[Owasp-board] promote owasp co-participation

Dinis Cruz dinis at ddplus.net
Tue Mar 6 19:54:25 UTC 2007

Thanks so accepting the responsibility.

This is still not 100% confirmed since I still need to get feedback from
some OWASP board members, but every piece seems to be falling into palce.

Re advertizement on the newsletter, I am not sure. I would prefer to keep it


On 3/6/07, Sebastien Deleersnyder <sebastien.deleersnyder at ascure.com> wrote:
>  Hi Dinis,
> I can take this on. Let me know how it works out.
> We can set up a page with offers and requests when the idea takes off.
> Another untapped source of advertising that I think will be most
> interesting for sponsors is the OWASP Newsletter.
> I add the SANS NewsBites as example on how this can be included.
> Something else from the SANS NewsBites are the editorial comments:
> something that can add value to the AppNews entries?
> Regards,
> Seba
>   ------------------------------
> *From:* Dinis Cruz [mailto:dinis at ddplus.net]
> *Sent:* dinsdag 6 maart 2007 18:54
> *To:* Sebastien Deleersnyder
> *Subject:* Fwd: promote owasp co-participation
> Hi Sebastien
> The idea below might happen, would that be something that you could help
> us with?
> Namely in begin the point of contact for the people who want to apply?
> Dinis
> ---------- Forwarded message ----------
> From: *Dinis Cruz* <dinis at ddplus.net>
> Date: Mar 5, 2007 8:22 PM
> Subject: promote owasp co-participation
> To: OWASP Board < owasp-board at lists.owasp.org>
> Hi, I have another financial proposal that i would like to pass by you.
> One of the areas that we really need to work on (from a leadership point
> of view) is to promote cross collaboration between our chapters and to
> expose us to OWASP projects. And this means face to face meetings.
> so, following the thread bellow, I would like to propose the following:
>    - OWASP to use the 4k a month from website advertising to help OWASP
>    leaders and OWASP members to attend regional meetings outside its area,
>    where they will be doing a 20m to 60m presentation. We would cover up to
>    $500 USD per individual
>    - And (I was going to propose this separately, but actually makes
>    sense to be combined), trips to the OWASP conferences can be covered from
>    this fund (so Dave, that idea the I talked to you about yesterday would now
>    be funded from the owasp.org advertisement and not the conference)
> This actually would work quite well, since it is another 'unique' benefit
> to members, would help the OWASP community and it is using a pot of money
> that we have just about 95% guarantee will be available (unless all 2007
> owasp.org advertisement slots are already allocated)
> What do you think?
> Dinis
> ---------- Forwarded message ----------
> From: *Daniel Cuthbert* <daniel.cuthbert at owasp.org>
> Date: Mar 5, 2007 3:59 PM
> Subject: Re: [Owasp-leaders] Introduction
> To: "Byrne, David" < David.Byrne at echostar.com>
> Cc: owasp-leaders at lists.owasp.org
> Us old farts from OWASP always like to travel :0)
> On 5 Mar 2007, at 22:57, Byrne, David wrote:
> > You're fortunate, especially if he's making his XSS presentation. It's
> > hard (at least for us in Denver) to get presenters of that caliber.
> >
> > David Byrne
> > OWASP - Denver
> >
> >
> > -----Original Message-----
> > From: owasp-leaders-bounces at lists.owasp.org
> > [mailto: owasp-leaders-bounces at lists.owasp.org] On Behalf Of Darian
> > Anthony Patrick
> > Sent: Monday, March 05, 2007 8:19 AM
> > To: owasp-leaders at lists.owasp.org
> > Subject: [Owasp-leaders] Introduction
> >
> > Hash: SHA1
> >
> > Hello everyone,
> >
> > I'm a new leader of the Philadelphia chapter (along with Aaron
> > Weaver).
> >
> > We're kicking off the year with our first meeting tomorrow night
> > featuring a presentation by Jeremiah Grossman at Drexel University.
