text:
Malware RSS Feed
A Fanny Equation: "I am your father, Stuxnet"
At the Virus Bulletin conference in 2010, researchers from Kaspersky Lab partnered with Microsoft to present findings related to Stuxnet. The joint presentation included slides dealing with various parts of Stuxnet, such as the zero-days used in the attack.
Perhaps the most interesting zero-day exploit from Stuxnet was the LNK exploit (CVE-2010-2568). This allowed Stuxnet to propagate through USB drives and infect even machines that had Autorun disabled.
It was discovered during the 2010 research into Stuxnet that the LNK exploit has earlier been used in another malware, supposedly a Zlob PE, that pointed to "fanny.bmp".
Back in 2010, very few people paid much attention to a piece of malware that used the LNK exploit prior to Stuxnet. Zlob is a large malware family and these kinds of crimeware-grade samples are rarely of interest to researchers digging into zero-days and nation-state sponsored operations.
However, during our 2014 research into the Equation group, we created a special detection for the group's exploitation library, codenamed "PrivLib". To our surprise, this detection triggered a worm from 2008 that used the Stuxnet LNK exploit to replicate, codenamed Fanny.What's so Fanny?
This PrivLib-boosted Worm, which spreads using the Stuxnet LNK exploit and the filename "fanny.bmp" was compiled on Mon Jul 28 11:11:35 2008, if we are to trust the compilation timestamp. It arrived in our December 2008 collection from the wild, so the compilation might very well be correct.
"Fanny my name" could be an introductory message from the authors
The 2008 "Fanny.bmp" Worm is detected by Kaspersky Lab products as Trojan-Downloader.Win32.Agent.bjqt. The malware includes the LNK exploit, which means that it is a piece of malicious software that used the Stuxnet LNK exploit before Stuxnet!The second Stuxnet exploit (MS09-025)
If one piece of malicious software that used an exploit from Stuxnet before Stuxnet is a good catch, a second Stuxnet exploit makes it even more interesting.
The second exploit used to be a zero-day when Fanny was operational. This means that Fanny used two zero-days to replicate, both of which were later used by Stuxnet. The specific vulnerability used for privilege escalation was patched with MS09-025:"The security update addresses these vulnerabilities by correcting the methods used for validating a change in specific kernel objects, for validating the input passed from user mode to the kernel, and for validating the argument passed to the system call. The security update also addresses a vulnerability by ensuring that the Windows kernel cleans up pointers under error conditions."
The same exploit was later used in an early Stuxnet module from 2009, which was embedded into a large binary built using the Flame platform. That Stuxnet module, also known as "atmpsvcn.ocx" or Resource 207 was the technical link between Stuxnet and Flame. This story has previously been covered in our post.
#Fanny used two zero-days to replicate, both of which were later used by #Stuxnet #EquationAPT #TheSAS2015Tweet
While the vulnerability exploited by both the Stuxnet/Flame module and Fanny is the same, the implementation of the exploit is different. The exploit in Stuxnet targets a specific OS version, while Fanny is designed to be universal and is capable of running on multiple platforms. It has a unique shellcode and exploit-triggering procedures for:
- Windows NT 4.0
- Windows 2000
- Windows XP
- Windows 2003
- Windows Vista, 2008 and possibly others from NT6.x family
The implementation of the exploit in Fanny is more complex than in Stuxnet: instead of running just one payload the authors created a framework to run as many payloads as they want by replacing a system service call dispatcher nt!NtShutdownSystem with their own custom pointer from theuser-space as shown in the next figure.
Fanny injected its own system service call dispatcher
This enables a persistent trampoline from user-mode to kernel-mode. This feature was not present in the Stuxnet module but there are other similarities. For instance, it seems that both the developers of Stuxnet and of Fanny follow certain coding guidelines such as the usage of unique magic numbers from each function call. Most of the returned results are simply disposed but they are still part of the code. This could be the remains of a debug version of the code which could potentially log every step in the code to ease the tracking down of an error while testing. In complex systems where kernel and user-space code is running with no interaction this seems a logical and even essential method. Again, it's implemented both in the Stuxnet code and in Fanny. See next figure.
Stuxnet (on the left) and Fanny (on the right) using magic return valuesThe Fanny Malware
So, what is Fanny essentially? It is a USB Worm with a sophisticated backdoor that uses the so-called "Stuxnet LNK vulnerability" to automatically execute from the USB drive even if Autorun has been disabled. It can elevate privileges to the local System using kernel exploit and drops and registers additional modules. It attempts to connect to a C&C server and deploys additional components if connection is available. If not, it uses the USB drive as a carrier to send/receive requests to and from the operator via a hidden storage area created in raw FAT structure.
Typically a victim plugs in a new USB drive and opens it with Windows Explorer. You can visually observe the two stages of infection from the USB which take seconds to execute.
This file is a DLL with two exports (to install and uninstall the malware). It contains a xor-encrypted config in binary resource with number 101. The config determines malware behavior: there is a command to deploy malware on the current system, URLs for the C&C server and local filenames and paths used to install embedded malware components.
Fanny components inside the main executable
Upon starting it checks the following mutexes:
- Global\RPCMutex
- Global\RPCMutex
Where is a 1-byte long integer taken from the config. If any of these mutexes exist, the code doesn't run. It means that another instance of the same code is running. InstanceNum most likely identifies a variant or generation of Fanny preventing the same version from reinfecting the system but allowing for different versions to run (possibly to enable enforced update of components).
The module also checks another important byte in its configuration. This byte is a counter that is decreased during successful system infection. When the counter reaches a minimal value of one the module cleans up the USB drive and stops spreading the worm. In this way the attackers limit the maximum length of the Worm's killchain.
If the module is named "fanny.bmp" (the file name that Fanny uses to spread via USB drives) the module self-installs from the USB drive.
As part of the initial infection process Fanny attempts to elevate current privileges if the user has no administrative rights on the current system. It uses a vulnerability patched by MS09-025 for that purpose. Only if the elevation succeeds does the malware attempt to connect to the C&C server using a URL which is stored in the config:
- http://webuysupplystore[.]mooo[.]com/ads/QueryRecord200586_f2ahx.html
Below is a sample request issued by the malware:GET /ads/QueryRecord200586_f2ahx.html HTTP/1.1
User-Agent: Mozilla/4.0 (compatible;)
Host: webuysupplystore.mooo.com
The malware expects the C&C server to reply with an HTTP 200 response and append a 0x7f-xored string that has a second stage URL. The second stage response may contain an executable file body which is saved on disk and executed.
The C&C server is currently sinkholed by Kaspersky Lab, but according to our pDNS records it previously pointed to the following IP address:
- 18.104.22.168
The following describes the stages that were identified during the analysis of the initial and embedded components of Fanny.Infection
The module searches for fanny.bmp in the root of disk drives starting from drive D: and copies it to the following locations:
- %WINDIR%\system32\comhost.dll
- %WINDIR%\system32\mscorwin.dll
Why does Fanny make two copies of itself? Actually, there is a minor difference between these two files. Fanny patches its config in the resource section of one of the files (comhost.dll). The patched data is the value of remained maximum length of the Fanny killchain. "mscorwin.dll" is the original file copied as-is from the removable drive. So far, one copy is used for infecting other USB drives, the other is loaded on the system boot.
It also copies all *.lnk files from the USB drive to "%WINDIR%\system32\" in order to reuse them when infecting other attached USB drives. Note that there may be more than one LNK file, because each LNK contains a distinct path to the DLL which gets loaded. As far as the letter of a new drive on the target system is unknown, Fanny uses several LNKs for the most common drive letters. This method was improved later in Stuxnet, which used a relative DeviceID-dependent path to the USB drive. However, even that method required several LNK files (up to four) because of different relative paths on different versions of Windows, but that's far fewer than an almost full set of letters from the Latin alphabet.Persistence
Fanny creates the following registry value to achieve persistence:
This is not a common way to make code start automatically on a system boot and it's extremely invasive, but it guarantees that the module is loaded in the address space of each process in the system, including some critical processes such as lsass.exe and services.exe running as SYSTEM user.
When the module is loaded it checks other values that start from "filter" in the same registry key, i.e.:
- HKLM\System\CurrentControlSet\Control\MediaResources\acm\ECELP4\filter2
- HKLM\System\CurrentControlSet\Control\MediaResources\acm\ECELP4\filter3
- HKLM\System\CurrentControlSet\Control\MediaResources\acm\ECELP4\filter8
The values contain a hosting process name and a path to a DLL or EXE file. If the current process name contains the value set as hosting process, then the module loads a DLL or starts a new process (in case of EXE file) depending on target file extension.
This is a map of the processes and modules that are used in Fanny:Process Fanny module Short Description winlogon c:\windows\MSAgent\AGENTCPD.DLL USB backdoor explorer c:\windows\system32\shelldoc.dll Windows Explorer rootkit lsass c:\windows\system32\mscorwin.dll USB worm USB Worm
The code of the actual Worm is part of %WINDIR%\system32\comhost.dll export with ordinal 4 (name of export is "dll_installer_4"). The DLL is a modified next-generation Worm which is copied to every attached USB drive with all related LNK files stored in Windows\System32 directory. This module is distributed by mscorwin.dll which is part of the lsass system process.Windows Explorer Rootkit
The rootkit functionality is provided by a shelldoc.dll file loaded in the Windows Explorer process. It hides some Fanny-related files (LNK-files and fanny.bmp) in Windows Explorer by removing them from the list of items in the foreground window that uses SysListView32 control (normally Windows Explorer window).
Some screenshots with disappearing files were demonstrated previously, however sometimes this approach may raise suspicions. Here is what it looks like if the user opens a system32 directory with Explorer:
Seven Fanny-related file icons disappeared in Windows Explorer
Apparently, it looks as if some of the file icons were cut off. In addition some of standard directories seem to be missing due to a bug in the rootkit code. It appears as if this component was not tested properly by the authors.Masquerade Mode On
There is an interesting part of the code in USB Backdoor DLL which at first glance doesn't make much sense. It takes some hardcoded constants and generates a random value which is saved to a registry key.
Fanny generates random values that are saved to the registry
Then it moves the current executable which is hosting the DLL to c:\windows\system32\msdtc32.exe. After that the executable path is appended to HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell registry value which makes this executable run on system boot.
The trick to mimic the behavior of traditional malware was used to avoid revealing further secret activities #FannyTweet
This may look like a traditional way for malware to add itself to autostart, but don't be fooled by that. The purpose of this move is to make certain automated systems and software, such as those based on sandboxes and emulators, believe that they have caught some known malware and not to let it run further. It seems that the component is so unique that the authors decided to avoid the risk of looking even more suspect. It might seem a paradox, but the authors prefer this code to be detected as malware if someone is checking it. The trick is to mimic the behavior of some traditional cybercriminal malware, a bot, and get detected as soon as possible, thereby not revealing any further secret activities. Considering that this component was spreading via USB drives and could pop up on many systems, discovering it as a traditional bot would put it in lower risk zone and as a result the malware would probably end up being deleted without proper analysis.
This might explain why this code was detected as a variant of Zlob malware in the past and no one paid proper attention to it.USB Backdoor
One of the modules, agentcpd.dll, is a backdoor that was designed to work as an advanced reconnaissance tool for air-gapped computers that are normally used in highly secure facilities. The backdoor waits for a USB drive to be plugged in and if that's a new disk, it instantly allocates some space for a hidden container using its own FAT16/FAT32 filesystem driver.
This is what the FAT root directory looks like before and after plugging a USB drive into an infected machine:
Hexdump of raw disk partition before and after plugging into an infected machine
On top of this hexdump the drive label "MYDRIVE" can be found (corresponding hex bytes are underlined with green). It is followed by a single byte flag value (0x08 in hex) which, according to Microsoft, means ATTR_VOLUME_ID. Each entry in this root directory table is 32-bytes long.
Subdirectory entries such as Pictures, Music, Documents and Work occupy 63 bytes, because of the long filename FAT feature. There are two variants of subdirectory names – short and long. A subdirectory entry uses a flag 0x10 following the short directory name, which, according to Microsoft, means ATTR_DIRECTORY.
The last record inserted by Fanny (highlighted in red) uses an invalid directory name and a flag 0x18, which combines ATTR_VOLUME_ID and ATTR_DIRECTORY. This combination of flags is not documented according to current FAT specifications and the whole entry is therefore ignored by filesystem drivers as if it were a data corruption or a bad block. As a result this entry is not visible in Windows, Mac OS and Linux and probably all other implementations of FAT driver.
It's possible that #Fanny was used to map some of the future targets of #Stuxnet #EquationAPT #TheSAS2015Tweet
While Fanny doesn't rigorously protect data in hidden storage (it doesn't mark the allocated space as bad blocks, probably to avoid attention), it changes the filesystem driver hint value indicating where to look for the next free cluster. In this way it reserves disk space of approximately 1Mb in size to use for a hidden storage.
