= Jerry Tubbs has accepted this invitation.

Unveillance Demo for= Westfield Insurance

1. Please join my meeting, Monday, May 23 a= t 2:30 PM Central Daylight Time.
h= ttps://www2.gotomeeting.com/join/147526458

2. Use your microphone an= d speakers (VoIP) - a headset is recommended. Or, call in using your telep= hone.

Dial +1 (312) 878-3078
Access Code: 147-526-458
Audio PIN= : Shown after joining the meeting

Meeting ID: 147-526-458

Who

When

Mon = May 23 3:30pm =96 4:30pm Eastern Time

Where

GoToMe= eting Session (map)

Calendar

khijazi@unveillance.com

•	Karim Hijazi - organiz= er
•	Andy Gabriel
•	johnbrady@westfieldgrp.com =
•	jtubbs@unveillance.com
•	<= div> Jim Weiss

Invitation from Google Calendar

<= p>You are receiving this email at the account khijazi@unveillance.com becau= se you are subscribed for invitation replies on calendar khijazi@unveillanc= e.com.

To stop receiving these notifications, please log in to https:= //www.google.com/calendar/hosted/unveillance.com/ and change your notificat= ion settings for this calendar.

--0016e640d1561aa27a04a3b9b730 Content-Type: text/calendar; charset=UTF-8; method=REPLY Content-Transfer-Encoding: 7bit BEGIN:VCALENDAR PRODID:-//Google Inc//Google Calendar 70.9054//EN VERSION:2.0 CALSCALE:GREGORIAN METHOD:REPLY BEGIN:VEVENT DTSTART:20110523T193000Z DTEND:20110523T203000Z DTSTAMP:20110520T185903Z ORGANIZER;CN=Karim Hijazi:mailto:khijazi@unveillance.com UID:5u4gshs0sm7ajtbal071ck9dmg@google.com ATTENDEE;CUTYPE=INDIVIDUAL;ROLE=REQ-PARTICIPANT;PARTSTAT=ACCEPTED;CN=jtubbs @unveillance.com;X-NUM-GUESTS=0:mailto:jtubbs@unveillance.com CREATED:20110520T185745Z DESCRIPTION:1. Please join my meeting\, Monday\, May 23 at 2:30 PM Central Daylight Time.\nhttps://www2.gotomeeting.com/join/147526458\n\n2. Use you r microphone and speakers (VoIP) - a headset is recommended. Or\, call in using your telephone.\n\nDial +1 (312) 878-3078\nAccess Code: 147-526-458\n Audio PIN: Shown after joining the meeting\n\nMeeting ID: 147-526-458 LAST-MODIFIED:20110520T185902Z LOCATION:GoToMeeting Session SEQUENCE:0 STATUS:CONFIRMED SUMMARY:Unveillance Demo for Westfield Insurance TRANSP:OPAQUE CATEGORIES:http://schemas.google.com/g/2005#event BEGIN:VALARM ACTION:DISPLAY DESCRIPTION:This is an event reminder TRIGGER:-P0DT0H30M0S