Month: May 2010

The University of California, Berkeley, has found that more than half young adults have become more aware of Internet privacy issues than they were five years ago. That number is similar to Internet users their parents’ age or older.

“In its telephone survey of 1,000 people, the Berkeley Center for Law and Technology at the University of California found that 88 percent of the 18- to 24-year-olds it surveyed last July said there should be a law that requires Web sites to delete stored information. And 62 percent said they wanted a law that gave people the right to know everything a Web site knows about them.”

The Pew Internet Project is set to release the results of a survey soon that will show Internet users in their late teens and 20s work harder to control their privacy than older people.

“In the Pew study, to be released shortly, researchers interviewed 2,253 adults late last summer and found that people ages 18 to 29 were more apt to monitor privacy settings than older adults are, and they more often delete comments or remove their names from photos so they cannot be identified. Younger teenagers were not included in these studies, and they may not have the same privacy concerns. But anecdotal evidence suggests that many of them have not had enough experience to understand the downside to oversharing.”

Story here: “Tell-All Generation Learns to Keep Things Offline”

Tom Kelchner

.

We’re seeing a lot of reports in relation to dubious Facebook pages using Javascript to try and spam anybody who happens to be on your friends list. Here’s a typical example:

Should the end-user hit the “Click here” button, rather nifty prompts appear that encourage them to do something a little bit silly:

If you’re somebody that knows their way around the keyboard, you’ll immediately recognise the above as “Copy”. But what are you copying? And what do they want you to do with it?

For anyone that isn’t aware, ALT + D will put the focus back onto the URL bar in the browser. Let’s see, you’ve copied something, switched back to the URL bar – I wonder if they want you to paste something into the browser?

Yes, it looks like they do. The end-user will paste the following Javascript code into the address bar. This isn’t a good thing:

Once the end-user hits the enter key, two things will happen.

A “suggest this to your friends” box will automatically flash up on the screen for a second or two:

It then vanishes, replaced by a CAPTCHA prompt.

The end-user will probably fill this in, and once this happens the spamlink will appear on the news feed of anybody who happens to be their friend:

From there, the links “go viral” as people are endlessly suckered into visiting the pages, pasting the Javascript into the browser and making money for the creator.

How are they making money, you ask?

A website will appear inside the Facebook page, covered with a CPA lead box that wants you to fill in a survey or take part in a competition to see the content (and by “content”, I mean “random site or spamblog that isn’t worth wasting six seconds of your life looking at”).

Of course, people not familiar with these kinds of scams will happily sign their life away to expensive ringtones, fake iPod offers and mail order doodahs (technical term). If you want an idea of how many people are firing these links around at present, here’s a random sample from just four of these pages (there’s a lot more of them out there):

We can’t show a screenshot for the next group as it’s a bit naughty, but here’s the total of “likes” anyway:

Same again for this one:

Let’s finish off with a page that’s currently sitting on 21,347 “Likes”:

Is that a frankly terrifying number of people entering random code into their browser without knowing what it is then hitting the okay button?

Unfortunately: yes.

We’ve notified Facebook, and hopefully some of these pages will be dismantled over the coming days.

Christopher Boyd

We’re seeing a lot of reports in relation to dubious Facebook pages using Javascript to try and spam anybody who happens to be on your friends list. Here’s a typical example:

Should the end-user hit the “Click here” button, rather nifty prompts appear that encourage them to do something a little bit silly:

If you’re somebody that knows their way around the keyboard, you’ll immediately recognise the above as “Copy”. But what are you copying? And what do they want you to do with it?

For anyone that isn’t aware, ALT + D will put the focus back onto the URL bar in the browser. Let’s see, you’ve copied something, switched back to the URL bar – I wonder if they want you to paste something into the browser?

Yes, it looks like they do. The end-user will paste the following Javascript code into the address bar. This isn’t a good thing:

Once the end-user hits the enter key, two things will happen.

A “suggest this to your friends” box will automatically flash up on the screen for a second or two:

It then vanishes, replaced by a CAPTCHA prompt.

The end-user will probably fill this in, and once this happens the spamlink will appear on the news feed of anybody who happens to be their friend:

From there, the links “go viral” as people are endlessly suckered into visiting the pages, pasting the Javascript into the browser and making money for the creator.

How are they making money, you ask?