When Fanny detects a new USB drive, with the help of its own FAT driver it looks into the root directory and locates the entry which starts with magic value 51 50 40 98 (see above). It then uses the offset which follows the flag value of 0x18. On the figure above it is set to 0x001e9c00. This offset on the same USB disk will have another magic value D0 CF CE CD serving as a marker for the beginning of the hidden storage:
Hexdump of Fanny hidden storage with list of running processes
Once Fanny has allocated space for hidden storage it populates the storage with basic information about the current system: i.e. OS Version, Service Pack number, computer name, user name, company name, list of running processes, etc.
This secret storage is also used to pass commands to computers that are not connected to the Internet. According to Fanny code, the container may carry additional components and internal commands: such as to copy certain file from the local filesystem to the USB drive (locations are defined as parameters, the file is set hidden and system file attributes), or to update the configuration block. It uses RC4 with the following hard-coded key to protect critical information:
When the USB drive travels to another infected computer connected to the Internet it can be used to carry important files and provide a way to interact with the operator. This simple and extremely slow method of communication is not used by traditional cybercriminals, that is why the whole code looks like a toolkit for professional cyberespionage. This component is one of the rare malware samples from a new class of malware called USB-Backdoors.
If you find this or a similar code of USB-Backdoor on some of your systems this is an indicator of a professional cyberattack.Sinkholing and victim statistics
We sinkholed the Fanny C&C server and collected victim statistics, shown below. In total, we observed over 11,200 unique IPs connecting to the sinkhole server over a period of five months:
At the moment, the vast majority of victims are located in Pakistan (a whopping 59.36%). Indonesia and Vietnam follow at great distance, with 15.99% and 14.17% respectively. The infection numbers in other countries are probably too small to be relevant.
Of course, this could raise the question: was Pakistan the true target of Fanny? To be honest, we do not know. The current infection situation might be different from what it was in 2008-2010. Considering that there are still over ten thousand victims worldwide, the number back in 2009 might have been much, much higher – perhaps even as high as 50,000 infections. It may be relevant that Pakistan is a top target for the Equation group's other malware, along with Russia and Iran.Conclusion
With Fanny, we begin yet another chapter in the story of Stuxnet, the Equation Group and Flame. Created in 2008, Fanny used two zero-day exploits. These two were added to Stuxnet in June 2009 and March 2010. Effectively, it means that the Equation group had access to these zero-days (and others) years before the Stuxnet group did.
While the true target of Fanny remains unknown, its unique capability to map air-gapped networks and communicate via USB sticks indicate a lot of work went into gaining the ability to access these air-gapped networks. As a precursor for the versions of Stuxnet that could replicate through the network, it's possible that Fanny was used to map some of the future targets of Stuxnet.
Another unusual fact is the very high number of infections coming from Pakistan. Since Fanny spreads only through USB sticks, which is rather slow, this indicates that the infection began in Pakistan, possibly before many other countries.
Was Fanny used to map some highly sensitive networks in Pakistan, for an unknown purpose, or was it used in preparation for Stuxnet? Perhaps time will tell.
Equation: The Death Star of Malware Galaxy
Download "Equation group: questions and answers" PDF"Houston, we have a problem"
One sunny day in 2009, Grzegorz Brzęczyszczykiewicz1 embarked on a flight to the burgeoning city of Houston to attend a prestigious international scientific conference. As a leading scientist in his field, such trips were common for Grzegorz. Over the next couple of days, Mr Brzęczyszczykiewicz exchanged business cards with other researchers and talked about the kind of important issues such high level scientists would discuss (which is another way of saying "who knows?"). But, all good things must come to an end; the conference finished and Grzegorz Brzęczyszczykiewicz flew back home, carrying with him many highlights from a memorable event. Sometime later, as is customary for such events, the organizers sent all the participants a CDROM carrying many beautiful pictures from the conference. As Grzegorz put the CDROM in his computer and the slideshow opened, he little suspected he had just became the victim of an almost omnipotent cyberespionage organization that had just infected his computer through the use of three exploits, two of them being zero-days.A rendezvous with the "God" of cyberespionage
It is not known when the Equation2 group began their ascent. Some of the earliest malware samples we have seen were compiled in 2002; however, their C&C was registered in August 2001. Other C&Cs used by the Equation group appear to have been registered as early as 1996, which could indicate this group has been active for almost two decades. For many years they have interacted with other powerful groups, such as the Stuxnet and Flame groups; always from a position of superiority, as they had access to exploits earlier than the others.
The #EquationAPT group is probably one of the most sophisticated cyber attack groups in the world #TheSAS2015Tweet
Since 2001, the Equation group has been busy infecting thousands, or perhaps even tens of thousands of victims throughout the world, in the following sectors:
- Government and diplomatic institutions
- Telecoms
- Aerospace
- Energy
- Nuclear research
- Oil and gas
- Military
- Nanotechnology
- Islamic activists and scholars
- Mass media
- Transportation
- Financial institutions
- Companies developing encryption technologies
To infect their victims, the Equation group uses a powerful arsenal of "implants" (as they call their Trojans), including the following we have created names for: EQUATIONLASER, EQUATIONDRUG, DOUBLEFANTASY, TRIPLEFANTASY, FANNY and GRAYFISH. No doubt other "implants" exist which we have yet to identify and name.
The #EquationAPT group interacted with other powerful groups, such as the #Stuxnet and #Flame groups #TheSAS2015Tweet
The group itself has many codenames for their tools and implants, including SKYHOOKCHOW, UR, KS, SF, STEALTHFIGHTER, DRINKPARSLEY, STRAITACID, LUTEUSOBSTOS, STRAITSHOOTER, DESERTWINTER and GROK. Incredible as it may seem for such an elite group, one of the developers made the unforgivable mistake of leaving his username: "RMGREE5", in one of the malware samples as part of his working folder: "c:\users\rmgree5\".
Perhaps the most powerful tool in the Equation group's arsenal is a mysterious module known only by a cryptic name: "nls_933w.dll". It allows them to reprogram the hard drive firmware of over a dozen different hard drive brands, including Seagate, Western Digital, Toshiba, Maxtor and IBM. This is an astonishing technical accomplishment and is testament to the group's abilities.
Over the past years, the Equation group has performed many different attacks. One stands out: the Fanny worm. Presumably compiled in July 2008, it was first observed and blocked by our systems in December 2008. Fanny used two zero-day exploits, which were later uncovered during the discovery of Stuxnet. To spread, it used the Stuxnet LNK exploit and USB sticks. For escalation of privilege, Fanny used a vulnerability patched by the Microsoft bulletin MS09-025, which was also used in one of the early versions of Stuxnet from 2009.
LNK exploit as used by Fanny
It's important to point out that these two exploits were used in Fanny before they were integrated into Stuxnet, indicating that the Equation group had access to these zero-days before the Stuxnet group. The main purpose of Fanny was the mapping of air-gapped networks. For this, it used a unique USB-based command and control mechanism which allowed the attackers to pass data back and forth from air-gapped networks.
Two zero-day exploits were used by the #EquationAPT group before they were integrated into #Stuxnet #TheSAS2015Tweet
In the coming days, we will publish more details about the Equation group malware and their attacks. The first document to be published will be a general FAQ on the group together with indicators of compromise.
By publishing this information, we hope to bring it to the attention of the ITSec community as well as independent researchers, who can extend the understanding of these attacks. The more we investigate such cyberespionage operations, we more we understand how little we actually know about them. Together, we can lift this veil and work towards a more secure (cyber-)world.
Download "Equation group: questions and answers" PDFIndicators of compromise ("one of each"): Name EquationLaser MD5 752af597e6d9fd70396accc0b9013dbe Type EquationLaser installer Compiled Mon Oct 18 15:24:05 2004 Name Disk from Houston "autorun.exe" with EoP exploits MD5 6fe6c03b938580ebf9b82f3b9cd4c4aa Type EoP package and malware launcher Compiled Wed Dec 23 15:37:33 2009 Name DoubleFantasy MD5 2a12630ff976ba0994143ca93fecd17f Type DoubleFantasy installer Compiled Fri Apr 30 01:03:53 2010 Name EquationDrug MD5 4556ce5eb007af1de5bd3b457f0b216d Type EquationDrug installer ("LUTEUSOBSTOS") Compiled Tue Dec 11 20:47:12 2007 Name GrayFish MD5 9b1ca66aab784dc5f1dfe635d8f8a904 Type GrayFish installer Compiled Compiled: Fri Feb 01 22:15:21 2008 (installer) Name Fanny MD5 0a209ac0de4ac033f31d6ba9191a8f7a Type Fanny worm Compiled Mon Jul 28 11:11:35 2008 Name TripleFantasy MD5 9180d5affe1e5df0717d7385e7f54386 loader (17920 bytes .DLL) Type ba39212c5b58b97bfc9f5bc431170827 encrypted payload (.DAT) Compiled various, possibly fake Name _SD_IP_CF.dll - unknown MD5 03718676311de33dd0b8f4f18cffd488 Type DoubleFantasy installer + LNK exploit package Compiled Fri Feb 13 10:50:23 2009 Name nls_933w.dll MD5 11fb08b9126cdb4668b3f5135cf7a6c5 Type HDD reprogramming module Compiled Tue Jun 15 20:23:37 2010 Name standalonegrok_18.104.22.168 / GROK MD5 24a6ec8ebf9c0867ed1c097f4a653b8d Type GROK keylogger Compiled Tue Aug 09 03:26:22 2011 C&C servers (hostnames and IPs): DoubleFantasy: advancing-technology[.]com
config.getmyip[.]com - SINKHOLED BY KASPERSKY LAB
myhousetechnews[.]com - SINKHOLED BY KASPERSKY LAB
newsterminalvelocity[.]com - SINKHOLED BY KASPERSKY LAB
successful-marketing-now[.]com - SINKHOLED BY KASPERSKY LAB
techasiamusicsvr[.]com - SINKHOLED BY KASPERSKY LAB
www.forboringbusinesses[.]com EquationLaser: lsassoc[.]com - re-registered, not malicious at the moment
gar-tech[.]com - SINKHOLED BY KASPERSKY LAB Fanny: webuysupplystore.mooo[.]com - SINKHOLED BY KASPERSKY LAB EquationDrug: newjunk4u[.]com
newip427.changeip[.]net - SINKHOLED BY KASPERSKY LAB
ad-servicestats[.]net - SINKHOLED BY KASPERSKY LAB
subad-server[.]com - SINKHOLED BY KASPERSKY LAB
247adbiz[.]net - SINKHOLED BY KASPERSKY LAB
gar-tech[.]com - SINKHOLED BY KASPERSKY LAB
rapidlyserv[.]com GrayFish: ad-noise[.]net
unwashedsound[.]com TripleFantasy: arm2pie[.]com
tropiccritics[.]com Equation group's exploitation servers: standardsandpraiserepurpose[.]com
technology-revealed[.]com IPs hardcoded in malware configuration blocks: 18.104.22.168
22.214.171.124 Kaspersky products detection names:
- Backdoor.Win32.Laserv
- Backdoor.Win32.Laserv.b
- Exploit.Java.CVE-2012-1723.ad
- HEUR:Exploit.Java.CVE-2012-1723.gen
- HEUR:Exploit.Java.Generic
- HEUR:Trojan.Java.Generic
- HEUR:Trojan.Win32.DoubleFantasy.gen
- HEUR:Trojan.Win32.EquationDrug.gen
- HEUR:Trojan.Win32.Generic
- HEUR:Trojan.Win32.GrayFish.gen
- HEUR:Trojan.Win32.TripleFantasy.gen
- Rootkit.Boot.Grayfish.a
- Trojan-Downloader.Win32.Agent.bjqt
- Trojan.Boot.Grayfish.a
- Trojan.Win32.Agent.ajkoe
- Trojan.Win32.Agent.iedc
- Trojan.Win32.Agent2.jmk
- Trojan.Win32.Diple.fzbb
- Trojan.Win32.DoubleFantasy.a
- Trojan.Win32.DoubleFantasy.gen
- Trojan.Win32.EquationDrug.b
- Trojan.Win32.EquationDrug.c
- Trojan.Win32.EquationDrug.d
- Trojan.Win32.EquationDrug.e
- Trojan.Win32.EquationDrug.f
- Trojan.Win32.EquationDrug.g
- Trojan.Win32.EquationDrug.h
- Trojan.Win32.EquationDrug.i
- Trojan.Win32.EquationDrug.j
- Trojan.Win32.EquationDrug.k
- Trojan.Win32.EquationLaser.a
- Trojan.Win32.EquationLaser.c
- Trojan.Win32.EquationLaser.d
- Trojan.Win32.Genome.agegx
- Trojan.Win32.Genome.akyzh
- Trojan.Win32.Genome.ammqt
- Trojan.Win32.Genome.dyvi
- Trojan.Win32.Genome.ihcl
- Trojan.Win32.Patched.kc
- Trojan.Win64.EquationDrug.a
- Trojan.Win64.EquationDrug.b
- Trojan.Win64.Rozena.rpcs
- Worm.Win32.AutoRun.wzs
1 pseudonym, to protect the original victim's identity >>
2 the name "Equation group" was given because of their preference for sophisticated encryption schemes >>
The Great Bank Robbery: the Carbanak APT
The story of Carbanak began when a bank from Ukraine asked us to help with a forensic investigation. Money was being mysteriously stolen from ATMs. Our initial thoughts tended towards the Tyupkin malware. However, upon investigating the hard disk of the ATM system we couldn't find anything except a rather odd VPN configuration (the netmask was set to 188.8.131.52).
At this time we regarded it as just another malware attack. Little did we know then that a few months later one of our colleagues would receive a call at 3 a.m. in the middle of the night. On the phone was an account manager, asking us to call a certain number as matter of urgency. The person at the end of the line was the CSO of a Russian bank. One of their systems was alerting that data was being sent from their Domain Controller to the People's Republic of China.
Up to 100 financial institutions have been hit.Total financial losses could be as a high as $1bn#TheSAS2015#CarbanakTweet
When we arrived on site we were quickly able to find the malware on the system. We wrote a batch script that removed the malware from an infected PC, and ran this script on all the computers at the bank. This was done multiple times until we were sure that all the machines were clean. Of course, samples were saved and through them we encountered the Carbanak malware for the first time.Modus Operandi
Further forensic analysis took us to the point of initial infection: a spear phishing e-mail with a CPL attachment; although in other cases Word documents exploiting known vulnerabilities were used. After executing the shellcode, a backdoor based on Carberp, is installed on the system. This backdoor is what we know today as Carbanak. It is designed for espionage, data exfiltration and remote control.
Each bank robbery took 2-4 months, from infecting the first computer to cashing the money out #TheSAS2015 #CarbanakTweet
Once the attackers are inside the victim´s network, they perform a manual reconnaissance, trying to compromise relevant computers (such as those of administrators') and use lateral movement tools. In short, having gained access, they will jump through the network until they find their point of interest. What this point of interest is, varies according to the attack. What they all have in common, however, is that from this point it is possible to extract money from the infected entity.
