Fake Lotto for Indian Premier League

There has been yet another spam attack on the widely followed game of cricket. Earlier this year, Symantec reported about a spam attack that targeted the Cricket World Cup. It is now time for the Indian Premier League (IPL). With the playoffs in progress and the grand finale just two matches away, it is not surprising to see spammers trying to make the best of it.

We have observed IPL scam, in the wild, promoting an IPL lottery. Were the IPL honchos promoting a sweepstake of this sort?  We did our research and the answer is no.  So, where did this offer come from?  We investigated further and found that it was from a compromised machine from the suburbs of Mumbai, India.

Below is the spam sample:


So what is this scam all about? Our analysis found out that it comes from a fake “IndianPremier League Fiduciary Agent– claim department” and speaks about a whooping amount of “(Rs/-56,80,708.00) Fifty Six Lacs Eighty Thousand Seven Hundred and Eight India Rupees”.  What does a user have to do to get this coveted cheque/demand draft? As is customary with such scams, there is a list of information that needs to be provided along with personal details such as:
·         Full name
·         Date of birth
·         Present contact address
·         Email address
·         Mobile number

Ironically, there is a security warning included in the offer: “For Security reasons, you are advised to keep your winning information CONFIDENTIAL to avoid double claim or impersonation”.
All this together makes for a perfect IPL sweepstake scam!  This scam attack is targeted at the cricket-crazy population in India. We advise our readers to follow general security and safety policies and to not reply to such scam emails.

Thanks to Christopher Mendes for the contribution of this blog.

By: Samir Patil

Cybercriminals Catch the Olympic Fever Early On

There is no doubt that athletes all around the world are training hard to compete at the London Olympics in 2012, but cyber criminals seem to be gearing up for the event as well. Even with over 400 days still to go until the Olympics, we have already started seeing search terms related to this event returning a large number of poisoned links. As we have observed with search engine optimization (SEO) poisoning in the past, these poisoned links redirect to rogue antivirus sites.

The following are the top 10 poisoned search terms:


We have also found dozens of other poisoned search terms related to Olympics tickets, mascots, offers, and so on. Below is a screenshot of the search results for the term “london 2012 stadium diagram”; Norton Safe Web indicates that all of the first 10 links are malicious:



These URLs redirect to malicious content only when you click on the link from the search engine result page—a benign page is presented when you navigate to these links directly. We found the fake pages created by scammers to contain Olympic-related text, images, and links to other fake pages. These pages are presented to the search engine bots for indexing, and all of these images are hot-linked from reputable news sites. The presence of images on these pages suggests that these sites are being used to poison image searches as well.

Below is a sample page presented to the search engine bot for indexing:


Once a user clicks on the search result link, he or she is redirected to a fake online scanner that asks the user to download rogue antivirus software:



In this case, the user is tricked into installing the rogue antivirus XP Total Security 2011, which pretends to scan the system and shows a huge list of threats to be "fixed":



During the course of the year leading up to the big event, we expect to see many more Olympics-related search terms being used by cybercriminals to push rogue antivirus software. We have already found over 300 compromised sites used in this campaign over the past week. We recommend that users stick to legitimate news sites, and keep a look out for domain names that appear to be unrelated to the news being searched for. Symantec customers are already protected from this attack with IPS, AV, and Safe Web technologies.

By: Nithya Raman

What iPads Did To My Family -- A Year Later

About a year ago, I wrote my most popular post of all time: What iPads Did To My Family.
The timing was good: the iPad was just getting into people's hands, and people were interested in the intersection between brand new tech and how we all react to it.  Yes, it's only been about a year ...

Best as I can figure, the post has been read more than 500,000 times.  If you really want some fun, scroll through the 100+ comments.

I thought I owed people a follow-up post -- sort of a sequel to the story.

 It's been a year -- what's changed?

The iPad Is Incremental At the time, the heated debate was whether or not iPads could replace full-functioned desktops, laptops, etc.  The answer -- at least in our household -- is most certainly "no".
For example, I have four students in my family -- three children plus my wife.  There is jus no way you're going to voluntarily pick up an iPad to write a term paper, take online courseware, etc.
Sure, the iPad software is plenty functional, but the keyboard is for occasional use only.  For me, I sometimes have to write stuff up while at home -- I use a traditional desktop or laptop for that.
That means that the aging fleet of PCs and laptops will stay for the time being -- albeit reduced somewhat in status and priority.  No upgrades planned here anytime soon.

The Personal, Portable Browser
The iPad, however, has joined the mobile phone as a "must have" in our family.

One goes with us everywhere we go: vacations, shopping, anytime we're out and about.  For example, if you're walking around in a new city, you can bring up big maps, find interesting restaurants, etc. in a way that's hard to do on a smaller smartphone screen.

As a more useful example, we'll be shopping for something, and we'll be reading product reviews, doing comparison shopping, etc. while we're standing right there in the store or car dealership.
Tap, tap, tap.   You can see the brief glimpse of despair in the occasional salesperson's face as they walk up to us and see what we're doing.

No surprise, all of our iPads going forward will now come standard with AT&T 3G for those times when there's no WiFi around.  The 3G service isn't all that expensive for occasional use, and we can take it out of the country -- for example, on a recent trip to Niagara Falls.

