<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: would-be]]></title>
    <link>http://securityratty.com/tag/would-be</link>
    <description></description>
    <pubDate>Sat, 08 Nov 2008 08:29:59 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Tips for staying safe online this Holiday season]]></title>
      <link>http://securityratty.com/article/4601cb0e0df5f980983616dff3fecc59</link>
      <guid>http://securityratty.com/article/4601cb0e0df5f980983616dff3fecc59</guid>
      <description><![CDATA[Great article by Mr Walling. Take the time read the tips and maybe you wont become a statistic this season


clipped from www.marketwatch.com

Walling Datas Top Ten Safety Tips for Online Shopping


...]]></description>
      <content:encoded><![CDATA[<div > Great article by Mr Walling.<br/>Take the time read the tips and maybe you wont become a statistic this season </div>
<table cellpadding="0" cellspacing="0" width="100%" style="margin: 12px 0px; font-family: arial; color: #333333; background: #ffffff; border: solid 4px #e5e5e5; width: 100%; clear: left;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" class="CM_CTB_Content_Wrap" style="margin: 0px; padding: 0px;background-color: #ffffff;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" style="border-bottom: solid 1px #dcdcdc; white-space: nowrap; margin-bottom: 8px; background-color: #eeeeee ;background-image: url(http://clipmarks.com/images/source-bg.gif); background-repeat: repeat-x; height: 24px; line-height: 24px; vertical-align: middle; padding-bottom: 4px; color: #666666; font-size: 10px;">
<tr>
<td valign="top"><a href="http://clipmarks.com/clipmark/5CC9381E-01B3-4581-A29F-B6C7D9C85A8E/" title="go to this clipmark"><img src="http://content.clipmarks.com/blog_icon/a9a2ac45-d36e-42ed-8102-6fd92fd5847c/5CC9381E-01B3-4581-A29F-B6C7D9C85A8E/" alt="" width="19" height="19" border="0" style="vertical-align: middle; margin: 0px 4px; display: inline; border: none; float:none;" /></a>clipped from <a title="http://www.marketwatch.com/news/story/Walling-Datas-Top-Ten-Safety/story.aspx?guid=%7B877022E1-B408-495D-A4F6-C49F6002D0AE%7D" href="http://www.marketwatch.com/news/story/Walling-Datas-Top-Ten-Safety/story.aspx?guid=%7B877022E1-B408-495D-A4F6-C49F6002D0AE%7D" style="font-size: 11px;">www.marketwatch.com</a></td>
</tr>
</table>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://www.marketwatch.com/news/story/Walling-Datas-Top-Ten-Safety/story.aspx?guid=%7B877022E1-B408-495D-A4F6-C49F6002D0AE%7D -->
<div style="margin: 4px 0px; color: #000000; font-size: 20px;">Walling Data&#8217;s Top Ten Safety Tips for Online Shopping</div>
</td>
</tr>
</table>
<div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://www.marketwatch.com/news/story/Walling-Datas-Top-Ten-Safety/story.aspx?guid=%7B877022E1-B408-495D-A4F6-C49F6002D0AE%7D --><DIV class="p"><br />
            &#8220;The Internet is safe if you follow basic, fundamental rules of<br />
      using a computer safely,&#8221; says Luke Walling, Founder and President of Walling<br />
      Data, one of the largest distributors of online security products in<br />
      the country. &#8220;Many people think of their computer much like<br />
      they would an appliance, such as a microwave or stereo that behaves in a<br />
      predictable pre-programmed way. But, in reality computers<br />
      are dynamic devices that evolve dramatically with the installation of<br />
      each new program. It&#8217;s important to remember that viruses<br />
      and spyware are programs as well.&#8221;<br />
</DIV></td>
</tr>
</table>
</td>
</tr>
</table>
<div style="margin: 0px 6px 6px 4px;">
<table style="font-size: 11px;border-spacing: 0px;padding: 0px;" cellpadding="0" cellspacing="0" width="100%">
<tr>
<td style="background:transparent;border-width:0px;padding:0px;">&nbsp;</td>
<td align="right" style="background:transparent;border-width:0px;padding:0px;width:107px" width="107"><a href="http://clipmarks.com/share/5CC9381E-01B3-4581-A29F-B6C7D9C85A8E/blog/" title="blog or email this clip"><img src="http://content6.clipmarks.com/images/c2b-foot.png" border="0" alt="blog it" width="107" height="17" style="border-width:0px;padding:0px;margin:0px;" /></a></td>
</tr>
</table>
</div>
</td>
</tr>
</table>