A website will appear inside the Facebook page, covered with a CPA lead box that wants you to fill in a survey or take part in a competition to see the content (and by “content”, I mean “random site or spamblog that isn’t worth wasting six seconds of your life looking at”).

Of course, people not familiar with these kinds of scams will happily sign their life away to expensive ringtones, fake iPod offers and mail order doodahs (technical term). If you want an idea of how many people are firing these links around at present, here’s a random sample from just four of these pages (there’s a lot more of them out there):

We can’t show a screenshot for the next group as it’s a bit naughty, but here’s the total of “likes” anyway:

Same again for this one:

Let’s finish off with a page that’s currently sitting on 21,347 “Likes”:

Is that a frankly terrifying number of people entering random code into their browser without knowing what it is then hitting the okay button?

Unfortunately: yes.

We’ve notified Facebook, and hopefully some of these pages will be dismantled over the coming days.

Christopher Boyd

Microsoft has said it will push two security bulletins on Patch Tuesday next week.

Both are rated “critical” and fix vulnerabilities that could allow remote execution of arbitrary code. One will fix vulnerabilities in Windows and the other in Microsoft Office and Visual Basic for Applications.

Microsoft advance notification here.

Tom Kelchner

Microsoft has said it will push two security bulletins on Patch Tuesday next week.

Both are rated “critical” and fix vulnerabilities that could allow remote execution of arbitrary code. One will fix vulnerabilities in Windows and the other in Microsoft Office and Visual Basic for Applications.

Microsoft advance notification here.

Tom Kelchner

The National Journal is reporting that Rep Rick Boucher (D-Va.), one of the two congressmen who drafted a proposed U.S. privacy bill, has said he will be meeting with industry and consumer organization representatives to make revisions to represent the broad range of interests affected by the bill.. Boucher also has called for written comments from interested parties by June 4.

Boucher, who is chair of the House Energy and Commerce Communications Subcommittee, introduced the draft bill along with the subcommittee’s ranking member Cliff Stearns (R-Fla.) Earlier this week it met with a variety of reactions from advertising industry, trade press and privacy groups. (See Sunbelt Blog: “U.S. privacy bill: the battle lines form”)

Reactions ranged from “kill this bill” to “we look forward to working with Representative Boucher on this legislation” (which might mean the same thing).

Story here: “Boucher Seeking Written Comments on Privacy Bill”

Boucher web site here.

Stearns web site here.

I suspect this is going to be a long, hard fight. It’s an effort to balance Internet users’ need for privacy against enterprises need for information that can be used for targeted advertising. Somebody has to pay for all that great web content out there and advertisers are going to be that “somebody” for a long time, barring pay-per-view sites or an Internet tax (just kidding).

At the same time, there is the problem that information takes on a life of its own once it’s stored, sold and shared. One’s personal information can be used for legitimate (unobtrusive) advertising, in-your-face annoying advertising and even identity theft.

We predict that a perfectly-balanced bill, if it would be possible to craft such a thing, would still be disliked to some degree by nearly everyone.

But, that’s why they call it “comp-ro-mise.”

Tom Kelchner

A “bug” did it.

PCWorld is reporting that Facebook has stopped quietly adding applications to users profiles (without permission) when they visited certain Web sites. A Facebook spokesman said a bug was responsible for it and the situation has been corrected.

PCWorld wrote: “If you visit certain sites while logged in to Facebook, an app for those sites will be quietly added to your Facebook profile. You don’t have to have a Facebook window open, you don’t need to be signed in to these sites for the apps to appear, and there doesn’t appear to be an option to opt-out anywhere in Facebook’s byzantine privacy settings.

“These apps appear to be related to Facebook’s sharing tools. The sites currently leaving this trail all have Facebook Connect integration, and the list includes heavyweights such as the Gawker network of blogs, the Washington Post, TechCrunch, CNET, New York Magazine, and formspring.me.

“It isn’t entirely clear what information these apps are pulling from user profiles or feeding back to Facebook.”

Although Facebook has stopped the practice, apps that have been added remain and Facebook members will need to remove them:

Account (top right corner of Facebook) | Application

Click on the “X” to the right of the app. (If there are no x’es, you’re good.)

Story here: “New Facebook Social Features Secretly Add Apps to Your Profile (Updated)”

This story is drawing a load of attention, none of it good PR for Facebook. One friend of a friend on my FB commented: “All your base are belong to Facebook.”

