Hack-and-Patch Dispatch Number 326 from the Cyber Secure Institute: Financial Systems Remain Unacceptably and Unnecessarily Vulnerable!
Editor's Note: I'm telling you. Mark my words. E-Commerce Transactions are NOT SAFE in a web browser. I'm not crying wolf here. What I am crying is: The Hackers are Coming...The Hackers are Coming! I'll continue to utilize 3rd party sources to prove my point. Hopefully, I won't have to say "I told you so"...but I will... if need be....and it doesn't need to be.
Click the Picture to Enlarge...
WASHINGTON--(BUSINESS WIRE)--Today, Rob Housman, Executive Director of the Cyber Secure Institute, a research and advocacy firm released this statement: “Two recent breaches highlight the insecurity of the financial markets and banking systems that we all rely on.
“On March 18, 2009, a harmful cyber-attack was discovered that affected Diebold ATM machines. A Trojan had been implanted into the windows-based operating systems of the machines, and opened up users to a whole host of threats including unauthorized access to their private information such as their accounts as well as the threat of stolen PIN numbers and funds. “There are also new reports that 'The Analyzer', who was arrested last year in Canada for stealing $1.5 million from Canadian banks, also allegedly hacked two U.S. banks, a credit card and debit card firm, and a payment processor firm. The attacks have led to at least $10 million in losses to date.
“Attacks like these undermine the integrity of the US and international financial system—at a time when we can ill afford doubts about the security of investments and markets.
“What is most disturbing is that these types of attacks are now entirely preventable. There are now inherently secure cyber-technologies, such as those offered by INTEGRITY Global Security, one of our member companies, which are certified as capable of withstanding these types of attacks. “The financial sector needs to replace at risk, hack and patch technologies with inherently secure systems.”
The White House, the Pentagon, power grids, all have been compromised. If these systems can be hacked no system is secure. You, your family, your company could be next.
Why? Because, the technologies we depend on to secure our nation, drive our economy, run our companies and live our lives are all fundamentally insecure.
In fact, these technologies, despite claims of security, are actually certified by the federal government as insecure; the National Security Agency and the National Institute for Standards and Technology have certified that these technologies are only secure against inadvertent and non-hostile threats. But the cyber attackers we face today are serious, sophisticated, technologically-advanced bad actors with hostile intent—the Chinese Military, the Russian mafia, corporate espionage spies, and disgruntled IT insiders.
We are in constant race between the hackers and the patchers (the IT staffers who run behind the hackers trying to fill the gaps as they learn of them). And, we are losing:
* Every year cyber attacks cost the U.S. economy $226 billion.1 * Every month identity theft affects more than 33,333 American children.2 * Every day up to 5 million fraudulent phishing emails are sent.3 * Every three seconds someone’s identify is stolen.4
By Anthony M. Freed, Information-Security-Resources.com Financial Editor
Jailed international hacker and cyber criminal “The Analyzer,” (See Analyze This...More on "Hack You!") who awaits extradition to the U.S. from Canada to face charges related to cyber crimes committed in 2008, is now also a suspect in several other unspecified electronic crimes, according to authorities.
Finextra.com - Ehud Tenenbaum, a notorious Israeli hacker arrested in Canada last year in relation to the theft of around $1.5 million, is now suspected of breaking into the systems of four US institutions as part of a global “cashout” conspiracy that resulted in the loss of at least $10 million. In 1998 Tenenbaum gained notoriety as “The Analyzer” after being arrested following hacks on computer systems used by the Pentagon, Nasa, the Israeli parliament and Hamas.
In August he made the news again as one of four gang members arrested by Canadian police for allegedly stealing C$2 million by hacking the database of a Calgary-based business and loading money onto pre-paid cards. The gang allegedly compromised the company’s computer system and loaded money onto the pre-paid debit cards before withdrawing the cash at ATMs in Canada and several other countries.
The few details that have been released by authorities show a number of similarities to details from the RBS WorldPay breach of their pre-paid credit card division in late 2008, that resulted in a reported $9 million dollar heist perpetrated at numerous ATMs in several different countries.
ISR news - RBS WorldPay announced on December 23 that they’d been hacked, and personal information on approximately 1.5 million payroll-card and gift-card customers had been stolen. (Payroll cards are debit cards issued and recharged by employers as an alternative to paychecks and direct-deposit.) Now we know that account numbers and other mag-stripe data needed to clone the debit cards were also compromised in the breach.