<BR/><MAP name="bdv_RSS_Ad_281108043701"><AREA alt="Feed Ads By BidVertiser.com" shape="poly" coords="0,0,467,0,467,45,315,45,315,59,0,59" href="http://secure.bidvertiser.com/performance/bdv_rss_rd.dbm?pid=165886&amp;bid=400950&amp;PHS=281108043701&amp;click=1" target="_blank" /><AREA alt="Feed Ads By BidVertiser.com" shape="rect" coords="315,45,467,59" href="http://www.bidvertiser.com/bdv/bidvertiser/bdv_ref.dbm?Ref_PID=165886&amp;Ref_Option=main&amp;source=90614506" target="_blank" /></MAP><P><a href="http://secure.bidvertiser.com/performance/bdv_rss_rd.dbm?pid=165886&amp;bid=400950&amp;PHS=281108043701&amp;click=1" target="_blank"><IMG src="http://bdv.bidvertiser.com/BidVertiser.dbm?pid=165886&amp;bid=400950&amp;PHS=281108043701&amp;rssimage=1&amp;rSRC=2" border="0" usemap="#bdv_RSS_Ad_281108043701" /></a></P>]]></content:encoded>
      <pubDate>Fri, 28 Nov 2008 13:37:01 +0000</pubDate>
      <category domain="http://securityratty.com/tag/online">online</category>
      <category domain="http://securityratty.com/tag/tips">tips</category>
      <category domain="http://securityratty.com/tag/online security products">online security products</category>
      <category domain="http://securityratty.com/tag/computer safely">computer safely</category>
      <category domain="http://securityratty.com/tag/safety tips">safety tips</category>
      <category domain="http://securityratty.com/tag/computer">computer</category>
      <category domain="http://securityratty.com/tag/dynamic devices">dynamic devices</category>
      <category domain="http://securityratty.com/tag/datas top">datas top</category>
      <category domain="http://securityratty.com/tag/safe">safe</category>
      <source url="http://spywarebiz.com/spywarebizblog/?p=665">Tips for staying safe online this Holiday season</source>
    </item>
    <item>
      <title><![CDATA[Friday Squid Blogging: Preserving Giant Squid]]></title>
      <link>http://securityratty.com/article/f149b30158b44ffcbe92efcb77211405</link>
      <guid>http://securityratty.com/article/f149b30158b44ffcbe92efcb77211405</guid>
      <description><![CDATA[At the Smithsonian : At the centerof the Smithsonian Institution's National Museum of Natural History's gleaming new Sant Ocean Hall lies a preserved giant female squid -- the arresting, spineless...]]></description>
      <content:encoded><![CDATA[<p>At the <a href="http://pubs.acs.org/cen/science/86/8644sci1.html">Smithsonian</a>:</p>

<blockquote>At the centerof the Smithsonian Institution's National Museum of Natural History's gleaming new Sant Ocean Hall lies a preserved giant female squid -- the arresting, spineless star among the vibrant exhibition's animal specimens. Tentacles menacingly outstretched and seemingly frozen in time, the 24-foot squid embodies humans' fascination with the briny deep. But this squid also symbolizes something else: an ongoing experiment in the chemistry of preservation, without which the Smithsonian's new exhibition would not have been possible.</blockquote>

<p>Also note the <a href="http://scienceblogs.com/bioephemera/2008/11/pickling_a_better_squid.php">terrorism tie-in</a>:</p>

<blockquote>To create the exhibit, the Smithsonian had to work around post-9/11 rules restricting flammable materials, while maximizing the lifelike appearance of the squid for public display. They turned not to formalin or ethanol, but to a new fluorinated chemical called Novec, developed by 3M.</blockquote>

<p>If we give up our preserved giant squids, then surely the terrorists have won.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=oRsPN"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=oRsPN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=Fw3kN"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=Fw3kN" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Fri, 21 Nov 2008 13:20:18 +0000</pubDate>
      <category domain="http://securityratty.com/tag/squid">squid</category>
      <category domain="http://securityratty.com/tag/smithsonian">smithsonian</category>
      <category domain="http://securityratty.com/tag/giant female squid">giant female squid</category>
      <category domain="http://securityratty.com/tag/smithsonian institution">smithsonian institution</category>
      <category domain="http://securityratty.com/tag/vibrant exhibition">vibrant exhibition</category>
      <category domain="http://securityratty.com/tag/exhibition">exhibition</category>
      <category domain="http://securityratty.com/tag/national museum">national museum</category>
      <category domain="http://securityratty.com/tag/natural history">natural history</category>
      <category domain="http://securityratty.com/tag/briny deep">briny deep</category>
