Attack Computer Wiz

1. Download and install the latest version of TrueCrypt. (7.1a at the time of this post) http://www.truecrypt.org/.
2. Launch TrueCrypt and click on “System”, then “Encrypt System Partition/Drive...”.
3. Choose a “Normal” or a "Hidden” system encryption, for this guide I am choosing “Normal”, click “Next”.
4. Choose to “Encrypt the Windows system partition” or “Encrypt the whole drive”, for this guide I am choose whole drive, click “Next” *Choosing whole drive will take a considerable amount of time however all of your data on the drive will be secure, not just the Windows system.
5. If prompted, acknowledge the 'User Account Control' by clicking “Yes”.
6. Choose your option on whether or not to encrypt the “Host Protected Area”. *The host protected area may have drivers, such as RAID drivers, that need to be accessed ‘pre-boot’.
7. Choose whether you have a single OS installed or are booting between multiple OS’s, click “Next”.
8. Choose the 'Encryption Algorithm' and the 'Hash Algorithm' you want to use. Read each description and select the one that you feel is best for you. By clicking the “Benchmark” button you can estimate how many megabytes per second your encryption task may take. Click “Next”.
9. Create your encryption password, the bigger the better, recommended is 20 characters, click “Next”. *Here is a link to check the strength of your password http://howsecureismypassword.net/.
10. On the next screen you will see moving text. Simply move your mouse around your screen for a while to create a random data pool. Do this for as long or as little as you like, but you should give it a few seconds at the very least. Click “Next”.
11. The next screen will show you the generated keys. You do not need to do anything here, just click “Next”.
12. On the 'Rescue Disk' screen you need to specify a path for an ISO file to be created. You will need this ISO file in the event you need to boot your system from a disk. So “Browse” to a location and save your rescue disk. Click “Next”.
13. Acknowledge the action and insert a blank CD into your CD burner. Choose your CD burner from the drop down box and click “Burn”.
14. Now, before you continue, navigate to the location of the ISO file that you created in the last step. Copy that ISO file to an external location such as a thumb drive. If your disk is lost or broken you can use this ISO file to create a new one.
15. Click “Close”, then click “Next” to verify that your cd is good, click “Next” again.
16. Remove the burned disk, label it, and store it in a safe location.
17. On the next screen you are asked if you want to wipe unused space on your disk. This can be important if you need to securely erase any data that can possibly be recovered. Choose your wipe mode (3 pass is sufficient) or choose “None” if this is not a concern to you. Click “Next”.
18. Next you are asked to perform a 'Pretest'. Be sure that all of your applications are closed and your work is saved. Next click “Next”, agree to the terms, then click “Yes” to reboot your computer and begin the pretest.
19. Assuming there are no issues, your computer will reboot normally and after the POST screen you are asked for your TrueCrypt password. Type the password that you created earlier and press “Enter” on your keyboard.
20. Assuming there are no issues, your computer will start into Windows as it always does. Logon if needed and click on the “Desktop” button from your new start screen. Once on the desktop Trucrypt should be waiting for you. Simply press the “Encrypt” button to begin the whole disk encryption process. You may need to agree to the terms again and User Account Control may prompt you for permission again.
21. At this point just sit back and wait.

Posted by Mike Wright

Posted below is my abbreviated presentation from the 2012 RSA Security Conference in San Francisco. I hate watching myself on video and no, despite my swaying back and forth, it was not film on a ship in rough seas.

Garage Sale Forensics: Data Discovery Through Discarded Devices

"A review of how data storage devices can be discovered and the data left on those devices used for unauthorized purposes. Individuals and organizations may dispose of a device without completely purging all data that resides or resided on it. This presentation will show where devices can be located, how data can be recovered, and how the organization or individual can protect themselves from loss."

Posted by Mike Wright

While at the RSA Conference in San Francisco last week I had the need to drop into the Apple Store. I was looking for a stand for my iPad that I could use to view the script of my presentation while on stage. With the help of an Apple Genius I as able to find exactly what I was looking for. Then, to my surprise she whipped out her POS device, Point of Sale device that is, and advised me that if I was done shopping, that she could complete my purchase. On her modified iPod she swiped my credit card and emailed me a receipt. Purchase complete no fuss no hassle.

