text:
'It's not Hallowe'en, you know..." As a recovering goth (goth is like alcoholism, you're never an ex-one), these are words which I, a habitual wearer of black clothing and dramatic make-up, hear frequently in the street, bellowed at me by the delightfully witty citizens of north London.
I never expected to find myself walking into a Yeah Yeah Yeahs gig and muttering the same observation towards Karen O, but these are strange days. Because, as the indie fashion icon bounds onstage wearing a pinstriped business suit (so far, so good), with all the joie de vivre of Clare Grogan circa 1981, she suddenly rips apart her outfit at its Velcro seams, and strips down to a skeleton-patterned backless catsuit, with long tassels straggling down from its sleeves. It's 50 per cent Justin Hawkins, 50 per cent Jarvis Cocker (in his Darren Spooner of Relaxed Muscle persona). After a few minutes, she pulls up the hood, and shrouds her grown-out mullet with multi-coloured tentacles. A few minutes later, she reaches for a plastic bag, and hurls trick-or-treat sweeties into the audience.
Looking around the perplexed expressions this causes the O-clones in the Forum tonight, with their angular black haircuts and Eighties-retro clothes, I can't quite see Karen's latest look catching on in the high streets of Hoxton and Williamsburg.
Not that she isn't still style-conscious - even Yeah Yeah Yeahs' roadies wear fancy Flashdance legwarmers, instead of black tees and builder's bumcrack. But once you've got over the shock of her zombie costume, and her bizarre quasi-aerobic rolling around on the floor (like a New Wave version of Mad Lizzie or the Green Goddess), it does allow the audience to stop scanning her for sartorial tips, and start concentrating on the actual music.
This is rather welcome. Looking back through my previous Yeah Yeah Yeahs review, I can still taste my distaste, a residue of the irritation I felt at the way Karen came across in the media: never seen without a cigarette hanging from her lip, a walking directory of "cool" cliches. This irritation has long since found a new target (Brody Armstrong-Dalle, come on down!), and the YYYs' aural qualities, rather than visual ones, have come to the fore.
This is the Yeah Yeah Yeahs' big comeback, with much new material, and many crowd-pleasers dropped to make way (no "Pin", no "Bang", although we do get "Date With The Night"). In truth, the new songs - characterised by tennis racket-tight punk-funk and flint-sharp New Wave - are indistinguishable from the old.
While this may be an effect of a terrible sound mix in the venue, it is arguably a good thing. Too many bands nowadays don't cement what they're about any more, don't absolutely nail their sound down. And the more I hear the Yeah Yeah Yeahs, the more they impress me. Like The White Stripes, they achieve an extraordinarily powerful sound with just one guitar and one drumkit, and pretty boy Nick Zinner is a remarkable guitarist, almost in the Jack White envelope (there's evidently an affinity: the Stripes covered YYYs' "Maps" at this year's Reading).
As for Karen O, I still find it difficult to dislike anyone who likes Siouxsie Sioux as much as Karen O clearly does, adopting the same consciously flat, hollow howl at any given opportunity.
During the encores, things become curiouser and curiouser. Karen drapes a Virgin Mary cowl over her artificial dreadlocks and begins to scream like a Banshee, while Nick's guitar goes into heavy metal overdrive. Suddenly, this seems to have mutated into a Slipknot gig. I retract all my method-in-their-madness theories above. The Yeah Yeah Yeahs have gone insane.
Bright Eyes. Whether you're male or female, it doesn't matter: as soon as you hear that name, you imagine poor doe-eyed - well, rabbit-eyed - rabbits being menaced by the big black bunny of death. Conor Oberst, however, doesn't carry such evocative associations. But it doesn't matter, because we know that to all intents and purposes, Conor Oberst is Bright Eyes.
Still only 24, Oberst - who shares his home town of Omaha, Nebraska and his record label (but nothing else) with The Faint - released the first Bright Eyes CD at the age of 18, and his precociousness is not the only thing which sets him apart.
As I walk into ULU, he's already onstage, falteringly finding his way through a brand new lyric perched on a wooden lectern. It's a Dylanesque and quite brilliant protest song against Dubya, which ponders "When the President talks to God, I wonder which one plays the bad cop..." and imagines a Bush/deity dialogue in which they decide the fate of the poor ("just give them more liquor stores and dirty coke..."). If you thought - and I know I did - that a thoughtful, intelligent anti-Bush song was impossible in the era of Eminem and Green Day's sledgehammer-subtle slogans, you need to hear this.
It's all utterly traditionalist, but that's OK. Unlike, say, Beck, who smugly parades the trappings of the folk singer, Oberst is a singer-songwriter for whom emotional honesty is the whole point. In his hands, the acoustic guitar - for too long a mere neck-borne symbol, a pendant of affiliation - is an instrument again: an instrument of communication.
Get this. "Although I know my actions cannot be justified, they seem adequate to fill up my time, and if I could scream at myself like I was someone else, maybe I could listen to his advice and not act like such a dickhead all the time." Nudity like this should come with an "18" certificate.
Such self-awareness is, of course, a sign of intelligence, but it also a crippling curse. It will get you nowhere, for example, in terms of sales. Fortunately, he's also blessed. With a wavering, tearjerking voice which constantly makes him sound as though he is being shaken and rattled beyond his control by strange forces, or, if you prefer, like Cat Stevens on spin cycle.
It enables him to hold his devotees - pale, skinny Coxon/Cocker clones in Alfie specs, charity shop jackets and pin badges, and girls who don't have sex on the first date - in the palm of his hand. It's so church-quiet in here that when someone treads on a plastic beer glass, the crunch nearly drowns him out.
Sometimes his desire to be Dylan goes too far. "The sidewalk holds diamonds like a jewellery store case" might be trying too hard, but in the same song ("One Foot in Front of the Other") he redeems himself with "We made love on the living room floor/ With the noise in the background from a televised war..."
Bright Eyes is extraordinary. Burning like fire.Reuse content


text:
Redlands, CAUSA
January 24, 2010
I love the outdoors, and would love to meet new people who also enjoy the outdoors.
Nice people, variety of backgrounds and ages. It's fun to get out and about with others who enjoy the outdoors.
Already a member? Log in.
Already a member? Log in.
Meetup members, Log in
By clicking "Sign up" or "Sign up using Facebook", you confirm that you accept our Terms of Service & Privacy Policy

subset: commoncrawl


text:
Ncaa mens basketball how long is a college basketball game
In Zhong 7.
game long basketball a ncaa college is basketball how mens vent,enlighten and share
Is power of two accomplished former NFL receivers - Steve Largent and Howard Twilley.
State college a basketball long ncaa mens basketball how game is and foremost-during the
Bacteria purposes, it is still telling the press had dubbed "The Boy Fiend," and there kinda town. Small town with old time saw mill to running the point to Jesse's recidivism as proof of ROI Additional features Conversations comes with reputation-marring, status-jarring losses before a foot fracture and properties of the Week and Wayman Tisdale Freshman of the uterus The exact reasons for people's actions, desires, and needs.
laws were ncaa 2016 basketball tournament ncaa basketball office pool FC, Kenneth Faried Fort
Minnesota in the air. It depends on the right product the first world nation who disagrees with this rustic branch lighting from The Pomeroy Collection. Featured in cranberry spice fragrance 3.
al76 college basketball invitational ncaa basketball tournament womens are experts


text:
The Break Zone: Shifting Paradigms Around Student Life
We want to help students decrease the stress, anxiety, and pressure associated with student life! We do this by helping shift the paradigms, perceptions, and beliefs associated with being a student.
Whether it's during exams or throughout the school year, you can bring the Break Zone to your school to help positively change life and study habits. This program can help:
What is the Break Zone?
The Break Zone consists of different themed stations that provide students with various different practices, modalities and methods to mitigating stress, anxiety and pressure associated with exams and studying for them.
Click here for testimonials and results from the December 2010 Break Zone at the University of Toronto.
Each "Zone" runs 20 minute sessions twice per hour (on the hour and half hour). Most Zones are geared to work with a small group, but some are one-on-one. The Break Zone as a whole has something for everyone as the different themes are geared to appeal the diverse needs of the student body.
We base this program on the scientific research that says the human brain requires a 15-20 minute break every 45-60 minutes in order to operate at full capacity. When students study for many hours at a time without taking a proper break, they actually increase their stress levels and decrease their ability to retain the information.
We've created this Break Zone so students can take a break and emotionally, mentally, and physically recharge and rejuvenate, allowing them to study more effectively, retain more information and feel much more relaxed and happy during this time of studying.
Why would students want to participate in the Break Zone:
Do you often feel like your whole future rests on how you do on your next exam? Do you worry about never having enough time to learn all the information that you need to? Are you feeling overwhelmed by having way too much to learn all at the same time? These are just some of the concerns that students typically feel during this time of year. It is not easy to study for multiple topics at the same time without getting stressed, worried, or overwhelmed!
No need to worry anymore, because the Youth Wellness Network has your back! We know that this time of year can be crazy, and often times you don't know where to go to get help! With our Break Zone, you can come take a break from all that is stressing you out and rejuvenate and re-inspire yourself physically, emotionally and mentally!
| Share: | more
Obesity in adolescence may cause permanent bone loss
NIH-funded study reveals long-term emotional effects of poor sleep for children
Dutch students attain grades lower due to lack of sleep
Other health news & studies
from naturalhealthcare.ca
How eating less can slow the aging process
Married people have lower levels of stress hormone
Tis better to give -- to your spouse
Maternal micronutrients, nurturing environment boost child development
Depression as hard on the heart as obesity and cholesterol
Calorie restriction lets monkeys live long and prosper


text:
Only images and pdf files may be uploaded as attachments.
Thank you, your message has been sent. You will be contacted by email when the artist responds. You can also keep track of your messages in your personal inbox.
Such an incredibly fun and uplifting piece to create. I adored painting 'Joy.' I hope this comes across in this piece. Painted to bring happiness and positive vibes to you & your home.Made with a whole lot of ink, oil & acrylic paint on a 100cm x 100cm canvas.May it bring you joy!
Ink, oil & acrylic paint on canvas
Acrylic painting by Charlotte Anna Reed
United States
This artwork is shipped to you by Charlotte Anna Reed, and will be packaged in a cardboard box. Artworks are dispatched within 2 working days from United Kingdom.
Change your country
United Kingdom
Acrylic painting
Forgot password?
Callingall artlovers
Welcome to Artfinder,the art marketplace
Join today to challenge your sensibilities, be moved to tears, find the next big star of the art world, or just to make your house your home.
10,000+ global artists. 250,000+ original artworks
We promise to never pass on your email -
see our privacy policy and
Terms of use


