text:
Topic Information security threats
SubTopic Malware
Nation-state cyberattacks
Messaging threats
Emerging threats
Hacker tools and techniques
Examining Conficker: When a worm becomes a botnet
Conficker may be backed by a well funded group or government intending to silently collect information. Though the hype has waned, Conficker could lead to a much larger threat.
Brian Sears
"It would be more likely that Conficker is backed by a well funded group or government and that the development lifecycle of Conficker will lead to a much larger threat."
Brian C. Sears, Director Information Systems, Benson & McLaughlin
I recently read an article where two experts expressed different ideas of what Conficker represented. One expert argued that Conficker was clearly not a botnet, as it lacked some of the basic abilities typically found in botnets. While the other expert said Conficker indeed was a botnet, In the end they both agreed Conficker represented a significant threat. So what is Conficker? Well in the case of our two experts, they were both right and wrong. In my opinion, Conficker appears as a package or a mesh of several different threats, each one with its own purpose.
For example, the attacker has to find a way to deliver Conficker to its target. Delivery is performed via phishing emails, email attachments, spam and enticing websites. This represents the first component in the complete package. The second component is the delivery device; for Conficker it is in the form of a worm (W32.Downadup). Once executed, it delivers its payload and then begins to look for new hosts to infect. The third component is the exploitation of a weakness in Microsoft's Windows code intended to assist in taking over the infected target. Taking advantage of the weakness gives the attacker greater ability and access to the host. Then finally the fourth component, the botnet, is then delivered providing the attacker with control over the exploited target.
So now that we have a basic understanding of the "how," we still need to answer what is Conficker? Understanding Conficker's actions will help define what it is and provides us with some idea of what the end goal may be.
So to define Conficker as a botnet we only need to answer two questions:
Can the installed threat on a client take action on its own without the attacker having to log into the client?
Can many infected clients act in a unified manner to accomplish a common goal?
In this case Conficker has clearly demonstrated it can meet both of these requirements and therefore is a botnet. Since its inception, Conficker evolved by altering its own code to defeat detection attempts and preventing antivirus from performing its task. It was also believed that on April 1, 2009 version (C) with increased command and control abilities and a new set of anti-detection measures would turn itself on to call home for instructions. While April 1 turned out to be uneventful, to say that nothing happened would be a mistake. Eight days later on April 8, version (E) appeared again, demonstrating that it was still in contact with its command and control.
Botnets and Conficker:
VIDEO: Jose Nazario on botnets, cyberwarfare: Botnets are being used to silence political dissenters, explains Jose Nazario of Arbor Networks. DDoS attacks are a growing part of cyberwarfare.
Conficker updates with no problems reported: Despite hyped reports of a trail of destruction, the latest Conficker worm upped the ante April 1, but security researchers are successfully blocking it from receiving orders.
Conficker leaves security industry looking clueless: The true Conficker story may well turn into an introspective of the security industry. It should start with hard questions of security vendors and service providers.
Now the big question yet to be answered, is the why? In the past, a botnet's intent or its "why" could be traced to the motivation to make money. Their creators did not go to great lengths to hide this detail. However, in the case of Conficker, I believe the why may be a bit more complex. Since its arrival it has remained relatively quiet, but this in no way means it is harmless. In fact, I believe the lack of action on the part of Conficker is a telling indication of its true intent.
My theory on Conficker is that it's a dry run, an intelligence gathering exercise intended to test a response to a threat. To support my theory, we look at Conficker's actions and its lack of actions. Version (A) simply established that the worm could gain access and deliver its payload. In addition, the version demonstrated that the payload worked by taking advantage of a weakness in Windows, giving the attacker control of the host. Between November and February 2009, Conficker continued to spread; taking advantage of unpatched Windows based computers. During this time it did not take on typical roles and stayed mostly inactive. I believe that during this time it was gathering information that would be used to develop the next two versions.
Between mid-February and early March Version (B) and (C) arrived, and with information collected from the earlier version, Conficker then adapted to defend itself. It disabled Windows services, antivirus and blocked access to antivirus vendor websites. Conficker also developed a way to hide its command and control servers. This was performed by having it randomly select 500 domain names each day from a list of 50,000. It then attempted to contact these 500 random domains to receive its next command. This made it difficult to trace the domain where new commands would originate.
