E-mail snoop!

 

Who reads my e-mail?

E-mail is the most popular form of communication today. The number of e-mail users is probably well over 400 million across the planet, and enjoying a steady increase of some 2 million new addicts per week.

That is all well and fine, but the problem is that you never know who reads your e-mail, or which motives they have those who can or would like to read your mail.

Somebody once said that to send an e-mail is as secure as sending a postcard. That is plain wrong - it is much worse from a security standpoint. On the one hand you can fill an e-mail with so much more info, and on the other it is much easier to systematically scan the Net compared to regular mail.

This page will explain why you should never send e-mail across the Net without protecting it with encryption. This goes not only for companies, but for authorities, and private folks as well. The page ends with a summary description of how you can protect yourself.

Who wants to read my e-mail?

"I have nothing to hide and it doesn't bother me that someone reads my mail", is the most common view on this. If you are of this opinion you assume that all people are good. Unfortunately this is wrong. If you think of all the e-mails you have sent, you will soon realize that you have put yourself and others at risk time and time again.

Criminals

The quickening pace of development on the Internet holds for competence and imagination within the criminal field as well, especially organized crime. Many criminals use the Internet to varying degrees, not in the least the small-time crooks.

In many larger cities across Europe wealthy people have been subjected to heinous crimes and burglaries, all related to Internet usage. Several homes have been burglarized in a seemingly organized fashion. No one knows anything about the perpetrators, but they seem to be extremely well informed. It looks as if they have employed e-mail scanning, extensive snooping and then have proceeded to act. The police, which recently learnt how to use a mouse, are powerless against this new type of electronic burglary.

The criminal purposes vary but include the following:



Background information prior to burglary. To find out when you are not home. In practice the burglar would scan your inbox for the words "vacation", "holiday", etc. and find out when you are out of the country.

-  Blackmail. To blackmail someone becomes substantially easier with knowledge reaped from the Net. It can be related to anything from a new job, family events or extra-marital affairs.

The sale of stolen information. Information has value. The right information can have immense value for the right buyer.

-  Mapping. Many criminals map and collect information on scores of people. This information can be used for racist crimes, and other crimes where the subject can be used / abused. Journalists are a special target for this type of crime.

-  Deceit. Where knowledge taken from e-mails can be used to deceive people in any number of ways.

-  Theft. Business plans, inventions, drawings, names, manuscripts, and many many other things can easily be stolen. A patent application can be submitted by an impostor, etc.


Very few of these cases of e-mail snooping ever get noticed - so the figures of affected people are hard to come by. All that can be said is that the usage of the Internet as a planning OR operative tool in burglary and theft will continue to rise.

Fun and games

Knowledge of how to access other people's mailboxes is widely spread. In many cases it is merely young hackers or crackers that give it a go, without any malicious intent. However, the ensuing damages can be devastating and the subject does not always find it funny that unknown people are messing with one's Inbox.

Mistakes

It is easy, and very quick to send e-mail. Everyone has made a mistake sometime and sent the wrong mail to the wrong people. Similarly, technical glitches can cause mail to take strange turns - and sometimes your confidential info ends up in the oddest places.

Corporate Espionage

Some types of corporate espionage is allowed, and other types are not. Where you draw the line varies according to the company, and the country, in question.

All companies and executives should assume that other companies will do whatever it takes to access their information. What value a certain piece of information has to a competitor can best be vauled by the host company. Information of this type is sometimes traded on information markets or bourses run by criminal interests.

To send e-mail without protecting your information with strong encryption can be compared to allowing competitors into your offices with acces to everything including computers, archives, etc.

Think about what would happen if your competitor found out EVERYTHING about your person and your company?

-  Correspondence with clients
-  Business Development
-  Recruitment
-  Economic Information
-  Sales Leads
-  Etc

A company which is the target of e-mail espiionage very seldom notices it. Even government offices and military orgnaisations have been the targets without even knowing. How many companies are under constant surveillance?

National Government Agencies

Every modern nation has policies directing how it handles surveillance. In most nations a court order is a necessary requirement to wire-tap someone, and this order is in itself restricted material. In practice these court orders are usually issued after the wiretap has taken place, the purpose of which is to collect evidence and discover crime.

