Dutch prosecutors believe that Avanesov made up to €100,000 ($139,000) a month from renting and selling his botnet just for spam, said Wim De Bruin, spokesman for the Public Prosecution Service in Rotterdam. Avanesov was able to sell parts of the botnet off "because it was very easy for him to extend the botnet again," by infecting more PCs, he said.
EDITED TO ADD (11/11): Paper on the market price of bots.
What's also interesting is that the cybercrime unit took over the botnet themselves, and used it to display warning messages on infected computers. This has caused a bit of a minor scandal, since in doing so the unit probably broke the law.
I would treet the income figures with a bit of caution.
Other researchers hav indicated in the past that income models are less than a tenth of the 100,000 euros given here.
It may be a case of the usual prosecutorial multiplication to get tougher sentances or justify the investegatory expenses.
Would it be possible to cut off the C&C centre of a botnet legally ?
Presumably, the law allegedly broken here was accessing computers without permission. But cutting off the C&C servers would cause the botnet to stop sending spam. I doubt any law regarding unauthorised access of a computer allows stopping it from doing something while disallowing making it do something. So shutting down a C&C server breaks the same law that displaying warning messages to users does.
One would expect that a cybercrime unit would be quite well aware of the legal ramifications of their primary purpose for existence, although this is not a certainty. The general public and the media can still cause plenty of controversy while being wrong too.
Bringing Avanesov to justice may not be a simple matter. €100,000 per month for ten years (or somewhat less because the article said "up to €100,000") is a lot of money. Assuming he hasn't spent it all and he can access enough of it, he will be able to hire a very good team of lawyers. Another thing tyo consider is that only a small portion of the botnet will be in any one country.
I do not think that shutting down a botnet and issuing warnings via the botnet are against any law.
Seems to me that "negotiorum gestio", "defense of others" maybe even "self-defence" apply.
"Would it be possible to cut off the C&C centre of a botnet legally ?"
Yes perfectly legaly and without the requirment for a warrant or anything like that.
If you inspect any agreement to provide communications over a channel you will find that there is a clause about harming the network and another one for technical reasons.
If you go and dig out the EU R&TTE regs (which apply across the whole of the of Europe) you will see that it specificaly has clauses for disconection for harm / endangering the network and for technicaly justifiable reasons.
Removing the comms is by no means the same as gaining entry to a computer (which is at best questionable and very dangerous at worst).
However as was seen with the Spanish controled bot net choping the head off does not of necessity stop the botnet operator getting control back if they can subvert a node on the botnet side of the comms break they can simply redirect the botnet comms to another controler.
The thing that realy makes me scratch my head with these bot net operators is that they realy don't try to make the Command and Control channel effectivly One Time through the likes of google searches and random posts to blogs.
This last year of political campaigning saw the creation of a lot of groups for the purpose of delivering large quantities of cash to politicians. At least one individual, loser, spent 140 million of her own money on her campaign.
The Indian firm Aiplex announced that they were launching Distribute Denial-of-Service (DDoS) attacks against The Pirate Bay.
One of the basic facts of cyber war would be to establish and maintain footholds into the enemies networks. (fill in your enemy here).
I've thought for years that it's easier to buy already compromised networks than build to suit. Are military and IC budgets already paying into botherder coffers?
Considering that; I'm wondering about the purpose, or secondary purposes, of Darkmarket. Only to identify and persecute criminals? It could easily be used to channel best of breed into other programs.
In the EU, it mostly is. As I understand it, law enforcement stopping someone who is breaking the law is almost always legal. Especially if the crime is in progress.
I think there is a legal difference between entering a place to search for evidence, which requires a search warrant, and entering to stop a crime in progress, which should not.
Note that there might be problems with any evidence unearthed while interfering with the crime. But that is a completely different matter.
Paxson, V., Franklin, J., Perrig, A., and Savage, S. An inquiry into the nature and causes of the wealth of internet miscreants. In CCS '07: Proceedings of the 14th ACM conference on Computer and communications security (New York, NY, USA, 2007), ACM, pp. 375–388.
It seems to suggest that spam is not as lucrative as it may seem. Have spammers gained an advantage in the arm race since then?
"The thing that realy makes me scratch my head with these bot net operators is that they realy don't try to make the Command and Control channel effectivly One Time through the likes of google searches and random posts to blogs."
iii) why they do not use other communication vectors like you said - forums, usenet, free email accounts, mailing lists, blog comments, even public ldap keyservers would work.
Guess we can be thankful that most of the botnet folk are slightly inept.
Aye, gone are the days when spirits were brave, stakes were high, hackers were real hackers, women were real women and small furry creatures from alpha centauri were real small furry creatures from alpha centauri.
Yeah, the financial figures are usually unreliable. The only reliable financial figures in the underground are what something is selling for (it's posted) or what a guy just made off a crime. Even these can be inaccurate due to haggling or exaggeration. Does anyone really think a guy about to do 10 years for hacking is going to brag about making $14 a day?
I don't think they are inept as much as just using readily available kits. Most of the botnet builders use kits made by a few hackers in their spare time. Others build extensions. But the botherders seem to mostly be non-technical as far as system-level programming goes. They are usually more like modern code monkeys: slapping pieces together and hoping something good happens.
As far as the features you mentioned, I designed a botnet last year I think that had all of those features. It was inspired by a certain, little-known P2P program with excellent security. The design extended a well-known kit with some protocol logic and crypto added in. It took an hour for the basic design. Full verification could take considerably longer, but I didn't intend to build so I didn't have to go that far.
These botnet business discussions always remind me of PointCast and SETI clients. Wonder if anyone running a nefarious botnet is also trying to make it run legit computations and use it as a defense: "don't shut it down, it's searching for a cure for cancer"
"Guess we can be thankful that most of the botnet folk are slightly inept."
If you are really, really, smart, brilliant and only want to make a lot of money, the obvious route to riches is not crime. Especially not cracking other peoples home computers. You go working for a merchant bank on the stock exchange.
As Inspector Columbo said in one of his shows, "Murderers are not very smart. If they would have been smart, they could have gotten what they wanted in a better way".
"...requiring all instructions to be signed with a private key..."
"specially-trained transit police officers would begin looking into passengers' bags"
Didn't know having a pair of eyes requires special training. Then again, they'll use any justification to get training money and form those useless special taskforces.
Maybe soon there'll be a need to inspect the toilets, so they'll go for special smell resistant training.
"Being found in possession of that private key would be pretty damning evidence..."
True security-guy paranoid thinking! I salute you!
Holy crap! $139k a month!
I think Columbo is wrong. Ignoring legality here, murder is often a viable and useful strategy for gaining riches if it accompanies a theft and the source is properly disguised. This has happened enough in real life that we should take it seriously. Most get caught, but a few don't or we can't do anything to them legally. Another application is when you want to create instability or losses that financially benefits you in an indirect way. Using put options in connection with a bombing comes to mind, although they are audited (need alibi).
I do agree that really smart people typically don't need murder or crime to make money: I've said it myself on occasion. Even ignoring stock exchanges, there are many grey areas where people can essentially defraud others or steal legally. Personally, I'd say what the patent trolls are doing is theft. Intellectual ventures made like five billion on it, though.
Hey, I just got an idea that I don't think anyone has posted about. Most writers have been talking about the kind of money people make botherding and the kind of time they do if caught. How about making money by busting botherders?
If you can find the Crimefighters Handbook online, as it used to be a free txt file, you will see that there are numerous bounty hunter laws civilian crimefighters can use. The basic one is up to $25,000 for info leading to the arrest (not conviction) of a felon, with another $25,000 if they had drugs on them. RICO lawsuits allow the crimefighter to collect up to 50% of all fines and forfeitures. So, if these guys had a huge bankroll, a crimefighter would make six digits off their bust.
I was going to do this in my city but I didn't like the risk of retribution. However, most botherders that have been arrested aren't that type and the risk is almost zero. A few ideas come to mind. Infiltration and gaining their trust. Possibly pretexts to get them to come into the United States to make more money, then busting them upon entry. The American ones would be especially easy.
So, my target is botherders, bank account thieves and CC fraud dudes. Most use Western Union, with many stores having video cameras. If we can't get them technically, then this could be a decent way to do it. Cost a bit, though. Should probably put a $25,000 limit on expenses. Then, sue the guys for the expenses and put a lien on their property. I could see this working for someone with professionalism. ;) What do you guys think? Should we spread the word about the reward laws to give incentives to people capable of busting these guys?
"the Dutch High Tech Crime Team began taking over command-and-control servers used to issue instructions to the *29 million* infected computers"
Wow! That's a lot of computers under this guys' control. I figure reporters would be focusing a bit on how huge this thing was and how long it took to build. It could be the biggest I've heard of. For DDOS lovers, that thing is Excaliber. Any comments?
"It takes almost no brains to get one going and make money off it. Avoiding getting caught via the money is more difficult, but a smart guy will do the research and figure that out. Hence, crime is a viable option for a smart and amoral person, especially if they live in Northern Asia or Eastern Europe. The money issues disappear when the mob does the laundering or dirty politicians look the other way. ;)"
I agree with everything you wrote. And Columbo was only a TV show. But the question was why criminals are not very bright?
And the point was that if they *were* very bright, they could earn their money with less risk. Those who remain in crime are those that (have to) chose the easier, and riskier, options. But indeed, keeping your own hands clean doesn't mean you cannot "incentivive" others to perform the dirty work.
Getting the mob to launder your money and politicians to back you and still get rich would be an achievement in itself.
I glossed over the obvious point that there are places where crime might indeed be the only option to an ambitious genius.
Consider the simple case of a 2048 bit personal key and a 512 bit bot net key.
There are very easy ways to hide the 512bit key in the upper third of the 2048bit key. Proving it was there would be almost impossible unless caught in the act of using it.
There are very many other tricks that can be used to hide a private key with little difficulty I've thought of a few myself.
