<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Security Wandering &#187; bots &amp; botnets</title>
	<atom:link href="https://securitywandering.com/?cat=3&#038;feed=rss2" rel="self" type="application/rss+xml" />
	<link>https://securitywandering.com</link>
	<description>Digital common sense</description>
	<lastBuildDate>Fri, 21 Oct 2016 15:55:55 +0000</lastBuildDate>
	<language>en-US</language>
		<sy:updatePeriod>hourly</sy:updatePeriod>
		<sy:updateFrequency>1</sy:updateFrequency>
	
	<item>
		<title>Ultrasonic more then bugs talking…….or &#8220;bab bios&#8221; or should it be sound gaps not air gaps</title>
		<link>https://securitywandering.com/?p=516</link>
		<comments>https://securitywandering.com/?p=516#comments</comments>
		<pubDate>Fri, 01 Nov 2013 15:12:28 +0000</pubDate>
		<dc:creator><![CDATA[lou]]></dc:creator>
				<category><![CDATA[bots & botnets]]></category>
		<category><![CDATA[general security]]></category>
		<category><![CDATA[Hack and Hackers]]></category>
		<category><![CDATA[Interesting information]]></category>
		<category><![CDATA[legal]]></category>
		<category><![CDATA[Uncategorized]]></category>

		<guid isPermaLink="false">http://securitywandering.com/?p=516</guid>
		<description><![CDATA[<p>Meet “badBIOS,” the mysterious Mac and PC malware that jumps airgaps Like a super strain of bacteria, the rootkit plaguing Dragos Ruiu is omnipotent.   Three years ago, security consultant Dragos Ruiu was in his lab when he noticed something highly unusual: his MacBook Air, on which he had just installed a fresh copy of [&#8230;]</p>
<p>The post <a rel="nofollow" href="https://securitywandering.com/?p=516">Ultrasonic more then bugs talking…….or &#8220;bab bios&#8221; or should it be sound gaps not air gaps</a> appeared first on <a rel="nofollow" href="https://securitywandering.com">Security Wandering</a>.</p>
]]></description>
				<content:encoded><![CDATA[<h1 class="heading" style="list-style: none; padding: 0px; margin: 0px; -webkit-font-smoothing: antialiased; text-rendering: optimizelegibility; font-family: NoticiaBold, 'Times New Roman', serif; text-decoration: none; color: #263034; font-size: 30px; font-style: normal; font-variant: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: left; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff;">Meet “badBIOS,” the mysterious Mac and PC malware that jumps airgaps</h1>
<h2 class="standalone-deck" style="list-style: none; padding: 0px 0px 12px; margin: 0px 0px 8px; color: #657b83; font-size: 16px; font-weight: normal; border-bottom-width: 1px; border-bottom-style: solid; border-bottom-color: #dddddd; font-family: Arial, sans-serif; font-style: normal; font-variant: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: left; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff;">Like a super strain of bacteria, the rootkit plaguing Dragos Ruiu is omnipotent.</h2>
<p style="margin: 0px 0px 15px; color: #263034; font-family: Arial, sans-serif; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: 20px; orphans: auto; text-align: left; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff;"> </p>
<p style="margin: 0px 0px 15px; color: #263034; font-family: Arial, sans-serif; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: 20px; orphans: auto; text-align: left; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff;"><span class="Apple-style-span" style="color: #000000; font-family: Helvetica; line-height: normal; font-size: medium;"><img title="badbios.jpg" src="http://securitywandering.com/wp-content/uploads/2013/11/badbios.jpg" alt="Badbios" width="600" height="337" border="0" /></span>Three years ago, security consultant Dragos Ruiu was in his lab when he noticed something highly unusual: his MacBook Air, on which he had just installed a fresh copy of OS X, spontaneously updated the firmware that helps it boot. Stranger still, when Ruiu then tried to boot the machine off a CD ROM, it refused. He also found that the machine could delete data and undo configuration changes with no prompting. He didn&#8217;t know it then, but that odd firmware update would become a high-stakes malware mystery that would consume most of his waking hours.</p>
<p style="margin: 0px 0px 15px; color: #263034; font-family: Arial, sans-serif; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: 20px; orphans: auto; text-align: left; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff;">linked from:<br /> <a href="http://arstechnica.com/security/2013/10/meet-badbios-the-mysterious-mac-and-pc-malware-that-jumps-airgaps/">http://arstechnica.com/security/2013/10/meet-badbios-the-mysterious-mac-and-pc-malware-that-jumps-airgaps/</a></p>
