Technology's advancement requires competition.

I'm 100% in favor of a company starting out small with an innovative idea and then expanding. If this happens in a way so that little competition happens for the innovative company it's something magical to behold. Everyone benefits from competition however.

Without competition a company can set prices to whatever they want. If an innovative company has a new product and no other companies step up to compete, it could be because other companies lack funding, the knowledge, or they may see no benefit in competing at all (for a product they do not believe will be successful).

More and more in this day and age companies aren't getting ahead because they have more superior products or because the people buying the products have a heightened sense of brand awareness, but rather because a company benefits from information or services illegally or they pay other companies not to use the competition.

When a person knowingly supports a company that has ill-gotten gains, this helps and endorses the company to keep doing what they were doing. By having an unfair advantage a company can put all competition out of business and then set prices to control a market. If the item in question is technology, they can control all prices globally. Also without competition, technological advancement is in the hands of the only company left standing. If the company decides not to advance because it's not in the best financial interest of shareholders, then the results could be detrimental to a product line, a piece of technology, even society itself (just think if one company controlled the water supply... see Wikipedia for Water Privatization).

AMD Advanced Micro Devices and why you should not buy Nvidia or Intel (at the moment)
Many companies benefit when they hire a disgruntled employee from a competitor. They receive inside knowledge of the inner workings of the competition. They also benefit from any project the employee might have had knowledge about, not to a degree that the company can copy the technology entirely or beat the original company to a patent (unethical), but they can prepare for the competing technology, software, or product to be on the market and find ways to innovate and compete ethically and legally. This is the reason that companies have employees hire a non-compete and also clauses that state that anything you work on during employment with the company is the property of the company done as "work for hire." I myself feel non-compete clauses should be illegal themselves, but in most cases a company will be hard pressed to keep an ex-employee from obtaining gainful employment in their field of expertise. Work for hire is something that should be allowed if the company is funding the research, but if the company can show no receipts for the time the employee came up with the idea, then it should belong to the employee.

Sometimes however companies don't receive information legally, but instead pay recruiters to tempt employees of the competition into selling inside information before the employees have left the company. Insider theft and espionage not only cost companies billions, it can put a company out of business and even hurt everyone involved.

AMD Advanced Micro Devices stock values 1/28/2013.

Two cases have come to light in the past years involving AMD and unfair practices against their business. In a lawsuit filed 1/14/2013 - AMD vs. Feldstein, Desai, Kociuk, and Hagen - AMD is seeking damages and injunctions against the 4 people involved who allegedly sold inside information and collected data from the AMD database to AMD's main competitor in the graphics card market, NVidia. If only one person had sold the information to NVidia, or attempted to sell the information, then there might be the case that NVidia had nothing to do with the case and the person selling the information might have been opportunistic. Since four people sold information, it looks more like NVidia might be paying these people (and recruiting) information for ill-gotten gains.

The second case that comes to mind is an Antitrust issue between Intel and AMD. There was a "complaint" filed for NY vs. Intel where they go into detail about Intel suggesting to their clients that they stop using AMD chips. In the EU there was an Antitrust case filed against Intel in 2009 where the courts ruled in favor of payment to AMD. Intel's counter "Intel takes strong exception to this decision. We believe the decision is wrong and ignores the reality of a highly competitive microprocessor marketplace..."

In short, No, it is not innovative to pay off the market and keep companies from purchasing from your competitors products.

Is it okay to buy anything Apple branded?
While I definitely like the road Apple has taken with their machines recently in terms of speed, I give second, third, and even tenth thoughts to buying Apple products. Apple has become a company that ignores human rights when it comes to building their portable devices. Another reason is that Apple exclusively uses Intel chips in their machines and do not allow installation of their operating system on any other platform (including AMD). From Apple's EULA for Snow Leopard:

"You agree not to install, use or run the Apple Software on any non-Apple-branded computer, or to enable others to do so."