I would comend the works of Adam Young and Moti Yung to those who want to see just how an inventive mind can be put to use.
I keep waiting to hear about somebody turning botnets into TOR networks. At the very least they would be useful to any organization that controls the botnet directly and somewhat useful to "little guys" renting usage - still gotta worry about the botherder snooping since technically he does have control over all the nodes in the network. But as long as the botherder isn't the CIA or another TLA, its probably good enough for most uses.
29 Million is indeed scary.
I've seen 25 bots do damage to a badly-tuned application. I've seen 1,000 bots take-down a bad firewall.
I wonder what kind of bandwidth they were pushing when they threw those 225K computers against the Dutch authorities.
I could see those bots become Tor exit nodes indeed.
@Clive: "...hide a private key with little difficulty..."
As with all steganography approaches, these are generally very hard to implement correctly.
E.g., hiding the key in another key would likely require some program to get it back out (unless you'd prefer to code/compile such a program for every access and destroy it thereafter) which would be pretty suspicious in itself (and could be used to find the key).
We're also seeing the many cybercriminals are preferring to operate smaller botnets and run "under the radar," hoping to be able to operate the botnets for a longer period of time being they are detected and become a target for takedown.
Given that any self respecting "cyber criminal" should have said key residing on encrypted media and only used via an secure anonymous proxy, if law enforcement can find it - they bloody well deserve to nail the user.
"If you are really, really, smart, brilliant and only want to make a lot of money, the obvious route to riches is not crime. Especially not cracking other peoples home computers. You go working for a merchant bank on the stock exchange."
"But the question was why criminals are not very bright?"
The bright ones are those we never hear about, or are running the country.
"The basic one is up to $25,000 for info leading to the arrest (not conviction) of a felon, with another $25,000 if they had drugs on them. RICO lawsuits allow the crimefighter to collect up to 50% of all fines and forfeitures."
To be honest, that really surprised me when I read it, but, yup it's in there. I do believe the 3059 provision has been repealed in February this year though, however US legislation seems even more difficult to discern than UK statutelaw so I could be wrong.
i) Centralized CnC provide resilience. P2P botnets were gaining in popularity until rival operators realized how easy it is to steal other botnet operators' nodes. Malicious distributors using "Pay Per Install" schemes will pay operators a certain amount of money for each machine they can infect. So the more machines you can control, the more you get paid. Having machines stolen from you is literally having money stolen from you. Therefore some form of centralized CnC is preferred. These assets are easier to manage and retask on-demand.
ii) Who can say? There are countless ways this can occur.
iii) This is a growing trend. We see botnet malware CnC posing as seemingly innocent posts to web forums, "image" downloads and the like. The use of filesharing domains are also popular. However, the criminals don't ave a need need to get too complex. Most use simple DNS and HTTP/HTTPS as the CnC infrastructure. The newer malware is proxy-aware, so it can move out of the network with or without a web proxy.
Most organizations either don't see botnet traffic moving through their networks, or they DO see it, but it looks benign or mundane enough not to earn further scrutiny.
"Centralized CnC provide resilience. P2P botnets were gaining in popularity until rival operators realized how easy it is to steal other botnet operators' nodes."
"Most use simple DNS and HTTP/HTTPS as the CnC infrastructure. The newer malware is proxy-aware, so it can move out of the network with or without a web proxy."
When considering a command and control type setup, the I agree with you, it doesn't require too much complexity. For a stealthy P2P setup, it will probably need to be a bit, erm, smarter.
I like your file sharing suggestion, I hadn't thought of that.
"Most organizations either don't see botnet traffic moving through their networks, or they DO see it, but it looks benign or mundane enough not to earn further scrutiny."
Most organisations do actually pick it up: either the NMS/SEM will flag something unusual, or it gets discovered when executing a payload, i.e. it's pretty obvious when you company's own systems start trying to send spam through your internal mail.
"As with all steganography approaches, these are generally very hard to implement correctly."
To hide something has a few basic aspects the two most obvious being the object and the container. The security relies on an adversary not being able to prove the existance of the object in the container.
1, Is it possible to put the object in the container?
2, Is it possible for an adversary to find the object in your container?
If you examine a "pq" public key you will find the most significant bit is 1 and that if it is also a Blum integer the two least significant bits are defined by the constraint on both p & q of being "congruent 3 mod 4" which is of the form "4t+3" with t being an integer. Thus the two least significant bits of p and q will be set (binary 3 or '11') and thus the two least significant bits of the p,q multiple or key are "01", giving you a public key foramt of "1... y ...01"
If you then consider y, the bits in between the start and end bits (ignoring the carry in for now) they are the result of an A.B multiple where A and B are the "t" from the "4t+3" right shifted two places which is just t.
The question then is is the distribution of the t's any different from the distribution of ordinary integers?
The answer is obviously yes, as "4t+3" has to be prime for p and q to be prime. Where as for ordinary integers there is not this constraint.
The question then arises does this matter?
The answer is no, because for the pq multiple to be a valid public key that is the expected distribution, not the distribution of A.B where A and B are any integer in the range 1 to 2^(y/2).
The next question arising is can I find a bit patern x in the available keys 1... y ...01, where x is a sub string of y?
To which the answer is yes. That is you make up your short key x then go on a hunt using a fairly simple algorithm. If after a period of time a legitimate public key containg x has not been found simply generate a new x and run the algorithm again.
On a PC with the legitimate public key being 2048 bits a secret short key x of 512bits can usually be found in less than 24 hours. Also usually at an easily rememberable point in the legitimate 2048 bit long public key.
The important question (2) is can x the short secret key be recognised by an adversary in the public key 1... y ...01?
Not untill they have cracked the 512bit short secret key x from the bot net traffic public key, and thus know the bit pattern to look for.
So as easy as factoring any other RSA public key to get the pq primes to build the private 512bit secret key x.
3, the bit offset in the public key to find the start of the secret short key.
4, any additional obsfication used.
Or you could do the whole thing in reverse and find a legitimate public key everybody has on their PC and then find a secret short key to match it with a little easily remembered obsfication.
Which is easier than it sounds when you consider the number of CA public keys tucked away in the likes of the default install of Internet Explorer or other browser.
"Most organizations either don't see botnet traffic moving through their networks, or they DO see it but it looks benign or mundane enough not to earn further scrutiny."
I had an argument with Richard Clayton of at Camb Labs over this point some time ago. His view appearing to be that bots are only used for spam and DDoS (which I am very sure they are not in some selected cases).
My view is that those botherders using botnets for spam or DDoS are wasting a resourse. That is they don't actually know how to capitalise on their assets any better.
Simply because when they start Spamming or DDoSing most people in SMSE's and above cannot miss the increase in network traffic and thus take investagative steps to find and remove the cause. Also some ISP's inform users that they are in violation of their T&C's and will threaten to cut them off if they don't clean up their machine.
One of the reasons I sugested back then to use Google or other search engines for making a non centralised command structure was that it looks just like normal user traffic on the network and provided it keeps the bandwidth low it's not going to be that easy to spot.
The reason I was thinking about it is botnets are essentialy "fire and forget" malware and can be used to amongst other things search out valuable information and find ways across air gaps.
That is when used for intel information gathering a botnet can enumerate network topology and also search for user documentation etc. Thus it becomes a significant and rather worrying APT tool not just a resource using anoyance.
"My view is that those botherders using botnets for spam or DDoS are wasting a resourse. That is they don't actually know how to capitalise on their assets any better."
That's an insanely modern and ultimately correct view, IMO. Or to put it in the words of a teenager..."Spam and DDoS bots are sooooo 2005." Depending on when you and Richard talked, he may have been right. However the game has substantially changed in over the last year.
Theft of corporate banking instructions/credentials, PPI, intellectual property and PII are far more lucrative and don't require that cozy criminal-to-victim interaction (as some of the DDoS-for-Ransom attacks do). Clive hit the nail on the head. Criminals are getting smarter and using their (stolen) resources more effectively.
"Most organisations do actually pick it up: either the NMS/SEM will flag something unusual, or it gets discovered when executing a payload, i.e. it's pretty obvious when you company's own systems start trying to send spam through your internal mail"
Again, spambots are giving way to theft-bots that primarily use HTTP or HTTPS. Most of the time, the CnC will be "seen" over the web proxy as a user attempting to visit a blocked site. That may be categorized as 'Spyware/Malware' but may also flag as Adult or even the ubiquitous 'Uncharacterized'. With hundreds or thousands of these events coming in per day, the security teams say "Proxy blocking. Proxy working. OK, dudes... Nothing to see here, let's go work on our other 234 projects that are due on Friday..."
If there user is on a mobile device, they will leave the network and the bot will often update itself by downloading newly created domains that will slip past proxies and other blacklists. We have observed some of the Monkif and Zeus-based bots going to legit sites like Google just to check if Internet access is allowed and if anything is blocking outbound requests.
Google 'tdss rootkit analysis' and 'building botnet campaigns' for a look at common tactics.
These days, stenography has become a lot easier. Look at your <insert any utility here>-bill. They all have QR codes. Print a set of fake bills replacing the QR code with your key. All you need then is a way to convert the QR code into a long number into a text file. Nobody will ever bother scanning the QR code on your bills... Depending on your level of paranoia, you can iterate on the concept with secret sharing between different QR codes, replacing the QR code on different products or if you are really so paranoid, there is an age-old technique: memorize the key! I know it's a long string of hex. But seriously, if there was a string of hex which I could use to be a multi-millionaire or could be used to send me to jail, I would spend however long it took to memorize the darn thing. It would be worth it!
"Depending on when you and Richard talked, he may have been right. However the game has substantially changed in over the last year."
"Well if the botnet doesn't send spam or perform DDoS attacks, then the damage it does is really rather limited — and we've won anyway"
You can see from what I initialy said at the time I was aware of other activities bubbling up but was reluctant to say "out loud" what they were.