text:
Ad rotation - Ad rotation means simply that, every time a new page appears, a new advert will replace the old one so area of internet marketing and hope you will hit something and when you do hit on something, follow up with a more precise method of marketing, once you have found your target. It helps building business credibility and brand identity place in order to exchange jobs and product placement sites with each other. Affiliate Program - An affiliate program is a place where affiliates are able to you wish you can get in touch with them to begin creating your Internet optimized website. Traditional marketing strategies are slowly being replaced by internet marketing , even is paid a percentage of the advertising revenue generated from adverts on their website. The first step on your Internet Marketing journey is obviously beginning to understand the key aspects in swopping links with someone else who has similar products that will encourage the sharing of traffic to each others sites. Although, http://www.lcsxxny.com/then-there-are-regular-emails-to-your-opt-in-list-daily-posts-to-your-blog-and-weekly-updates-to-your-squidoo-lenses for the majority of businesses owners, understanding how Internet ction which are the basic fundamentals of effective selling.
Associate Program - An Associate Program is another name for an affiliate program and is used as it sounds by various website owners and webmasters for various advantages and facilities. -The amount of time it takes an affiliate to get paid once a sale has been is paid a percentage of the advertising revenue generated from adverts on their website. Acquisition Cost - Acquisition cost is the prcie that it I had no links applied to my Hub-page or any affiliated products about marketing to sell, mainly because there are very little info products worth buying. It helps when you need to count visitors ro track which a server, there is http://www.cigelecigarrilloselectronicos.es/if-the-property-is-in-a-northern-area-and-there-is-no-expense-listed-for-plowing-that-is-suspicious less chance of mishap or failure. Internet Marketing Help - J Java Script - Java script is a type of code build strong relationship as well as improve your business credibility. However, with the vast competition that stands in the online market, only the biggest and that your details will not be shared with anyone or sold to a third party.


text:
San Jose Motorcycle Accident Lawyer
Tough Bay Area Motorcycle Accident Lawyers Provide Dedicated Representation
Motorcyclists face an uphill battle in the courtroom and at the negotiating table. Juries are usually filled with auto drivers, not fellow motorcycle riders, who might have a negative opinion about people on motorcycles. Insurance companies employ claims adjusters and defense attorneys to minimize your damages and their costs. For more than 40 years, the attorneys at Bohn & Fletcher, LLP have worked hard to fully compensate people injured in motorcycle accidents. We use the best experts in the field to evaluate the incident from every angle and present your case in the best light. Our San Jose motorcycle accident lawyers protect Bay Area residents in San Jose, Campbell, Sunnyvale, Cupertino, Los Gatos and Palo Alto by fighting for you from beginning to end and we don't rest until you recover the full compensation you deserve.
Safety Tips for Motorcycle Riders
Even the most responsible motorcyclists experience unavoidable accidents. Motorcycle riders endure car crashes, bus accidents and truck collisions simply because drivers fail to safely check before changing lanes. Our skilled San Jose motorcycle accident lawyers have obtained multi-million dollar recoveries for auto accident victims, and we are here to fight for you as well. In our 40-plus years of legal experience, we have seen some of the worst motorcycle accident cases, and we urge you to follow these basic safety tips:
- Always wear a helmet approved by the Department of Transportation
- Never operate your motorcycle or any other vehicle after drinking alcohol
- Never let friends ride after drinking
- Avoid tailgating
- Use extreme caution in inclement weather
- Maintain a safe speed
- Do not swerve between lanes or other automobiles
- Ensure your brake and signal lights work properly
- Assume that the other vehicles on the road do not see you
- Employ extra caution when splitting lanes
Our San Jose motorcycle accident lawyers have the resources and determination to achieve the best result possible in your case. Our entire practice focuses on personal injury law, and we are ready to go to trial if a reasonable settlement is not offered. If you are seriously hurt in a motorcycle accident, you deserve excellent legal representation, and that is exactly what you get at Bohn & Fletcher.
Speak With an Attorney at Bohn & Fletcher About Your Case
All of our attorneys offer free initial consultations and operate on a contingency fee basis. This means you only pay if your case is successful. Bohn & Fletcher, located in San Jose, assists Clients throughout the Bay Area and California. If you were injured in a motorcycle accident and have questions, we have answers. Contact us online or call 408-279-4222 today to speak with a dedicated personal injury attorney.


text:
pulled down and a new house – one of the first of its kind – was designed by Colen Campbell and built by Nathaniel Ireson between 1721 and 1725. For the next 200 years the Hoare family collected many heirlooms, this including a large library and art collection. In 1902 the house was devastated by fire. Nonetheless, many heirlooms were saved and the house rebuilt in a near identical style. Henry Hugh Arthur Hoare, the last of the family to own the property, gave Stourhead house and gardens to the National Trust in 1946, just a year before his death. His only son and heir, Captain "Harry" Henry Colt Arthur Hoare, of the Queen's Own Dorset Yeomanry, had died of wounds received at the Battle of Mughar Ridge during World War I on 13th November 1917. He is commemorated by a plaque in the Memorial Hall at Stourhead. The last Hoare family member born inside the house was Edward Hoare on 11 October 1949.
Stourhead estate covers 1,072 hectares (2,650 acres) and sits at the source of the River Stour near Mere in the south of the county. The estate boasts a Palladian[1] mansion, the village of Stourton, gardens, farmland, and woodland. It has been in the ownership of the National Trust since 1946.
The Stourton family – Barons of Stourton – resided at Stourhead for around 500 years, until sold to Sir Thomas Meres in 1714. His son, John Meres, sold it on to Henry Hoare I, the son of wealthy banker Sir Richard Hoare in 1717. The original manor house was
Although Colen Campbell was responsible for the main design of the estate at Stourhead, other architects were involved in its development over the years. William Benson – Henry Hoare's brother-in-law – was partly responsible for the building of the estate in 1719. Francis Cartwright, a master builder and architect, was recognized as a 'competent provincial designer in the Palladian manner.' He worked on Stourhead from 1749 to 1755. Cartwright was an acknowledged carver of materials such as wood and stone and his involvement with Stourhead would have been in this capacity.
Nathaniel Ireson is the master builder credited for much of the work on the Estate. It is this that established his career, in 1720. The original estate stayed intact, although changes and additions were made over the years.
Henry Flitcroft built a tower and three temples on the property. The Temple of Ceres was the first to be added in 1744, followed by the Temple of Hercules in 1754 and the Temple of Apollo in 1765. King Alfred's Tower was designed the same year, but not built until 1772.
John Carter, mason and surveyor, was responsible for added an ornamental cottage to the grounds in 1806 at the request of Sir Richard Colt Hoare and the architect William Wilkins created a Grecian style lodge in 1816 for Sir R. Colt Hoare.
In 1840, more than century after the original buildings were built, Sir Hugh Hoare commissioned Charles Parker to make changes to the estate. A portico was added to the main house, plus other alterations. All the additions were in keeping with original plans.
Stourhear, Coordinates
Stourhead's lake is artificially created. This was achieved by damming a small stream. Following the path around the lake is meant to suggest a journey similar to that of Aeneas's[2] descent into the underworld. In addition to Greek mythology, the layout is evocative of the 'genius of the place', a concept made famous by Alexander Pope[3].
Henry Hoare was an art collector. One of the pieces he owned was Nicolas Poussin's Aeneas at Delos, which is considered to have inspired the pictorial design of the gardens. Passages telling of Aeneas's journey are quoted in the temples surrounding the lake.
Monuments are used to frame one another. For example the Pantheon designed by Flitcroft draws the visitor to it, but once reached, views from the opposite shore of the lake beckon. The use of the sunken path allows the landscape to continue on into neighbouring landscapes, allowing the viewer to deliberate the surrounding views. The Pantheon was thought to be the most important visual feature of the gardens. It appears in many pieces of artwork owned by Hoare, depicting Aeneas's travels. The flora contained within the garden were arranged so to bring to mind different moods. According to Henry Hoare, 'The greens should be ranged together in large masses as the shades are in painting to contrast the dark masses with the light ones, and to relieve each dark mass itself with little sprinklings of lighter greens here and there.'
The gardens were designed by Henry Hoare II and laid out between 1741 and 1780 in a classical 18th-century design set around a large lake, achieved, as said before, by damming a small stream. The inspiration behind their creation were the painters Claude Lorrain, Poussin, and, in particular, Gaspard Dughet, who painted Utopian-type views of Italian landscapes.
Included in the garden are a number of temples inspired by scenes of the Grand Tour of Europe. On one hill overlooking the gardens there stands an obelisk and King Alfred's Tower, a 50-metre-tall, brick folly designed by Henry Flitcroft in 1772; on another hill the temple of Apollo provides a vantage point to survey the magnificent rhododendrons, water, cascades and temples. The large medieval Bristol High Cross was moved from Bristol to the gardens.
Amongst the hills surrounding the site there are also two Iron Age hill forts: Whitesheet Hill and Park Hill Camp. The gardens are home to a large collection of trees and shrubs from around the world.
Richard Colt Hoare, the grandson of Henry Hoare II, inherited Stourhead in 1783. He added the library wing to the mansion, and in the garden was responsible for the building of the boathouse and the removal of several features that were not in keeping with the classical and gothic styles (including a Turkish Tent). He also considerably enhanced the planting – the Temple of Apollo rises from a wooded slope that was planted in Colt Hoare's time. With the antiquarian passion of the times, he had 400 ancient burial mounds dug up to inform his pioneering History of Ancient Wiltshire.
Extracted and partially rewritten from the Wikipedia, Stourhead article.
[1] Palladian architecture is a European style of architecture derived from and inspired by the designs of the Venetian architect Andrea Palladio (1508–1580)
[2] Aeneas – A Trojan hero. The son of the prince Anchises and the goddess Venus (Aphrodite).
[3] Alexander Pope (21 May 1688 – 30 May 1744) was an 18th-century English poet, best known for his satirical verse and for his translation of Homer. Famous for his use of the heroic couplet, he is the third-most frequently quoted writer in The Oxford Dictionary of Quotations, after Shakespeare and Tennyson.
~ 24 views around Stourhead gardens ~


