<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: youtube]]></title>
    <link>http://securityratty.com/tag/youtube</link>
    <description></description>
    <pubDate>Tue, 05 Aug 2008 03:14:42 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Zango And The Batman Online Videogame]]></title>
      <link>http://securityratty.com/article/df88ab063f04def43d02f931dfa23c42</link>
      <guid>http://securityratty.com/article/df88ab063f04def43d02f931dfa23c42</guid>
      <description><![CDATA[This is Newsarama, a site (mostly) geared around comics and other related media





Click to Enlarge

You'll notice Batman, over on the right there. Let's take a closer look





Free Online Batman...]]></description>
      <content:encoded><![CDATA[
        This is Newsarama, a site (mostly) geared around comics and other related media:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/batzang1.html" onclick="window.open('http://blog.spywareguide.com/images/batzang1.html','popup','width=839,height=492,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/batzang1-thumb-339x198.jpg" alt="batzang1.jpg" class="mt-image-none" style="" height="198" width="339" /></a></span><br /> </div><div><div align="center">Click to Enlarge<br /></div><br />You'll notice Batman, over on the right there. Let's take a closer look:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="batzang2.gif" src="http://blog.spywareguide.com/images/batzang2.gif" class="mt-image-none" style="" height="266" width="316" /></span></div><br /></div><div><br />"Free Online Batman Game"? Well, that's curious because I follow comics pretty closely and I'd be the first to know if an "Online Batman Game" had been in the works (this advert has been doing the rounds on <a href="http://forums.superherohype.com/showthread.php?p=15406107">numerous</a> <a href="http://dcboards.warnerbros.com/web/message.jspa?messageID=2004718393#2004718393">comic-related</a> <a href="http://www.comicforum.de/showpost.php?s=543cba941aeb245f8174ec4943be2adc&amp;p=2733165&amp;postcount=29">websites</a>. Visit the URL in the ad - Batmangame.info - and you'll see this...<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/batzang3.html" onclick="window.open('http://blog.spywareguide.com/images/batzang3.html','popup','width=725,height=666,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/batzang3-thumb-325x298.gif" alt="batzang3.gif" class="mt-image-none" style="" height="298" width="325" /></a></span><br /></div></div><div><div align="center">Click to Enlarge<br /></div><br />There it is again - "Online Batman Game". Furthermore, the text goes on to say:<br /><i><br />"Batman Online lets you do anything and every little thing you'd like in a Batman game. From leveling up your character to destroying villans, it has it all. Download and play this amazing game now, all for free! I'm sure you'll be playing for hours on end, it's that much fun.<br /><br />&nbsp;&nbsp;&nbsp; Level Up Your Character<br />&nbsp;<br />&nbsp;&nbsp; Explore a Huge Vast World<br />&nbsp;<br />&nbsp;&nbsp; Play Online With Your Friends<br />&nbsp;<br />&nbsp;&nbsp; Hundreds of Quests To Finish<br />&nbsp;<br />&nbsp;&nbsp; Perfect Battle System<br /><br />So start your Batman adventure today! Download the&nbsp; full game below and fight them all!"</i><br /><br />Note that they specifically call it "Batman Online". It specifically sounds like a text blurb you'd expect to see with a <a href="http://en.wikipedia.org/wiki/Massively_multiplayer_online_role-playing_game">MMORPG</a>. However, something isn't quite right here.<br /><br /><b>1)</b> The only DC licensed MMORPG anybody knows of is <a href="http://en.wikipedia.org/wiki/DC_Universe_%28video_game%29">this</a>, and it isn't due out until 2009. It's not Batman-centric, either.<br /><br /><b>2)</b> The screenshots are lifted from the <a href="http://en.wikipedia.org/wiki/Batman_Begins_%28video_game%29">Batman Begins videogame</a>, which came out in 2005. If you were offering a "Batman Online Game", wouldn't you use screenshots from that instead of an unrelated title?<br /><br /><b>3)</b> Absolutely no licensing, copyright or legal mumbo-jumbo on the page anywhere. DC and Warner Bros don't roll like that.<br /><br /><b>4)</b> The website - Batmangame(dot)info - is <a href="http://whois.domaintools.com/batmangame.info">registered anonymously</a>. Not exactly something you see everyday for websites related to licensed DC franchises such as Batman videogames.<br /><br /><b>5)</b> "To download and play the Batman Online Game you must download and install Zango as well. It is free, very easy to install and will give you access to the full game."<br /><br />Shall we continue?<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/batzang4.html" onclick="window.open('http://blog.spywareguide.com/images/batzang4.html','popup','width=757,height=638,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/batzang4-thumb-357x300.gif" alt="batzang4.gif" class="mt-image-none" style="" height="300" width="357" /></a></span><br />Click to Enlarge<br /></div><br />A Zango installer prompt, complete with picture of Batman at the top. If you say "No" to the install, you end up on Google.com. What happens if you click "Start"? Well, you'll get the <a href="http://blog.spywareguide.com/images/batzang5.gif">usual collection</a> of <a href="http://blog.spywareguide.com/images/batzang6.gif">Zango installer screens</a> including one that rather humorously has a guy in a superhero costume.<br /><br /></div><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="batzang7.gif" src="http://blog.spywareguide.com/images/batzang7.gif" class="mt-image-none" style="" height="333" width="419" /></span></div><div><br />Once everything is installed, you're taken to another page and from here things just get plain confusing. Remember, up to this point you've been promised an "Online Batman Game", the description of which is clearly intended to evoke images of a MMORPG. However....<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/batveng.html" onclick="window.open('http://blog.spywareguide.com/images/batveng.html','popup','width=841,height=623,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/batveng-thumb-341x252.jpg" alt="batveng.jpg" class="mt-image-none" style="" height="252" width="341" /></a></span><br />Click to Enlarge<br /></div><br />All of a sudden, you're being told you're downloading "Batman: Vengeance" on a cheap-looking splash page and shown what looks like an unofficially ripped <a href="http://www.youtube.com/watch?v=D1WqzbNB8tM&amp;eurl=http://www.batmangame.info/setup.exe">Batman: Vengeance trailer</a> on Youtube.<br /><br />In case you're unaware, Batman: Vengeance is a videogame <a href="http://en.wikipedia.org/wiki/Batman_Vengeance">first launched way back in 2001</a> for consoles (followed shortly after by a PC version). What does this have to do with an "Online Batman Game"? Well, nothing, actually. Aside from the fact you were presented with one thing and are now handed another, things get even stranger when you see the download location:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/batzang00.html" onclick="window.open('http://blog.spywareguide.com/images/batzang00.html','popup','width=542,height=281,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/batzang00-thumb-342x177.gif" alt="batzang00.gif" class="mt-image-none" style="" height="177" width="342" /></a></span><br /></div></div><div><div align="center">Click to Enlarge<br /></div><br />Have you ever heard of an officially licensed game being offered via Rapidshare downloads? It's possible, I guess, but it seems a little odd. However, the <i>real</i> oddness is reserved for the "Online Batman game" itself.<br /><br />Remember, we've been promised "Hundreds of quests", "A huge vast world", the ability to "level up your character" and (of course) the "play online with your friends" promise of greatness.<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/batinstall.html" onclick="window.open('http://blog.spywareguide.com/images/batinstall.html','popup','width=811,height=549,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/batinstall-thumb-311x210.gif" alt="batinstall.gif" class="mt-image-none" style="" height="210" width="311" /></a></span><br />Click to Enlarge<br /></div><br />Imagine your dismay, then, when you've installed Zango, downloaded the game from Rapidshare using up around 140MB of bandwidth, installed it and....<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="batdemo.gif" src="http://blog.spywareguide.com/images/batdemo.gif" class="mt-image-none" style="" height="288" width="451" /></span></div><br />Oh dear.<br /><br />Not only are you given a totally different game than what was advertised, you're given a DEMO VERSION of that game with <a href="http://blog.spywareguide.com/images/menu.gif">four short sample levels</a> present, no online functionality and quite a few less quests than the "hundreds" advertised.<br /><br />Hilariously, you can download a 100% legit copy of this demo <a href="http://www.fileplanet.com/110885/110000/fileinfo/Batman-Vengeance-Demo">here at Fileplanet</a>, sans Adware. Setting aside the issue of whether this file is actually sitting on Rapidshare with either Ubisoft or DC / Warner Bros permission (and if it IS okay to be there, I'm pretty sure it's NOT okay to falsely advertise it as some kind of MMORPG) there are some questions that need to be raised here.<br /><br />When this guy approached them with his website, did nobody stop to think that this game did not actually match up with the "Online Batman" game it was touted as? Didn't someone at Zango Quality Control actually download the game and see the big "This is a demo" wording as soon as it starts up? Or question why the <a href="http://blog.spywareguide.com/images/begins1.gif">screenshots</a> on the website don't look like the graphics for <a href="http://blog.spywareguide.com/images/batveng1.gif">Batman: Vengeance</a> in the slightest?<br /><br />However you look at it, this is a scam, pure and simple. Whoever came up with the idea of an "Online Batman Game" is lying through their teeth. Of course, because their website is registered anonymously we have no idea who the culprit is, unless of course Zango want to deposit them on the steps of Gotham City and let me dispense some Batman-style justice to their posterior.<br /><br />However, based on the way these things tend to go - God forbid anyone ever offer up the identity of someone happily scamming the public at large, even when that person is dragging the name of the company associated with them through the mud by their antics - I think I might be waiting some time for the Bat Signal...<br /></div>
        