However I found out a writer on a security blog had almost coincidently put out an article letting the cat out of the bag so my later posting went into more details of what a bot net could be used for in terms of enumerating out honeynets etc as well as how to make a decoupled control channel using search engines.
"Again, spambots are giving way to theft-bots that primarily use HTTP or HTTPS. Most of the time, the CnC will be "seen" over the web proxy as a user attempting to visit a blocked site....Nothing to see here, let's go work on our other 234 projects that are due on Friday"
iv) the malware somehow doesn't trigger anything but activates when the user in question is not logged into the system, or violates some other base rule in the SEM.
e) assuming the malware returns information via HTTP/HTTPS then it must be encoded in such a fashion that it is not obvious to any border scan (I'm fairly sure some proxies can recertificate https with a company cert and as such scan the plaintext, although I could be wrong).
Not particularly easy, but again not impossible either.
"To compromise a system within a security conscious organisation is a difficult and often noisy busines with normal case scenarios..."
The reason being that even in security conscious organisations there are resource limitations and usually an ever expanding external connections demand over and above the increasing demand internal to the organisation.
"If a tree falls where nobody is does it make a noise?"
That is you can create as much noise as you like providing you know that it is not going to be heard, or if heard not understood for what it is.
2, Find a computer on which the exploit will work.
3, Get the exploit onto the computer.
Preventing this is usually a case of "recognition by signiture" and this is where it starts going wrong for the defender.
Signitures are "statments of the known" not "recognition of the unknown".
If you have a file that is never modified, taking a couple of hashes via different algorithms will be sufficient to detect any changes, likewise with filesystem directory and allocation tables. This is usually the case with most OS files. With one proviso this is a working security stratagy for detecting unauthorised changes to effectivly static files and file systems.
It does not work as well for files or filesystems that get appended, That is it works upto the last snapshot point but not after, but it can immensely reduce the search/check space when making the next snapshot provided it is coupled to an effective checking system. However as a security system it is only effective for the known not the unknown thus it has windows of opportunity for an attacker between the snapshots.
For files and filesystems that get random changes hashes are not going to achieve anything unless you have a journal to track the changes. I'm not directly aware of journaling systems coupled with effective checking systems, but even if they exist that only effectivly makes them equivalent to the above appending systems.
The more random and the more frequent the changes to file and file systems the larger the effective window of opportunity becomes, thus the less effective a signature based system becomes.
The proviso to all these systems is of course the reliability of the reporting mechanism (ie it does not report falsely as in the case of root kits).
The same argument applies to a computer systems memory and any excecutable code or data that effects a codes execution.
Likewise with network data this is very much a dynamic system where unlike a static file or file system not matching a signiture is the norm not the exception.
B, They have to be able to check a packet to a signiture.
The first (A) is a real problem in of it's self a signiture is only going to exist for a known issue. Likewise the signature has to be able to produce a reliable indication to be of use.
From an attackers point of view all they have to do is either come up with an unknown exploit or a method of changing a known exploits signiture beyond the point it is recognised. There are tools out there (ENG++) that will take an exploit apart and then "fuzz" the basic components such that a signiture is very much changed.
Likewise we have seen in the past polymorphic virus code that does similar with signiture avoidance encryption and compression engines.
However IDS/IPS have a "real time" problem, to be of use they have to be able to do packet inspection at all levels in a very very short time frame on very large numbers of packets.
Needless to say this is very very resource heavy to do even moderatly well on compleate packets. And this is where their second problem (B) arises many IDS/IPS's cannot handle fragmented packets let allone fragmented packets that are significantly out of sequence.
Part of the recent Advanced Evasion Attacks (AET) bruhar appears to be over this very issue. They revolve mainly around the known packet fragmentation and timestamp out sequencing techniques but bring "fuzzing" to the party. Thus taking the fourty or so known techniques and multipling them well beyond the capabilities of many IDS/IPS systems.
However from some comments by H.D.Moore (who did some of the original evasion research) who has had the details disclosed to him there is a bit more to AET than just a reboiling of known issues (but we are going to have to wait untill the end of this month to find out what).
The upshot is that "fuzzing" brings a whole new dimension to foiling signitures that allow even years old exploits to be got past the detectors not just of IDS/IPS but Anti Virus Systems (AVS) as well.
That is taking a known exploit taking it appart and reordering it gets past some patches.
The reason for this is that sometimes there are fundemental vulnerabilities that cannot be fixed just obsficated. And importantly there are way more of these than at first you would think.
Thus there is a not just 0-Day exploits but what some chose to call Z-Day exploits which are known exploits that are fuzzed into new forms.
So even very security concious organisations that have reasonable resources are potentialy going to get caught out by fuzzing.
And as has been more recently seen even old well trusted security techniques that where once thought invincable (ie Air Gaps) are being breached due to the way we now work. Gone are the days of locked down systems not just in the OS and applications but in connectivity, access and data types.
Mobile devices don't have the resources to adiquatly protect themselves from known attacks.
Thus mobile devices have in themselves become the new Achaean (Greek) wooden horses. Wheeled through the defending ramparts into the modern Troy like corporate citadel by lax Trojan executives. Who bouyed up by past imperviousness view them as tributes to their own abilities. Not as they should as hiding places for Achaean cohort like rich data formats. That can spring forth to rampage around the network of citadel highways to pillage as they feel the treasure of information within the citadel data stores. Safe in the knowledge that any noise they make or alarms sounded will be drowned in the corousing of drunk with power executives who see no value in the caution of more battle hardend and wary troops.
"For files and filesystems that get random changes hashes are not going to achieve anything unless you have a journal to track the changes. I'm not directly aware of journaling systems coupled with effective checking systems, but even if they exist that only effectivly makes them equivalent to the above appending systems."
I don't mean to be rude, but what on earth do journaliing file systems have to do with this discussion?
B, They have to be able to check a packet to a signiture."
Firstly, most decently sized organisations will have at least a border IDS; I also suspect the high end commercial solutions perform a lot better than you expect, and don't rely solely on signature detection. On normal traffic these solutions should perform at almost wire speed.
"The first (A) is a real problem in of it's self a signiture is only going to exist for a known issue. Likewise the signature has to be able to produce a reliable indication to be of use."
Ofcourse, an unknown exploit is unlikely to be covered (although I am aware of one IDS solution that partially deals with the problem of unknown vulnerabilities).
"From an attackers point of view all they have to do is either come up with an unknown exploit or a method of changing a known exploits signiture beyond the point it is recognised."
"There are tools out there (ENG++) that will take an exploit apart and then "fuzz" the basic components such that a signiture is very much changed."
You're assuming the IDS is similar to say, Snort, and is using a signature engine - that is not necessarily the case.
"Likewise we have seen in the past polymorphic virus code that does similar with signiture avoidance encryption and compression engines."
Again, this assumes a purely signature basic IDS. Encrypted packets where there shouldn't be any will almost certainly raise alarm bells. Exploits have an addition problem that virus code does not: often with an exploit there must be a certain structure to work; so while the payload can be easily obfuscated the actual exploit usually has to fit a semi-rigid pattern.
"However IDS/IPS have a "real time" problem, to be of use they have to be able to do packet inspection at all levels in a very very short time frame on very large numbers of packets."
They seem to manage, as do high end firewall products like Checkpoint (the last time I read a spec they could punt 6Gb/s across a link and that was about three years ago).
"Needless to say this is very very resource heavy to do even moderatly well on compleate packets. And this is where their second problem (B) arises many IDS/IPS's cannot handle fragmented packets let allone fragmented packets that are significantly out of sequence."
I thought packet reassembly was implemented even in open source IDS solutions some time ago? More to the point, how are highly fragmented packets getting past the firewall?
"Part of the recent Advanced Evasion Attacks (AET) bruhar appears to be over this very issue."
Would be good to see how it performs against different commercial IDS solutions (too many fragmented packets alone should raise an alarm).
"That is taking a known exploit taking it appart and reordering it gets past some patches."
"So even very security concious organisations that have reasonable resources are potentialy going to get caught out by fuzzing."
iv) (a) it has been a while since I did much Windows sysadmin but on most modern *nix system a successful exploit may not actually get the attacker anywhere other than a well firewalled sandbox.
"Thus mobile devices have in themselves become the new Achaean (Greek) wooden horses. Wheeled through the defending ramparts into the modern Troy like corporate citadel by lax Trojan executives."
"Safe in the knowledge that any noise they make or alarms sounded will be drowned in the corousing of drunk with power executives who see no value in the caution of more battle hardend and wary troops."
Business systems are usually watched fairly carefully for them, and their own personal systems, well.
On the whole, I'm not disagreeing with you - it is quite possible and more than feasible to do "slow and low" type attacks. However, against a security conscious target it is not as easy as it may first appear.
"I don't mean to be rude, but what on earth do journaliing file systems have to do with this discussion"
Any and all file systems can be regarded as bit buckets with memory or containers from a 20,000ft view. At an interface level there are four operations you can do on any data item stored in one, Create, Read, Updadte, Delete (CRUD) the same with any abstract container such as a database.
For databases and similar systems the idea is that the create/write/delete operations should be atomic to ensure consistancy. As this cannot be done in reality the idea of roll back came in where a record to be changed is first read into a "journal". The operation is then performed on the actual database and then the new written record is then checked against the modification if it was OK then the original record is deleted from the journal. If the record is not ok for some reason then the journal record is written back to the database. A process that earned the name of the three phase commit.
Journaling file systems work in the same way to ensure consistancy in the file system. The original reason for this was to get around the Unix file system check at boot up as checking a 1TByte of file system for integraty can take a very long time. Checking the journals in the file system however can take less than a blink of an eye.
At a slightly lower than 20,000ft view a container can be said to consist of two parts those where data is unchanging in any given time period and those that have changed in any time period. Unless the changes are stored in a journal you have to go through the whole container when doing any kind of check or update.