END:VALARM END:VEVENT END:VCALENDAR --0016e640d1561aa27a04a3b9b730-- --0016e640d1561aa28204a3b9b732 Content-Type: application/ics; name="invite.ics" Content-Disposition: attachment; filename="invite.ics" Content-Transfer-Encoding: base64 QkVHSU46VkNBTEVOREFSDQpQUk9ESUQ6LS8vR29vZ2xlIEluYy8vR29vZ2xlIENhbGVuZGFyIDcw LjkwNTQvL0VODQpWRVJTSU9OOjIuMA0KQ0FMU0NBTEU6R1JFR09SSUFODQpNRVRIT0Q6UkVQTFkN CkJFR0lOOlZFVkVOVA0KRFRTVEFSVDoyMDExMDUyM1QxOTMwMDBaDQpEVEVORDoyMDExMDUyM1Qy MDMwMDBaDQpEVFNUQU1QOjIwMTEwNTIwVDE4NTkwM1oNCk9SR0FOSVpFUjtDTj1LYXJpbSBIaWph emk6bWFpbHRvOmtoaWphemlAdW52ZWlsbGFuY2UuY29tDQpVSUQ6NXU0Z3NoczBzbTdhanRiYWww NzFjazlkbWdAZ29vZ2xlLmNvbQ0KQVRURU5ERUU7Q1VUWVBFPUlORElWSURVQUw7Uk9MRT1SRVEt UEFSVElDSVBBTlQ7UEFSVFNUQVQ9QUNDRVBURUQ7Q049anR1YmJzDQogQHVudmVpbGxhbmNlLmNv bTtYLU5VTS1HVUVTVFM9MDptYWlsdG86anR1YmJzQHVudmVpbGxhbmNlLmNvbQ0KQ1JFQVRFRDoy MDExMDUyMFQxODU3NDVaDQpERVNDUklQVElPTjoxLiAgUGxlYXNlIGpvaW4gbXkgbWVldGluZ1ws IE1vbmRheVwsIE1heSAyMyBhdCAyOjMwIFBNIENlbnRyYWwNCiAgRGF5bGlnaHQgVGltZS5cbmh0 dHBzOi8vd3d3Mi5nb3RvbWVldGluZy5jb20vam9pbi8xNDc1MjY0NThcblxuMi4gIFVzZSB5b3UN CiByIG1pY3JvcGhvbmUgYW5kIHNwZWFrZXJzIChWb0lQKSAtIGEgaGVhZHNldCBpcyByZWNvbW1l bmRlZC4gIE9yXCwgY2FsbCBpbiANCiB1c2luZyB5b3VyIHRlbGVwaG9uZS5cblxuRGlhbCArMSAo MzEyKSA4NzgtMzA3OFxuQWNjZXNzIENvZGU6IDE0Ny01MjYtNDU4XG4NCiBBdWRpbyBQSU46IFNo b3duIGFmdGVyIGpvaW5pbmcgdGhlIG1lZXRpbmdcblxuTWVldGluZyBJRDogMTQ3LTUyNi00NTgN CkxBU1QtTU9ESUZJRUQ6MjAxMTA1MjBUMTg1OTAyWg0KTE9DQVRJT046R29Ub01lZXRpbmcgU2Vz c2lvbg0KU0VRVUVOQ0U6MA0KU1RBVFVTOkNPTkZJUk1FRA0KU1VNTUFSWTpVbnZlaWxsYW5jZSBE ZW1vIGZvciBXZXN0ZmllbGQgSW5zdXJhbmNlDQpUUkFOU1A6T1BBUVVFDQpDQVRFR09SSUVTOmh0 dHA6Ly9zY2hlbWFzLmdvb2dsZS5jb20vZy8yMDA1I2V2ZW50DQpCRUdJTjpWQUxBUk0NCkFDVElP TjpESVNQTEFZDQpERVNDUklQVElPTjpUaGlzIGlzIGFuIGV2ZW50IHJlbWluZGVyDQpUUklHR0VS Oi1QMERUMEgzME0wUw0KRU5EOlZBTEFSTQ0KRU5EOlZFVkVOVA0KRU5EOlZDQUxFTkRBUg0K --0016e640d1561aa28204a3b9b732-- From - Sat May 21 19:21:57 2011 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Delivered-To: khijazi@unveillance.com Received: by 10.224.45.145 with SMTP id e17cs192645qaf; Fri, 20 May 2011 12:12:18 -0700 (PDT) Received: by 10.150.135.13 with SMTP id i13mr661436ybd.280.1305918738015; Fri, 20 May 2011 12:12:18 -0700 (PDT) Return-Path: Received: from gateout02.mbox.net (gateout02.mbox.net [165.212.64.22]) by mx.google.com with ESMTPS id v21si1289646ybd.73.2011.05.20.12.12.16 (version=TLSv1/SSLv3 cipher=OTHER); Fri, 20 May 2011 12:12:16 -0700 (PDT) Received-SPF: neutral (google.com: 165.212.64.22 is neither permitted nor denied by best guess record for domain of jhunt@mitagroup.com) client-ip=165.212.64.22; Authentication-Results: mx.google.com; spf=neutral (google.com: 165.212.64.22 is neither permitted nor denied by best guess record for domain of jhunt@mitagroup.com) smtp.mail=jhunt@mitagroup.com Received: from gateout02.mbox.net (gwo2-lo [127.0.0.1]) by gateout02.mbox.net (Postfix) with ESMTP id 456044BC463 for ; Fri, 20 May 2011 19:12:16 +0000 (GMT) X-USANET-Received: from gateout02.mbox.net [127.0.0.1] by gateout02.mbox.net via mtad (C8.MAIN.3.72B) with ESMTP id 749PeTTmN1424Mo2; Fri, 20 May 2011 19:12:13 -0000 Received: from S1HUB5.EXCHPROD.USA.NET [165.212.120.254] by gateout02.mbox.net via smtad (C8.MAIN.3.72B) with ESMTPS id XID929PeTTmN7874Xo2; Fri, 20 May 2011 19:12:13 -0000 X-USANET-Source: 165.212.120.254 IN jhunt@mitagroup.com S1HUB5.EXCHPROD.USA.NET X-USANET-MsgId: XID929PeTTmN7874Xo2 Received: from MBX6.EXCHPROD.USA.NET ([10.120.221.61]) by S1HUB5.EXCHPROD.USA.NET ([10.120.220.35]) with mapi; Fri, 20 May 2011 19:12:05 +0000 From: James Hunt To: Karim Hijazi Unveillance Email Date: Fri, 20 May 2011 19:11:39 +0000 Subject: Read: Going after Foster Wheeler Thread-Topic: Going after Foster Wheeler Thread-Index: AcwXIag6ycYAMwyWQmeVAUQ7DYksmAAABavQ Message-ID: In-Reply-To: <4DD6BCC3.4050708@unveillance.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: multipart/report; boundary="_000_B41C53427D44E140AFB94BCBDEE1781A09F315BE54MBX6EXCHPRODU_"; report-type=disposition-notification MIME-Version: 1.0 --_000_B41C53427D44E140AFB94BCBDEE1781A09F315BE54MBX6EXCHPRODU_ Content-Type: multipart/alternative; boundary="_002_B41C53427D44E140AFB94BCBDEE1781A09F315BE54MBX6EXCHPRODU_" --_002_B41C53427D44E140AFB94BCBDEE1781A09F315BE54MBX6EXCHPRODU_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Your message was read on Friday, May 20, 2011 7:11:39 PM UTC. --_002_B41C53427D44E140AFB94BCBDEE1781A09F315BE54MBX6EXCHPRODU_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Your message was read on Friday, = May 20, 2011 7:11:39 PM UTC.

