<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: avoid]]></title>
    <link>http://www.securityratty.com/tag/avoid</link>
    <description></description>
    <pubDate>Fri, 24 Oct 2008 10:25:00 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Pentagon hacker tries one more time to avoid extradition]]></title>
      <link>http://www.securityratty.com/article/9bdae2ef7e4cd2d4485a4f2c2df83182</link>
      <guid>http://www.securityratty.com/article/9bdae2ef7e4cd2d4485a4f2c2df83182</guid>
      <description><![CDATA[A British systems administrator who hacked into U.S. military computers in 2001 and 2002 will have another chance to make his case of why he shouldn't be extradited to the...]]></description>
      <content:encoded><![CDATA[A British systems administrator who hacked into U.S. military computers in 2001 and 2002 will have another chance to make his case of why he shouldn't be extradited to the U.S.<br style="clear: both;"/>
  <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:bffac8453adb09cd601a6f2e01a64726:w0T456MduBpBBp6SppwV0xBQjCotrOsbyI5Z0nrM9gfxREg9xNeLCKSCSrKqVJLlpzqkL4c08s2s'><img border='0' title='Add to digg' alt='Add to digg' src='http://www.pheedo.com/images/mm/digg.gif'/></a>
  <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:3378e4dbe3a4e4d2bc4bbbc191cb6263:Cz4tJ%2BKi3OTH14RP3l1inRoBnuAXvmT%2FlcUqAJo7ckB2S4Ydiuy2cyAtxGFweKijoau5NCGHPWyq%2Fg%3D%3D'><img border='0' title='Add to StumbleUpon' alt='Add to StumbleUpon' src='http://www.pheedo.com/images/mm/stumbleit.gif'/></a>
  <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:c35a1400e072cc736a52aea3d174398d:ae96%2FVlt4Xf0KfSUapYQQilD3ZKpM7H%2FNBKouniHmGpsYGp1uL12Na%2Fz5HhNBXDfEvDqlA1z%2FWfq9w%3D%3D'><img border='0' title='Add to Twitter' alt='Add to Twitter' src='http://www.pheedo.com/images/mm/twitter.png'/></a>
  <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:5d70045c7235096862a43fe03a27730a:dRYLLcONrTfT2o%2F428UvD7sQ7vleKLQsti2qqQeudofAzqyeY3cPjpDbjX83x9HoHHye31JRTlxzVQ%3D%3D'><img border='0' title='Add to Slashdot' alt='Add to Slashdot' src='http://www.pheedo.com/images/mm/slashdot.png'/></a>
<br style="clear: both;"/>
<a href="http://www.pheedo.com/click.phdo?s=6fb32c7cc9fb42aa1ab4a13cb7fd7cb7&p=1"><img alt="" style="border: 0;" border="0" src="http://www.pheedo.com/img.phdo?s=6fb32c7cc9fb42aa1ab4a13cb7fd7cb7&p=1"/></a>
<img src="http://www.pheedo.com/feeds/tracker.php?i=6fb32c7cc9fb42aa1ab4a13cb7fd7cb7" style="display: none;" border="0" height="1" width="1" alt=""/>
]]></content:encoded>
      <pubDate>Wed, 03 Dec 2008 02:00:00 +0000</pubDate>
      <category domain="http://www.securityratty.com/tag/british systems administrator">british systems administrator</category>
      <category domain="http://www.securityratty.com/tag/military computers">military computers</category>
      <category domain="http://www.securityratty.com/tag/chance">chance</category>
      <source url="http://feeds.computerworld.com/click.phdo?i=6fb32c7cc9fb42aa1ab4a13cb7fd7cb7">Pentagon hacker tries one more time to avoid extradition</source>
    </item>
    <item>
      <title><![CDATA[Its not just about a strong password any more]]></title>
      <link>http://www.securityratty.com/article/a700eb95d1070aedb5ab5ff1520c6ac9</link>
      <guid>http://www.securityratty.com/article/a700eb95d1070aedb5ab5ff1520c6ac9</guid>
      <description><![CDATA[Make sure, as discussed in this great article, that you have a hard to guess login name


clipped from www.pcworld.com

Logins Are Half Your Access


Thieves need the login and password to access your...]]></description>
      <content:encoded><![CDATA[<div > Make sure, as discussed in this great article, that you have a hard to guess login name.<br/> </div>
<table cellpadding="0" cellspacing="0" width="100%" style="margin: 12px 0px; font-family: arial; color: #333333; background: #ffffff; border: solid 4px #e5e5e5; width: 100%; clear: left;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" class="CM_CTB_Content_Wrap" style="margin: 0px; padding: 0px;background-color: #ffffff;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" style="border-bottom: solid 1px #dcdcdc; white-space: nowrap; margin-bottom: 8px; background-color: #eeeeee ;background-image: url(http://clipmarks.com/images/source-bg.gif); background-repeat: repeat-x; height: 24px; line-height: 24px; vertical-align: middle; padding-bottom: 4px; color: #666666; font-size: 10px;">
<tr>
<td valign="top"><a href="http://clipmarks.com/clipmark/C3ADC4F0-095C-4746-A0AA-F115F73B0989/" title="go to this clipmark"><img src="http://content.clipmarks.com/blog_icon/e8d56bc8-ccab-4b20-b493-6238be719143/C3ADC4F0-095C-4746-A0AA-F115F73B0989/" alt="" width="19" height="19" border="0" style="vertical-align: middle; margin: 0px 4px; display: inline; border: none; float:none;" /></a>clipped from <a title="http://www.pcworld.com/article/154538/article.html?tk=nl_spxblg" href="http://www.pcworld.com/article/154538/article.html?tk=nl_spxblg" style="font-size: 11px;">www.pcworld.com</a></td>
</tr>
</table>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://www.pcworld.com/article/154538/article.html?tk=nl_spxblg -->
<div style="margin: 4px 0px; color: #000000; font-size: 20px;">Logins Are Half Your Access</div>
</td>
</tr>
</table>
<div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://www.pcworld.com/article/154538/article.html?tk=nl_spxblg --><P>Thieves need the login and password to access your accounts, so make the login difficult to guess, too. Avoid a simple, name-based method; add extra numbers, letters, or an ID that&#8217;s entirely different. Ideally, use unique logins (and passwords) for each service to isolate any exposure, should someone breach an account. (At the very least, keep unique logins and passwords for your most sensitive accounts, such as online banking.) While you may have to tell a customer service representative your login on occasion, don&#8217;t share the information without need. And never give anyone a password.</P></td>
</tr>
</table>
</td>
</tr>
</table>
<div style="margin: 0px 6px 6px 4px;">
<table style="font-size: 11px;border-spacing: 0px;padding: 0px;" cellpadding="0" cellspacing="0" width="100%">
<tr>
<td style="background:transparent;border-width:0px;padding:0px;">&nbsp;</td>
<td align="right" style="background:transparent;border-width:0px;padding:0px;width:107px" width="107"><a href="http://clipmarks.com/share/C3ADC4F0-095C-4746-A0AA-F115F73B0989/blog/" title="blog or email this clip"><img src="http://content8.clipmarks.com/images/c2b-foot.png" border="0" alt="blog it" width="107" height="17" style="border-width:0px;padding:0px;margin:0px;" /></a></td>
</tr>
</table>
</div>
</td>
</tr>
</table>