      <source url="http://www.schneier.com/blog/archives/2008/11/friday_squid_bl_153.html">Friday Squid Blogging: Preserving Giant Squid</source>
    </item>
    <item>
      <title><![CDATA[News Report on Non Vulnerability in Windows Vista]]></title>
      <link>http://securityratty.com/article/3a7950aaea1375ea46dc4f0439559b20</link>
      <guid>http://securityratty.com/article/3a7950aaea1375ea46dc4f0439559b20</guid>
      <description><![CDATA[Are editors so excited to use the headline Vulnerability in Windows Vista in their SEO URLs that they will have their reporters write a story on a non-issue
IDG News has published a news report...]]></description>
      <content:encoded><![CDATA[<p>Are editors so excited to use the headline &#8220;Vulnerability in Windows Vista&#8221; in their SEO URLs that they will have their reporters write a story on a non-issue? </p>
<p>IDG News has published a news report titled, &#8220;<a href="http://www.itworld.com/windows/58144/researchers-find-vulnerability-windows-vista">Researchers find vulnerability in Windows Vista</a>&#8220;. The report says:</p>
<blockquote><p>An Austrian security vendor has found a vulnerability in Windows Vista that it says could possibly allow an attacker to run unauthorized code on a PC.</p>
<p>The problem is rooted in the Device IO Control, which handles internal device communication. Researchers at Phion have found two different ways to cause a buffer overflow that could corrupt the memory of the operating system&#8217;s kernel.</p>
<p>In one of the scenarios, a person would already have to have administrative rights to the PC. In general, vulnerabilities that require that level of access somewhat undermine the risk since the attacker already has permission to use to the PC.</p></blockquote>
<p>Somewhat undermine the risk? If you need admin rights to exercise a bug it is not a security issue since you could already run any code with whatever privilege you wanted.  Microsoft is not issuing a patch, but creating a bug fix in a service pack, yet this is newsworthy?  This story has no comment from anyone but the finder of the bug.  Let&#8217;s see if other news outlets pick up on this one.</p>
]]></content:encoded>
      <pubDate>Thu, 20 Nov 2008 15:41:16 +0000</pubDate>
      <category domain="http://securityratty.com/tag/windows vista">windows vista</category>
      <category domain="http://securityratty.com/tag/vulnerability">vulnerability</category>
      <category domain="http://securityratty.com/tag/news report">news report</category>
      <category domain="http://securityratty.com/tag/report">report</category>
      <category domain="http://securityratty.com/tag/bug fix">bug fix</category>
      <category domain="http://securityratty.com/tag/bug">bug</category>
      <category domain="http://securityratty.com/tag/headline vulnerability">headline vulnerability</category>
      <category domain="http://securityratty.com/tag/austrian security vendor">austrian security vendor</category>
      <category domain="http://securityratty.com/tag/news outlets pick">news outlets pick</category>
      <source url="http://www.veracode.com/blog/2008/11/news-report-on-non-vulnerability-in-windows-vista/">News Report on Non Vulnerability in Windows Vista</source>
    </item>
    <item>
      <title><![CDATA[Most Spam Came from a Single Web Hosting Firm]]></title>
      <link>http://securityratty.com/article/894b4e87cb13c364abc659a7aab3070a</link>
      <guid>http://securityratty.com/article/894b4e87cb13c364abc659a7aab3070a</guid>
      <description><![CDATA[Really : Experts say the precipitous drop-off in spam comes from Internet providers unplugging McColo Corp., a hosting provider in Northern California that was the home base for machines responsible...]]></description>
      <content:encoded><![CDATA[<p><a href="http://voices.washingtonpost.com/securityfix/2008/11/spam_volumes_drop_by_23_after.html?nav=rss_blog">Really</a>:</p>

<blockquote>Experts say the precipitous drop-off in spam comes from Internet providers unplugging McColo Corp., a hosting provider in Northern California that was the home base for machines responsible for coordinating the sending of roughly 75 percent of all spam each day.</blockquote>

<p>Certainly this won't last:</p>

<blockquote>Bhandari said he expects the spam volume to recover to normal levels in about a week, as the spam operations that were previously hosted at McColo move to a new home.