We put a lot of trust in retailers when we hand over our credit card to them to complete a transaction. In many cases we are standing at a checkout counter, we usually swipe our card ourselves or hand it to the checker to swipe for us, but most of the time that card never leaves our hand, or at worse it never leaves our sight. The major exception to this is restaurants. At most restaurants we order, we eat, we get a check, and we hand over our card. Then our card disappears for a few minutes or on some cases more than a few minutes. What is going on back there? Where is my card? Is it being skimmed, are the numbers being transfered or copied, did it get handed to another customer by mistake? There are so many things that could be going on when that card is out of our sight that we have no control over.

If Apple can create a POS system that uses a presumably secure wifi connection and a presumably secure iPod device to complete a credit card transaction why can't Applebee's, and Denny's, and every other restaurant out there. This technology is available, it may cost a little more then their current POS devices, but it could save them:

Time; the wait staff could use one of the devices to deliver the check and take immediate payment, then have the receipt emailed or printed back at the register. The customer, who often is ready to leave can do so without waiting even longer for the ticket and their card to return.

Security; the customers card never leaves their site and there is no question as to whether or not the card is tampered with or copied. The wifi and devices would be compliant with laws and regulations that regulate such transactions, not only in transit but also in rest.

Cost; the establishment simply needs to purchase and design the system for a handful of devices. The wait staff could share multiple devices between them. After all, in most cases they only have one or two current POS devices to complete these transaction now.

Reputation; when a theft does occur or even a suspected theft, that customer is going to complain. But often that customer is complaining loudest to other customers. They will tell everyone about the theft and how they think that it must have been that waiter that stole his card. If the card does not leave the customers sight the opportunity of skimming or theft would be low.

Satisfaction; the customer will be very pleased that their credit card does not leave their sight, that they don't have to worry about losing a receipt because it has been emailed, and they don't have to wait for the lengthy payment process at the end of their meal.

Good job to Apple on this one. Another great device even if it is just a POS device.

Posted by Mike Wright

Network World is reporting the Blippy.com is going to hire a Chief Security Officer (CSO) in light of their recent data loss...

I am at a loss for words... dumb, dumb, dumb.

Source: Network World

Posted by Mike Wright

I first introduced you to Blippy.com in my post on March 16, 2010 titled "Blippy.com, a Whole New Level of Stupid". It has just been discovered that using a simple Google search you can see actual credit card numbers of Blippy users. This Google search is very similar to the method that I showed you in my first post.

You can see an example of the Google results in the screen shots below. At the time of this post the Google search is broken but there are plenty of examples on the internet. The breach was acknowledged by Blippy management and they state that it was an over site during some beta testing that they were preforming.

Blippy.com, a Whole Whole New Level of Stupid!

Image 1 credit: venturebeat.com
Image 2 credit: CNET/Google
Source: CNET
Source: Venture Beat

Posted by Mike Wright

Affinity Health Plan has released a statement concerning a data loss of as many as 409,000 customers.

In the press release they state that a copier that they had been leased was discovered to have contained personal information of its clientele. The lost data may include Social Security numbers, dates of birth, and medical records.

Abbe Abboa-Offei, the senior vice president of Customer and Community Connections stated, “Like many organizations across the country, we were not aware copy machines contained hard drives that need to be wiped.” (eh, fail!)

Affinity Health Plan was one of the companies that was in the CBS news video that I posted yesterday. If you have not seen that video, you should! (Click here)

Press Release.














.

Posted by Mike Wright

Computer World is reporting that there are “thousands” of images of students that have been discovered in the laptop webcam case reported back in February. This is according to a motion filed April 15 by attorneys for the Robbins family.

In the complaint it is alleged that software on the boy’s laptop was activated 400 times in a 15 day period. During that 15 day period there was photos taken of the boy in various states of undress. There were also photos of him sleeping, conversing with friends and photos of his family members.

Source: Computer World

Posted by Mike Wright

A new malware has been discovered and is “in the wild”, meaning that some antivirus / antimalware vendors are not detecting it.

This is a new twist on ransom ware or as I like to refer to it as extortion ware. The notice received after visiting an infected site is a “Copyright Violation Alert.”

These fake copyright violation notices advise that they have determined you have illegally downloaded files onto your computer and that you must pay their pre-defined amount of $400 or you will be sued. Part of the process of paying the ransom is to enter your credit card information. However it has been confirmed that there is no payment processing associated to the action and the hacker is likely just capturing your credit card data to be used later.