The access and possibilities that a national government has to wiretap (e.g. e-mail) someone are enormous. The laws and regulations surrounding this are very nebulous and in for example the UK ALL e-mail traffic passes thru a few computers. Read more: http://www.csmonitor.com/durable/2000/05/05/p1s1.htm

www.nandotimes.com
In the US the FBI uses Carnivore, which is a black steel box that is placed in all the ISPs facilities. Thru this box the Feds can scan all e-mail passing through this ISP. This practice has been tried in court and the court found that the ISP cannot deny the FBI the right to scan mail.

In conclusion - you have absolutely no guarantee that national government agencies act according to their statutes. On the contrary - you should assume and prepare for that agencies or people within agencies misuse their capabilities.

Foreign government agencies and embassies

Governments and foreign embassies conduct larges scale organized and unorganised wire-tapping. Officially this is to combat terrorism, fight crime and to ensure the safety of the nation. In practice a lot of it can be described as corporate espionage.

The state-of-the-art system is the "Echelon" system run by the National Security Agency (NSA) of the US. NSA is fittingly called the "computer-CIA" and they can - on an hitherto unprecedented scale scan ALL e-mail, faxes and phone-calls, of ALL countries. This high-tech espionage operation is rumoured to employ close to 40,000 people and most of what they are up to is shrouded in secrecy. As of late, Echelon has been very much in the news thanks to enquiries conducted by the European Parliament. The EP is worried that the system infringes on civil liberties and that it conducts high-level industrial espionage. See www.europarl.eu.int/committees/echelon_home.htm for more information.

In 1992 the NSA admiral Studeman informed a committee that commercial espionage has become the second leg of the NSA. The US companies that seek advice turn to the Office of Executive Support, while in the UK companies would turn to GCHQ:s K-division. There is a wealth of information on the Echelon system to be found on www.echelonwatch.org which is an NGO devoted to monitoring this collossus of information gathering. What's true about all this? How powerful is really this Echelon system? No one knows, but the evidence is gathering momentum and - according to the European Parliament - it is definitely worth worrying about. They recently issued a recommendation to ALL European companies to encrypt their information.

Worldwide the picture is even more gloomy for e-mail security. Japanese have a wonderful knack for reading the internal memory of faxes sold by Japanese companies and the Russian government is very proficient at wiretapping e-mail. A curious detail is that the Global Incident Analysis Center recently discovered that a Trojan Horse (a program that sneaks into your computer and runs it from the inside) was sending information to an IP-address in Russia (194.87.6.X). GIAC recommended internet users to block traffic to this IP.

More info can be found at the Sans Institute. http://www.sans.org. So we cannot know if governments track our mail. Maybe we are under constant surveillance because we got the wrong mail from the wrong person. Maybe your invention is already at some US company even before you have had time to patent it. There are no guarantees and everything is shrouded in secrecy.

How can I snoop on somebody's e-mail?

The exact technique will not be divulged, but to understand the risks a few methods will be described - from the simple to the sophisticated. What needs to be transmitted is that it is SO easy to snoop on e-mail and that everyone need to protect themselves or not use e-mail.

Background E-mail addresses are very public information. In most cases a persons e-mail address will give information about exactly which server a person is using according to the domain name. The header information divulges information about which IP number was used, thus revealing the server's number, address and proprietor. This makes it easy to use any number of techniques to snoop on somebody's e-mail.


A short listing of the techniques used:

Insider

The employees at the Internet Service Providers have all the possibilities in the world to snoop. Either they enter your account using your password and login or they simply take a copy of your whole inbox.

Either the insider does this on his own initiative, either as a result of bribes or pressure, or he does it on direct order from his bosses. It can also be the case that the insider is just carrying out instructions, and not knowing what he is doing.

Every day the information that passes through the ISP is backed up for security reasons, but the list of who can access this information is not public. The suffering party will often not even notice that someone has compromised their mail.

The insider can be everything from an ISP employee through police, military or intelligence agent, but a common form of insider is the normal computer service personell. Most people give these service workers their passwords without thinking twice. Other examples of insider intrusions include normal company networks (so called Local Area Networks, LANs), which are often used in apartment blocks equipped with broadband too. Every computer hooked onto the LAN can access mail sent to and from other computers, scan other peoples web-surfing, etc. There are several free programs on the Web to do this, most notably WebSpy.

The risk that someone would find the insider is small - the insider knows he is a potential target. It is very often a person with low pay whose services it is easy to buy.