When companies (Psystar and PearC) selling hardware of their own branding with the Mac OS operating system installed were sued by Apple, the supreme court found that the use of the Apple Operating System on Non-Apple hardware was a violation of the DCMA. Meaning it's illegal. This makes me wonder if the Librarian at the Library of Congress has received any compensation for helping Apple to become a monopoly in this regard since the Library of Congress controls the DCMA (Digital Copyright Millenium Act). Because of this I have only purchased low-end Macs for checking email, but maintain an AMD 12-core server as my primary workstation.

Hybrid Postal Delivery Services: How they destroy brands

I recently ordered an upgrade to one of my workstations from a “local” vendor. They’re about 60 miles from my present location, just outside of Chicago. Most packages in the greater Chicago area being sent through the United States Postal Service take a maximum of 3 days from the time they’re sent, in my experience. This usually involves going from a local post office, to a main sorting facility, back to the destination post office, and into the hands of the postal carrier. Three days is on the high-end, as it is usually only takes two. This all depends on whether the address is handwritten or if the sender printed a barcode with all of the CASS-Certified presort information detail on the label. (Hand reading and sorting adds time to delivery.)

When I was making my purchase from the website, (I'm giving them a second chance hence the failure to mention them directly), I was presented with a couple of options: FedEx 2-day which would cost me an additional $15, FedEx Overnight Air $30 (no air involved for a local delivery), and several other highly expensive services. I trust the Postal Service very little, but rather than paying for extra non-essential services when my package could be delivered in two days using the normal postal system, I elected to use the “free” service which guaranteed 2-3 days.

When I received my receipt the vendor indicated the 2-3 day delivery and two and now three days have come and gone. My dilemma is that the people I ordered my package from, rather than using the standard United States Postal Service in a local, traceable method, decided to use one of the new hybrid services, in this case UPS SurePost 'Saver.' I HATE seeing this as the free option for local shipping because it almost definitely means that the package is going to be lost and take an extra few days. FedEx has a similar service call FedEx SmartPost… equally as bad (if not worse). When I use either of these services I end up seeing my package within 2-3 miles of the office for 2-3 days before it is finally delivered. Something about the process makes the postal service or the shipping service delay the final delivery.

After looking at the tracking detail last night and expecting my package to arrive today, I went down and met my postal carrier at the box and surprise, surprise... no package. He looks at me rather puzzled. I look at him rather puzzled and bid him a good day. He’s a nice guy, so are my local UPS drivers... it's not their faults... it's the logistics.

Upon returning to the office I go in to check the tracking detail. Apparently my package was “ROUTED TO WRONG LOCAL POST OFFICE. PACKAGE WILL BE TRANSFERRED TO CORRECT POST OFFICE FOR DELIVERY,” according to the UPS website. When I called UPS, rather eager to pick-up my package in person (because I’m tired of waiting), the person on the phone told me that my package would be delivered either today or tomorrow and that they were on top of it. When I asked if I could pick up the package, they said they weren’t sure where the package was exactly... a breakdown in the tracking detail between both services involved, in this case UPS and USPS.

So this brings to light several reasons why these services DO NOT NEED TO EXIST AT ALL. There are no savings using this model for anyone: shipper, receiver, or the shipping service(s). When a company loses a package or misdelivers a package due to the complexity of the shipping logistics it has the potential to smear all of the brands involved. That costs companies money (think Billions). In fact, here I am smearing their brands, DO NOT USE UPS SurePost or FedEx SmartPost ‘Saver’ Services for delivering packages to your customers or clients. They will find other vendors. Offer simple, yet-traceable delivery services. I may not purchase anything else from the original company for fear of not receiving it on time (or at all). I will avoid the UPS SurePost ‘Saver’ delivery service, like the plague, and try to find another vendor that will simply send my package to me, timely without added expense and patience required on my part.

If one were to go in and read the countless reviews on Amazon.com, Newegg.com, ebay.com or several other websites where reviews abound, they will notice a pattern of people who give an item a low rating simply because of a shipping delay. This not only hurts the success of the product (manufacturer's brand) that they are berating, but also the reputation of the company (seller's brand) that is selling the product. This is no doubt because the people doing the ratings have no concept of what they are doing, nevertheless it happens and is also costly.