Video Streaming, Anyone?
Back at home (and on WiFi!) it's changed a lot of our viewing habits.

Between NetFlix and YouTube, we don't spend as much time staring at wall-mounted TVs as we used to.  Now we tend to cuddle up in a comfy chair (or bed!) and dial up something mindless to watch.  Much better than channel surfing, even with 500 channels.  Tap, tap, tap -- and very few ads.

Email, Twitter, Facebook, web surfing, et. al. -- all best consumed on the iPad.  Occasionally, you'll want a lot of real-estate on a screen (e.g. doing detailed research), but for everything else ...

The New Indispensable Business Tool
I go through periods where I'm a bonafide road warrior -- and, as anyone who travels knows, WiFi access at hotels, airports, etc. can be sketchy at times.  The 3G access means I can get online to my email, etc. whenever and wherever I happen to be.  No fuss, no muss -- just turn it on and go.

During my frequent airline flights, the iPad is loaded up with music, video, reading, games, etc. -- plenty to keep me entertained while firmly wedged into the center seat.  I also get to indulge my "closet musician", taking the rough tracks created on my Mac version of GarageBand and listening to them critically on the iPad version.  Time flies when your brain is busy ...

I have also come to the conclusion that insanely long battery life is the new "killer app" when travelling.  I'm not hunting for power outlets in airports anymore.

For example, I recently had a 20-hour workday where I used the iPad continually -- both WiFi and 3G.  I got home at 1:30 AM, and it still had 25% battery left -- which (as experienced users will know) represents many more hours left to go.  Needless to say, I didn't stay up to see how long it would last.

In meetings, the iPad format is perfect for reading email and attached docs, viewing your calendar, or maybe taking a few notes if someone is saying something interesting.
Or maybe idly surfing the web ...

I do still carry around my MacBook Air, but it gets a lot less use -- mostly composing longer documents, or doing detailed presentation editing, or anytime I need a bit more screen real estate to read something.
Everything else, it's iPad for me.

Games, Games, Games!
The touchscreen interface means that games are a lot easier to play -- physically, I mean.  No mouse, no keyboard, just point/tap/swipe/etc.  Tap, tap, tap.  If you're stuck in a center airplane seat with no elbow room and a seat reclined into your face, that's a big deal.

Although a few hard-core gamers in my house (e.g. my 17-year-old son) prefers consoles and PCs, everyone else in the family is quickly gravitating to native iPad games as the preferred time-waster.
Plants vs. Zombies, World of Goo, Angry Birds, Scrabble, et. al. -- our iPad game library continues to grow.

Packaged Entertainment For Younger Kids
Although my kids are getting older, we frequently have families visiting with younger members.  The problem is that we don't have much around to entertain them -- we got rid of all that junk years ago.
Way back when, we'd use to pop in a "Barney" video tape, and they'd be quietly hypnotized so the grownups could visit.  Now we hand over an iPad with a few cool age-appropriate games, and the result is even better.  The kids get hypnotized, and we're free to carry on.  Tap, tap, tap.
Two downsides, though.  

There's usually a fuss when it's time to pry the iPad out of the kids' hands (tears are common), and more than a few parents have been dismayed when their precious offspring eschew the approved educational software and end up with a strong preference for gleefully destroying zombies with animated plants :)

Older Kids, Too
I have a daughter (20), a son (17) and my youngest daughter is 15.  I occasionally ask them -- what would you like as your primary computer, a laptop or an iPad?
They think long and hard about it each time I ask.

The first answer is inevitably "both!" (yeah, right) but if I force them to choose, it's a laptop.  After all, they're all still students, and I don't think it's a practical proposition to do all your schoolwork (or your office work for that matter) from an iPad.

For them, the iPad is incremental, and not a replacement for a traditional laptop.

Technology So Good, You Don't Think Of It As Technology
The best personal technology isn't perceived as technology.
It quietly assumes a place in your daily life, and you barely notice how often you're using it until you stop and think about what you did before.

Such is the case with the iPad.  Its powerful functionality and slick integration means we don't really think about it as technology, it's just now a part of our daily lives.  And we're starting to forget what we used to do before it was around.

Any Interest In The Other Tablets?
Lots of cool tablet devices in the pipeline.  I'm sure that each will find a few followers here or there.  That's fine -- choices are good.

But, at least in my family, there's no need to consider alternatives.  The iPad fits in nicely with our busy daily lives.  It's quickly become a friendly and familiar face around our house.  The refrain of "where's an iPad?" can often be heard when we're together.  We miss it when it's not around.
Why would we replace a good friend?

By: Chuck Hollis

Humanizing Education Through Video

What if Isaac Newton had owned a video camera? Suspend your disbelief a little more … what if he used that camera to record himself teaching calculus lessons and then posted those lessons on YouTube?


Well, if Newton had done these things, then Salman Khan “wouldn’t have to,” as Khan said in a March TED Talk. Since Newton pre-dated the digital era, Khan took it upon himself to fill the gap with his brainchild, Khan Academy, the world’s first video-based virtual school.