<p style="margin: 0px 0px 15px; color: #263034; font-family: Arial, sans-serif; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: 20px; orphans: auto; text-align: left; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff;">it was just a matter of time before microcode injections into the controller on various sub systems of a computer would be targeted.<br />This is a very troubling discovery for many people. </p>
<p>The post <a rel="nofollow" href="https://securitywandering.com/?p=516">Ultrasonic more then bugs talking…….or &#8220;bab bios&#8221; or should it be sound gaps not air gaps</a> appeared first on <a rel="nofollow" href="https://securitywandering.com">Security Wandering</a>.</p>
]]></content:encoded>
			<wfw:commentRss>https://securitywandering.com/?feed=rss2&#038;p=516</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Botnet Called &#8216;Practically Indestructible&#8217; &#8211; Computerworld</title>
		<link>https://securitywandering.com/?p=276</link>
		<comments>https://securitywandering.com/?p=276#comments</comments>
		<pubDate>Mon, 18 Jul 2011 13:16:42 +0000</pubDate>
		<dc:creator><![CDATA[lou]]></dc:creator>
				<category><![CDATA[bots & botnets]]></category>
		<category><![CDATA[general security]]></category>
		<category><![CDATA[Hack and Hackers]]></category>

		<guid isPermaLink="false">http://securitywandering.com/?p=276</guid>
		<description><![CDATA[<p>  Over on the post &#8220;Botnet Called &#8216;Practically Indestructible&#8217; &#8211; Computerworld&#8221; contains this text: &#8220;Massive botnet &#8216;indestructible,&#8217; say researchers By Gregg Keizer July 18, 2011 06:00 AM ET1 Comment Computerworld &#8211; A new and improved botnet that has infected 4.5 million Windows PCs is &#8220;practically indestructible,&#8221; security researchers say. TDL-4, the name for both the [&#8230;]</p>
<p>The post <a rel="nofollow" href="https://securitywandering.com/?p=276">Botnet Called &#8216;Practically Indestructible&#8217; &#8211; Computerworld</a> appeared first on <a rel="nofollow" href="https://securitywandering.com">Security Wandering</a>.</p>
]]></description>
				<content:encoded><![CDATA[<p> </p>
<p>Over on <em><a></a></em> the post &#8220;<em><a href="http://www.computerworld.com/s/article/357532/Botnet_Called_Practically_Indestructible_?source=rss_security&amp;utm_source=feedburner&amp;utm_medium=feed&amp;utm_campaign=Feed%3A+computerworld%2Fs%2Ffeed%2Ftopic%2F17+%28Computerworld+Security+News%29">Botnet Called &#8216;Practically Indestructible&#8217; &#8211; Computerworld</a></em>&#8221; contains this text:</p>
<blockquote><p><em>&#8220;Massive botnet &#8216;indestructible,&#8217; say researchers By Gregg Keizer July 18, 2011 06:00 AM ET1 Comment Computerworld &#8211; A new and improved botnet that has infected 4.5 million Windows PCs is &#8220;practically indestructible,&#8221; security researchers say.</em></p></blockquote>
<blockquote><p><em> </em><em></p>
<p style="display: inline !important;"><span style="font-style: normal;"><em> </em></span></p>
<p><em></p>
<p style="display: inline !important;">TDL-4, the name for both the bot Trojan that infects machines and the ensuing collection of compromised computers, is &#8220;the most sophisticated threat today,&#8221; reported Kaspersky Labs researcher Sergey Golovanov late last month.</p>
<p></em></em><em></p>
<p> </p>
<p></em></p></blockquote>
<blockquote>
<p><em>&#8220;[TDL-4] is practically indestructible,&#8221; Golovanov said.&#8221;</em></p>
</blockquote>
<p> </p>
<p>The post <a rel="nofollow" href="https://securitywandering.com/?p=276">Botnet Called &#8216;Practically Indestructible&#8217; &#8211; Computerworld</a> appeared first on <a rel="nofollow" href="https://securitywandering.com">Security Wandering</a>.</p>
]]></content:encoded>
			<wfw:commentRss>https://securitywandering.com/?feed=rss2&#038;p=276</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>what happens when airlines merge&#8230;or why no ones cares once they get your cash</title>
		<link>https://securitywandering.com/?p=266</link>
		<comments>https://securitywandering.com/?p=266#comments</comments>
		<pubDate>Thu, 07 Jul 2011 13:05:53 +0000</pubDate>
		<dc:creator><![CDATA[lou]]></dc:creator>
				<category><![CDATA[bots & botnets]]></category>
		<category><![CDATA[Cloud]]></category>
		<category><![CDATA[Cool Tech]]></category>
		<category><![CDATA[event]]></category>
		<category><![CDATA[Events]]></category>
		<category><![CDATA[exploits]]></category>
		<category><![CDATA[general security]]></category>
		<category><![CDATA[good practices]]></category>
		<category><![CDATA[Hack and Hackers]]></category>
		<category><![CDATA[Interesting information]]></category>
		<category><![CDATA[legal]]></category>
		<category><![CDATA[Product info]]></category>
		<category><![CDATA[Sec for Dumies]]></category>