<BR/><MAP name="bdv_RSS_Ad_281108043052"><AREA alt="Feed Ads By BidVertiser.com" shape="poly" coords="0,0,467,0,467,45,315,45,315,59,0,59" href="http://secure.bidvertiser.com/performance/bdv_rss_rd.dbm?pid=165886&amp;bid=400950&amp;PHS=281108043052&amp;click=1" target="_blank" /><AREA alt="Feed Ads By BidVertiser.com" shape="rect" coords="315,45,467,59" href="http://www.bidvertiser.com/bdv/bidvertiser/bdv_ref.dbm?Ref_PID=165886&amp;Ref_Option=main&amp;source=90614506" target="_blank" /></MAP><P><a href="http://secure.bidvertiser.com/performance/bdv_rss_rd.dbm?pid=165886&amp;bid=400950&amp;PHS=281108043052&amp;click=1" target="_blank"><IMG src="http://bdv.bidvertiser.com/BidVertiser.dbm?pid=165886&amp;bid=400950&amp;PHS=281108043052&amp;rssimage=1&amp;rSRC=2" border="0" usemap="#bdv_RSS_Ad_281108043052" /></a></P>]]></content:encoded>
      <pubDate>Fri, 28 Nov 2008 13:30:52 +0000</pubDate>
      <category domain="http://www.securityratty.com/tag/login difficult">login difficult</category>
      <category domain="http://www.securityratty.com/tag/logins">logins</category>
      <category domain="http://www.securityratty.com/tag/login">login</category>
      <category domain="http://www.securityratty.com/tag/unique logins">unique logins</category>
      <category domain="http://www.securityratty.com/tag/password">password</category>
      <category domain="http://www.securityratty.com/tag/customer service representative">customer service representative</category>
      <category domain="http://www.securityratty.com/tag/service">service</category>
      <category domain="http://www.securityratty.com/tag/accounts">accounts</category>
      <category domain="http://www.securityratty.com/tag/sensitive accounts">sensitive accounts</category>
      <source url="http://spywarebiz.com/spywarebizblog/?p=664">Its not just about a strong password any more</source>
    </item>
    <item>
      <title><![CDATA[Links for 2008-11-25 [del.icio.us]]]></title>
      <link>http://www.securityratty.com/article/5f45c605eed2ff767afb830215eb7e3a</link>
      <guid>http://www.securityratty.com/article/5f45c605eed2ff767afb830215eb7e3a</guid>
      <description><![CDATA[The Myth of Software Support Chris Swans Weblog
More On Why I Think Free Microsoft AV Will Be Good For Consumers | securosis.com My belief is that we essentially have both conditions today (low...]]></description>
      <content:encoded><![CDATA[<ul>
<li><a href="http://thestateofme.wordpress.com/2008/11/20/the-myth-of-software-support/">The Myth of Software Support &laquo; Chris Swan&rsquo;s Weblog</a></li>
<li><a href="http://securosis.com/2008/11/25/more-on-why-i-think-free-microsoft-av-will-be-good-for-consumers/">More On Why I Think Free Microsoft AV Will Be Good For Consumers | securosis.com</a><br/>
My belief is that we essentially have both conditions today (low innovation, easy evasion), and the nature of attacks will continue to change rapidly enough to exceed the current capabilities of AV.</li>
<li><a href="http://securosis.com/2008/11/21/idiocy/">Idiocy | securosis.com</a></li>
<li><a href="http://securosis.com/2008/11/19/the-impact-of-free-antivirus-from-microsoft/">The Impact Of Free Antivirus From Microsoft | securosis.com</a><br/>
This gives them enough time to avoid suddenly losing 40% (don’t quote me on that, I’m on an airplane and just guessing) of profits over 12 months. The real losers will be the consumer-only AV companies without diversified portfolios or a larger enterprise base.</li>
<li><a href="http://www.csoonline.com/article/463067/Rich_Mogull_Infosec_Trends_for_">Rich Mogull: 7 Infosec Trends for 2009 - CSO Online - Security and Risk</a></li>
<li><a href="http://news.cnet.com/8301-1001_3-10096254-92.html">Safe bets for IT spending in '09 | Business Tech - CNET News</a><br/>
Second, security management will merge with log management. That works for ArcSight, RSA, LogLogic, and LogRhythm.</li>
<li><a href="http://darkmatterlabs.blogspot.com/2008/11/land-of-confusion.html">Dark Matters: Land of Confusion</a></li>
<li><a href="http://www.internetnews.com/software/article.php/3786036/Enterprise+SaaS+Buyers+Want+More+Than+Uptime.htm">InternetNews Realtime IT News - Enterprise SaaS Buyers Want More Than Uptime</a></li>
<li><a href="http://www.socaltech.com/high_tower_software_shuts_down/s-0018681.html">High Tower Software Shuts Down | socalTECH.com</a><br/>
Aliso Viejo-based High Tower Software, a venture-backed developer of security, compliance, and log management software, has shut down.</li>
</ul><img src="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~4/465834955" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 25 Nov 2008 21:00:00 +0000</pubDate>
      <category domain="http://www.securityratty.com/tag/tower software shuts">tower software shuts</category>
      <category domain="http://www.securityratty.com/tag/log management software">log management software</category>
      <category domain="http://www.securityratty.com/tag/log management">log management</category>
      <category domain="http://www.securityratty.com/tag/tower software">tower software</category>
      <category domain="http://www.securityratty.com/tag/security">security</category>
      <category domain="http://www.securityratty.com/tag/security management">security management</category>
      <category domain="http://www.securityratty.com/tag/larger enterprise base">larger enterprise base</category>
      <category domain="http://www.securityratty.com/tag/enterprise saas buyers">enterprise saas buyers</category>
      <category domain="http://www.securityratty.com/tag/cnet news">cnet news</category>
      <source url="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~3/465834955/anton18">Links for 2008-11-25 [del.icio.us]</source>
    </item>
    <item>
      <title><![CDATA[Dont get a lump of coal this season!]]></title>
      <link>http://www.securityratty.com/article/76b2b4912a579fe9fd9b6d37062635a1</link>
      <guid>http://www.securityratty.com/article/76b2b4912a579fe9fd9b6d37062635a1</guid>
      <description><![CDATA[Make sure your online protection products are working and updated, or you may get a lump of coal this Holiday season


clipped from www.marketwatch.com

Webroot Threat Advisory: Online Threats to...]]></description>
      <content:encoded><![CDATA[<div > Make sure your online protection products are working and updated, or you may get a lump of coal this Holiday season. </div>
<table cellpadding="0" cellspacing="0" width="100%" style="margin: 12px 0px; font-family: arial; color: #333333; background: #ffffff; border: solid 4px #e5e5e5; width: 100%; clear: left;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" class="CM_CTB_Content_Wrap" style="margin: 0px; padding: 0px;background-color: #ffffff;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" style="border-bottom: solid 1px #dcdcdc; white-space: nowrap; margin-bottom: 8px; background-color: #eeeeee ;background-image: url(http://clipmarks.com/images/source-bg.gif); background-repeat: repeat-x; height: 24px; line-height: 24px; vertical-align: middle; padding-bottom: 4px; color: #666666; font-size: 10px;">
