<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:admin="http://webns.net/mvcb/"
	xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
	xmlns:content="http://purl.org/rss/1.0/modules/content/">
	<channel>
		<title>Gadi Evron &#45; CircleID</title>
		<link>http://www.circleid.com/</link>
		<description>Postings from Gadi Evron on CircleID</description>
		<dc:language>en</dc:language>
		<dc:rights>Copyright 2008, unless where otherwise noted.</dc:rights>
		<dc:date>2008-05-20T08:33:00-08:00</dc:date>
		

		
		<item>
			<title> An Account of the Estonian Internet War (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/85209_account_of_estonian_internet_war</guid>
			<link>http://www.circleid.com/posts/85209_account_of_estonian_internet_war</link>
			<description><![CDATA[About a year ago after coming back from Estonia, I promised I'd send in an account of the Estonian "war". A few months ago I wrote an article for the Georgetown Journal of International Affairs, covering the story of what happened there. This is the "war" that made politicians aware of cyber security and entire countries scared, NATO to "respond" and the US to send in "help". It deserved a better understanding for that alone, whatever actually happened there. <a href="http://www.circleid.com/posts/85209_account_of_estonian_internet_war">More...</a>]]></description>
			<dc:date>2008-05-20T08:33:00-08:00</dc:date>
		</item>
		
		<item>
			<title> An Internet Security Operations Viewpoint of IGF (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/711219_internet_security_operations_igf</guid>
			<link>http://www.circleid.com/posts/711219_internet_security_operations_igf</link>
			<description><![CDATA[The Internet Governance Forum (IGF) is an annual UN conference on Internet governance which was held this year in Rio de Janeiro, Brazil. The topics discussed range from human rights online to providing Internet access in developing countries. A somewhat secondary topic of conversation is Internet security and cyber-crime mostly limited to policy and legislative efforts. Techies and Internet security industry don't have much to do there, but I have a few updates for us from the conference. <a href="http://www.circleid.com/posts/711219_internet_security_operations_igf">More...</a>]]></description>
			<dc:date>2007-11-21T13:59:00-08:00</dc:date>
		</item>
		
		<item>
			<title> More on Broadband Router Insecurity and Being Proactive (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/broadband_router_insecurity</guid>
			<link>http://www.circleid.com/posts/broadband_router_insecurity</link>
			<description><![CDATA[Fergie replied on NANOG to my recent post on the subject of <a href="http://www.circleid.com/posts/broadband_routers_botnets/">broadband routers insecurity</a>: "I'll even go a step further, and say that if ISPs keep punting on the whole botnet issue, and continue to think of themselves as 'common carriers' in some sense -- and continue to disengage on the issue -- then you may eventually forced to address those issues at some point in the not-so-distant future..." He is right, but I have a comment I felt it was important - to me - to make. Not just on this particular vulnerability, but on the "war"... <a href="http://www.circleid.com/posts/broadband_router_insecurity">More...</a>]]></description>
			<dc:date>2007-05-13T10:44:00-08:00</dc:date>
		</item>
		
		<item>
			<title> Broadband Routers and Botnets: Being Proactive (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/broadband_routers_botnets</guid>
			<link>http://www.circleid.com/posts/broadband_routers_botnets</link>
			<description><![CDATA[In this post I'd like to discuss the threat widely circulated insecure broadband routers pose today. We have touched on it before. Today, yet another public report of a vulnerable DSL modem type was posted to bugtraq, this time about a potential WIRELESS flaw with broadband routers being insecure at Deutsche Telekom. I haven't verified this one myself but it refers to "Deutsche Telekom Speedport w700v broadband router"... <a href="http://www.circleid.com/posts/broadband_routers_botnets">More...</a>]]></description>
			<dc:date>2007-05-11T16:26:00-08:00</dc:date>
		</item>
		
		<item>
			<title> Put Security Alongside .XXX (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/put_security_alongside_xxx</guid>
			<link>http://www.circleid.com/posts/put_security_alongside_xxx</link>
			<description><![CDATA[Isn't security as important to discuss as .XSS? The DNS has become an abuse infrastructure, it is no longer just a functional infrastructure. It is not being used by malware, phishing and other Bad Things [TM], it facilitates them. Operational needs require the policy and governance folks to start taking notice. It's high time security got where it needs to be on the agenda, not just because it is important to consider security, but rather because lack of security controls made it a necessity. <a href="http://www.circleid.com/posts/put_security_alongside_xxx">More...</a>]]></description>
			<dc:date>2007-04-02T18:59:00-08:00</dc:date>
		</item>
		