Authorities investigating the RBS WorldPay breach, as well as the breach at Heartland Payment Systems, have used similar language to describe an international conspiracy that is targeting multiple financial institutions.
Based on these similarities, it seems highly likely that Tenenbaum and his cohorts may indeed be the culprits behind a rash of major information security breaches that have the Payment Card Industry pointing fingers and attempting to dodge responsibility for security compliance.
Early in the Heartland investigation, authorities indicated that the perpetrators were most likely part of an international crime ring, and stated that they had already identified a suspect, leading infosec blogger Evan Schuman to conclude in an article that this could be evidence that authorities had already been on the perpetrator’s trail for some time:
Given the word that the Secret Service believes it has located the prime suspect, it raises the possibility that law enforcement was already on their trail long before the Heartland spyware was detected.
In an email from Evan, he offered:
“The similarities of the modus operandi here are eerie. I’m not hearing that this guy is involved in Heartland, but it certainly wouldn’t stun me if he turns out to be.”
Heartland was apparently breached sometime in the Spring of 2008, but was supposedly not aware of the security lapse until notified by Visa and MasterCard at the end of October that they had problems.
This corresponds to the time line of similar criminal activities revealed in the investigation of Tenenbaum, with the majority of activity beginning in early 2008 and lasting most of the year:
Finextra.com - According to the affidavit, in January and February 2008 a US Secret Service investigation into a computer hacking “conspiracy” against banks and other firms, uncovered attacks on the systems of Texas-based OmniAmerican Credit Union and pre-paid card distributor Global Cash Card.
In April and May 2008, authorities investigated further SQL injection attacks on 1st Source Bank in Indiana, and pre-paid debit card processor Symmetrex, which resulted in losses of over $3 million. According to the affidavit, in an MSN instant messenger conversation, on 18 April 2008, Tenenbaum revealed that he was responsible for hacking into the network of Global Cash Card, adding “yesterday I rechecked [Global Cash Card] they are still blocking everything. so we cant hack them again.” On 20 April, the affidavit says he received updates on a “cashout” operation, where accomplices used stolen card data to withdraw money from ATMs in the US, Russia, Turkey and Canada, among others.
It would be quite a relief to the finance industry if we knew for sure that the ringleader of such a prolific group of criminals was behind bars and awaiting trial. We can only hope that he turns on his partners in an effort to gain leniency for himself.
Until more details of the breaches are released, this is all purely speculation. Even if Tenenbaum turns out to be responsible for the RBS WorldPay and Heartland breaches, there are still an undisclosed number of participants on the loose, and an unknown number of systems that may be under threat of dormant malware that has yet to be discovered and neutralized.
Anthony is a researcher, analyst and freelance writer who worked as a consultant to senior members of product development, secondary, and capital markets from the largest financial institutions in the country during the height of the credit bubble. Anthony’s work is featured by leading Internet publishers including Reuters, The Chicago Sun-Times, Business Week’s Business Exchange, Seeking Alpha, and ML-Implode.
The Author gives permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author and to Information-Security-Resources.com
Last Thursday, police confirmed a skimmer, which is a removable device that scans and stores card information, had been attached to the Bank of America ATM on East Third Street. Video surveillance was also used to film ATM users' personal information as it was entered into the machine. A total of 286 accounts have already been compromised and over $43,000 lost, investigator Rob Toronzi said.
According to an article on LehighValleyLive.com, $43,625 was stolen from 34 accounts as a result of the skimmer on East Third Street and another on Catasaqua Road.
The thieves are believed to be Armenian or of some other European origin and driving a dark-colored Mercedes E55 sedan, according to the same article. The Bank of America employees realized something was wrong after they started receiving numerous calls about unusual card activity and problems. Upon investigation, they discovered a skimmer on the ATM on Catasauqua Road and later found a skimmer and video device at an ATM on East Third Street, Toronzi said.
The skimmers are believed to have been attached from Feb. 25 to March 9, according to an article in The Morning Call. "Customers with unauthorized card transactions, if reported within 60 days from the statement date, will be reimbursed," the same article stated.