Now one such check is retreving lost or mangled files caused at some higher level such as by an application crashing or a user with finger problems. This is often done with "backups" however like a file system consistency check theses can be unbelivably slow on large filesystems. So the idea of heirachical backups to save time came in that is you only do a full backup say once a month and then do backups of only the "delta" files that have been modified inbetween the full backups. However the old way of doing this by looking at a file modification time or status bit only works on inactive file systems not on active file systems. To do it reliably on active file systems you need a journaling process such that a time point can be set to take an acurate picture of the file system or a "snapshot"
Now on some network based file systems the file system automaticaly maintains "snapshots" of how the file system was at some previous point in time. That is there is a record kept of the "deltas" (all the changes) kept between snapshots so you can roll a view of the file system backwards or in some cases forwards in time from any particular shapshot. This is also done by what are effectivly "journals".
Now checking for malware is a long slow process just like checking a file system consistancy or doing a backup and if you can you don't want to be doing it on parts of the file system you have already checked, but as in backing up a live file system you don't want to miss any bits.
As I said briefly I'm not aware of any security systems that use hashes to check file consistancy that interface with journal systems such as snapshots. I'm not saying that they don't exist it's just that I'm not aware of them as I've never gone looking to see.
"I also suspect the high end commercial solutions perform a lot better than you expect, and don't rely solely on signature detection"
Same communications problem again with "signature".
I'm not using it in the "bit for bit" comparison sense I'm using it in the much broader sense.
That is all recognition systems use some form of patern matching, in which a particular activity has some recocnisable traits. A recognisable trait whatever it might be is a signiture. The evaluation of the signitures can be either determanistic as in yes / no or probabalistic as for instance the wieghted sum of several such signitures set against a threshold.
Obviously the simple bit matching determanistic system is going to be the fastest, but the easiest to avoid. As the IDS/IPS becomes more probablistic the resources required goes up.
On problem of rule based systems (which most AI systems are) is that changing the order of an event can make the rule fail. In general rules are optomised for efficiency and thus are fairly strict.
There is a window of oportunity where the exploit or attack method used to deliver it can be reorganised. If a rule is to strict it will fail to recognise either the exploit or the attack method.
There are two ways you can find a modification you can make that will get you through. The first is the determanistic method of examing the rule set to see how it works. The second is the probabilistic method of get a system and fuzz the input and see if it gets picked up or not.
The advantage the second method has is it tests the whole IDS/IPS system not just the particular rule set you are looking at. This means it will also find bugs in the system where some underlying asspect is deficient.
The fact that people are doing this demonstrates the second principle of "low hanging fruit". That is the visable low hanging fruit have been eaten, you either reach up higher for visable fruit (first principle) or you start looking for fruit low down that are not visable because of something obscuring them.
There is of course still the third and forth principles of "find another tree" and "learn to climb a tree". We tend to hope that removing the low hanging fruit will cause the third principle and with script kiddies it tends to. However it has been obvious for some time that because we never raise the bar high enough we are actually teaching our opponents not just to climb trees but mountains as well (which is a point I've made for some time now).
Then of course for those with sufficient power there are the fifth and sixth principles of "shake the tree" and "knock the whole tree down" so even the highest fruit gets to ground level but both tend to require considerable force and be quite noisy. But we have seen with DDoS and worms that in the information world "force multipliers" don't have physical world limitations and are thus virtually costless to an attacker.
"I'm not using it in the "bit for bit" comparison sense I'm using it in the much broader sense."
Yeah, I was assuming that too.
"That is all recognition systems use some form of patern matching, in which a particular activity has some recocnisable traits. A recognisable trait whatever it might be is a signiture. The evaluation of the signitures can be either determanistic as in yes / no or probabalistic as for instance the wieghted sum of several such signitures set against a threshold."
That paragraph seems to suggest the assertion that all IDS systems must work by pattern recognition and hence are all signature schemes? If that is so, then I can show that assertion is incorrect by counter example: I know of at least one IDS system that checks for non-procotol input. So for example, if you have an input which expects a maximum of n characters and the input has n+m then it will raise an alarm. Now while that is certainly pattern matching, it is not a signature scheme as it can potentially flag up unknown exploits which would be by definition impossible to code a signature for.
"Obviously the simple bit matching determanistic system is going to be the fastest, but the easiest to avoid. As the IDS/IPS becomes more probablistic the resources required goes up."
Yes, but modern IDS products specify the resource requirements necessary to use their product. And more of the ones I am aware of essentially run at almost wire speed.
"There are two ways you can find a modification you can make that will get you through. The first is the determanistic method of examing the rule set to see how it works. The second is the probabilistic method of get a system and fuzz the input and see if it gets picked up or not."
You may try that, but for large classes of exploits that simply will not work. For example: an SQL injection attack *will* require certain special characters and no amount of fuzzing will change that; a buffer overflow *will* require an input that is longer than the buffer and no amount of fuzzing will change that. I would imagine the vulnerabilities this may be effective against are multivariable logic flaws where manipulating several inputs obtains the exploit, which is a narrow window to work within.
"The advantage the second method has is it tests the whole IDS/IPS system not just the particular rule set you are looking at. This means it will also find bugs in the system where some underlying asspect is deficient."
You also have to have the same IDS to test against. When these things cost in the hundreds of thousands, that puts it out the range for most attackers.
"The fact that people are doing this demonstrates the second principle of "low hanging fruit"."
Going back to my original statement: it is usually a difficult and noisy affair to compromise a system in a security conscious organisation.
Yes, those companies/institutions that don't bother will be your "low hanging fruit" but even the most basic measures can make compromising a network difficult.
"I've just realised you've replied on this, so apologies as there is a fair chance you'll not see my response now :-("
"That paragraph seems to suggest the assertion that all IDS systems must work by pattern recognition and hence are all signature schemes?"
It depends on your definition of signature, as far as I'm aware all systems (apart from some learning systems) recognise activity that either matches or does not match a rule set of some kind.
That is it is programed to recognise a charecteristic and decide if it is a match or not then by some process make a choice on another rule set as to if the charecteristic is acceptable or not.
I regard the charecteristic (what ever it is) as being a signature, so your example of n+m charecters as a signiture to be picked up on in the rule set as 'X equals n', 'X is less than n' or 'X is greater than n' etc this then used as a go no go at the simplest level or adds a weighted value into another rule set that might or might not include specific exceptions.
"Now while that is certainly pattern matching, it is not a signature scheme as it can potentially flag up unknown exploits which would be by definition impossible to code a signature for."
Your definition of signature is more restrictive than mine, which is fair enough.
"For example: an SQL injection attack *will* require certain special characters and no amount of fuzzing will change that; a buffer overflow *will* require an input that is longer than the buffer and no amount of fuzzing will change that."
Yes but a even if the requirment for special charecters or required length is met a given input may not work thus you fuzz the unknown component. Fuzzing does not need to be across the whole input and likewise it does not need to be just fuzzing by substitution but by transposition.
If you have a previously working attack that consists parts aranged as ABCDEF, if it nolonger works you can fuzz the order of the parts to say FEABCD and find it does get through simply because it follows a different path down the IDS rule set.
As I said You have two basic ways to find a working order, the first is examin a known rule set and find a path through by examination this works against publicaly available rule sets. However if the rule set is unavailable or very complex you have to try different input orders and this can be either fully determanistic "brut force" every option or probablistic "fuzzing" in the abscence of directing information (ie knowledge of the rule set) general fuzzing would be expected to find a working solution faster than brut force on average.
Obviously the fastest route for an attacker would be to use directed fuzzing where the direction comes from partial knowledge of the system or feedback from the response changes.
"You also have to have the same IDS to test against."
"When these things cost in the hundreds of thousands, that puts it out the range for most attackers"
Not true, you just have to know where several otherwise unrelated sites have the same IDS that you can see and use them in a round robbin fashion.
2, Avoid providing information about their defences in the process.
3, Determin what purpose the attack had if any.
Most organisations are happy to stop at the first point they simply don't have the resources to ensure the second (if they are even aware of the need). As for the last point few if any organisations do this and if they do how many make their findings available to the wider community?
Although testing defences are not unknown in conventional warfare (probing attacks) they are usually very expensive in casualties for no gain and serve to alert the enemy. Neither constraint realy applies in the current Information Security setup we currently have.
"Going back to my original statement: it is usually a difficult and noisy affair to compromise a system in a security conscious organisation"
Is true, but not if the attack has first been refined at another "test site" so it either makes little noise or noise where it is not heard at the "target site".
'You never know when you have spent to much on defense, only to little'.
I suspect you are aware of the old saying about football "It's a funny old game" well it applies equaly as well to information security.
"Not true, you just have to know where several otherwise unrelated sites have the same IDS that you can see and use them in a round robbin fashion."
That is prone to a number of problems and would be of doubtful reliability: most institutions will have differing network topologies, differing server configurations, different firewalls, and perhaps customised IDS configurations.
"Which is one of the asymmetric advantages attackers have over defenders. Attackers can chose a point of attack that is advantageous to themselves, the defenders have three problems,..."
"...Most organisations are happy to stop at the first point they simply don't have the resources to ensure the second (if they are even aware of the need). As for the last point few if any organisations do this and if they do how many make their findings available to the wider community?"
Most of the higher end IDS or firewall solutions do this automatically by feeding information back to the supplier for analysis. A trend sould be noticed fairly quickly and attention diverted to that issue.
"Fuzzing does not need to be across the whole input and likewise it does not need to be just fuzzing by substitution but by transposition.
If you have a previously working attack that consists parts aranged as ABCDEF, if it nolonger works you can fuzz the order of the parts to say FEABCD and find it does get through simply because it follows a different path down the IDS rule set."
