the only markets available to arms brokers like Defense Solutions. The gradual normalization of relations with Libya opens another door into a quasi-legal area of sales. 
</p>

<p>
Like Iraq, Libya has a substantial arsenal of Soviet-origin military weapons, offering a potential market for brokers working with Russia and other former Soviet states. But even when there's not an outright ban, sales to the Middle East are often fraught with controversy, particularly to countries like Libya, which was under international sanction for more than a decade. Even as sanctions against it have been lifted, European companies proposing to sell arms to Libya have faced steep criticism, particularly since the country is still ruled by dictator Muammar Gaddafi, who took power in a military coup in 1969. 
</p>

<p>
While the United States lifted Libya's "state sponsor of terrorism" designation in 2006, other restrictions, such as on the sale of arms, remain in place. A State Department spokesperson confirmed that exports of "lethal munitions" to Libya, such as tanks or related equipment, are still banned, although sales of nonlethal equipment are now allowed on a case-by-case basis.
</p>

<p>
In late March, Weldon traveled to Libya for a weeklong trip at the invitation of the <a href="http://gdf.org.ly/index.php?lang=ar&Page=101&lang=en">Gaddafi Foundation</a>, a group run by the son of Libya's leader, and the chairman of Libya's foreign affairs committee, according to <a href="http://blog.wired.com/defense/files/libya_trip_report.doc">the report he sent to Defense Solutions</a> (.pdf), a copy of which was obtained by Wired.com. The trip reports states: "Agreement reached for Weldon to quickly return to Libya for meetings with son [of Libyan leader Gaddafi] Morti regarding defense and security cooperation."
</p>

<p>
A document dated April 16, just two weeks after Weldon's trip, outlines Defense Solutions' proposal to Libya to refurbish the country's fleet of armored vehicles, including its T-72 tanks, BMP-1 infantry fighting vehicles, and BTR-60 armored personnel carriers. A copy of the sales proposal, also provided to Wired.com, is on Defense Solutions' letterhead, appears to bear the signature of company CEO Timothy Ringgold, and is addressed to Libya's defense procurement council. "Defense Solutions is committed to delivering a full end-to-end solution to its clients," the proposal states. "Besides refurbishing these vehicles, we are capable of providing a full logistics support package, including a two year supply of spare parts, maintenance and repair services, and operator, maintenance, and repair training."
</p>

<p>
In an interview with Wired.com, Ringgold admitted that he's interested in doing business in Libya and confirms receiving Weldon's trip report from Libya, but denies drafting or signing an arms-sale proposal. "I've never made such a document to Libya," Ringgold insisted, after being read the proposal, and told that his signature is on it.
</p>

<p>
In addition to the Libyan arms-deal document, Wired.com has also reviewed copies of e-mails from Ringgold discussing the Libyan deal.
</p>

<p>
While Ringgold denies proposing an arms sale to Libya, he is open about speaking with Rosoboronexport, which has been on a U.S. government sanctions list since 2006, after the Russian state agency allegedly violated the Iran and Syria Nonproliferation Act. An April e-mail provided to Wired.com describes Ringgold, Weldon and Stephan Minikes, a senior advisor to Defense Solutions and a former ambassador, meeting with Rosoboronexport. The conversations included a number of potential deals, including supplying Mi-17 helicopters to Afghanistan and spare parts for Iraq's infantry fighting vehicles. Ringgold wrote to colleagues following the visit, describing the meetings as a "spectacular success," saying the Russian agency "has the ability to undercut all cost proposals from brokers."
</p>

<p>
Ringgold confirmed those discussions and said that his company has sought to do business with Rosoboronexport. Asked whether Ringgold considers his dealings with Russia to be legal, he argued that U.S. companies could work with Rosoboronexport on a "case-by-case" basis. "The particular purpose of the meeting we had -- and I want to be crystal clear -- was in response to a U.S. government requirement," he said.
</p>

<p>
A number of officials at the State Department and in the Pentagon, when contacted for this article, could not say whether working with Rosoboronexport is legal or not. A Pentagon spokeswoman said she was familiar with the issue, but deferred the question to the State Department. When asked about Rosoboronexport's status on the blacklist, John Herzberg, a State Department spokesman replied: "What's on there is on there."
</p>

<p>
Asked whether, given the ban, there was any way a company could legally work with Rosoboronexport, as Ringgold suggested, Herzberg provided an equivocal answer. "At the stage of the process we're at, I'm unable to give you an answer," he said. "You can try elsewhere in government, and maybe they'll be braver than me."
</p>

<p>
In an interview from Iraq, General Luckey conceded it was a murky area, but said, "My understanding is they are currently on our no-go list." 
</p>

<p>
The confusion over debarred parties has even led the U.S. government into its own legal tangles, according to Jim McAleese, a Washington attorney who specializes in government contracting and foreign military sales. Because the Russian government violated U.S. nonproliferation laws, even NASA had to go to Congress to ensure it could work with Russia on Soyuz flights to the international space station. "What I'm warning you about is, don't be surprised by the confusion," McAleese said. "There are a whole bunch of different statutes that were adopted piecemeal and were never intended to be reconciled."
</p>

<p>
But it's the very ambiguity of the law that troubles those who monitor export control. "It's highly unusual to do anything with the Russians, particularly Rosoboronexport," said Scott Jones, director of Export Control Programs at the <a href="http://www.uga.edu/cits/">Center for International Trade and Security</a> at the University of Georgia. 
</p>