"My Bank of America debit card was frozen here and the teller told me it was probably due to the scam," said Corrado Altomare, '09. The Bethlehem Investigative Bureau is currently working to track down those who are responsible for the scam. "We're working in conjunction with the Secret Service and they are aware of the individuals," Toronzi said. "We know of them but not exactly who they are. We have photos."
The men have been targeting ATMs in southeastern Pennsylvania since mid-December, but may be difficult to find because they move around and do not live in the area, Toronzi said.
As for the skimmer itself, it is a small, battery-operated device that is glued to the card-scanning machine on an ATM and works by reading the magnetic strip on the debit card. Skimmers vary in appearance.
"One is a sliver of plastic glued to the slot of the ATM's card reader," according to the same article. "Others are more sophisticated, including an overlay fastened to the ATM's keypad."
The other device that was employed in the scam was a video surveillance camera. According to Toronzi, the surveillance cameras are tiny and are usually attached to either the upper light fixtures on the ATM or the brochure holders. Toronzi encouraged all ATM users to check both visually and physically for illegal devices before swiping their cards or entering their PIN. "If there is something that protrudes out of the card holder, pull on it hard," Toronzi said. "If it comes off, then it is a skimming device. If all else fails, when you are putting in your pin number, just hide the pin number."
Toronzi insisted everyone should search the Internet for images of skimming devices, so they know what to look for while making transactions at an ATM. "I would never put my card into a sketchy-looking slot," Chris Brunn, '11, said. Toronzi warned that skimming devices are not only used on ATMs. "A skimming device can be put on anything," he said. "Gas pumps, look for it there."
E.T. (Ehud Tenenbaum)a.k.a.(The Analyzer) allegedly used SQL injection exploits to gain access to these supposedly secure financial databases, giving him access to account and card details."
Let me be "The Analyzer" for a moment here. E.T. "gained access" to"supposedly secure""financial databases using SQL injection. Allow me to do some "needling" myself: Don't worry...I'll be NYCE...
When's the SeQueL? Who'sgoing to STAR in it? This guy Accel's in the Exchange of Information. So if you put your finger on the PULSE, then Shazam! You'll Discover that Tyme after time a PCI 2.0certified Hardware device designed for the web (can you say SAFE-T-PIN)is EXPONENTIALLY safer than a software approach.
But, I "could" be wrong. Guess we'll have to wait for the SeQueL. When it happens, it'll have a "familiar ring" to it.
Developing...in the meantime...E.F.T. - Call Home(ATM)! Hackers can "screw" with us all they want. We're impregnable!
Maybe we should rename this guy, Ehud Tenenbaum "The Innoculator" since he used SQL Injection.
Or get him as a spokesman. After all...his initials are E.T. and he can tell the E(F)T Networks to "Call Home(ATM) Maybe we should call our product "The Innoculator" as we would fully protect Internet Retailers AND Financial Institutions from SQL Attacks. (Did you know there's ONLY 450,000 SQL attacks per day, up from 5000 in the 2Q '08?)
Here's more on this guy:
A hacker previously convicted of breaking into the Pentagon may be responsible for as much as US$10 million of similar thefts from US banks, investigators believe.Israeli Ehud Tenenbaum, aka. “The Analyzer”, is currently in Canadian custody on charges relating to a fraud which netted US$1.47 million from Direct Cash Management in Calgary, a firm that sells pre-paid debit cards. Editor's Note: "He allegedly used SQL injection exploits to gain access to these supposedly secure financial databases, giving him access to account and card details."
Let me be "The Analyzer" for a moment here. He "gained access" to "supposedly secure" "financial databases using SQL injection. When's the sequel? Who's going to STAR in it? This guy Accels in the Exchange of Information. So if you put your finger on the PULSE, then Shazam! A PCI 2.0 certified Hardware device designed for the web (can you say SAFE-T-PIN) is EXPONENTIALLY safer than a software approach. Tenenbaum was arrested in Montreal a month before his six month tourist visa ran out last year.Tenenbaum first achieved notoriety back in 1998 when - at the age of 19 - he was caught and convicted of hacking into US government computers including those of NASA and the Pentagon, as well as the Israeli Knesset. He escaped jail and was sentenced by an Israeli court to one year probation and also received a two year suspended sentence and a fine. Since then he has been off the radar.US authorities now wish Tenenbaum to be held in custody and may wish to extradite him over several hacks on US banks and card processing companies. According to an affidavit(PDF, obtained by Wired.com), US authorities believe Tenenbaum to be the ringleader in a global “PIN Cashout” conspiracy, using “cashers” in numerous countries to systematically empty accounts at institutions that he successfully hacked and taking a 10%-20% cut of the proceeds.