> >
> > I'm very excited and looking forward to being a part of the project
> > and
> > sharing materials and insight.
> >
> > Best,
> >
> > Darian
> > - --
> > Darian Anthony Patrick
> > Principal, Application Development
> > Criticode LLC
> > (215) 240-6566 Office
> > (866) 789-2992 Facsimile
> > Web:   http://criticode.com
> > Email: darian at criticode.com
> > JID:   darian at jabber.criticode.net
> > Version: GnuPG v1.4.2.2 (GNU/Linux)
> > Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
> >
> > iD8DBQFF7DTZKpzEXPWA4IcRArDiAJ98ZS/zH392pg/iPgkerivuJZ953QCdGpN3
> > inMamBObw5aL8oi9Yjh8vyo=
> > =UT5W
> > -----END PGP SIGNATURE-----
> > _______________________________________________
> > OWASP-Leaders mailing list
> > OWASP-Leaders at lists.owasp.org
> > http://lists.owasp.org/mailman/listinfo/owasp-leaders
> > _______________________________________________
> > OWASP-Leaders mailing list
> > OWASP-Leaders at lists.owasp.org
> > http://lists.owasp.org/mailman/listinfo/owasp-leaders
> _______________________________________________
> OWASP-Leaders mailing list
> OWASP-Leaders at lists.owasp.org
> http://lists.owasp.org/mailman/listinfo/owasp-leaders
> ------------------------------
> This message may be confidential. It is also solely for the use of the
> individual or group to whom it is addressed. If you have received it by
> mistake, please let us know by e-mail reply. Ascure is not liable for any
> direct or indirect damage arising from errors, inaccuracies or any loss in
> the message, from unauthorized use, disclosure, copying or alteration of it.
> For the complete version or other languages of this disclaimer see
> http://www.ascure.com/disclaimer.htm
> ---------- Forwarded message ----------
> From: "The SANS Institute" <NewsBites at sans.org>
> To: "Sebastien Deleersnyder" <sebastien.deleersnyder at ascure.com>
> Date: Tue, 27 Feb 2007 21:49:41 +0100
> Subject: SANS NewsBites Vol. 9 Num. 17
> Hash: SHA1
> Tomorrow (February 28) is the early registration deadline for SANS 2007
> in San Diego.  Fifty immersion training courses; a big expo, and all
> right on the ocean.
> http://www.sans.org/sans2007/event.php
> *************************************************************************
> SANS NewsBites              February 27, 2007             Vol. 9, Num. 17
> *************************************************************************
>   Cyber Crime on the Rise in Japan
>     Judge Grants Restraining Order and Asset Freeze in SEC Fraud Action
>     Man Faces Prison for Uploading Movie to Internet
>     Guilty Plea in IRC Trojan Case
>     German Law Enforcement to Use Custom Malware.
>     WGA Anti-Piracy Tool Updated; Foreign Language Versions Rolled Out
>    First Remotely Exploitable Flaw Found In Microsoft Office 2007
>    Microsoft Looks into Reports of IE 7 and Vista Flaws
>     Firefox and SeaMonkey Updates Address Vulnerabilities
>     Fruit of the Loom Addresses Breaches
>     Stolen Laptop Holds Worcestershire County Council Staff Data
>     Stolen Computers Hold Mystery Shoppers' Personal Data
>     Pharming Malware Web Sites Shuttered
>     Text Strings in Malware Lash Out at ISC
> *********************** Sponsored By ArcSight, Inc. *********************
> Free Whitepaper: Addressing Insider Threats with ArcSight ESM
> An attack from a malicious insider - someone trusted by your
> organization - can be just as devastating as a security breach from
> outsiders. But insider attacks are often more difficult to detect.
> Learn how to prevent the loss or exposure of your confidential
> information in our free whitepaper on Addressing Insider Threats.
> http://www.sans.org/info/4076
> *************************************************************************
> Save more than $200 by registering by tomorrow for SANS 2007 in San
> Diego Mar 29-April 6: More than 50 immersion training courses on
> security and audit - taught by the world's best security instructors,
> plus a big expo all right on the ocean in San Diego.  Why attend SANS?