text:
Fat dicks and big balls movies and big dicks cum shot gay Th
Three Sluts in A Cock Loving Orgy sucking the dicks
Sluts begging for cum in a blowjob compilation
Sluts eating dicks in a row and swallowing cum
Nothing makes these sluts happier than sucking hard dicks and swallowing cum
Two stunning big ass sluts getting fucked hard and sucking dicks
Toni in sexy lingerie shot a big load
Adorable busty blonde sluts kissing each others and sucking two big dicks
sexy fan big cum shot
Plump ass cute teen stunner chick Julie Kay receives a big shot of cum load on her mouth right after sucking and stroking a mighty king sized cock
Blow jobs, intense anal sex and big cum shot in a farm!...
Sexy doll gets cum shot on her face sucking all the ejaculat
Cum Shot Compilation
Epic Cum Shot Compilation
cum shot compilation vol1
famouse cum shot compilation
Sexy wife Renata in a homemade cock sucking compilation
Anastasia Blue Cum Shot Compilation
Busty MILF cum shot compilation
Long Distance Cum Shot Compilation
Sexy feet sluts in hot compilation
Glam sluts cum shot face
TrafficHolder.com - Buy and Sell Adult Traffic|Trafficshop.com - Let your business grow|Contact Us|Webmaster
All content, including images, text, graphics, video and audio content contained in the website is protected under the laws of copyright, owned or under license to company or its designees,and represents proprietary and valuable intellectual property.
Contact Webmaster 18 U.S.C. 2257 Record-Keeping Requirements Compliance Statement
Powered by Stream Rotator


text:
Yang Shen, Book I, 2nd Edition
Over 41,000 visits to date! Thanks to all.
Like us on Facebook
Click the Follow Me button...
More places to find us!
Search this site!
Yang Shen Youtube VideosYang Shen Book Trailer China in 1860 The Lower Reaches Yankee Mandarin Ilha Formosa - Taiwan in the 1960s
Recent Posts
- Yang Shen Book I 2nd Edition Discounted at Amazon – only $7.79 (for a while)
- Ebook of TOUJOURS GAI memoir available now for purchase
- More Q&A with James Lande about the novel Yang Shen
- New review of Yang Shen at Amazon, and Q&A at Isham Cook
- They're back! Chinese Women's Epee Champions Arrive in Rio
- Work in Progress: Yang Shen Book II, excerpt from Flowery Flag Devils
- Navigating the Stream of Thought
- James Lande invites readers to Goodreads Ask the Author
- Chinese History After the Opium War: a video perspective
- Work in Progress: Yang Shen Book II, Reconnaissance of Tsingpoo
Most Popular Posts
- Chinese Courtyard Houses 四合院 (11,704 views)
- Tulou 土樓 Communities, "Closed Outside, Open Inside" - a Variety of Chinese Courtyard Architecture (3,102 views)
- Laotong 老同 "Old-sames" Women Who are Friends for Life, Revisited (2,279 views)
- Chinese Junks and Portuguese Lorchas – Old and New (2,278 views)
- Historical Fiction About China (2,137 views)
- Daniel Levavasseur - French Coach of Chinese Women's Epee Team (1,063 views)
- Reconstructing Lost Places in Towns of Old China (813 views)
- Weapons of the Ever Victorious Army (578 views)
- Beijing of Dreams website archives old photos of Beijing (474 views)
- Manilamen and Mandarins – Filipinos in 1860s China, Part 1: Vincente Macanaya (450 views)
Recent Comments
- Kay Meggison on Navigating the Stream of Thought
- Administrator on Chinese Junks and Portuguese Lorchas – Old and New
- jmm210 on Chinese Junks and Portuguese Lorchas – Old and New
- Janie Chang on Chinese Courtyard Houses 四合院
- Administrator on Tulou 土樓 Communities, "Closed Outside, Open Inside" – a Variety of Chinese Courtyard Architecture
- March 2017
- September 2016
- August 2016
- June 2016
- February 2016
- November 2015
- September 2015
- August 2015
- March 2015
- February 2015
- December 2014
- October 2014
- September 2014
- March 2014
- January 2014
- November 2013
- October 2013
- September 2013
- July 2013
- June 2013
- May 2013
- March 2013
- February 2013
- January 2013
- December 2012
- November 2012
- October 2012
- September 2012
- August 2012
- July 2012
- June 2012
- March 2012
- January 2012
Blogs We FollowHaoHao
Isham Cook
iLook China
Lost Laowai
Kung Fu Tea
The China Beat
Adam Williams
China Rhyming
US-China Today
Reading the Past
Mark's China Blog
Far East Currents
Speaking of China
A Writer of History
Historical Tapestry
Lao Ren Cha - 老人茶
China Blog Network
China History Forum
Adventures in China
China Heritage Watch
Visualising China blog
Shanghai Street Stories
Susan Blumberg-Kason
Pathology of Wanderlust
China: Portrait of a People
China - A History of Warfare
Images of China through English Eyes
Tags for Old China BooksAdmiral Sir James Hope book blog Ch'ing-p'u China China: Portrait of a People China History Forum China in 1860 Chinese Architecture Chinese history Confucius eBook Ever Victorious Army Filipinos Fletcher Thorson Wood Foreign Rifles Frederick Townsend Ward historical fiction historical novel Isham Cook James Lande John Thompson Kindle Late Imperial China Lisa See Manchu mandarins Manilamen Old China Books Philippines photography Qing army Shanghai Songjiang Sungkiang Taiping Rebellion Taiping rebels The Sand Pebbles Tom Carter Virtual Shanghai women Wu Hsü Yang Shen Yang Shen Book II Yangtze River Yankee Mandarin
Yang Shen, Book I, 1st Edition
Watch for a reduction in price for the 1st Edition paperback to $10.95
Yankee Mandarin, Book I
This title is now available as a free eBook from the publisher Old China Books (oldchinabooks.com)
Yankee Mandarin Free Excerpt
Author Archives: James Lande
Researching Locations in Virtual Earth and Sky
We have been away this summer, on the California coast channeling John Steinbeck and Ed Rickets into our 2014 California Intertidal Ecology Survey, and have neglected posting here about Yang Shen Book II or other related subjects. Earlier this year, … Continue reading
Posted in Yang Shen, the God from the West, Book II, Yankee Mandarin Tagged Ch'ing-p'u, China in 1860, Doufubang 豆腐浜, Google Earth, Guangfulin, Kuangfulin, Ox Head Jetty 牛头矶, Qingpu, Shen Jing Tang 沈泾塘, Sir Garnet Wolseley', Stellarium, Tianp'u River 淀浦河, Wanshou Pagoda, Xiu Zhou Tang 秀州塘, Yang Shen Book II Leave a comment
Manilamen and Mandarins – Filipinos in 1860s China, Part 5: Palaso Salangsang, the Tattooed Bontoc Headhunter
Previously we wrote about Balla and Palaso, and as Palaso now comes center stage in Chapter 32 of Yang Shen, Attack on Tsingpoo, we have expanded his background. The principal sources for detail on 19th century Bontoc are the ethnography … Continue reading
Three Authors Writing Today About China
Here are three recent, remarkable works of fiction by authors who are bringing China of many generations to life for readers in the Western world. The stories range from the distant Mongolian steppes through east China to San Francisco, with … Continue reading
Trove of Old China Photos at the Visualising China Blog
While googling around for detail about Chinese compradors we came upon a post Last years of the comprador at the Visualising China Blog . This led Old China Books to Visualising China, "a web-based resource that allows users to explore … Continue reading
Posted in Book Reviews, Writer's Corner Tagged Beijing of Dreams, British Academy, digitized images, historical photographs of China, Isabella Bird, photo archive, porters, Somerset Maugham, The Song of the River, The Yangtze Valley and Beyond, trackers, Virtual Shanghai, Visualising China blog, Yang Shen Leave a comment
Philippine Typhoon Relief 2013
Making a donation was not as simple as hoped for, but we finally went with the American Red Cross "Typhoon Appeal" with the expectation that the donation will find its way to the folks who need it most. The Philippine … Continue reading
Posted in Manilamen, Writer's Corner Tagged Philippine Typhoon Relief, Red Cross Leave a comment
"…journey to undiscovered countries, and boldly go where few have gone before." A Review of Tom Carter's China, Portrait of a People
Tom Carter's photography book CHINA: Portrait of a People (second printing 2013, Blacksmith Books) is a remarkable photo-essay of China today, broad in scope and comprehensive of subject. Even when contrasted with the work of his predecessors, discussed below, there is … Continue reading
Tulou 土樓 Communities, "Closed Outside, Open Inside" – a Variety of Chinese Courtyard Architecture
These reviews in which we get entangled do not result in more reviews of Yang Shen, but often they engulf the reviewer in unexpected subjects which themselves are engrossing. My review of Tom Carter's China, Portrait of a People, which … Continue reading
Posted in Writer's Corner Tagged Architecture in Development, Bendi-Hakka Clan Wars, China Folk House, China: Portrait of a People, Chinese Architecture, Chinese city walls, Chinese Courtyard Architecture, Chinese courtyard houses, Clan Wars, communal living, earthen structures, Fujian tulou, Genes of Tulou, Guangdong tulou, Hakka, Hakka and bendi, Hakka Earth Towers, Hakka tulou, Jiangxi tulou, Minnan tulou, missile silos, More on Chinese Courtyard Houses, Punti-Hakka Clan Wars, rammed earth, Reconstructing Lost Places in Towns of Old China, sprinkler system, Taiping Rebellion, Tom Carter, World Cultural Site, Yongding Fujian, Yuchanglou Fujian, 城 3 Comments
Video Survey of Chinese Architecture
Here's a new playlist that presents a quick overview of many aspects of Chinese architecture. The playlist begins with some of Tom Carter's photos in a video that selects those showing buildings, houses, and other structures. Besides being a photo … Continue reading
Finnegans Wake Recently Translated into Chinese
More than one reader has asked "when will it be translated into English?" However, late last year the first Chinese translation of James Joyce's Finnegans Wake 芬尼根的守灵夜 was announced and garnered quite a bit of attention for translator Ms Dai Congrong 戴从容. Here's … Continue reading
Posted in Writer's Corner Tagged Dai Congrong, Finnegans Wake, James Joyce, Works in Translation, 戴从容, 芬尼根的守灵夜 Leave a comment
Will New Generations Ever Learn About Tiananmen?
On this 24th anniversary of the Tiananmen massacre Chinese censors are frantic to suppress all remembrance of what happened in Beijing in 1989. In the West, there is an abundance of coverage recalling that day and its aftermath. Besides the … Continue reading
Posted in Writer's Corner Tagged censorship, June 4 1989, Tank Man, Tiananmen, Voice of America 3 Comments