<tr>
<td valign="top"><a href="http://clipmarks.com/clipmark/28686275-C882-4C1B-A9E1-759CBA367C2A/" title="go to this clipmark"><img src="http://content.clipmarks.com/blog_icon/1301bf5b-a6cb-4d7a-8eef-aab9911ce964/28686275-C882-4C1B-A9E1-759CBA367C2A/" alt="" width="19" height="19" border="0" style="vertical-align: middle; margin: 0px 4px; display: inline; border: none; float:none;" /></a>clipped from <a title="http://www.marketwatch.com/news/story/Webroot-Threat-Advisory-Online-Threats/story.aspx?guid=%7B006BCB25-0501-4CC4-9D00-0B98C35C8C95%7D" href="http://www.marketwatch.com/news/story/Webroot-Threat-Advisory-Online-Threats/story.aspx?guid=%7B006BCB25-0501-4CC4-9D00-0B98C35C8C95%7D" style="font-size: 11px;">www.marketwatch.com</a></td>
</tr>
</table>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://www.marketwatch.com/news/story/Webroot-Threat-Advisory-Online-Threats/story.aspx?guid=%7B006BCB25-0501-4CC4-9D00-0B98C35C8C95%7D -->
<div style="margin: 4px 0px; color: #000000; font-size: 20px;">Webroot Threat Advisory: Online Threats to Increase This Holiday Season</div>
</td>
</tr>
</table>
<div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://www.marketwatch.com/news/story/Webroot-Threat-Advisory-Online-Threats/story.aspx?guid=%7B006BCB25-0501-4CC4-9D00-0B98C35C8C95%7D --><DIV class="p"><br />
            To protect themselves during any online<br />
      shopping experience, consumers need to be aware of the security<br />
      risks and necessary precautions they should take to avoid being a victim<br />
      of cyber crime. Since the October to December timeframe will be a key<br />
      money-making season for today&#8217;s financially<br />
      motivated cyber criminals Webroot is recommending that consumers follow<br />
      these five steps:<br />
</DIV></td>
</tr>
</table>
</td>
</tr>
</table>
<div style="margin: 0px 6px 6px 4px;">
<table style="font-size: 11px;border-spacing: 0px;padding: 0px;" cellpadding="0" cellspacing="0" width="100%">
<tr>
<td style="background:transparent;border-width:0px;padding:0px;">&nbsp;</td>
<td align="right" style="background:transparent;border-width:0px;padding:0px;width:107px" width="107"><a href="http://clipmarks.com/share/28686275-C882-4C1B-A9E1-759CBA367C2A/blog/" title="blog or email this clip"><img src="http://content8.clipmarks.com/images/c2b-foot.png" border="0" alt="blog it" width="107" height="17" style="border-width:0px;padding:0px;margin:0px;" /></a></td>
</tr>
</table>
</div>
</td>
</tr>
</table>
<BR/><MAP name="bdv_RSS_Ad_181108054621"><AREA alt="Feed Ads By BidVertiser.com" shape="poly" coords="0,0,467,0,467,45,315,45,315,59,0,59" href="http://secure.bidvertiser.com/performance/bdv_rss_rd.dbm?pid=165886&amp;bid=400950&amp;PHS=181108054621&amp;click=1" target="_blank" /><AREA alt="Feed Ads By BidVertiser.com" shape="rect" coords="315,45,467,59" href="http://www.bidvertiser.com/bdv/bidvertiser/bdv_ref.dbm?Ref_PID=165886&amp;Ref_Option=main&amp;source=90614506" target="_blank" /></MAP><P><a href="http://secure.bidvertiser.com/performance/bdv_rss_rd.dbm?pid=165886&amp;bid=400950&amp;PHS=181108054621&amp;click=1" target="_blank"><IMG src="http://bdv.bidvertiser.com/BidVertiser.dbm?pid=165886&amp;bid=400950&amp;PHS=181108054621&amp;rssimage=1&amp;rSRC=2" border="0" usemap="#bdv_RSS_Ad_181108054621" /></a></P>]]></content:encoded>
      <pubDate>Tue, 18 Nov 2008 14:46:21 +0000</pubDate>
      <category domain="http://www.securityratty.com/tag/season">season</category>
      <category domain="http://www.securityratty.com/tag/online threats">online threats</category>
      <category domain="http://www.securityratty.com/tag/online">online</category>
      <category domain="http://www.securityratty.com/tag/holiday season">holiday season</category>
      <category domain="http://www.securityratty.com/tag/online protection products">online protection products</category>
      <category domain="http://www.securityratty.com/tag/cyber criminals webroot">cyber criminals webroot</category>
      <category domain="http://www.securityratty.com/tag/webroot threat advisory">webroot threat advisory</category>
      <category domain="http://www.securityratty.com/tag/consumers follow">consumers follow</category>
      <category domain="http://www.securityratty.com/tag/consumers">consumers</category>
      <source url="http://spywarebiz.com/spywarebizblog/?p=660">Dont get a lump of coal this season!</source>
    </item>
    <item>
      <title><![CDATA[DIY Phishing Pages With Command and Control Interfaces]]></title>
      <link>http://www.securityratty.com/article/78a81ce667063a0a1268788bb3f66128</link>
      <guid>http://www.securityratty.com/article/78a81ce667063a0a1268788bb3f66128</guid>
      <description><![CDATA[The day when DIY phishing pages start coming with manuals is the day when consciously or subconsciously a phisher is lowering down the entry barriers into phishing for yet another time. A much more...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://2.bp.blogspot.com/_wICHhTiQmrA/SRIwl6hmo2I/AAAAAAAACa8/_1fYFgW0kzk/s1600-h/rapidshare_phishing_admin_panel.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://2.bp.blogspot.com/_wICHhTiQmrA/SRIwl6hmo2I/AAAAAAAACa8/_1fYFgW0kzk/s200/rapidshare_phishing_admin_panel.jpg" /></a>The day when DIY phishing pages start coming with manuals is the day when consciously or subconsciously a phisher is lowering down the entry barriers into phishing for yet another time. A much more user-friendly compared to the old-fashioned -- yet effective -- <a href="http://ddanchev.blogspot.com/2007/09/209-host-locked.html">rock phish directory listing</a>, a recently released command and control interface for Rapidshare phishing campaigns aims to empower its users with easy dynamic link generation for their campaigns.<br />
<br />
<a href="http://3.bp.blogspot.com/_wICHhTiQmrA/SRLdeRIJEbI/AAAAAAAACbE/ta5F-iiF2gg/s1600-h/DIY_phishing_scripts.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://3.bp.blogspot.com/_wICHhTiQmrA/SRLdeRIJEbI/AAAAAAAACbE/ta5F-iiF2gg/s200/DIY_phishing_scripts.JPG" /></a>What they've managed to achieve is another trust factor since Rapidshare generates a second dynamic link upon clicking on the original one. The script not only generates a dynamically looking link, but also, actually logs in the victim into their account in order to avoid suspicion whereas it still logs all the accounting data.<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="http://3.bp.blogspot.com/_wICHhTiQmrA/SRLhzGDKcrI/AAAAAAAACbM/5-CHdeukArk/s1600-h/rapidshare_phishing_insecure_directory_permissions.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://3.bp.blogspot.com/_wICHhTiQmrA/SRLhzGDKcrI/AAAAAAAACbM/5-CHdeukArk/s200/rapidshare_phishing_insecure_directory_permissions.JPG" /></a></div>Scammers also tend to be ironic every then and now. For instance, in this particular case, one of the users finds it ironic that the Rapidshare phishing page is hosted at Rapidshare itself. Is the script actually working? It appears so at least going through a misconfigured accounting data dump left by one of the phishers.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2008/03/phishing-pages-for-every-bank-are.html">Phishing Pages for Every Bank are a Commodity</a><br />