> "I have attended courses by several of SANS rivals, and SANS blew them
> away." (Alton Thompson, US Marines).
> http://www.sans.org/sans2007/event.php
> *************************************************************************
>  --Cyber Crime on the Rise in Japan
> (26 & 23 February 2007)
> The rate of reported cyber crime in Japan jumped by 40 percent last
> year, according to figures from National Police Agency (NPA).  The total
> number of cyber crimes investigated last year was 4,425, up from 3,161
> in 2005.  Seven-hundred and three of the cases involved illegal access
> using stolen credentials, nearly three times the number reported in
> 2005.  The number of reported phishing attacks was 220, up from just one
> the previous year, and there were 197 reports of spyware last year, a
> six-fold increase over the figures for 2005.
> http://tech.monstersandcritics.com/news/printer_1269204.php
> http://www.americasnetwork.com/americasnetwork/article/articleDetail.jsp?id=406880
> [Editor's Note (Grefer): The only thing the NPA can claim is that the
> number of cyber crime investigations rose by 40 percent.  However, just
> like in other countries, this likely is just the tip of the iceberg.
> Most cyber crime continues to go unreported, given that it would have a
> severe negative impact on victimized companies, since their reputation
> would suffer.]
> ***************************  Sponsored Links:  **************************
> 1) Mobile Data Security Requires More than Just Encrypting Bits on
> Disks!  Four technology requirements (whitepaper)
> http://www.sans.org/info/4081
> 2) Stopping image-based spam - get the white paper from MX Logic.
> Click here!
> http://www.sans.org/info/4086
> 3) Mobile Preparedness for Business Continuity. Are you prepared to turn
> office workers into mobile workers?
> http://www.sans.org/info/4091
> *************************************************************************
>  --Judge Grants Restraining Order and Asset Freeze in SEC Fraud Action
> (26 February 2007)
> A US federal court has granted the Securities and Exchange Commission's
> (SEC) request for a temporary restraining order and asset freeze against
> Blue Bottle Limited and its owner and chief executive Matthew Charles
> Stokes.  The SEC's complaint alleges that Stokes accessed computer
> systems without authorization, obtained corporate news releases before
> they were made public and used the information to make a US $2.7 million
> profit in online securities trading.  The restraining order bars Stokes
> from "violating the anti-fraud provisions of federal securities law."
> http://news.zdnet.com/2102-1009_22-6162258.html
> http://www.forbes.com/feeds/ap/2007/02/26/ap3463914.html
> http://www.sec.gov/news/digest/2007/dig022607.txt
> (The Blue Bottle case is the third item under the "Enforcement
> Proceedings" heading)
>  --Man Faces Prison for Uploading Movie to Internet
> (23 February 2007)
> Salvador Nunez Jr. is facing a felony charge of copyright infringement
> for uploading a copy of the film Flushed Away to the Internet.  The
> charge carries a maximum sentence of three years.  A digital watermark
> in the file identified its source as an Oscar screening copy.  Nunez
> obtained the film from his sister, who received the advance copy because
> she is an Oscar voter.
> http://www.usatoday.com/tech/news/2007-02-23-flushed-felony_x.htm?csp=34
> [Editor's Note (Ullrich): It's amazing how easy it is to get people
> fined/arrested for something simple like a copyright violation while law
> enforcement attention to botnets, intrusions and identity theft is
> limited to a few big cases.]
>  --Guilty Plea in IRC Trojan Case
> (23 & 22 February 2007)
> Richard C. Honour has pleaded guilty to a charge of computer fraud for
> releasing a Trojan horse program over an IRC (Internet relay chat)
> channel.  The one count of computer fraud carries a maximum penalty of
> five years in prison and a US $250,000 fine.  The program, called
> WindowsMedia.exe, infected computers belonging to members of the
> DarkMyst IRC group; Honour sent messages to the IRC users containing a
> link he claimed led to a video.  The malware opened a back door on
> infected computers.  Evidence gathered from Honour's home indicated he
> had obtained information from compromised machines.