Connecting thru a phone station

The phone system is very vulnerable to snoops. Voice and data traffic go thru phone stations which are often located out of the way in discreet places. If someone gains access to a station, which can be very small and located on a pole high up in the air - then it is very very easy to tap all traffic passing thru such as phone, fax and e-mail. The snoopers need not be in the vicinity, they can just place a transmitter to transmit the information through radio or the telephone network itself.

Access to the phonelines

A person with the right equipment can scan right off the phone lines. With really good tools a person can simply climb up a pole, hook on to the line itself and listen in on all information - and even place calls. Nowadays cables are most often in the ground, but phone companies are more than service minded when it comes to divulging info on EXACTLY where these cables are buried - since they are worried that someone is accidently going to cut them off while digging.

Forced entry into server

All servers have special entries for service, so called service ports. Sometimes they are not protected, but if they are it is with some simple password. ("Admin" is the most popular…) Forced entries can be done via anonymous servers and whoever manages to enter can access ALL information located on that server.

Even if you receive guarantees that your server has good firewalls and other forms of protection, the fact of the matter is that the ISP cannot guarantee the security of other servers that your mail will pass through. A mail will typically pass through at least ten servers on its way from client to client. ( See http://www.vitalsigns.com/products/nm/) Your protection is only as strong as the weakest link of this chain. That security is not good enough.


Stolen user identities or passwords acquired thru scanning

Every time you send and receive e-mail you send, completely open, your UserID and your password. It islike as if the department store chief would call out on the PA system the codes to the safe when he locks away the cash for the night. It is entirely possible to scan the IP numbers your ISP uses and copy all thrugoing traffic and then automatically search for passwords. Some scanners are on-line all the time with automated searches looking for vulnerabilities and passwords and some only do random searches.

Stealing e-mail by scanning

It is possible to steal copies of e-mail passing thru cyberspace. If you have honed in your search and you are scanning a precise server you can get exactly the mails you want. Or, you could use software "robots" which either scan the WHOLE net ALL the time or can carry out precise searches looking for words, phrases or names.

Broadband (fiberoptics)

Broadband has been marketed as the safer alternative. It is not. There are two ways to copy traffic from broadband, one is to physically bend the cable and remove the cover - will result in information leaking out that can be copied. The other method is to physically break the cable, mount a small device and then connect the cable thru the device. No one will notice if a criminal organisation or foreign elements perpetrate this sort of operation in some rural area where the cable passes thru.

There is also said to be a special kind of radar technique for tapping broadband, where simple proximity to the cable is enough to scan the info.

Aerial Phone and Data traffic

All traffic that passes tru the air can be accessed by anyone with reception equipment. Today there are local wireless Internet-nets in cities, and phone traffic goes via satellite. Most often this type of traffic has someform of encryption but usually too weak and the keys are with the wrong people.

Cell phone networks are of course weak in the same way. NMT, GSM 900-1800, AMPS och ETACS, US systems, etc. were said to be very secure. It shows the encryption used can be cracked in less than one second.

Web E-Mail

Web-based e-mail have very low security. During a famous breach of security during the autumn of 1999 Hotmail accidently allowed anyone to access any account. Without passwords. Passwords are often stored in the computer (cookies) used to access the hotmail account so very often the next user can easily access your account.

There are also special viruses that send an e-mail to the web-mail account. The virus reads the cookie-file and sends the stolen passwords back to another e-mail account. The user will not notice anything.

There is another very widespread method which is pure scam. A false copy of the login page for a web-mail is published. The only function it fills is to fool people to leave their passwords and then the page informs the user that there is a "temporary problem accessing" the mailboxes. The user will not understand what happened.

The LogIn function of any web-mail is a java script application that can be downloaded to your home computer. You can then conduct so called brute force attacks on the password of any LogIn name, most often these are easy and crackable. A program that does this in a few seconds is Munga Bunga.

Many web e-mail providers have a forwarding service so you can "POP" your mail. To activate this function you must often enter your UserID and password which are then stored at Hotmail. Not recommended, for obvious reasons.

On top of these specific risks, web mail have all the normal risks associated with them too.

Unauthorized Access to another computer

Access to your computer can be gained physically or thru network access. Many apartment buildings have LAN-like networks with access to the Internet. If someone gains access to your computer, then your LogIn and password can easily be found - in an encrypted file. Those who know how can decrypt this in no time.