<p>"We're seeing a slow recovery," Bhandari. "We fully expect this to recover completely, and to go into the highest ever spam period during the upcoming holiday season."</blockquote></p>

<p>But with all the talk of massive botnets sending spam, it's interesting that most of it still comes from hosting services.  You'd think this would make the job of detecting spam a lot easier.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=dOYuN"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=dOYuN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=HEDZN"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=HEDZN" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Mon, 17 Nov 2008 02:11:07 +0000</pubDate>
      <category domain="http://securityratty.com/tag/spam">spam</category>
      <category domain="http://securityratty.com/tag/spam volume">spam volume</category>
      <category domain="http://securityratty.com/tag/spam period">spam period</category>
      <category domain="http://securityratty.com/tag/spam operations">spam operations</category>
      <category domain="http://securityratty.com/tag/recover">recover</category>
      <category domain="http://securityratty.com/tag/recover completely">recover completely</category>
      <category domain="http://securityratty.com/tag/home">home</category>
      <category domain="http://securityratty.com/tag/home base">home base</category>
      <category domain="http://securityratty.com/tag/machines responsible">machines responsible</category>
      <source url="http://www.schneier.com/blog/archives/2008/11/most_spam_came.html">Most Spam Came from a Single Web Hosting Firm</source>
    </item>
    <item>
      <title><![CDATA[Do you know who your employees are?]]></title>
      <link>http://securityratty.com/article/912fccde5dd0e4681c49ad021e6f3b01</link>
      <guid>http://securityratty.com/article/912fccde5dd0e4681c49ad021e6f3b01</guid>
      <description><![CDATA[Do you really

The Financial Times in London ran an article which illustrates the risks posed by disgruntled IT professionals. According to a recent survey, 88% of redundant IT administrators claimed...]]></description>
      <content:encoded><![CDATA[Do you really?<br /><span id="fullpost"><br />The Financial Times in London ran an article which illustrates the risks posed by disgruntled IT professionals.  According to a recent survey, 88% of redundant IT administrators claimed they would steal valuable and sensitive information from their company if they were ever fired.    <br /></span><br />A real-life example of this is the systems administrator with the Dept. of Technology who earlier this year created a password which locked officials out of the network because he feared he was losing his job.<br /><br />While it is very difficult to know if an employee is thinking this way, proper background checking and screening would likely discover if they ever did anything like this to a previous employer.<br /><br />When a termination is imminent, employers should close all of the employee's accounts and recover devices such as Blackberries, laptops, elctronic key cards and I.D.  When we are called in to assist with terminations, we always advise emloyers and supervisors of the need to do this.<br /><br />Surprisingly, many employers are not in a rush to get back laptops and other devices as they fear "upsetting" the termianted employee. If this is the case, turn over the responsibility to a professional outsourced security consultant who can take care of these duties and the company does not have to worry about being right in the "middle" of the process.<div class="blogger-post-footer">Visit Sexton Executive Security at www.sextonsecurity.com</div>]]></content:encoded>
      <pubDate>Sat, 15 Nov 2008 15:18:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/devices">devices</category>
      <category domain="http://securityratty.com/tag/elctronic key cards">elctronic key cards</category>
      <category domain="http://securityratty.com/tag/recover devices">recover devices</category>
      <category domain="http://securityratty.com/tag/employee">employee</category>
      <category domain="http://securityratty.com/tag/risks posed">risks posed</category>
      <category domain="http://securityratty.com/tag/recent survey">recent survey</category>
      <category domain="http://securityratty.com/tag/proper background">proper background</category>
      <category domain="http://securityratty.com/tag/previous employer">previous employer</category>
      <category domain="http://securityratty.com/tag/systems administrator">systems administrator</category>
      <source url="http://www.thebulletproofblog.com/2008/11/do-you-know-who-your-employees-are.html">Do you know who your employees are?</source>
    </item>
    <item>
      <title><![CDATA[How does Microsoft explain seven-year patch delay?]]></title>
      <link>http://securityratty.com/article/516e5e5f76947d724820f61a3d4c9b21</link>
      <guid>http://securityratty.com/article/516e5e5f76947d724820f61a3d4c9b21</guid>
      <description><![CDATA[The software giant says that fixing the flaw earlier would have broken customer network...]]></description>
      <content:encoded><![CDATA[The software giant says that fixing the flaw earlier would have broken customer network applications.<img src="http://feedproxy.google.com/~r/digg/topic/security/popular/~4/5BVfwrWgksw" height="1" width="1"/>]]></content:encoded>
      <pubDate>Fri, 14 Nov 2008 22:50:01 +0000</pubDate>
      <category domain="http://securityratty.com/tag/customer network applications">customer network applications</category>