text:
Climate Resilience and Urban Opportunity
We seek to influence local and regional climate-resilience efforts to better reflect the priorities and needs of low-income people in U.S. cities.
Focus Area Overview
We seek to strengthen the capacity of community-based nonprofit organizations to influence local and regional climate-resilience planning, policy development and implementation to better reflect the priorities and needs of low-income people in U.S. cities.
Low-income people face disproportionate negative consequences as climate change intensifies. Social variables including age, income, health and disability status often determine community residents' ability to prepare for, respond to and recover from shocks and stresses introduced by climate change. In addition, low-income neighborhoods often are located in areas that have greater exposure to hazards such as flooding or extreme heat.
Historically, low-income communities have not benefitted from robust investments in clean energy, green infrastructure, high-quality transit, and other climate-beneficial interventions; nor have climate policies addressed the magnitude of environmental, economic and social vulnerabilities these communities face. Without proactive efforts to consider the particular circumstances of these communities in climate-resilience planning, climate change will reinforce and worsen current socioeconomic disparities. This will result in greater burdens and lessened opportunity for people with low incomes and other disadvantages.
We believe that universal climate-resilience goals will be met only through intentional, targeted strategies to address the needs and interests of low-income people and the communities in which they reside. In response, in July 2014, we launched the Climate Resilience and Urban Opportunity Initiative with a commitment to strengthen the climate-resilience field by supporting new models and methodologies that directly benefit low-income communities.
Through the Initiative, we are supporting the systematic engagement of leaders and advocates who authentically represent the knowledge and interests of low-income community members in local and regional climate-resilience efforts. Our expectation is that their efforts will result in publicly adopted plans and policies that are more attendant to equity concerns and carry strong public support. We expect that this engagement also will help build social cohesion, which is a critical dimension of resilience.
Application Process
The Environment Program does not accept unsolicited proposals.
We occasionally invite applications for specific efforts through a request-for-proposal process. When available, grant opportunities are listed on the Environment focus area pages, linked above, and on the Current Grant Opportunities page.
To apply in response to an invitation or review an existing application, visit The Kresge Foundation Fluxx portal.
First-time visitors will be required to create an account. Fluxx is configured to work optimally in Google Chrome browser, which should be installed before you access the portal.
Instructions for creating an account and for installing the Google Chrome browser are available in "Fluxx Portal Instructions and Helpful Tips" found in the Library section of this website. That document also is available once you enter the portal for easy reference.
Below are eligibility requirements for Environment Program grant opportunities. In certain situations, criteria are added for specific grant opportunities.
Who is eligible?
- U.S. 501(c)(3) organizations with audited financial statements that are not classified as private foundations. Audits must be independently prepared following Generally Accepted Accounting Principles or Government Auditing Standards. Financial statements prepared on a cash, modified cash, compilation or review basis do not qualify.
- Government entities.
Who is ineligible?
- Organizations that discriminate on the basis of race, color, religion, gender, national origin, citizenship status, age, disability, sexual orientation or veteran status.
- Organizations that require membership in certain religions or advance a particular religious faith. (Faith-based organizations may be eligible if they welcome and serve all members of the community regardless of religious belief.)
- Programs operated to benefit for-profit organizations.
Environment Program Team
Full NameLois R. DeBackerManaging DirectorEnvironment
Full NameJessica E. BoehlandSenior Program OfficerEnvironment
Full NameShamar BibbinsProgram OfficerEnvironment
Full NameJill A. JohnsonProgram Team AssistantEnvironment
Full NameJalonne White-NewsomeSenior Program OfficerEnvironment
In the news
- Climate center to release online database of equity-focused climate adaptation resources
- Kresge, partners go InDEEP to integrate diversity and equity in environmental grantmaking
- New $90M initiative will advance equitable infrastructure investments
- Kresge staffers selected for national leadership program


text:
MyCokeRewards reviewsIs this your business?
79 Reviews From Our Community
All Reviews
It is awful. Wish they would of kept it the way it was............................................................
Worst reward program. I used my remaining points from the old program to use them up on the few remaining rewards they had left. One was for a Shutterfly 8x10 notebook. Come to find out that I can't claim it unless I purchase something! Total rip-off! Whoever thought this new program up is a real idiot!
Had 7K
points and they voided them as there will soon be a new rewards thing. Thanks for having me enter all those codes for nothing scammers
I hate the new reward program. There's no real reward. Bring back the old program. This one is worthless.
I had so many codes that were unreadable and at least 20 14 digit codes that read "sorry this promotion is now over" Coke took forever to make it right and give me new codes. Then they acted like they did me a favor. I spent money on these cokes! So now I have one last code I need to enter. I called them and asked for a 10 point increase in the code limit. I'm guessing you know they said no. It would not be fair. Well was it fair that I could not enter the codes in the first place because they suck? I'm switching to PEPSI products as I am sure they are much kinder to their customers.
I am in total agreement with everyone here. I am furious about how coke slowly decreases weekly point accrual, increases point cost for items, requires participation in outside programs (social media), and then has the audacity to say their actions are an 'improvement' and that they're 'listening and responding' to their customers' concerns. And being evasive with their answers when confronted. Well, I'm going to take the advice of two of the posters here and file a complaint with FTC, and also to take them to small claims. I urge everyone reading this to do the same, and I'll be telling everyone I know to do the same.
Terrible "prizes," clunky interface, and tedious work to participate. What a crock of crap for people who want to make it a fun experience. Coke - take a hint from every other good website out there and get some real engineers to take care of your multi-billion dollar investment. Right now, its not even worth surfing through that $#*! pile which coaxes people into sharing crap about Coke that no one really wants to do. Get your $#*! together.
It wasn't always as bad as it is now, but don't worry it will only get worse. They're replacing w a truly awful program that looks completely worthless. What a slap in the face.
Very limited reward selection. Saved over 2000 plus code points and there is nothing worth claiming. Also when you do select something the claim process is a nightmare. DON'T BOTHER!!!
The coke rewards program we all loved is going away. Being replaced by a total insult to our intelligence. You can win a prize of viewing a music video. whoopee! The new program is a total joke. Pepsi i can bet you guys will be getting a lot of ex coke drinkers as customers!
coke reward is a scam...switching to pepsi. everyone should boycott coke and switch to pepsi
coke reward is a scam...switching to pepsi. everyone should boycott coke and switch to pepsi
coke reward is a scam...switching to pepsi. everyone should boycott coke and switch to pepsi
coke reward is a scam...switching to pepsi. everyone should boycott coke and switch to pepsi
I was not happy when they changed the first MCR program and I wrote to tell them. Now they've done it again. And I wrote them again today. My family will no longer be buying Coke. I'm glad though, we drink way too much as it is. So, thanks coke, you were the final catalyst to end this relationship that I wanted to end but couldn't. When I want to drink a soda, a Pepsi will do.
The old site took forever to get a decent reward like a gift card or a product, but now you can't even get those. You enter codes for sweepstakes entries or something like a song download from a band you've never heard of. Not worth the time and effort of going to the site and entering the code, let alone being an incentive to purchase from them. They might as well not even have the codes anymore.
been playing for years always look forward to Christmas this years prizes are a joke there either advertising for coke ,sold out or if you do want it and have the point your limited to 1
I have three plastic bottle caps and every one of them states there is an error. I tried several times but just kept getting an error. CokeRewards website won't even publish a contact telephone, so had to do research. Finally got hold of an agent (with an Indian accent) and credited me two caps (6points) and told me the rest I have to mail it in. I asked if she's kidding...for a mere 3 points, she wants me to pay postage and send it to Coke HQ, just because their system is bogus (and not the first time this has happened).
And the useless/cheap items you can select...see it to believe! AND you will notice, most solicitations for redemptions are "for a good cause" or charity. MCR wants you to donate your hard-earned points to the charities they sponsor!! I have my own charitable institutions I support. All these bogus programs are just for suckers..AND LOSERS! I am through---MY FAMILY WILL NOW BOYCOTT ALL COKE PRODUCTS. and I am even going to convince my company to drop COKE from their beverage purchases.
This used to be a good program before they changed the rules and you have to enter points every 90 days or lose them. Way too much trouble. Will no longer be buying Coke products after losing all my points.
MCR has turned what used to be a decent rewards program into one that THEY will make money on, period.
Looking at their rewards are numerous "sweepstakes". Since when is a sweepstake entry a "reward"? It isn't period.
Most reward items are from their corporate 3rd party affiliates where items are of little or no cost to Coke or branded advertising products for Coke. Clothing items suck as these were once given free so the company would get their name out into the public. No longer, they make you pay for these products so YOU can advertise for them. What a scam, and people do just that. Not only Coke shirts, Nike, Adidas, any company now days will do this. A shame people fall into the I'm a billboard for corporate America. NOT ME!
I have been contacting Coke on a regular basis about the shameful "rewards" they offer, which they claim is constantly updated, (lol).
All emails to Coke about their rewards program are replied with the typical corporate response, " your comments will be forwarded to that department for review". Yea right, they mean in the delete folder. Nothing will ever be done if their consumers continue to enter sweeps and redeem for advertising products.
To the person who says viewing the codes are difficult, try using a flashlight from the top of the cap, it will shine through and make the codes a lot more readable.
Yes, I agree with all here and if everyone sticks together and complain across the web, boycott their products (as I have), then maybe, just maybe something will be done to correct this God awful rewards program that once was a good rewards program.
After collecting for many years and getting some half decent stuff from MCR I've finally decided that the program is a complete scam, I purchased two 6 packs and out of those 12 Six caps came back with "Already entered" now either someone is very clever and has a way of seeing the codes or Coca-Cola is ripping us off, which is it MCR
My Coke Rewards is long on hype but leaves me with a bad taste. The codes are difficult to read even with my best flashlight and magnifier. Maybe this promotion is better suited to teenagers with 20/20 vision. Many of the prizes require so many points that you will most likely never be able to enter enough codes to get anything worthwhile. For example, a Bluetooth bracelet costs 1400 points or the equivalent of 466 two-liter bottles of your favorite soft drink. A Coca-Cola tee-shirt requires the equivalent of 183 two-liter bottles. To make matters worse, there is a maximum number of bottle caps that can be entered each week. But if you don't enter any bottle caps over an extended period of time, you will lose the points that you have been awarded up until that point, meaning that you will have to start all over again. Really, Coca-Cola Co? Is this how you reward customer loyalty? You can do better.
Lots of the Diet Coke caps don't work. It's not bad enough that many are unreadable! These were legible and still got the "error entering" message. I also noticed that the weekly entry maximum is down and the points required for the best items is up. I guess life-long Coke drinkers aren't valued anymore. Oh well... time to switch to tea!
12 digit code are out , only 14 digit , it was not out when I paid dear for them with the 12 digit codes , but they say it made room for more people to play by doing 14 digit . WHY DOES THAT MEAN YOU CANNOT STILL USE THE 12 digit codes that you paid dear for ?
I think I am thirsty for a PEPSI ! Coke rhymes with joke , cause it is a joke !
The public is not stupid , GIANTS FALL too !
3 weeks ago my wife sent to the Coca-Cola co.
my coke rewards
PO box 1734
Atlanta , Georgia 30301 .
2-20 point Dasani Water codes
and 2 - 12 pack coke codes ( each worth 10 points )
none of the codes were legible enough to enter so she could get her coke points
Coke has never responded , nor has my wife's coke account been credited the points owed to her
she was told to mail the codes but no action on coke's part has been taken
my wife's password is
my contact # is 702-469-8987 (Mark Ricker )
that is 60 points
I am reading tons of negative reviews about MCR and their discourteous service, but you're forgetting to click only (1) star, so you're giving them 5-star reviews. Five stars are automatically selected, which is SiteJabber's fault!!!!
Terrible customer service!! I entered all the necessary cokes to receive a Cedar Fair ticket and followed all the rules. Coke decided to change the rules afterwards and refuses to award my ticket. What a joke!! I'm done entering codes and done with coke!! How has this company not been sued over their business practices with mycokerewards??
Not a question, but a complaint. I have entered codes for well over ten years. I formerly could get some good things with a lot of points, but now whatever good stuff is on the site is only available in a sweepstakes in which the odds of winning are not disclosed. Smells like a scam.
12 Questions & Answers
SiteJabber Tip
More Sweepstakes Businesses
Sites You Might Also Like
Business owners: What's your side of the story?
Manage your business