It all began in 2004, when Khan recorded math tutorials for his school-aged cousin and posted them to YouTube. His cousin could access the lessons at her convenience, replaying them as many times as she needed to master the subject. Fast-forward seven years, and it’s safe to say Khan’s virtual-classroom platform has grown just a bit …  to 2,200 videos accessed by more than one million viewers each month.

According to Khan, teaching through video technology helps humanize education. This assertion may seem counterintuitive—after all, the videos don’t even show Khan’s face, just a digital chalkboard and his multi-colored hand-written notes—but Khan has proof that the videos result in increased interaction among teachers and students. He has heard from teachers that assign the videos as homework so that they don’t spend their class time lecturing, but rather spend it facilitating group work, enrichment activities, and remedial help.

Khan Academy certainly exemplifies the power of video technology to change education for the better. The project clearly refutes some educators’ protests to the integration of more technology into the teaching process. I’d argue that video, especially telepresence, could do even more for Khan Academy: it has the potential to bring to fruition Khan’s vision of a “global one-world classroom.” Khan aspires to make the site a forum through which, for example, a student in California can discuss material with a student in Calcutta. Imagine the power of this interaction should it take place via telepresence—two students, a world away from one another, suddenly in the same virtual room sharing the learning experience. It doesn’t get more human or global than that.

By: Kerry Best

Filling the Void: School Districts Embrace Telepresence to Save Money and Share Resources

With budgets tighter than ever, school administrators are finding new ways to collaborate with other schools and districts hundreds of miles away.  Instead of spending money on flights and hotels to travel across the state and share best practices with others in their field, teachers, principals and superintendents in several California schools are now using telepresence to get that same face-to-face interaction without leaving town.


Fontana Unified School District (FUSD) in Southern California, for example, is a huge district – 41,000 students at 40 schools across 25 miles. FUSD is the latest school district to incorporate telepresence in order to offer their students the best programs possible — and not only prepare them for college, but also prepare them for the real world.  In such a large district, telepresence is a vehicle that allows the district to offer the same opportunities to every student at every school, and save time and money because administrators don’t have to travel across town for meetings.

Fresno Unified School District and Long Beach Unified School District, both in economically distressed regions with high poverty rates, are other examples of California districts that began using telepresence last year – in this case to solve a K-6 math crisis.  By incorporating visual communication capabilities, the two districts are able to get more done faster and more efficiently at a far lower cost.  The face-to-face interaction allows them to collaborate in a meaningful way without spending the time and money to travel to the other’s district.

The more school districts are able to incorporate telepresence, the more each district, school, and student can benefit by being able to collaborate with schools across the state, country and hopefully world.

By: Kerry Best

Too Many Hoaxes

At first, I was just plain annoyed. Someone forwarded a hoax email to me twice in the same week. I am often asked about hoax email: “Kevin, you work at Symantec, is this true?” That’s fine; that’s not what annoyed me. What set me off was that both emails had been forwarded to warn me. The forwarder wasn’t even questioning the content of the email. They had accepted clearly bogus warnings about the “world’s worst virus” as fact.

Then I started thinking about the Twitter discussion I recently had about education. Some security professionals are turned off by education because they don’t believe it works. The rest feel it’s important, but never done right. (I fall into the latter category.) And, I decided that my previous approach to educating people about these hoaxes was not working. Just giving people a link to a Web page that disputes the hoax is not enough. Rather than give a man a fish, I needed to teach them how to fish.

So, I sat down and wrote an email explaining how to spot a virus hoax. It took a little longer than just forwarding a link, but I think it will be more effective. Plus, I can now just cut and paste this email as a response the next time someone forwards a hoax email to me.

If you want to give what I’ve done a try, I turned my email into a template that you can use. (See below.) The next time someone forwards a hoax email to you, just cut and paste this into a reply. I’m optimistic that we can educate people—we just need to adjust and adapt when things don’t work.
-----
Dear [fill in friend’s name],

As you know, I work at [Company Name] in the group that covers computer security. I see my fair share of viruses. I also see quite a bit of hoax email. The email you forwarded is a hoax.

It is true that miscreants are sending email with attachments and making posts to people’s Facebook pages with links that lead to malware. They use high profile events or interesting sounding videos to get you to click on the attachment or link. The goal is always the same, to get you to click and become infected. It is only the come-on that changes.

But, the thing is, any warning that comes in via email is almost always a hoax. They are never about real malware. Sometimes they tell you to do things that could actually damage your computer. (Hoaxers have a strange sense of humor.)

There are five easy ways to tell if the email you’ve received is a hoax:

1.    Snopes verified it.

The email you forwarded to me is confirmed by Snopes as a hoax. The hoaxers only tell you Snopes has verified it as true so you will not check for yourself.

2.    It’s the worst virus Symantec has ever seen.

Even if it truly existed, it would not be the worst virus ever seen. Trust me. Unless it will force cylinders used for uranium enrichment to spin out of control, it is not the worse virus ever seen.

3.    It does irreversible harm to your computer.

People who write malware are crooks, not vandals. They try to steal your information. They need your machine to stay functioning to do that.