When a package that should normally only touch two local post offices and a main sorting facility, bounces through three UPS sorting facilities, a local UPS branch, and two local United States Post Offices, and multiple mail carriers there is an increased risk of the package being mishandled, misdelivered, lost, stolen, and/or destroyed.

My recommendation if you’re UPS, USPS, FedEx, or Any Company that wants to have customers that spread good words of mouth about your products and services, then DO NOT use any of the hybrid sending services (or provide them) because unlike the normal services customers have come to love and expect, these complexities to the rather simple purchase and delivery model are a risk to all.


That's all for now.
-Chris

Information Sharing - A Double-Edged Sword

This posting was sparked by a few new exploits on the rise, a Java exploit and a couple of Ruby-on-Rails vulnerabilities. I found out about both of them from Dark Reading.

I've been using computers for a very long time (31 years) by technology standards. One thing I've become accustomed to is regular updates and patches to systems, programs, and apps. Sometimes the systems that need to be patched aren't the systems that people themselves might have access to, but they may be a web server, a mail server, a programming interface, or even a server-side plugin.


The good
The reason these things need to be patched and fixed isn't because the companies who are making the patches are making money off of them. It's actually kind of counter that. It's a huge issue for a company's brand (yes, PR and Marketing) when their software is the main reason most of the Internet or Corporate America goes down. Think of the damage control a company like Microsoft has to do when there is a massive worm spreading around the Internet like CodeRed or the Melissa Virus. It's huge. People change platforms, they decide they can no longer trust a company with such glaring vulnerabilities. They "switch." I myself started using Macs simply because I trust Unix way more than I do Microsoft's ability to protect my system e-mails and webpages.

Here's the problem though, those vulnerabilities usually aren't because some crazy hacker on a mission has decided they're going to ruin one of these worldwide brands. It's usually because the company themselves have someone, either on their payroll or contracted who has provided the notification of the exploit initially (internally or through a provider channel), either when they were working on the code, they crashed their own systems, or they had a hunch and tested their theory. They notify the company who in-turn rolls out a patch... these people are paid to provide this service.

People read everything with their own filter on the world. If they are a good person, when they see a patch, they probably think to themselves... I need to apply this because I don't want any downtime... but what if the people are bad? Okay, let's not say "good" and "bad" because that's not necessarily the case at all (and part of a larger discussion). Let's say they are users and then those other people who have "too much time on their hands" at the moment. I say this because at one point or another in a white hat hacker's life they have more than likely infected something or spread something on accident. They're not bad people, but if it's uncontrolled it could do just as much damage. Always test on an offline machine if you're going to open Pandora's Box.

The bad
So back to my point about the people filtering what they see. When someone who 1.) wants to experiment, 2.) has downtime, and 3.) a need of an idea for something to hack, they have this great expanse of information (the Internet)... I know it's pretty obvious right? Although [most] people think that most hackers all go to secret websites and have a secret handshake, that's really just the people who go to Defcon or who have friends who are hackers because they do it for a living, or they want to pretend they're hackers. Most of the other hackers I've met happened by accident because someone else mentioned that I hacked, then we talked about the level of what we were into.

Usually self-proclaimed "hackers" in my experience are in actuality script kiddies (people who use a program or a tool in a way they've read about to purposely cause chaos), so often when I'm confronted with the questions of what I do, I kind of go the other way and don't share what I'm into unless they let me know that they're "cool," A.K.A. not a script kiddie. Just like the branding issues companies have with being exploited, "hackers" white, black, and gray.... all hats, also have a branding issue because somewhere some [insert expletive here] is writing a virus that will cause harm and it says the same thing on my nametag to society that his says... I'm a creative professional with the means and ability. Society doesn't care whether I would do it or not or about my moral compass, but you have to think like a "bad guy" to outsmart a bad guy... it doesn't make me "bad." But it makes the unknowing populous marvel and wonder (in a bad way).