Sorry, but that is missing he point. For an exploit to work it must conform to a certain structure for that associated vulnerability - if you scan for that structure any further modifications are irrelevant and ineffectual.
In a weak form, take an IDS that scans for *anything* that will trigger a specific vulnerability then your exploit will either be detected, or it will go undetected and will not work. For example, if an input expects 5 characters and 6 chars cause a buffer overflow, it is trivial to check for more than 5 characters - changing the order of the first 5 is irrelevant.
In a stronger form: if your IDS scans for any input which violates expectations, it will include the last example and also catch a more generalised class of exploit. I know of at least one well known product that works on this basis.
The vulnerabilities that are possible to "fuzz" for are generally the more complex logic flaw types where there are dependences between multiple inputs. Again in a trivial example, one input specifies how many characters to expect in the next input and then more are sent.
"One of the almost forgoton requirments in the mainly nonsense "Cyber-war-Command" idea is sharing of intel about all attacks. This is something that is virtually nonexistent currently and it's absence gives a huge advantage to the attacker and causes a vast immeasurable cost to organisations because of the defence spending maxim,"
I can say from experience, that is not entirely true - relevant information on security threats is exchanged, it is just not advertised or available to general staff.
In the end, I'm not really disagreeing with you; all I am saying is that it is much harder to successfully attack a security aware organisation without detection than it may first appear.


text:
Is Wi-Fi Safe for Children?
Beware of Health Risks
Doctors and Scientists around the world have warned against unnecessary exposure of children to RF/microwave from wireless technology and recommend safer WIRED internet connection instead, both in school and at home. We are parents who fully support the use of computers and the incorporation of technology in education, and we believe that it must be implemented in a SAFE manner.
Teachers' Unions in Germany, UK, USA and Canada Who Have Done Their Research Do Not Support WiFi in Schools
EdTech companies keep pushing for MORE wireless in classrooms, saying RF/EMF is safe when official agencies lack long-term data of health impact from exposure on children.
All these unions below have done their research about the health risks of WiFi and cellphones and are fighting to protect the health of their adult members in the workplace.
Why would school boards choose to increase the exposure to school children?
What kind of liabilities are school boards prepared to bear, for knowingly putting children under unnecessary and involuntary exposure to an IARC Class 2B Possible Carcinogen?
United Federation of Teachers - 200,000 teachers and educational professionals in New York City (2014)
Advisory: Wireless radiation is emitted by the myriad of wireless devices we encounter every day. It was once thought to be relatively harmless. However, we now know that wireless radiation can cause non-thermal biological effects as well, including damage to cells and DNA, even at low levels.
Reducing Your Exposure to Wireless Radiation
Some tips to reduce your exposure to wireless radiation.
What You Need to Know About Wireless Radiation and Your Baby
Taking certain precautions around wireless radiation is appropriate for our most vulnerable populations, including pregnant women.
http://www.uft.org/our-rights/wireless-radiation
Canadian Teachers' Federation - over 200,000 teachers across Canada (2013)
That Safety Code 6 include a recommendation for prudent use of Wi-Fi whenever possible including the recommendation to limit consistent exposure in schools by turning off wireless access points when not in use.
That Safety Code 6 exposure thresholds be based upon both thermal and biological effects of exposure to Wi-Fi
That the Expert Panel recommend an education program regarding the relative safety of Wi-Fi exposure and that appropriate resources be developed to educate the public regarding ways to avoid potential exposure risks of Wi-Fi access points and devices."
http://www.ctf-fce.ca/Research-Library/BrieftoExpertpanel.pdf
Elementary Teacher's Federation of Ontario - over 76,000 teachers (2013):
ETFO's adopted resolutions:
"That ETFO study the impact of non-ionizing electromagnetic radiation, including the possible implications for schools and members, with a report with recommendations to the February 2014 Representative Council.
There are growing health and safety concerns regarding the widespread use of technologies which produce and emit non-ionizing electromagnetic radiation. It is estimated that over one million Canadians have an environmental sensitivity to this radiation and experience serious physical and biological effects. As has been the case with other known societal health dangers, the health effects of long-term exposure to this radiation may not be known for some time. Widespread exposure to wireless communication devices and infrastructure in Ontario schools can be a potential workplace hazard. Further study is needed to ensure the safety of members."
"That ETFO, through OTF, lobby the Ministry of Education, the Ministry or Labour, and the Ministry of Health to ensure that school boards:
1. Follow the 'Right to Know" legislation under the Ontario's Occupational Health and Safety Act by clearly labelling the location Of Wi-Fi access points
2. Develop a hazard control program related to wireless microwave radiation through the Joint Health and Safety Committee (JHSC)."
http://annualmeeting.ca/wp-content/uploads/2013/07/Session-71.pdf (#1 & 17)
British Columbia Teachers' Federation - 41,000 public school teachers (2013)
BCTF adopted resolution to protect teachers' health: "The BCTF supports members who are suffering from electromagnetic hypersensitivity by ensuring that their medical needs are accommodated in the workplace."
Greater Victoria Teachers' Association - 1,500 teachers (2013)
"The GVTA recommends a precautionary approach to the School District with regard to provision of wireless internet in schools.
The precautionary approach comes from the environmental movement and has been adopted as common practice in areas regarding potential environmental, ecological or biodiversity damage. It suggests that the lack of significant evidence is not enough of a reason to be unconcerned. The fact that many other countries have instituted regulations to protect children, seniors, pregnant women and other susceptible populations should be the guide for a District policy on WiFi installation and use in the worksites..."
http://gvta.net/index.php/health-safety/2013-02-20-23-22-17
United Teachers of Los Angeles - 40,000 teachers and staff (2013)
http://ehtrust.org/la-teachers-union-passes-resolution-to-ensure-safety-from-hazardous-electromagnetic-fields-emf-in-schools-including-emf-emissions-from-wireless-technology/
UTLA passed the following motion by a sweeping majority:
"I move that UTLA will abide by current National NEA Policy for Environmentally Safe Schools which states that all employees and stakeholders should be informed when there are changes in their exposure to environmental hazards including electromagnetic radiation and that all stakeholders and the public should be notified of any actual and potential hazards. UTLA will advocate for technological solutions that maintain technology upgrades while not increasing employees exposure to electromagnetic radiation."
The Ontario English Catholic Teachers Association - 37,000 teachers (2012)
A position regarding the use of Non-Ionizing Electromagnetic Radiation, including WiFi, in the workplace:
1. We do not know what the long-term effects of low-level non-ionizing radiation are on those who are exposed (workers and students). No form of radiation can be deemed 'safe' as it depends on the constitution of the individual exposed, the amount of exposure as well as a sufficient amount of time to pass to observe any health effects that have a long latency period (i.e. cancer).
2. The WHO has classified low-level non-ionizing radiation in the microwave band associated with celluar phones as a class 2b carcinogen (possible carcinogen) and Health Canada has warned about limiting the use of handheld personal electronic equipment such as cellular phones among youth. Initializing WiFi for personal electronic equipment will result in an unpredictable exposure as use varies.
3. A segment of the population are environmentally sensitive (a disability according to the Canadian Human Rights Commission) to low level non-ionizing radiation and may experience immediate physical/biological reactions when exposed.
4. Employers including School Boards have the duty to accommodate persons with disabilities including that of electro-hypersensitivity. A widespread investment in a redundant WiFi network may limit the ability to reduce WiFi exposure thereby accommodating workers with an electro-hypersensitivity disability.
5. The safety of this technology has not thoroughly been researched and therefore the precautionary principle and prudent avoidance of exposure should be practiced.
6. The purposeful introduction of non-ionizing radiation transmitters, such as WiFi, into the work place is considered to be the introduction of new equipment that presents a potential health and safety hazard for workers. As such, it is the duty of the Joint Health and Safety Committee to develop a hazard control program to; assess the risk of injury from the potential hazard, recommend controls to be applied to address the hazards, and to monitor the effectiveness of the applied controls.
7. Administrative and physical control methods to address the hazards of non-ionizing radiation, such as WiFi, in the workplace are readily available and relatively easy to apply. Application of controls would be completely consistent with the ALARA (As Low As Reasonably Achievable) approach and the precautionary principles as well as the general duty clause, Section 25 (2)(h) of the Occupational Health and Safety Act.
I. OECTA recognizes that there is a growing concern regarding the potential adverse health effects of the use of wireless technology which requires the broadcasting of non-ionizing electromagnetic radiation, typically in the radio/microwave frequency band.
II. OECTA recognizes that the installation of WiFi microwave transmitters and the expanded use of wireless devices in Catholic schools and educational facilities across the Province of Ontario may present a potential Health and Safety risk or hazard in the workplace.
III. OECTA recognizes the need to provide information to the Joint Health and Safety Committee(s) at the local Unit level regarding the potential hazards and prudent avoidance control measures regarding the presence of non-ionizing radiation (WiFi) in the workplace such that they may exercise their powers as established under S. 9(18) the Occupational Health and Safety Act (OHSA).
IV. OECTA post this position paper on the OECTA website.
http://www.oecta.on.ca/wps/wcm/connect/6a665c0049fedbee85919db62552ca8d/WiFipositionpaper2.pdf?MOD=AJPERES
UK: Voice - The Union for Education Professionals - 20,000 members
http://www.voicetheunion.org.uk/index.cfm?cid=495 (2009)
http://blog.voicetheunion.org.uk/?p=1097 (2013)
"In the last few years there has been a great weight of evidence from around the world which suggests that exposure to electromagnetic radiation can have long-term health impacts, particularly on children, and that exposing young children (from birth to 12) to electromagnetic radiation (EMR) can produce changes in cell formation, genetic changes, and potential cancers.
Exposure levels are only half the story; length of exposure is crucial too. Long exposures at lower intensity levels may be as damaging as high exposure levels for short periods hence our concern about wireless networks in schools and nurseries.