With increasing speed new programs reach the market with new security challenges. Napster, a program for sharing MP3 files gives others access to your hard disc. With some small modifications it is the perfect spy-ware. Napster, which is only one of many peer-to-peer programs, today has 20 million users and projections point to 70 million before the end of the year. Many people connect to similar file sharing systems from their office computers, thus giving access for other Net users to their whole corporate networks.

Other programs such as Outlook, ICQ, etc. are very susceptible to small strings of code that will function that e-mailer robots sending out ALL your communications to an undisclosed recipient. The source code for this particularly ugly piece of spy-ware can be found at Underground Security Research (USSR) http://www.ussrback.com

Virus Trojans

There are virus programs which work according to the same principles as "Happy99" and "I Love You". The only difference is that the recipient wil not notice anything, since the only thing the virus does is to send your UserIDs and passwords to a preprogrammed mailing address. Other interesting pieces of Trojan software are Netbus and Backdoor / BackOrifice. By using these programs an external actor can simply take control over your computer and do what he or she pleases.

Software for eavesdropping

There is a plethora of programs for snooping, where many were designed simply to monitor net traffic but can be used for many other purposes. Some can be targeted at specific IP addresses and some have "Echelon" capabilities allowing them to scan / search for certain key words. Prices vary from a few dollars to tens of thousands and there are demo versions available.

Sniffer pro

http://www.nai.com Different version cost from 1,000 USD to 20,000 USD depending on the version. The program is marketed by Network Associates, which can seem strange seeing as how they are the market leaders in the protection field with products such as PGP and McAffee. It is a realtime program and one of the most advanced for the consumer market.

CyberSnoop

http://www.pearlsoftware.com Costs around 50 USD
The program logs FTP and chat activities. Install on the computer to be logged but cannot handle realtime.

Message Inspector

http://www.elron.com Costs around 20 USD 200 thru Dataconstruction. The program is designed to monitor networks and can also write reports - excellent for apartment buildings.

Intraspy

http://business.fortunecity.com/all/164/products/intraspy/ Costs 25 USD. Install on the computer you want to monitor. Can check everything, including keystrokes.

Webspy

http://www.webspy.com Costs around 300 USD (30 day demo available)
Livingstone Group has gone thru a name-change. WebSpy can monitor ALL traffic, very user friendly software, extremely effective.

Whatsup

http://www.ipswitch.com Costs 900 USD. The program is designed to analyze which computers are hooked on to a network, so the snooper would first use this program and then another one in this "Snoop-Suite" of programs.

How can I protect myself?

To protect yourself you should encrypt all your information and communication. The downside with encryption is that those with whom you are communicating must also have the exact same equipment. You would then encrypt and they would decrypt.

If you think this is over-kill then you could use an anonymous e-mail account. This level of protection will hopefully lead an attacker to attack someone else.

If you have important information to protect you should consider the fact that crypto cracking capabilities develop extremely fast - in conjunction with the extreme speed increase in computing power that was estimated to have taken 50 years. There are available today extremely powerful computers that anybody with the right amount of money can buy freely that are capable of 12,300,000,000,000 calculations per second (IBM ASCI White).

A couple of years ago it was considered extremely good with 1,000,000 calculations per second. In the security business there is an estimate called MIPS years, that represents how many years it would take for a brute force attack to crack an encryption. With today's computing power what formerly took a year now takes 0.3 seconds, and NSA and others probably have vastly more powerful computers. 0.3 seconds means that you do 12,000 years worth of brute force calculations in under an hour.

This means that symmetric keys need to be at least 2-300 bits or more to withstand a brute force attack. First a reduction would take place (prior knowledge about parts of the contents) then through trial and error different theoretical alternatives would be tested. A BlowFish algorithm of 256 bits can be reduced to around 40-60 bits and then brute force attacked on the remaining 1099511627776 - 1152921504606846976 combinations.

RSA

RSA does not only sound like NSA, but th three founders are former NSA employees. RSA is the big giant in the security world - and their algorithm, the RSA algorithm is the most frequently used, now present in over 90-95% of all encryption protections. Within the crypto world it is said that the RSA algorithm can be cracked with a simple PC program. NSA among others is said to be in possession of this program. RSA has never publicly denied that it cannot be cracked and it is therefore objectionable that they continue to release new algorithms.