    ]]></content:encoded>
      <pubDate>Wed, 03 Sep 2008 07:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/batman">batman</category>
      <category domain="http://securityratty.com/tag/batman online">batman online</category>
      <category domain="http://securityratty.com/tag/batman game">batman game</category>
      <category domain="http://securityratty.com/tag/online batman game">online batman game</category>
      <category domain="http://securityratty.com/tag/batman online game">batman online game</category>
      <category domain="http://securityratty.com/tag/batman adventure">batman adventure</category>
      <category domain="http://securityratty.com/tag/batman begins videogame">batman begins videogame</category>
      <category domain="http://securityratty.com/tag/batman-centric">batman-centric</category>
      <category domain="http://securityratty.com/tag/batman-style justice">batman-style justice</category>
      <source url="http://blog.spywareguide.com/2008/09/zango-and-the-batman-online-vi.html">Zango And The Batman Online Videogame</source>
    </item>
    <item>
      <title><![CDATA[Don't Panic]]></title>
      <link>http://securityratty.com/article/171b434e504b03e183525367f4118cdd</link>
      <guid>http://securityratty.com/article/171b434e504b03e183525367f4118cdd</guid>
      <description><![CDATA[Sometimes it's easy to believe that every last thing online is going to eat into your PC, burn your house down, kill your cat and so on. The last few days I'd been hearing rumblings about some...]]></description>
      <content:encoded><![CDATA[
        Sometimes it's easy to believe that every last thing online is going to eat into your PC, burn your house down, kill your cat and so on. The last few days I'd been hearing rumblings about some "Youtube rap video" and a file that would start hijacking your PC - well, thanks to a tipoff from a forum-goer at Spywarewarrior, I can hopefully put this one to rest.<br /><br />In short, a video promoting a rap mix-tape supposedly took you to a file that "hijacked your PC with Spywarestop". In actual fact, there's no file to hijack you. Let's take a look - here's the Youtube page in question:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/mixtape1.html" onclick="window.open('http://blog.spywareguide.com/images/mixtape1.html','popup','width=895,height=493,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/mixtape1-thumb-395x217.gif" alt="mixtape1.gif" class="mt-image-none" style="" height="217" width="395" /></a></span><br /><br />Click to Enlarge<br /></div><br />As you can see, there's the mix-tape being advertised and a link to Mediafire, where the mix-tape is hosted. Click the Mediafire link, and all that happens is you'll see an advert for various antispyware tools - some of them on the <a href="http://www.spywarewarrior.com/rogue_anti-spyware.htm">Rogue Antispyware list</a>, some of them not on the list but known to be of little worth to the end-user.<br /><br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/mixtape2.html" onclick="window.open('http://blog.spywareguide.com/images/mixtape2.html','popup','width=757,height=457,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/mixtape2-thumb-357x215.gif" alt="mixtape2.gif" class="mt-image-none" style="" height="215" width="357" /></a></span><br /> </div><div><div align="center"><br />Click to Enlarge<br /></div><br />In this particular case, it's an advert for Adware Alert. It's not hijacking you, or breaking things or making your browser fly around the screen, nor is it a "virus". It's just an (admittedly loud) advert. If you're running a browser compatible with <a href="http://adblockplus.org/en/">Adblock Plus</a>, all you'll see beneath the Mediafire logo is a blank space. Even if you're vaguely alarmed by the advert, all you have to do is click the "Continue to Mediafire.com" message at the top right of the screen (missing from the above screenshot as I cropped the image too small - whoops) and you'll be taken to the file you requested.<br /><br />Like the title says - don't panic. This really isn't something to worry about too much. Even the most obnoxious rogue antispyware advert (the ones that <i>do</i> resize your browser, throw up endless popups and make annoying "Woop woop" noises) can usually be escaped by simply hitting CTRL+ALT+DEL and using Task Manage to close your browser session.<br /></div>
        