On with the Internet reference... when I say they have the Internet at their fingertips, they don't need to go to one of the heavily monitored websites for script kiddies or the IRC channels, all they have to do is browse through a company's patches. In the patches that most people install there is usually some bit of information that says what exploit or vulnerability is being patched. Apple doesn't share a lot of detail about this, but Microsoft usually tells you what they're patching if you follow enough links from Windows Update. Java, Ruby, PHP, and most other opensource languages will release it in a bugfix that you can read about. When it happened to Microsoft's brand before, Microsoft had already provided patches for the exploits for CodeRed and Melissa long before they were in the wild and running rampant. Most people however do not like applying patches because, just like going to the doctor, "If it ain't broke don't fix it."

I've heard all sorts of reasons why someone shouldn't patch something... "because if they don't know I'm running an older version I'm safe" or "it might bring down my machine so I wait a couple of months to test it." Zero-day patches just like zero-day exploits can also bring your machine to its knees. I wait about a week to make sure that a patch has been thoroughly tested by the masses. It takes most companies a couple of days to clean up after a failed patch, so that should be enough time to cover myself. (I can't afford to have downtime.)

The incurable
When an idle mind sees a patch and decides to take it upon themselves to figure out how to exploit it, then that's where the problems arise. The problems where there is a vulnerability that a company doesn't know about the day it's unleashed are called a zero-day exploits or holes and they're usually compromised in a zero-day attack... because the company has had zero days to prepare for the aftermath from a technical and marketing standpoint. These can be people purposely writing a virus or altering code and spreading it. Because a company has little or no warning then it can be catastrophic for the brand.

How is information sharing bad?
The problem is with the channels where information is shared. Most of the highly technical details about a vulnerability do not need to be out in the wild so a passing bot or web crawling search-engine can find them. They need to be behind at least one level of authentication. This makes is more like a deterrent because only the people who would really need to know about something would take the time and effort to go in and look at all of the specifics. Potentially harmful individuals might go in and still compromise a machine or series of systems, but a casual passer-by wouldn't see the info to get any ideas.

Really observant individuals might actually take the time to find a pattern in [poor] programming. For instance Microsoft has been pretty bad about securing Internet Explorer and the way it is interconnected with their operating systems. In the past, when someone logged in with the default Administrator account they could open an e-mail or a webpage and take down their machine with full privileges. Luckily it's a little more difficult for most users now.

On another note Whitepapers can be something of a major problem as well. I downloaded yet another Whitepaper on SQL Injection attacks again today. Nothing new or earth shattering, but it always pays to look to see what I might be up against. I'm always interested in new perspectives.

A thief who can see a whole building and examine it in full detail, might realize it's much easier for them to drive through the wall and bypass the door and window sensors on the alarm system altogether. The same thing applies to Whitepapers and Patch Descriptions on the web. Although much of the media clambers for information about the technical specifics of what happened, it's probably safer if all of that detail isn't on the record completely and in the open. PR and Marketing departments should be the main filter in brand protection. After all, too much self-provided information might actually help in destroying your brand. (Same goes for real hackers.)

Soap Box
If you have a person (or group of people) in your organization or company who really want to support some of the open-source platforms like Java, PHP, Ruby-on-Rails, and so forth they also need to understand the responsibilities that come with maintaining an effectively secure system. Everything needs to be patched and it needs to stay somewhat up-to-date. When companies invest in new ideas and those ideas fail the people who are working on the front lines and in the trenches are the ones that are hit. Most companies can reboot from a failed experiment, but most people can't.

That's all for now.

YouTube Stabilize Video - Not always a good thing.

I did some video editing for a client. They provided me with several videos shot on-location without the use of a tripod. We went through found all of the cuts we were looking for and edited the video to make something really pretty cool and authentic looking. After adding all of the proper titles and fly-ins to the video I rendered the video down so it could be uploaded to YouTube. YouTube will not accept a 40gb raw file.