      <category domain="http://securityratty.com/tag/software giant">software giant</category>
      <category domain="http://securityratty.com/tag/flaw">flaw</category>
      <source url="http://feeds.digg.com/~r/digg/topic/security/popular/~3/5BVfwrWgksw/How_does_Microsoft_explain_seven_year_patch_delay">How does Microsoft explain seven-year patch delay?</source>
    </item>
    <item>
      <title><![CDATA[Embassy of Brazil in India Compromised]]></title>
      <link>http://securityratty.com/article/d16a985654ea698c4e0d3ab5e394be74</link>
      <guid>http://securityratty.com/article/d16a985654ea698c4e0d3ab5e394be74</guid>
      <description><![CDATA[Only an amateur or unethical competition would embedd malicious links at the Embassy of Brazil in India's site , referencing their online community. With the chances of an Embassy involvement into the...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://1.bp.blogspot.com/_wICHhTiQmrA/SRxJCIZifgI/AAAAAAAACc0/7XHc2f7BAQo/s1600-h/brazil_embassy_india_compromised_1.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://1.bp.blogspot.com/_wICHhTiQmrA/SRxJCIZifgI/AAAAAAAACc0/7XHc2f7BAQo/s200/brazil_embassy_india_compromised_1.JPG" /></a>Only an amateur or unethical competition would embedd <a href="http://securitylabs.websense.com/content/Alerts/3228.aspx">malicious links at the Embassy of Brazil in India's site</a>, referencing their online community. With the chances of <a href="http://www.brazilembassy.in/">an Embassy</a> involvement into the fake antivirus software industry close to zero,<br />
<br />
<a href="http://4.bp.blogspot.com/_wICHhTiQmrA/SRxE9OAVBCI/AAAAAAAACck/u5qhnNXJyoE/s1600-h/brazil_embassy_free_web_space_rogue.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://4.bp.blogspot.com/_wICHhTiQmrA/SRxE9OAVBCI/AAAAAAAACck/u5qhnNXJyoE/s200/brazil_embassy_free_web_space_rogue.JPG" /></a>The compromise is a great example of a mixed use of pure malicious domains in a combination with compromised legitimate ones and on purposely registered accounts at free web space providers, hosting the blackhat SEO content. However, digging deeper we expose the entire malicious doorways ecosystem pushing PDF exploits, banker malware and Zlob variants. The malicious attackers embedded links to their blackhat SEO farms advertising fake security software, and also a link to a traffic redirection doorway<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><b>epmwckme.dex1.com</b><br />
<b>htkobaf.dex1.com</b><br />
<b>ogbucof.dex1.com</b><br />
<b>segundomuelle.com/mex/antivirus</b><br />
<b>jgzleaa.dex1.com</b><br />
<b>igpran.ru/services/tolstye</b><br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://1.bp.blogspot.com/_wICHhTiQmrA/SRxFRKFC0LI/AAAAAAAACcs/hsjTDmrLtbo/s1600-h/obfuscation_brazil_embassy.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://1.bp.blogspot.com/_wICHhTiQmrA/SRxFRKFC0LI/AAAAAAAACcs/hsjTDmrLtbo/s200/obfuscation_brazil_embassy.JPG" /></a>The active and redirecting <b>traff .asia</b> (89.149.251.203) is currently serving a fake account suspended notice - "<i>This account has been suspended. Either the domain has been overused, or the reseller ran out of resources.</i>" but is whatsoever redirecting us to <b>antimalware09 .net</b>. This particular traffic redirection doorway is actively redirecting us to a command and control server running a well known web malware exploitation kit which is currently serving PDF exploits. <b>&nbsp;</b><br />
<br />
<b>google-analyze .com/socket/index.php</b> (216.195.59.77) from where we're redirected to <b>google-analyze.com/tracker/load.php</b> which is serving system.exe (Trojan-Spy.Win32.Zbot.ehk; Win32.TrojanSpy.Zbot.gen!C.5), and <b>google-analyze .com/tracker/pdf.php</b> (Exploit:Win32/Pdfjsc.G; Exploit.JS.Pdfka.w; Bloodhound.Exploit.196). Naturally, within the live exploit URLs there are multiple IFRAMEs redirecting us to more of this group's campaigns. <b>google-analyze .com</b>&nbsp; has multiple IFRAMEs pointing to <b>google-analystic .net</b> (209.160.67.56), yet another traffic redirection doorway further exposing their campaigns.<br />
<br />
For instance, <b>google-analystic .net/in.cgi?20</b> loads <b>google-analystic.net/tea.php</b> (209.160.67.56) where <b>google-analystic .net/in.cgi?8</b> is redirecting to <b>91.203.93.61 /in.cgi?2</b> taking us to <b>91.203.93.61 /25/2/</b> where we deobfuscate the javascript leading us to the exact location of the PDF exploit - <b>91.203.93.61 /25/2/getfile.php?f=pdf</b>. This is just for starters. <b>google-analystic .net/in.cgi?9</b> redirects to <b>mangust32 .cn/pod/index.php</b> (218.93.202.102) where they serve load.exe (Backdoor:Win32/Koceg.gen!A) at <br />
<b>mangust32 .cn/pod2/load.php</b> and load.exe at <b>mangust32 .cn/eto2/load.php</b>, moreover, <b>google-analystic .net/in.cgi?10</b> leads us to <b>mmcounter .com/in.cgi?id194</b> (94.102.50.130) a traffic management login which is no longer responding. The last IFRAME found within google-analystic points to <b>busyhere .ru/in.cgi?pipka</b> which redirects to <b>beshragos .com/work/index.php</b> (79.135.187.38) where once we<br />
deobfuscate the script, we get to see the PDF exploit location <b>beshragos.com /work/getfile.php?f=pdf</b>.<br />
<br />
What's contributing to the increase of PDF exploits durin the last month? It's an updated version of a web based malware exploitation tool, which despite the fact that it remains proprietary for the time being, will leak in the next couple of weeks causing the usual short-lived epidemic.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2008/01/dutch-embassy-in-moscow-serving-malware.html">The Dutch Embassy in Moscow Serving Malware</a><br />