4.    A reliable person forwarded the email.

Being reliable and being a good judge of hoaxes are two completely different skills.

5.   You are to forward the email to everyone you know.

Good-hearted people try to warn others of impending disasters. Hoaxers tell people to forward an email to everyone they know. Thanks for being so concerned—it speaks well of you as a person. But, next time, please just delete the email.

Regards,

[Your name here]

By: Kevin Haley

W32.Qakbot - Under The Surface

W32.Qakbot is a worm that's been around since at least 2009. The worm initially infects users by exploiting vulnerabilities when certain Web pages are visited. It subsequenly spreads through network shares and removable drives. It downloads additional files, steals information, and opens a back door on the compromised computer. During the past few months we've seen high levels of active development from the malware author's side with the intent of circumventing detection techniques used by various security software.

The Symantec Security Response team has been monitoring this worm for the past couple of years. Activity around Qakbot appears every couple of months with external entities claiming to see an outbreak. The last major wave we saw started in early April. We took that opportunity to spend additional time to analyze and document the working of this threat in a little more detail. We took some actions to monitor the threat's prevalence and learnt a good amount.

Data acquired using our in-field telemetry show us just how prevalent this worm is. In the first quarter of 2011 the worm activity wasn't very different as compared to most other active worms. Once the author seeded the newer variants, its hard to believe if he/she could have foreseen its ability to spread.


Some of the key findings from the analysis of Qakbot were -

1. The worm spreads using network (SMB) drives, infected web pages, as well as removable drives
2. It steals keystrokes, certificates, POP3 passwords, as well as FTP credentials
3. It uses FTP credentials to locate web pages and infect them by injecting code
4. The worm steals online banking session tokens
5. It sets up a local SOCKS server which is used by the malware controller to connect through the compromised computer and reuse the hijacked banking session token
6. Qakbot has the ability to remove 'logoff' links from client visibility for some banking sites, and subsequently extend active sessions
7. It has a usermode rootkit which allows it to hide its files, processes and network connections
8. The data being targeted by this worm is primarily from clients using services of US-based banks and other financial institutions

In one instance, a few weeks ago, we also saw Qakbot files being digitally signed using a valid legitimate key. The intention behind signing the files is always to enhance appearance of legitimacy to unsuspecting end users. While we spoke with the legitimate owners of the digital key and got it revoked, a stolen key being used by Qakbot shows how actively the controllers are seeking means to push their creations to a wider client base.

Additional statistics about how many people continue to be affected by the threat on an ongoing basis, can be found with the report liked off the bottom of this article. Also within the document one can find details of each of the aforementioned Qakbot functions.

Details about all the aforementioned Qakbot functions and additional statistics, including infection rates, can be read about in this whitepaper.

By: Symantec Security Response

Phishers Return For Tax Returns

The Income Tax Department of India recently announced that the last date for sending income tax returns for AY 2010-2011 has been extended to July 31, 2011. During 2010, phishers had plotted their phishing scams based on the tax return deadline. As the deadline for tax returns of the current financial year approaches, phishers have returned with their stream of phishing sites.

This time, phishers have spoofed the Reserve Bank of India’s Web site as a ploy for a tax refund scam. The phishing site attempts to lure users by stating that the bank would take full responsibility for depositing the tax refund to the user’s personal bank account. The user is prompted to select the name of the bank and enter their customer ID and password. There is a list of eight banks to choose from. In this way, phishers intend to steal the confidential information of customers of several banks from a single phishing site. The following page asked for credit/debit card number and PIN number. After these details are entered, the phishing site displays a message acknowledging that the request for the tax refund has been submitted successfully. The user is then redirected to the legitimate Web site of Reserve Bank of India. If users fall victim to the phishing site, phishers will have stolen their information for financial gain.

Symantec has been in contact with the Reserve Bank of India. The bank has stated that emails sent in its name to customers have been observed asking for bank account details. The Reserve Bank has clarified that it has not sent any such email and that the Reserve Bank (or any bank) never issues communication asking for bank account details for any purpose. The Reserve Bank has also appealed to members of public to not respond to such email and to not share their bank account details with anyone for any purpose.



The phishing site used a numbered IP domain (for example, domains like hxxp://255.255.255.255) hosted on servers based in St Louis, USA. The same IP was used for hosting phishing sites of several other Indian banks. The IP belongs to a Web site of a company that provides roofing for houses. The IP of the company’s Web site was compromised to host the phishing sites.

Internet users are advised to follow best practices to avoid phishing attacks:
•    Do not click on suspicious links in email messages.
•    Avoid providing any personal information when answering an email.
•    Never enter personal information in a pop-up screen.
•    Frequently update your security software, such as Norton Internet Security 2011, which protects you from online phishing.

By: Mathew Maniyara

A Manifesto For Big Data

An interesting serendipity.  EMC goes long on Big Data at EMC World.  

And the McKinsey Global Institute releases a stupendous landmark tome entitled "Big Data: The Next Frontier For Innovation, Competition and Productivity".  For free - no reg required.

This document is making the round at warp speed in my circles.  At least ten people have sent me a copy, usually raving about it.  I read it at length (warning: it's long), and I have now also turned into an ardent fan.

