[RISKS] Risks Digest 26.07

From: RISKS List Owner <risko_at_private>
Date: Sat, 29 May 2010 20:42:49 PDT
RISKS-LIST: Risks-Forum Digest  Saturday 29 May 2010  Volume 26 : Issue 07

Peter G. Neumann, moderator, chmn ACM Committee on Computers and Public Policy

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
The current issue can be found at

Drilling for Certainty (David Brooks via PGN)
US Navy's Electro-Magnetic Aircraft Launch System software problem
  (Bruce Horrocks)
It's not just the camera in the laptop (Jeremy Epstein)
Caller ID Spoofing Puts Innocent Man In Jail (Joe Shortsleeve via
  Monty Solomon)
Pre-canned GSM eavesdropping (David Magda)
Video eye to scan for Newton parking lapsesm, will speed ticketing
  (Peter Schworm via Monty Solomon)
Trafficking in Human Data (Jason Roberson via PGN)
4000 echocardiograms lost on a computer read by technicians (DKRoss via PGN)
Measuring crisis response time (Peter Houppermans)
Cyber attack 'could fell US within 15 minutes' (Matthew Kruk)
Galaxy 15 satellite out of control, posing interference threat
  (Lauren Weinstein)
$42.9 million slot jackpot should have been $20 (Jim Reisert)
Affair outed by cellphone records (Gene Wirchenko)
Risks of remote administration, especially with bad crypto
  (Alexander Klimov)
Encrypted Google Web search (Google via Monty Solomon)
Google Streetview inadvertently Captured  Unencrypted Wi-Fi Data
  (Bob Gezelter)
IBM distributes virus-laden USB keys at security conference (Matthew Kruk)
Scientist Infects Himself With Computer Virus (Palmer/Maija)
Re: More Virus Protection Woes (Jonathan de Boyne Pollard)
Re: The Stock Market Fiasco of 6 May 2010 (Bob Frankston)
KNX: "Think Before You Friend!" -- How Facebook Can Seriously Bite
  (Lauren Weinstein)
Re: Risks of RFID car keys (Jonathan de Boyne Pollard)
Re: Wikipedia risks to personal reputation (RISKS-26.06)
Abridged info on RISKS (comp.risks)


Date: Fri, 21 May 2010 20:11:19 PDT
From: "Peter G. Neumann" <neumann_at_private>
Subject: Drilling for Certainty

David Brooks (*The New York Times* Op Ed, 28 May 2010, A19 Nat'l Edition)
had a very timely column that is right in line with many RISKS topics.

  "If there is one thing we've learned, it is that humans are not great
  at measuring and responding to risk when placed in situations too
  complicated to understand." ... "There must be ways to improve the choice
  architecture --- to help people guard against risk creep, false security,
  groupthink, the good-news bias [`people tend to spread good news and hide
  bad news'] and all of the rest."


Date: Wed, 12 May 2010 19:16:11 +0100
From: Bruce Horrocks <bruce_at_private>
Subject: US Navy's Electro-Magnetic Aircraft Launch System software problem


The article describes an incident where, apparently, a test of the US Navy's
new Electro-Magnetic Aircraft Launch System (EMALS) failed because it
unexpectedly went in reverse, destroying 'important equipment' and delaying
the program by several months. The failure has been blamed on a software

Given that such a device only has two possible ways to move - forwards or
backwards - one wonders just how it happened. However, I'm sure that it is
far more complicated than I realise.

What is most risky is the attitude of EMALS programme chief Captain Randy
Mahr who says, "The things that are delaying me right now are software
integration issues, which can be fine-tuned after the equipment is installed
in the ship."

I think most RISKS readers will agree that on-board ship will be the worst
place to finish the software. (However it will be the best place in order to
claim to your paymasters that the project is complete and operational - bar
a minor software glitch that may not happen again. And even if it does, it
may not kill or injure anyone as long as we remember to tell everyone to
stand well away from the back of the machine as well as the front.)


Date: Fri, 21 May 2010 08:47:22 -0400
From: Jeremy Epstein <jeremy.j.epstein_at_private>
Subject: It's not just the camera in the laptop

Risks tend to be worse when there are independent pieces which may be
relatively safe, but put together in unsafe ways.  Bad practices also help.
Here's a good example with all of the above.