<a href="http://ddanchev.blogspot.com/2007/09/us-consulate-st-petersburg-serving.html">U.S Consulate in St. Petersburg Serving Malware</a><br />
<a href="http://ddanchev.blogspot.com/2007/09/syrian-embassy-in-london-serving.html">Syrian Embassy in London Serving Malware</a><br />
<a href="http://ddanchev.blogspot.com/2007/12/have-your-malware-in-timely-fashion.html">French Embassy in Libya Serving Malware</a><b> <br />
</b><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=GVhoN"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=GVhoN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=1M6tN"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=1M6tN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=BksVn"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=BksVn" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=u03In"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=u03In" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=HzjZN"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=HzjZN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=9KBON"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=9KBON" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=2Qbtn"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=2Qbtn" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/451892286" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 13 Nov 2008 06:47:45 +0000</pubDate>
      <category domain="http://securityratty.com/tag/embassy">embassy</category>
      <category domain="http://securityratty.com/tag/php">php</category>
      <category domain="http://securityratty.com/tag/traffic redirection doorway">traffic redirection doorway</category>
      <category domain="http://securityratty.com/tag/syrian embassy">syrian embassy</category>
      <category domain="http://securityratty.com/tag/exploit">exploit</category>
      <category domain="http://securityratty.com/tag/live exploit urls">live exploit urls</category>
      <category domain="http://securityratty.com/tag/cgi">cgi</category>
      <category domain="http://securityratty.com/tag/pdf exploits durin">pdf exploits durin</category>
      <category domain="http://securityratty.com/tag/pdf exploits">pdf exploits</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/451892286/embassy-of-brazil-in-india-compromised.html">Embassy of Brazil in India Compromised</source>
    </item>
    <item>
      <title><![CDATA[Worm Risk Spurs Critical Microsoft Patch]]></title>
      <link>http://securityratty.com/article/8cf9511bc9ea45e86f1aba005afcf898</link>
      <guid>http://securityratty.com/article/8cf9511bc9ea45e86f1aba005afcf898</guid>
      <description><![CDATA[A scary security flaw that would allow malicious worms to infect one PC and then automatically jump to others prompted Microsoft to release a rare out-of-cycle patch in October. The glitch is critical...]]></description>
      <content:encoded><![CDATA[A scary security flaw that would allow malicious worms to infect one PC and then automatically jump to others prompted Microsoft to release a rare out-of-cycle patch in October. The glitch is critical for both 32-bit and 64-bit versions of Windows XP and Windows Server 2003, and for Windows Server 2000. Microsoft says that targeted attacks exploited the hole prior to the patch's release, and that "detailed exploit code" is currently available online.]]></content:encoded>
      <pubDate>Wed, 12 Nov 2008 21:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/patch">patch</category>
      <category domain="http://securityratty.com/tag/windows">windows</category>
      <category domain="http://securityratty.com/tag/windows server">windows server</category>
      <category domain="http://securityratty.com/tag/rare out-of-cycle patch">rare out-of-cycle patch</category>
      <category domain="http://securityratty.com/tag/microsoft">microsoft</category>
      <category domain="http://securityratty.com/tag/scary security flaw">scary security flaw</category>
      <category domain="http://securityratty.com/tag/malicious worms">malicious worms</category>
      <category domain="http://securityratty.com/tag/64-bit versions">64-bit versions</category>
      <category domain="http://securityratty.com/tag/critical">critical</category>
      <source url="http://www.networkworld.com/news/2008/111308-worm-risk-spurs-critical-microsoft.html?fsrc=rss-security">Worm Risk Spurs Critical Microsoft Patch</source>
    </item>
    <item>
      <title><![CDATA[Data Loss Prevention Tools: Friend or Foe?]]></title>
      <link>http://securityratty.com/article/ca67a18e4d56f645bdc3eb1f183611ba</link>
      <guid>http://securityratty.com/article/ca67a18e4d56f645bdc3eb1f183611ba</guid>
      <description><![CDATA[I recently visited a customer and we had an in-depth conversation about the use of DLP in a large corporate environment. The customer agreed that the technology surrounding DLP is great and that it...]]></description>
      <content:encoded><![CDATA[<p><B>I  recently visited a customer and we had an in-depth conversation about the use  of DLP in a large corporate environment.</b>  The customer agreed that the technology surrounding DLP is great and  that it would definitely help identify potential rogue employees.&nbsp; However, the customer also expressed concerns  about when is enough&hellip;enough.</b>]]></content:encoded>
      <pubDate>Sun, 09 Nov 2008 21:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/customer">customer</category>
      <category domain="http://securityratty.com/tag/potential rogue employees">potential rogue employees</category>