The gang behind Carbanak does not necessarily have prior knowledge of the inner workings of each bank targeted, since these vary per organisation. So in order to understand how a particular bank operates, infected computers were used to record videos that were then sent to the Command and Control servers. Even though the quality of the videos was relatively poor, they were still good enough for the attackers, armed also with the keylogged data for that particular machine to understand what the victim was doing. This provided them with the knowledge they needed to cash out the money.Cash out procedures
During our investigation we found several ways of cashing out:
ATMs were instructed remotely to dispense cash without any interaction with the ATM itself, with the cash then collected by mules; the SWIFT network was used to transfer money out of the organisation and into criminals' accounts; and databases with account information were altered so that fake accounts could be created with a relatively high balance, with mule services being used to collect the money.
Since we started investigating this campaign we have worked very closely with the law enforcement agencies (LEAs) tracking the Carbanak group. As a result of this cooperation we know that up to 100 financial institutions have been hit. In at least half of the cases the criminals were able to extract money from the infected institution. Losses per bank range from $2.5 million to approximately $10 million. However, according to information provided by LEAs and the victims themselves, total financial losses could be as a high as $1 billion, making this by far the most successful criminal cyber campaign we have ever seen.
Losses from #Carbanak per bank range from $2.5 million to approximately $10 million #TheSAS2015Tweet
Our investigation began in Ukraine and then moved to Moscow, with most of the victims located in Eastern Europe. However thanks to KSN data and data obtained from the Command and Control servers, we know that Carbanak also targets entities in the USA, Germany and China. Now the group is expanding its operations to new areas. These include Malaysia, Nepal, Kuwait and several regions in Africa, among others.
The group is still active, and we urge all financial organizations to carefully scan their networks for the presence of Carbanak. If detected, report the intrusion to law enforcement immediately.
For a full description of the campaign, IOCs and list of infections please see our report.
To check your network for Carbanak's presence, you can also use the open IOC file available here.FAQ What is Carbanak?
Carbanak is the name we use for an APT-style campaign targeting (but not limited to) financial institutions. The main difference with other APT attacks is that attackers do not see data but money as their primary target. We say APT-like, however the attack is not strictly speaking Advanced. Strictly speaking, the main feature defining the attackers is Persistence.
We name the backdoor Carbanak since it is based on Carberp and the name of the configuration file is "anak.cfg".What are the malicious purposes of this campaign?
The attackers infiltrate the victim´s network looking for the critical system they can use for cashing money out. Once they have stolen a significant amount of money (from 2.5 to 10 MM USD per entity), they abandon the victim.Why do you think it is significant?
Banking entities have always been a primary target for cybercriminals. However it was almost always through their customers. This time attackers are targeting financial entities directly in an unprecedented, determined, highly professional and coordinated attack, and using any means from the target to cash as much money out as possible, up to an apparently auto-imposed limit.Can you explain the timeline of the campaign?
According to what we know, the first malicious samples were compiled in August, 2013 when the cybercriminals started to test the Carbanak malware. The first infections were detected in December, 2013.
On average, each bank robbery took between two and four months, from infecting the first computer at the bank's corporate network to cashing the money out.
We believe that the gang was able to successfully steal from their first victims during the period of February-April 2014. The peak of infections was recorded in June 2014.
Currently the campaign is still active.Why didn´t you make the details public until now?
Since we started working on this campaign we have collaborated with the different LEAs involved in the investigation and helped them as much as possible. As it remains an open investigation, we were asked not to share any details until it was safe to do so.Have you reached victims and Computer Emergency Response Teams (CERTs) in those countries where you have detected the incidents?
Yes, this investigation turned into a joint operation between Kaspersky Lab's Global Research and Analysis Team and international organizations, national and regional law enforcement agencies and a number of Computer Emergency Response Teams (CERTs) worldwide.
One of our main goals was to disseminate our knowledge of the campaign and IOCs among all detected and potential victims. We used national CERTs and LEAs as the distribution channel.How did you contribute to the investigation?
We're helping to assist in investigations and countermeasures that disrupt malware operations and cybercriminal activity. During the investigations we provide technical expertise such as analyzing infection vectors, malicious programs, supported Command & Control infrastructure and exploitation methods.How was the malware distributed?
Attackers used spear phishing emails with malicious attachments against employees of the targeted financial institutions, in some cases sending them to their personal email addresses. We believe the attackers also used drive by download attacks, but this second assumption is still not 100% confirmed.What is the potential impact for victims?
Based on what the attackers stole from victims, a new victim faces potential losses of up to 10 million $. However this figure is arbitrary based on what we know: nothing limits the potential loss once an institution is infected.Who are the victims? What is the scale of the attack?
Victims are mainly institutions in the financial industry; however we have also found traces of infections in POS terminals and PR agencies. For a sense of the scale of the attack please see the different charts and maps we provide in our report.
As with many malware campaigns there are a variety of companies/individuals analyzing the malware, resulting in requests to the Command and Control server. When we analyze those servers, all we see are the IPs and possibly some additional information. When this additional information is not present, and when the IP cannot be traced back to its owner, we mark it as an infection.
Based on this approach our analysis concludes that Russia, the US, Germany and China are the most affected countries.How are corporate users protected against this type of attack? Does Kaspersky Lab protect their users?
Yes, we detect Carbanak samples as Backdoor.Win32.Carbanak and Backdoor.Win32.CarbanakCmd.
All Kaspersky Lab's corporate products and solutions detect known Carbanak samples. To raise the level of protection, it is recommended to switch on Kaspersky's Proactive Defense Module included in each modern product and solution.
We also have some general recommendations:
- Do not open suspicious emails, especially if they have an attachment;
- Update your software (in this campaign no 0days were used);
- Turn on heuristics in your security suites, this way it is more likely that such new samples will be detected and stopped from the beginning.
What you ask people walking around inside your company offices without a valid identity card: "May I help you?"
Financial cyber threats in 2014: things changed
In 2013 we conducted our first in-depth research into the financial cyber-threat landscape. At that time we registered a sudden surge in the number of attacks targeting users' financial information and money. The financial cyber threats landscape was discussed in detail in Kaspersky Lab's "Financial Cyber-threats in 2013" report.
In 2014, the situation changed considerably: the number of attacks and attacked users significantly decreased, as did the amount of financial phishing. The key findings of the study into the financial cyber-threat landscape in 2014 are as follows:
Attacks with Financial malware in 2013 and 2014Financial phishing attacks
- In 2014 financial phishing attacks, which include phishing that targets Banks, Payment Systems and E-shops, accounted for 28.73% of all phishing attacks (a decrease of 2.72 percentage points).
- Bank-related phishing accounted for 16.27% of all attacks.
- The amount of phishing against Payment Systems increased 2.4 p.p. (from 2.74% in 2013 to 5.14% in 2014)
- In 2014 Kaspersky Lab products detected 22.9 million attacks involving financial malware against 2.7 million users. This represents a YoY decrease of 19.23% for attacks and 29.77% of users.
- Among the total number of users subjected to all types of malware attacks, 4.86% of users encountered attacks involving some kind of financial threat – that's 1.34 percentage points less than in 2013.
- The amount of Banking malware rose 8.89 percentage points to 75.63% of all financial malware attacks in 2014.
- The number of attacks involving Bitcoin mining malware tripled: from 360,065 attacks in 2013 to 1,204,987 in 2014
There are several possible reasons for these changes. First of all, law enforcement agencies around the world actively prosecuted cybercriminals who were spreading financial malware and phishing. In particular, last summer, law enforcement agencies in the US and the UK stopped the activities of two dangerous malicious campaigns – Gameover / Zeus and Shylock.
The second reason for the decline in the number of attacks might be a shift in the cybercriminals' focus – instead of attacking end-users they are now pursuing organizations that work with financial information and payment tools. Throughout the year there were frequent reports of malicious attacks on large stores, hotel chains and fast food restaurants that serve millions of customers a day. In each case the fraudsters used malicious software that could steal bank card data directly from the memory of the POS terminals used by the organizations under attack. Banks became yet another "new" cybercriminal target. In 2014, Kaspersky Lab investigated several attacks targeting banks rather than their users' accounts. Neither of these "new" types of attack prompted a rash of new AV detections simply because there are so few organizations involved compared with the number of private users running antivirus solutions, so it is difficult to compare the number of attacks. Nevertheless, the damage from such attacks amounted to millions of dollars so this threat can hardly be dismissed.
#Cybercriminals are less interested in "mass" malicious attacks, preferring fewer, more "targeted" #attacksTweet
A third possible reason for the reduced number of cyberattacks lies in a general trend observed by Kaspersky Lab specialists in 2014. According to the company's experts, cybercriminals are less interested in "mass" malicious attacks on users, preferring fewer, more "targeted" attacks. This is shown by the increased levels of targeted phishing: fraudsters only go after a specific group of users (for example, online banking users) rather than spreading mass mailings with malicious links.
This tactic suggests that a selective malicious mailing is less likely to be detected by IT security specialists and the lifespan of malicious links and malware samples will be extended. The trick is not always successful, but one consequence of its use is a decline in the absolute number of registered cyberattacks.Android financial malware attacks
And what about mobile financial threats?
First of all, when we talk about mobile cyberthreats we focus on Android cyberthreats. According to Kaspersky Lab experts, more than 99% of mobile malware they are aware of is designed to attack Android devices.
48.15% of the attacks against #Android users utilized malware targeting financial data (Trojan-SMS and Trojan-Banker)Tweet
In 2014 Kaspersky Lab and INTERPOL released a joint study on Mobile Cyberthreats which – among others – covered financial malware targeting Android users. According to the findings, there were 3,408,112 attacks against 1,023,202 users recorded in the period from August 1st, 2013 to July 31st 2014. About 500,000 users have encountered Android malware designed to steal money at least once. More than half a year has passed since the end of the period covered by the Kaspersky Lab / INTERPOL study and here is how things changed since:
- 48.15% of the attacks against users of Android-based devices blocked by Kaspersky Lab products utilized malware targeting financial data (Trojan-SMS and Trojan-Banker)
- In comparison with 2013 the number of financial attacks against Android users increased 3.25 times (from 711,993 to 2,317,194 attacks) and number of attacked users was up 3.64 times (from 212,890 to 775,887 users)
Attacks against users of Android-based devices in 2013 and 2014
In other words, the ever-increasing numbers of financial attacks against users of Android-based devices is a strong trend that shows no sign of declining.
Read more about financial cyber-threats in 2014 in our whitepaper.
DKIM technology on guard of your mail
Over the last decade DKIM signatures have become an important technology in the extensive list of methods for fighting against spam. Despite the fact that many users have no idea what the term DKIM even means, it is exactly this system that behind the scenes keeps our mailboxes guarded from various types of unsolicited mail, as well as protects a part of the world mail traffic from being wrongly labeled as "spam".
In this article we investigate the structure of DKIM in perspective from its emergence all the way up to nowadays. We also reveal the main advantages and downsides of this piece of technology, as well as explore typical spammers' tricks for forging DKIM signatures.Concept of DKIM
DKIM technology (DomainKeys Identified Mail) provides a sender verification and guarantees the integrity of the delivered email. The verification is based on the electronic message signature which is generated with asymmetric cryptography. This signature is added to the service headers and is transferred transparently for the end user.
DKIM signature validation occurs automatically on the user side. It relies on the data extracted from the DKIM header as well as on the public encryption key retrieved from the sender's DNS domain name records. The message might be marked as scam, phishing, or suspicious if the specified domain name was not authorized to send this message, depending on the user's policies. Email clients are more loyal to the correspondence with successfully validated DKIM headers, as opposed to the messages with failed DKIM verification. In the meantime, emails without any DKIM headers are processed in the standard mode.DKIM history
The history of DKIM starts in 2003 with an independent technology DomainKeys (DKIM ancestor) developed by Mark Delany as a part of his work at Yahoo. Two years later Yahoo is granted a patent for Domainkeys, and a wide range of vendors starts to prepare the first recommendatory version of DKIM standard.