So I get a call today saying "The type in the video is going all over the place." I quickly opened all of the videos I provided the client to check, and they all appeared as expected. So I go onto YouTube and something crazy is happening with the video. I know all about JPEG and MPEG compression and what that does when you start increasing the compression level, but this was altogether different and wildly amusing (yet scary). They type was crawling across the screen and climbing into areas where I was sure there was no type. I looked at the formats I used to make sure I hadn't selected some hybrid in After Effects that used vector layers by chance (they're always upgrading things) and found no issue with the raster-only formats I was using.

YouTube has some excellent features and this one is supremely impressive. My client upon uploading the video decided to select the option to "Stabilize Video" in the video editor section of the YouTube Video Manager for their channel. The video shakiness was remastered to make the video look completely stable (like a professional videographer shot the footage). If you watched the off-camera areas in the shots they appeared a little strange having been cloned from shots where they existed prior and post. The type however was everywhere, so it made it look like a bad editing job. I mean really bad. It was super distracting. Luckily there's a way to tell YouTube to revert to the original video (you have to dig for it in the video editor settings). Upon selecting the "revert to original," after some time the original non-corrected/non-stabilized video *should* be in place. If this doesn't work you can always delete the video and re-upload the original.

Leave it to Google / YouTube and their new features and upgrades to really ramp up your learning curve. Luckily this time however the crisis was averted.

'Project Mayhem' Hacks Accounting Software - A Rebuttal

The more I read Dark Reading, the more and more I'm starting to notice certain aspects of the new market for hackers. In a recent post on the site - 'Project Mayhem' Hacks Accounting Software, No exploit required for defrauding Microsoft and other accounting systems, researchers at Black Hat Abu Dhabi reveal - they go into detail about this elaborate scheme to create a fake billing transaction in a database.

In my comment about this possible "threat" I mention:

Microsoft should probably use SSL between the client machines and the database and lock down the database so only clients with the appropriate credentials (IP addresses, SSL Keys, and login credentials) would be allowed to make database queries and injections. They might also look at splitting up the database logins, so you have one login for queries and one login for inserts. The tables per client should be named according to the actual company so they're not standardized within Microsoft Dynamics Great Plains across the board. Also the database itself needs to be encrypted (I'm not familiar with the Great Plains system myself) so it couldn't be updated somewhere else and replaced (after the end of business). (One of the things that used to be sort of a standard practice in the 90s was make a copy, hack it offsite, then return it to the system at a later date... so there is no trail.) They might also limit access to the terminal that is authorized to only being allow to make transactions during business hours (like banker's hours for the machine itself).

There are probably hundreds of ways to secure this particular issue. Also from an IT standpoint you would require that all communications to the accounting database come from an accounting computer on the network subnet.

It sounds more like a fail on the Information Technology or Information Systems department's part (or something they wouldn't consider as a possibility).

The problem is more of a human issue. The IT department thinks to themselves that the company only hires qualified people who don't have bad backgrounds. The admins are busy (probably under staffed or better yet outsourced) so they either aren't familiar with the system themselves, don't need to be familiar with the system, or don't have the time to think about all of the possible injections. The idea someone could gain access to the network, have a machine with the necessary tools to actually perform an attack, not have that attack be logged, and do this consistently is a little far-fetched?

Stepping back I see that it makes a great story, but it's just a company trying to get creative with ways of saying "There is no need for our services, but we can prove to you that you need us because we can show you a world of possibilities that are highly improbable, but capable given an enormous amount of funding, interest, and time in the realm of distant possibility."

Another thing, is the people who would have this skill set, the ability to pull off the job, and the ability to collectively network with other individuals and collaborate on something this illegal probably would only ever do this just to say it could be done as a proof of concept. It's unlikely these highly skilled professionals would be unemployed and outspoken enough to say to their other unemployed colleague, "I have a way we could make some money." A little too Hollywood for the real world.

I have a larger thought brewing about these particular "issues" and if given enough time will probably write more about it here and possible in some sort of thesis... unfortunately it's back to my day job for now. Just think, if I had gone to college someone might actually take me seriously.

Until later.