You can see sample screen shot of the popup at the below link.

Source: F-Secure

Posted by Mike Wright

A 16 year old boy is suing his mother alleging that she accessed his Facebook and email accounts, made “slanderous” comments about him on his Facebook page, and changed the account passwords.

According to Denise New, the boy’s mother, he left his accounts logged in on her computer and because of this she was able to access his accounts, change the passwords, and leave some comments.

New says that she was upset about posts that he had made on his Facebook account and felt that she was within her rights as a mother to monitor his behavior.

New did not deny the allegations and in fact made statements that seemed to confirm them. New will get her next day in court on May 12 where she will answer the criminal charge of harassment.

Source: KATV.com
Source: PC World

Posted by Mike Wright

Have you ever considered what you would really lose if you were to lose or have stolen your USB thumb drive. Whether it is dangling from your neck or attached to your key chain you should consider the reality that you may misplace, lose, or have that device stolen from you.

In 2008 I traveled to the Palo Alto California to take part in a review of a security product that was in Beta. After the two day review was completed I made the trek home and returned to life as normal. I soon realized that I was missing my USB thumb drive that I use when traveling. This drive contained my password management program, all of my logins, personal and financial data. It also included VPN information, network and systems information. I called the hotel and to my surprise they had actually found my drive and would ship it back to me.

I was quite relieved by this good news. Now I was not going to have to dig through my bowl of swag drives and build a new travel thumb drive. You may be surprised to know that I was not concerned in the least about the data on the device because I used whole disk encryption to secure the device thus making any data stored on the device completely unreadable to anyone who was to find it.

When you utilize disk encryption any data stored on the device, or in the encrypted areas of the device, will be completely unreadable by anyone who does not have the corresponding password, passphrase, or key that is required to decrypt.

There are many paid applications and a few completely free applications that anyone can use to encrypt data or entire disks or devices. TrueCrypt is one of the freebies. Utilizing a utility like this to secure your device is not only a great idea but could save you a lot of time and money if, or when, you lose your device.

Posted by Mike Wright

I recently ran across an excellent write up on the recommended steps to take for anyone who is duped into answering a Phishing Scam.

Full credit goes to Dan Keen of eHow.com

************************* Quote *************************

By Dan Keen, eHow Contributing Writer

Phishing is the name given to an Internet scam where criminals send emails to unsuspecting victims in an attempt to lure them into giving financial and personal information. For example, a victim may receive an email that appears to be from his bank requesting his account number and passwords. The email tells the unsuspecting victim that this information must be checked because the bank has noticed unusual activity on the account. This is a hoax.

Contact the Impersonated Company
Notify the impersonated company about the email you received. Many large companies have a 24-hour, toll-free number to handle these kinds of emergency situations.

Notify Government Agencies
Forward the fraudulent email to spam@uce.gov, and to the Federal Trade Commission at their "Identity Theft" website: ftc.gov/idtheft.

File a Complaint With the FBI
File a formal complaint with the FBI's Internet Crime Compliant Center at their website: www.ic3.gov.

Close Accounts With the Impersonated Company
Quickly close the accounts you have with the company whose name has been fraudulently used in the email to you. For credit and debit cards, have the company issue you new cards with new numbers.

Report to the Three Major Credit Reporting Agencies
File a report with Experian (fraud line is (888) 397-3742), Equifax (fraud line is (800) 525-6285) and TransUnion (fraud line is (800) 680-7289). Notify them of possible identity theft, and request that a "fraud alert" be placed on your account.

Report Scam to Anti-Phishing Working Group
Report the scam to an organization known as The Anti-Phishing Working Group, which is comprised of law enforcement agencies, financial institutions and Internet security vendors. Email to them at reportphishing@antiphishing.org.

Be Alert to Identity Theft
Victims of phishing scams, which compromise personal and financial information, are likely to also become victims of identity theft. Keep a timely check on your bank accounts, and statements from store credit cards and major credit and debit cards.

*********************** End Quote ***********************
Source: eHow.com

Posted by Mike Wright

Last week I was working in my yard when the meter reader stopped by to read my power meter. I apologized to him of the excess pile of toys that he had to navigate through to get to my meter. He told me that it was alright and it won’t be much longer and I will be fitted with a ‘Smart Meter’ that will transfer all of my meter data wirelessly.