It is a considerable concern that in schools we are installing wi-fi systems and we have no clear evidence that they are safe. Our concern is that until they are declared to be safe and proven to be safe we should not be installing them in schools.
The difficulty is that once installed in schools, they are switched on constantly. Whether the children are using them or not, they are exposed to that level of radiation.
Voice has advocated that new wi-fi systems should not be installed in schools, that existing systems should be turned off when not required and that schools should consider whether they really need to use wi-fi, which was developed to facilitate Internet access on the move rather than to be used as a convenient alternative to cables in dedicated IT facilities."
UK ATL: Association of Teachers and Lecturers - more than 160,000 members (2009) http://www.telegraph.co.uk/education/educationnews/5125161/Wifi-in-school-should-be-stopped-say-teachers.html
UK PAT: Professional Association of Teachers - 35,000 members (2007) http://www.telegraph.co.uk/news/uknews/1549419/Teachers-voice-fears-of-Wi-Fi-health-risk.html
Germany GEW: Gewerkschaft Erziehung und Wissenschaft (Education and Science Workers' Union) - 260,000 members
2003 http://t.co/EQaUodrq7W
2006 http://t.co/7S0gOWoPkN
(2013) Members of 5 major unions in France which represented workers of the following large corporations and organizations protested to demand reduction of electromagnetic radiation in their work place.
http://www.20minutes.fr/ledirect/1096131/appel-syndicalistes-reduire-ondes-travail
The Bank of France
France Telecom Orange
L'Oréal (Cosmetics giant)
The City of Paris
RATP (Autonomous Operator of Parisian Transports - a state-owned public transport operation)
Geodis (A leading Transport and Logistics company in Europe)
The Bibliothèque Nationale de France (National Library of France)
Labels: #BCTF2014, 21st Century Learning, BCCPAC, BCED, bcparent, BCSTA, BCTF, BYOD, children, education, health, Kids, learning, safe, safety, school, students, technology, wifi, wireless
UCLA Study: Cellphones & Children's Headaches
6-min Video: Dr. Martin Pall to Portland Public Schools Board
Excellent presentation on WiFi's hazardous effects by Dr. Martin Pall (Professor Emeritus of Biochemistry and Basic Chemical Sciences at Washington State University; recipient of multiple honours) and researcher Merry Callahan.
Video: http://www.youtube.com/watch?v=HCAyPMVuJHY
C.V.: http://www.ncnm.edu/images/CE/Pall_CV.pdf
4-min Video: Dr. Anthony Miller to Toronto City Council
Dr. Anthony Miller (Professor Emeritus at University of Toronto's School of Public Health, renowned epidemiologist) recently presented to the Toronto City Council that classification of the cancer-causing property of cellphone/WiFi/cordless phone's non-ionizing radiation should be upgraded from 2B "Possibly Carcinogenic" to 2A "Probably Carcinogenic". He emphasized the importance of Prudent Avoidance.
Video: http://www.youtube.com/watch?v=wARxnaxrRKk
Bio: http://www.dlsph.utoronto.ca/faculty-profile/anthony-b-miller
UCLA Study Found Children at Higher Risk of Headache if they used cellphones or if their mothers used cellphones while pregnant with them
http://www.prlog.org/12269207-cell-phone-use-and-prenatal-exposure-to-cell-phone-radiation-may-cause-headaches-in-children.html
UK Expert Report
In-depth analysis of health issues resulting from the use of WiFi in schools
http://ssita.org.uk/wp-content/uploads/2014/01/SSITA-response-January-2014.pdf
The True Face of 21st Century Learning
How education became a tool for corporate profits
http://www.policyalternatives.ca/sites/default/files/uploads/publications/National%20Office/2013/02/osos110_21stCenturyLearning_0.pdf
Petition at Avaaz: Stop exposing children to radiation from WiFi and 4G in schools till proven harmless
https://secure.avaaz.org/en/petition/The_members_of_the_European_Commission_European_Parliament_Stop_exposing_children_to_radiation_from_WiFi_and_4G_until_pr/?pv=7
Labels: Allergy, Anxiety, Asthma, Breath, Child, Dizziness, Eyes, Fatigue, Headache, Hearing, Heart, Hyperactivity, Kids, Memory, Nausea, Numbness, Pain, Rashes, Sleep, Spasm
American Academy of Pediatrics: New Media Policy & Call for Protection of Children and Pregnant Women from Wireless Radiation
The American Academy of Pediatrics (AAP ) just updated their policy statement on media usage by children and youth. The new policy statement offers recommendations for parents:
Parents can model effective "media diets" to help their children learn to be selective and healthy in what they consume. Take an active role in children's media education by co-viewing programs with them and discussing values.
Make a media use plan, including mealtime and bedtime curfews for media devices. Screens should be kept out of kids' bedrooms.
Limit entertainment screen time to less than one or two hours per day; in children under 2, discourage screen media exposure.
Read more: http://www.aap.org/en-us/about-the-aap/aap-press-room/pages/Managing-Media-We-Need-a-Plan.aspx
As well, the American Academy of Pediatrics has published 3 letters in the past 2 years calling for the adoption of the Precautionary Principle by protecting children and pregnant women from radiation emitted by cellphones and wireless devices. They also demand that the FCC revises its inadequate and outdated exposure guidelines and testing protocols (which happens to be the same as Health Canada's).
The AAP represents 60,000 pediatricians and pediatric surgeons.
http://bemri.org/component/docman/cat_view/2-publications/5-biological-effects-of-non-ionizing-radiation/14-mobile-phones.html?limit=20&order=hits&dir=ASC&limitstart=0
http://www.citizensforsafetechnology.org/uploads/scribd/AAP_07-12-12%20FCC%20cell%20phone%20radiation%20ltr.pdf
http://citizensforsafetechnology.org/uploads/scribd/AAP_Letter%20to%20Kucinich_Dec%202012%20(1).pdf
Labels: 21st Century Learning, BCCPAC, BCED, bcparent, BCSTA, BCTF, BYOD, children, education, health, ipad, Kids, parenting, safe, safety, school, students, technology, wifi, wireless
iPads: How Safe Are Our Children?
TheGreenGazette July-August 2013
In the past few years, iPad has become many adults' best friend and children's babysitter. It is used as a computer, eBook reader, camera, video/music player, word processor, communication device, drawing tool, game pad, and more.
Apple says, "Read all safety information below and operating instructions before using iPad to avoid injury." The safety information provided with purchase is a small booklet of 3 1/4" x 5", with text so tiny it is practically illegible without magnifying glasses. As a result, most people have never read the following:
"iPad contains radio transmitters and receivers. When on, iPad sends and receives radio frequency (RF) energy through its antenna. The Wi-Fi and Bluetooth® antennas are located behind the screen to the left of the Home button, and behind the Apple logo... A cellular antenna is located at the top edge of iPad Wi-Fi+3G, when oriented with the Home button at the bottom."
When ifixit.com dissected a Wi-Fi+3G iPad, they discovered not three but five antennas, including the frame of the LCD screen being a giant antenna.
"... to be sure that human exposure to RF energy does not exceed the FCC, IC, and European Union guidelines, always follow these instructions and precautions: Orient the device in portrait mode with the Home button at the bottom of the display, or in landscape mode with the cellular antenna (located under the black edge at the top of the device) away from your body or other objects..."
This means if you don't handle the iPad exactly as instructed, the RF radiation can exceed governments' limits for human exposure. Unfortunately, most parents and teachers have no idea about this, and have never communicated the manufacturer's instructions to children who are using iPads.
The user manual recommends: "you can further limit your exposure by limiting the amount of time using iPad Wi-Fi+3G in wireless mode, since time is a factor in how much exposure a person receives, and by placing more distance between your body and iPad Wi-Fi + 3G, since exposure level drops off dramatically with distance."
RF/EMF: 2B Possible Carcinogen
In 2011, the International Agency for Research on Cancer (IARC) of the World Health Organization (WHO) classified radiofrequency electromagnetic fields emitted by wireless communication devices as Type 2B Possible Carcinogen to Humans. The monograph states: "The general population receives the highest exposure from transmitters close to the body... In children... deposition of RF energy may be two times higher in the brain and up to ten times higher in the bone marrow of the skull than in adult users." The WHO report concluded that additional research is important and advised the public, particularly young adults and children, to take pragmatic measures to reduce exposure.
Comparison between iPad and cellphone radiation
The published radiation level of mobile devices is called Specific Absorption Rate (SAR). An iPad on WiFi/3G has an SAR of 0.76-1.19 W/kg, compared to the SAR of an iPhone on GSM/CDMA at 0.547-1.18 W/kg. Many other cellphones have even lower SAR value than the iPhone.
Governments of some countries including Canada have issued warnings on children's use of cellphones. With iPad's radiation level being similar to cellphones, the same caution should be taken. Health Canada, "encourages parents to reduce children's RF exposure... since children are typically more sensitive" and "there is currently a lack of scientific information regarding the potential health impacts of cellphones on children."
Health Canada advises the following: Limit the length of cellphone calls; replace cellphone calls with text messages or use hands-free devices; and encourage children under the age of 18 to limit their cell phone usage.
Just as we would not put an actively transmitting cellphone against a child's head for hours a day, we should not put an actively transmitting iPad against the reproductive organ or other parts of a child's body for hours a day.
900 blasts of radiofrequency per hour
When the WiFi antenna in an iPad is turned on, it emits a burst of radiofrequency approximately every four seconds. That makes 900 blasts per hour in the child's hands, on his lap, or at his face. This does not include any additional data signals resulting from uploading and downloading activities. Moreover, the blasts at four-second intervals occur even when the user is not accessing the Internet. In other words, even if a child is only using the iPad to draw or to play a game, he still receives 900 blasts an hour as long as the WiFi antenna is left on.