US financial organizations listed in the affidavit include OmniAmerican Credit Union of Texas, Global Cash Card of California, Symmetrex of Florida and 1st Source Bank of Indiana. Tenenbaum allegedly usedSQL injectionexploits to gain access to these supposedly secure financial databases, giving him access to account and card details.
Once inside, he is alleged to have increased card limits before farming out card details to accomplices who would burn copies onto blank swipe cards and withdraw money in the US and abroad. US investigators believe that losses of at least US$10 million occurred as a result of these attacks.Curiously for a hacker capable of such audacious and complex fraud, Tenenbaum appears to have become careless, using a hotmail address that was registered under his real name to discuss some of the hacks. Feds also traced an IP address used to access the hotmail account back to Tenenbaum’s security company Internet Labs Secure.
By Kevin M. Nixon, Information-Security-Resources.com Security Editor
“We need end-to-end encryption…”
I have heard that statement repeated many times as customers, colleagues, and press quickly point out that it is necessary for consumers and companies to conduct business on the Internet.
For a security practitioner, ironically, it is a very bad idea. The Problem
Before you shoot me for saying it’s a bad idea, end-to-end encryption should be defined first as to set the backdrop for my arguments.
End-to-end’s definition is the means utilized when a computer communicates with the server from which or to which it is sending information, using some encryption technology.
By way of example, VPN software on a laptop communicates with the VPN server internally to build the IPSEC tunnel, and end-to-end encryption starts on the desktop VPN client and ends at the VPN server.
A second example is a web browser using SSL to transport traffic to/from a web site, whereby the end-to-end encryption starts at the browser and finishes at the web server.
A key point: the traffic is at its destination before it is evaluated and therein is the problem.
The Concern
Current best practice methodology states that security is best practiced with a Defense-In-Depth security strategy. Defense- in-Depth recommends that more than one “layer” be used in the defense of the protected assets in question.
One example of an added layer in a network topology is filtering unnecessary traffic at an ingress network point through, say, the IP Access Lists.
If a network is protected by access-lists alone protection is limited at best, given that so many attacks are conducted over “acceptable or trusted” IP ports.
Defense- in-Depth requires taking at least one additional step, frequently the use of a firewall.
Traffic which passes the first layer, and that has successfully matched the allowed traffic rules for the network’s designated IP characteristics, is then secondarily evaluated at a firewall for protocol compliance so as to avoid exploits utilizing buffer overflows or overly lengthy data requests.
Oftentimes a third step is implemented: as traffic is traversing the security checkpoints, intrusion detection engines monitor the ‘knocking on the door’ attempts and alert based on various situations.
Lastly, traffic checks occur on the destination host to ensure that the data matches what is expected before being processed.
“End-to-end” encryption circumvents some of these steps under the accepted definition.
Since the traffic has characteristics that allow it through the filtering (it has a TCP destination port 443 (SSL), for example), the next two protection depths are the Intrusion Detection engines and the Firewall… but since the traffic is encrypted, these two technologies all too frequently can’t read the traffic!
It is here that we undermine a defense in depth strategy, and here that end-to-end as good practice takes on bad characteristics.
As a result of encryption, the new set of simple attacks is targeting encrypted web sites, VPN servers, or extranet sites.
Why? Because the traditional methods for stopping these attacks are rendered useless by encryption. Traffic cannot be reviewed except under the most basic conditions, such as IP header data, which we have already established is not enough by itself.
The scenario plays out as follows: When web traffic was unencrypted, it was reviewed by firewalls for protocol compliance, header fields, and others. With that same web traffic tunneled over SSL, the payload (which is the same HTTP traffic as before, encrypted) cannot be analyzed.
In short, SSL in a very odd way is assisting the hacking community, not impeding it.
Another example is secure email. Since S/MIME is on the rise, the contents of email will be more and more difficult to analyze until decrypted, and as a result, the contents of those emails will have to be analyzed/controlled on the desktop.