Beware of Bad Holiday Scheming

Okay, so I've had my eye on an iPad Mini since they came out. Smaller device, new form factor, I just want to check them out, and could use one for testing purposes. So I've noticed that on the Apple website when you try to make a purchase during the holidays around Black Friday that the really cool *new* items aren't on sale at all. They're at their regular prices.

So a couple of years ago I found a couple of ways around this. I've bought a few refurbished items from the Apple site at a considerable discount over the regular priced items. The idea of a second-hand, handheld device like an iPad, anything with a keyboard, and even Smart Phones skeeves me out, but luckily when Apple refurbishes an iPad or iPod they actually replace all of the pieces that you would touch with new parts (meaning you're not going to get a scratched touch-screen). This is cool because I can't bring myself to pay full-price for something I don't feel is worth it, and I'm sorry Apple, they're cool devices, but you're paying substandard wages to the people who make them, and they're imported so I shall not reward you. So that's one way to beat Apple at their own game (they still make the money, but not as much from me).

Another way is to check out Best Buy because when they have a Black Friday sale they DO put the Apple items on sale with the other items. This is great for things that aren't yet available as a refurbished item on the Apple store and for things like Apple's horrible excuse for a non-laptop, the Macbook Air (more about that at some other time), that WOULD be nasty to get as a refurbished item if they don't replace the keyboard. Having worked as a network administrator I can truly say YUCK!

So this brings me to the reasoning for this write-up today. Working in advertising and marketing for much of my career (my day job) I've developed a quick eye for bad math and tricks of the trade. Today I received and email that says "Save $25 on your Next Purchase when you use Store Pickup for an Order of $250 or More" at Best Buy. Here's the image from their email:

Seems like a good deal. I can save $25 on that not-yet-refurbished iPad Mini, which amounts to a little less than local sales tax, but it's a savings of sorts... right?

Wrong again.

Apparently the people at Best Buy don't understand the meaning of the word "NEXT."

According to their site:

"Here's how it works

• Place an order of $250 or more on BestBuy.com on Wednesday, December 5 through Saturday, December 8.
• During checkout, choose Store Pickup and select your store.
• The savings code will be e-mailed to you FOUR TO SEVEN DAYS AFTER your order has been picked up in store.
• Redeem your savings code in store or online on YOUR NEXT PURCHASE.
• Note: not all products are available for Store Pickup."

So yes, you're not saving anything AT ALL on your actual NEXT purchase because you have to make a purchase of $250 or more NOW before they take their sweet time to send you your savings code. Then you get a coupon or discount code (I would hope in the form of a $25 gift card but probably not) only AFTER you've made your purchase for the full price. I guess this is what happens when you don't have a marketing budget.

Hey Best Buy give me a call if you need any help understanding English or possibly want to hire someone who isn't out to trick people.

Until later keep an eye out for trickery.

Dark Reading Mailing List Compromised?

So I try to stay on top of the tech news in regard to exploits and security. One of the sites that I subscribe to is Dark Reading. It's more of a main stream sort of whitepaper delivery system for vendors but every once in a while I find something useful. They usually provide links to the real content and I go in search of something more informative on the topic, but they're a good starting point (unlike the 2600 Hacker Quarterly who publishes exploits directly on their pages).

As a hacker I'm paranoid about a lot of things. I see the system and I see all of the nuts, bolts, cables, users, and the complete infrastructure all at once. It's sort of a mind-numbingly overwhelming gift for information overload.

While I was Web Manager working at CertMag.com one of my responsibilities was configuring, securing, and learning the ins and outs of our StrongMail MTA and maintaining our mailing lists locally (amongst a bazillion other things). We had an offsite service that "maintained" our list, but there were a few ways that the list(s) could be captured by savvy listeners when we were submitting it or receiving it over non-secure or non-encrypted channels (think Wireshark). At the time we employed the services of Hallmark Data Systems, and they had several procedures and securities in place to make sure our list was "safe." Basically from what I gathered it was an offline database on an AS 400, although I think they were considering integrating some aspects online (for a fee of course).