Jason Perlow, on his Tech Broiler blog on ZDNet has written a useful piece about securing your Facebook account here.

For some reason it seems to be written upside down with tips about linking Twitter to your Facebook account and tips on RSS feeds first. The most useful basic information is at its end, so, we recommend reading it from the bottom.

Tom Kelchner

Asis Internet Services, a Garberville, Calif., ISP with only 1,000 customers has been awarded nearly $2.6 million by a federal judge in an action brought under the CAN-SPAM act. The judge ruled that defendant Edward Heckerson had violated the act for sending 24,724 spam emails to Asis customers advertising a business called Find a Quote.

Judge Elizabeth Laporte of the U.S. District Court in Northern California granted Asis’ motion for summary judgment and awarded damages of $865,340, then tripled them to $2,596,000, because Find a Quote spammers had employed automatic scripts.

Court order here.

Register news story here.

It seems like an attempt to bail out the ocean with a teacup, but it’s a good thing. The vast amount of spam comes from botnets, however, there are still spammers out there who can be reached by a legal action.

Tom Kelchner

The draft privacy legislation in the U.S. Congress that we blogged about yesterday has drawn comment from a lot of players – businesses and trade groups in the $24 billion online advertising industry as well as privacy groups.

The draft legislation was introduced by Rep. Rick Boucher of Virginia (D-9), who is chair of the House Subcommittee on Communications, Technology and the Internet. It is cosponsored by the ranking minority member of the committee Rep. Cliff Sterns of Florida (R-6).

If there’s one conclusion that can be drawn from the news stories, it’s that everyone is expecting a lot of changes to be made on the bill.

Nobody likes it as it is written now. Industry sources of course want to kill it entirely and many are trotting out the old “we prefer self regulation” horse (you know, the way their “self regulation” stopped adware and spam.) Privacy groups don’t think it’s gone far enough.

There is a very, very legitimate place for Internet advertising, however, it’s pretty clear that without some kind of regulation by an agency with some real power to access penalties, most Internet advertisers simply won’t care about customers’ privacy. If they can sell that information, that makes it all the better.

Below is a roundup of the reactions:

Not pleased (bill does too much):

Mike Zaneis, vice president for public policy for the trade group Interactive Advertising Bureau: “…some of these definitions and requirements were ‘overly broad.’ For instance, including an I.P. address in covered information would be a huge ‘change to existing laws here in the U.S. and would potentially have widespread implications.’”

(N.Y. Times: “Consumer Groups Say Proposed Privacy Bill Is Flawed”)

Direct Marketing Association: the measure “has potentially sweeping impacts for direct marketers working across every marketing channel.

“Requiring notice and consent from an individual prior to any collection, use, or disclosure of information for any purpose would threaten the most basic of direct marketing practices.”

Association of National Advertisers hasn’t yet taken an official position on the draft, but executive vice president of government relations Dan Jaffe says the draft proposal “would be very disruptive” to online and offline marketers.

(Media Post News: “DMA Takes Stand Against Boucher Bill”)

Not pleased (bill doesn’t do enough):

Michelle DeMooy, senior associate for national priorities at Consumer Action: “Please explain to me why a marketer would need your information for 18 months?”

John Simpson from Consumer Watchdog: “This bill really adopts and endorses an archaic … notice and consent regime that we know does not work,

“I can’t imagine that the industry would be happier if they’d written a bill themselves. This basically gives them absolutely everything they want with no meaningful protection for consumers whatsoever. To describe it as industry-friendly is an understatement.”

Peter Eckersley, senior staff technologist at the Electronic Frontier Foundation: “What we need is better default rules of the road for how privacy occurs on the Internet [so] you don’t have to worry about opting-out.

“One of the biggest concerns that we have with the current regime is that when opt-outs are present, they’re frequently kind of dummy opt-outs. What you’re opting out of is not the collection of information about you, but rather the targeting of advertising to you based on the information that was previously collected. You have no option of being surveilled, you can only opt out of being marketed to.”

Ginger McCall, staff counsel with the Electronic Privacy Information Center: “the opt-out requirements ‘simply maintains the status quo’ while the state pre-emption clause denies the states a more innovative solution to combating violations.”