<p>
Legal or not, reputable American companies simply don't want to work with banned entities, Jones said, for fear of risking their reputations and business. "Even if it's not an outright prohibition, most companies don't want to put themselves in a liability situation that has really bad PR … and they stay away from it," Jones said. "But if that's your business, pimping out arms from the U.S. or Russia, that's the way it works, and you push as much as possible."
</p>

<p>
Finding any U.S. defense company working with the Russian government at this point would be "remarkable," Jones added.
</p>

<p>
In the meantime, the future for Weldon is unclear. The FBI investigation continues and Weldon's former chief of staff recently pleaded guilty to a conspiracy charge and is cooperating with the government, notes Melanie Sloan, the executive director of <a href="http://www.citizensforethics.org/">Citizens for Responsibility and Ethics in Washington</a>, which filed a complaint against Weldon in 2004. Sloan speculated that Weldon may be charged with "honest service fraud" for misusing his office for personal gain. "It's an easier standard than bribery," she said. "I wouldn't be surprised [if he's charged] with bribery, but I think it will be honest services fraud."
</p>

<p>
Ringgold insists that he and Weldon are on the right side of the law. "Everything we do is in strict compliance with international and U.S. law and we operate only in the best interests of the U.S. government," he said. "I didn't serve 30 years in the United States Army to throw that away on a whim."
</p>

<p>
Asked if Weldon is still working for the company, Ringgold replied: "Absolutely, proudly so." 
</p><br style="clear: both;"/>
  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=3c1b81ed8ecb441b359b5fd6e6dec750" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=3c1b81ed8ecb441b359b5fd6e6dec750" style="display: none;" border="0" height="1" width="1" alt=""/><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=f5EjSJ"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=f5EjSJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=zYmkhj"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=zYmkhj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=S9Ojfj"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=S9Ojfj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=xPEQRJ"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=xPEQRJ" border="0"></img></a>
 <a href="http://feeds.wired.com/~f/wired/politics/security?a=OTsesJ"><img src="http://feeds.wired.com/~f/wired/politics/security?i=OTsesJ" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=wFj1Jj"><img src="http://feeds.wired.com/~f/wired/politics/security?i=wFj1Jj" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=OExjrj"><img src="http://feeds.wired.com/~f/wired/politics/security?i=OExjrj" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=DKk6TJ"><img src="http://feeds.wired.com/~f/wired/politics/security?i=DKk6TJ" border="0"></img></a> </div><img src="http://feeds.feedburner.com/~r/wired/politics/privacy/~4/326164069" height="1" width="1"/><img src="http://feeds.wired.com/~r/wired/politics/security/~4/326164070" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 03 Jul 2008 18:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/arms brokers">arms brokers</category>
      <category domain="http://securityratty.com/tag/brokers">brokers</category>
      <category domain="http://securityratty.com/tag/infamous arms brokers">infamous arms brokers</category>
      <category domain="http://securityratty.com/tag/defense">defense</category>
      <category domain="http://securityratty.com/tag/firm defense solutions">firm defense solutions</category>
      <category domain="http://securityratty.com/tag/arms">arms</category>
      <category domain="http://securityratty.com/tag/arms trade">arms trade</category>
      <category domain="http://securityratty.com/tag/international arms trade">international arms trade</category>
      <category domain="http://securityratty.com/tag/russian weapons suppliers">russian weapons suppliers</category>
      <source url="http://feeds.wired.com/~r/wired/politics/security/~3/326164070/defense_solutions">U.S. Arms Dealer Tests Legal Bounds in Middle East Arms Bazaar</source>
    </item>
    <item>
      <title><![CDATA[Sony USA PlayStation Website SQL Injected And Redirects Visitors To Fake Anti-Virus Scam]]></title>
      <link>http://securityratty.com/article/1fbc74fb24da220cb5a30810eab4d198</link>
      <guid>http://securityratty.com/article/1fbc74fb24da220cb5a30810eab4d198</guid>
      <description><![CDATA[Sonys USA PlayStation website, a website with a very large number of daily visitors according to Alexa, had been the victim of an SQL injection attack. Sony PlayStations site is another high...]]></description>
      <content:encoded><![CDATA[Sony’s USA PlayStation website, a website with a very large number of daily visitors according to Alexa, had been the victim of an SQL injection attack. Sony PlayStation’s site is another high trafficked web site that fall victim into the continuing waves of massive botnets (ASProx botnet for example) SQL injections.
The purpose of this wave [...]]]></content:encoded>
      <pubDate>Wed, 02 Jul 2008 14:41:28 +0000</pubDate>
      <category domain="http://securityratty.com/tag/sql injection attack">sql injection attack</category>
      <category domain="http://securityratty.com/tag/sony playstations site">sony playstations site</category>
      <category domain="http://securityratty.com/tag/website">website</category>
      <category domain="http://securityratty.com/tag/massive botnets">massive botnets</category>
      <category domain="http://securityratty.com/tag/sql injections">sql injections</category>
      <category domain="http://securityratty.com/tag/web site">web site</category>
      <category domain="http://securityratty.com/tag/asprox botnet">asprox botnet</category>
      <category domain="http://securityratty.com/tag/daily visitors">daily visitors</category>
      <category domain="http://securityratty.com/tag/victim">victim</category>
      <source url="http://cyberinsecure.com/sony-usa-playstation-website-sql-injected-and-redirects-visitors-to-fake-anti-virus-scam/">Sony USA PlayStation Website SQL Injected And Redirects Visitors To Fake Anti-Virus Scam</source>
    </item>
  </channel>
</rss>