If you care anything at all about Big Data (or might be just a bit curious), or -- as a leader, you care about "innovation, competition and productivity" --  make the time to go read this paper in its entirety.  Not the short summary, the full-boat longer version.

It uniquely captures the breadth and depth of the opportunity in front of us collectively.  It does a yeoman's job of quantifying the economic benefits in five interesting use cases.  It offers pragmatic advice for both the organizational leader as well as policy makers everywhere.  And it has a useful and easy-to-understand glossary of big data terms and concepts.  

If I could make it required reading to pass the course, I would.

Please, go make a few hours in your busy life and go read this PDF (it's at the bottom of the page).

(disclosure -- a lot of people on Twiiter wondered if EMC had someone sponsored this work.  Fair question.  The timing, the talk-track -- I mean, it's almost eerie.  But, alas, that's not the case to the best of my knowledge.)

It's that good.

My personal congratulations to the McKinsey team for a landmark intellectual contribution on the topic.  For the ability to express compelling technology in business terms that anyone should be able to understand.  

And, especially, for the wisdom to make it freely available to all.

More could learn from your stellar example :)

Staying Ahead of the Hacker Curve

Turn-key Web Application Security Solution

Anti-virus, network firewalls and malware protection alone do not protect web applications or websites from hackers. Whether it's politically motivated attacks from rogue states, or financially motivated attacks, there is a continuous stream of new security threats. With approximately 75% of all Internet attacks targeting web applications, it's critical for companies to be prepared to defend their information assets diligently. This is becoming even more important, and more challenging, as these applications are developed and deployed within cloud environments.

Solution

I have been waiting for this type of solution for a long time. I always thought the best solution would be able to discover the weaknesses of a web application by scanning, and then use the results of that scan to block hackers from exploiting the vulnerabilities. It's finally here. The Cenzic / Citrix integration does just that by protecting websites against hacker attacks by detecting and then protecting them against a broad range of threats. Cenzic's web testing (vulnerability scanning) solutions combined with the Citrix's web application firewall is a powerful combination that prevents breaches and secures websites for both on-premise and cloud based application deployments. The integration provides a "1-2 punch" against website hackers, as Cenzic identifies the website weaknesses and Citrix blocks against them.

Benefits

• Turnkey Web Application Security Solution
  • Reduces risk by identifying and blocking vulnerabilities in websites and web applications that hackers exploit
  • Integrated solution allows faster set-up of NetScaler WAF and easier on-going web application security
  • Does not require deep security expertise
• Compliance
  • Citrix and Cenzic provide compliance testing and reports to meet GLBA, PCI, HIPAA, SOX & other regulations
• Solutions for companies that need to protect their data
  • On-premise or SaaS solutions from Cenzic and Citrix
  • Entry-level to enterprise—all industries
  • Protects customer information, meets government regulations and secures web commerce from hackers

How it works

1. Websites are tested for security flaws using Cenzic
2. Results are imported into the Citrix Web Application Firewall (WAF)
3. The Citrix WAF blocks attacks directed at those security flaws
4. Users routinely run website security tests to stay ahead of the hacker curve 

Big Science Means Big Data

I don't know about you, but modern astronomy fascinates me: just about everything I learned about the subject when younger has since been re-written.  Like most of the sciences, things are moving fast indeed.

Increasingly, pushing the boundaries of human understanding now requires big data.  The bigger the science, the bigger the data it seems.

As a case in point, I'd like to discuss the proposed Square Kilometre Array (SKA), and how -- from a storage perspective -- it pushes the boundaries for all of us.

To Being With

The bigger the telescope, the more signal it can capture and correlate.  The more signal, the farther away it can probe, and -- correspondingly -- the farther back in time we can look.

Not only that, but there's increasing evidence that many of the biological precursors for life are routinely manufactured in interstellar space.  I don't know about you, but that gets my curiousity going :)

When we move from shorter wavelength optical to longer-wavelength radio, telescopes can get very big indeed.  Big radio telescopes need big land, and -- ideally - a location with a minimum of background interference.

As I understand it, the contest is now down to either South Africa or ANZ as to who's going to host this monster.  Either way, there's going to be a *lot* of data.

Fun With Numbers

Consider this quote from a recent article:

"... each of the 3000 dishes will be collecting data continuously and when combined, the SKA will produce nine million signals at once, enough to fill five thousand 160-gigabyte mp3 players every minute."

The storage geek in me finds this fascinating.

Let's see ... five thousand times 160 GB is about 800 TB per minute.  At ten hours per day, that's about 480 petabytes per day.  Now, assume it runs for a few years to get a good survey baseline for researchers.  We can easily be at 500,000 petabytes without too much effort.

On behalf of EMC and the entire storage industry, sign me up!

Seriously, though, given the current state (and economics!) of storage technologies, no one's going to be standing up that amount of capacity anytime soon.  But it does serve to illustrate the insatiable demand for ever more capacity -- especially in many areas of advanced scientific research.

The Bad News

Unfortunately -- like most initiatives -- data captured will be limited solely by the funding model and current technological limits.  There will be X amount of money for storage capabilities.  No matter how efficient or how compressed -- most of the data will inevitably be thrown away.