Evan Hendricks, editor and publisher of Privacy Times: “No bill would be better than this bill. This is a non-starter. I don’t feel compelled [to thank Boucher for his efforts], but I will thank him if he realizes that this thing should be buried.”

Not completely displeased:

Facebook spokesman Andrew Noyes: “As public attitudes towards sharing and control over information evolve and become more diverse, Rep. Boucher has taken an important step in what promises to be a productive and vigorous public dialogue about privacy in the Internet age. We look forward to being part of the discussion.”

Google: “We believe strong, consensus protections for data privacy are vital to support both the interests of our users and future innovation. We are reviewing the draft legislation now and look forward to working with Congress on this important issue.”

Microsoft spokeswoman Christina Pearson: “Microsoft has long advocated for a comprehensive federal privacy bill. We look forward to working with Chairman Boucher, Rep. Stearns and the House and Senate on this important effort to ensure consumer privacy is protected.”

Yahoo: “While there certainly remain some fundamental issues to be worked out to make sure that this legislation protects the extraordinary breadth of free services for consumers made possible by online advertising, Yahoo commends the hard work that Representatives Boucher and Stearns have done thus far and we are grateful that they have stated they are not looking to disrupt this business model with their legislation. We look forward to continuing to work constructively with the sponsors of this legislation and others in Congress as they debate this complex but important issue.”

(PC Magazine: “Boucher’s Privacy Bill Scolded by Consumer Groups”)

Pam Dixon, executive director of public-policy-research group World Privacy Forum: “This is one part of the argument showing that the ad industry has lost. There’s a broad acknowledgment at this point that computer-based and numeric identifiers are just as good as your name.”

(Advertising Age: “Draft of Online Privacy Bill Stirs Fears Among Ad Industry”)

Tom Kelchner

Computer world is reporting that Core Security Technologies discovered that Microsoft had patched three vulnerabilities in Exchange and Windows SMTP last month and didn’t publicize the fact. Core Security makes penetration testing software.

Although such silent fixes are not new, Core researchers pointed out that two of the three fixes patched more serious flaws than the announced ones did in Microsoft’s Security Bulletin MS10-024.

Story here: “Security firm reveals Microsoft’s ‘silent’ patches”

Patching vulnerabilities puts a developer into a labyrinth of decisions not only about what to fix but what to tell the world about the patches. After all, as soon as a high-profile patch is make – and a lot of Microsoft’s are high profile – there are malicious operators out there trying to reverse engineer the patches to see what the vulnerabilities were that prompted the update. The vulnerabilities can be targeted by exploits which are then aimed at that huge number of Microsoft users who don’t run updates.

On the other hand, there is an army of IT people with tens of thousands of machines to maintain who must make some decisions about what updates to run and which ones to run when. Although most people think that IT exists outside space and time, they really are human with only so many hours in a day. Publishing an update without publicizing what it fixes means they might put some updates in the “do it in 30 days,” or “we don’t run that” category.

— Tom Kelchner

A section of China’s official Xinhua news Web site was hacked and was serving malware last month, however, Google’s safe browsing service is still labeling it as unsafe despite the fact that it was fixed more than a week ago.

The hack is one of several high-profile compromises of government sites recently. The U.S. Department of the Treasury site on Monday was found to have a malicious iFrame exploit that directed browsers to a site in the Ukraine that served malware, according to AVG researcher Roger Thompson.

Stories here: “China State News Agency Web Site Hit With Malware”

“US Treasury Web sites hacked, serving malware”

Tom Kelchner

Legislation has been introduced in the U.S. Congress that would expand privacy protections both on- and off-line, requiring companies to allow consumers to opt-out of any data collection. IP addresses are included in the list of information covered by the bill.

The legislation was introduced by Rick Boucher of Virginia (D-9), who is chair of the House Subcommittee on Communications, Technology and the Internet. It is cosponsored by the ranking minority member of the committee Cliff Sterns of Florida (R-6). (copy here).

The bill would give the U.S. Federal Trade Commission oversight and violations would be treated as unfair and deceptive acts or practices.

It also would require the FTC to educate the public: “The Commission shall conduct a consumer education campaign to educate the public regarding opt-out and opt-in consent rights afforded by this Act.”

Story here: “Consumer Groups Say Proposed Privacy Bill Is Flawed”

In stories like this the key phrase is “has been introduced.” One can be sure that there will be changes after input from privacy groups and business interests.