--_002_B41C53427D44E140AFB94BCBDEE1781A09F315BE54MBX6EXCHPRODU_-- --_000_B41C53427D44E140AFB94BCBDEE1781A09F315BE54MBX6EXCHPRODU_ Content-Type: message/disposition-notification Final-recipient: RFC822; jhunt@mitagroup.com Disposition: automatic-action/MDN-sent-automatically; displayed X-MSExch-Correlation-Key: SZCM+Bt2uk+G31KsnNhlng== X-Display-Name: James Hunt --_000_B41C53427D44E140AFB94BCBDEE1781A09F315BE54MBX6EXCHPRODU_-- From - Sat May 21 19:21:57 2011 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-Path: Received: from [192.168.1.107] (c-76-31-218-178.hsd1.tx.comcast.net [76.31.218.178]) by mx.google.com with ESMTPS id s8sm1169188ank.2.2011.05.20.10.05.30 (version=SSLv3 cipher=OTHER); Fri, 20 May 2011 10:05:30 -0700 (PDT) Message-ID: <4DD69F60.9060006@unveillance.com> Disposition-Notification-To: Karim Hijazi Unveillance Email Date: Fri, 20 May 2011 12:05:36 -0500 From: Karim Hijazi Unveillance Email Reply-To: khijazi@unveillance.com Organization: Unveillance User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2.17) Gecko/20110414 Lightning/1.0b2 Thunderbird/3.1.10 MIME-Version: 1.0 To: adam.sindelar@accenture.com CC: jtubbs@unveillance.com, jason.lewkowicz@accenture.com, jaroslav.vorlicek@accenture.com, carlo.farinella@accenture.com, mthompson@unveillance.com, mmolloy@unveillance.com Subject: Re: sinkhole traffic References: <4F2F24C83AFEAE42B94895F1028061990125F21A528D@EMEXM3133.dir.svc.accenture.com> <5585926455904866475@unknownmsgid> <4F2F24C83AFEAE42B94895F1028061990125F21A5BE3@EMEXM3133.dir.svc.accenture.com> In-Reply-To: <4F2F24C83AFEAE42B94895F1028061990125F21A5BE3@EMEXM3133.dir.svc.accenture.com> X-Enigmail-Version: 1.1.1 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Adam, No worries my friend, and thank you for the understanding. As promised, here are the destination IPs that should help make your life easier: 66.228.49.83 173.230.146.33 I will keep you informed as to when the interface will display these details. In that you are very dilligent with the system, I am sure you will see it as soon as it is available! Thanks again Adam, and as always don't hesitate to call on us for anything. All the best, Karim On 5/20/2011 10:27 AM, adam.sindelar@accenture.com wrote: > Karim, > > > > Thank you ? having access to the sinkhole ranges via the web interface > will be very helpful. I fully understand and appreciate your comments > about your reasons for being careful with this information. > > > > However, we are currently working on addressing the IRC bot traffic > Unveillance detected from our asset 170.252.198.8 and are having > troubles isolating the offending device due to the sheer volume of > traffic over that interface. Do you think it would be possible for you > to let us know the destination IP of that particular detection before > that information becomes available through the web interface? > > > > Thank you and regards, > > Adam > > > > *Adam Sindelar* > > * * > > *ISIRT* > > *Information Technology Risk > Accenture * > > * * > > *Office: +420.225.07.7758* > > *OC: +420.910.90.1152* > > > > *adam.sindelar@accenture.com * > > * * > > *Prague, Czech Republic* > > > > > > *From:*Karim Hijazi [mailto:khijazi@unveillance.com] > *Sent:* Thursday, May 19, 2011 2:18 PM > *To:* Sindelar, Adam > *Cc:* ; Lewkowicz, Jason; Vorlicek, Jaroslav; > Farinella, Carlo; Matt Thompson; mmolloy@unveillance.com > *Subject:* Re: sinkhole traffic > > > > Adam, > > > > Thank you for your email. We will begin providing destination > information via the interface shortly. We fully understand the > difficulty in locating infections utilizing port 80/TCP. > > > > Candidly, the reason we have been tentative is that with a number of > other, less informed clients, the information (destination IP, domain, > port) has been used to simply block access to our sinkhole resulting in > a self-defeating situation. Furthermore, it has rendered a few clients > to believe we are not tracking adequately (oddly enough due to their > filtering) and question the value of the Unnveillance platform. Quite a > dilemma for us as you can imagine! > > > > Obviously, there is no way we can enforce usage of such information. > All we can do is kindly request that