Indeed, building high-speed computers to decide what to keep and what to discard (in realtime) itself is a major undertaking.

.. To deal with the problem Gaensler and colleagues are working on new intelligent computer algorithms to process the torrent of data.  "We need computers that can do the job of humans, but make decisions on a timescale of microseconds. It would decide if something is interesting or should be thrown away," he says.  "Undoubtedly we'll occasionally be throwing out important data."

That's unfortunate -- having to deploy enormous amounts of computing resource to simply figure out what's not worth saving, and frequently getting it wrong.

Using The Data

Most of the article focuses on the primary challenges associated with simply capturing the signal streams.  Step back a minute, and consider the related challenge of making all these data sets freely available to researchers around the world.  Even more storage -- and considerable bandwidth as well.   In some respects, this aspect becomes even more important than primary data capture.

Much of the interesting work in modern astronomy involves comparing time series over very long periods of time -- years quickly become decades or longer.  So it's safe to imagine this data being around a very long time indeed.

Big data becomes even bigger data.

A Quick Plug

At EMC, we've become intensely interested in these researchers -- who are they, what are they doing, and what do they need from us?

As a result, EMC is hosting what we believe to be an industry first: a summit for data scientists, hosted at EMC World next week.

Take a quick look at the agenda -- this isn't about technology; it's about what's now possible that simply couldn't be considered before.

And that's cool.

Cutting Edge -- Or Merely A Preview Of Things To Come?

It's tempting to look at initiatives such as this and immediately classify them as exotic outliers -- certainly not anything any of us would ever encounter from an IT perspective.

Really?  

The energy industry is now contemplating what to do with all the metering data that's starting to be available from smart grids and intelligent appliances.  Some law enforcement agencies are starting to get drowned with all the video that's now available.  Health researchers have realized that more data means better outcomes for patients. Investment firms are now starting to monitor Twitter streams to gauge consumer sentiment.

And all of that is even before we settle the matter of smartphones tracking our every location.

Look around a bit, and you'll see signs of big data showing up just about everywhere.

Are you ready?

By: Chuck Hollis

VP -- Global Marketing CTO

EMC Corporation

Filling the Void: School Districts Embrace Telepresence to Save Money and Share Resources

With budgets tighter than ever, school administrators are finding new ways to collaborate with other schools and districts hundreds of miles away.  Instead of spending money on flights and hotels to travel across the state and share best practices with others in their field, teachers, principals and superintendents in several California schools are now using telepresence to get that same face-to-face interaction without leaving town.

Fontana Unified School District (FUSD) in Southern California, for example, is a huge district – 41,000 students at 40 schools across 25 miles. FUSD is the latest school district to incorporate telepresence in order to offer their students the best programs possible — and not only prepare them for college, but also prepare them for the real world.  In such a large district, telepresence is a vehicle that allows the district to offer the same opportunities to every student at every school, and save time and money because administrators don’t have to travel across town for meetings.

Fresno Unified School District and Long Beach Unified School District, both in economically distressed regions with high poverty rates, are other examples of California districts that began using telepresence last year – in this case to solve a K-6 math crisis.  By incorporating visual communication capabilities, the two districts are able to get more done faster and more efficiently at a far lower cost.  The face-to-face interaction allows them to collaborate in a meaningful way without spending the time and money to travel to the other’s district.

The more school districts are able to incorporate telepresence, the more each district, school, and student can benefit by being able to collaborate with schools across the state, country and hopefully world.

Government and Human Rights Websites Fall Victim to Targeted Web Malware Attack

On May 11th, 2011, we detected a targeted attack against an Asian political party’s website causing the site to serve malware to unsuspecting visitors. Incidentally, we found a similar type of targeted malware attack back in April on the UK site of a global human rights organization, which served as a big clue in the development we’ve stumbled upon that includes so far two other countries’ websites that are part of the same human rights organization: the Philippines and Hong Kong. It is worth noting that these attacks were discovered due to a free value-added service that comes with VeriSign SSL Certificates, provided in conjunction with our partner Armorize Technologies.

In the case of the attack on the Asian political party’s website, visiting the website caused a backdoor to be installed without the visitor’s knowledge, and because it was a targeted attack, antivirus detection rate against it was very low—0 out of 43 vendors on VirusTotal detected this backdoor: http://www.virustotal.com/file-scan/report.html?id=681c76134a6cfecee07fb2b377d3e748f74ed86d00a8ae24596e63fd8019f637-1305115050

We found that the backdoor connected back to command & control at 203.98.168.29, an IP address in Hong Kong.

The Asian political party’s website was injected with two malicious HTML snippets:

  <script src="js/jquery-gui.ajax.js" type="text/javascript"></script>

  <script src="js/jquery-ui.ajax.js" type="text/javascript"></script>

These two snippets generated an  iframe pointing to different exploits hosted on the Philipinnes human rights website, which we found was also compromised. We just finished working with the organization and remediated the situation.

We discovered there had been more than 10,400 visitors to the compromised Philippines site prior to the fix, all of whom may be infected. We’ve identified a log file which lists the IP addresses, operating systems, locale settings and referers of the victims. The log file suggest that the computers of the website admins are likely to have been infectedby this Web malware (drive-by download).