> http://www.theregister.co.uk/2007/02/22/trojan_plea/print.html
> http://www.vnunet.com/vnunet/news/2184082/hacker-takes-rap-trojan-horse
>  --German Law Enforcement to Use Custom Malware.
> (27 February 2007)
> German law enforcement agencies are pushing for a legal basis to be able
> to use malware and spyware in investigations. The malware will be used
> to "bug" suspect's computers. In addition to collecting information from
> the computer itself, cameras and microphones connected to these
> computers could be used to monitor conversations.
> http://www.theregister.com/2007/02/27/german_state_hackers/
>  --WGA Anti-Piracy Tool Updated; Foreign Language Versions Rolled Out
> (22 February 2007)
> Microsoft has updated its Windows Genuine Advantage Notifications
> software for Windows XP for English speakers.  The company has also
> begun introducing the tool in 21 non-English speaking countries. The
> tool lets users know if the software they are running is legitimate.
> Among the foreign language versions are three for Chinese speakers, two
> for Portuguese speakers and one for Russian speakers; those countries
> have been identified as having "long-standing traditions of
> counterfeiting software."  WGA Notifications is delivered via Automatic
> Update and is optional for Windows XP, but it is mandatory for Windows
> Vista.
> http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=security&articleId=9011674&taxonomyId=17&intsrc=kc_top
> [Editor's Note (Schultz): All the new security features in Vista will
> do little good if numerous vulnerabilities such as the ones found
> recently continue to be found. Good code is far superior from a security
> perspective to new Vista security features such as Windows Defender and
> BitLocker encryption. ]
>  --First Remotely Exploitable Flaw Found In Microsoft Office 2007
> (23 February 2007)
> eEye informed Microsoft and the world that "a remotely exploitable flaw
> exists within Publisher 2007 that allows arbitrary code to be executed
> in the context of the logged in user." Office 2007 was one of the first
> products to go through Microsoft's SecuritY Development Lifecycle.
> http://www.networkworld.com/news/2007/022307-researchers-spot-first-remote-code.html?fsrc=rss-security
>  --Microsoft Looks into Reports of IE 7 and Vista Flaws
> (26 February 2007)
> Microsoft is investigating reports of flaws in Internet Explorer 7 (IE
> 7) and Windows Vista that could be exploited to gain access to sensitive
> data.  The IE 7 flaw lies in the way some "onUnload" events are handled
> and could be used in phishing scams.  IE 6 is vulnerable to this flaw
> as well.  The Windows Vista vulnerability exists in a component that
> fails to properly validate user permissions.  The flaw also affects
> Windows XP, 2000 and Windows Server 2003.
> Internet Storm Center: http://isc.sans.org/diary.html?storyid=2310
> http://news.com.com/2102-1002_3-6162313.html?tag=st.util.print
>  --Firefox and SeaMonkey Updates Address Vulnerabilities
> (26 & 23 February 2007)
> Mozilla has released new versions of Firefox and SeaMonkey to address a
> number of vulnerabilities that could be exploited to circumvent security
> measures, launch cross-site scripting attacks, steal data or take
> control of vulnerable systems.  The most significant flaw is a memory
> corruption vulnerability.  Users are urged to upgrade to Firefox
> or and SeaMonkey 1.0.8.  Users who cannot upgrade right away
> should disable JavaScript as a temporary workaround.
> http://www.theregister.co.uk/2007/02/26/firefox_update/print.html
> http://www.eweek.com/print_article2/0,1217,a=201809,00.asp
> http://www.mozilla.org/security/announce/2007/mfsa2007-08.html
> [Editor's Note (Honan): Given the recent spate of Javacript
> vulnerabilities in browsers such as IE, Firefox etc. perhaps you should
> consider disabling Javascript as a permanent workaround.]