<a href="http://ddanchev.blogspot.com/2007/08/diy-phishing-kits.html">DIY Phishing Kits</a><br />
<a href="http://ddanchev.blogspot.com/2007/09/diy-phishing-kit-goes-20.html">DIY Phishing Kit Goes 2.0</a><br />
<a href="http://ddanchev.blogspot.com/2008/05/diy-phishing-kits-introducing-new.html">DIY Phishing Kits Introducing New Features</a><br />
<a href="http://ddanchev.blogspot.com/2007/09/209-host-locked.html">209 Host Locked</a><br />
<a href="http://ddanchev.blogspot.com/2007/12/2091-host-locked.html">209.1 Host Locked</a><br />
<a href="http://ddanchev.blogspot.com/2007/11/661-host-locked.html">66.1 Host Locked</a><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=5kY3N"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=5kY3N" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=r8EaN"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=r8EaN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=Qtrtn"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=Qtrtn" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=qM6qn"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=qM6qn" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=T3U6N"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=T3U6N" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=YwrRN"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=YwrRN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=nQNrn"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=nQNrn" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/444324371" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 06 Nov 2008 03:31:43 +0000</pubDate>
      <category domain="http://www.securityratty.com/tag/diy">diy</category>
      <category domain="http://www.securityratty.com/tag/pages">pages</category>
      <category domain="http://www.securityratty.com/tag/rapidshare">rapidshare</category>
      <category domain="http://www.securityratty.com/tag/data dump">data dump</category>
      <category domain="http://www.securityratty.com/tag/data">data</category>
      <category domain="http://www.securityratty.com/tag/campaigns">campaigns</category>
      <category domain="http://www.securityratty.com/tag/dynamic link">dynamic link</category>
      <category domain="http://www.securityratty.com/tag/pages start">pages start</category>
      <category domain="http://www.securityratty.com/tag/link">link</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/444324371/diy-phishing-pages-with-command-and.html">DIY Phishing Pages With Command and Control Interfaces</source>
    </item>
    <item>
      <title><![CDATA[Wells Fargo Opt Out 800 Number]]></title>
      <link>http://www.securityratty.com/article/7196138e5586bb624e0e2802946ab975</link>
      <guid>http://www.securityratty.com/article/7196138e5586bb624e0e2802946ab975</guid>
      <description><![CDATA[I have been a happy customer of Wells Fargo for a couple of years now, but one thing has always bothered me: being solicited by loosely affiliated companies. Well, I finally found out how to fix this....]]></description>
      <content:encoded><![CDATA[<p>I have been a happy customer of Wells Fargo for a couple of years now, but one thing has always bothered me: being solicited by loosely affiliated companies. Well, I finally found out how to fix this. I called 888.528.8460, which is their &quot;privacy preference line&quot;. From there I was able to opt out of all solicitation for new services.</p> <p>We&#39;ll see how well it works.</p> <p>I&#39;m not a crazy environmentalist, but waste makes me cringe. I make it a habit to contact companies that mail me catalogs that I don&#39;t read, telling them to take me off of their lists. I also do little things like bring a couple of bags to the grocery store every time I go in order to avoid generating more plastic waste.</p> <p>The other day, I was buying my son a sweatshirt in T.J. Maxx, and the clerk popped it into a plastic bag. I said, &quot;Thanks, but I really don&#39;t need that bag.&quot; He promptly balled it up and threw it in the trash. It makes me sad how so many people just don&#39;t get it. If everyone would just think a little bit about this in their daily lives, I think it&#39;d make a big difference for the world we leave to our kids and grandkids.</p><div style="clear:both;"></div><img src="http://www.pluralsight.com/community/aggbug.aspx?PostID=54177" width="1" height="1">]]></content:encoded>
      <pubDate>Thu, 30 Oct 2008 15:04:26 +0000</pubDate>
      <category domain="http://www.securityratty.com/tag/plastic waste">plastic waste</category>
      <category domain="http://www.securityratty.com/tag/plastic bag">plastic bag</category>
      <category domain="http://www.securityratty.com/tag/waste">waste</category>
      <category domain="http://www.securityratty.com/tag/contact companies">contact companies</category>
      <category domain="http://www.securityratty.com/tag/bag">bag</category>
      <category domain="http://www.securityratty.com/tag/companies">companies</category>
      <category domain="http://www.securityratty.com/tag/privacy preference line">privacy preference line</category>
      <category domain="http://www.securityratty.com/tag/opt">opt</category>
      <category domain="http://www.securityratty.com/tag/grocery store">grocery store</category>
      <source url="http://www.pluralsight.com/community/blogs/keith/archive/2008/10/30/wells-fargo-opt-out-800-number.aspx">Wells Fargo Opt Out 800 Number</source>
    </item>
    <item>
      <title><![CDATA[Barak Obama Discusses Security Trade-Offs]]></title>
      <link>http://www.securityratty.com/article/66adeb7e03a72798a66d6a815c8cb26d</link>
      <guid>http://www.securityratty.com/article/66adeb7e03a72798a66d6a815c8cb26d</guid>
      <description><![CDATA[I generally avoid commenting on election politics -- that's not what this blog is about -- but this comment by Barak Obama is worth discussing: [Q] I have been collecting accounts of your meeting with...]]></description>
      <content:encoded><![CDATA[<p>I generally avoid commenting on election politics -- that's not what this blog is about -- but <a href="http://www.time-blog.com/swampland/2008/10/the_full_obama_interview.html">this comment</a> by Barak Obama is worth discussing:</p>

<blockquote>[Q] I have been collecting accounts of your meeting with David Petraeus in Baghdad. And you had [inaudible] after he had made a really strong pitch [inaudible] for maximum flexibility. A lot of politicians at that moment would have said [inaudible] but from what I hear, you pushed back.