From the exploits and the file names, it is apparent that the attacker is the same group that targeted the UK human rights group’s website on April 13th.  In the UK incident, the attacker used a variation of the drive-by download technique called drive-by cache. Details as to the type of attack can be found here:http://blog.armorize.com/2011/04/newest-adobe-flash-0-day-used-in-new.html

As previously mentioned, the chain of events helped us identify a third website—a human rights website in Hong Kong-- that has recently fallen victim to the same group and is currently serving up malware. The website is still infected as of now, and we’ve been in communication with the website to remediate the issue (this particular site is not a customer).

Summary of events:

April 13, 2011:  Human rights website in UK-- we detected this website to be serving malware, leveraging the zero day exploit CVE-2011-0611 (issue was fixed shortly after it was identified). One of the exploits used a uncommon exploitation technique—drive by cache—which helps to further reduce antivirus detection rate, which was 0 out of 40 vendors on VirusTotal. One of the malware was named newsvine2.jp2. Connects back to 182.237.3.105, an IP in Hong Kong.

May 11, 2011: Website of a ruling Asian political party—included an iframe that pointed to Philippines human rights website. The Asian political party’s site was fixed May 12.

Philippines human rights website: was found to be serving malware (fixed as of May 13). The same newsvine2.jp2 is found amongst several malware. Detection rate is 0 out of 43 vendors on VirusTotal. Malware connects back to 203.98.168.29, an IP again in Hong Kong. Exploits included one for CVE-2011-0094, which is rare. From our investigation, this exploit was uploaded to the website on Apr 8th, during which CVE-2011-0094 was still a zero day.

Hong Kong human rights website: currently serving malware. Same technique—drive-by cache with malware named newsvine2.jp2—, and connects back to 59.188.5.19, an IP again in Hong Kong and of the same ASN—AS17444. Working to fix the issue.

 A targeted attack works differently from general criminal activity.  In a targeted attack, the aim is to infect a specific group of users who access specific sites and not  mass-infect websites on a broad scale.   Zero day exploits are commonly used in this type of attack as it reduces exposure and prolongs the lifetime of the exploit, whereas a mass infection of random victims would defeat the ultimate goal of targeting a specific set of users. In the case of these specific attacks, we could observe the unique exploits being injected into very few websites of a similar nature targeting a specific group of users.

In this particular case, the chain of incidents all involved injected scripts, exploits, and malware that are only found in a few infected websites, which is rare. The methods and exploits used were also rare and not commonly seen in the wild. Zero day exploits were used. Antivirus detection rates for the installed malware were very low. This all makes us believe that this is a target group aimed at government and human rights websites in particular.

Any organization facing these risks should take care to compose defences that are robust enough to defend against the escalating threats now in play.  Symantec recommends the following defences for your web-based infrastructure:

• Host Intrusion Prevention Systems(HIPS) –HIPS technologies let you lock down key servers from unauthorized modifications.  Attackers frequently rely on poorly defended web servers as  part of their game plan.  Protecting these servers helps you to stop these servers from pushing malware at people browsing your site.
• Managed Security Services (MSS) – Many organizations facing these attacks may want to consider outsourcing some of their incident response team to a third party.  Managed Security Services Providers allow you to delegate these tasks to experts in threat detection and remediation so that your team can focus on tasks that are core to your group’s mission.
•  Automated Malware Scanning  -- Symantec’s VeriSign division offers proactive automated scanning for malware as an option for customers that use our SSL certificates.  These scans are an excellent way to diligently check for signs of infection coming off your site that may cause unintended harm to people who come to your website.

Posted by Symantec

The Business Value of Video

ideo is a cool technology. It’s a fun way to communicate. It looks neat. But what’s the real business value around video? What does video give us that other forms of communication don’t? How can a particular video solution help your company achieve x or solve y? These are questions that all companies rolling out a video strategy should consider.

A cornerstone of Cisco’s strategy is to promote collaboration through pervasive use of video. But this doesn’t mean that every type of video should be deployed everywhere or that one size video solution fits all. Our video strategy fundamentally boils down to connecting people, bringing people together, regardless of where they are, and driving the concept of collaboration globally. When you look at how people actually communicate and collaborate, one of the big value contributions of video becomes quite apparent. Many studies have been conducted on the percentage of communication that is really about the spoken word. Results vary but the number tends to hover around 15 percent; that is, the words we choose make up only about 15 percent of our intended meaning any time we communicate. Instead, visual or nonverbal communication overwhelmingly conveys more significance. How we communicate – our body language, facial expressions, inflections in speech – makes up at least 55 to 60 percent of our communication and, to a lesser extent, how we’re viewed (our title, the company we work for, etc.). Some of these influencers exist in voicemail, but not to the extent that they do in video. Video drives humanization, the desire for human beings to connect and collaborate in ways that come naturally. As such, video can hasten the process of building and maintaining trust with others, and ultimately, help to accelerate the decision-making process.

Cisco’s vision for video brings this same effective interaction with people – their body language, facial expressions, tone – to our employees regardless of where they are located and, eventually, independent of the end device they are using. That’s what we mean by pervasive use of video.