    ]]></content:encoded>
      <pubDate>Fri, 29 Aug 2008 13:03:16 +0000</pubDate>
      <category domain="http://securityratty.com/tag/mediafire link">mediafire link</category>
      <category domain="http://securityratty.com/tag/link">link</category>
      <category domain="http://securityratty.com/tag/browser">browser</category>
      <category domain="http://securityratty.com/tag/mediafire">mediafire</category>
      <category domain="http://securityratty.com/tag/browser session">browser session</category>
      <category domain="http://securityratty.com/tag/rap mix-tape supposedly">rap mix-tape supposedly</category>
      <category domain="http://securityratty.com/tag/mix-tape">mix-tape</category>
      <category domain="http://securityratty.com/tag/mediafire logo">mediafire logo</category>
      <category domain="http://securityratty.com/tag/browser compatible">browser compatible</category>
      <source url="http://blog.spywareguide.com/2008/08/dont-panic.html">Don't Panic</source>
    </item>
    <item>
      <title><![CDATA[Automatic Email Harvesting 2.0]]></title>
      <link>http://securityratty.com/article/215d1f3ffdea93e64224f10dcdb310d4</link>
      <guid>http://securityratty.com/article/215d1f3ffdea93e64224f10dcdb310d4</guid>
      <description><![CDATA[Just when you think that email harvesting matured into user names harvesting in a true Web 2.0 style with the recently uncovered harvested IM screen names , and Youtube user lists for spammers,...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://1.bp.blogspot.com/_wICHhTiQmrA/SLPj-Z2aPhI/AAAAAAAACHM/KxPZ6rpqjZs/s1600-h/email_harvesting_20.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://1.bp.blogspot.com/_wICHhTiQmrA/SLPj-Z2aPhI/AAAAAAAACHM/To_TE0L7esg/s200-R/email_harvesting_20.jpg" /></a>Just <a href="http://ddanchev.blogspot.com/2006/09/email-spam-harvesting-statistics.html">when you</a> think that <a href="http://ddanchev.blogspot.com/2007/01/inside-email-harvesters-configuration.html">email harvesting</a> matured into user names harvesting in a true Web 2.0 style with the recently uncovered harvested <a href="http://ddanchev.blogspot.com/2007/10/thousands-of-im-screen-names-in-wild.html">IM screen names</a>, and <a href="http://ddanchev.blogspot.com/2008/05/harvesting-youtube-usernames-for.html">Youtube user lists</a> for spammers, phishers and malware authors to take advantage of, someone has filled in the gap that's been around as long as email harvesting has been a daily routine for spammers - dealing with text obfuscations which still remain highly popular online, once it became evident that spammers are in fact crawling for default mailto lines. This email harvesting module can be run a separate script, or get integrated as a module within any botnet, is capable of harvesting the following text obfuscations often used in order to prevent spamming crawlers : <br />
<br />
<b>mail@gmail.com <br />
mail[at]gmail.com <br />
mail[at]gmail[dot]com <br />
mail [space]gmail [space]com <br />
mail(@)gmail.com <br />
mail(a)gmail.com<br />
mail AT gmail DOT com</b><br />
<br />
The overall availability and easy of obtaining a huge percentage of valid email addresses within an organizaton, is not just resulting in the increasing <a href="http://ddanchev.blogspot.com/2008/05/segmenting-and-localizing-spam.html">segmentation and localization of spam, phishing and malware campaigns</a>, it's increasing the profit margins for the spamming providers which is now not just <a href="http://ddanchev.blogspot.com/2007/04/shots-from-malicious-wild-west-sample.html">offering verified to be 100% valid email addresses</a>, but also, can providing the foundations for spear phishing and targeted attacks.<br />
<br />
<a href="http://ddanchev.blogspot.com/2008/07/dissecting-managed-spamming-service.html">Quality assurance in spaming</a> is still in its introduction phrase, with customers starting to put the emphasis on the number of emails that actually made it through the spam filters, than the number of emails sent as <a href="http://ddanchev.blogspot.com/2007/10/managed-spamming-appliances-future-of.html">a benchmark for increasing the probability of bypassing anti spam filters</a>. Taking into consideration the big picture, sniffing for email addresses streaming out of malware infected hosts, and stealing huge email databases by exploiting vulnerable online communities, seems to be the tactics of choice for the majority of individuals whose responsibility is to continuously provide fresh and valid email addresses.<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=2rXjAK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=2rXjAK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=nGHWgK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=nGHWgK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=BC4Y6k"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=BC4Y6k" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=N6ZPDk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=N6ZPDk" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=Pklg3K"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=Pklg3K" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=TfpIxK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=TfpIxK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=iTLEzk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=iTLEzk" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/375213353" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 26 Aug 2008 04:01:51 +0000</pubDate>
      <category domain="http://securityratty.com/tag/email">email</category>
      <category domain="http://securityratty.com/tag/email addresses">email addresses</category>
      <category domain="http://securityratty.com/tag/valid email addresses">valid email addresses</category>
      <category domain="http://securityratty.com/tag/spam filters">spam filters</category>
      <category domain="http://securityratty.com/tag/spam">spam</category>
      <category domain="http://securityratty.com/tag/huge email databases">huge email databases</category>
      <category domain="http://securityratty.com/tag/anti spam filters">anti spam filters</category>
      <category domain="http://securityratty.com/tag/mail spacegmail spacecom">mail spacegmail spacecom</category>
      <category domain="http://securityratty.com/tag/mail">mail</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/375213353/automatic-email-harvesting-20.html">Automatic Email Harvesting 2.0</source>
    </item>
    <item>
      <title><![CDATA[Lost.....and Found]]></title>
      <link>http://securityratty.com/article/1315aa8a559dddd4479c65bf88b0f2fc</link>
      <guid>http://securityratty.com/article/1315aa8a559dddd4479c65bf88b0f2fc</guid>
      <description><![CDATA[The practice of affiliates signing up with Zango then hiding pirated movies behind their installer prompt ([ 1 ], [ 2 ]) takes another twist, as we go hunting for TV episodes instead of movies and...]]></description>
      <content:encoded><![CDATA[
        The practice of affiliates signing up with Zango then hiding pirated movies behind their installer prompt ([<a href="http://blog.spywareguide.com/2008/08/a-dark-knight-for-zango.html">1</a>], [<a href="http://blog.spywareguide.com/2008/08/another-site-hiding-pirate-mov.html">2</a>]) takes another twist, as we go hunting for TV episodes instead of movies and find....<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/zan1.html" onclick="window.open('http://blog.spywareguide.com/images/zan1.html','popup','width=982,height=581,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/zan1-thumb-382x226.gif" alt="zan1.gif" class="mt-image-none" style="" height="226" width="382" /></a></span><br /> </div><div><div align="center">Click to Enlarge<br /></div><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/zan2.html" onclick="window.open('http://blog.spywareguide.com/images/zan2.html','popup','width=949,height=570,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/zan2-thumb-349x209.gif" alt="zan2.gif" class="mt-image-none" style="" height="209" width="349" /></a></span><br /></div></div><div><div align="center">Click to Enlarge<br /></div><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/zan3.html" onclick="window.open('http://blog.spywareguide.com/images/zan3.html','popup','width=948,height=584,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/zan3-thumb-348x214.gif" alt="zan3.gif" class="mt-image-none" style="" height="214" width="348" /></a></span><br /></div></div><div><div align="center">Click to Enlarge<br /></div><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/zan4.html" onclick="window.open('http://blog.spywareguide.com/images/zan4.html','popup','width=841,height=584,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/zan4-thumb-341x236.gif" alt="zan4.gif" class="mt-image-none" style="" height="236" width="341" /></a></span><br /></div></div><div><div align="center">Click to Enlarge<br /></div><br />......TV shows (apparently ripped and streamed from Chinese Youtube-style websites), hidden behind Zango installer prompts. Obviously, this is something of a mini industry we have here but I'm faintly alarmed that so many of these affiliates are happily churning out these kinds of sites. I'm also pretty sure Zango doesn't want people seeing what effectively says "Free ripped off movies online sponsored by Zango" on their installer prompts, either.<br /><br />As a side note, it's not just Zango affiliates doing this - here's another example, this time for something called "Cpalead.com" that wants you to fill in a survey in return for seeing "free" episodes of Lost:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/cpal1.html" onclick="window.open('http://blog.spywareguide.com/images/cpal1.html','popup','width=836,height=603,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/cpal1-thumb-336x242.gif" alt="cpal1.gif" class="mt-image-none" style="" height="242" width="336" /></a></span><br />Click to Enlarge<br /></div><br />In case you were wondering, my monitor isn't broken, they just grey out the page when the popup appears. The Lost episodes appear to be ripped by end-users and uploaded to Megavideo.com.<br /><br />The sites above are<br /><br />lost-stream(dot)com<br />ietv(dot)co.uk/category/watch-lost-online<br />watchprisonbreakonlinefree(dot)com<br />watch-lost-online(dot)info<br />www.heroesstreaming(dot)com<br /><br />I guess I ended up with a trilogy after all.<br /></div><div><br /></div>
        