you utilize the details of the > destination IP address/domain for the intended use, such as correlation > with NATed device logs or SIEM for example; not to be used to block > communication to our sinkholes as that simply blinds us and facilitates > further compromise. > > > > Should you have any creative ideas on how we might be able to mitigate > this issue with other clients, I would be interested in hearing your > collective thoughts. > > > > In conclusion, we will get the details to you shortly. I apologize for > the extra effort this may have caused on your part and hope you > understand our reasoning thus far. > > > > -- > > All the best, > > > > Karim Hijazi > > CEO | President > > Unveillance > > O. (800) 540-8478 > > M. (561) 542-5704 > > www.unveillance.com > > khijazi@unveillance.com > > > > ******************************************** > > CONFIDENTIAL & PRIVILEGED COMMUNICATION This message is for the named > > person's use only. The information contained in this communication is > > confidential and/or privileged, proprietary information that is > > transmitted solely for the purpose of the intended recipient(s). No > > confidentiality or privilege is waived or lost by any > > mistransmission. If you receive this message in error, please > > immediately delete it and all copies of it from your system, destroy > > any hard copies of it and notify the sender. You must not, directly or > > indirectly, use, disclose, distribute, print, or copy any part of this > > message if you are not the intended recipient. The sender or any of > > its subsidiaries each reserve the right to monitor all e-mail > > communications through its networks. > > ******************************************** > > > On May 19, 2011, at 5:13 AM, > wrote: > > Hi Jerry, > > > > We?re working on addressing the incident your system raised for our > asset at 170.252.123.161. This is another case where the traffic > went over 80/tcp and knowing the destination IP range would help us > greatly reduce the volume of information we have to analyze. Do you > think you could please share with me whether this is the standard > Defintel Sinkhole (67.xxxxxxx) or a different IP range? > > > > Thank you and regards, > > Adam > > > > *Adam Sindelar* > > * * > > *ISIRT* > > *Information Technology Risk > Accenture * > > * * > > *Office: +420.225.07.7758* > > *OC: +420.910.90.1152* > > > > *adam.sindelar@accenture.com * > > * * > > *Prague, Czech Republic* > > > > > > > > ------------------------------------------------------------------------ > > This message is for the designated recipient only and may contain > privileged, proprietary, or otherwise private information. If you > have received it in error, please notify the sender immediately and > delete the original. Any other use of the email by you is prohibited. > - -- All the best, Karim Hijazi CEO | President Unveillance O. (800) 540-8478 M. (561) 542-5704 www.unveillance.com khijazi@unveillance.com ******************************************** CONFIDENTIAL & PRIVILEGED COMMUNICATION This message is for the named person's use only. The information contained in this communication is confidential and/or privileged, proprietary information that is transmitted solely for the purpose of the intended recipient(s). No confidentiality or privilege is waived or lost by any mistransmission. If you receive this message in error, please immediately delete it and all copies of it from your system, destroy any hard copies of it and notify the sender. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. The sender or any of its subsidiaries each reserve the right to monitor all e-mail communications through its networks. ******************************************** -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (MingW32) iQEcBAEBAgAGBQJN1p9gAAoJEIk0Dw4U/G3lcFYIAIZzwCEZ20GTr7LerKj3T60k YDcC6fW9M1uJhUnzHapCYlDHvgtRGrvsf1iwG5DTa3+Tb3H+BLcfLjw6TbZ1R4gm kPzJu38Pwe7SOBDpvOneARdfxUvtKn/vg/aNeHnM8NvmuDZCtQ+TkaGTanRYmGx/ jmS6EkL97IOhWd/H1VS6lS3ayvbjzQ9QXXLPStT74Hn/eYCD+CuTaxQ4Fi2a18DL 6/HxwuuV5fIA06dfLwBEdztzp4RVJCZbZW44kUNd0v2OI9n8pGvs04PBilptNTaq 29O8gmoPolKSLxWFoBDZpgmNjPldOquAlujVSBk7nP/Mabzbn0uhvGau1T0OyXQ= =8yfL -----END PGP SIGNATURE-----