In addition, it is highly possible that there is more than one command and control server. It is also likely that commands are fragmented between several servers. Only after it makes contact with enough servers and receives all of the fragmented pieces does it then execute the next command. This would make it very hard to pinpoint the command and control servers. These fragmented commands might even be missed or discarded as useless information. This may be why it appeared that nothing happened on April 1, as it took eight days for each infected host to receive a complete set of commands.
As we have seen, Conficker will use the information collected to evolve and defend itself. It has also demonstrated that it will take extreme measures to protect its command and control servers. A significant point to make is that unlike other well-known botnets, there has been no obvious attempt by Conficker to generate income. All this together implies it is still learning and evolving.
So what did Conficker learn from the April 1 deadline? This deadline was a social engineering exercise on the part of Conficker. Let's think of it as the boy who cried wolf; Conficker implied that on April 1 some major event would take place. Media reports on Conficker helped fuel the hype of some impending event that we were unable to prevent. Then when April 1 arrived, and the anticipated disastrous event failed to appear, people were disappointed and began to discount further reports.
This helps Conficker, because as humans, once we are drawn into the hype of an event and then disappointed when it doesn't occur, we tend to discredit it in the future. The proof of this leading up to April 1 was the national media's reporting on the impending event. However, once this date passed and nothing happened the reporting stopped. Even on April 8 when version (E) was discovered it was not widely reported. By crying wolf, it became easier for Conficker to evolve and spread as most will discount future warnings as unfounded hype.
Conficker became active and evolved to version (E) by installing an enhanced spam bot with phony antivirus software on infected host computers. These two new components would restore the worm's ability to begin spreading to a new host. This was also the first time Conficker took on the normal role of a botnet with the ability to begin generating income for its owners. Part of Conficker's new design is the bot called Waledac, and it's believed that Waledac is the successor to the Storm bot. Conficker is now demonstrating it can take on many different roles. With the addition of Waledac, it can now be used to generate spam or scareware, but most notably it has returned to propagating again.
If my theory is correct, and this is a dry run intended to collect information and evolve, it would indicate that it's much larger than any one individual. It is likely that Conficker is backed by a well funded group or government and that the development lifecycle of Conficker will lead to a much larger threat. This threat would likely come in a form that would exploit multiple known and unknown weaknesses in our operating systems. It will install quietly, leave little evidence of its presence and avoid detection. Once on a computer it will remain dormant until activated and run almost transparent to the users. It is not out of the realm of possibility that a well funded and backed entity could develop such a threat, but the development process would require live test or dry runs, I believe based on behavior that Conficker may be part of such a development cycle.
Brian C. Sears is director of information systems at Benson & McLaughlin. He wrote this column as part of a research paper for the Information System Security course at the University of Washington.
Dig Deeper on Malware, virus, Trojan and spyware protection and removal
Who's to blame for ransomware attacks -- beyond the attackers?
virus (computer virus)
GandCrab decryption tool helps victims recover data
Ransomware attacks on local and state governments increasing
Verizon DBIR: Ransomware still a major threat, despite reports
Enterprise security threats rising, consumer attacks falling
logic bomb
malware (malicious software)
How is Plead malware used for cyberespionage attacks?
Are Meltdown and Spectre real vulnerabilities or mere flaws?
What enterprises need to know about ransomware attacks
Understanding the new breed of command-and-control servers
Is a Mirai botnet variant targeting unpatched enterprises?
Why is the N-gram content search key for threat detection?
How was a credit card skimmer used to steal data from Newegg?
How does a WordPress SEO malware injection work and how can enterprises prevent it?
What new technique does the Osiris banking Trojan use?
How is SamSam ransomware using a manual attack process?
How were attackers able to bypass 2FA in a Reddit breach?
Why Electronic Signatures, and Why Now? –Adobe
New Conficker variant has ties to Storm botnet – SearchSecurity
Waledac botnet showing resurgence with thousands of ... – SearchSecurity
Microsoft takes legal action to shut down Waledac ... – SearchSecurity