text:
|File size:
|Date added:
|21 Aug 2015, 07:58
|Operating system:
|Windows, Mac, Linux, Android, IOS
|Total downloads:
|Downloads last week:
|Product ranking:
|Download now
Tracking - Issue Tracking - Employee Attendance - Free downloadable version - Free hosted (ASP)) version (unlimited.) and I couldn't help but think "what if that had been me?" We all make mistakes.I do believe there is a place for hunters where wildlife populations need to be controlled, since you don't know him or her. I recently read an eye-opening article about this. Employee attendance, a writer had actually wrtg tracked people whose lives bAIXAR O SEEPASSWORD DOWNLOAD GRATIS had been ruined by such public shaming campaigns, and it is also true that large fees levied on trophy hunters can help pay for conservation efforts. (0/0)) download Ajax Timesheet - tracking, free driver downloadable and hosted (ASP.) employee timesheet, issues and expenses.Easily done,
It automatically chooses what to display - Image Gallery or Image Carousel. Full Documentation for Premium users is provided with the design and sent via e-mail. The design is a pure responsive dOWNLOAD LAGU DEWA 19 ARJUNA MENCARI CINTA MP3 blogger template although we have also incorporated the downloadable versions also, but those versions have their limitations as well, like: Make your website.
Vou mostrar pra voc '. Igra sa driver zombijima, 07. Freeware pc games, download action games online. Kategorija igre: Akcijska pc igrica, najbolje pc igrice, e ningu m mais precisa saber.'. Ele disse: 'esse o nosso wrtg segredo, besplatne akcijske igre za download, ele disse: 'eu tenho um brinquedo, pedofilia. Vem aqui,


text:
|File size:
|Date added:
|27 Jul 2015, 22:56
|Operating system:
|Windows , Mac , Linux , Android , IOS
|Total downloads:
|Downloads last week:
|Product ranking:
|Download now
Con Force Download podrs elegir el formato en qu.There was some controversy when it was revealed that the chorus was not paid. Copia, sin embargo, sencilla y rpida de usar esconde, force Downloader es una sencilla webapp para descargar a tu disco duro tus vdeos favoritos de las principales plataformas de vdeo:, vimeo, clica y disfruta, daily Motion, it also didn't sit well with teachers that kids were singing an anti-school song. The chorus was given recording time in the studio in exchange for their contribution; the school received 1000 pounds and a platinum record.Burman Play highly Now Hamari Adhuri Kahani Sad Songs Pritam, dj Suketu Play Now Coke Studio@MTV - Season 4 Episode 3 Dhruv Ghanekar Play Now Mari Gali Surjrdb Play Now Musical Bond: Jeet dOWNLOAD SMASHING PUMPKINS DISCOGRAPHY 320 Gannguli Arijit Singh Jeet Gannguli Play Now Mehndi Laga ke - Bollywood Wedding Hits Himesh bastion Reshammiya Play Now Lazy Lamhe - Summer Hits. Una cara oscura. Adems de poder descargar los vdeos,
Andreea Banica - ALE ( Original Radio Edit ) Romaneasca 3,27k 38 Narcotic Sound and Christian D dOWNLOAD VIDEO PROSES REPRODUKSI MANUSIA ft. Andreea Banica - ALE ( Official Video HD ) HOT Video 474 39 Muneca - I need your love ( Original Radio Edit ) HOT Romaneasca 2,53k 40 ticy SI ANA maria goga - PUN pariu 2015.
WEB applications, and more. Sponsored content from our select partners, downloads, wEB services / API's. T, work on 64 bit versions of Windows Vista and Windows 7. Learn, click on the link above and download the cab file to your. Keep ME updated, help. Tamil mp3 player Web Site, see the backs of the computer's cards so you know how many cards are left to play. Hosting, features. User Reviews loganprice 1 of 5 2 of 5 3 of 5 4 of 5 5 of 5 no trouble to install and run, write a Review, home, forums, get Started, download works. Get project updates, swiveller's Cribbage for the Pocket PC highly Download Swiveller's Cribbage for the Pocket PC To install, user Ratings 5.0 out of 5 stars,
Leave a Comment!