Between 2008 and 2011, the European Union Parliament and the Council of Europe passed multiple resolutions against the "early, ill-considered, and prolonged use of mobiles and other devices emitting microwaves." Many medical associations in North America and Europe have also issued public statements to warn about the serious health risks associated with using wireless devices. Among them, the American Academy of Environmental Medicine wrote:
"In September 2010, the Journal of the American Society for Reproductive Medicine - Fertility and Sterility reported that only four hours of exposure to a standard laptop using WiFi caused DNA damage to human sperm."
"Multiple studies correlate radiofrequency exposure with diseases such as cancer, neurological disease, reproductive disorders, immune dysfunction, and electromagnetic hypersensitivity... Other neurological and cognitive disorders such as headaches, dizziness, tremors, decreased memory and attention, autonomic nervous system dysfunction, decreased reaction times, sleep disturbances, and visual disruptions have been reported to be statistically significant in multiple epidemiological studies with radiofrequency exposure occurring non-locally."
With the proliferation of the wireless industry, it might not be possible to eliminate all sources of RF radiation. However, a good start is to follow the European parliaments' advice for an exposure level called A.L.A.R.A. (as low as reasonably achievable). The following resolution was adopted by the BC Confederation of Parent Advisory Council this year. While these steps were proposed for schools, they are also useful for reduction of unnecessary exposure at home:
1. to provide on/off switches to WiFi routers;
2. to establish a protocol of use that
(i) WiFi routers and WiFi/3G functions of computers/laptops/tablets are to be turned on only when they are needed for access to the Internet via the wireless network; and,
(ii) Bluetooth function is to be turned on only if it is needed for accessing other Bluetooth-enabled devices.
3. to observe safety warnings and follow safety instructions in the user manual of iPad by reducing the duration of use under wireless mode and keeping the iPads away from the students' bodies.
Note that putting an iPad on airplane mode will initially turn off all antennas on the iPad. However, WiFi and bluetooth antennas can be re-enabled without switching off the airplane mode. Therefore, an iPad showing airplane mode "on" is not a guarantee that all the antennas are off. It is important to check the antennas separately. In addition, when the WiFi function on an iPad shows "Not Connected," it does not mean the antenna is off. It only means the iPad is not logged onto any available wireless network. To ensure the WiFi antenna is turned off, the WiFi function must read "off."
Differences between the iPad and an AM/FM Radio
The "radio" frequency emitted by iPad is often confused with AM/FM radio waves. The two actually differ in the following ways: (1) AM/FM radio utilizes analogue signals with a continuous waveform (see diagram below). iPad (via 3G or WiFi) emits digital signals in the form of pulsed microwave, similar to cellphone and DECT cordless phones. Pulsed microwave digital signal has sharp spikes in its waveform. (2) AM/FM radio is one-way transmission, with the listeners at the receiving end only. iPad antennas, on the other hand, work in constant two-way communication. iPad is not only a receiver but also a transmitter of pulsed microwave. The user of an iPad on wireless mode is in direct or close contact with the pulsed microwave signal at its source, which is the strongest.
Graphic adapted from EMfields.
Reference for this article: http://goo.gl/AHE1Z For more information on wireless radiation, its health effects and scientific basis, and video of RF measurements, please visit the following websites: www.safeinschool.org, www.wiredchild.org, www.citizensforsafetechnology.org
TheGreenGazette
Solutions for living green and achieving self-sufficiency https://interactivepdf.uniflip.com/2/60627/289518/pub/
Lisa Bland, Publisher / Editor-in-Chief: info@thegreengazette.ca
Download this article in a flyer format:
http://citizensforsafetechnology.org/uploads/scribd/iPads-are-they-safe-for-children-Flyer.pdf
More Health and Safety Warnings from the iPad User Manual:
Seizures, Blackouts, and Eyestrain
A small percentage of people may be susceptible to blackouts or seizures (even if they have never had one before) when exposed to flashing lights or light patterns such as when playing games or watching video. If you have experienced seizures
or blackouts or have a family history of such occurrences, you should consult a physician before playing games or watching videos on your iPad. Discontinue use of iPad and consult a physician if you experience headaches, blackouts, seizures, convulsion, eye or muscle twitching, loss of awareness, involuntary movement, or disorientation. To reduce risk of headaches, blackouts, seizures, and eyestrain, avoid prolonged use, hold iPad some distance from your eyes, use iPad in a well-lit room, and take frequent breaks.
Glass Parts
The outside cover of the iPad screen is made of glass. This glass could break if iPad is dropped on a hard surface or receives a substantial impact. If the glass chips or cracks, do not touch or attempt to remove the broken glass and stop using iPad. Glass cracked due to misuse or abuse is not covered under the warranty.
Radio Frequency Interference
Radio-frequency emissions from electronic equipment can negatively affect the operation of other electronic equipment, causing them to malfunction... the wireless transmitters and electrical circuits in iPad Wi-Fi + 3G may cause interference in other electronic equipment. Therefore, please take the following precautions:
Use of iPad may be prohibited while traveling in aircraft.
For more information about using Airplane Mode to turn off the iPad wireless transmitters, see the iPad User Guide.
Radio frequency emissions from iPad may affect electronic systems in motor vehicles. Check with the manufacturer or its representative regarding your vehicle.
Pacemakers
The Health Industry Manufacturers Association recommends that a minimum separation of 15 cm (6 inches) be maintained between a handheld wireless phone and a pacemaker to avoid potential interference with the pacemaker.
Persons with pacemakers: Should always keep iPad more than 15 cm (6 inches) from the pacemaker when the wireless device is turned on.
If you have any reason to suspect that interference is taking place, turn iPad off
immediately (press and hold the Sleep/Wake button, and then slide the onscreen slider).
If you use any other personal medical device, consult the device manufacturer or your physician to determine if it is adequately shielded from radio frequency emissions from iPad.
Hospitals and health care facilities may use equipment that is particularly sensitive to external radio frequency emissions. Turn iPad off when staff or posted signs instruct you to do so.
Blasting Areas and Posted Facilities
To avoid interfering with blasting operations, turn off iPad when in a "blasting area" or in areas posted "Turn off two-way radio." Obey all signs and instructions.
http://manuals.info.apple.com/MANUALS/1000/MA1562/en_US/iPad_iOS4_Important_Product_Info.pdf
EHS Children Forced from Schools - Legal Appeal to School Board
Go to EHS Parents page
The Sooke School District #62 (BC) has denied the appeal of three young children with an environmental intolerance, medically known as electromagnetic hypersensitivity (EHS). EHS is caused by exposure to Wi-Fi (wireless internet) and other devices emitting microwave, radio frequency radiation. Symptoms commonly associated with microwave sickness include headaches, fast heart rate, chest pain, dizziness, nausea, concentration and memory problems, anxiety, sleep disorders, extreme fatigue, tremors, reoccurring infection, impaired immune function, skin rash, facial flushing, abdominal pain, nosebleeds, ringing in the ears, and more.
Since there is currently NO school in Sooke that is free of Wi-Fi networks, these children have been forced to leave not only their respective schools but the district as well. The parents have formally brought the issue forward, without success, to every level within the school system. Despite their doctors' written requests for the children to avoid Wi-Fi emissions, their medical circumstances have been consistently ignored and denied by the school district. At this time, the parents are appealing their district's decision to the BC Ministry of Education so that their children will be able to return to school. There is no place for discrimination in schools, and a safe learning environment is a right afforded to all Canadian children.
In order to prevent the onset of specific EHS symptoms, the children's parents are asking that their school board provide them with one school in their district that is free of wireless radiation. This would necessitate the use of hardwired communications within that school to make phone calls and to access the Internet.
It is important to note that in May of 2012, in order to accommodate children with EHS and to provide choice for parents who want to heed health warnings to reduce exposure for children who are most vulnerable, the BC Confederation of Parent Advisory Councils (BCCPAC) called for a moratorium on Wi-Fi in schools, and for a minimum of one school in each district at each level to be free of Wi-Fi.
BCCPAC Resolutions:
http://www.bccpac.bc.ca/resolutions/wi-fi-classrooms-committee-report
http://www.bccpac.bc.ca/resolutions/parent-choice-regarding-exposure-emf-emissions-src-safety-wi-fi-committee
School districts continue to ignore these resolutions and the voices of many concerned parents.
We are asking now for your support. An attorney specializing in this field has been engaged to represent the concerned families in this appeal process. The projected cost of legal fees is estimated at $5,000. Your donations will help to fund this important legal challenge.
Children in many parts of Canada are faced with this same injustice. If accommodation is achieved in this case, through this appeal process, it will be precedent-setting for other school districts in B.C. and Canada.
CHRC Report: Medical Perspective on Environmental Sensitivities (RF/EMF legitimate trigger for ill symptoms)
http://www.chrc-ccdp.ca/sites/default/files/envsensitivity_en.pdf
The Canadian Human Rights Commission recommends accommodation for those with EHS through reasonable measures such as hard wired communications in the working/school environment.
Another video of interest: Wi-Fi in Schools-The Facts (18 min) Note: Australia's A.R.P.A.N.S.A = Health Canada (Safety Code 6)
http://www.youtube.com/watch?v=kmcAXZ-o1K4&;list=FLI_8xq3QcBTrnb4665kpsNA
For more info on Wi-Fi health effects:
http://www.safeinschool.org
http://www.citizensforsafetechnology.org
New WiFi Resolution Adopted by BCCPAC AGM 2013
1. BCCPAC 2013 Resolution: On/Off Switches for WiFi Routers and Protocol for Use of Wireless Devices
Adopted by strong majority votes (140-94) on May 4, 2013. Last year, the two resolutions passed by BCCPAC called for a halt in installing wireless network where other networking solutions are feasible, and for the creation of at least one fully-wired school at each level per school district. This 2013.11 resolution focuses on schools which already have WiFi installed and cannot get it removed right now. The British Columbia Confederation of Parent Advisory Councils (BCCPAC) represents 670+ public school PACs and district PACs in the province in 2013.