text:
Agosto é um longa metragem de 1988, co-produzido por Portugal e França e realizado por Jorge Silva Melo.

O filme é uma adaptação da obra "La Spiaggia" de Cesare Pavese e sua estréia ocorreu no Festival de Cinema de San Sebastian.

Sinopse
O filme se passa na praia da Arrábida, quando o trio: Carlos, Dário e Alda, passam as férias e esqueçem dos seus problemas corriqueiros.

Elenco
 Christian Patey ...  Carlos
 Olivier Cruveiller ...  Dário
 Marie Carré ...  Alda
 Manuela de Freitas ...  Nina
 Pedro Hestnes ...  Alberto (como Pedro Hestnes Ferreira)
 José Nascimento ...  Rodrigo
 Fernando Mora Ramos ...  Emílio
 Glicínia Quartin - Idosa com livro

Ligações externas

Filmes produzidos por mais de um país da década de 1980
Filmes de Portugal de 1988
Filmes da França de 1988
Filmes em língua portuguesa da década de 1980
Filmes baseados em obras de autores da Itália
Filmes realizados por Jorge Silva Melo
Filmes de drama de Portugal
Filmes de drama da França

redpajama_set_name: RedPajamaWikipedia


text:
Du er her: The journal Volume 51, No. 1 | Gender in research
Volume 52, No. 3 | The Danish Political Parties
Volume 52, No. 2 | Political decision-making processes
Volume 52, No. 1 | Policy professionals in Denmark
Volume 51, No. 4 | Small states in rough seas: Denmark and the North Atlantic: past, present, and future
Volume 51, No. 3 | Research and practice
Volume 51, No. 2 | Articles without a common theme
Volume 51, No. 1 | Gender in research
Volume 50, No. 3 | The Interaction between Citizens, Service Users and the Public Administration
Volume 50, No. 2 | The limits of the law
Volume 49, No. 4 | Danish Foreign Policy Activism Across Institutional Arenas
Volume 49, No. 3 | Integration of immigrants in Denmark
Volume 49, No. 2 | Class and politics
Volume 49, No. 1 | Local government economy
Volume 48, No. 4 | Political bureaucrats
Volume 48, No. 3 | Political-economic regulation after the financial crisis
Volume 48, No. 2 | Leadership in the public sector
Volume 48, No. 1 | Civil war
Volume 47, No. 4 | Public-private partnerships
Volume 47, No. 3 | Terror and counter-terrorism - new trends and perspectives
Volume 47, No. 2 | Co-production – citizens' contributions to public service production
Volume 46, No. 4 | The new English School: the international society in the 21st century
Volume 46, No. 3 | Coordination in and among Danish political parties
Volume 46, No. 2 | Inequality in health
Volume 46, No. 1 | Empirical methods for the study of causality in political science
Volume 45, No. 2 | Local government officers
Volume 45, No. 3 | Public sector innovation
Volume 45, No. 4 | Denmark and the EU
Volume 44, No. 1 | Values and motivation in the public sector
Volume 44, No. 3 | The welfare state
Volume 44, No. 4 | Political attitudes
Volume 43, No. 2 | Religion and politics
Volume 43, No. 3 | Method in political theory
Volume 43, No. 4 | Freewheeling climate? Global warming and climate policy
Volume 42, No. 1 | Special interests in a new terrain
Volume 42, No. 2 | Erosion of local democracy
Volume 42, No. 3 | Media and politics in Denmark
Volume 42, No. 4 | Gender and behavior in the public administration
Ann-Dorte Christensen | Masculinity, power and intersectionality
Studies on men and masculinity focus on men's identities and values, and on the normative, accepted cultural practice of being a man in a specific context. This research field has contributed significantly to gender studies and has produced new knowledge, which is useful for the social sciences in general, for instance in terms of understanding processes of social differentiation and political values. Theoretically, studies on men and masculinities have been dominated by the theory of hegemonic masculinity and a focus on patriarchal power structures. The article introduces an intersectional approach as a fruitful alternative in studies of the complexities and ambiguities of gendered identities, inequalities and power structures. The intersectional argument is illustrated by two empirical examples: 1) men as the extreme gender at the top and bottom of society, and 2) new masculinity ideals.
