Bogus emails: - Your Cancellation

Published: 2012-05-09
Last Updated: 2012-05-09 20:09:19 UTC
by Dan Goldberg (Version: 2)
3 comment(s)


There are bogus order cancellation emails going around claiming to be from Amazon like this:



Dear Customer,

Your order has been successfully canceled. For your reference, here's a summary of your order:

You just canceled order 15-6698-2492 placed on May 9, 2012.Status: CANCELED


1 "Mulberry"; 2006, Special Edition

  By: Sorcha Stewart

Sold by: LLC


Thank you for visiting!


Earth's Biggest Selection


The 15-6698-2492 in the copy I received linked to the URL which contains this is in the body:
<script type="text/javascript">window.location="";</script>


the web server seems to be down:
--2012-05-09 13:43:19--  (try: 7) to||:80... 

It is probably safe to assume that the content of that site is not user friendly.
Here is the full content of the page at
<html><head><script type="text/javascript">window.location="";</script></head><body><a href="">Click</a></body></html>
Handler ISC
**Thanks to reader Jim Smuda for bringing this to my attention early today. 


3 comment(s)

The day after patch Tuesday; sometimes called Wednesday

Published: 2012-05-09
Last Updated: 2012-05-09 16:49:23 UTC
by Dan Goldberg (Version: 1)
4 comment(s)

This is my first diary entry in several years. I am returning as a handler after a lengthy hiatus. I joined an organization which took too much time and did not permit this kind of interaction. It was worth it. That ride is coming to a close and I am happy to be able to return to this fine organization.

Today many of us are working through the monthly onslaught of patches and updates. Between the Microsoft May 2012 updates, PHP, ESX, and some Adobe updates there is quite a bit to think about. This is a monthly occurrence though. There are a number of steps organizations can take to prepare for this recurring event. A simple one is to mark the second Tuesday on a team calendar. Start to clear the deck on the Friday before and make sure that test systems on ready to go following the Tuesday release.

I have seen a number of approaches to patch preparation. At one extreme all critical systems are replicated in a lab, patches applied and a QA team validates key functions. At the other extreme, patches are just applied and then organization deals with the fall out. Not being an extremist I like to somewhere in the middle depending on organization size, mission, and capability.

There is also the triage effort for reviewing updates and determining how long to wait to get updates applied. I have seen one organization which waited 10 days after the MSFT release then applied all release patches counting on the forums and general buzz about the updates to call out any problems with them. This of course can leave the organization open to many other risks if an exploit is in the wild.

I advocate a more hands on approach especially with key systems. The organization just mentioned ran into a problem recently where two RADIUS (IAS) servers were taken offline by a patch which modified the CA cert. This brought the IAS servers down impacting wireless access for several hours while the problem was identified and investigated and resolved. Testing or patching one system at a time could have prevented or mitigated this outage.

What are some that work and some that don’t work? Care to share?


4 comment(s)
ISC StormCast for Wednesday, May 9th 2012


eweew<a href="">mashood</a>
dwqqqwqwq mashood
[ |]
What's this all about ..?
password reveal .

Diary Archives