As described in RISKS-25.95 and 25.97, a school district in Pennsylvania
provided laptops to students equipped with the LanRev software, which allows
remotely enabling the camera.  While initially claimed to be used to track
down stolen units, the school district is alleged to have used the camera to
spy on students, including capturing pictures of students in their homes in
various states of undress.  [The students' lawyers claim that through the
discovery process they've found thousands of pictures, which the court is
allowing the families to review, which makes the "track down stolen units"
argument suspect.]

The LanRev software in the laptop works by querying a server every few
seconds for commands.  It turns out that the software uses a fixed
encryption key (the same for all instances of the software worldwide), so
once you have the key, if you can get in the middle, you can issue commands
to the client that it will believe.  The Wired article describing this
weakness talks about being on the same network as the laptop (e.g., common
Wifi network) to jump in the middle, but of course it can also be done by
redirecting the client through DNS or BGP to a site that the attacker
controls.  And once you can impersonate the server, you can tell the client
to do anything, including running arbitrary programs.

So the risk is the combination of:
* Poor use of encryption (fixed shared key)
* Lack of a reliable way to get to a server (no protection against DNS, BGP,
  or MITM attacks)
* Application software running with full system access (lack of least
* Cameras that give no reliable indication of when they're on (there's a
  light on some cameras, but it's software-controlled - and I'm guessing
  that LanRev doesn't turn it on since their product is designed to use in
  case the equipment is stolen to remotely enable the camera)
* The purchaser (the school district) not knowing what questions to ask
  before buying/installing the software

[The vendor selling the LanRev software says they're releasing a new version
that uses SSL/TLS, which will address many of these problems.  Amazing to me
that with open source TLS implementations (e.g., OpenSSL), there's anyone
still rolling their own crypto....]



Date: Wed, 12 May 2010 21:37:28 -0400
From: Monty Solomon <monty_at_private>
Subject: Caller ID Spoofing Puts Innocent Man In Jail (Joe Shortsleeve)

[Source: Joe Shortsleeve, Caller ID Spoofing Puts Innocent Man In Jail, WBZ,
11 MAy 2010]

Imagine police bursting into your home, handcuffing you, and then locking
you up for days for something you did not do.  The I-Team says that is
exactly what happened to a Quincy man, and WBZ's Chief Correspondent Joe
Shortsleeve says this man was set up by someone using a popular technology.
The man does not want people to know his name, but he recounted that cold
winter night a year ago when he was making cupcakes in his kitchen. ...



Date: Tue, 11 May 2010 11:47:56 -0400
From: "David Magda" <dmagda_at_private>
Subject: Pre-canned GSM eavesdropping

A company called Meganet has released a product that allows you to
eavesdrop on GSM signals. From the "Engadget" article:

> The ["Dominator I"] system consists of two nondescript white boxes, two
> directional antennas that you'll point in the direction of your victim,
> and a laptop that you can use to get a glimpse at all of the phones
> currently connected to your nearest cell site and record up to four active
> calls simultaneously [...]. It can't do the 128-bit A5/3 used in UMTS, but
> now that it's been cracked in a somewhat practical way, we're sure the
> Dominator II can't be far behind.


The product is not yet listed on their web page:


Time to change the cipher I guess.


Date: Sun, 16 May 2010 17:08:26 -0400
From: Monty Solomon <monty_at_private>
Subject: Video eye to scan for Newton parking lapses, will speed ticketing

[Source: Peter Schworm, *The Boston Globe*, 10 May 2010; PGN-ed]

Newton MA is acquiring three $50K automatic license plate recognition
devices with a panoramic video camera, laptop computer, and sophisticated
software to detect cars that have been parked too long that sounds an alert
to write a ticket.

Similar technology has been put to use by a number of police departments
across the state in recent years, but largely to enforce outstanding arrest
warrants or hunt for serious offenders.  Some communities, including Boston,
use such a system to locate repeat parking offenders.



Date: Thu, 20 May 2010 18:50:55 PDT
From: "Peter G. Neumann" <neumann_at_private>
Subject: Trafficking in Human Data (Jason Roberson)

Device design for gathering data and  billing rather than safety?