<p>[BO] I did. I remember the conversation, pretty precisely. He made the case for maximum flexibility and I said you know what if I were in your shoes I would be making the exact same argument because your job right now is to succeed in Iraq on as favorable terms as we can get. My job as a potential commander in chief is to view your counsel and your interests through the prism of our overall national security which includes what is happening in Afghanistan, which includes the costs to our image in the middle east, to the continued occupation, which includes the financial costs of our occupation, which includes what it is doing to our military. So I said look, I described in my mind at list an analogous situation where I am sure he has to deal with situations where the commanding officer in [inaudible] says I need more troops here now because I really think I can make progress doing x y and z. That commanding officer is doing his job in Ramadi, but Petraeus's job is to step back and see how does it impact Iraq as a whole. My argument was I have got to do the same thing here. And based on my strong assessment particularly having just come from Afghanistan were going to have to make a different decision. But the point is that hopefully I communicated to the press my complete respect and gratitude to him and Proder who was in the meeting for their outstanding work. Our differences don't necessarily derive from differences in sort of, or my differences with him don't derive from tactical objections to his approach. But rather from a strategic framework that is trying to take into account the challenges to our national security and the fact that we've got finite resources.</blockquote></p>

<p>I have made this general point again and again -- about airline security, about terrorism, about a lot of things -- that the person in charge of the security system can't be the person who decides what resources to devote to that security system.  The analogy I like to use is a company: the VP of marketing wants all the money for marketing, the VP of engineering wants all the money for engineering, and so on; and the CEO has to balance all of those needs and do what's right for the company.  So of course the TSA wants to spend all this money on new airplane security systems; that's their job.  Someone above the TSA has to balance the risks to airlines with the other risks our country faces and allocate budget accordingly.  Security is a trade-off, and that trade-off has to be made by someone with responsibility over all aspects of that trade-off.</p>

<p>I don't think I've ever heard a politician make this point so explicitly.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=DBjNM"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=DBjNM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=WeT5M"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=WeT5M" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Mon, 27 Oct 2008 03:31:12 +0000</pubDate>
      <category domain="http://www.securityratty.com/tag/security">security</category>
      <category domain="http://www.securityratty.com/tag/airline security">airline security</category>
      <category domain="http://www.securityratty.com/tag/national security">national security</category>
      <category domain="http://www.securityratty.com/tag/security system">security system</category>
      <category domain="http://www.securityratty.com/tag/strong pitch inaudible">strong pitch inaudible</category>
      <category domain="http://www.securityratty.com/tag/inaudible">inaudible</category>
      <category domain="http://www.securityratty.com/tag/job">job</category>
      <category domain="http://www.securityratty.com/tag/airplane security systems">airplane security systems</category>
      <category domain="http://www.securityratty.com/tag/maximum flexibility">maximum flexibility</category>
      <source url="http://www.schneier.com/blog/archives/2008/10/barak_obama_dis.html">Barak Obama Discusses Security Trade-Offs</source>
    </item>
    <item>
      <title><![CDATA[Virtual wont protect in the real online world]]></title>
      <link>http://www.securityratty.com/article/cad62b3a1b24e68b8b7dd3f93f4afa81</link>
      <guid>http://www.securityratty.com/article/cad62b3a1b24e68b8b7dd3f93f4afa81</guid>
      <description><![CDATA[Be careful as Virtual becomes the target of the nasty people


clipped from newsletters.trendmicro.com


Real Threats in Virtual Worlds and Online Games


Thought you could avoid the pitfalls of real...]]></description>
      <content:encoded><![CDATA[<div > Be careful as Virtual becomes the target of the nasty people. </div>
<table cellpadding="0" cellspacing="0" width="100%" style="margin: 12px 0px; font-family: arial; color: #333333; background: #ffffff; border: solid 4px #e5e5e5; width: 100%; clear: left;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" class="CM_CTB_Content_Wrap" style="margin: 0px; padding: 0px;background-color: #ffffff;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" style="border-bottom: solid 1px #dcdcdc; white-space: nowrap; margin-bottom: 8px; background-color: #eeeeee ;background-image: url(http://clipmarks.com/images/source-bg.gif); background-repeat: repeat-x; height: 24px; line-height: 24px; vertical-align: middle; padding-bottom: 4px; color: #666666; font-size: 10px;">
<tr>
<td valign="top"><a href="http://clipmarks.com/clipmark/69B3BFB4-8FD3-4967-A472-2634A98997B7/" title="go to this clipmark"><img src="http://content.clipmarks.com/blog_icon/a566bcf9-0078-4bfd-8e5c-43de99cd6ce1/69B3BFB4-8FD3-4967-A472-2634A98997B7/" alt="" width="19" height="19" border="0" style="vertical-align: middle; margin: 0px 4px; display: inline; border: none; float:none;" /></a>clipped from <a title="http://newsletters.trendmicro.com/servlet/website/ResponseForm?mgLEVTTB_UTVX_.40ev.2e_0okLHm_eHgKlJHiL" href="http://newsletters.trendmicro.com/servlet/website/ResponseForm?mgLEVTTB_UTVX_.40ev.2e_0okLHm_eHgKlJHiL" style="font-size: 11px;">newsletters.trendmicro.com</a></td>
</tr>
</table>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://newsletters.trendmicro.com/servlet/website/ResponseForm?mgLEVTTB_UTVX_.40ev.2e_0okLHm_eHgKlJHiL --><br />
<table background="undefined" bgcolor="">
<tr><TD valign="top" colspan="2">Real Threats in Virtual Worlds and Online Games</TD></tr>
</table>
</td>
</tr>
</table>
<div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://newsletters.trendmicro.com/servlet/website/ResponseForm?mgLEVTTB_UTVX_.40ev.2e_0okLHm_eHgKlJHiL --><DIV>Thought you could avoid the pitfalls of real life by living in a virtual world? Wrong. Living virtually does not make you immune to the same kinds of online threats you experience in the real world. Unfortunately, the growing popularity of virtual worlds has attracted the attention of both hackers and organized criminals.</DIV></td>
</tr>
</table>
</td>
</tr>
</table>
<div style="margin: 0px 6px 6px 4px;">
<table style="font-size: 11px;border-spacing: 0px;padding: 0px;" cellpadding="0" cellspacing="0" width="100%">
<tr>
<td style="background:transparent;border-width:0px;padding:0px;">&nbsp;</td>
<td align="right" style="background:transparent;border-width:0px;padding:0px;width:107px" width="107"><a href="http://clipmarks.com/share/69B3BFB4-8FD3-4967-A472-2634A98997B7/blog/" title="blog or email this clip"><img src="http://content6.clipmarks.com/images/c2b-foot.png" border="0" alt="blog it" width="107" height="17" style="border-width:0px;padding:0px;margin:0px;" /></a></td>
</tr>
</table>
</div>
</td>
</tr>
</table>