		<category><![CDATA[social phishing]]></category>
		<category><![CDATA[Staying off the grid]]></category>

		<guid isPermaLink="false">http://securitywandering.com/?p=266</guid>
		<description><![CDATA[<p>So the story goes something like this. bout airplane tickest a while ago&#8230;..great priceDay before try to get 2 seats together  online at check in&#8230;. That did not happen, normal not a big deal.but this time the wife is in a walking boot for her ankle and the kid always flys next to the wife. [&#8230;]</p>
<p>The post <a rel="nofollow" href="https://securitywandering.com/?p=266">what happens when airlines merge&#8230;or why no ones cares once they get your cash</a> appeared first on <a rel="nofollow" href="https://securitywandering.com">Security Wandering</a>.</p>
]]></description>
				<content:encoded><![CDATA[<p>So the story goes something like this.</p>
<p>bout airplane tickest a while ago&#8230;..great price<br />Day before try to get 2 seats together  online at check in&#8230;.</p>
<p>That did not happen, normal not a big deal.<br />but this time the wife is in a walking boot for her ankle and the kid always flys next to the wife.</p>
<p>Security at the airport was a breeze for everyone including the wife in her ankle boot contraption.<br />security made sure that the kid did not go wondering off well mom got scanned.<br />I get to deal with the 10 little gray bins and getting them thru the xray thing<br />as odd as it sounds it was like they wanted to help&#8230;.got to love that.</p>
<p>Get to the gate wait for the gate folks to get there.<br />Now the gate folks had always been very helpful  for me</p>
<p>So I know they could easily fix the seating issue for me&#8230;..</p>
<p>WRONG<br />&#8220;the flight is full figure it out yourself when you get on the plane&#8221; <br />The message from the gate folks</p>
<p>it was like they were more concerned about themselves then helping me an mine.<br />no even an earl boarding invite&#8230;.wife in a walking boot for her ankle injure and 7 year old boy&#8230;.</p>
<p>so we wait and yet more self involved airline folks come and go.</p>
<p>they open the plane for boarding&#8230;</p>
<p>final yet another group of airline folks&#8230;<br />about half way thu boarding we get invited to board after the wife hobbles around in the waiting line.</p>
<p>I new face from airline&#8230;.who had just helped a 13 year old traveling alone&#8230; was the yes please go bored voice of reason</p>
<p>we go down the empty gate ramp took like 5 minutes down hill walking slow&#8230;.<br />get on the plane and there are people sitting in all of our seats&#8230;.<br />kid starts crying&#8230; have i mentioned yet that the wife &#8220;does not like to fly &#8220;motion sickens&#8221;&#8221;</p>
<p>get the tickets from the wife&#8230;<br />kick an old couple out of my seat and the 13 year old seat&#8230;.<br />then the 13 year old says I&#8217;ll change with you..</p>
<p>So the the wife and the kids get 2 seats together&#8230;..finally<br />the 13 year old stranger gets a window seat beind me&#8230;</p>
<p>Oh yeah forgot to mention the flight crew losing it because we had stopped anyone from boarding  the plane.<br />that kind of happens on the small jets  when you are in row 3 waiting for some folks to move out of your seats&#8230;.</p>
<p>longer story short..</p>
<p>flight was great 20 minutes early kind of great.</p>
<p>moral of the story you should always call the airplane phone support folks to fix seating issues and wait on hold for an hour to talk to <br />SAM &#8220;shrewas&#8221;  who think that the yankees are a florida baseball team&#8230;&#8230;</p>
<p> </p>
<p> </p>
<p>The post <a rel="nofollow" href="https://securitywandering.com/?p=266">what happens when airlines merge&#8230;or why no ones cares once they get your cash</a> appeared first on <a rel="nofollow" href="https://securitywandering.com">Security Wandering</a>.</p>
]]></content:encoded>
			<wfw:commentRss>https://securitywandering.com/?feed=rss2&#038;p=266</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Top-secret US lab infiltrated by spear phishers – again • The Register</title>
		<link>https://securitywandering.com/?p=172</link>
		<comments>https://securitywandering.com/?p=172#comments</comments>
		<pubDate>Wed, 20 Apr 2011 19:15:37 +0000</pubDate>
		<dc:creator><![CDATA[lou]]></dc:creator>
				<category><![CDATA[bots & botnets]]></category>
		<category><![CDATA[exploits]]></category>
		<category><![CDATA[Hack and Hackers]]></category>

		<guid isPermaLink="false">http://securitywandering.com/?p=172</guid>