[Source: Jason Roberson, Hospitals criticized over offers to earn or save
money by sharing electronic patient data, *The Dallas Morning News* item, 18
May 2010, thanks to dkross.  PGN-ed]

``The $45 billion set aside for electronic health records in the federal
government's 2009 stimulus package created a carrot-and-stick approach to
lure providers into the electronic age.  Physician practices could be paid
up to $44,000 over five years, and hospitals could get a maximum of $15.9
million to install systems that comply with federal rules.  On the other
hand, the government would penalize providers that don't participate,
reducing their Medicare and Medicaid payments by 1 percent beginning in
2015. In later years, the penalty grows to 3 percent.''

But with the promises of efficiency come questions of privacy.  Dallas-based
Tenet Healthcare Corp.'s vendor has been criticized for sharing patient data
with drug companies. Fort Worth's Cook Children's Health Care System
potential vendor may offer physician customers discounts for sharing patient
data.  Three other hospitals anticipate sharing records.

Dr. Deborah Peel, founder of Patient Privacy Rights, questions whether a
patient's most confidential information in their medical records, such as
psychological treatment or HIV testing, will be secure at those hospitals.
"Once your information is released, it's like a sex tape that lives in
perpetuity in cyberspace," Peel said. "You can never get it back."



Date: Fri, 28 May 2010 15:13:27 PDT
From: "Peter G. Neumann" <neumann_at_private>
Subject: 4000 echocardiograms lost on a computer read by technicians

  [From D.K.Ross]



Date: Fri, 28 May 2010 12:18:01 +0200
From: Peter Houppermans <peter_at_private>
Subject: Measuring crisis response time

Apologies for the self promotion, but I keep getting good feedback for my
simple, non-technical method of determining Business Continuity Management

  1. Take a copy of your BCM/BCP guide.
  2. Carry it to a safe place.
  3. Set fire to it and measure how long it burns.

Background here: http://bit.ly/alOheK.

Given that these manuals can serve in possible loss-of-life situations I'm
not quite sure how someone can supply this in good conscience, but I'm
positive this will start a healthy debate.


Date: Sat, 8 May 2010 17:14:06 -0600
From: "Matthew Kruk" <mkrukg_at_private>
Subject: Cyber attack 'could fell US within 15 minutes'


The US must prepare itself for a full-scale cyber attack which could cause
death and destruction across the country in less than 15 minutes, according
to Richard Clarke, former anti-terrorism Tsar to Bill Clinton and George W
Bush.  Clarke claims that America's lack of preparation for the annexing of
its computer system by terrorists could lead to an "electronic Pearl
Harbor".  In his warning, Mr Clarke paints a doomsday scenario in which the
problems start with the collapse of one of Pentagon's computer networks.
[Source: Alex Spillius in Washington, *The Telegraph*, 07 May 2010; PGNed]


Date: Sun, 9 May 2010 17:25:59 -0700
From: Lauren Weinstein <lauren_at_private>
Subject: Galaxy 15 satellite out of control, posing interference threat

  [From the Network Neutrality Squad list]

Galaxy 15 satellite out of control, posing interference threat to
other satellites
http://bit.ly/bjrL9m  (Christian Science Monitor)


Date: Wed, 19 May 2010 15:28:47 -0600
From: Jim Reisert AD1C <jjreisert_at_private>
Subject: $42.9 million slot jackpot should have been $20

*The Denver Post*

The correct prize for an apparent $42.9 million slot machine jackpot that a
Thornton woman hit at a Central City casino should have been $20.18,
Colorado gaming regulators said [19 May 2010].  The errant jackpot appeared
on a "Price is Right" penny slot at Fortune Valley Hotel & Casino on March
26 after Louise Chavez made a minimum bet of 40 cents.

The Colorado Division of Gaming's forensic investigation found that the slot
machine malfunctioned and displayed the wrong payout because of errors in
"mathematical calculations built into the game software."

Interesting that it was a mathematical error, and not a mechanical one.  I
guess someone missed testing this corner case!  Certainly in this case, the
Price WASN'T Right!

Jim Reisert AD1C, <jjreisert@private>, http://www.ad1c.us


Date: Tue, 18 May 2010 09:07:53 -0700
From: Gene Wirchenko <genew_at_private>
Subject: Affair outed by cellphone records

  Mom who cheated on husband says Rogers bill outed her affair and broke up
  her marriage because her Rogers cellphone bill exposed her extramarital
  affair, and is suing Rogers.  [Source: "The Daily News" of Kamloops, BC,
  Canada, 2010-05-18, p. A7; PGNed]

Well, this is an interesting mess.  This raises questions.  The answers will
vary by jurisdiction.