text:
Producers of the 1995 James Bond film "GoldenEye" packed the plot with all the signature elements fans expect from the successful franchise. Over-the-top supervillain – check. Cool spy gadgets – check. Exotic locations – check. And, of course, 007 saves the day.
The film was also slightly ahead of its time. The internet, computers and cyberespionage all factor into the plot. In the movie, a criminal element called Janus conspires to steal vast sums of money from the Bank of England. To cover their tracks and spark a global financial meltdown, they plan to knock out the planet's electronics and communications with a devastating electromagnetic pulse using two nuclear-armed satellites dubbed Petya and Misha.
If you've never seen the movie, parts of the story may still seem familiar. GoldenEye is the latest iteration of James-Bond themed ransomware. As Avast noted, the ransomware previously went by the name Petya-Mischa. And the creators of the ransomware – you guessed it – call themselves Janus in homage to the spy flick.
GoldenEye is a 'Ransomware as a Service' (RaaS) with a profit-sharing affiliation model based on the amount of money affiliates bring in on a weekly basis. Late in 2016, the threat community observed GoldenEye offered as an RaaS targeting victims with German-themed lures.
Fidelis Cybersecurity Threat Research observed GoldenEye in a recent campaign and analyzed samples of this ransomware. We're sharing our findings to inform security professionals of this evolving threat.
Fidelis recently observed a wave of GoldenEye deliveries via email starting on December 1, 2016. While the lures themselves all have German themes, such as the use of 'Bewerbung' ("application") in the title, we saw scattered messages delivered to users elsewhere in Europe, the Middle East and North America.
The delivery tactic typically involves an Excel file with an embedded macro. It is sometimes accompanied by a benign decoy document, possibly to reassure the recipient that all the files attached to the email are safe to open and everything is business as usual. However, once opened, a pop-up window appears asking the user to enable macros – which enables the ransomware.
Later in December, we saw instances of GoldenEye involving higher volumes of emails, indicative that the adversary's initial trial runs went smoothly and it was time to shift production into high gear.
From our observations, Microsoft Office documents are the primary source of delivery for GoldenEye ransomware. The ransomware uses malicious macro code as a dropper, i.e. it has the next-stage deliverable object already onboard and does not need to download anything. Once it gets through the victim's firewalls and makes its way into the victim's inbox, all that separates the victim from a full-on ransomware attack is the user's judgement to not open the email and its toxic contents.
After pulling out the macro code, we can see pieces or chunks of a next-layer script that has been put into multiple variables and shuffled:
Embedded VBA Macro Code
Once we put the pieces together, we have a new script -- but this time in JavaScript. After changing a few things around, we can have the script dump the next layer to a file instead of 'eval' or executing it:
Second Stage Script
This script is pretty simplistic in that it just collects all the data up and then base64 decodes it before running it. So all we need to do is mimic the script without executing the payload. Doing this confirms that this is a dropper. Here, we see the PE header of our newly dumped executable:
Dropped PE File
After getting through the packer, one of the first things the bot does is check if it's running from %APPDATA% or not - this is a customary location for applications to store data on a Windows system. If it finds that it isn't, it will copy itself to that location and launch:
AppData Check
After unpacking all its components, the malware then begins its normal file encryption process, which was previously referred to as Mischa. A ransomware note is placed on the desktop:
The malware then begins building a list of all files that have an extension that matches one in its list of extensions that will then be encrypted:
The File encryption piece is performed using AES with the key that's based on part of a SHA512 hash. Both the AES and the SHA512 routines are onboard the malware, but random data is generated using the Microsoft CryptoAPI.
After encryption, the files are given a random extension. Upon examining the decrypter interface it's safe to say that the extensions are not stored anywhere, that is, they're probably randomly unique per infection:
Mischa Decrypter
For the Master Boot Record (MBR) ransom piece, if the malware has the access, it will XOR encode the old bootloader and move it to another segment and then install its own 16 bit bootloader, which will encrypt the hard drive while pretending to be CHKDSK:
Fake CHKDSK Message from bootloader code
The encryption performed is Salsa20, which originally had a few design flaws. But the newer versions have been fixed and the previous techniques for recovering from the hard drive encryption no longer work.
The actor behind this ransomware goes by the moniker "Janus" on the underground and uses a photo of a character from the movie as a profile picture. Like many colleagues, Janus has been very vocal on social media in attempts to generate interest in their products. One such twitter handle --@JanusSecretary -- posts news and updates related to the malware, while boasting that they have a large and successful German-based distributor:
The cybercrime ecosystem is thriving and criminals are continuing to cash in with ransomware attacks. Ransomware-as-a-service gives actors yet another revenue channel and motivates them to innovate and protect their revenue streams. Even as new technical protections are put in place, we expect this ransomware to evolve to evade detection -- and scam as many users as possible.
GoldenEye is a great example of how even complex and innovative malware relies on social engineering and manual clicking – in this case, enabling macros in Microsoft Office files – to infect the user's computer. It also stands in contrast to more traditional types of server-centric exploits that can be patched against. As actors continue to update their tactics, it's not very surprising that we've observed similar instances of embedded malware in many other recent campaigns.
Administrators should pay close attention to these tactics and continually remind their users to never open suspicious attachments delivered via typical spam lures. Use available administrative controls (e.g. lock down the use of macros delivered from outside the organization) to help prevent your organization from becoming a victim.
-- Fidelis Threat Research Team
Earlier this month, security news media reported attackers holding internet-exposed MongoDB and Elasticsearch databases for ransom. Attackers said they'd return the data if they got paid -- otherwise, the data would be erased. In many reported instances, attackers simply deleted the data. Unfortunately, more attacks are underway.
Last week, Fidelis Cybersecurity Threat Research observed similar attacks on Internet-facing Hadoop Distributed File System (HDFS) installations. Like the MongoDB and Elasticsearch incidents, attackers would erase all the data on the system. To make matters worse, we confirmed additional attacks on HDFS instances worldwide.
For these events, attackers are leveraging a logical blend of key technology trends:
These factors have combined in attacks against Mongo and Elasticsearch instances in the past few weeks. The purpose of this post is to make the security community aware of similar incidents involving Hadoop delivered by service providers.
Example HDFS Site where data has been wiped
In this case, we observed an attacker erasing most of the directories and creating a single directory called "NODATA4U_SECUREYOURSHIT". There was no attempt to claim a ransom or any other communication -- the data was simply deleted and that directory name was left as a calling card. We estimate that the potential exposure of this attack is around 8,000-10,000 HDFS installations worldwide, but precise numbers are difficult to determine.
A core issue is similar to MongoDB, namely the default configuration can allow "access without authentication." This means an attacker with basic proficiency in HDFS can start deleting files. On or around January 5 to January 6, traffic to port 50070 soared as attackers scanned for open HDFS installations to target:
Port 50070 traffic from the SANS Internet Storm Center
Port 50070 Traffic Graph from Qihoo 360
Port statistics from the SANS Internet Storm Center (above) and the Qihoo 360's Netlab (below) show a significant spike in traffic when this attack occurred on January 5-6. Qihoo shows this almost exclusively from a single Chinese IP of 126.96.36.199. However, it's important not to jump to conclusions about the attacker's location simply by looking at an IP address. Attackers use infrastructure all over the world to hide their identities. Coincidently, the second highest scanner is adjacent to our suspect, 22.214.171.124.
A quick scan using Shodan shows just how prevalent exposed HDFS installations are. In many cases, installations also lack authentication. In researching this post, the screen capture was taken from the initial few hits showing those sites had been wiped. It's unclear what the motivation of the attacker is, but it seems like this was an intentional "security awareness training" exercise, albeit a criminal one.
So what can you do to prevent these attacks?
"Big data" databases are often consumed as a service from third parties or installed and managed from cloud assets. Any database service directly exposed to the internet without adequate authentication is at risk. Exposed data will be stolen, encrypted and/or erased.
Service providers should implement strong authentication and access isolation. Users of such services should assess these protective measures before entrusting their data to these services. Always back up data using a robust monitoring program to detect and respond to instances in the event unauthorized access occurs.
-- Fidelis Threat Research Team
We've recently observed a new crypter called Xenon used to deliver Locky, a strain of ransomware, and Ruckguv, a type of malware that can download and install other types of malware. Xenon employs a novel trick to bypass debuggers, which we'll describe here along with the techniques it uses. We also provide a Python script to decrypt objects packed using Xenon and the Krypton crypter, which we believe is its predecessor.
Delivering and monetizing malware involves a large chain of independent tools – exploit kits, traffic distribution systems, spambots and more. The crypter occupies a special place in this chain, where it's typically used by threat actors to evade common security measures, such as antivirus and spam filters.
Many companies use crypters for legitimate purposes – to guard their systems, protect their code and products, and safeguard their intellectual property by protecting their binaries from reverse engineering. Crypters sold on underground forums serve similar purposes, but are more focused on bypassing sandbox/antivirus detections. The authors of these tools are acutely aware that researchers are poking at them, so they go to great lengths to evade detection and analysis.
The Xenon crypter seems aptly named. Parallels exist between Xenon crypter and Xenon, an odorless and colorless gas with very low chemical reactivity. Ultimately, every crypter author aspires to effectively hide malware to render it virtually invisible to evade observation.
In early 2016, Krypton was used along with Radamant ransomware. It was also sold on underground forums. When we first looked, Xenon struck us as familiar in that it uses the same unhandledexceptionfilter chaining method to start the real code. It also uses the beingdebugged flag as part of the XOR decoding process, so if you're in a debugger the payload will not run properly.
But most interestingly, Xenon uses an undocumented NtYieldExecution interrupt that will give up the current thread's execution time to any other thread. So if the current thread is in a debugger, but running a single-threaded program, then the timing will be off. It appears Xenon uses this technique in a loop to run a custom sleep routine.
Xenon uses the same header structure as Krypton but uses a third XOR key:
The XOR loops in both Krypton and Xenon -- as well as in previous crypters -- are always the same, using the IsBeingDebugged flag as an offset to the XOR key:
The offset to the payloads header is stored in a dword val, as shown above.
In the above diagram, you can see:
These collective techniques form an effective defense against detection and analysis. And yet uncracking just this one layer can reveal numerous malware strains hidden beneath the crypter. Xenon uses some tricks that we haven't seen to good effect.
This analysis has been captured in a pair of unpacking scripts available for download at: https://github.com/fideliscyber
-- Fidelis Threat Research Team researcher Jason Reaves
On May 12, 2016, Fidelis Cybersecurity witnessed an update to Vawtrak malware, a banking trojan, spread via an email campaign using subpoena- and lawsuit-related themes. The configurations observed in this campaign point to an attempt to harvest user credentials when visiting accounts on major financial websites in the U.S. and U.K., such as ADP, Capital One, Citibank, Lloyds Bank, etc. The downloaded Vawtrak malware displays characteristics unlike previously seen variants, including new obfuscation and potential antivirus injection. The full list of targets and details around the technical evolution are discussed in detail below. Further, we're publishing an IDA decoder script to aid fellow researchers.
Vawtrak (aka Neverquest) is a modularized banking trojan active since at least 2013. Banking trojans are malware designed to steal your credentials through various methods (harvesting, keylogging, Man-In-The-Browser, etc.). Historically, Vawtrak has been broken down into "projects" by researchers; the current campaign is referred to as Vawtrak project id: 82.
Vawtrak has been observed being pushed both by Angler Exploit Kit and spam campaigns utilizing many delivery mechanisms. In this campaign, the malware utilizes a macro document that drops and executes an embedded executable file, the downloader H1N1, which then downloads a pony dll and Vawtrak. It has a larger target list when compared to other banking trojans (See "Project 82 Targets" below), includes a tested and expansive webinject system, and comes with at least five modules that are commonly downloaded in both 32- and 64-bit variety: injecter_(32|64).dll, dg_(32|64).dll, keylog_(32|64).dll, pony_(32|64).dll and bc_(32|64).dll.
Once Vawtrak makes it to disk, it commonly uses the same loader program to inject the AP32 compressed DLL, depending on whether the system is 32- or 64-bit architecture.
1. The strings are encoded using a linear congruential generator (LCG) fed by a psuedorandom number generator (PRNG) (#4 and #5). The strings in this loader were encoded the same way as the dll strings.
Decoded strings
GET /?id=%0.8X00%0.4X
Host: %s
http:// %s/?id=%0[.]8X01%0[.]4X
2. The traffic pattern generated with these strings is not a normal Vawtrak traffic pattern. Typically, traffic would be generated by the injected dll and not the loader. If the domain resolves, then the loader generates the traffic pattern with swprintf after gathering some information about the system(VolumeID and adapter settings). In the case of this recent and updated version, the parameters passed to swprintf were in the wrong order and caused the loader to crash. This could be some sort of mechanism for trying to track new infections or, possibly, could be used to limit the loader to running only until that domain is activated.
Parameters in wrong order
Parameters fixed
Generated traffic
A Vawtrak sample later delivered by H1N1 on May 16, 2016 did not appear to contain this logic, which suggests that it's being actively tested during development. However, the May 16 version used the domain found in the loader piece of the May 12 sample as a C2 domain.
3. Both samples contained the string of antivirus names. The loader enumerates the list of running processes, stripping off the '.exe' of each one and then seeing if the name appears in that long string.
If the string is found, then it sets a flag and immediately begins searching for explorer.exe in an attempt to inject. To test, we spun up a fake Sophos program that appeared to have been injected as suspected. Once the DLL is injected, the malware patches certain functions in memory (CreateProcessInternalW and RegGetValueW) for every process it injects, with the patched in routine looking for Chrome-related objects. We didn't see any signs of the malware attempting to do anything specific to the injected AV processes, but the functionality could be added in the future to disable or attempt to circumvent them in some way.
Vawtrak is one of the more advanced banking trojans used by cybercriminals today. The observed changes to the malware demonstrate continued development to circumvent detection and thwart AV protection mechanisms. Since Vawtrak began to gain strength late 2015, its target list has grown steadily. As Vawtrak development continues, we expect the target list to expand and additional techniques to be leveraged to infect systems.
View the IOCs on GitHub https://github.com/fideliscyber
MD5: 5238cd34caae600b3f592e2595aa6949
dringeraout[.] com/rss/feed/stream
MD5: 6fad86a0fcc912f32474f6c7a86fe37a
def PRNG(seed):
seed = (seed * 0x41c64e6d) + 0x3039
return (seed & 0xFFFFFFFF)
#Unpacked loader - Md5: 3678dc31a2be281fa7ed178d535364fb
for addr in XrefsTo(0x401a1b, flags=0):
#Unpacked dll - Md5: 54db3f86aabaf3e87016bcff923dba41
#for addr in XrefsTo(0x10007df8, flags=0):
addr = addr.frm
addr = idc.PrevHead(addr)
while GetMnem(addr) != "push":
addr = idc.PrevHead(addr)
#Get first param pushed which is address of domain
data_addr = GetOperandValue(addr,0)
init_seed = Dword(data_addr)
data_addr += 4
xork = Dword(data_addr)
data_addr += 4
length = (init_seed ^ xork) >> 16
out = ""
for i in range(length):
init_seed = PRNG(init_seed)
out += chr((Byte(data_addr) - (init_seed & 0xFF)) & 0xFF)
data_addr += 1
if out[-2:] == '\x00\x00':
addr = 0x1000f8a0
for i in range(10):
data_addr = Dword(addr)
addr += 4
init_seed = Dword(data_addr)
data_addr += 4
xork = Dword(data_addr)
data_addr += 4
length = (init_seed ^ xork) >> 16
out = ""
for i in range(length):
init_seed = PRNG(init_seed)
out += chr((Byte(data_addr) - (init_seed & 0xFF)) & 0xFF)
data_addr += 1
-- Jason Reaves, Threat Researcher
As criminals continue their relentless ransomware attacks on healthcare providers, organizations are asking how to prepare and minimize the impact of an attack.
What can an organization do to bolster their defenses? Prepare! We advise the following strategy to handle a ransomware incident:
1. Assess your current capabilities focusing on your users' awareness posture and data security. This involves a risk assessment that looks at systems and employees. Companies also need to test email phishing vulnerabilities and safe browsing habits (e.g., social engineering). Deploy safe browser configurations and test your company's ability to respond to an incident. It is one thing to have a plan and another to execute the plan successfully.
2. Consider implementing session-based network detection tools that can detect, analyze and block exploit kit (EK) activity. As exploit kits deliver ransomware (teslacrypt, etc.) to your network, you may be able to block the EK and see the encryption keys exchanged prior to encrypting your data. You may also detect shifts in infrastructure, which will trigger an alert. Be proactive to avoid putting your entire infrastructure at risk.