    ]]></content:encoded>
      <pubDate>Fri, 15 Aug 2008 10:20:17 +0000</pubDate>
      <category domain="http://securityratty.com/tag/zango installer prompts">zango installer prompts</category>
      <category domain="http://securityratty.com/tag/installer prompts">installer prompts</category>
      <category domain="http://securityratty.com/tag/lost">lost</category>
      <category domain="http://securityratty.com/tag/zango">zango</category>
      <category domain="http://securityratty.com/tag/tv episodes">tv episodes</category>
      <category domain="http://securityratty.com/tag/episodes">episodes</category>
      <category domain="http://securityratty.com/tag/enlarge">enlarge</category>
      <category domain="http://securityratty.com/tag/click">click</category>
      <category domain="http://securityratty.com/tag/dot">dot</category>
      <source url="http://blog.spywareguide.com/2008/08/lostand-found.html">Lost.....and Found</source>
    </item>
    <item>
      <title><![CDATA[Spamblogs Pushing Rogue Antivirus Programs]]></title>
      <link>http://securityratty.com/article/b6b356c5aefde884fbcf56de64cf84ab</link>
      <guid>http://securityratty.com/article/b6b356c5aefde884fbcf56de64cf84ab</guid>
      <description><![CDATA[Nothing earth-shattering, but worth a mention anyway. I've noticed a couple of blogs pushing security blog feeds are also hawking pretend Youtube vids





Click to Enlarge

When the videos are...]]></description>
      <content:encoded><![CDATA[
        Nothing earth-shattering, but worth a mention anyway. I've noticed a couple of blogs pushing security blog feeds are also hawking pretend Youtube vids:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/sblog1.html" onclick="window.open('http://blog.spywareguide.com/images/sblog1.html','popup','width=755,height=622,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/sblog1-thumb-355x292.jpg" alt="sblog1.jpg" class="mt-image-none" style="" height="292" width="355" /></a></span><br /> </div><div><div align="center">Click to Enlarge<br /></div><br />When the videos are clicked, you'll find your browser vanishes down onto the taskbar, replaced by this sitting in the middle of the screen:<br /><br /><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="sblog2.jpg" src="http://blog.spywareguide.com/images/sblog2.jpg" class="mt-image-none" style="" height="146" width="540" /></span><br /><br />Once you click the popup box away, you're confronted with this:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/sblog3.html" onclick="window.open('http://blog.spywareguide.com/images/sblog3.html','popup','width=790,height=585,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/sblog3-thumb-390x288.jpg" alt="sblog3.jpg" class="mt-image-none" style="" height="288" width="390" /></a></span><br /><br />Click to Enlarge<br /></div><br />...a randomly selected rogue antivirus product. From here on it, any and all attempts to get rid of this page results in an endless barrage of popups, scare tactics ad hilariously lame warning messages (note the first one is called a "Security Update"):<br /><br /><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="sblog4.jpg" src="http://blog.spywareguide.com/images/sblog4.jpg" class="mt-image-none" style="" height="265" width="436" /></span><br /><br /><br /><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="sblog5.jpg" src="http://blog.spywareguide.com/images/sblog5.jpg" class="mt-image-none" style="" height="121" width="336" /></span><br /></div><div><br /><br /><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="sblog6.jpg" src="http://blog.spywareguide.com/images/sblog6.jpg" class="mt-image-none" style="" height="173" width="507" /></span><br /></div><div><br /><br /><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="sblog7.jpg" src="http://blog.spywareguide.com/images/sblog7.jpg" class="mt-image-none" style="" height="191" width="533" /></span><br /></div><div><br />Wow, they just get more and more hysterical, don't they?<br /><br />The site to block that's pimping the fake videos is<br /><br />thoughtcrime(dot)blogtodo(dot)com<br /></div>
        