This change will undermine the virus mail firewall scanners that currently aide us, for example, which then lowers our overall protection. The Solution(s)
As an advocate for best practice, end-to-end encryption takes on a different meaning for me.
The encryption termination point (one “end”) is a device that peels off the encryption layer, perhaps even temporarily, allows the payload and previously encrypted traffic to be analyzed as defense in depth dictates, and if approved, then and only then does the firewall allow it to continue - in short, the traffic is decrypted and then the defense in depth methodology is instituted as if the traffic were never encrypted.
The change in architecture has a cost, e.g. “another” device is involved, but the benefits outweigh the costs. The defense in depth strategy is enforced while still maintaining the needed design confidence.
The existing generation devices and designs fall into three categories.
The first category terminates encrypted traffic on a front-end device, decrypts and analyzes the traffic in the clear, and if approved, sends it on in the clear to the back-end devices.
Oftentimes, this is the approach of the all- in-one vendors whereby the traffic is terminated on a VPN tunnel and/or SSL tunnel, sent to the virus and IDS scanning engine in the device, and then passed on into the back end network in the clear.
The all in one device is a security proxy. This design has strengths in defense in depth, but weaknesses in defense in exposure as the information is in the clear for too long.
The second category terminates the traffic similarly on a front-end device, decrypts and analyzes the traffic in the clear, then re-encrypts the traffic on another device and sends it to the back-end.
To address the weaknesses inherent in the previous all- in-one example, network administrators “work around” and create minimalist networks (which is good) that meet the ideological goal of end-to-end. This approach has similar strength in defense in depth, and marginal (but better) strength in defense in exposure since the traffic is re-encrypted.
The third category is evolving in the technology industry today. In this category, traffic is decrypted on a device, analyzed on the same device, and then re-encrypted on the same device and sent on.
This design ensures a minimal exposure, while still retaining the multi-tiered security capabilities. This has the now-familiar strength of defense in depth, as well as the highest strength for defense in exposure.
Conclusion
Encrypted traffic cannot be analyzed by a firewall unless either decrypted permissively or decrypted forcibly.
The same traffic cannot be cleansed of viruses, or worm signatures, or attack characteristics (IIS URL length overflow) until the traffic is decrypted on the host.
Clearly, traffic should never hit a multi-purpose operating system until after all of this happens.
End-to-end encryption is what we want, but not at the price we’d have to pay. Protection of data during creation, transmission, processing and storage or End-to-End-Defense-in-Depth is what we really want, as it ensures the defense in depth best practices are not lost.
Without it, break-ins will increase not decrease, and we again lose.
Kevin has testified as an expert witness before the Congressional High Tech Task Force, the Chairman of the Senate Armed Services Committee, and the Chairman of the House Ways and Means Committee. He has also served on infrastructure security boards and committees including the Disaster Recovery Workgroup for the Office of Homeland Security, and as a consultant to the Federal Trade Commission.
The Author gives permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author and to Information-Security-Resources.com
On Tuesday Socialwise, Inc., a wholly owned subsidiary of ideaEDGE, Inc. and developer of integrated e-Commerce payment solutions and social network group gifting platforms, announced that it completed the production version of the company's BillMyParents payment system which is ready to go live with key e-Commerce partners. BillMyParents is a payment option created for the children to allow them to shop online while parents retain control.
Before the launch Socialwise conducted an extensive testing of the platform and related Application Programming Interfaces (APIs) that will be integrated into popular social network applications and online e-Commerce environments. BillMyParents youth payment system is launching with the popular social networking services targeted at young audience. Socialwise expects BillMyParents to be fully integrated into these partners sites within 60 days.
"We believe that BillMyParents will be a great benefit for kids, and a valuable tool for parents and online merchants," said Jim Collas, CEO of ideaEDGE, Inc. "To date, the BillMyParents concept has been very well received by potential partners in the social networking space and the e-Commerce world. BillMyParents will enable online merchants to capture a piece of the estimated $40 billion in sales transactions that are currently lost because some kids don't have a payment method for safe and responsible online purchasing. With one solution, BillMyParents meets the needs of all parties in the value chain - with helpful and trusted services for everyone."
18 month credit fraud ring investigation leads to three arrests - KTN Las Vegas
Box after box, jewelry, DVD players, cars of every size and all of it is now evidence.