In parallel with the DomainKeys development in 2003-2007, Cisco creates their own project "Identified Internet Mail" (IIM), based on a similar concept of authentication with the message signature.
In 2007 IETF publishes DomainKeys standard RFC 4870 (as already deprecated one) and the first standard of DKIM RFC 4871. Later on DKIM standard improves and gets updated in 2009 (RFC 5672). Finally, in 2011 IETF decides to merge two specs, IIM and DKIM, into the final standard RFC 6376.
Despite the fact that new standard had been published, by the year 2012 numerous companies were still using a deprecated 2007-year version of standard. This created a lot of interesting research on potential vulnerabilities in DKIM which we discuss below.
DKIM is based on the standard asymmetric encryption.5 main DKIM stages:
- For every server a public/private key pair (or a set of pairs) is generated.
- The private key is stored on the sender's server and is being used to create all corresponding DKIM headers for the outgoing mail.
- The public key is added to the domain DNS zone file in the form of special TXT-record by the domain owner and be comes accessible to everyone.
- Email with DKIM signature is sent to the recipient (see below).
- Signature is verified using the public key retrieved from the DNS records.
- Compose and send message.
User sends an email and it is accepted by the sender's mail server.
- Create DKIM signature.
The mail server adds a new "DKIM signature" header. This header includes an electronic signature created with the private encryption key, the message's body, its headers, current time, and other parameters.
- Transfer signed message.
Message with a new signed "DKIM signature" header is sent to the recipient.
- Message reception and signature validation.
The recipient's mail client analyzes the DKIM header and gives a verdict based on the public key, whether the sender and email are legitimate or not.
The very last stage, message validation, is especially interesting.
Main milestones:
- Sending DNS-request.
Mail client/service performs a DNS-request that includes the domain name from which allegedly the message was sent.
- Public encryption key retrieval.
The corresponding TXT-record that includes a public key is extracted from the response body from the DNS-server
- DKIM header analysis:
- Every tag in the header is decrypted from Base64 to its text representation.
- Received strings are decrypted using the previously retrieved public key.
- Final verdict.
The last stage is to compare the body text and headers with the decrypted information from the DKIM header. Any sort of discrepancy leads to dkim=fail, whereas if the content matches the verdict is dkim=pass.
Typical DKIM signature headers comprises of a list of tags like "tag=value". Tags names have short names and usually are 1-2 characters long.
Example:DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=foursquare.com; h=from:to:subject:mime-version:content-type; s=smtpapi; bh=9UsnWtzRLBWT7hnQc8V2RF4Ua4M=; b=IgnW7QsK2LBp0VQJ4FJcLv9MmHBvD 2Ch6jPxQ/Hkz+TX2WXyWkGbScx4gbZeWj3trqN4LUVvTf2U+htG4Wsg6sQAKqvnC neTeDvcmm225CKji0+MSXL8VK6ble8mkk14EAwWDP8+DJMwL2f7v/wp6QEdd7jqY q/fX+TY5ChIYHQ= Tags and descriptions
Main tags:Tag Tag description b message content (body + headers, encoded in Base64) bh hash of the canonicalized body part of the message(also in Base64) d domain name of the signing entity h list of signed headers
Additional headers:Tag Tag description a main algorithm to generate the signature v system version s selector subdividing the namespace for the "d=" (domain) tag c algorithm to use to convert the body and headers to the canonical form q list of query methods used to retrieve the public key x signature expiration time i identity of the client on behalf of which the message is signed (in quoted-printable) l body length count in the number of octets in the body included in the cryptographic hash t signature timestamp z copied header fields at the moment of signature generation Common attack methods on DKIM Simple attacks
First attempts to use DKIM by spammers were observed by us back in 2009. Originally, spammers tried to add headers with content that was far away from valid DKIM signatures. Spammers paid very small attention to the accuracy of the signature, what created some pretty interesting cases.
For example, spammers used the same header for all emails in this spam mailing (the genuine DKIM headers are actually different for non-identical messages since each of them is based the message body, headers, timestamps, and other unique factors).
Other spam samples show how spammers copied DKIM signature from the legitimate third-party website and for every email changed content of only one DKIM-tag, completely forgetting that other tags also depend on the message content and should have different values as well.
Similar mistakes systematically appeared in spam throughout the last years.
Some of the most popular of them:
- Spammers correctly generate the "b"-tag which describes the message body, but forget about the "bh"-tag (hashed body).
- Domain name specified in "d"-tag does not correspond to the sender, nor to any details information in the email at all.
- Specified timestamp ("t"-tag) is not accurate and is related to some other date in the distant past.
Spammers are capable of setting up their own mail servers and domains in order to generate legitimate DKIM headers as the average system administrator would do. In spite of that, valid DKIM headers have been fairly uncommon in spam until recently.
This is largely due to the complexity of the installation process of the DKIM server side for the valid signatures generation. However, the number of domain names involved in the spam activity has increased significantly over time, therefore attacks on DKIM have become more efficient and profitable for spammers. For these reasons spammers had to learn how to skillfully operate DNS-records of their numerous domains.
In the example below we can see a perfectly valid DKIM signature along with a correct domain's TXT-record which lead to the "dkim=pass" verdict when coupled together.
This extra work appears to be reasonable enough for spammers since many email services are more loyal to the messages with correct DKIM signatures, and spammers' mail eventually has higher chances not to be banned by anti-spam filters and end up in the user's mailbox.
In addition to simple checks for the "DKIM=fail" verdict in message headers, our Kaspersky Security for Linux Mail Server detects all email spam with mentioned spammers tricks. It either detects this mail as spam and forwards straight to the junk folder or increases the spam rate of the message.Vulnerabilities and weaknesses of DKIM
- DKIM does not provide any guarantees.
It is not reasonable to rely solely on DKIM for the following reasons:
а) Spammers, as well as the average users, can correctly configure DKIM on their own website.
b) It is possible that some of mail coming from a single domain name does not have any DKIM headers. One example might be if the domain uses multiple mail servers with different configurations, although there might be many other scenarios.
Because of these reasons, the standard advises not to "penalize" any mail without DKIM signatures.
- Lack of sustainability when message structure changes.
DKIM signature becomes invalid when the headers order is even slightly modified, when new headers are added, or when headers had any minor changes in their content. These kinds of changes are quite common and occur when the message is processed by the server-forwarder on the way to the recipient.
- Short encryption keys are vulnerable.
All DKIM signatures signed with private keys shorter than 1024 bits in length are vulnerable according to the research by Zach Harris published in Wired in October 2012. Moreover, Harris managed to crack the 384-bit authentication in just 24 hours using his laptop only. You can read about other requirements to DKIM in our blog article about this news.
Interestingly enough, Harris had successfully sent emails to Google founders Sergey Brin and Larry Page in 2012 by spoofing their DKIM headers and formatting messages as their personal correspondence between each other.
Recently, numerous companies including Google and Microsoft started to intensively promote the use of encryption keys with the sufficient length. Despite that, there are still a great number of insecure mail servers signing DKIM headers with private keys of not cryptographically strong lengths.Advantages of DKIM
- Correctly created DKIM signature confirms that the received message has been indeed sent from the specified domain.
- DKIM is a powerful tool for building a domain reputation based on the variety of messages received throughout a period of time (often used by diverse anti-spam solutions and by members of the DKIM reputation project)
- DKIM gives another indicator which helps to make a decision on the client side, whether to trust the sender or not.
DKIM is used in combination with other technologies of mail reputational analysis. The majority of modern email services and mail clients already support DKIM verification. However, it is useful to ensure that DKIM is configured correctly if you use your own domain name, or if you want to set up DKIM on your own mail server.DKIM installation on the corporate mail service
Many corporate email services support DKIM installation with only several clicks required. However, the domain administrator will have to manually edit the DNS zone file to add corresponding TXT-records.
For example, this is how the DKIM activation process looks like for Gmail for Work service.
- Open administratior panel for your domain name at https://admin.google.com
- Choose "Apps" in the list of menu items.
- Then choose Gmail from the list of apps.
- Confirm the intention to activate the "Email-authentication" and click "Generate new record".
- Service will generate the content of new TXT-record that you have to store in your domain's DNS zone file. To do that, open your domain's administrator panel, find a section for manually editing the domain zone, add a new record with TXT type, and copy there all values offered by Gmail.
- As an extra step, you can create another TXT-record in order to support SPF policy as well. For Gmail for Work service this record should be:
- Shortly after you finish all previous steps (often already after 20 minutes, but may take up to 48 hours), all emails sent from your domain start to be labeled with dkim=pass and spf=pass flags, confirming the legitimacy of the sender.
Final content of the zone record should be similar to:
google._domainkey IN TXT v=DKIM1; k=rsa; p=(generated public key)
@ IN TXT v=spf1 include:_spf.google.com ~all
This record authorizes Google servers to send mail from your domain name, and therefore the reversed verification on the recipient side will result in the spf=pass verdict.
If you have any problems with installation, the DKIM installation manual and SPF record manual from Google Apps should be helpful. For the details on the zone file editing, refer to your domain name registrant documentation.DKIM installation on your own mail server
Setting up DKIM on your own mail server is a less trivial process. We will give a short explanation of the DKIM installation procedure for Postfix mail agent on the server with Debian-like distribution. DKIM installation for other mail servers and OS is analogous. For more details, refer to the documentation on the interested email client and the information at the OpenDKIM project website.
Main stages:
- Install Postfix MTA and the following OpenDKIM packages from the official repositories depending on your distribution
- Generate the private key to be able to create DKIM signatures in the future. You will need to specify your domain name, as well as the selector name that can be chosen arbitrarily (used later).
- Copy the example file from /etc/opendkim/opendkim.conf.sample to /etc/opendkim/opendkim.conf and edit the following options depending on your domain name and the chosen selector name:
- Create new TXT-record in your DNS zone file (see also examples of zone file configuration above in the example for Gmail for Work service). Do not forget to specify your selector name picked on the previous steps. The record should look similar to:
- The last stage is the integration of opendkim to Postfix. Edit the configuration file /etc/postfix/main.cf and add the following data to it:
- The installation is finished and you can run opendkim service.
postfix opendkim opendkim-tools
$ opendkim-genkey -r -s selector -d yourdomain.com
Store the generated key to the arbitrary file in the server directory with limited access and specify the path to it in the configuration file below.
Domain yourdomain.com
KeyFile /path/to/the/key
Selector selector
Socket inet:8891@localhost
UserID opendkim
selector._domainkey IN TXT v=DKIM1; k=rsa; p=...
You can validate the TXT-record of your domain with a simple request using host tool:
host -t TXT selector._domainkey.yourdomain.com
However, take into account it might take up to several hours to have your TXT-record updated because DNS providers cache data on their side.
smtpd_milters = inet:localhost:8891
non_smtpd_milters = inet:localhost:8891
sudo service opendkim start
The majority of public email services support DKIM signatures, validate them transparently for the user, and use the received verdicts for their own anti-spam systems.
Some services try to make DKIM-check more visual and mark emails that successfully pass DKIM validation.
For example, Gmail service marks emails with a 'secured connection' icon if the sender is verified and this email passes some internal validations for the sender.
You can enable this functionality in Settings → Labs → Authentication icon for verified senders.
As another example, Yandex.Mail service supports DKIM-indicators by default. It shows the icon when this email has a valid electronic signature.
DKIM technology has various competitors and has become a basis for other sender authentication solutions.
- Sender Policy Framework (SPF)
SPF also uses DNS for storing information, and is a tool for verification the sender's domain. As opposed to DKIM, SPF stores not the public key in DNS records, but the list of the servers authorized to send email messages. Overall, SPF allows to verify the authenticity of the domain name, but not the message text or its headers.
Nonetheless, SPF technology is more widespread than DKIM and is supported by the vast majority of mail clients and email services.
- Pretty Good Privacy (PGP)
PGP is currently the most popular algorithm for email encryption in the world. It allows to encrypt the entire message under assumption that both sides generate public/private keys in advance and exchange the public keys. DKIM does not try to compete with PGP while being just an extension of the ordinary concept of email-message with the ability to validate the sender.
- Domain-based Message Authentication, Reporting and Conformance (DMARC).
DMARC is a relatively fresh authentication method that combines both SPF and DKIM technologies. This system was presented for the first time in 2011 and numerous top vendors expressed interest in it. In 2013 DMARC was already protecting more than half of the world mailbox while still not yet being an official standard, which once again proves the success of DKIM technology that underlies DMARC.