    ]]></content:encoded>
      <pubDate>Mon, 11 Aug 2008 14:50:05 +0000</pubDate>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/security blog feeds">security blog feeds</category>
      <category domain="http://securityratty.com/tag/rogue antivirus product">rogue antivirus product</category>
      <category domain="http://securityratty.com/tag/click">click</category>
      <category domain="http://securityratty.com/tag/videos">videos</category>
      <category domain="http://securityratty.com/tag/pretend youtube vids">pretend youtube vids</category>
      <category domain="http://securityratty.com/tag/fake videos">fake videos</category>
      <category domain="http://securityratty.com/tag/scare tactics">scare tactics</category>
      <category domain="http://securityratty.com/tag/endless barrage">endless barrage</category>
      <source url="http://blog.spywareguide.com/2008/08/spamblogs-pushing-rogue-antivi.html">Spamblogs Pushing Rogue Antivirus Programs</source>
    </item>
    <item>
      <title><![CDATA[On TV Warfare]]></title>
      <link>http://securityratty.com/article/7aa61433eb4c92c880feff4e75ceeba8</link>
      <guid>http://securityratty.com/article/7aa61433eb4c92c880feff4e75ceeba8</guid>
      <description><![CDATA[It is simply amazing that all the countries now &quot;get it&quot; that war happens primarily on TV ( this vs this ; many other examples are around). It is also amazing that there is NO way to know where &quot;media...]]></description>
      <content:encoded><![CDATA[<p>It is simply amazing that all the countries now &quot;get it&quot; that war happens primarily on TV (<a href="http://www.nytimes.com/2008/08/12/world/europe/12georgia.html?_r=1&amp;pagewanted=2&amp;bl&amp;ei=5087&amp;en=b5bf8c5e2c630491&amp;ex=1218600000&amp;oref=slogin">this</a> vs <a href="http://www.themoscowtimes.com/article/600/42/369720.htm">this</a>; many other examples are around). It is also amazing that there is NO way to know where &quot;media reporting&quot; ends and &quot;psyops&quot; begin. So, a burning tank with no clear markings that you see on TV might be:</p>  <ol>   <li>Tank belonging to warring side A</li>    <li>Tank belonging to warring side B</li>    <li>Just a tank that was passing by and got hit by mistake :-)</li>    <li>Something that looks like a burning tank</li>    <li>An archive shot that reporter added for visual impact</li> </ol>  <p>Same applies to the &quot;primary weapon&quot; of a modern TV war: &quot;evidence of atrocities of the opposing side.&quot;</p>  <p>What's the truth? Who knows... progress brought us &quot;TV wars,&quot;&#160; is this the first <a href="http://www.defensetech.org/archives/004355.html">&quot;YouTube war&quot;?</a> But if we cannot believe the media coverage, how can we believe a random video online? Well ...&#160; maybe the same way we often believe Wikipedia over Britannica.&#160; </p>  <p>In any case, if there was a better time to turn off the TV (and tune off the web news...), it would be now. Also, time to get the dust off my <a href="http://www.amazon.com/War-Anti-War-Making-Todays-Global/dp/0446602590">copy of Toffler?</a></p>  <p>Rant mode off :-)</p>  <div class="blogger-post-footer">About me: http://www.chuvakin.org</div><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=eQOSbK"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=eQOSbK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=ZcEx8K"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=ZcEx8K" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=a86LNK"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=a86LNK" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~4/362457461" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 11 Aug 2008 13:41:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/tv">tv</category>
      <category domain="http://securityratty.com/tag/tv wars">tv wars</category>
      <category domain="http://securityratty.com/tag/modern tv war">modern tv war</category>
      <category domain="http://securityratty.com/tag/war">war</category>
      <category domain="http://securityratty.com/tag/youtube war">youtube war</category>
      <category domain="http://securityratty.com/tag/tank">tank</category>
      <category domain="http://securityratty.com/tag/media coverage">media coverage</category>
      <category domain="http://securityratty.com/tag/media">media</category>
      <category domain="http://securityratty.com/tag/random video online">random video online</category>
      <source url="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~3/362457461/on-tv-warfare.html">On TV Warfare</source>
    </item>
    <item>
      <title><![CDATA[Pedal to the metal NAC]]></title>
      <link>http://securityratty.com/article/7521a3b0531ce4d781c478df46961baf</link>
      <guid>http://securityratty.com/article/7521a3b0531ce4d781c478df46961baf</guid>
      <description><![CDATA[OK, I am not really a big car racing fan. I dont know, Long Island was not a NASCAR hot bed. Of course the Indy 500 was always big news. In any event I have become much more of a race fan since Chip...]]></description>
      <content:encoded><![CDATA[
<div xmlns="http://www.w3.org/1999/xhtml"><p>OK, I am not really a big car racing fan.&nbsp; I don’t know, Long Island was not a NASCAR hot bed. Of course the Indy 500 was always big news.&nbsp; In any event I have become much more of a race fan since Chip Ganassi racing became a StillSecure customer.&nbsp; They are using a complete NAC solution that performs both pre and post connect testing. Racing today is not about some gearheads putting in spark plugs and changing tires.&nbsp; It is high, hi-tech and their information security needs to protect their IP are high priority.&nbsp; </p>

<p>Rather than the usual case study, our VP of marketing Jayson Ayers actually tried something new.&nbsp; A video case study is what we have done.&nbsp; I think it is pretty cool and in the spirit of the YouTube generation, am embedding it here.&nbsp; You can read more about this <a href="http://www.stillsecure.com/library/case_studies/ganassi.php">on our site here</a>.</p>

<table cellspacing="0" cellpadding="2" width="400" border="0"><tbody><tr><td valign="top" width="200"><a href="http://www.stillsecureafteralltheseyears.com/ashimmy/WindowsLiveWriter/image.png"><img title="image" height="346" alt="image" src="http://www.stillsecureafteralltheseyears.com/ashimmy/WindowsLiveWriter/image_thumb.png" width="274" border="0" style="BORDER-RIGHT: 0px; BORDER-TOP: 0px; BORDER-LEFT: 0px; BORDER-BOTTOM: 0px" /></a> </td>