We weren't controlling any sensitive information, unless you count names, addresses, titles, and email addresses as sensitive (I guess altogether it could be something because it was a loosely targeted list if you're into marketing). For the most part once that information was sent to the database house it was out of our hands and pretty much would never be seen again in its complete state unless we pulled an audit query. They managed providing the list to the printer that distributed the print versions of our publications and they would also email back to us a queried list of names and email addresses only matching certain criteria per publication (I think this was eventually accessible online after a while come to think of it). They would then update the lists for people who had opted out or unsubscribed for legal and advertising audit purposes. In short it's a big technical inefficient process.

Jump ahead 5 Years later, one of the major issues with web subscriptions today or services where you expect to get something for providing a little personal information is getting tons of stuff that you don't want. So how can you tell whether the unsolicited email you're receiving is random spam, from a sold list, from a compromised web form or from a hacked database? One of the ways I combat this myself is I create a custom email address for every site that I'm registered on. I think right now I'm up to 400 or something ridiculous like that. It's usually nothing anyone would guess... acronyms but not random gibberish. When I register for a new site, I give them a new address. If an email looks like a legitimate pass with something in the footer like "You're receiving this message because you subscribed for Dark Reading," then I know they sold it or it's a sister publication. By law any legitimate sending service is required to provide an opt-out.  Also when someone opts out there is a certain amount of time to stop sending that person messages or the fines could be steep (severely).

So today I'm going through my emails and I see a message to my Dark Reading account titled "Re:Re: sending servers /.../." Out of curiosity I open the message on a *NIX machine and it's an ad for "Highly Stable and Secure Bulk Email Servers for Email Marketing." Sort of ironic. The company that I subscribed with was exploited by a company that provides "Highly Stable and Secure Bulk Email" services that are apparently more secure than my subscriptions own service?

So out comes the magnifying glass. A reverse look-up of the sending server's IP address with ARIN.net goes back to 173.192.141.86 at SoftLayer in Texas. No domain information was provided on the handshake with my email server, so it's no doubt a compromised machine running a root kit or a slave app. The return-path goes to an email address at fillmore.com which is owned by Fillmore Real Estate in Brooklyn. It was more than likely either hacked or they could just be a bounce back victim of a spam reply at which point they're not even involved.

So I dig a little deeper.

There's an email address in the links only(no websites) that goes to 21cn.com. If you're familiar with ccTLDs or country-code Top Level Domains then you'll recognize "cn" as China. This is a .com TLD, so on a hunch I look up the domain in APNIC.net... returned no results, Network Solutions... no results, Ripe.net... no results, but Internic.net came back with very little information and a different whois server for the domain at whois.35.com. So I plug that in and found the registrant to be:

     21cn corporation limited domainmanage@21cn.com +86.2085264358 +86.2085265827
     21CN Corporation Limited
     2F,NO.52 Liuyunwu street,Tiyu Rd,East,Tianhe,Guangzhou,China
     Guangzhou,Guangdong,CN 510620

So apparently the Dark Reading website's database, or their database management service, or some machine at Dark Reading's HQ was "hacked" and their list stolen, because I've not received any bulk emails on that list where I saw any other "subscribers," like an accidental broadcast with everyone in the CC field or some rookie mistake like that. There is the chance someone might have run a cycler to guess my own email address, but it's unlikely since I have a lot more email addresses that begin with letters other than "D" prior. Since it's only been provided to Dark Reading and it's a receive-only alias account I know it is not an issue on my end because that address isn't stored anywhere. If someone gleaned it from my mail server on the off chance they were listening to the data center in California then I'm sure I would receive a lot more of these to all of my email addresses (aliases) on record.  If they're using a service like we were it also might have been compromised in the transfer between Dark Reading and their database managing service.

From a PR standpoint, it always looks bad when a website that publishes info about online security experts might not have an IT staff that implements what they read in their own material. Okay that might be a little harsh considering there are more important things to do like replace faulty mice or tell people their company provided laptop no longer works because they've dropped it one too many times, but I can almost guarantee I probably won't read about it in Dark Reading.

That's all for now.