      <category domain="http://securityratty.com/tag/in-depth conversation">in-depth conversation</category>
      <category domain="http://securityratty.com/tag/dlp">dlp</category>
      <category domain="http://securityratty.com/tag/recently">recently</category>
      <category domain="http://securityratty.com/tag/enoughenough">enoughenough</category>
      <category domain="http://securityratty.com/tag/environment">environment</category>
      <category domain="http://securityratty.com/tag/technology">technology</category>
      <category domain="http://securityratty.com/tag/concerns">concerns</category>
      <source url="http://www.rsa.com/blog/blog_entry.aspx?id=1382">Data Loss Prevention Tools: Friend or Foe?</source>
    </item>
    <item>
      <title><![CDATA[When Markets Collide]]></title>
      <link>http://securityratty.com/article/b33dd419bf17d2010a5e8c1da7814637</link>
      <guid>http://securityratty.com/article/b33dd419bf17d2010a5e8c1da7814637</guid>
      <description><![CDATA[One of my favorite Motley Fool analysts is Bill Mann, yesterday he wrote an article on China that re-set a number of the investing thesis themes in the current global situation


Things are so bad in...]]></description>
      <content:encoded><![CDATA[<p><span style="font-size: 13px; ">One of my favorite Motley Fool analysts is Bill Mann, yesterday he wrote an </span><a href="http://www.fool.com/investing/international/2008/11/07/why-i-believe-in-the-chinese-miracle.aspx"><span style="font-size: 13px; ">article</span></a><span style="font-size: 13px; "> on China that re-set a number of the investing thesis themes in the current global situation:</span></p><div><span style="font-size: 13px; "><br /></span></div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #222222; font-size: 14px; line-height: 20px; "><span style="color: #222222; line-height: 20px; font-size: 13px; ">Things are so bad in China that its gross domestic product growth rate may fall from double digits to the dowdy level of 8%. Eight percent, by the way, is a level at which the United States is unlikely&#0160;</span><em style="background-repeat: no-repeat; border-top-width: 0px; border-right-width: 0px; border-bottom-width: 0px; border-left-width: 0px; border-style: initial; border-color: initial; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; font-size: 100%; font-weight: inherit; font-style: italic; "><span style="background-repeat: no-repeat; border-top-width: 0px; border-right-width: 0px; border-bottom-width: 0px; border-left-width: 0px; border-style: initial; border-color: initial; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; font-weight: inherit; font-style: italic; font-size: 13px; ">to ever grow again</span></em><span style="color: #222222; line-height: 20px; font-size: 13px; ">. It can&#39;t. Our economy is simply fully developed. Thus the sobriquet &quot;developed economy.&quot; I know, not exactly catchy.</span></span><span style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 40px; border-top-style: none; border-right-style: none; border-bottom-style: none; border-left-style: none; border-width: initial; border-color: initial; padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; font-size: 13px; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #222222; line-height: 20px; font-size: 13px; ">..</span></p></blockquote><p><span style="font-size: 13px; "><br /></span></p><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #222222; font-size: 14px; line-height: 20px; "><span style="font-size: 11px; line-height: 10px; "><p style="background-repeat: no-repeat; border-top-width: 0px; border-right-width: 0px; border-bottom-width: 0px; border-left-width: 0px; border-style: initial; border-color: initial; padding-top: 0px; padding-right: 0px; padding-left: 0px; font-style: inherit; font-weight: inherit; font-size: 1.3em; margin-top: 10px; margin-right: 0px; margin-bottom: 10px; margin-left: 0px; line-height: 20px; padding-bottom: 5px; "><span style="background-repeat: no-repeat; border-top-width: 0px; border-right-width: 0px; border-bottom-width: 0px; border-left-width: 0px; border-style: initial; border-color: initial; padding-top: 0px; padding-right: 0px; padding-left: 0px; font-style: inherit; font-weight: inherit; margin-top: 10px; margin-right: 0px; margin-bottom: 10px; margin-left: 0px; line-height: 20px; padding-bottom: 5px; font-size: 13px; ">All of the headlines show China sitting at a crossroads. But the reason I have faith in China is that it has historical proxies. Since 1970, with the exception of a few OPEC members, only four economies have made the transition from emerging to developed markets (meaning their per-capita incomes exceed $15,000 per year): Taiwan, Singapore, Hong Kong, and South Korea.</span></p><p style="background-repeat: no-repeat; border-top-width: 0px; border-right-width: 0px; border-bottom-width: 0px; border-left-width: 0px; border-style: initial; border-color: initial; padding-top: 0px; padding-right: 0px; padding-left: 0px; font-style: inherit; font-weight: inherit; font-size: 1.3em; margin-top: 10px; margin-right: 0px; margin-bottom: 10px; margin-left: 0px; line-height: 20px; padding-bottom: 5px; "><span style="background-repeat: no-repeat; border-top-width: 0px; border-right-width: 0px; border-bottom-width: 0px; border-left-width: 0px; border-style: initial; border-color: initial; padding-top: 0px; padding-right: 0px; padding-left: 0px; font-style: inherit; font-weight: inherit; margin-top: 10px; margin-right: 0px; margin-bottom: 10px; margin-left: 0px; line-height: 20px; padding-bottom: 5px; font-size: 13px; ">These four economies have two things in common. First, they have few natural resources; and second, they are dominated by Chinese values and the traditional Chinese work ethic. Mainland China is different only because it got a later start.