Yvonne Mørck and Bente Rosenbeck | Intimate citizenship in the 21st century
T.H. Marshall's understanding of citizenship from 1950 continues to be reworked and expanded, for example with the concept of intimate citizenship. In general, the term refers to having or not having control over one's body, feelings, relationships and identities. Intertwining the concepts of intersectionality (i.e., identifying interlocking systems of power/social stratification) and intimate citizenship offers a strong analytical approach to key challenges facing late-modern Danish society in relation to citizens' personal and intimate lives. This applies to, e.g., violence against women in ethnic minority families, the living conditions of minority ethnic LGBT people and the rights of intersexed people. Thus, the claim to full citizenship also includes equality and sexual rights. Moreover, as the intersectional analytical approach is under continuous development, we wish to emphasize the need for more intersectionality-inspired analyses of everyday lives and practices.
Arnfinn H. Midtbøen and Mari Teigen Value polarization in a Norwegian context? Distance between the elite and the population in attitudes toward immigration and gender equality
To what extent do the Norwegian elite and the population at large differ in their views on immigration and gender equality? The article analyzes data from the Norwegian Leadership Survey 2015, conducted among the holders of top positions in ten sectors in Norwegian society, and compares elite attitudes to attitudes in the Norwegian population. We find a considerable distance between elite and population, but immigration is more polarizing than gender equality. The findings are discussed in light of recent comparative research on populism and the growing resistance to liberal and post-material values, as well as literature on gender equality as a "Nordic value".
Hanne Marlene Dahl | A changing landscape of elderly care
Elderly care is at the top of the political agenda nationally and globally due to changing demography, declining fertility rates, increasing labor market participation rates of women and the financial crisis. Elderly care has been theorized successfully within feminist care theory. However, changing societal and political conditions in the Nordic welfare regime such as professionalizing, late modernizing, degendering and neoliberalizing indicate the inadequacy of this theoretical framework. In critical dialogue with – and extension of – the feminist theory of care, I argue in favor of introducing new analytical concepts from philosophy and political science such as assemblage, relatedness, logics, multilevel governance and transnational discourses. These concepts are elaborated in view of the contemporary (human) condition.
Anne Skorkjær Binderkrantz | Are women inferior to men as teachers ... according to students?
International studies have found a gender difference in student evaluations where female teachers are evaluated lower than their male colleagues. This article investigates whether this is also the case in the Danish context. The article draws on evaluations from Aarhus BSS where a common procedure is in place for evaluating all teaching across study programs with varying gender composition of students and teachers. The material includes almost 30,000 student evaluations of more than 1,000 different teachers. Rather than a general gender bias, the analysis finds a relation between the composition of teachers, student gender and the evaluation of teachers of different gender.

redpajama_set_name: RedPajamaCommonCrawl


"Mustard seeds explode in the hot oil. She holds a lid over the pan to fend off the missiles. Rat-a-tat! like hail on a tin roof. She adds the cumin seeds, which sizzle, darken, and crackle. A dry, fragrant smoke chases out the mustard scent. Only then are the onions added, handfuls of them, and now the sound is that of life being spawned in a primordial fire"