<td valign="top" width="200"><embed src="http://www.youtube.com/v/cTNNDnXPkUo&amp;hl=en&amp;fs=1" width="425" height="344" type="application/x-shockwave-flash" allowfullscreen="true"></embed></td></tr></tbody></table></div>

<p><a href="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?a=tRam5k"><img src="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?i=tRam5k" border="0"></img></a></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=7ARydK"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=7ARydK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=LIqnKK"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=LIqnKK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=VIW8dK"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=VIW8dK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=jLzWYK"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=jLzWYK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=JRWh9k"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=JRWh9k" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=gDfMWk"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=gDfMWk" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~4/359748366" height="1" width="1"/>]]></content:encoded>
      <pubDate>Fri, 08 Aug 2008 12:01:03 +0000</pubDate>
      <category domain="http://securityratty.com/tag/fan">fan</category>
      <category domain="http://securityratty.com/tag/race fan">race fan</category>
      <category domain="http://securityratty.com/tag/nascar hot bed">nascar hot bed</category>
      <category domain="http://securityratty.com/tag/complete nac solution">complete nac solution</category>
      <category domain="http://securityratty.com/tag/stillsecure customer">stillsecure customer</category>
      <category domain="http://securityratty.com/tag/youtube generation">youtube generation</category>
      <category domain="http://securityratty.com/tag/jayson ayers">jayson ayers</category>
      <category domain="http://securityratty.com/tag/study">study</category>
      <category domain="http://securityratty.com/tag/chip ganassi">chip ganassi</category>
      <source url="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~3/359748366/pedal-to-the-me.html">Pedal to the metal NAC</source>
    </item>
    <item>
      <title><![CDATA[Listening to the evidence]]></title>
      <link>http://securityratty.com/article/cb3684b9bd257e429791aaa34c5339e3</link>
      <guid>http://securityratty.com/article/cb3684b9bd257e429791aaa34c5339e3</guid>
      <description><![CDATA[Last week the House of Commons Culture, Media and Sport Select Committee published a report of their inquiry into Harmful content on the Internet and in video games . They make a number of...]]></description>
      <content:encoded><![CDATA[<p>Last week the <a href="http://www.parliament.uk/parliamentary_committees/culture__media_and_sport.cfm">House of Commons Culture, Media and Sport Select Committee</a> published a report of their inquiry into &#8220;<a href="http://www.publications.parliament.uk/pa/cm200708/cmselect/cmcumeds/353/353.pdf">Harmful content on the Internet and in video games</a>&#8220;. They make a number of recommendations including a self-regulatory body to set rules for Internet companies to force them to protect users; that sites should provide a &#8220;watershed&#8221; so that grown-up material cannot be viewed before 9pm; that YouTube should screen material for forbidden content; that &#8220;<a href="http://www.spiked-online.com/index.php?/site/article/4633/">suicide websites</a>&#8221; should be blocked; that ISPs should be forced to block child sexual abuse image websites whatever the cost, and that blocking of bad content was generally desirable.</p>
<p>You will discern a certain amount of enthusiasm for blocking, and for a &#8220;<a href="http://www.yes-minister.com/polterms.htm#Politicians">something must be done</a>&#8221; approach. However, in coming to their conclusions, they do not, in my view, seem to have listened too hard to the evidence, or sought out expertise elsewhere in the world&#8230;<br />
<span id="more-351"></span><br />
Google/YouTube told them that 10 hours of video was posted every minute, and the amount is increasing. In the oral evidence session an MP helpfully suggested: &#8220;That video content is tagged. You do not need to look at every single minute of video content. Surely you could have people who would look at the video content which is tagged with labels which suggest it could be inappropriate.&#8221; Of course &#8220;<a href="http://lostria.blogspot.com/2008/01/fertility-slaps.html">happy_slapping.wmv</a>&#8221; or &#8220;<a href="http://www.phrases.org.uk/meanings/bunny-boiler.html">fluffy_bunnies.avi</a>&#8221; must always contain exactly what it says on the tin (<a href="http://en.wikipedia.org/wiki/Not%21">not!</a>) but unaccountably Google said it was a &#8220;fair suggestion&#8221;, so perhaps my cynicism is misplaced.</p>
<p>However, back to blocking.</p>
<p>I submitted <a href="http://www.cl.cam.ac.uk/~rnc1/080129-cms.pdf">some evidence of my own</a>, which the committee summarised, reasonably accurately:</p>
<blockquote><p>Dr Richard Clayton, a researcher in the Security Group of the Computer Laboratory at Cambridge University and author of several academic papers on methods for blocking access to Internet content, pointed out that there was no single blocking method which was both inexpensive and discerning enough to block access to only one part of a large website (such as FaceBook). In his view, the fatal flaw of all network-level blocking schemes was the ease with which they could be overcome, either by encrypting content or by the use of proxy services hosted outside the UK.</p></blockquote>
<p>The committee&#8217;s conclusion, having read this was:</p>
<blockquote><p>At a time of rapid technological change, it is difficult to judge whether blocking access to Internet content at network level by Internet service providers is likely to become ineffective in the near future. However, this is not a reason for not doing so while it is still effective for the overwhelming majority of users.</p></blockquote>
<p>which I suppose logically means that the committee thinks that blocking should now be discarded as a policy option &#8212; but somehow I think that isn&#8217;t their intended meaning.</p>
<p>The Committee should perhaps have a look at <a href="http://www.acma.gov.au/webwr/_assets/main/lib310554/isp-level_internet_content_filtering_trial-report.pdf">this Australian report</a>, which found that ISP level content filtering (and in Australia the politicians want to use ISP level filtering to provide a child-friendly Internet) did work (up to a point) at Tier 3 (the smallest) ISPs. The <a href="http://en.wikiquote.org/wiki/Evelyn_Waugh#Scoop_.281938.29">up-to-a-point</a> is that unlike previous tests the systems didn&#8217;t completely wreck the browsing experience by slowing it down. However, the systems blocked only 85-98% of illegal material and similar percentages of material suitable for adults but not for younger children. Interestingly some products were better at different categories.</p>
<p>Getting that many sites wrong is really quite significant, so it&#8217;s difficult to see this as a ringing endorsement for blocking the web. Additionally, the Australian report found that the blocking was useless on &#8220;non-web&#8221; protocols (such as peer-to-peer) and their report specifically didn&#8217;t consider cost, or ease of circumvention &#8212; so it&#8217;s not just UK politicians not wanting to consider evidence on that topic!</p>
<p>Finally, I should note that the Culture Media and Sport Committee has also ignored some rather more recent academic work. The MPs have put into their report that they were horrified to discover that child sexual abuse images took 24 hours to remove in the UK. What (should they ever learn of it) will they make of the recent discovery by <a href="http://people.seas.harvard.edu/~tmoore/">Tyler Moore</a> and myself that shows that if the website is hosted abroad then <a href="http://www.lightbluetouchpaper.org/2008/06/11/slow-removal-of-child-sexual-abuse-image-websites/">a month is more to be expected</a>?</p>
]]></content:encoded>
      <pubDate>Thu, 07 Aug 2008 20:24:33 +0000</pubDate>
      <category domain="http://securityratty.com/tag/content">content</category>
      <category domain="http://securityratty.com/tag/isp level content">isp level content</category>
      <category domain="http://securityratty.com/tag/video games">video games</category>
      <category domain="http://securityratty.com/tag/video">video</category>
      <category domain="http://securityratty.com/tag/bad content">bad content</category>
      <category domain="http://securityratty.com/tag/video content">video content</category>
      <category domain="http://securityratty.com/tag/internet">internet</category>
      <category domain="http://securityratty.com/tag/evidence">evidence</category>
      <category domain="http://securityratty.com/tag/child-friendly internet">child-friendly internet</category>
      <source url="http://www.lightbluetouchpaper.org/2008/08/08/listening-to-the-evidence/">Listening to the evidence</source>
    </item>
    <item>
      <title><![CDATA[Strange Digg.com Spamming]]></title>
      <link>http://securityratty.com/article/7756a909ad9e37edfadb259e480b7179</link>
      <guid>http://securityratty.com/article/7756a909ad9e37edfadb259e480b7179</guid>
      <description><![CDATA[I saw this in the security section earlier today