text:
Ever wondered how to get involved in astronomy, but were unsure how to start? Do you have a desire to find out more about the meteorites displayed at the ROM? In this course we will survey the frontiers of space and look up close at meteorite specimens. Through gallery exploration, discover some of the surprising astronomical connections that some artifacts have. Finally, we will learn some of the multiple ways you can participate and add to the ever increasing astronomical data through citizen science projects in this 21st century.
Instructor: Mauricio Argote-Cortes is a teacher in the Education Department of the Royal Ontario Museum.
Royal Ontario Museum
Education Classrooms, Level 1

subset: commoncrawl


text:
San Diego Music Thing expands, evolves
This weekend's 6th annual edition of the homegrown music conference and concert marathon features 150-plus local & national acts
"Our hardest job now is educating the public as to how they can take advantage of seeing all the bands, whether it's by buying a wrist band, a super-pass or individual tickets. There are a lot of ways to participate and, sometimes, people get confused."
Doing San Diego Music Thing concerts at the Birch North Park Theatre had long been on the event's wish-list, Hellman noted, but was not feasible in previous years for logistical reasons.
"The Birch is the crown jewel in North Park and we wanted to do something in the theater for the last five years, but other events were booked," he said. "It was available this year and Ra Ra Riot's tour schedule worked out, so we're thrilled to incorporate the venue and bring in a bigger band. That's stunted our growth in previous year — we didn't have larger venues to bring in bigger bands."
While the panels, keynotes and one-on-one sessions at the Sheraton Mission Valley are still dwarfed in number by the evening concerts, there are more of them this weekend than in any previous edition of the San Diego Music Thing.
"It's similar to what we've done in the past, but we've tried to create more one-on-one sessions," Hellman said. "Our hope is that the mentoring sessions will let people get answers right at the start and not just ask question at the end of panel."
Gone this year are the shuttle buses that ran up and down University Avenue and beyond, although there will be shuttle service from the Sheraton to North Park and back.
"We found that 95 percent of the people were coming to the corner of 30th and University and that people going to, say, the Soda Bar were going there for the night. So it didn't make sense to be having shuttle buses if no one is gong to be using them," Hellman said.
Will the San Diego Music Thing return to the Sheraton in Mission Valley next year?
"It is too early to say," Hellman said. "If our experience is good, we'd love to. They've been very nice and this is a very nice, modern hotel."