		<item>
			<title> Ongoing Internet Emergency and Domain Names (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/internet_emergency_domain_names</guid>
			<link>http://www.circleid.com/posts/internet_emergency_domain_names</link>
			<description><![CDATA[There is a current ongoing Internet emergency: a critical 0day vulnerability currently exploited in the wild threatens numerous desktop systems which are being compromised and turned into bots, and the domain names hosting it are a significant part of the reason why this attack has not yet been mitigated. This incident is currently being handled by several operational groups. This past February, I sent an email to the Reg-Ops (Registrar Operations) mailing list. The email, which is quoted below, states how DNS abuse (not the DNS infrastructure) is the biggest unmitigated current vulnerability in day-to-day Internet security operations, not to mention abuse. <a href="http://www.circleid.com/posts/internet_emergency_domain_names">More...</a>]]></description>
			<dc:date>2007-03-30T22:10:00-08:00</dc:date>
		</item>
		
		<item>
			<title> How Many Bots? How Many Botnets? (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/how_many_bots_how_many_botnets</guid>
			<link>http://www.circleid.com/posts/how_many_bots_how_many_botnets</link>
			<description><![CDATA[We touched on this subject in the past, but recently Rich Kulawiek wrote a very interesting email to NANOG to which I replied, and decided to share my answer here as well: I stopped really counting bots a while back. I insisted, along with many friends, that counting botnets was what matters. When we reached thousands we gave that up. We often quoted anti-nuclear weapons proliferation sentiments from the Cold War, such as: "why be able to destroy the world a thousand times over if once is more than enough?" we often also changed it to say "3 times" as redundancy could be important... <a href="http://www.circleid.com/posts/how_many_bots_how_many_botnets">More...</a>]]></description>
			<dc:date>2007-02-20T15:57:00-08:00</dc:date>
		</item>
		
		<item>
			<title> Web Server Botnets and Server Farms as Attack Platforms (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/web_server_botnets_farms_attack</guid>
			<link>http://www.circleid.com/posts/web_server_botnets_farms_attack</link>
			<description><![CDATA[Are file inclusion vulnerabilitiess equivalent to remote code execution? Are servers (both Linux and Windows) now the lower hanging fruit rather than desktop systems? In the February edition of the <a href="http://www.virusbtn.com/">Virus Bulletin magazine</a>, we (Kfir Damari, Noam Rathaus and Gadi Evron (me) of <a href="http://www.beyondsecurity.com/">Beyond Security</a>) wrote an article on cross platform web server malware and their massive use as botnets, spam bots and generally as attack platforms. Web security papers deal mostly with secure coding and application security. In this paper we describe how these are taken to the next level with live attacks and operational problems service providers deal with daily. <a href="http://www.circleid.com/posts/web_server_botnets_farms_attack">More...</a>]]></description>
			<dc:date>2007-02-12T16:56:00-08:00</dc:date>
		</item>
		
		<item>
			<title> Google, Service Providers and the Future of P2P (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/google_service_providers_and_the_future_of_p2p</guid>
			<link>http://www.circleid.com/posts/google_service_providers_and_the_future_of_p2p</link>
			<description><![CDATA[In a non-operational NANOG discussion about Google bandwidth uses, several statements were made. It all started from the following post by Mark Boolootian: "Cringley has a theory and it involves Google, video, and oversubscribed backbones..." The following comment has to be one of the most important comments in the entire article and its a bit disturbing... <a href="http://www.circleid.com/posts/google_service_providers_and_the_future_of_p2p">More...</a>]]></description>
			<dc:date>2007-01-20T17:14:00-08:00</dc:date>
		</item>
		
		<item>
			<title> P2P as a New Spam Medium, Moving From PoC to Full Operations (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/p2p_spam_poc_to_full_operations</guid>
			<link>http://www.circleid.com/posts/p2p_spam_poc_to_full_operations</link>
			<description><![CDATA[Spam on P2P networks used to be mainly with advertising inside downloaded movies and pictures (mainly pornographic in nature), as well as by hiding viruses and other malware in downloaded warez and most any other file type (from zip archives to movie files). Further, P2P networks were in the past used for harvesting by spammers. Today, P2P has become a direct to customer spamvertizing medium. This has been an ongoing change for a while. As we speak, it is moving from a proof of concept trial to a full spread of spam, day in, day out... <a href="http://www.circleid.com/posts/p2p_spam_poc_to_full_operations">More...</a>]]></description>
			<dc:date>2006-11-21T16:56:00-08:00</dc:date>
		</item>
		