My security hat immediately came on and I decided I would do some research and try to determine how a ‘Smart Meter’ worked. After about an hour of research it was pretty clear that they keep that information quite guarded, go figure.
Today though I was happy to find a story on Yahoo that addressed the concerns that I had and as it turns out these ‘Smart Meters’ have some gaping security issues, again, go figure.

The meters themselves are supposed to save money. They save the power company money by not having to send people out and read the meter and they save the consumer money by giving you a real time, anytime, view of your power consumption allowing you to adjust accordingly.

But according to Joshua Wright (no relation) a Senior Analyst with InGauardians Inc., there are “egregious” flaws in the meters and the technology that the utility companies are incorporating to handle the data from the meters.

Wright found security issues with five meters, each from different manufacturers. The security holes could lead to a hacker being able to intercept the encryption keys used by the meter to communicate with the access points that collect the meter information.

He discovered that a hacker may be able to change the usage reported to the access points raising a victim’s power bill or lowering it, depending on the shade of hacker. Wright said that while the technology of the meters is new, some of the security vulnerabilities he discovered have been around for 10 years.
While I do look forward to the ability to see my real-time usage I will be keeping tabs on this service in the same manner I do my credit card bill and would encourage everyone else to do the same.

Source: Yahoo!

Posted by Mike Wright

I ran across an application a few months ago but it was not until recently that I had the time and the need to use it. Microsoft's Windows Live Family Safety software can help you keep your children safe online.

There are four basic components to this application:

Web Filtering: Web filtering allows you to specify the types of web sites that your children can access. There are three settings; Strict, Basic, and Custom. Strict is the most restrictive only allowing a small list of websites. You can see that list here. I recommend this setting for younger children. Also in web filtering you can specify specific web sites that you would like to allow or block. Also you can allow or prevent the child from being able to download any files.

Activity Monitoring: Activity monitoring allows you to see a near real time log of all internet activity. You can see exactly what websites your children are visiting, when they visited them, and whether or not they were allowed or blocked when accessing them. From here, you can also change the setting allowing or blocking the site for future visits.

Contact Management: Contact management can control who your child chats with or emails online using Hotmail, Messenger and Spaces. Remember, you can block all other email, chat, and networking websites and force them to use only these.

Requests: On the computer that your child is using, when they access a site that is blocked, they have the ability to click a link to request that you allow them to view the site in the future. In the requests section you will find and be able to authorize or deny any of those requests.

If this sounds good to you, please continue reading and I will walk your through how to install and configure.

How to Install:

1. You must have a Live account. If you have a Hotmail account you already have one. You can sign up at Live.com.
2. You need to log into the child’s computer with your user account. This account will have the ability to make configuration changes and install the application.
3. You need to make sure that your user account has a password. It can be whatever password you want, and depending on your child’s age, it could be very basic.
4. You need to ensure that the name of the computer is not the same as the name of any of the user accounts. This seems silly, but I learned this the hard way. For example: If your child’s user name is “Johnny” you must ensure that the computer name is not “Johnny”. If it is change the computer or user name or you will fail when configuring the system.
5. Download the application from this link.
6. Logged on with your administrator account, on the child’s computer, double-click the application that you just downloaded.
7. You are presented with options to install multiple items. I suggest, at this point, you un-check all applications with the exception of “Family Safety”. Click “Install” and follow the instructions as they are presented.

How to Configure:

1. After you install the application you will need to launch it by clicking “Start” > “Programs” > “Windows Live” > “Windows Live Family Safety”.
2. The first screen you see will ask you to log into your Live account.
3. After you have successfully logged in you will be asked to choose the user account that you wish to monitor. Check the box, click “Save”, then click “Close”.
4. Now you need to log in to your Live account by clicking on this link.
5. Click on “Edit settings” under the user name of your child.
6. Now you will see the links for each of the four sections that I listed above. I suggest that you review each section and configure it accordingly. Be sure that you click “Save” at the top of the screen after your changes so that they can take effect.

I know that’s a lot to take in, but I think it is well worth it!

Posted by Mike Wright

According to Wired, Albert Gonzalez the hacker convicted breaching the networks and stealing data from T.J. Maxx, Office Max, Dave and Busters and a handful of other companies, was today sentenced to 20 years in prison and a $25,000 fine. I reported earlier this week that he could have gotten as much as 25 years.

You can read Wired full story at the link below.