>  --Fruit of the Loom Addresses Breaches
> (26 February 2007)
> Personally identifiable data belonging to approximately 2,500 current
> and former Fruit of the Loom employees have been compromised. The data
> were accessible on the Internet from January 15 until February 20.  The
> data included names and Social Security numbers (SSNs).  The compromise
> also affects some people who worked for Rabun Apparel Inc., a former
> Fruit of the Loom subsidiary.  The company will notify everyone
> potentially affected by the breach by overnight mail.
> http://www.thenortheastgeorgian.com/articles/2007/02/23/news/business/01business.prt
>  --Stolen Laptop Holds Worcestershire County Council Staff Data
> (26 & 23 February 2007)
> A laptop computer stolen in a street robbery contains personally
> identifiable information of approximately 19,000 Worcestershire (UK)
> County Council staff.  The data on the computer include names,
> addresses, and national insurance and bank account information.  The
> computer was stolen two weeks ago, but affected individuals were
> notified only recently.
> http://www.worcesternews.co.uk/misc/print.php?artid=1216931
> http://news.bbc.co.uk/2/hi/uk_news/england/hereford/worcs/6396285.stm
>  --Stolen Computers Hold Mystery Shoppers' Personal Data
> (22 February 2007)
> Computers stolen from the Woodlands, Texas office of Speedmark, a
> company that employs mystery shoppers to evaluate employee conduct for
> their clients, contain personally identifiable information.  The data
> include names, addresses, email accounts and SSNs of Speedmark mystery
> shoppers.  Speedmark became aware of the theft on December 16, 2006, but
> affected employees did not learn of the breach until two months later.
> When a shopper asked someone at the company why there was such a lengthy
> delay between the discovery of the theft and notification, the person
> said the company had to restore the data from backups to determine who
> was affected and "contract with a vendor to produce and mail 35,000
> letters."  In addition, the company did not notify people by email
> saying they did not have specific permission to send formal notices
> through means other than the US Postal Service.
> http://www.consumeraffairs.com/printme.php?url=/news04/2007/02/speedmark.html
>  --Pharming Malware Web Sites Shuttered
> (23 & 22 February 2007)
> An attempt by attackers to trick online banking customers into
> disclosing their login information has been thwarted.  The attack
> exploited a critical code execution vulnerability in the Microsoft Data
> Access Components (MDAC) function in Windows; Microsoft issued a patch
> for the flaw in April 2006.  Targets were lured to specific sites seeded
> with malware.  The malware, in turn, downloaded several other pieces of
> malicious software from a server in Russia.  Once their machines were
> infected, users were directed to phony banking sites where they were
> asked for their login details.  The login credentials were passed to the
> true site so the victims were unaware that an intermediary was stealing
> the information.  The attack took a lot of work as it required the
> creation of at least 50 different fake banking web sites for
> institutions in the US, Europe and the Asia-Pacific region.  The
> vulnerability could be exploited simply by getting someone to visit a
> website; there is no user interaction required. The web sites with the
> malicious code have been shut down.
> http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9011653
> http://www.theregister.co.uk/2007/02/23/trojan_phishing_attack/print.html
> http://www.microsoft.com/technet/security/Bulletin/MS06-014.mspx
> [Editor's Note (Grefer): A recursive download of any one web site (or
> even 50 of them) is not all that labor intensive, nor is the insertion
> of a bit of code.  When done on this scale, it is likely that the
> perpetrator(s) spent a bit of though on how to automate the process.
> Alleging that all these sites have been shut down sounds a bit of
> hubris.]
>  --Text Strings in Malware Lash Out at ISC
> (23 February 2007)
> The SANS Internet Storm Center received a sample of malware code
> intended to update a network of infected computers that ISC has been
> monitoring.  The code contained threatening text strings indicating the
> writers want ISC to stop dogging their efforts.  Johannes Ullrich, ISC
> CTO, believes the perpetrator is someone recently reported to a DNS
> provider for using its server to send spam.  The message carried a
> veiled threat that if ISC does not leave them alone, ISC's web site
> would be the target of an attack.  Ullrich says the text strings
> indicate ISC is doing what they're supposed to be doing - thwarting the
> efforts of malware purveyors.