		<item>
			<title> ICANN Issues a Statement on the Spamhaus Case (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/icann_statement_spamhaus_case</guid>
			<link>http://www.circleid.com/posts/icann_statement_spamhaus_case</link>
			<description><![CDATA[ICANN issued a <a href="http://www.icann.org/announcements/announcement-10oct06.htm" title="statement">statement</a> on the <a href="http://www.circleid.com/posts/icann_illinois_court_suspend_spamhaus/" title="Spamhaus case">Spamhaus case</a>: "...ICANN is not a party to this action and no order has been issued in this matter requiring any action by ICANN. Additionally, ICANN cannot comply with any order requiring it to suspend Spamhaus.org..." <a href="http://www.circleid.com/posts/icann_statement_spamhaus_case">More...</a>]]></description>
			<dc:date>2006-10-11T18:09:00-08:00</dc:date>
		</item>
		
		<item>
			<title> ICANN Ordered by Illinois Court to Suspend Spamhaus.org (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/icann_illinois_court_suspend_spamhaus</guid>
			<link>http://www.circleid.com/posts/icann_illinois_court_suspend_spamhaus</link>
			<description><![CDATA[Apparently, at this stage, it is only a proposed ruling. But I am no lawyer. This story <a href="http://blogs.securiteam.com/index.php/archives/608">has been discussed before</a>, when Spamhaus, which is located in the UK, was sued in the US by a spammer. They refused to come before the court as "they do no business in Illinois, and are located in the UK...After this court ruling, Spamhaus.org was under a DDoS attack, in my opinion for the purpose of preventing users from reaching the information it provided about the court ruling. This was done along-side a Joe Job, sending fake email appearing to come from Spamhaus's CEO... <a href="http://www.circleid.com/posts/icann_illinois_court_suspend_spamhaus">More...</a>]]></description>
			<dc:date>2006-10-07T09:31:00-08:00</dc:date>
		</item>
		
		<item>
			<title> .MS: Alternate Root and Monoculture as Good Things (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/alternate_root_tlds_as_good_things</guid>
			<link>http://www.circleid.com/posts/alternate_root_tlds_as_good_things</link>
			<description><![CDATA[Why shouldn't there be a .gadi TLD? Why not one for Microsoft? This post is not about alternate roots or why they are bad, this post is about something else. We do need to go over some background (from my perspective) very quickly though. ICANN has a steel-fist control over what happens in the DNS realm. They decide what is allowed, and who gets money from it. Whether it's VeriSign for .com or any registrar for the domains they sell. They decide if .gadi should exist or not. ...What I am here to discuss is why Microsoft, as a non-arbitrary choice this time, indeed, of all the world, should kick it aside, creating an alternate root while at the same time not disturbing the world's DNS. <a href="http://www.circleid.com/posts/alternate_root_tlds_as_good_things">More...</a>]]></description>
			<dc:date>2006-09-17T09:32:00-08:00</dc:date>
		</item>
		
		<item>
			<title> Why Senator Stevens is Right on Net Neutrality (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/senator_stevens_on_net_neutrality</guid>
			<link>http://www.circleid.com/posts/senator_stevens_on_net_neutrality</link>
			<description><![CDATA[Several people emailed me about the actual things the senator said and why he is off-base. I decided to listen to his speech again, and write down the points I believe are critical. Senator Stevens who everyone is dissing on for his speech on Net Neutrality in my book spoke nothing less than brilliant. I will also tell you, in my opinion, exactly why... He nailed down the subject into the point that matters: Business. It's about profit. <a href="http://www.circleid.com/posts/senator_stevens_on_net_neutrality">More...</a>]]></description>
			<dc:date>2006-07-06T08:26:00-08:00</dc:date>
		</item>
		
		<item>
			<title> Net Neutrality Is As Silly As So-Called Internet Governance (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/net_neutrality_silly_as_internet_governance</guid>
			<link>http://www.circleid.com/posts/net_neutrality_silly_as_internet_governance</link>
			<description><![CDATA[From the perspective of Internet security operations, here is what Net Neutrality means to me. I am not saying these issues aren't important, I am saying they are basically arguing over the colour of bits and self-marginalizing themselves. For a while now I tried not to comment on the Net Neutrality non-issue, much like I didn't comment much on the whole "owning the Internet by owning the Domain Name System" thingie. Here it goes anyway. Two years ago I strongly advocated that consumer ISP's should block some ports, either as incident response measures or as permanent security measures... <a href="http://www.circleid.com/posts/net_neutrality_silly_as_internet_governance">More...</a>]]></description>
			<dc:date>2006-07-04T08:09:00-08:00</dc:date>
		</item>
		
	</channel>
</rss>