Wired.com

Posted by Mike Wright

What would you think if I told you that there is a website that allows you to search anyone and find personal details about them? What if I told you that all I need to know is your name and the city you live in and I may be able to find your; address, phone number, cell phone number, spouses name, age, gender, race, marital status, education, hobbies, type of home, zodiac sign, whether or not you own your home, how long you have lived in your home, number of people living in your home, whether or not you have children, a photo of your home (yes a photo of your home!), and... Need I continue, or do I have your attention?

The website is spokeo.com who coins themselves as “Not your grandma’s phonebook”. This very easy to use search engine will locate just about anyone and allow you to learn a lot of information about them. Of course, it is not 100% accurate, but it is not too far off either!

Where do they get this information? I am sure a lot of it is dredged up from the internet and public record. I would imagine some of it is found on your social networking websites. But what about the data that is not common record or dredged up around the internet.

Let me use as an example my 90 year old grandmother who has never touched a computer. Why is her information there? Or my sister-in-law who told me about this site (I can see Mickey Mouse in your back yard). I know that she does not put her data on the internet.

Any conspiracy theorists want to tackle the US Census data?

To spokeo’s credit they do offer a way to remove yourself from their records and it is quite easy and effective. Below are the simple steps to remove yourself and your family members. Be warned, you can only make requests to remove two listings. I am not sure what the delay is before you can remove more.

1. Go to Spokeo.com
2. Enter the name of the person you want to search
3. Locate the person and click on them so that you see the profile on the right side
4. Now copy the URL from the address field of your web browser
5. Next, in the lower right corner of the page you will see a link named “Privacy”
6. Click on “Privacy” and paste the URL in the URL field, enter your valid email address and the captcha code
7. Click “Remove Listing”
8. Now go check your email and when you get the email confirmation follow the instructions to complete

Your results will be removed from the search usually within 24 hours, however I found that while I still showed up in the search, my data was removed within 20 minutes.

Posted by Mike Wright

Facebook does not have any authorized application that allows you to track who is visiting your profile. That means, that when you get a friend request asking you to install an application so that you can track people who visit your Facebook profile, you are being scammed.

These applications are classified as malware, or malicious software, and are designed to steal your information and reproduce itself. They do this by tricking you into installing their application, tricking you into allowing their application to access your Facebook profile, retrieving all of your information, and then propagating itself by sending itself to all of your Facebook Friends.

What can you do?

• If a friend sends you a request to join, forward them this article.
• Block the application if you already joined or are infected.
• Un-friend, un-follow, and un-fan the application.
• Change your Facebook password.
• Change your email password.

Remember, you are only infected if you installed the application and allowed the application to access your information. You can confirm this in a number of ways, in Facebook;

• In your profile, click Info, under pages click “See All”. Does everything look correct?
• Now click “Account”, “Application Settings”, then choose “Authorized” from the drop down list. Click the “X” for any unwanted applications.
• In the same area, choose “Allowed to Post” from the drop down list. Click the “X” for any unwanted applications.
• If you find any unwanted applications listed you should now change your Facebook password by clicking on “Account” then “Account Settings”. Now find “Password” and Click the “change” link. 
• Then ask your friends if they received any of these types of requests sent from your account.

Posted by Mike Wright

Facebook brought us the ability to tell everyone that we are home from work and ready to relax. Then Twitter let us inform the world that the wine works well with the steak at Outback, as we are eating it. Then we start to share our locations with Foursquare getting a little too personal by allowing people to track and possibly stalk us. But now there is Blippy.com a site that allows you to link your credit cards to your account and let everyone know exactly where you are and what you are buying.

Bear with me if you find the following unimaginable:

Blippy.com allows you to link your credit cards to your Blippy account and advertise where you are, what you are buying, and how much you spent. According to the Blippy website you can see “What your friends are buying”. But Google paints an entirely different story.

Do this… Go to Google.com and type search this term "blippy com" site:blippy.com "outback" (or just click the link to open a new Google search window/tab) Be sure that you keep the quotes exactly as I typed it. You will note that the last word is “outback” in quotes. You can change that word to anything you want, but be sure to keep the quotes. I encourage you to use your imagination with the word, it gets very interesting if you do! Now look through the results.

Did you notice that you were never prompted to log into or sign up for the service? Yet you can see all details with a simple Google search! I think I will pass on this service, but Google searching it will prove for hours of fun.