</span></p></span></span></p></blockquote><p><span style="color: #222222; line-height: 20px; font-size: 13px; "><br /></span></p><div><span style="color: #222222; line-height: 20px; font-size: 13px; ">Also, China reportedly has currency reserves $1.6 trillion. That means that China has a better balance sheet than the US, plus 1.6 trillion beats minus 12 trillion if you are scoring at home.</span></div><div><span style="color: #222222; line-height: 20px; font-size: 13px; "><br /></span></div><div><span style="color: #222222; line-height: 20px; font-size: 13px; ">Given that the Chinese stock market is down 70% in the last year, its an interesting time to look at Chinese stocks. A few weeks back Mohamed El-Erian made the bull case for buying the MCSI Emerging Markets index which gives you exposure to the BRICs plus a lot of other countries.</span></div><div><span style="color: #222222; line-height: 20px; font-size: 13px; "><br /></span></div><div><span style="color: #222222; line-height: 20px; font-size: 13px; ">Speaking of El-Erian, his book &quot;When Markets Collide&quot; was just </span><a href="http://business.timesonline.co.uk/tol/business/economics/article4968973.ece"><span style="font-size: 13px; ">voted Best Business Book of the Year</span></a><span style="color: #222222; line-height: 20px; font-size: 13px; ">. If we could have voted for a book that we wished everyone had read in 2007 he would have won that too, he said&#0160;</span></div><div><span style="color: #222222; line-height: 20px; font-size: 13px; "><br /></span></div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="line-height: 16px; font-size: 13px; ">“When I wrote the book, I thought I was writing about the future. When it was going to press, I thought it was about current affairs. Now I wish it was about history.”</span><span style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 40px; border-top-style: none; border-right-style: none; border-bottom-style: none; border-left-style: none; border-width: initial; border-color: initial; padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; font-size: 13px; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="line-height: 16px; font-size: 13px; "><br /></span></p></blockquote><p><span style="line-height: 16px; font-size: 13px; ">This part below reminds me a lot of 1995 security architectures used to defend 2008 integrated applications</span></p><div><span style="line-height: 16px; font-size: 13px; "><br /></span></div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 40px; border-top-style: none; border-right-style: none; border-bottom-style: none; border-left-style: none; border-width: initial; border-color: initial; padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; font-size: 13px; ">The present crisis had been triggered because the international financial system had undertaken activities that had “far outpaced the ability of the infrastructure to sustain them”, said El-Erian.</span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 40px; border-top-style: none; border-right-style: none; border-bottom-style: none; border-left-style: none; border-width: initial; border-color: initial; padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; font-size: 13px; "><br />And it was not just the markets that could not cope with their own changes, but governments as well. Significant weaknesses had been exposed “from the firms, to the regulatory agencies, to governments, to multilateral oversight”.<br /><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 40px; border-top-style: none; border-right-style: none; border-bottom-style: none; border-left-style: none; border-width: initial; border-color: initial; padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; font-size: 13px; ">“Turbocharge that with financial innovations, which history tells us we tend to overproduce and overconsume, and it’s inevitable that you will get a series of market accidents,” he said.<br /></span></p></blockquote><p><span style="font-size: 13px; "><br /></span></p><div><span style="font-size: 13px; ">In a Robert Garigue sense, in computer security our infostructure (users, apps and data) &#0160;are outpacing our infrastructure-centric security models</span></div><div><span style="font-size: 12px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></div><div><span style="font-family: Arial;"><br /></span></div>]]></content:encoded>
      <pubDate>Sat, 08 Nov 2008 08:29:59 +0000</pubDate>
      <category domain="http://securityratty.com/tag/markets">markets</category>
      <category domain="http://securityratty.com/tag/china">china</category>
      <category domain="http://securityratty.com/tag/china reportedly">china reportedly</category>
      <category domain="http://securityratty.com/tag/markets collide">markets collide</category>
      <category domain="http://securityratty.com/tag/mainland china">mainland china</category>
      <category domain="http://securityratty.com/tag/markets index">markets index</category>
      <category domain="http://securityratty.com/tag/business book">business book</category>
      <category domain="http://securityratty.com/tag/trillion beats minus">trillion beats minus</category>
      <category domain="http://securityratty.com/tag/trillion">trillion</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/11/when-markets-collide.html">When Markets Collide</source>
    </item>
  </channel>
</rss>