The maths and the logic behind the RSA-algorithm is that if you have the sum of two large prime numbers (extremely large), you cannot just by knowing this arrive at the two prime numbers. P * Q = N where P and Q are two prime numbers. If you have N you cannot calculate P and Q (maybe not?). It is said that prime numbers of 4096 bits can be calculated with less than 25 million calculations, by starting with the last number as a prime and then using about 40 connections and probabilities - start to build up the prime number with the last prime number first then the second to last…etc. If these assumptions hold then such an encryption can be cracked in less than one second.

There are reasons to take this rumour seriously. The link between RSA and the NSA and the fact that it is American might make for a good case to choose another encryption algorithm. Another thing is that US crypto export has been extremely strongly regulated until December 1999, whereafter it has been freed for certified products. If you are just a little bit suspicious you can assume that it is free to export those products which NSA has the capabilities to read.

In conclusion it is safe to say that care should be taken when using american made products.

Hushmail

http://www.hushmail.com
This company was first on the market with encrypted web e-mail. The good thing is that it is free, easy to get started, easy to use and better than no protection at all. The not so good things are that the security offered is really no good at all. You're your computer to their server you are only protected by SSL encryption which is normally used for credit card protection, the service is s.l.o.w. and you cannot mail everything you want. And, as per usual when it comes to encryption, both parties must have get a new e-mail address.

PGP

http://www.pgp.com
This may be the most commonly used program for e-mail encryption, much due to the fact that it is free for private use and costing 40 USD / license for corporate usage. The program works with asymmetric encryption, which in principle always is more insecure than a symmetric solution since there are more known parameters. In principle the data mass to be protected is encrypted with a random key. This key is sent together with the message but encrypted asymmetrically with the public key of the recipient. In this way the protection is asymmetric.

The program exists in many versions and is american. Mr. Zimmerman who developed the program was sued by the US government but this was recalled 3 years later. How the agreement between Mr. Z and the US govt looks is classified material. Zimmerman later sold PGP to Network Associates, which markets the virus software McAffee and the snooping program Sniffer. PGP supports many algorithms and exists in many versions. This is a problem since the user knows very little about the version used and how the code looks. It is impossible to know if there are backdoors in the version one is using. To add to the problem there are millions of places where you can download PGP - if it is safer or not to load it from the US www.pgp.com ….no one knows.

If you have a good version of PGP it can be considered safe. Where PGP has been breached it has most often been related to faults committed by the user. A correct version, correctly installed and used - should be safe.


Info about bugs and risks in PGP

http://www.cert.org/advisories/CA-2000-09.html
http://www.pgpi.org/doc/bugs/win
http://www.csl.sri.com/neumann/insiderisks.html

A new serious bug was recently discovered and made public in August 2000. The bug is so serious that encrypted messages can be decrypted by others, even without brute force. In PGP from ver 5.0 there is a function called ADK (Additional Decryption key). The function is supposed to facilitate protection in corporate environments and has been criticized since it has meant serious risks concerning the safety of the keys. More discussions on this can be found at http://www.cdt.org/crypto/risks98/ ADK can place itself within an unencrypted area in the key. This smells like a backdoor and the manufacturer has announced a possible bug fix. The German who discovered the problem can be found on http://senderdek.de/securtity/key-experiments.html

The major logical security fault with PGP is that it is the recipient and not you that sets the level of security. Let us say that you are an expert and you have the most advanced PGP version, you have checked the source code, chosen the longest key lengths and everything else to make your PGP usage as secure as possible. When you are about to send a document to someone it is your counterparts chosen security level which sets the level and not yours. If your counterpart has a short key, a compromised program, and stolen keys…then the security will be accordingly. You must therefore not only check your own security but your counterparts as well, AND his security management!!! Most people find PGP extremely difficult to use. A good report on this can be found at http://www.cs.cmu.edu/~alma/johnny.pdf

SafeIT (recommended)

http://www.SafeIT.com
This is a really good and user-friendly protection for your e-mails. It is fast and easy to get started and it is simple to use. The user mails just as usual usin g his normal e-mail program. Many people use SafeIT simply because it is so simple to use and also to tell customers to use it. Softnet Security, the company behind the product is from Sweden. They were recently given the first global export license for strong encryption of 480 bits. http://194.22.106.5/en/media/pressreleases/010123.html

The security level is extremely high compared to other products and the establishment of secure contacts thru the usage of a 2048 bit asymmetric start using the Diffie-Hellman key exchange system. Thereafter the communication will be carried out with symmetric encryption. The keys used are discarded after each message is eschanged - which is a feature they are alone in the whole market with. You can choose between the symmetric algorithms Blowfish, Twofish, Rijndael/AES and the proprietary SafeIT algorithm.