Initially it appears that most of the provisions of the bill are simply good business practice, however, if it becomes law all enterprises probably will need to burn some cycles checking existing procedures.

From the initial description it doesn’t appear as though it will change our definition of adware, according to Eric Howes, Sunbelt Software Spyware Research Manager.:

“The defining characteristic of adware is the display of unsolicited advertising on the user’s desktop by a locally installed application. Many adware programs do engage in tracking of users’ online behavior, but that doesn’t change the defining behavior of advertising.

“Moreover, the FTC has already issued rules requiring that adware vendors perform the kind of disclosure that this bill effectively extends to all manner of online data collection. Even when adware vendors satisfy those requirements we still detect the programs because of the advertising, which users find to be an intrusion on their use of their own PCs.”

Our definition of adware is here: “Sunbelt CounterSpy ThreatTypes & Categories”

We’ll be watching it.

Tom Kelchner

iTunes Gift cards can be pretty expensive, and of course this means there are people who will quite happily go to great lengths to take them from you. While looking around a fake Facebook Hack website, I noticed something else lurking on the same user account. The URL in question here is applehack(dot)webs(dot)com/ituneshack, and this is what it looks like:

“iTunes Hack”? Oh dear. Anyone likely to fall for this is probably going to be drawn to the “iTunes code value increaser”, so let’s take a look.

Imagine: the victim has just purchased a £50 iTunes card, thinks they can double the value with the aid of some leet hax and enters their card code into the box. Pick one of the following options:

A) The victim hits “Submit”, and their code is processed in an advanced piece of technology that spits out a double value card and everyone is a winner.

B) The victim hits “Submit”, and their unused code is sent to the phisher who happily gives themselves all the time in the world to redeem said code by inventing a fictitious amount of time needed for the leet haxing to take place. They may pop up a fake (and utterly useless) code, too.

“Wait 12 hours before redeeming the card”? Yeah, you just got scammed.

If you’re wondering what happens should the victim hit “Download program”, they’re taken to the endless advert loop of doom from the fake Facebook Hack website. All in all, a rather horrible thing to fall for – so don’t!

Christopher Boyd

Sunbelt Software has begun offering live webinar demos of VIPRE® Enterprise Premium 4.0 weekdays at 4 p.m. Presentations will include:

— features and functionality
— tips and best practices for configuration
— LIVE answers to your questions from our Support team.

VIPRE Enterprise Premium 4.0 combines antivirus, antispyware, client firewall and malicious website filtering technologies in a single agent that protects against the ever-changing wave of malware in the most comprehensive, efficient manner.

Register here: http://www.sunbeltsoftware.com/Daily-Webinars/

Tom Kelchner

There are all sorts of ways for dubious characters to generate some cash for themselves – some will offer up fake hacking programs that require you to fill in a survey to download their worthless application, while others will go down the tried and tested method of infecting your PC then popping endless promos and deals that make them affiliate cash.

This one does away with all of that, combining some barefaced cheek with a completely useless website designed to make the end-user click things until their hands fall off. The URL is applehack(dot)webs(dot)com/fbhack

Is this the part where I start to pull out screenshots? You bet:

As you can see, the site claims it’ll hack whatever Facebook account you care to suggest. Simply enter the Username of the victim, hit the Hack button and then…you see the below message, which is possibly the cheekiest piece of fibbing I’ve seen in some time:

Yes, that really does tell you to wait around for thirty minutes while clicking every advert you can get your hands on. Thanks to some coding which continually loops a fresh advert every time you click (along with a neverending stream of popups outside of the main browser window), you may find your desktop starts to look like somebody gave it one too many energy drinks:

Click to Enlarge

All those browser windows, and I didn’t even have to install any Adware – how very retro. Anyway, you can rest assured that simply entering a Facebook Username into this site is not going to give you access, so don’t be tempted – you’ll just end up generating lots of money for someone with a cheaply thrown together fakeout.

Christopher Boyd

Consumer Reports has published results of its “State of the Net” survey in the June 2010 magazine. Bottom line: there are twice as many people using social media as a year ago and a lot of them aren’t very security aware.

The study of 2,000 households was done online in January.