> ISC: http://isc.sans.org/diary.html?storyid=2295
> http://www.scmagazine.com/us/news/article/635361/sans-institute-ullrich-threatened-zombie-spam-message/
> http://blog.washingtonpost.com/securityfix/2007/02/spammers_declare_war_on_antisc.html?nav=rss_blog
> [Editor's Note (Honan): I hope Johannes and the team have printed off
> this text and framed it as a glowing reference to the good work they are
> doing disrupting the operations cyber criminals.  On a more serious note
> this event also highlights that those involved in thwarting cyber
> criminals should be aware that they could come under attack either
> electronically or indeed physically and should take appropriate steps
> to protect themselves.]
> =========================================================================
> The Editorial Board of SANS NewsBites
> Eugene Schultz, Ph.D., CISM, CISSP is CTO of High Tower Software and the
> author/co-author of books on Unix security, Internet security, Windows
> NT/2000 security, incident response, and intrusion detection and
> prevention.  He was also the co-founder and original project manager of
> the Department of Energy's Computer Incident Advisory Capability (CIAC).
> John Pescatore is Vice President at Gartner Inc.; he has worked in
> computer and network security since 1978.
> Stephen Northcutt founded the GIAC certification and currently serves
> as President of the SANS Technology Institute, a post graduate level IT
> Security  College, www.sans.edu.
> Johannes Ullrich is Chief Technology Officer of the Internet Storm
> Center.
> Howard A. Schmidt served as CSO for Microsoft and eBay and as Vice-Chair
> of the President's Critical Infrastructure Protection Board.
> Ed Skoudis is co-founder of Intelguardians, a security research and
> consulting firm, and author and lead instructor of the SANS Hacker
> Exploits and Incident Handling course.
> Tom Liston is a Senior Security Consultant and Malware Analyst for
> Intelguardians, a handler for the SANS Institute's Internet Storm
> Center, and co-author of the book Counter Hack Reloaded.
> Bruce Schneier has authored eight books -- including BEYOND FEAR and
> SECRETS AND LIES -- and dozens of articles and academic papers.
> Schneier has regularly appeared on television and radio, has testified
> before Congress, and is a frequent writer and lecturer on issues
> surrounding security and privacy.
> Marcus J. Ranum built the first firewall for the White House and is
> widely recognized as a security products designer and industry
> innovator.
> Mark Weatherford, CISSP, CISM, is the Chief Information Security Officer
> for the State of Colorado.
> Alan Paller is director of research at the SANS Institute
> Clint Kreitner is the founding President and CEO of The Center for
> Internet Security.
> Rohit Dhamankar is the Lead Security Architect at TippingPoint, a
> division of 3Com, and authors the critical vulnerabilities section of
> the weekly SANS Institute's @RISK newsletter and is the project manager
> for the SANS Top20 2005 and the Top 20 Quarterly updates.
> Koon Yaw Tan leads the cyber threat intent team for Infocomm Development
> Authority (IDA) of the Singapore government.
> Chuck Boeckman is a Principal Information Security Engineer at a
> non-profit federally funded research and development corporation that
> provides support to the federal government.
> Gal Shpantzer is a trusted advisor to several successful IT outsourcing
> companies and was involved in multiple SANS projects, such as the
> E-Warfare course and the Business Continuity Step-by-Step Guide.
> Brian Honan is an independent security consultant based in Dublin,
> Ireland.
> Roland Grefer is an independent consultant based in Clearwater, Florida.
> Please feel free to share this with interested parties via email, but
> no posting is allowed on web sites. For a free subscription, (and for
> free posters) or to update a current subscription, visit
> http://portal.sans.org/
> Version: GnuPG v1.4.6 (Darwin)
> i7Yw1boemjWZ44M1I/h4dKc=
> =8Q05
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.owasp.org/pipermail/owasp-board/attachments/20070306/bd9b6370/attachment-0002.html>

More information about the Owasp-board mailing list