* When can a service provider combine billing?  What are the privacy
  implications, and how are they covered by law?

* If the invoice and surrounding matters are evidence for this trial, what
  about a claim by the ex-husband for breach of marriage contract?  Note
  that the husband is not limited to seeking merely $600,000, but might seek

* While adultery is not a criminal offence in Canada, it is grounds for
  divorce.  Consequently, it is reasonable to argue that adultery is not in
  the public interest.  Criminal activity would not be protected by privacy
  laws, but should such a situation be protected?  Would the answer change
  if the husband caught a sexually-transmitted disease as a result of his
  wife's affair?  Why or why not?


Date: Tue, 25 May 2010 15:32:33 +0300
From: Alexander Klimov <alserkli_at_private>
Subject: Risks of remote administration, especially with bad crypto

I guess most readers remember the story when a remote administration
program "Absolute Manage" was used to spy on students at home via
their laptop web-cams. Recent analysis
shows that one does not need to be a sysadmin in that school to
exploit it.

Turns out that software uses a fixed (hard-coded) Blowfish key for all its
encryption and a 7-digit number (SeedValue) for authentication. As a result
all communication can be easily decrypted once intercepted.  In addition it
is possible in about four hours of guessing to find the SeedValue used by
each client for its server authentication (the same number is used by all
clients of a server) and send commands to a client even without a need for
network data interception.


Date: Sat, 22 May 2010 09:22:43 -0400
From: Monty Solomon <monty_at_private>
Subject: Encrypted Google Web search

Search more securely with encrypted Google Web search, 21 May 2010

As people spend more time on the Internet, they want greater control over
who has access to their online communications. Many Internet services use
what are known as Secure Sockets Layer (SSL) connections to encrypt
information that travels between your computer and their service. Usually
recognized by a web address starting with "https" or a browser lock icon,
this technology is regularly used by online banking sites and e-commerce
websites. Other sites may also implement SSL in a more limited fashion, for
example, to help protect your passwords when you enter your login

Years ago Google added SSL encryption to products ranging from Gmail to
Google Docs and others, and we continue to enable encryption on more
services. Like banking and e-commerce sites, Google's encryption extends
beyond login passwords to the entire service. This session-wide encryption
is a significant privacy advantage over systems that only encrypt login
pages and credit card information.  Early this year, we took an important
step forward by making SSL the default setting for all Gmail users. And
today we're gradually rolling out a new choice to search more securely at
https://www.google.com. ...


SSL Search


Date: Sat, 15 May 2010 06:43:38 -0500
From: Bob Gezelter <gezelter_at_private>
Subject: Google Streetview inadvertently Captured  Unencrypted Wi-Fi Data

An article that originally appeared in Bits, one of the online Blogs
maintained by staff of *The New York Times* has been repeated on the
first business page of today's paper.

Apparently, it has been disclosed that Google's Streetview imaging vehicles
were also taking note of Wi-Fi networks they encountered in their surveys.
The details of what happened are contained in the underlying Google blog
post at:

It appears to be a case of code reuse with under-appreciated side effects.
Then again, unencrypted Wi-Fi should probably only be used for otherwise
encrypted traffic (e.g., VPN, SSH, HTTPS) with properly administered keys.

All in all, since the Google Streetview vehicles were not in any one place
for any length of time, the danger of this is low. It is certainly not cost
effective for an organization to trawl through a large geographic space
looking for interesting data. The hazard is more credible with more local,
non-roving threats, who acquire data over a longer period of time.

Morals of the story:
  1) Encrypt your home network
  2) Use public Wi-Fi as a carrier for otherwise enciphered traffic

I noted the utility of public, unencrypted Wi-Fi as a "dial-tone" for
otherwise secured communications (e.g., VPN) in a series of talks under the
auspices of the IEEE Computer Society Distinguished Visitor Program.  "Safe
Computing in the Age of Ubiquitous Connectivity", a paper presenting this
material was presented at LISAT 2007. A reprint of this paper is available
at: http://www.rlgsc.com/ieee/longisland/2007/ubiquitous.html

The New York Times article is at:

CNN/Money has also published an account, at:

Bob Gezelter, http://www.rlgsc.com


Date: Sat, 22 May 2010 13:34:41 -0600
From: "Matthew Kruk" <mkrukg_at_private>
Subject: IBM distributes virus-laden USB keys at security conference

IBM distributes virus-laden USB keys at security conference
May 21, 2010

IBM has been left with egg on its face after it distributed virus-laden USB
keys to attendees at Australia's biggest computer security conference.