<BR/><MAP name="bdv_RSS_Ad_251008062533"><AREA alt="Feed Ads By BidVertiser.com" shape="poly" coords="0,0,467,0,467,45,315,45,315,59,0,59" href="http://secure.bidvertiser.com/performance/bdv_rss_rd.dbm?pid=165886&amp;bid=400950&amp;PHS=251008062533&amp;click=1" target="_blank" /><AREA alt="Feed Ads By BidVertiser.com" shape="rect" coords="315,45,467,59" href="http://www.bidvertiser.com/bdv/bidvertiser/bdv_ref.dbm?Ref_PID=165886&amp;Ref_Option=main&amp;source=90614506" target="_blank" /></MAP><P><a href="http://secure.bidvertiser.com/performance/bdv_rss_rd.dbm?pid=165886&amp;bid=400950&amp;PHS=251008062533&amp;click=1" target="_blank"><IMG src="http://bdv.bidvertiser.com/BidVertiser.dbm?pid=165886&amp;bid=400950&amp;PHS=251008062533&amp;rssimage=1&amp;rSRC=2" border="0" usemap="#bdv_RSS_Ad_251008062533" /></a></P>]]></content:encoded>
      <pubDate>Sat, 25 Oct 2008 14:25:33 +0000</pubDate>
      <category domain="http://www.securityratty.com/tag/virtual">virtual</category>
      <category domain="http://www.securityratty.com/tag/virtual world">virtual world</category>
      <category domain="http://www.securityratty.com/tag/virtual worlds">virtual worlds</category>
      <category domain="http://www.securityratty.com/tag/real life">real life</category>
      <category domain="http://www.securityratty.com/tag/real threats">real threats</category>
      <category domain="http://www.securityratty.com/tag/real world">real world</category>
      <category domain="http://www.securityratty.com/tag/online threats">online threats</category>
      <category domain="http://www.securityratty.com/tag/nasty people">nasty people</category>
      <category domain="http://www.securityratty.com/tag/online games">online games</category>
      <source url="http://spywarebiz.com/spywarebizblog/?p=648">Virtual wont protect in the real online world</source>
    </item>
    <item>
      <title><![CDATA[Malware? We don't need no stinking malware!]]></title>
      <link>http://www.securityratty.com/article/cbb029a08a78820b5ef90b69579719a1</link>
      <guid>http://www.securityratty.com/article/cbb029a08a78820b5ef90b69579719a1</guid>
      <description><![CDATA[Written by Oliver Fisher

This site may harm your computer
You may have seen those words in Google search results but what do they mean? If you click the search result link you get another warning...]]></description>
      <content:encoded><![CDATA[<span class="byline-author">Written by Oliver Fisher</span><br /><br /><span style="font-weight: bold;">"This site may harm your computer"</span><br />You may have seen those words in Google search results — but what do they mean? If you click the search result link you get another warning page instead of the website you were expecting. But if the web page was your grandmother's baking blog, you're still confused. Surely your grandmother hasn't been secretly honing her l33t computer hacking skills at night school. Google must have made a mistake and your grandmother's web page is just fine...<br /><br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://3.bp.blogspot.com/_LMSk7hTEaIE/SQI_1LfaQYI/AAAAAAAAtcc/zI4emYNyj4g/s1600-h/example.png"><img style="margin: 0px auto 10px; display: block; text-align: center; cursor: pointer; width: 320px; height: 125px;" src="http://3.bp.blogspot.com/_LMSk7hTEaIE/SQI_1LfaQYI/AAAAAAAAtcc/zI4emYNyj4g/s320/example.png" alt="" id="BLOGGER_PHOTO_ID_5260837497572311426" border="0" /></a><br /><br />I work with the team that helps put the warning in Google's search results, so let me try to explain. The good news is that your grandmother is still kind and <a href="http://fitz.blogspot.com/2008/10/everybody-should-have-one.html">loves turtles</a>. She isn't trying to start a botnet or steal credit card numbers. The bad news is that her website or the server that it runs on probably has a security vulnerability, most likely from some out-of-date software. That vulnerability has been exploited and malicious code has been added to your grandmother's website. It's most likely an invisible script or iframe that pulls content from another website that tries to attack any computer that views the page. If the attack succeeds, then viruses, spyware, key loggers, botnets, and other nasty stuff will get installed.<br /><br />If you see the warning on a site in Google's search results, it's a good idea to pay attention to it. Google has automatic scanners that are constantly looking for these sorts of web pages. I help build the scanners and continue to be surprised by how accurate they are. There is almost certainly something wrong with the website even if it is run by someone you trust. The automatic scanners make unbiased decisions based on the malicious content of the pages, not the reputation of the webmaster.<br /><br />Servers are just like your home computer and need constant updating. There are lots of tools that make building a website easy, but each one adds some risk of being exploited. Even if you're diligent and keep all your website components updated, your web host may not be. They control your website's server and may not have installed the most recent OS patches. And it's not just innocent grandmothers that this happens to. There have been warnings on the websites of banks, sports teams, and corporate and government websites.<br /><br /><span style="font-weight: bold;">Uh-oh... I need help!</span><br />Now that we understand what the malware label means in search results, what do you do if you're a webmaster and Google's scanners have found malware on your site?<br /><br />There are some resources to help clean things up. The Google Webmaster Central blog has <a href="http://googlewebmastercentral.blogspot.com/2008/04/my-sites-been-hacked-now-what.html">some tips</a> and a <a href="http://googlewebmastercentral.blogspot.com/2007/09/quick-security-checklist-for-webmasters.html">quick security checklist for webmasters</a>. <a href="http://stopbadware.org/">Stopbadware.org</a> has great information, and their <a href="http://groups.google.com/group/stopbadware">forums</a> have a number of helpful and knowledgeable volunteers who may be able to help (sometimes I'm one of them). You can also use the Google SafeBrowsing diagnostics page for your site (http://www.google.com/safebrowsing/diagnostic?site=<i>&lt;site-name-here&gt;</i>) to see specific information about what Google's automatic scanners have found. If your site has been flagged, Google's <a href="http://www.google.com/webmasters/tools/">Webmaster Tools</a> lists some of the URLs that were scanned and found to be infected.<br /><br />Once you've cleaned up your website, use Google's <a href="http://www.google.com/webmasters/tools/">Webmaster Tools</a> to <a href="http://googlewebmastercentral.blogspot.com/2008/08/hey-google-i-no-longer-have-badware.html">request a malware review</a>. The automatic systems will rescan your website and the warning will be removed if the malware is gone.<br /><br /><span style="font-weight: bold;">Advance warning</span><br />I often hear webmasters asking Google for advance warning before a malware label is put on their website. When the label is applied, Google usually <a href="http://www.google.com/support/webmasters/bin/answer.py?answer=45432#2">emails the website owners</a> and then posts a warning in Google's <a href="http://www.google.com/webmasters/tools/">Webmaster Tools</a>. But no warning is given ahead of time - <span style="font-weight: bold;">before</span> the label is applied - so a webmaster can't quickly clean up the site before a warning is applied.<br /><br />But, look at the situation from the user's point of view. As a user, I'd be pretty annoyed if Google sent me to a site it knew was dangerous. Even a short delay would expose some users to that risk, and it doesn't seem justified. I know it's frustrating for a webmaster to see a malware label on their website. But, ultimately, protecting users against malware makes the internet a safer place and everyone benefits, both webmasters and users.