Another foundational component of Cisco’s video strategy is metrics: how we measure the value of video, and what the key indicators are that continue to show if we’re making progress. Some of these metrics are incredibly easy to extract, some are quite difficult, and others require lots of inferences. Regardless, it all comes down to demonstrating the value of video within your organization, along with determining the value drivers.

Your video strategy should be broad enough to include the business problems you’re trying to solve or the company objectives you want to drive. How can a video solution or solutions help you achieve those goals? TelePresence is a good example. The value drivers are widely known: significant reduction in global travel costs, increased employee productivity, shortened sales cycles . . . In the early days of Cisco’s TelePresence deployment, of course we had to justify the costs, and then measure and track the value of TelePresence throughout the phases of implementation. And we continue to prove its return on investment today. Now we have identified the value drivers and are applying the same level of metrics and tracking to other types of video solutions within Cisco, including desktop streaming video (value drivers include improving employee knowledge, productivity, and retention); digital signage (communicating Cisco’s brand and culture); and video surveillance (protecting company assets and reducing time to action).

We’re not rolling out video because it’s fun and neat or simply because we can, but because there is true business value in video and a measurable return on our investment.

Considering the Cloud Architects

The industry storyline of IT evolution is getting very interesting indeed: cloud concepts are changing how we think about delivering IT services.

The IT supply chain is de-constructing and re-constructing at an amazing pace.  More change is going on right now than perhaps any other period of IT evolution.

And, as with any riveting narrative, understanding the motivations of the key characters is an essential part of the plot.

Who are they, and how are they getting dragged into the drama that's unfolding?

When it comes to transforming IT, the central heroes are now turning out to be a new breed of IT professional -- the nascent roles of "cloud architect".

If you've been following our story, you'll be aware that we've started to build training and certifications for this new breed.

But, in many respects, we've only just begun ...

Agents Of Change Traditional IT careers in the physical world were mostly about being really good at one specific thing or another: networking, storage, application development, etc.

In the new world, deep functional expertise is still useful, but you ostensibly need less of it overall.  Instead, there's a pronounced bias towards two key perspectives.

The first perspective is understanding a little about a lot of different things -- and how they interact at the boundaries and interfaces.  Breadth wins over depth in this new world.

And the second perspective is organizational change management: how do you introduce the new way of thinking into the established organization -- in logical, bite-sized steps that makes meaningful progress forward without causing undue chaos?

It turns out that in many situations, there are actually *three* distinct flavors of cloud architects emerging that have both perspectives.  And, very often, they're not entirely aware that they're being pulled into an essential part of the storyline.

The "Technology Enabler" Cloud Architect

For most technologists, this role is the easiest to grasp, but not necessarily achieve.  At a high level, it's understanding the essential elements of different technology disciplines, and using them to create architectural design patterns that can support cloud-like IT delivery.

EMC has dug into this agenda with a passion: this certification (and associated training materials) have proven to be exceptionally popular.  Undoubtedly, more to come in this vein.

But, by itself, having a dandy technology infrastructure is only part of the equation.

Which brings us to ..

The "Process Reengineering" Cloud Architect

Cloud isn't about doing things the way you've always done them, only with shinier technology.  Almost none of the benefits associated with cloud (efficiency, robustness, agility, etc.) can't be achieved without significant process redesign.

From how services are provisioned to how applications are constructed to how IT is governed and paid for -- there's substantial IT process re-engineering at each and every turn.  Fail to get good at this, and you'll fail to achieve the benefits that were so motivating at the outset.

Indeed, like other parts of the business, re-engineering IT processes is a well than never runs dry: there's always more to do, and there's always more benefit to be had.

But, indeed, there's even more to consider ...

The "Business Enablement" Cloud Architect

One aspect of cloud is the notable goal of transforming IT from being perceived as a cost-center to becoming a key value generator for the enterprise.  At some point, this activity has to reach outside the boundaries of IT: it has to directly engage the users and stakeholders who are driving the enterprise itself.

For starters, IT is now less about individual projects, and more about consuming pre-existing services.  That's a big change in behavior for just about every enterprise consumer of IT.  Going farther: real rationalization of what needs to be done internally, and what's better left to external service providers with unique expertise.  Or perhaps a continual process to create new IT services for the enterprise (regardless of source!) and driving their intelligent consumption.

When people say they want to "run IT as a business", what they're really saying is "deliver superior value by anticipating current and future client needs better than anyone else".  That's the business mindset, isn't it?

Cloud Architects -- The Creators Of The Next Wave of IT?

We as technology vendors can only do so much to accelerate change.  We can create cool technology, and make it easy to consume.  We can position it to do a better job with today's applications, and prepare you for tomorrow's.

But, at some point, the tennis ball is in the other court, so to speak.

Proficient consumers of enterprise technology are realizing the game has changed, and have started to invest in the key skills and behaviors required to bring about change.

Very often, this is happens inuitively, but -- in a few cases -- there's an explicit evolution in IT leadership along these lines.

I'm glad we're doing our part to help ...

By: Chuck Hollis

VP -- Global Marketing CTO

EMC Corporation