Delegates of the AusCERT conference, held over the past week at the Royal
Pines Resort on the Gold Coast, were told about the malware problem in a
warning email this afternoon by IBM Australia chief technologist Glenn

The incident is ironic because conference attendees include the who's who of
the computer security world and IBM was there to show off its security
credentials. ...



Date: Wed, 26 May 2010 16:24:36 PDT
From: "Peter G. Neumann" <neumann_at_private>
Subject: Scientist Infects Himself With Computer Virus

[Source: Palmer/Maija, *Financial Times* 26 May 2010;
Excerpted from ACM TechNews, 26 May 2010.  PGN]

University of Reading scientist Mark Gasson has deliberately infected
himself with a computer virus in order to study the potential risks of
implanting electronic devices in humans.  Gasson implanted a radio frequency
identification chip into his left hand last year.  The chip, which is about
the size of a grain of rice, gives him secure access to Reading's buildings
and his mobile phone.  Gasson then introduced a computer virus into the
chip.  He says the infected microchip contaminated the system that was used
to communicate with it, and notes that it would have infected any other
devices it was connected to.  Gasson says the experiment provides a "glimpse
at the problems of tomorrow," considering devices such as heart pacemakers
and cochlear implants are essentially mini-computers that communicate,
store, and manipulate data.  "This means that, like mainstream computers,
they can be infected by viruses and the technology will need to keep pace
with this so that implants, including medical devices, can be safely used in
the future," he says.


Date: Sat, 08 May 2010 13:33:02 +0100
From: Jonathan de Boyne Pollard <J.deBoynePollard-newsgroups_at_private>
Subject: Re: More Virus Protection Woes (Brady, RISKS 26.04)

As a former Microsoft MVP myself, I append a note of caution to M. Brady's
pointing to a Usenet conversation between one Microsoft MVP (Robear Dyer)
and xyrself, misattributed to "the MS MVPs".  MVPs don't represent Microsoft
in any way.  Nor do MVPs work for Microsoft.  (Robear Dyer's potted
autobiography at James A. Eshelman's Windows Support Centre WWW site states
that xe works for a vineyard.)  MVPs are helpful experts that Microsoft has
chosen to recognize for their on-line contributions.  They are not a formal
organization or a club, with a collective voice, but individuals in receipt
of (annual) awards of a title.

For more information, read http://mvps.org./about/ and
http://aumha.org./ as well as, of course, Microsoft's own WWW pages
about the MVP award programme.


Date: Fri, 14 May 2010 11:43:04 -0400
From: "Bob Frankston" <Bob19-0501_at_private>
Subject: Re: The Stock Market Fiasco of 6 May 2010 (RISKS-26.06)

A *NYTimes* story debunks the fat finger theory and the problem of
individual markets trying to correct these aberrations.
http://www.nytimes.com/2010/05/14/business/14norris.html?ref=business It
also calls to mind the recent understanding of rogue waves
(http://en.wikipedia.org/wiki/Rogue_wave) which didn't fit into the classic
models. As per the NYT article I don't want to claim any understanding of
the particular complex phenomena but I do feel that our tendency towards
analog continuous models fail us when digital or quantizing effects are


Date: Thu, 13 May 2010 16:55:30 -0700
From: Lauren Weinstein <lauren_at_private>
Subject: KNX: "Think Before You Friend!" -- How Facebook Can Seriously Bite


L.A. newsradio station KNX has been running a series on how various entities
-- real estate agents, landlords, banks, and other financial institutions,
are using the data they find on Facebook to make decisions about real-world
matters with tremendous impact on individual lives.  Say too much, and you
might get burned.  Look like you're too private, and they might think you're
hiding something.