Click to Enlarge

Each one links to a page on a website called Tubeteases(dot)com, and each page streams a Youtube video - usually females...]]></description>
      <content:encoded><![CDATA[
        I saw this in the security section earlier today:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/diggspam1.html" onclick="window.open('http://blog.spywareguide.com/images/diggspam1.html','popup','width=699,height=579,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/diggspam1-thumb-399x330.jpg" alt="diggspam1.jpg" class="mt-image-none" style="" height="330" width="399" /></a></span><br /> </div><div><div align="center"><br />Click to Enlarge<br /></div><br />Each one links to a page on a website called Tubeteases(dot)com, and each page streams a Youtube video - usually females bouncing around in various states of undress.<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/diggspam2.html" onclick="window.open('http://blog.spywareguide.com/images/diggspam2.html','popup','width=715,height=612,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/diggspam2-thumb-315x269.jpg" alt="diggspam2.jpg" class="mt-image-none" style="" height="269" width="315" /></a></span><br /></div></div><div><div align="center"><br />Click to Enlarge<br /></div><br />Usually with spam like this, there's a financial incentive - however, I'm having a hard time working out what the motive is here. There are no clickable ads to make money from on the site - it's just page after page of miniaturised Youtube clips.<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/diggspam3.html" onclick="window.open('http://blog.spywareguide.com/images/diggspam3.html','popup','width=771,height=610,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/diggspam3-thumb-371x293.jpg" alt="diggspam3.jpg" class="mt-image-none" style="" height="293" width="371" /></a></span><br /></div></div><div><div align="center"><br />Click to Enlarge<br /></div><br />No popups, no flashing banners, no mousetraps.....nothing.<br /><br />I thought I'd worked it out when I scrolled down the page and saw a large advert for a webcam site. Aha! Obviously the gimmick is luring you to the above video site then get you to pay up for webcam access, right?<br /><br />Well, not exactly...<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/diggspam4.html" onclick="window.open('http://blog.spywareguide.com/images/diggspam4.html','popup','width=615,height=422,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/diggspam4-thumb-315x216.jpg" alt="diggspam4.jpg" class="mt-image-none" style="" height="216" width="315" /></a></span><br /></div></div><div><div align="center"><br />Click to Enlarge<br /></div><br />...."Free"? Oh dear, this isn't going well. They don't even have the advert for the webcam site at the top of the page, it's stuffed down at the bottom somewhere so I can't even claim "in-your-face" advertising.<br /><br />At the very bottom, I saw a set of weblinks to other sites - surely this is the gimmick then? Entice potential webmasters to pay up for links placed on-site? Well, as it turns out, no. Clicking the "free slots available" link simply takes you to a page offering a free link placement script.<br /><br />Normally spam = profit. Here though, I can't see that this follows the usual pattern. Perhaps someone woke up feeling philanthropic and randomly decided the best course of action for Digg.com users was watching hundreds of postage-stamp sized clips of semi-naked females.<br /><br />We can tell them off for spamming Digg though, so we've got them there...<br /></div>
        