Posted by Mike Wright

I was ready to write another store about how hotels should stop storing our credit card data when I saw the headline. But then I read the letter to customers and it got interesting...

The Westin Bonaventure Hotel and Suites in Los Angeles is reporting that between April and December of 2009 they had a credit card data breach. They are advising that the breach affected customers who made purchases to as many as four of their hotel restaurants and their valet parking.

The report is specific to a breach of data by "outside hacker[s]" and was directed at the point of sale systems (those are the systems that they use to swipe your cards and take your money).

This is where I think this gets interesting:

The hotel chain is reporting that the loss of data includes "the names printed on customers' credit or debit cards, credit or debit card numbers, and card expiration dates." They also state that "the hacker did not obtain any information from the computer system used to store hotel guest information."

So, you may be wondering, why do I think that is the interesting part? If a "hacker" stole data, but did not get it from the systems that store hotel guest data, where did they get it?

My bet is that they discovered an employee using a card skimmer to copy data from the credit/debit cards of customers. (A card skimmer is a small device that someone can swipe a card through. The skimmer has a small memory card that will save a copy of the data stored on the card.) You hand your credit card to the waiter/waitress and they walk away. The perfect chance for them to skim your card and steal your data. What information can they get by skimming? Your name, your card number, and the expiration date. Note there is no mention about customer address, phone number or any other information.

Since handing over your credit card is common practice, the best way to protect your self from fraud is to:

1. Review your credit card statement.
2. Save your receipt so you can compare the amounts.
3. Never, Never, Never hand over a debit card. Debit cards draw on your account while credit cards extend credit. Ask yourself, is it easier to dispute a charge or try to get your money back from a debit draw?

Westin Notification Letter

Posted by Mike Wright

So did you notice that your friend asked you to join a Facebook fan page that allows you to see who is clicking on your profile? So cool! You can see every person who views you. You can catch that high school crush that you just knew had it for you and catch that stalker, right? Actually, no, you can’t.

These fan pages that tout the ability to track these activities are a complete and utter fraud. According to Sophos these types of fan pages are nothing more that pyramid schemes. In the pages that they tested, and the pages that I personally tested, once you get suckered into becoming a fan they force you to suggest to your friends that they also join the fan page. You must do this before you can move to the next step. Sophos reports the page they tested required that you share their page with 50 of your friends. The one I tested required that you add your entire friends list.

Once you move on to the next step you enter into an endless bombardment of data mining websites. They force you to sign up to receive information on all sorts of junk. Every time you enter your information into one site and hit submit they force you to another, and another, and another. In the one I tested I went five screens of entering data like name, address, phone number, email, and birth date before I gave up.

At this point I must apologize to Blah Blahgerson, at 125 blahblah st, blahsville, CA 99999.

So next time you get that suggestion from your friend about “See Who’s Spying On Your Profile – GET NOTIFIED”, “See Everyone Who Views Your Profile,” or any other fan page like it, JUST SAY NO! Then forward this story on to your x-friend.

Sophos story
Sophos on Facebook Privacy
Sophos on Facebook Security Best Practices *Very good information

Posted by Mike Wright

Cryptome.org is a website that recently hit my radar when they were ordered by Microsoft to remove information from public view. When the big boys like Microsoft and Apple put someone in the cross hairs I normally pay notice and try to find out what the deal is.

In this case, Cryptome.org publishes documents that may come from questionable sources or may not necessarily be for general consumption. I gathered a few documents that were labeled “Law Enforcement Only” and have put together a spreadsheet that compares what data is stored about you.

I think this information is very valuable and all of us should take note what companies store about us. Not so much for what they can or will release to law enforcement, not in the least, but what they may lose should systems be breached and your data lost.

Sorry if the data is truncated, I tried to fit it in the space provided.

Service

Date

Name

Add

Bill

SSN

Tel

IP

CC

eMail

Txt

Files

Pics

Profiles

Logs

Facebook

2/08

X

X

X

X

X

X

X

X

MySpace

6/06

X

X

X

X

X

X

X

X

AOL

9/08

X

X

X

X

X

X

X

X

X

X

X

X

MSN

3/08

X

X

X

X

X

X

X

X

X

X

X

X

Skype

10/07

X

X

X

X

X

X

eBay

?

X

X

X

X

X

X

PayPal

?

X

X

X

X

X

X

X

Posted by Mike Wright