The total security is superior to other products and seeing as how SafeIT is very much more user friendly than comparable products that makes it even more secure. If it is easy to use it means you will use it - if it is difficult you will not. SafeIT is wholly automatic and the user friendliness. You can use several e-mail accounts / addresses with the program. The negative aspects are that the program only supports PC users with WIN 95/98 NT, 2000 and XP. The program is free for normal users and can be upgraded for pros.

Awarded by Secure Computing Magazine:
http://www.westcoast.com/securecomputing/2001_08/testc/prod2.html#SafeIT

ZixMail

http://www.zixmail.com
Zixmail is a relatively new company listed on Nasdaq which has amassed tons of venture capital and is worth billions in stock market value. The product Zixmail is a new innovation that enables the sender to send encrypted e-mail to any recipient regardless of if the recipient has the program, a password or anything else. Fantastic. And free to boot. A closer look reveals the frightening truth that the security offered is nil, almost ridiculous.

A short brief of how it is supposed to work:

1. Download the program. Works like an e-mail program.

2. Create a special password.

3. Send an e-mail to my counterpart that does not have the program.

4. The e-mail will be delivered to the Zixmail server.

5. The counterpart will get an e-mail from Zixmail informing him to connect to Zixmail and choosing a password.

6. The counterpart will get a second e-mail, click on to the server - read mail.


Thus far it is all well and fine - except that it is a bit of a quirky process to send ONE e-mail. There are also certain flaws in the process such as the security clearance of the employees at ZixMail who can read the message in clear text and also that only SSL is used to protectthe messages. But when analysing further the security of the whole system you discover fatal flaws designed by the developer. If an eavesdropper where to catch the e-mail mid-flight then he can access the ZixMail server and register a new password. Not good.

In conclusion the product is dangerous in itself - since users can be led to believe they have protection when they have not. In most cases it is probably more safe to send an e-mail the normal way and hope for the best. By using the flawed security of ZixMail you basically mark information you want to protect as "secret" without making it a secret. Just like sending money in the mail, and marking the envelope "WARNING! CONTAINS LARGE SUMS OF MONEY".

Protecting Word and Zip-files with encryption (low security)

You can password protect Word, Excel, powerpoint, Publisher and Zip files. You can then send them as attachments. The security here is veeeery low. There are even publicly available brute force attackers which open these in no time - just look thru a search engine. On the one hand people use crappy passwords, and on the other the algorithms used are decidedly not state-of-the-art.

Certificates

Certificates are really an asymmetric algorithm where you have a public key which is your identity and is guaranteed by a third party. Messages to you can be encrypted with your public key/identity, but only decrypted by whoever has that identity's private decryption key. In Netscape and Outlook there are built-in certificate functions, which few choose to trust. During the fall of 1999 it was discovered that the Netscape certificate was only so much hot air, with no security.

Certificates are a much touted method, not least by governments who have even drafted laws implementing it. In security terms the method is not to be recommended, but has been backed by the possibility to make electronic signatures. There are many standards out there and the most common are RSA and S/MIME, then there are many certificators and many guarantors. The problem is that the standars and the differens certificate systems do not work well together.

Those who issue identities (the public and the private keys) give no real guarantees that the confidence will not be breached. To add to this incertainty the people at the certification authority are not neccesarily trustworthy. If someone can access the private key then they can getat the information. In many instances it can be much worse to live under the illusion that you ARE protected, than to know that you are not. All systems that build on guarantees from a third party carry other inherent risks, both with your own and others' management of your security.

Additional e-mail security programs

There are many. Most work according to the principle that you encrypt a file and attach it to an e-mail. The problem is that you must distribute your key in some way and only to the right recipient.

Some can be found here:

http://download.cnet.com/downloads/0-10000.html?tag=st.cn.10105-ron.sb.10000
http://www.pepsoft.com/

Source References

 More