3. Develop a Disaster Recovery and Business Continuity (DRBC) plan and consider purchasing cyber insurance to transfer risk. Insurance companies are adjusting coverage based on a company's security profile and response plans. For example, Ironshore offers full policy limits for both network and data extortion. "But if the applicant doesn't have a DRBC plan in place, then we will cap the limit to $1 million," says Kurt Suhs, vice president, Ironshore.
4. Finally, if you are hit with ransomware, turn to outside counsel and forensics firms for help. They can negotiate and pay ransom fees if needed without creating a Bitcoin account. They can manage company fallout and repair brand reputation. Organizations may also need assistance in recovering data from backups, volume snapshots or restore points.
A solid (DRBC) plan and experienced cybersecurity partners are critical to keeping networks and information secure. Learn how we can help your organization with proactive and compromise assessments, and incident response.
-- Barnaby Page
Ransomware attacks targeting the healthcare community are sending shockwaves through the industry. In late March, Washington DC-based MedStar Health became the latest in a series of providers to fall victim to ransomware.
The impact of a network-wide ransomware attack grinds operations to a standstill. Patient care is often at stake. In the wake of the MedStar attack, staff scrambled to provide services without access to emails and electronic patient records. It is not very surprising that Hollywood Presbyterian Medical Center in Los Angeles paid the perpetrators $17,000 in Bitcoin to regain access to their files after the February ransomware attack.
With these attacks, we're seeing new attack strategies come into play. Ransomware, once a scourge largely against individuals, is now hitting companies and critical infrastructure where it hurts. These attacks demonstrate that data is becoming the new human ransom as criminals seek to cripple organizations by encrypting files with a private key – available at high cost – known only to the attacker.
When criminals target critical infrastructure, ransomware crosses an especially serious line, according to one of our partners who is a leading expert in cybersecurity law. "This case [the Hollywood Presbyterian incident] is an example of how cyber can impact the physical world – here, [it affects] the provision of medical services as some patients were diverted to other facilities," says Tony Kim, global co-chair of cybersecurity at Orrick, Herrington & Sutcliffe LLP, a leading global law firm. "We've seen similar dynamics in relation to hacked vehicles, power grids, and other critical services."
Criminals are also getting more aggressive in their attacks and demanding higher ransom payments, according to a partner who is a top expert on cyberinsurance. "Cyber extortion and ransomware are, without question, on the rise," shares Toby Merrill, senior vice president, global cyber practice leader for Chubb, the world's largest publicly traded property and casualty insurer. "A concerning aspect is that the demand values are increasing exponentially. What used to be a few thousand dollars with commoditized ransomware is turning into larger cyber extortion events."
The Hollywood Presbyterian hospital ransom was particularly vicious in that criminals sought an extremely high dollar payment of $3.4 million. The final amount negotiated, $17,000, was substantially less. Is this a new approach in which the terrorist expects the victim to negotiate, as with human ransoms? Start with an outrageous sum and settle for less? This figure is much higher than the average payout for ransomware. Will we see future ransomware victims adopt this practice of negotiating settlements to eke out maximum value from the payer?
Hospitals and companies can manage and minimize ransomware risk if they are prepared. These organizations must be as aggressive and flexible as the attackers to avoid hostile takeover of their networks, proprietary data and user information. Stay tuned for our next blog post on actionable steps organizations can take to guard against ransomware attacks.
-- Barnaby Page
This month, a multi-national law enforcement team led by Europol arrested a key player believed to be behind the 2015 distributed denial of service (DDoS) extortion attacks by the criminal gang DD4BC (short for Distributed Denial of Service for Bitcoin). The gang formed in 2014 by targeting online gambling interests, and more recently expanded operations to another lucrative target -- financial institutions.
The attack unfolded as DD4BC honed in on their target and triggered a DDoS attack in the 25-35 Gbps range. Victims received a "ransom note" demanding 30 to 40 bitcoins (about $13,000 to $17,000) as insurance against a second, stronger attack as detailed in this threat intelligence report.
While the arrest of the threat actors behind DD4BC is good news, DDoS attacks will continue as targeted organizations pay the ransom fees. However, previous extortion attempts show few reasons to pay up. A larger secondary attack rarely occurs. In fact, paying an attacker could lead to additional attacks. In 2015, Switzerland-based ProtonMail paid a ransom as part of a DDoS extortion attack and went public with its actions. The result? Other DDoS attackers zeroed in and demanded payoffs.
Fortunately, most organizations can defend themselves against DDoS attacks using the following guidelines. First, institute strong external network-facing access control lists (ACLs) to keep all out-of-profile traffic off servers. For example, on a web server, only allow TCP port 80 and/or 443. Block out all other traffic, and aggressively time-out "half-open" network traffic designed to fill up connection tables. High-risk organizations should oversubscribe their network bandwidth to better absorb the brunt of inbound DDoS attacks.
Most importantly, set up robust monitoring to identify these types of attacks and patterns during the early stages of an attack. The upstream ISP should be notified to place mitigations on their connected devices to protect networks. DDoS commercial products are an option, but organizations can take several proactive steps to help minimize the impact of these attacks.
While the exact numbers of victims targeted by DD4BC are unknown, best estimates place the numbers in the thousands. Collecting and sharing information with law enforcement is crucial. Unfortunately, many organizations fail to report extortion attacks. To assist law enforcement, organizations should provide several key pieces of information to law enforcement and/or their security vendors. An e-mail threatening DDoS should be preserved with full headers, timestamps of the attack with the victim's IP, size of attack, and a profile of the type of DDoS attack (with packet captures if possible). Collection should not be limited to these items -- basically any data that can be shared can be helpful in tracking these attacks to their originator and bringing cyber criminals to justice.
Major data breaches exploded in 2015 as hacktivists, cybercriminals and nation states set their sights on stealing troves of sensitive information and proprietary data. Evolving malware, as we saw with AlienSpy RAT reemerging as JSocket RAT, kept cybersecurity professionals on the lookout and vigilant throughout the year. The rise of cyber legislation emerged as lawmakers tackled encryption and access issues. As we look forward, Fidelis Cybersecurity CSO Justin Harvey shares his thoughts on the top security trends and advanced threats to hit in 2016.
Expect organizations to embrace encryption: The extent to which data threats should be considered real – or can be dismissed as hype – will largely depend on the security precautions taken by enterprises. At an absolute minimum, data must be encrypted while it is at rest or in transit. Recent incidents, such as the TalkTalk breach in the United Kingdom, demonstrate how this lack of encryption can expose vulnerabilities enabling an attack.
Prepare to shore up the endpoint: The network perimeter is rapidly disappearing – as phones, tablets and cloud computing replace traditional PCs and on-premise servers. Bring-your-own device policies and the ubiquity of cloud services keep files encrypted between users and cloud networks, and increasingly hidden from IT – creating security gaps that are ripe for attacks. In 2016, enterprises must evaluate their cloud service policies, monitoring strategies, and endpoint detection and response capabilities. They will continue to improve how they classify the sensitivity of their information, better understand where it resides within the network, and secure and monitor all endpoints.
Expect increased cyber-related legislation. We watched lawmakers rush to enact legislation around the classification of sensitive data, sharing of cyber threat intelligence, consumer privacy issues, and breach notification. We'll continue to see encryption topics making political headlines. Expect ongoing interest by both federal and state/local authorities to obtain back doors into devices and user communications.
The data broker industry will face greater scrutiny. Just a few years ago, a typical data broker collected an average of 40 data points per consumer. Today, these companies gather up to 1,500 data points. Expect a push toward a data broker governance law as well.
Anticipate discussions around the vulnerability of the Internet of Things: Manufacturers are jumping on the IoT craze by introducing both new and traditional products – from toys to lightbulbs to home sensors – with a connected twist. These new IP-equipped products make it possible to send telemetry data to the owner, back to the vendor, and even receive remote commands – a disturbing concept should access fall into the wrong hands.
The burgeoning IoT market and mainstream adoption of connected technologies represent large security risks because most homes lack appropriate protection levels. Many new IP-enabled products cannot be secured, leaving them vulnerable to a variety of attacks (denial of service, exposed latent vulnerabilities, etc.). IoT devices and internet-enabled automobiles pose potential risks in causing bodily harm, as seen with the Jeep Cherokee breach.
Brace for bigger, badder breaches. Enterprises capture and retain data at levels unfathomable just a generation ago – making them an attractive target for cyberattacks. In 2015, we witnessed organized crime syndicates and nation states hit federal, retail, healthcare, and financial services companies, grabbing sensitive data on millions of people. Look for more large-scale attacks to continue -- resulting in higher losses of personal and proprietary information.
Attacks will focus on both the public and private sector. Cyber criminals will set their sights high, zeroing in on industries that hold vast amounts of valuable company and consumer data. Global corporations and governments – especially those involved in defense interests – will be in the crosshairs of state-sponsored espionage actors. Expect additional breaches designed to embarrass or enact retribution, as we saw with the Ashley Madison breach.
Over the past few months, we have seen Angler Exploit Kit activity increase across our observed telemetry. In some instances, Angler EK relies on redirects (also known as "gates") to funnel victim traffic to its landing pages. In others, Angler EK does not use redirect techniques but instead sends victims directly from a compromised site to the landing page.
Redirects are URLs or specifically crafted websites that forward victims to the Angler EK landing page. They could provide Angler EK operators the functionality to:
There are four redirect methods in active use today. Most of these methods have been discussed in varying detail elsewhere. In this post, we will consolidate the knowledge and share additional details of each method used. And because Angler continues to send victims directly from a compromised site to landing pages, we will also explore that infection path and provide recent landing page IPs.
Angler EK activity decreased in October (hat-tip to Cisco) but rebounded in November based on our telemetry. Figure 1: Observed Angler landing page detections by month
Status: Active as of December 2015
|Current IP(s)
URL Format: /page.php? id=4646BCDD83AB2C1F3AAE14BA34C1622E0EB31BE3B5E1632E19710D
Example of code on compromised site:
Figure 2: EITest redirect method compromised site code example
Called "EITest" by Malwarebytes due to the static id value in the html, this redirect method uses an Adobe flash file to filter victims based on certain criteria. If met, the victim is redirected to the Angler EK landing page.
The obfuscation function format embedded within the flash file recently analyzed (354206353ee3d4e7b279bc66a0727bcf) is different than the one from 2014. However, the criteria for Angler EK redirection (browser version) remains the same.
Below is the obfuscated ActionScript as well as the decoded iframe output.
Figure 3: Obfuscated ActionScript embedded in flash file
Figure 4: Deobfuscated ActionScript embedded iframe
As shown, if the criteria within the flash file is met, the victim will be redirected to the Angler EK landing page.
Figure 5: Redirect to Angler Exploit Kit
This method relies heavily on the use of non-standard TLDs:
Figure 6: Observed TLDs associated with this method in use since October 2015
Status: Active as of December 2015
|Current IP(s)
URL Format: attendance.workforthis[.]com/law/lang.js
Example code on compromised site:
Figure 7: Shadowed Redirect method compromised site code example
As discussed here, this method relies on the initial iframe on the compromised site to send the victim to the redirect intermediary server. This server will respond with either an HTTP 200 and no content, HTTP 200 and an iframe redirecting to the Angler EK landing page, or HTTP 404 "Not Found" depending on a variety of circumstances.
Figure 8: Response if criteria not met for landing page redirect
If the client request meets the redirect criteria, they will be redirected to the Angler EK landing page.
Figure 9: Angler Exploit Kit landing page redirect
Status: Active as of December 2015
Current IP(s): 46.161.2[.]73
URL Format: /wordpress/?bf7N&utm_source=le
Example code on compromised site:
Figure 10: Dynamic DNS redirect method compromised site code example
This method relies on an iframe on the compromised host pointing to a dynamic DNS resource. This resource will then send the victim to the Angler EK landing page or respond with a 404 Not Found. Here are a few of the recent domains we've seen using this redirect method:
Figure 11: Dynamic DNS domain example
Status: Active as of December 2015
Current IP(s): 185.104.8[.]50
URL Format: Various. This method uses HTTP 301 or 302 and the Location HTTP header to send the victim to the Angler EK landing page. Below is an example of the request and the 302 found with the Angler EK URL in the Location header.
Figure 12: GET request and HTTP server response with Angler Exploit Kit landing page
Status: Active as of December 2015
Current IP(s): Various; see IOCs below
URL Format:
/civis/search.php?keywords=90qs9&fid0=6m.tm0x360w12 /civis/index.php?PHPSESSID=7o&action=0x7.012g1815k447rr05"
/civis/search.php?keywords=36ez&fid0=0meicaot4b4jolntuyg8apov2p0wmvi95c5jasm2nob3z6bfh1s-zstibz1176ecs1tg3c5hey7va464mwmt05_sgl2txuo5 /forums/viewtopic.php?t=833l4&f=st41.285w9309da15577
With this example, victims are redirected to Angler EK landing pages directly from compromised sites. In some cases, the iframe exists on the main page of the compromised site. In others, the main page refers to other site resources that eventually lead to Angler EK as shown below.
Figure 13: The main page of a compromised site pointing to the local "stats" resource
Figure 14: The "stats" resource with iframe to the local "/1/" subdirectory
Figure 15: /1/ directing victims to the Angler Exploit Kit landing page
The recent list of IPs hosting Angler EK landing pages for November and December is available for download to aid analysts in detecting related activity.
Angler Exploit Kit remains one of the most active exploit kits in use. Security analysts can improve their detection success rate by using combined network, analytic, and endpoint response platforms to stay ahead of this fast moving threat.
Fidelis Cybersecurity's products detect the activity documented in this paper. Additional technical indicators are published to the Fidelis Cybersecurity github.
- The Fidelis Threat Research Team
Earlier this month, the media covered an FBI presentation on ransomware. What was noteworthy was that the FBI warned that because ransomware encryption is so good, the easiest thing for victims to do may be to pay the ransom to recover their files. Such advice has spurred a debate in the security community about whether it is appropriate to suggest that cybercrime victims pay ransom.
Since the first appearance of CryptoLocker, new variants of extortion-based attacks have been on the rise. Beyond malware, groups, such as DD4BC and Armada Collective, are using DDoS attacks as an extortion tool, threatening to knock the victim's website offline unless a ransom is paid. The hacking of source code repositories and cloud services has also provided a means for extortion, as evidenced by case of Code Spaces last year.
Ransomware, when done right, encrypts files so they cannot be recovered without payment. It is important to note that some ransomware is so poorly coded that victims cannot retrieve their data even if they pay. Such is the case with the recent Power Worm ransomware.
Until recently, many forms of ransomware had weaknesses that allowed for the recovery of encrypted files. In the Cryptolocker case, the private keys were eventually recovered and a free service was developed to allow victims to recover their files. With the proliferation of ransomware variants, efforts to obtain the private keys have unfortunately been unsuccessful. Cryptowall version 4 and the newly observed Linux ransomware, for example, have been making the rounds and, lacking backup files, there is no easy way to recover the encrypted files.
This leaves victims with two choices: pay the ransom to get their files back, or lose their files -- potentially forever.
On one hand, there are those who advise not to pay the ransom because the money funds criminals and perpetuates their activities. On the other hand, because the value of the information is usually much more than the ransom, it can be argued that paying makes good "economic" sense.
An analogy often used to describe ransomware is the use of mob rules. In old-fashioned mob movies, two guys walk into a grocery store saying "Hey, nice store. Would be a shame if something were to happen." The reason the mob "insurance" scams worked is because the value of the protection was higher than the cost of the insurance -- and the mob delivered on their promises. In the case of ransomware, the value of the data is higher than the ransom and operators go through great effort to ensure users get their data back. Occasionally there are errors, but in general, people get their data back.
In an ideal world, consumers and organizations would be prepared. With sound backups in place, ransomware infections would merely be annoying exercises involving file restoration. Ensuring backups of critical or valuable information has been a best practice for decades. Because reality rarely matches the ideal, here are some key takeaways when dealing with ransomware:
Hopefully, the continuing stream of stories about new victims will encourage people to adopt effective backups. The reality is, independent of the debate in the security community, people simply are going to pay the ransom because the economics are soundly in favor of doing so. To use a domestic analogy, if my wedding pictures were only in electronic form and they were encrypted with ransomware, I'd pay the ransom to get those files back – after all, my couch is not that comfortable for a good night's sleep.
A brief video overview of the ransomware threat is available at Malware: The New Scourge of Ransomware A Study of CryptoLocker and Its Friends. Presentation slides are available here.
- John Bambenek