A few of the results:
— 40 percent posted full birth date on their social media page, opening themselves up for identity theft
— About 25 percent of those households with a Facebook account weren’t aware of Facebook privacy controls or didn’t choose to use them.
— Nine percent of social network users experienced a malware infection, scam, identity theft or harassment.

CR said: “Overall, we estimate that cybercrime cost American consumers $4.5 billion over the past two years. And it caused them to replace 2.1 million computers.”

Web news piece about the survey here.

Their web news piece on the survey includes links to a good brief security how-to: “7 Things to Stop Doing Now on Facebook”

Tom Kelchner

French researchers have found that large amounts of content on BitTorrent is supplied by a relatively small number of people according to a paper presented at the Usenix Workshop on Large-Scale Exploits and Emerging Threats in San Francisco.

The researchers from French National Institute for Research in Computer Science and Control found a way to monitor the actions of BitTorrent users for more than three months, collecting IP addresses used by nearly 150 million people and identifying two billion copies of the things they downloaded, many of them copyrighted.

The vulnerabilities they found in BitTorrent enabled them to find the IP addresses even when users went through the Tor anonymity service. Tor has urged users not to use BitTorrent in the past.

The paper “Spying the World from your Laptop — Identifying and Profiling Content Providers and Big Downloaders in BitTorrent” was written by Stevens Le Blond, Arnaud Legout, Fabrice Lefessant, Walid Dabbous and Mohamed Ali Kaafar from the Institut National de Recherche en Informatique et en Automatique.

The institute operates from eight locations throughout France under the authority of the French Research Ministry.

News story: “Researchers spy on BitTorrent users in real-time”

This has implications for BitTorrent users on two fronts: security and liability for illegal downloading. If I was a betting person, I’d wager that the two will converge in some very interesting and malicious way shortly.

Tom Kelchner

I was in the local library at the weekend, and noticed something a little bit odd at the computer terminal section. A flash drive was sticking out of one of the PCs – more often than not, this is evidence of shenanigans and computers that really should be locked down a little better. Sure enough, this was lurking on the drive:

As you’ve probably already guessed, anyone using this program should consider changing their Facebook password as soon as possible. This is what you see when you fire the program up:

As the program loads, a website also pops in the background to give it an attempted air of legitimacy:

“this is a program that allows you to visit Facebook from school or work”.

Yes. Of course it is. The program now asks the end-user for their name, email and password, then pops up a reassuring “loading soon” message:

This is where the smoke and mirrors kick in, with a fake (yet reasonably convincing) list of “things I’m really loading up for you, honest”:

As you can see, the “loading” process goes horribly wrong at the “Search bar” stage – from here, the end-user is only ever going to see one screen and it isn’t the one telling them they’re now logged into Facebook.

The failed login is blamed on a firewall, and the stolen login credentials are placed onto the flashdrive in the same location as the executable.

All the attacker needs to do at this point is reclaim their flashdrive, take it home and do various horrible things to the stolen accounts. Always be careful when logging into services at libraries, webcafes, school and work – your alarm bells should be ringing loud and clear whenever you see a flashdrive poking out of a public computer.

We detect this as “Trojan.Infostealer”. Thanks to Adam Thomas from Sunbelt’s Malware Research Team for additional testing.

Christopher Boyd

For the first time, Microsoft’s share of the browser marked has slipped below 60 percent, according to figures from Net Applications, a Aliso Viejo, Calif., web app and metrics firm .

Browser market share:

Microsoft — 59.95 percent
Mozilla’s Firefox — 24.59 percent
Google Chrome — 6.73 percent
Apple’s Safari — 4.72 percent
Opera — 2.30 percent.

Story here.

Tom Kelchner

Google has released the results of a year-long study of 240 million web sites that said 15 percent of the malware detected was related to rogue security applications. The study was released at the Workshop on Large-Scale Exploits and Emergent Threats at the Usenix conference in San Jose, California.

In the study, done between January 2009 and February 2010, Google researchers said they found 11,000 web sites distributing the rogues.

In Sunbelt’s ThreatNet detections top-ten list for April, a VIPRE detection for a loader (FraudTool.Win32.SecurityTool {v}) for rogue security product SecurityTool made it to the number 10 spot. That’s a first. ThreatNet is made up of tens of thousand VIPRE and CounterSpy users who report detections of malicious code that is detected in their systems.

Google said it was having some success in the year filtering malicious URLs more quickly.

Story here.

Tom Kelchner