<br /><br />Google's <a href="http://www.google.com/webmasters/tools/">Webmaster Tools</a> has started a test to provide <a href="http://googlewebmastercentral.blogspot.com/2008/10/message-center-warnings-for-hackable.html">warnings to webmasters</a> that their server software may be vulnerable. Responding to that warning and updating server software can prevent your website from being compromised with malware. The best way to avoid a malware label is to never have any malware on the site!<br /><br /><span style="font-weight: bold;">Reviews</span><br />You can request a review via Google's <a href="http://www.google.com/webmasters/tools/">Webmaster Tools</a> and you can see the status of the review there. If you think the review is taking too long, make sure to check the status. Finding all the malware on a site is difficult and the automated scanners are far more accurate than humans. The scanners may have found something you've missed and the review may have failed.  If your site has a malware label, Google's <a href="http://www.google.com/webmasters/tools/">Webmaster Tools</a> will also list some sample URLs that have problems. This is not a full list of all of the problem URLs (because that's often very, very long), but it should get you started.<br /><br />Finally, don't confuse a malware review with a <a href="http://googlewebmastercentral.blogspot.com/2008/07/requesting-reconsideration-using-google.html">request for reconsideration</a>. If Google's automated scanners find malware on your website, the site will usually not be removed from search results. There is also a different process that removes spammy websites from Google search results. If that's happened and you disagree with Google, you should submit a <a href="http://googlewebmastercentral.blogspot.com/2008/07/requesting-reconsideration-using-google.html">reconsideration request</a>. But if your site has a malware label, a reconsideration request won't do any good — for malware you need to file a malware review from the Overview page.<br /><br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://4.bp.blogspot.com/_LMSk7hTEaIE/SQJAJQN-pYI/AAAAAAAAtck/DOkV2_QwJdQ/s1600-h/example2.png"><img style="margin: 0px auto 10px; display: block; text-align: center; cursor: pointer; width: 320px; height: 202px;" src="http://4.bp.blogspot.com/_LMSk7hTEaIE/SQJAJQN-pYI/AAAAAAAAtck/DOkV2_QwJdQ/s320/example2.png" alt="" id="BLOGGER_PHOTO_ID_5260837842438759810" border="0" /></a><br /><br /><span style="font-weight: bold;">How long will a review take?</span><br />Webmasters are eager to have a Google malware label removed from their site and often ask how long a review of the site will take. Both the original scanning and the review process are fully automated. The systems analyze large portions of the internet, which is big place, so the review may not happen immediately. Ideally, the label will be removed within a few hours. At its longest, the process should take a day or so.<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/GoogleOnlineSecurityBlog?a=Cuj5M"><img src="http://feeds.feedburner.com/~f/GoogleOnlineSecurityBlog?i=Cuj5M" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/GoogleOnlineSecurityBlog?a=v7cwm"><img src="http://feeds.feedburner.com/~f/GoogleOnlineSecurityBlog?i=v7cwm" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/GoogleOnlineSecurityBlog/~4/431137747" height="1" width="1"/>]]></content:encoded>
      <pubDate>Fri, 24 Oct 2008 10:25:00 +0000</pubDate>
      <category domain="http://www.securityratty.com/tag/malware">malware</category>
      <category domain="http://www.securityratty.com/tag/google malware label">google malware label</category>
      <category domain="http://www.securityratty.com/tag/label">label</category>
      <category domain="http://www.securityratty.com/tag/malware review">malware review</category>
      <category domain="http://www.securityratty.com/tag/tools">tools</category>
      <category domain="http://www.securityratty.com/tag/webmaster tools lists">webmaster tools lists</category>
      <category domain="http://www.securityratty.com/tag/malware label">malware label</category>
      <category domain="http://www.securityratty.com/tag/webmaster tools">webmaster tools</category>
      <category domain="http://www.securityratty.com/tag/google">google</category>
      <source url="http://feeds.feedburner.com/~r/GoogleOnlineSecurityBlog/~3/431137747/malware-we-dont-need-no-stinking.html">Malware? We don't need no stinking malware!</source>
    </item>
    <item>
      <title><![CDATA[Malware? We don't need no stinking malware!]]></title>
      <link>http://www.securityratty.com/article/7b001609aa5afd4ad270a86d179c2f41</link>
      <guid>http://www.securityratty.com/article/7b001609aa5afd4ad270a86d179c2f41</guid>
      <description><![CDATA[Written by Oliver Fisher

This site may harm your computer
You may have seen those words in Google search results but what do they mean? If you click the search result link you get another warning...]]></description>
      <content:encoded><![CDATA[<span class="byline-author">Written by Oliver Fisher</span><br /><br /><span style="font-weight: bold;">"This site may harm your computer"</span><br />You may have seen those words in Google search results — but what do they mean? If you click the search result link you get another warning page instead of the website you were expecting. But if the web page was your grandmother's baking blog, you're still confused. Surely your grandmother hasn't been secretly honing her l33t computer hacking skills at night school. Google must have made a mistake and your grandmother's web page is just fine...<br /><br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://3.bp.blogspot.com/_LMSk7hTEaIE/SQI_1LfaQYI/AAAAAAAAtcc/zI4emYNyj4g/s1600-h/example.png"><img style="margin: 0px auto 10px; display: block; text-align: center; cursor: pointer; width: 320px; height: 125px;" src="http://3.bp.blogspot.com/_LMSk7hTEaIE/SQI_1LfaQYI/AAAAAAAAtcc/zI4emYNyj4g/s320/example.png" alt="" id="BLOGGER_PHOTO_ID_5260837497572311426" border="0" /></a><br /><br />I work with the team that helps put the warning in Google's search results, so let me try to explain. The good news is that your grandmother is still kind and <a href="http://fitz.blogspot.com/2008/10/everybody-should-have-one.html">loves turtles</a>. She isn't trying to start a botnet or steal credit card numbers. The bad news is that her website or the server that it runs on probably has a security vulnerability, most likely from some out-of-date software. That vulnerability has been exploited and malicious code has been added to your grandmother's website. It's most likely an invisible script or iframe that pulls content from another website that tries to attack any computer that views the page. If the attack succeeds, then viruses, spyware, key loggers, botnets, and other nasty stuff will get installed.<br /><br />If you see the warning on a site in Google's search results, it's a good idea to pay attention to it. Google has automatic scanners that are constantly looking for these sorts of web pages. I help build the scanners and continue to be surprised by how accurate they are. There is almost certainly something wrong with the website even if it is run by someone you trust. The automatic scanners make unbiased decisions based on the malicious content of the pages, not the reputation of the webmaster.