    ]]></content:encoded>
      <pubDate>Wed, 06 Aug 2008 03:51:10 +0000</pubDate>
      <category domain="http://securityratty.com/tag/page">page</category>
      <category domain="http://securityratty.com/tag/page streams">page streams</category>
      <category domain="http://securityratty.com/tag/video site">video site</category>
      <category domain="http://securityratty.com/tag/site">site</category>
      <category domain="http://securityratty.com/tag/on-site">on-site</category>
      <category domain="http://securityratty.com/tag/webcam site">webcam site</category>
      <category domain="http://securityratty.com/tag/digg">digg</category>
      <category domain="http://securityratty.com/tag/enlarge">enlarge</category>
      <category domain="http://securityratty.com/tag/click">click</category>
      <source url="http://blog.spywareguide.com/2008/08/strange-diggcom-spamming.html">Strange Digg.com Spamming</source>
    </item>
    <item>
      <title><![CDATA[The Twitter Malware Campaign Wants to Bank With You]]></title>
      <link>http://securityratty.com/article/0a86c9e6b40c8995b8c3f84a2d12480a</link>
      <guid>http://securityratty.com/article/0a86c9e6b40c8995b8c3f84a2d12480a</guid>
      <description><![CDATA[In what appears to be a lone gunman malware campaign -- where the malware spreader even left his email address within the binary - the now down Twitter malware campaign managed to attract only 69...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="text-align: center; clear: both;"></div><a href="http://bp0.blogger.com/_wICHhTiQmrA/SJgk-RghwII/AAAAAAAAB_c/xbrYBDO4K9Q/s1600-h/twitter_malware1.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp0.blogger.com/_wICHhTiQmrA/SJgk-RghwII/AAAAAAAAB_c/om2-uxKUmR4/s200-R/twitter_malware1.JPG" style="border: 0pt none ;" /></a>In <a href="http://www.twitpwn.com/2008/08/coming-up-malware-on-twitter.html">what appears to</a> be a lone gunman <a href="http://www.viruslist.com/en/weblog?weblogid=208187551">malware campaign</a> -- where the malware spreader even left his email address within the binary - the now down <a href="http://blogs.guardian.co.uk/technology/2008/08/05/twiters_trojan_problem.html">Twitter malware campaign</a> managed to attract only 69 followers before it has shut down, <a href="http://www.techcrunch.com/2008/07/27/who-is-johng77536-and-how-did-he-game-twitter/">using a trivial approach</a> for launching an XSS worm - <a href="http://en.wikipedia.org/wiki/Cross-site_request_forgery">Cross-site request forgery</a> (CSRF). More info :<br />
<br />
"<i>This week it’s Twitter’s turn to host an attack - one that is targeting both Twitter users and the Internet community at large. In this case it's a malicious Twitter profile twitter.com/[skip]/ with a name that is Portuguese for ‘pretty rabbit’ which has a photo advertising a video with girls posted.&nbsp;</i><br />
<br />
<i>This profile has obviously been created especially for infecting users, as there is no other data except the photo, which contains the link to the video. If you click on the link, you get a window that shows the progress of an automatic download of a so-called new version of Adobe Flash which is supposedly required to watch the video. You end up with a file labeled Adobe Flash (it’s a fake) on your machine; a technique that is currently very popular.</i>"<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="text-align: center; clear: both;"></div><a href="http://bp0.blogger.com/_wICHhTiQmrA/SJg7qxrXS-I/AAAAAAAAB_k/X5JjQEBfcgc/s1600-h/twitter_malware.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp0.blogger.com/_wICHhTiQmrA/SJg7qxrXS-I/AAAAAAAAB_k/tnrV5eIbz1M/s200-R/twitter_malware.JPG" style="border: 0pt none ;" /></a>Let's analyze the campaign before it was shut down. The original Twitter account used <b>twitter.com/video_kelly_key</b> basically included a link to <b>player-video-youtube.sytes.net</b> (204.16.252.98) which was using a URL shortening service <b>fly2.ws/NilOMN3</b> in order to redirect to the banker malware located at <b>freewebtown.com/construimagens/ Play-video-youtube.kelly-key.com</b>. It's detection rate is as follows :<br />
<br />
<b>Scanners Result</b>: 14/36 (38.89%)<br />
Trojan-Spy.Win32.Banker.caw <br />
<b>File size</b>: 88064 bytes<br />
<b>MD5</b>...: 25600af502758ca992b9e7fff3739def<br />
<b>SHA1</b>..: 9262ca501ef388e0fe42c50a3d002ddbd6e254f2<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="text-align: center; clear: both;"></div><a href="http://bp3.blogger.com/_wICHhTiQmrA/SJg8dgf3PnI/AAAAAAAAB_s/zemAG6fn3rM/s1600-h/xss_csrfworm.png" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp3.blogger.com/_wICHhTiQmrA/SJg8dgf3PnI/AAAAAAAAB_s/lOjia4dpUaw/s200-R/xss_csrfworm.png" style="border: 0pt none ;" /></a>Twitter isn't an exception to the realistic potential for <a href="http://0x000000.com/index.php?i=512&amp;bin=1000000000">XSS worms though CSRF that could affect each and every Web 2.0 service</a>, which as a matter of fact have all suffered such attempts, namely, <a href="http://ha.ckers.org/blog/20071220/orkut-xss-worm" title="Orkut XSS Worm">Orkut</a>, <a href="http://en.wikipedia.org/wiki/Samy_%28XSS%29" title="Samy MySpace XSS Worm">MySpace</a> (as well as the <a href="http://securitylabs.websense.com/content/Alerts/1319.aspx" title="MySpace QuickTime XSS Flaw">QuickTime XSS flaw</a>), <a href="http://blogs.securiteam.com/index.php/archives/786" title="GaiaOnline XSS Worm">GaiaOnline</a>, <a href="http://sirdarckcat.blogspot.com/2007/12/making-social-network-xss-worm-hi5com.html" title="Hi5 XSS Worm">Hi5</a>, and most recently the <a href="http://blogs.zdnet.com/security/?p=1487">XSS worm at Justin.tv</a>, demonstrate that trivial vulnerabilities come handy for what's to turn into a major security incident if not taken care of promptly.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2007/05/xss-planet.html">XSS The Planet</a><br />
<a href="http://ddanchev.blogspot.com/2007/02/xss-vulnerabilities-in-e-banking-sites.html">XSS Vulnerabilities in E-banking Sites</a><br />
<a href="http://ddanchev.blogspot.com/2006/05/current-state-of-web-application-worms.html">The Current State of Web Application Worms</a><br />
<a href="http://ddanchev.blogspot.com/2007/06/g0t-xssed.html">g0t XSSed?</a><br />
<a href="http://ddanchev.blogspot.com/2006/06/web-application-email-harvesting-worm.html">Web Application Email Harvesting Worm </a><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=oWAtgK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=oWAtgK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=L5UJoK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=L5UJoK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=dlgqak"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=dlgqak" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=3uAsZk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=3uAsZk" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=YHdd5K"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=YHdd5K" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=AezGSK"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=AezGSK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=JZQeBk"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=JZQeBk" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/356281978" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 05 Aug 2008 03:14:42 +0000</pubDate>
      <category domain="http://securityratty.com/tag/twitter">twitter</category>
      <category domain="http://securityratty.com/tag/twitter malware campaign">twitter malware campaign</category>
      <category domain="http://securityratty.com/tag/xss">xss</category>
      <category domain="http://securityratty.com/tag/xss vulnerabilities">xss vulnerabilities</category>
      <category domain="http://securityratty.com/tag/original twitter account">original twitter account</category>
      <category domain="http://securityratty.com/tag/xss worms">xss worms</category>
      <category domain="http://securityratty.com/tag/xss worm">xss worm</category>
      <category domain="http://securityratty.com/tag/twitter users">twitter users</category>
      <category domain="http://securityratty.com/tag/worm">worm</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/356281978/twitter-malware-campaign-wants-to-bank.html">The Twitter Malware Campaign Wants to Bank With You</source>
    </item>
  </channel>
</rss>