text:
Select Local Merchants
Splat TagRead MoreTo put it plainly, Splat Tag is massive. Twenty-two paintball fields sprawl across its 600 acres. Woods, brush, and felled trees make for strategic cover, and through every patch of forest could be something unexpected. A helicopter, a bunker, or perhaps an enemy base, right there for the taking?provided players have enough paint. The high number of play areas encourages players to linger, as does Splat Tag's policies. Open admission grants unlimited access for the day, with referees setting up 15- to 20-minute games. The fields admit up to 200 players per day, ensuring everyone can find those of similar skill levels. Splat Tag also hosts private and special events, including an annual gathering with enough paintballs to blot out murals of of the sun.835 County Rd EHudson, WI US
Adventure Zone PaintballRead MoreThrough the tree line at Adventure Zone Paintball, visitors can often hear the scattered reports of paintball markers and the thwack of their projectiles finding their targets. These friendly conflicts take place on seven fields, each ranging in size and configuration to encourage different combat situations. The largest is Hidden Valley, a heavily forested arena interwoven by trails and spotted with cover. The Outback encourages long-distance play with its central clearing, with players hiding in sniper towers, squatting behind plank walls, and standing awkwardly to pretend they are just trees. The small Urban Chaos field facilitates fast-paced games as teams duck behind overturned barrels and underneath the gate of a pretend car wash.13700 Nicollet AveBurnsville, MN US
Action Packed PaintballRead MoreAction Packed Paintball?s combat settings in Jordan include eight outdoor fields designed for woodsball, urban combat, and speedball. The experienced staff can accommodate private reservations and walk-on games, and there is a spectator area for those who prefer to just watch the action. After differences are settled on the field, outdoor combatants can retreat to onsite grilling and picnic areas as well as indoor restrooms.2412 University Avenue SoutheastMinneapolis, MN US
SplatballRead MoreUnless you're a spy, it's not usual to look for danger behind every corner. But it is normal when you're invested in a friendly bout of paintball. Inside Splatball's 10,000-square-foot facility, players avoid incoming splotches by ducking behind metal barrel- and castle-like structures—with the best of the best emerging to take control of the field. Referees are always on hand to make sure games don't get out of line, and spectators watch battles unfold from a safe observation area. Splatball rents and sells equipment from 30 different manufactures, including Tippmann, Planet Eclipse, and Ninja, and keeps gear up to snuff with a full-service repair shop. A concession stand replenishes players in between games, saving them from testing whether the red paint is cherry flavored.2921 2nd St N.Minneapolis, MN US
Devil Ops AirsoftRead MoreIt's no easy task to navigate the large warehouse that holds Devil Ops Airsoft. Two separate airsoft fields are like giant mazes, where opponents and their plastic artillery could wait behind each and every corner. The first arena takes the form of fast-paced hallways, where players must change strategies on the fly and resist the urge to quote long speeches from action films. The second arena? A two-level battlefield. Here, players fight their way up and down stairs, then battle for control of multiple rooms. The team at Devil Ops Airsoft runs public games every Saturday and Sunday and they rent out their facility for private events during the week.2554 Como Ave.Saint Paul, MN US
MN Pro-PaintballRead MoreOn MN Pro Paintball's 10 outdoor fields spanning 150 acres, players are immersed in a combat-style experience, darting amongst towers and trenches to avoid the paintballs whizzing through the air. Two commanders lead each team through each mission-based battle, guiding participants as they duck and weave, and certified guides supervise battles to ensure that combatants play fairly and wear their mandatory eye protection. The insured facility rents out traditional equipment from protective gear to ammo carriers, and also carries smoke and paint grenades.22554 Texas AveLakeville, MN US


text:
Join FREE | Login
& Deals
& Celebrations
Create a stampede with grilled beef topped with a kickin' butter.
©2014 General Mills, Inc. All Rights Reserved. This information will only be used to send an email to your friend(s) and will not be saved. Please read our Privacy Policy.
To broil steaks, place on broiler pan; broil 4 to 6 inches from heat using times above as a guide, turning once.
Grilled Halibut with Chipotle Butter
Grilled Tuna Steaks with Green Onions and Orange Butter
Grilled Corn and Chipotle Butter
Chunky Tomato-Basil Soup
Carnitas Gorditas with Creamy Chipotle Sauce
Home-Style Meat Loaf with Maple Glaze


text:
Food Fight: Metal vs. Plastic BeltingMarch 15, 2011 5:38 am | Articles | Comments
Different conveyor belting options are available to manufacturers, and each presents its own benefits to various applications.
Energy Management & Analysis for Energy-Intensive Industrial ProcessesMarch 11, 2011 5:49 am | by Schneider Electric | Product Releases | Comments
Schneider Electric presents its Production Energy Optimization (PEO) solution, an energy management and analysis tool for energy-intensive industrial processes. The solution reduces energy consumption per unit of production while making it more predictable for forecasting purposes.
Pumping up Fluid TransferMarch 9, 2011 7:24 am | by pumpsolutionsgroup | Videos | Comments
Since you can no longer do purge transfers, Almatec offers its Biocor pumps, which were on display at INTERPHEX 2010, to pump fluids through injectables and more.
Drive Technology for a Bottling PlantMarch 7, 2011 11:25 am | by NORD Drive Systems | Articles | Comments
The combination of a high-performance inverter, and extensive protection and monitoring systems for the inverter and motor, ensures the reliability of the bottling system.
Reduce Pump Energy Consumption and Mechanical FatigueMarch 3, 2011 6:24 am | by pumpsolutionsgroup | Videos | Comments
Wilden details the features and benefits of its PX1500 advanced aluminum pump and Pro-Flo X air distribution system.
An Expanded Line of Material-Handling MagnetsMarch 1, 2011 5:08 am | Chem Info | Product Releases | Comments
Industrial Magnetics recently expanded its line of Magnetic Cylinder-Actuated Transporters® for use in place of vacuum cups or grippers when lifting and moving parts.
Increase Safety, Decrease FatigueMarch 1, 2011 4:53 am | Product Releases | Comments
Parker Parflex's Fast-Stor® DURA-flex™ twin-line hose is a non-conductive, retractable coiled hose that is 28 percent lighter than competing rubber hoses.
Self-Propelled Trailer Saves SpaceFebruary 21, 2011 11:01 am | Product Releases | Comments
Wheelift Systems' self-propelled trailers are space-saving, ultra-maneuverable and have capacities up to and above 100 tons.
Valves for High Temperatures & Abrasive SurfacesFebruary 17, 2011 11:10 am | Product Releases | Comments
A-T Controls has engineered its M Series metal seat ball valves with specially coated matched balls and seats to stand up to high temperatures, pressures and abrasive materials.
Tank Wraps Protect Against FreezingFebruary 17, 2011 9:57 am | Product Releases | Comments
Powerblanket® now offers a variety of tank wraps to heat and maintain temperature in large holding tanks.
Label Me AutomatedFebruary 17, 2011 8:02 am | Articles | Comments
Docu-Proof Enterprise™ text inspection software not only automates the arduous task of proofreading labels, but also does it more rapidly and accurately.
Safety is on the DocketFebruary 17, 2011 7:41 am | by WALT SWIETLIK, Customer Relations Manager, Rite-Hite | Articles | Comments
What to do to prevent common safety issues at the dock and other high-speed environments.
The Seal of Approval for MixersFebruary 16, 2011 8:06 am | Product Releases | Comments
Sharpe Mixers recently launched its RD line of dry-running mechanical seals for mixers, agitators and reactors to meet ASME-BPE 2009 standards for cleanability.
A New & Improved Needle ValveFebruary 16, 2011 7:48 am | Product Releases | Comments
Hayward Flow Control recently redesigned its NVA Series needle valves with an integrated stem and PTFE seat for optimal control and performance.
A-to-Z All-in-One Tank MonitoringFebruary 10, 2011 11:47 am | by OPW FUEL MANAGEMENT SYSTEMS | Articles | Comments
The SiteSentinel® iSite automatic tank-gauging system swells control for an above-ground storage tank inventory dedicated to bulk lubes.
Rotary Feeders for Rugged ProcessingFebruary 10, 2011 9:01 am | Product Releases | Comments
According to ACS Valves, the CI Series rotary feeder valve provides bulk material processing operations continuous performance, reduced maintenance and optimal energy.
Tubular Drag ConveyorFebruary 8, 2011 12:53 pm | Product Releases | Comments
The MPE Chain-Vey™ tubular drag conveyor marries chain and disc technologies to gently move products without the use of air.
Hydraulic Scissor Lift & Tilt with ConveyorFebruary 8, 2011 12:42 pm | Product Releases | Comments
EnKon Systems scissor lift tables combine a hydraulic scissor lift with a tilting conveyor.
Single-Column Materials TesterFebruary 7, 2011 11:59 am | Product Releases | Comments
Lloyd Instruments' Model LS1 features linear guide technology, pre-loaded ball screws and advanced software compensation systems.
This Skid System Comes LoadedFebruary 4, 2011 11:51 am | Product Releases | Comments
Blue-White Industries has announced that its CHEM-FEED® skid systems are now available for ProSeries® M metering pumps.
Sifter Portholes Allow Screen InspectionFebruary 4, 2011 9:36 am | Product Releases | Comments
Sifter Parts & Service, Inc.'s inspection portholes on its CS-1 Gyratory Sifters allow easy access to visually inspect all of the screen area.
End-Ported Single-Use BiocontainersFebruary 1, 2011 10:27 am | Product Releases | Comments
Meissner now offers end-ported TepoFlex® biocontainer standards in sizes from 50 mL to 20 L.
Discharge Dry, Free-Flowing MaterialsJanuary 31, 2011 12:06 pm | Product Releases | Comments
Aerodyne's StopTight KG Valve discharges dry, free-flowing materials and isolates airlock valves from hoppers.
Mixing & Dispersion SystemJanuary 31, 2011 10:48 am | Product Releases | Comments
Charles Ross & Son Company's new mixing and dispersion system combines a high-shear mixer and a specially designed PowerMix.
Oil Shear Keeps Reading Rockin'January 31, 2011 5:47 am | by Reading Rock | Articles | Comments
Let's see specifically where and how oil shear technology is making a difference — and keeping the concrete block plant operational rather than idled.