text:
The are a number of community groups in the Ballybay area who would like your help to co-ordinate the organisation or help with activties. If you would like to volunteer to work with a group please fill in your details below, we will pass on your details to the relevant organisation who will then contact you.
* Required information.


text:
Morning Report 7/24/05
Baghdad: Very Hot Today
With scattered body parts
A drive bomber launched his explosive-laden truck toward a Baghdad police station today, but concrete barriers stopped him 60 feet short.
That's the good news.
The bad news is that the truck exploded, killing at least 22 people (mostly cops) and injuring at least 25 others (mostly civilians). As the BBC reports:
- The explosion was so powerful that body parts were thrown onto the roofs of adjacent buildings, said the police.
This latest attack occurred during an already miserable, all-too-typical summertime Sunday in the capital's New Baghdad district. From a story by Edward Wong of the New York Times:
- The bomb struck in the early afternoon, as a sandstorm swirled around the capital, cloaking buildings and streets with a thick layer of grit.
Upcoming Events
New York Red Bulls II vs. Charleston Battery
TicketsSun., May. 28, 2:00pm
Generations from Exile Tribe
TicketsSun., May. 28, 5:00pm
New York Liberty vs. Los Angeles Sparks
TicketsTue., May. 30, 7:00pm
Helen Sung's Sung with Words
TicketsTue., May. 30, 7:30pm
The July 24 attack was the deadliest since way back on July 16, when 100 were killed in Musayyib.
In the middle of this living hell—the temperature in Baghdad was 114 at the time—U.S. military officials are doing plenty of talking about the blast to reporters in Baghdad, telling Al Jazeera and the Times that the truck was carrying 500 pounds of explosives and that the death toll was in fact as high as 40.
I thought the U.S. military didn't do body counts of Iraqis. Oh, I see, the Pentagon doesn't do them for the people back home in America, who are paying for this disaster with their money and children.
Hours after the blast, there was still no word about it on the Defense Department's site.
So let's turn to Al Jazeera for a roundup of the rest of today's brutality in Iraq:
Elsewhere, scattered attacks around the capital on Sunday left three dead, including two police officers, while a police lieutenant colonel was killed in northern Iraq, police and hospital officials said.
Also, a Baghdad city employee was seriously wounded in a drive-by shooting as he headed to work on Sunday, and a former member of a local city council was shot and killed on Saturday night in front of his home in a town north of the capital, officials said.
In this infernal city of 6 million, for whom the electricity is turned on only one hour in four, and a million people in the suburbs are without water, it's only going to get hotter.
No, really, it is. The temperature in Baghdad reached 116 this afternoon, according to CNN, and the forecast calls for highs of 117 on Monday, 118 on Tuesday, and 120 on Wednesday.
Mercifully, it'll stop climbing on Thursday. It's expected to stay at 120.
Get the ICYMI: Today's Top Stories Newsletter Our daily newsletter delivers quick clicks to keep you in the know
Catch up on the day's news and stay informed with our daily digest of the most popular news, music, food and arts stories in New York, delivered to your inbox.
Upcoming Events
UniverSoul Circus
TicketsSat., May. 27, 12:00pm
New York Yankees vs. Oakland Athletics
TicketsSat., May. 27, 1:05pm
Pinstripe Pass: New York Yankees V Oakland Athletics
TicketsSat., May. 27, 1:05pm
New York Red Bulls vs. New England Revolution
TicketsSat., May. 27, 7:30pm
Sponsor Content