Modelado supported a Workshop and a Birds-of-a-Feather session at the International Supercomputing Conference, June 19-23, 2016 in Frankfurt, Germany.
Both meetings discussed dynamic runtimes.
The BoF presented recent progress on the Open Community Runtime (OCR) and the workshop followed up later in the week as a community building session on cooperation across the Atlantic. The complete set of presentations are archived through the highlighted links.
Abstract: Exascale and extreme-scale systems impose fundamental new requirements on software to target platforms with severe energy, data movement and resiliency constraints within and across nodes, and large degrees of homogeneous and heterogeneous parallelism and locality within a node. The Open Community Runtime (OCR) was created to foster discussions on how best to address these issues.
This BoF included a presentation of the current state of OCR and a discussion of next steps and collaboration opportunities and presented the motivation and current state of the various OCR implementations as well as concrete use cases. We discussed how to get started with OCR and engaged with the audience in discussing future directions and collaboration opportunities. OCR's goal is indeed to build and foster a community around the concepts expressed in OCR to better accelerate innovations in the exascale software stack.
3) Severe limits on power consumption in order to fit within datacenters' capacity and budgets.
Dynamic runtimes have emerged as tools to manage quickly changing circumstances. Several European and American projects have developed prototype systems that share some common characteristics, but there is no overall consensus on the exact needs and requirements of systems that will eventually be implemented in the extreme scale systems of the next decade. The workshop will bring together the developers of several systems to discuss the building of a collaborative community.
In this workshop the developers of the OmpSs programming model from the Barcelona Supercomputing Center, the StarPU system from INRIA, the Open Community Runtime from Rice University and University of Vienna and researchers from the American Department of Energy projects including HPX, DARMA and Legion addressed these challenges and identified common threads upon which to build future collaboration across the Atlantic.
Please consider attending the workshop on: Building a European/American Community for the Development of Dynamic Runtimes in Extreme-Scale Systems at the International Supercomputing Conference. ISC will be held in Frankfurt, Germany from June 19-23, 2016. This workshop takes place on Thursday June 23.
The University of Vienna, the Barcelona Supercomputer Center, INRIA, Sandia National Laboratory and Modelado are organizing this workshop with the following content.
Three main challenges face the high performance computing community on the road to Exascale: 1) Exploitation of extreme parallelism and the concurrent difficulty of programming, 2) Regular hardware and software failures of these very high part-count machines requiring adaption to frequent failures incidents, and 3) Severe limits on power consumption in order to fit within datacenters' capacity and budgets.
Dynamic runtimes have emerged as tools to manage quickly changing circumstances. Several European and American projects have developed prototype systems that share some common characteristics, but there is no overall consensus on the exact needs and requirements of systems that will eventually be implemented in the extreme scale systems of the next decade. This workshop will bring together the developers of several systems to discuss the building of a collaborative community.
In this workshop the developers of the OmpSs programming model from the Barcelona Supercomputing Center, the StarPU system from INRIA, the Open Community Runtime from Rice University and University of Vienna and researchers from the American Department of Energy projects including HPX, DARMA and Legion will discuss these challenges and identify common threads upon which to build future collaboration across the Atlantic.
Modelado is supporting Intel corporation for its 6th project meeting as part of FF2 and earlier related programs, FF1 and Xstack. This meeting brings together Intel researchers in extreme scale technologies with experts from the Department of Energy Laboratories to discuss program developments in the hardware design of an exascale machine, the runtime systems, software and tools and experiences in refactoring applications to these hardware and software architectures.
The meeting will feature three themes, 1) hands on joint work on programming applications, 2) a discussion of storage and memory hierarchy that leads to requirements for future work on the road to exascale and 3) status and updates on current progress.
The meeting will be held in Hillsboro, OR at Intel's Jones Farm facility on March 29-31, 2015.
XStackwiki users…going forward please use http://xstackwiki.modelado.org rather than xstackwiki.com to access the wiki. Please update your browser bookmarks appropriately.
The Modelado Foundation is a new Open Source Foundation for Parallel Computing. We are just getting started, and will have more info soon.
If you would like to contact us directly, please send email to info@modelado.org.