text:
WeatherBug Mobile Web Weather
New England, ND 58647
WeatherBug Mobile
Mobile Web Weather from WeatherBug®
Get updated weather information from WeatherBug on your phone's Mobile Web. Access mobile web weather information, including current conditions, forecasts, radar and more for any U.S. ZIP Code.
Features may vary depending upon your mobile phone model.
Select your carrier below to get more information on Mobile Web Weather from WeatherBug®
WeatherBug Featured Products
Weather News
Other Top Weather Headlines
Severe Storms Eye Southern Plains, Northeast Today
The Southern Plains will need to cope with another round of severe weather this afternoon. Meanwhile, the Northeast will see…More >
Punishing Storms, Flooding Test Texas Emergency Response
Powerful storms left 3 people dead in the southern Plains this…More >
$42 Million 'Nose-To-Tail' Upgrade For 2 Hurricane Hunters
The hurricane planes are getting new engines, new wings and better…More >
WeatherBug Featured Content
Green Living
You too can help save our planet and put money back in your wallet. Learn how you can take the first steps to reduce your environmental impact, including driving green, easy ways you can conserve water, and energy saving tips. To learn more and discover the benefits of going green, visit WeatherBug's green living section. More >
Be Prepared, Know Before
Get faster alerts and better forecasts from the exclusive neighborhood-level WeatherBug network.Learn More


text:
Zdeno Chara gets it back, B's and Bolts tied at 3-3
|02.22.09 at 6:38 pm ET
TAMPA, Fl. — A Zdeno Chara blast from the high slot with plenty of Bruins traffic in front beat Tampa Bay goalie Karri Ramo, and the B's have again tied it at 3-3 with 3:20 to go in the third.
Latest from Bleacher Report
- Brad Marchand's Hot Streak a Big Reason for the Boston Bruins' Recent...
- Prospect Depth Allows BOS to Not Rush Pastrnak
- Seth Griffith Fitting in on the First Line with the Boston Bruins
- Bruins' Depleted Defense Returns to Reality in Loss to Wild
- Bruins' Patrice Bergeron Records 500th Career Point
- Bruins Players Dress Up as 'Frozen' Characters
- Looking at Bruins Defensive Pairings Without Chara


text:
The Miami Heat star has 609,336 votes, while the Oklahoma City's Durant trails by about 2,000 votes in the first returns announced by the league on Thursday.
The Lakers' Kobe Bryant (501,215) and the Clippers' Chris Paul (393,313) pace the Western Conference backcourt players. The Heat's Dwyane Wade (396,279) is the East's top vote-getter in the backcourt, followed by the Cavaliers' Kyrie Irving (365,712).
Paul George of the Indiana Pacers (489,335) and the New York Knicks' Carmelo Anthony (424,211) are next in the Eastern Conference.
The Rockets' Dwight Howard (295,120) and the Clippers' Blake Griffin (292,925) lead the West frontcourt.
The All-Star game will be held in New Orleans Arena on Feb. 16.


text:
CORK, Ireland, June 28, 2011 /PRNewswire/ -- Tibotec Pharmaceuticals today announced that it has entered into a license agreement with Gilead Sciences, Inc., for the development and commercialization of a new once-daily single tablet fixed-dose antiretroviral combination product containing Tibotec's protease inhibitor PREZISTA® (darunavir) and Gilead's cobicistat, an investigational pharmacoenhancing or "boosting" agent.
PREZISTA, co-administered with ritonavir (PREZISTA/ritonavir), and with other antiretroviral agents, is indicated for the treatment of human immunodeficiency virus (HIV-1) infection. In the United States of America, once daily dosing of PREZISTA is indicated for treatment-naive adult patients and treatment-experienced adult patients with no darunavir resistance associated substitutions. In the European Union, once daily dosing of PREZISTA is recommended for treatment-naive adult patients and may be used in treatment-experienced adult patients with no darunavir resistance associated substitutions and who have plasma HIV-1 RNA < 100,000 copies/ml and CD4+ cell count greater than or equal to 100 cells x 10(6)/l.
"We are excited to be able to study and develop PREZISTA with an alternative boosting agent in a combination product which has the potential to reduce the number of tablets patients take. Tibotec is committed to developing new and innovative HIV treatment options, especially those which provide simplified treatment regimens that may help patients to better manage their HIV treatment. PREZISTA is one of the leading protease inhibitors and co-formulating it with cobicistat in a new combination product demonstrates our commitment to HIV and innovations that will provide new options for patients," said Johan Van Hoof, MD, Global Therapeutic Area Head, Infectious Diseases and Vaccines, Janssen Pharmaceutica N.V.
Subject to regulatory approval, Tibotec will be responsible for the formulation, ma
|SOURCE Tibotec Pharmaceuticals
Copyright©2010 PR Newswire.
All rights reserved


text:
Even though you might be jumping ship right now, that won't stop Netflix as they're supposedly expanding into Europe. Variety reports that Netflix is preparing to set up shop in Spain and the UK early next year. [Variety via Mashable]
Is Netflix On Its Way to Europe?
Kwame Opam
Filed to: Blip 7/16/11 1:00pm


text:
Proguanil hydrochloride
proguanil hydrochloride --> chloroguanide hydrochloride
1-(p-chlorophenyl)-5-isopropylbiguanide monohydrochloride;an antimalarial drug.
Synonym: chlorguanide hydrochloride, proguanil hydrochloride.
Please contribute to this project, if you have more information about this term feel free to edit this page
This page was last modified on 3 October 2005, at 21:16. This page has been accessed 702 times.
© Biology-Online.org. All Rights Reserved.
Register | Login
| About Us | Contact Us | Link to Us | Disclaimer & Privacy | Powered by CASPION


text:
marjani jhanjhar bol padi - Download MP3 music or MP4 video:
Watch Video OnlineDownload MP3 Download Video
Are you the owner of this convertable material and do you want to disable the conversion of your media on clip.dj? Then you can request a conversion block for this video.
Girls from Conway, Arkansas performing on Medley of Falguni Pathak songs at a cultural event in LR.
Please share this Video with your friends on Social Networking Sites..... like Facebook, Twitter, Linkedin, Google plus, etc........
sarika performing on "marjani jhanjhar" at saurabh's sagai on 4 feb 08.
MY PAKISTANI MUSIC LIBRARY. FROM - SUNNY email at - firstname.lastname@example.com.
May 22, 2010 Sheen & Elvin's Wedding PERFORMED BY IDENTITY First Group Feby Saji Meevel John Shilpa Abraham Second Group: Rushmi Abraham Sincy Kurian Susan K...
Dholrhythms at a Fundraiser for Ashkenaz Music & Dance Community Center in Berkeley Song: Jhanjhar by Diljit, Gippy Grewal.
"If you like the Video, Don't forget to Share and leave your comments" For More http://www.hotgossiptown.com/
Style: Bhangra.
Group dance by Arlin Felix and Aireen Felix.
Hey guys! clip.dj is an easy online tool to convert videos from YouTube, Dailymotion and Vimeo to high quality MP3 music or MP4 video files. Important: You must agree to our terms of service before using this web application! Have fun! ;)
How it works: Go to YouTube and find a video you want to download, copy its URL (like http://www.youtube.com/watch?v=MkviQTo67FM) into the text field at the top of this page and press "Go".
Check out the charts if you wanna know what's hot.
Drag the bookmarklet above to your browser toolbar, so you can download your MP3s and MP4s fast and comfortly by pressing on this bookmarklet whenever you're browsing YouTube.
Another awesome shortcut: whenever you're on YouTube just enter the two letters "xd" before the video URL and press enter: http://www.youtube.com/watch?v=MkviQTo67FM => http://www.xdyoutube.com/watch?v=MkviQTo67FM ;)


text:
Metros ring in a new day at the NYSE
Catherine Kinney, Youri Djorkaeff, Nick Sakiewicz, Jeff Agoos and Zach Wells.
The MetroStars rang the opening bell at the New York Stock Exchange Wednesday morning to kick off the day's trading.
Defender Jeff Agoos, midfielder/forward Youri Djorkaeff, goalkeeper Zach Wells and President and General Manager Nick Sakiewicz all joined NYSE President and Co-Chief Operating Officer Catherine Kinney on the balcony overlooking the trading floor to ring the bell.
Afterwards, the MetroStars hit the floor and learned all about the trading process from various brokers who were eager to show the players their playing field.
Many MetroStars and world soccer fans alike greeted the players as they toured the floor. Perhaps the Metros can bring some good fortune to Wall Street and spark a bullish rally in the market.


text:
(IE) Unequal Temperaments 2nd edition
After the remarkable success of the 1st edition of the Unequal Temperaments eBook, I am pleased to communicate that the 2nd revised edition is now available, ...
(US) The Fortepiano Writings of Streicher, Dieudonné, and the Schiedmayers
Streicher, Nanette , Dieudonné, Carl , Schiedmayer, Johann David , & Schiedmayer, Johann Lorenz , Translation and annotation of original texts by Preethi de Silva
About Preethi de Silva: Preethi de Silva holds a Doctor of Musical Arts degree from Yale University. Am Emerita Professor of Music at Scripps College, she is also Adjunct Professor of Music at Claremont Graduate University.
Visit publisher website for more information: The Edwin Mellen Press
(US) Latest concert listing from Early Music Guild of Oregon (EMGO.ORG)
Sunday, March 8, 2009, 3pm: Gayle and Phil Neuman and Hideki Yamaya present "La Cantatrice" : Music of the Early 17th Century from Italy and England. Music by members of the famous musical Caccini family - Guilio, Settimia, and Francesca, who was called "La Cantatrice", Girolamo Frescobaldi, John Dowland, Thomas Campion, and others for voice, lute, archlute, cittern, bandora, recorders, and curtal. Eliot Chapel at Reed College in Portland. Admission $10 and 8.
Sunday, March 22, 2009, 1-4 p.m.: Gayle and Phil Neuman and Hideki Yamaya perform 18th century French music on recorders, lute, violin, viola, baroque rackett, chalumeau, and serpent for Museum Family Day for the Portland Art Museum. The theme is the exhibition of French Paintings in the time of Louis XV and Madame de Pompadour. For further information see: Portland Art Museum
(BE) SUMMER SCHOOL CAPPELLA PRATENSIS (Aug. 24-30, 2009)
Music for Pope Leo X
The course Music for Pope Leo X concentrates on the polyphonic repertoire from the early 16th century. Leo X was born as Giovanni de Medici and sat on the holy chair between 1513 and 1521. This music and art loving pope was a composer himself. He continued the evolution that his predecessor Pope Julius II had started. Under Leo X, the Papal Chapel's ensemble became one of the most highly renowned ensembles in Europe.
24/08/09 to 30/08/09
(UK) Beverley & East Riding Early Music Festival
-- Click on the article's title to see the full listing. (ed.) ***
Event 1: Red Priest: Carnival of the Seasons
7.30pm Thursday 21 May 2009
Toll Gavel Methodist Church
Toll Gavel, Beverley, HU17 9AA
Piers Adams recorders, Julia Bishop violin, Angela East cello, Howard Beach harpsichord. A gloriously inventive mix of entertainments from Vivaldi, Corelli to Biber and van Ecyk. "Mad, bad and deliciously dangerous... wacky ideas, an impish sense of humour and astonishing virtuosity." Gramophone
Tickets: £15.00 (concessions £12.00, children £5.00) available from the National Centre for Early Music box office: 01904 658338; firstname.lastname@example.com; www.ncem.co.uk
Event 2: Beverley Early Music Festival Schools' Chorus
1.00pm Friday 22 May 2009
St Mary's Church
St Mary's Court
North Bar Within Beverley, HU17 8DG
Community Education Project Directed by Sam DunkleyWe are delighted to welcome students from Woldgate College, a Performing Arts College in Pocklington, who have been working with peers from other schools in the East Riding to form this exciting new group. In this, their inaugural performance, the Chorus will be joined by young soloists from the Royal Northern College of Music in music by Purcell and Vivaldi.
Tickets: £3.00 (students free of charge) available from the National Centre for Early Music box office: 01904 658338; email@example.com; www.ncem.co.uk
Editor's Tips
Choose the "News Categories"
to filter your news items by
categories. There are presently more than 2000 news
articles that have
appeared on the site.
"Web Links" are searched on the "Web Links" page of the site where you will find a search window dedicated to the more than 2600 Early Music weblinks.
Visit our "Calendar" page to view events sorted by regions and categories.
"Website font size" If you find the font too small, press the" Control " key down (Ctrl) and tap the " +" key till you find the font size more readable. Pressing the Ctrl key and tapping the" - " key will reduce the font size. To return to the default font size press the Control key down (Ctrl) and tap the"0" (zero) key. This should work for any modern browser such as Firefox; IE; Safari; etc.------------------------------
To activate your newsfeed, click on the newsfeed icon next to your browser's URL window (if the newsfeed icon is missing choose this link: EarlyMusicNews Feed and choose your setting for the feed. You will then be able to see any news additions to the site in your "Bookmarks" or "Favourites" toolbar without even visiting the site. If you find a particular item of interest, choose that item and you will be taken to the http://www.EarlyMusicNews.org site to read that particular article. Feeds for specific news categories are also available on the "News Categories" page. (ed.)