"Right now they're astronomically tired," said Lt. Robert Sebby of his Metro Police team. "this started Monday morning."
Sebbysays Metro has been investigating the charge card fraud ring for 18months or more. It all came to a head Monday, according to arrestreports, when an officer pulled-over Davit Kudugulyan and found severalcredit cards in a glove box, along with a fake I. D.
The numbers on the magnetic strips of those cards didn't match the numbers on the front.
So how were they making them? "A smoke-shop and another business," Lt. Sebby said. "In the smoke shop we recovered an active skimmer."
That'sa card-swipe device that records the magnetic information on yourcard. Police say the crooks were also collecting personalidentification numbers, or PINs, with a tiny camera as well.
"Nextto the pin pad, mounted in a counter display, was a pin-hole camerarecording people's numbers. So people have to be aware of theirsurroundings," Sebby said.
At the home on Chicory Court, policearrested Arytun Khoudagoulian after they say they found more creditcards, receipts, and a point-of-sale machine that had been tamperedwith. An the investigation expanded again after when policearrested a third man - Hrachya Arakelyan and investigators say theyaren't done yet.
EFT Call HomeATM Part Deau (The SeQueL)
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_uAyvMY6542zcXzDnElrDMHXKakiQX1ySCKsMjthicmRvYQawZwBLnLNZybAyu8dLnLnJp_UGvpYVCgAtpYkMlihv37Akidz5s9myRHV0-9xb0BSYZpD4YraibuyJDon8u365WoayBCQfjNQpxlwcve=s0-d)
Cyber Secure Institute![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_uFJsTAjq6JCAe986v35U0FvcpWP-OFQWOq_0YLPySrEhTxeJi5-8bLpipdQ7GRD6de0mtk_b35U-T5r4UB4TrlRT97iiz5t21fQJgb2fDLVNIItAJcyQsYLN48GC4wxdjtNTXQdobqoucgPxTHHyeR=s0-d)
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vaZp3DGTqUZidkV0mM5GeNaKBwUkBPEgWms-8cnle-83XbiZTveSYdm3Ha2d9fgsrshjJjqgRC1PYiDWvQLdpQ8uh5KpLEnlMLEyMv0iwTkGWo_irYGFjW1F-J1YeYyLxpw3e-wLzuzZtVfuQO7SJy=s0-d)
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_teVSiYzJj40jFeMHqtQNe9qDvHk3P1N7MRZbi4QsKBxzW56NC2hMmK3spsfvu42e1mprJ0GdwgJwpKzIkYaVrSyawlsklesMnb-wEpo1_m-cxerG5b9Ul5TdaXebc0ojqBybVLDbvUSba4yvnsptw=s0-d)
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_tmGWDfsIcKIcb2brlb8qxqn2wWMelRaJZpG-dgx-67xyvQhwIl6jHqeR0mUh06-q9WrO9lgeMfsWl9Nb0H5i-lhsfbahjlt1r15W627kLrC1u4yXy1NsfoNnMVFvbF_QONA3ztyaK2LK_QiQalDkC2=s0-d)
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_uiN7x53Sp-ORr0QG_I6uESPhZS9cOfq2EcXX2OtVmSyAL-21ZHpuYGzJ_bmVjbuM3-Sgt5wGF821_DqEZVvoYjzgl3dMu23Ls2NJ3OZYFh-TEfCBH19wlPIWnFDm_ShjuRfIJMpeEKE55eOU38hH-Q=s0-d)
E2E Encryption Prescription Is Bad Medicine : Information Security Resources
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_uY3PbZGXL2RLgH2fsu52-i5htCL_KTXAVCyzxeAtp7CQxvqdgJs7bIHmi0LLwU3PLdbKynW5hGVU-siEHxEFtLFITL_VMgjpc0LOZO2_Fuk0zkcWWjoCF3WWoJjd3Qm8Q0XXJ5zJGcZcLLxm94sHbF=s0-d)
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_sUHTs4wtT9DfySRedB6rYF6HbJArkGRdEvn1kblA3DdLmNtlfiaVyYjPRC4TZ8xnhTam2BPGtXs4NRg__CEbj7gkgRAb1Ov_3KpU2D_AdfD6c1y5GmwIoeGpxbkDaesmV-cQ2nZTTUILn8TiGnrff-=s0-d)