		<description><![CDATA[<p>  Over on the post &#8220;Top-secret US lab infiltrated by spear phishers – again • The Register&#8221; contains this text: &#8220;Top-secret US lab infiltrated by spear phishers – again Alert Print Post comment Retweet Facebook IE 0day leads to theft of data By Dan Goodin in San Francisco • Get more from this author   [&#8230;]</p>
<p>The post <a rel="nofollow" href="https://securitywandering.com/?p=172">Top-secret US lab infiltrated by spear phishers – again • The Register</a> appeared first on <a rel="nofollow" href="https://securitywandering.com">Security Wandering</a>.</p>
]]></description>
				<content:encoded><![CDATA[<p> </p>
<p>Over on <em><a></a></em> the post &#8220;<em><a href="http://www.theregister.co.uk/2011/04/19/us_lab_security_breach/">Top-secret US lab infiltrated by spear phishers – again • The Register</a></em>&#8221; contains this text:</p>
<blockquote><p><em>&#8220;Top-secret US lab infiltrated by spear phishers – again Alert Print Post comment Retweet Facebook IE 0day leads to theft of data By Dan Goodin in San Francisco • Get more from this author</p>
<p> </p>
<p>Posted in Malware, 19th April 2011 23:34 GMT On Demand Webcast : Making the decision on hosted apps &#8211; What’s the risk and reward? One of the most sensitive science labs in the US has shut down all internet access after attackers exploited a vulnerability in Microsoft&#8217;s Internet Explorer browser to steal data from some of its servers, according to published news reports.</p>
<p></em></p>
<p><em>The security breach at the Oak Ridge National Laboratory is at least the second time since 2007 that computers have been hacked when employees were duped by phishing emails. The most recent compromise was initiated by messages that were manipulated so that they appeared to come from the lab&#8217;s Human Resource Department, The Knoxville News Sentinel reported.&#8221;</em></p>
</blockquote>
<p> </p>
<p>The post <a rel="nofollow" href="https://securitywandering.com/?p=172">Top-secret US lab infiltrated by spear phishers – again • The Register</a> appeared first on <a rel="nofollow" href="https://securitywandering.com">Security Wandering</a>.</p>
]]></content:encoded>
			<wfw:commentRss>https://securitywandering.com/?feed=rss2&#038;p=172</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>U.S. shutters botnet, can disable malware remotely &#124; InSecurity Complex &#8211; CNET News</title>
		<link>https://securitywandering.com/?p=67</link>
		<comments>https://securitywandering.com/?p=67#comments</comments>
		<pubDate>Thu, 14 Apr 2011 12:07:25 +0000</pubDate>
		<dc:creator><![CDATA[lou]]></dc:creator>
				<category><![CDATA[bots & botnets]]></category>

		<guid isPermaLink="false">https://securitywandering.wordpress.com/?p=67</guid>
		<description><![CDATA[<p>Over on the post &#8220;U.S. shutters botnet, can disable malware remotely &#124; InSecurity Complex &#8211; CNET News&#8221; contains this text: &#8220;U.S. shutters botnet, can disable malware remotely by Elinor Mills By seizing servers and domain names and getting permission to remotely turn off malware on compromised PCs, U.S. officials have disabled a botnet that steals [&#8230;]</p>
<p>The post <a rel="nofollow" href="https://securitywandering.com/?p=67">U.S. shutters botnet, can disable malware remotely | InSecurity Complex &#8211; CNET News</a> appeared first on <a rel="nofollow" href="https://securitywandering.com">Security Wandering</a>.</p>
]]></description>
				<content:encoded><![CDATA[<p>Over on <em><a href=""></a></em> the post &#8220;<em><a href="http://news.cnet.com/8301-27080_3-20053708-245.html?part=rss&amp;subj=news&amp;tag=2547-1_3-0-20">U.S. shutters botnet, can disable malware remotely | InSecurity Complex &#8211; CNET News</a></em>&#8221; contains this text:</p>
<blockquote><p><em>&#8220;U.S. shutters botnet, can disable malware remotely<br />
by Elinor Mills</p>
<p>By seizing servers and domain names and getting permission to remotely turn off malware on compromised PCs, U.S. officials have disabled a botnet that steals data from infected computers.<br />
The legal actions are part of the &#8216;most complete and comprehensive enforcement action ever taken by U.S. authorities to disable an international botnet,&#8217; according to a statement from the Department of Justice. A botnet is a group of computers that have been compromised and are being remotely controlled by attackers, typically to send spam or attack other computers.&#8221;</em></p></blockquote>
<p>The post <a rel="nofollow" href="https://securitywandering.com/?p=67">U.S. shutters botnet, can disable malware remotely | InSecurity Complex &#8211; CNET News</a> appeared first on <a rel="nofollow" href="https://securitywandering.com">Security Wandering</a>.</p>
]]></content:encoded>
			<wfw:commentRss>https://securitywandering.com/?feed=rss2&#038;p=67</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