<br /><br />Servers are just like your home computer and need constant updating. There are lots of tools that make building a website easy, but each one adds some risk of being exploited. Even if you're diligent and keep all your website components updated, your web host may not be. They control your website's server and may not have installed the most recent OS patches. And it's not just innocent grandmothers that this happens to. There have been warnings on the websites of banks, sports teams, and corporate and government websites.<br /><br /><span style="font-weight: bold;">Uh-oh... I need help!</span><br />Now that we understand what the malware label means in search results, what do you do if you're a webmaster and Google's scanners have found malware on your site?<br /><br />There are some resources to help clean things up. The Google Webmaster Central blog has <a href="http://googlewebmastercentral.blogspot.com/2008/04/my-sites-been-hacked-now-what.html">some tips</a> and a <a href="http://googlewebmastercentral.blogspot.com/2007/09/quick-security-checklist-for-webmasters.html">quick security checklist for webmasters</a>. <a href="http://stopbadware.org/">Stopbadware.org</a> has great information, and their <a href="http://groups.google.com/group/stopbadware">forums</a> have a number of helpful and knowledgeable volunteers who may be able to help (sometimes I'm one of them). You can also use the Google SafeBrowsing diagnostics page for your site (http://www.google.com/safebrowsing/diagnostic?site=<i>&lt;site-name-here&gt;</i>) to see specific information about what Google's automatic scanners have found. If your site has been flagged, Google's <a href="http://www.google.com/webmasters/tools/">Webmaster Tools</a> lists some of the URLs that were scanned and found to be infected.<br /><br />Once you've cleaned up your website, use Google's <a href="http://www.google.com/webmasters/tools/">Webmaster Tools</a> to <a href="http://googlewebmastercentral.blogspot.com/2008/08/hey-google-i-no-longer-have-badware.html">request a malware review</a>. The automatic systems will rescan your website and the warning will be removed if the malware is gone.<br /><br /><span style="font-weight: bold;">Advance warning</span><br />I often hear webmasters asking Google for advance warning before a malware label is put on their website. When the label is applied, Google usually <a href="http://www.google.com/support/webmasters/bin/answer.py?answer=45432#2">emails the website owners</a> and then posts a warning in Google's <a href="http://www.google.com/webmasters/tools/">Webmaster Tools</a>. But no warning is given ahead of time - <span style="font-weight: bold;">before</span> the label is applied - so a webmaster can't quickly clean up the site before a warning is applied.<br /><br />But, look at the situation from the user's point of view. As a user, I'd be pretty annoyed if Google sent me to a site it knew was dangerous. Even a short delay would expose some users to that risk, and it doesn't seem justified. I know it's frustrating for a webmaster to see a malware label on their website. But, ultimately, protecting users against malware makes the internet a safer place and everyone benefits, both webmasters and users.<br /><br />Google's <a href="http://www.google.com/webmasters/tools/">Webmaster Tools</a> has started a test to provide <a href="http://googlewebmastercentral.blogspot.com/2008/10/message-center-warnings-for-hackable.html">warnings to webmasters</a> that their server software may be vulnerable. Responding to that warning and updating server software can prevent your website from being compromised with malware. The best way to avoid a malware label is to never have any malware on the site!<br /><br /><span style="font-weight: bold;">Reviews</span><br />You can request a review via Google's <a href="http://www.google.com/webmasters/tools/">Webmaster Tools</a> and you can see the status of the review there. If you think the review is taking too long, make sure to check the status. Finding all the malware on a site is difficult and the automated scanners are far more accurate than humans. The scanners may have found something you've missed and the review may have failed.  If your site has a malware label, Google's <a href="http://www.google.com/webmasters/tools/">Webmaster Tools</a> will also list some sample URLs that have problems. This is not a full list of all of the problem URLs (because that's often very, very long), but it should get you started.<br /><br />Finally, don't confuse a malware review with a <a href="http://googlewebmastercentral.blogspot.com/2008/07/requesting-reconsideration-using-google.html">request for reconsideration</a>. If Google's automated scanners find malware on your website, the site will usually not be removed from search results. There is also a different process that removes spammy websites from Google search results. If that's happened and you disagree with Google, you should submit a <a href="http://googlewebmastercentral.blogspot.com/2008/07/requesting-reconsideration-using-google.html">reconsideration request</a>. But if your site has a malware label, a reconsideration request won't do any good — for malware you need to file a malware review from the Overview page.<br /><br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://4.bp.blogspot.com/_LMSk7hTEaIE/SQJAJQN-pYI/AAAAAAAAtck/DOkV2_QwJdQ/s1600-h/example2.png"><img style="margin: 0px auto 10px; display: block; text-align: center; cursor: pointer; width: 320px; height: 202px;" src="http://4.bp.blogspot.com/_LMSk7hTEaIE/SQJAJQN-pYI/AAAAAAAAtck/DOkV2_QwJdQ/s320/example2.png" alt="" id="BLOGGER_PHOTO_ID_5260837842438759810" border="0" /></a><br /><br /><span style="font-weight: bold;">How long will a review take?</span><br />Webmasters are eager to have a Google malware label removed from their site and often ask how long a review of the site will take. Both the original scanning and the review process are fully automated. The systems analyze large portions of the internet, which is big place, so the review may not happen immediately. Ideally, the label will be removed within a few hours. At its longest, the process should take a day or so.<div class="feedflare">
<a href="http://feedproxy.google.com/~f/GoogleOnlineSecurityBlog?a=SIUWOyG4"><img src="http://feedproxy.google.com/~f/GoogleOnlineSecurityBlog?d=41" border="0"></img></a> <a href="http://feedproxy.google.com/~f/GoogleOnlineSecurityBlog?a=62ZsGul3"><img src="http://feedproxy.google.com/~f/GoogleOnlineSecurityBlog?i=62ZsGul3" border="0"></img></a>
</div><img src="http://feedproxy.google.com/~r/GoogleOnlineSecurityBlog/~4/FIyRCnLebV4" height="1" width="1"/>]]></content:encoded>
      <pubDate>Fri, 24 Oct 2008 10:25:00 +0000</pubDate>
      <category domain="http://www.securityratty.com/tag/malware">malware</category>
      <category domain="http://www.securityratty.com/tag/google malware label">google malware label</category>
      <category domain="http://www.securityratty.com/tag/label">label</category>
      <category domain="http://www.securityratty.com/tag/malware review">malware review</category>
      <category domain="http://www.securityratty.com/tag/tools">tools</category>
      <category domain="http://www.securityratty.com/tag/webmaster tools lists">webmaster tools lists</category>
      <category domain="http://www.securityratty.com/tag/malware label">malware label</category>
      <category domain="http://www.securityratty.com/tag/webmaster tools">webmaster tools</category>
      <category domain="http://www.securityratty.com/tag/google">google</category>
      <source url="http://feedproxy.google.com/~r/GoogleOnlineSecurityBlog/~3/FIyRCnLebV4/malware-we-dont-need-no-stinking.html">Malware? We don't need no stinking malware!</source>
    </item>
  </channel>
</rss>