The entire series to date is available here:
  http://bit.ly/aPRDCa  (KNX 1070 Los Angeles)


Date: Sat, 08 May 2010 13:35:49 +0100
From: Jonathan de Boyne Pollard <J.deBoynePollard-newsgroups_at_private>
Subject: Re: Risks of RFID car keys (Garret, RISKS-26.04)

Garret writes of a passive RFID device that xe does not have to be in direct
physical possession of, or even know the location of; that xe doesn't have
to formally present to a security device, or take any overt action in order
to operate; that a miscreant with suitable transponders located near to
M. Garret's home/hotel room/backpack can make use of remotely, without
necessarily trespassing upon M. Garret's property at all or having any sort
of physical access to xyr belongings or even cracking the encryption; that
will nonetheless enable M. Garret and such miscreants to access and to drive
M. Garret's (rented) car.  These are not new problems, of course.  Bruce
Schneier and Avi Rubin, amongst others, wrote about them almost half a
decade ago.  My first reaction, upon reading this latest article, was blunt:
Why is anybody still calling such devices "keys"?  They are clearly not.

Perhaps RISKS readers can come up with more suitable names.


Date: Wed, 19 May 2010 14:32:06 PDT
From: "Peter G. Neumann" <neumann_at_private>
Subject: Re: Wikipedia risks to personal reputation (RISKS-26.06)

Quite a few of our RISKS readers pointed out that the long message from
Edward Nilges in the previous issue was not really an appropriate item nor
was it sufficiently related to Computer-Related Risks, suggesting that I
erred in including it in RISKS-26.06.  I agree.  I erred, and apologize.


Date: Thu, 29 May 2008 07:53:46 -0900
From: RISKS-request_at_private
Subject: Abridged info on RISKS (comp.risks)

 The ACM RISKS Forum is a MODERATED digest, with Usenet equivalent comp.risks.
=> SUBSCRIPTIONS: PLEASE read RISKS as a newsgroup (comp.risks or equivalent)
 if possible and convenient for you.   The mailman Web interface can
 be used directly to subscribe and unsubscribe:
 Alternatively, to subscribe or unsubscribe via e-mail to mailman
 your FROM: address, send a message to
 containing only the one-word text subscribe or unsubscribe.  You may
 also specify a different receiving address: subscribe address= ... .
 You may short-circuit that process by sending directly to either
   risks-subscribe_at_private or risks-unsubscribe_at_private
 depending on which action is to be taken.

 Subscription and unsubscription requests require that you reply to a
 confirmation message sent to the subscribing mail address.  Instructions
 are included in the confirmation message.  Each issue of RISKS that you
 receive contains information on how to post, unsubscribe, etc.

=> The complete INFO file (submissions, default disclaimers, archive sites,
 copyright policy, etc.) is online.
 The full info file may appear now and then in RISKS issues.
 *** Contributors are assumed to have read the full info file for guidelines.

=> .UK users should contact <Lindsay.Marshall_at_private>.
=> SPAM challenge-responses will not be honored.  Instead, use an alternative
 address from which you NEVER send mail!
=> SUBMISSIONS: to risks_at_private with meaningful SUBJECT: line.
 *** NOTE: Including the string "notsp" at the beginning or end of the subject
 *** line will be very helpful in separating real contributions from spam.
 *** This attention-string may change, so watch this space now and then.
=> ARCHIVES: ftp://ftp.sri.com/risks for current volume
     or ftp://ftp.sri.com/VL/risks for previous VoLume
 <http://www.risks.org> redirects you to Lindsay Marshall's Newcastle archive
 http://catless.ncl.ac.uk/Risks/VL.IS.html gets you VoLume, ISsue.
   Lindsay has also added to the Newcastle catless site a palmtop version
   of the most recent RISKS issue and a WAP version that works for many but
   not all telephones: http://catless.ncl.ac.uk/w/r
 <http://the.wiretapped.net/security/info/textfiles/risks-digest/> .
==> PGN's comprehensive historical Illustrative Risks summary of one liners:
    <http://www.csl.sri.com/illustrative.html> for browsing,
    <http://www.csl.sri.com/illustrative.pdf> or .ps for printing
==> Special Offer to Join ACM for readers of the ACM RISKS Forum:


End of RISKS-FORUM Digest 26.07
Received on Sat May 29 2010 - 20:42:49 PDT

This archive was generated by hypermail 2.2.0 : Sat May 29 2010 - 21:49:01 PDT