text:
Contacting or Visiting Us
Join Team Philadelphia:
Register to be a part of Team Philadelphia as we compete for the gold!
Volunteer Feedback Form
Thank you for taking the time to submit your volunteer activity information. Please enter your information and click the "Submit Feedback" button. Please note that the asterisks (*) indicate required fields. Your information cannot be accepted without all required fields.
Find Related Info
Volunteer Programs
Register for the 2015 Dash
The 20th Annual Donor Dash is designed to help promote organ and tissue donation and highlight the success of transplantation.


text:
Ola, Arkansas
|Ola, Arkansas
Looking east down Highway 10 in Ola
Location in Yell County and the state of Arkansas
|Coordinates: 35°1′54″N 93°13′17″W / 35.03167°N 93.22139°WCoordinates: 35°1′54″N 93°13′17″W / 35.03167°N 93.22139°W
|United States
|• Total
|2 sq mi (5.1 km2)
|• Land
|1.9 sq mi (4.8 km2)
|• Water
|0.1 sq mi (0.3 km2)
|361 ft (110 m)
|Population (2000)
|• Total
|• Density
|602/sq mi (236.1/km2)
|Time zone
|Central (CST) (UTC-6)
|• Summer (DST)
|ZIP code
|Area code(s)
|FIPS code
|GNIS feature ID
Ola is a city in Yell County, Arkansas, United States. The population was 1,204 at the 2000 census. It is part of the Russellville Micropolitan Statistical Area.
Ola is located at 35°1′54″N 93°13′17″W / 35.03167°N 93.22139°W (35.031748, -93.221309).[1]
According to the United States Census Bureau, the city has a total area of 2.0 square miles (5.2 km2), of which 1.9 square miles (4.9 km2) is land and 0.1 square miles (0.26 km2) (6.53%) is water.
As of the census[2] of 2000, there were 1,204 people, 464 households, and 283 families residing in the city. The population density was 648.4 people per square mile (249.9/km²). There were 556 housing units at an average density of 299.4 per square mile (115.4/km²). The racial makeup of the city was 83.89% White, 0.42% Black or African American, 0.25% Native American, 0.25% Asian, 0.17% Pacific Islander, 12.96% from other races, and 2.08% from two or more races. 16.86% of the population were Hispanic or Latino of any race.
There were 464 households out of which 33.6% had children under the age of 18 living with them, 41.6% were married couples living together, 14.2% had a female householder with no husband present, and 39.0% were non-families. 34.5% of all households were made up of individuals and 17.9% had someone living alone who was 65 years of age or older. The average household size was 2.44 and the average family size was 3.18.
In the city the population was spread out with 28.3% under the age of 18, 8.3% from 18 to 24, 26.5% from 25 to 44, 18.9% from 45 to 64, and 18.0% who were 65 years of age or older. The median age was 36 years. For every 100 females there were 88.1 males. For every 100 females age 18 and over, there were 84.0 males.
The median income for a household in the city was $19,375, and the median income for a family was $24,125. Males had a median income of $21,250 versus $16,100 for females. The per capita income for the city was $10,117. About 20.1% of families and 27.2% of the population were below the poverty line, including 36.9% of those under age 18 and 29.9% of those age 65 or over.
Public education is administered by the Two Rivers School District, which supports :
- Two Rivers High School—Serves students in grades 7–12.
- Two Rivers Elementary School—Serves students in Kindergarten through 6th grade.
Two Rivers School District former in a merger of the school districts that formed around the former Ola High School and Plainview-Rover High School to form the Two Rivers High School.
Some portions of Ola are supported by the Danville School District, which leads to graduation from Danville High School.
The climate in this area is characterized by hot, humid summers and generally mild to cool winters. According to the Köppen Climate Classification system, Ola has a humid subtropical climate, abbreviated "Cfa" on climate maps.[3]
Notable people[edit]
- Babe Ellison, Major League Baseball player, member of Pacific Coast League Hall of Fame
- ^ "US Gazetteer files: 2010, 2000, and 1990". United States Census Bureau. 2011-02-12. Retrieved 2011-04-23.
- ^ "American FactFinder". United States Census Bureau. Retrieved 2008-01-31.
- ^ Climate Summary for Ola, Arkansas


text:
Minister wants Rs. 1,000-crore corpus for Women & Child Ministry; says its projects are limited by current allocation
The Union Women & Child Development Minister, Krishna Tirath, has staked claim to the Rs.1,000-crore Nirbhaya Fund. In letters to Prime Minister Manmohan Singh, Finance Minister P. Chidambaram and United Progressive Alliance chairperson Sonia Gandhi she has stated that while her Ministry was looking at strengthening its various projects and programmes, its "intent is limited by the budgetary allocation for its activities."
Ms. Tirath wrote: "The Government should look at allocating the Nirbhaya fund or any other fund to the Ministry since we are already in the process of designing the details of the structure, scope and application of the Rs.1,000-crore Nirbhaya Fund."
Further, presenting her Ministry's case, Ms. Tirath said: "In view of the recent events related to the issue of safety and security of women there is an urgent need for convergent action across the Ministries. The Ministry of Women & Child Development can play a nodal role in attempting convergence."
In the letter to the Union Finance Minister, Ms. Tirath has conveyed her apprehension about other Ministries too working at developing proposals under the Nirbhaya Fund.
She wrote: "As you may agree my Ministry being the nodal ministry for women, it would be appropriated if the task of co-ordination between other ministries who may have a role on the subject is entrusted to my Ministry with reference to developing a detailed plan for operationalisation of the Nirbhaya Fund."
Ms. Tirath has further noted that she proposes to create a task force comprising representatives of the key ministries and other experts who can design the details of the fund and recommend a national strategy to end violence against girls and women and develop various deliverables and operational guidelines for utilisation of Nirbhaya Fund.
In her communication to Ms. Gandhi, Ms. Tirath said: "My Ministry has already chalked out a strategy to bring a change in the mindset of the public through the ahimsa messengers – a cadre of women girls and youth who will generate awareness about legal procedures and provisions to address and eliminate all forms of violence against women through Poorna Shakti Kendras at grassroots level and facilitate social/community mobilisation to fight social evils – this is one of the many plans that we have to ensure the overall security and development of women."
Keywords: Krishna Tirath, Nirbhaya Fund, women's safety, violence against women


text:
Prospect Park steps into the future with DIY urbanism
By Jesse Marx
Cable's plot to destroy the internet
By Chris Parker
Signature business: Behind the lucrative autograph industry
By Jake Rossen
How Patrick Wall became the Catholic church's worst...
By Jesse Marx
By Michelle LeBow
The quest to close the achievement gap in north Minneapolis
By Alleen Brown
50 things to do in the Twin Cities before you die
By Maggie LaMaack
By CP Staff
Scott is clearly willing to take the risk. ''This will be the year of circulation for us,'' he says. His goal is 250,000 readers--nearly double Out's total now, but only about half the 485,000 Details has. He's looking to increase ad revenues from companies in financial services, pharmaceuticals, and especially fashion. And fashion coverage is something Collard is ideally suited to provide. Again, that editorial is likely to tilt toward men--there are relatively few ad campaigns aimed at lesbian style mavens.
The impending changes have caused considerable anxiety at Out. Two contributing writers, Daniel Mendelsohn and Sue Carswell, have already quit, and other staffers are mulling over their options. Collard used Brantley to relay a reassuring message to the lesbians who feared they might be fired, but trepidation persists that service and ''fun'' will inevitably diminish Out's serious journalism. ''People are trying to figure out what's best for a magazine that everyone is very, very dedicated to,'' says one staffer. They could quit in protest, but then ''suddenly he's got what he wanted--all the girls and the people who are doing serious stuff have left, so let's just make it a men's magazine.''
Earlier this year, some Out staffers were happy to participate when Scott made himself open to critiques of Pettit's behavior. They now suspect they played into Scott's hands by giving him an excuse to fire his editor and implement a new vision for Out he knew they wouldn't like. ''There's a relief that we lost Sarah's mean side,'' says one, ''but we're afraid we also lost the magazine.''
Sponsor Content


text:
Arizona Historical Society Al Merito Award 2015
The Arizona Historical Society would like to congratulate and recognize Shaw Kinsley as the 2015 Al Merito Award receipient for his dedicated service in preserving and making available to the public the history of Tubac, Tubac Presidio State Park, and the Santa Cruz Valley.
The Tucson Library and Archives is debuting a new reading room schedule in 2015!
Beginning in January, Mondays will be dedicated to: completing grant projects, relocating vulnerable collections, and focusing on interdivisional outreach initiatives. In order to accomplish this, the reading room will be closed on Mondays from January 5, 2015, through May 25, 2015. The reading room will continue to be open Tuesdays-Fridays from 9:00 am to 4:00 pm.
View the 2014 Annual Report