Please read the resolution along with the rationale which contains important safety information not just for the school environment, but for homes as well. Please share this information with parents, grandparents, teachers, school administrators and school board trustees. We demand that safety protocol be put in place.
http://citizensforsafetechnology.org/BCCPAC-Resolution-Passed-OnOff-Switches-for-WiFi-Routers-and-Protocol-for-the-Use-of-Wireless-Devices-in-Schools,19,3111
2. SD8 respects Winlaw Parents - turns off WiFi
http://www.nelsonstar.com/news/206826071.html
3. Former Microsoft Canada President agrees School WiFi is a Potential Health Hazard
http://www.bizjournals.com/prnewswire/press_releases/2013/05/09/C5138
4. Neuroscientist Baroness Susan Greenfield:
Increased Screen Time associated with Negative Changes to Children's Brains
http://www.youtube.com/watch?v=ri4_CW9P41s&feature=youtu.be&t=10m6s&noredirect=1
5. WiFi in Schools - a Teacher's Perspective
http://www.staffroomconfidential.com/2013/04/wifi-in-schools.html
6. Canada's Spokesperson for WiFi Safety is Funded by Wireless Telecom Industry
http://www.safeinschool.org/2013/04/conflict-of-interest-influences-emf.html
7. Dr. Devra Davis addresses the National Institute of Environmental Health Sciences (NIEHS) on Cellphone Radiation
http://goo.gl/I9OOi
8. Experts Adopted New Resolutions on Pulsed Radiofrequency Radiation:
"WiFi should not be placed in schools..."
http://saferemr.blogspot.ca/2013/04/experts-adopt-two-resolutions-about.html
Labels: 21st Century Learning, BCED, bcparent, BCSTA, BCTF, BYOD, children, Conflict of interest, education, EMF project, health, Krewski, McLaughlin, safety, school, students, technology, wifi, wireless
Tweets by @SafeinSchoolOrg
1) VIDEO: Pulsed Microwave of iPad
2) VIDEO: WiFi Router Radiation Measurement
3) 2012 Expert Witness Testimonies to U.S. Court concerning Removal of Wi-Fi in Public Schools
4) VIDEO: WiFi in Schools - The FactsWireless computer network in class simulation
5) VIDEOS: iPad iPhone Laptop Radiation Measurements
中文网页: 电磁微波辐射与孩子健康
Reference for SD Trustees
Scientific Studies 科研报告
Practical Ways to Reduce EMF Radiation 下载传单 Flyers...
The Precautionary Principle 预防原则
Microwave Exposure Limits - Countries Comparison
翻譯:请于以下按"Select Language"
然后选择 "Chinese Simplified" (简体中文)
或"Chinese Tradtional"(繁體中文) 翻譯
Select a language:简体中文Chinese Simplied繁體中文Chinese TraditionalEspañolDeutscheFrançaisItalianoPortuguêsArabicJapaneseKoreanRussianSwedishGermanRussianDanishGreekPolishHebrew
CLICK to Email us 按此电邮与我们联络 To connect with other Parents in your School District, email our Friends at Parents For Safe Schools or visit their Facebook Page
- Click on trangles next to months below to view all Titles
Teachers' Unions in Germany, UK, USA and Canada Wh...
Studies on Biological and Cellular Damage by Microwave & Radiofrequency Radiation
Israel's Position Paper on Electromagnetic Radiation in a School Environment
Dr. George Carlo speaks on Wi-Fi Radiation in Schools
LATEST WARNING: Wi-Fi Dangerous to Children and Pregnant Women
The Essential Message
Surprise! China's Safety Standard >100 times stricter than Canada's
International Warnings on Wi-Fi and Microwave Radiation
Removal of Wi-Fi from Schools and Libraries in Canada and Other Countries
Wi-Fi in the Education Environment
Protect your children from cell phone and WiFi radiation before it's too late
A letter to "Concerned Parent" on WLAN (Wi-Fi)
Children's Exposure to Microwave Radiation - A letter to the Sooke School Board
Children are Particularly Susceptible to the Harm of Wi-Fi
Wi-Fi Concerns Should Lead to Updated Regulations - A Letter by Carol Hughes, MP
How to reduce Wi-Fi (Microwave) Radiation on our Children
Mobile Learning and Health Risks Slideshow by University of Tampere, Finland
The World Health Organization
We are not alone! Victoria School District is re-evaluating the safety of Wi-Fi
The current debate on Wi-Fi being installed in schools without Parents' consent
Electromagnetic Induction by Wi-Fi causes Human Tissue to Polarize at Twice the Frequency
At a Glance - The issue of Wi-Fi in School
SafeInSchool.org

redpajama_set_name: RedPajamaCommonCrawl


text:
Is 'Game of Thrones' Final Season Teasing a Major Location's Fall?
Kevin Fitzpatrick Published: December 12, 2017
Even if it takes us until 2019 to get there, Game of Thrones is placing every card on the table for its final season. The White Walkers are loose and the endgame fast approaching, and – if John Bradley is to be believed – we have serious reason to fear that major characters will be scattered all over the map this year.
Series star John Bradley offered a cryptic bit of intel on the eighth and final season to TVGuide; namely that "Each of the characters this year is placed in a completely alien environment at some point in the season that they've never been placed in before." On the one hand, his words could be taken to imply that each character finds themselves in unfamiliar situations, but more likely that everyone will end up leaving the last locations we saw them in. The full quote, for context:
These characters are so detailed and so rich, you can feel that you've got a pretty good handle on your character. You can predict how your character will react in any given circumstance, but when you place these characters in a new environment, it's always putting them under a microscope, and you constantly have to reexamine your character. Each of the characters this year is placed in a completely alien environment at some point in the season that they've never been placed in before. The thrill is seeing how they react to it and how they respond… This season, I think, more than any other is stretching these characters.
There are a few interpretations to unpack here. Most urgently, perhaps, is that the Night King's army finally breached The Wall in Season 7's finale, and will likely come upon the major northern locations first. Winterfell is certainly high among those targets, and if we were to imagine anything displacing Sansa, Arya, Bran and Sam to "completely alien environments" in Season 8, it might be the destruction of their ancestral home. Similar concerns can be raised about King's Landing, given that Queen Cersei rarely travels outside the city for any reason, and Season 1 Daenerys saw a vision of a snow-ravaged throne room.
It's always possible Bradley didn't mean his comments so literally, or that certain characters might change locations one at a time (Bran can also "travel" anywhere in history), but should we be worried for any of our favorite locations when Game of Thrones returns in 2019?
16 Lingering 'Game of Thrones' Questions That Need to Be Addressed in Season 8
Source: Is 'Game of Thrones' Final Season Teasing a Major Location's Fall?
Eagle Point Park Listed in National Register of Historic Places
Four Injured, Suspect in Custody After Morning Explosion at New York City's Port Authority Bus Terminal
A Big 'Legends of Tomorrow' Shakeup Will Push 'Supergirl' Season 3 to June
5 Creative Ways to Dress up a Gift Card
Actress Accuses Dustin Hoffman of Sexual Misconduct on Broadway
Beyonce's Local Target Run Goes Viral on Twitter
Patrick Stewart Wants in On Quentin Tarantino's 'Star Trek'
Ed Sheeran Got Too Handsy With Prince Charles and Breached Royal Protocol
'X-Men' Director Bryan Singer Sued for Alleged Rape


We have been also specializing in improving the things administration and QC system to ensure that we could preserve terrific gain within the fiercely-competitive company for Cotton Rayon Blend Fabric , Cotton Blend Fabric , cotton rayon blend fabric , We welcome all with the clients and buddies to get in touch with us for mutual gains. Hope to do more enterprise with you.
"Our progress depends on the highly developed products ,great talents and repeatedly strengthened technology forces for Cotton Rayon Blend Fabric , Cotton Blend Fabric , cotton rayon blend fabric , because of our company has been persisting in the management idea of "Survival by Quality Development by Service Benefit by Reputation". We fully realize the good credit standing the high quality products the reasonable price and the professional services are the reason that the customers choose us to be their long-term business partner.


Purchase your tickets online and in advance at orlando.halloweenhorrornights.com to save time during your trip and money.
Download the official Universal Orlando Resort mobile application on the App Store or Google Play Store to view wait times for houses at the event. You can use the app to easily view which houses have short lines and long lines. You can use this information to decide which houses to experience.
Arrive by at least 4:45 PM to be one of the first into the park. You'll be permitted to enter the park about 30 minutes before the event officially starts. If you're staying at a Universal Orlando on-site hotel, take advantage of the designated entrance for on-site hotel guests.
If you're visiting Universal Studios Florida during the daytime, stay in the park and wait at a designated "Stay and Scream" location. This is the best way to get the most out of your night. As the park transitions its operations for Halloween Horror Nights, you'll be permitted to stay inside the park. You'll also be permitted into select houses before guests at the park turnstiles. This will give you the chance to visit more houses early in the night.
If your budget allows for higher costs, we highly advise purchasing a Halloween Horror Nights Express pass to drastically reduce your time in lines. It should be noted that you are only permitted to use the Express pass once per house. Due to this, we suggest using the regular line if the posted wait time is below 30 minutes and you interested in revisiting the house. You can then use the Express line afterward when the regular line has a longer wait time.
Consider purchasing a Coca-Cola Freestyle cup if you plan to have soft drinks. They allow you to pay a single price for a cup and enjoy unlimited beverages for an entire day.
Drink cool beverages throughout the night to stay hydrated. You can purchase a Coca-Cola Freestyle cup for unlimited refills of soft drinks or take advantage of free cups of water at any dining location.
When visiting houses before dusk, wear sunglasses. This will make it easier to adjust to the dark environment inside some houses when the sun is still out. They may also help darken the environment in houses that are situated in tents.