Thursday, January 30, 2014

Now Octatriaconta-Certified with GICSP Goodness. . .

From the SANS Global Information Assurance Certification (GIAC) on January 30th, 2014:

Christopher J. Marcinko -- Global Industrial Cyber Security Professional (GICSP)
"GIAC presents this certification to Christopher J. Marcinko who has met the necessary requirements and demonstrated a mastery of the subject matter and security skills to earn the Global Industrial Cyber Security Professional - GICSP."

Christopher J. Marcinko @ AcclaimDate of Certification:
January 30th, 2014

Expiration Date:
January 31st, 2022

Certificate Number:
74

Thursday, January 9, 2014

@securityguy23:

Back from a Check Point install in Austin -- returning to regularly scheduled programming, already in progress. . .

Sunday, January 5, 2014

No, I Do Not Want to Become a Part of Your Summit (Update4)

Update4 (August 9th, 2014 @ 9:30a):
Still getting a handful of these scam emails each month. Not nearly as many I used to, though I gather many many others out there are (based on the traffic to this page)

What I am receiving directly still look like retreads of the previous messages. Names, dates, and company references have been changed. The general message still remains (all but) the same.

Did see one new derivative with a different domain name, though. This one claiming that I've been nominated to be a cool leader. That's nice. Certainly been called worse by people who know me better. . .

----- Original Message -----
To: Denny [MASKED]
From: Matt T. Keener
Subject: Denny, question

Hi Denny, one of our members had nominated you for membership and I just wanted to follow-up on that request if you could advise.

We are a high level group of top COOs and Operations executives who meet monthly. You will find the other executives, topics, dates, and yearly dues info here.

www [DOT] cooleaders [DOT] org

Place my name in the last field of our signup page before our next monthly meeting for 10 pcnt from dues and I will also walk it through our screening committe.


Yours Truly,
Matt T. Keener
Operations Summit
The Organization of COOs and Operations Executives


This message is confidential and intended only for the original recipient. If you have received this message in error, please delete it or mail us back with re move in the sub ject. If any follow-up is needed I show your contact information as: Denny [MASKED], dweldon@[MASKED] Anderson Oil and Tire Co 254-840-2781 and you may also reach us at 1200 Abernathy Rd, Atlanta GA 30328 or through the contact page of our site. Thank you.


Update3 (January 5th, 2014 @ 8:30p):
Still getting a handful of these scam emails each week.

Most are just retreads of the previous messages. Names, dates, and company references have been changed. The general message still remains (all but) the same.

Others are similar, but are using tweaked domain names -- such as:
From:
Chris H Sanders (chrissanderpm1133 [AT] gmail [DOT] com) talking about "projectmanagementleaders [DOT] org" meetings on January 21st and February 18th, 2014

J.R. Williams (jason [AT] the-ciosummit [DOT] net) talking about another derivitive program named "the-ciosummit [DOT] net"

Chris H Sanders (chrissanderscio1144[AT]gmail [DOT] com) talking about "ciosummits [DOT] org" meetings on January 10th, February 14th, and March 15th, 2014

Still others (somewhat oddly) are forwarded versions of the original in an attempt to 'follow-up' on the first salespitch.
Hi Gabriel, I was just checking back to see if you had reached a decision per my original email below. We have a couple of openings and I thought you would enjoy the group. Here's a partial list of some of our members and speakers:

AT&T
Boston Scientific
Cisco
Logitech
Nordstrom

And also a number of smaller companies where we thought the head of Engineering had a lot of creativity and ideas to share.

Can you look at the www[DOT]theengineeringsummit[DOT]org meeting schedule and get back to me or relay if you think another is more appropriate? The others would really enjoy your participation.

Sincerely yours,
P. Hansen
Engineering-Summits
The Organization of Engineering Executives
www[DOT]theengineeringsummit[DOT]org


----- Original Message -----
To: Gabriel [MASKED]
From: P. Hansen
Subject: Gabriel, question

Hi Gabriel, on behalf of our Board I wanted to ask if you would like to become a part of the Engineering-Summits because of your experience and key role.

We are a high level group comprised of top Engineering executives and visionaries. We meet monthly by phone to exchange what is working, what is not, strategies and ideas. Our main goal is to help each other achieve. For a list of those you would be interacting with and upcoming meeting dates see:
www[DOT]theengineeringsummit[DOT]org

I am certain you will find the experience really useful in your efforts. Let me know of your decision (or relay if you think another is more appropriate as we wish involvement from your company). Thanks Gabriel.


Sincerely yours,
P. Hansen
Engineering-Summits
The Organization of Engineering Executives


Update2 (July 13th, 2013 @ 12:41p):
Received another version of the scam this week.

This one quotes certain companies who they claim will be represented. And though its pointing the reader towards the Project Management Summit (projectmanagementsummit [DOT] net), the email headers show it was sent via Association Growth Summit (associationgrowthsummit [DOT] net)

Also -- got pinged by another recipient of the scam who noted his version called themselves the "Human Resources Leadership Group"


Update1 (May 15th, 2013 @ 8:48a):

Received a new derivative of the scam this morning. This time speaking of an Engineering Summit on June 20th


Original Post (May 1st, 2013 @ 5:00p):
I've received a few emails every couple of days since April 10th in the catchall box which caught my eye.

Each ask if I would be interested in some sort of leaders summit. Some for a "Project Management Summit." Some for an "Engineering Summit." Some for an "Engineering Management Leaders Group." And several other derivatives.

So this seems like standard spam when just looking at its face value. Particularly since the text is generally the same, complete with the quirky english and the repeating formatting errors. And a quick Google search for a snip-it of the email pulls up a plethora of scam warnings from the last few years.

Except for this weirdness -- each of these emails are being sent to people I used to work with at EDS, if they had a @christoperj.com email address.

So if question 1 is "what the crap?", questions 2 and 3 follow oh so close behind with "how the hell?" and "why for?"

Not so sure about either, though I agree with the internet consensus that this incident seems probably only just a scam and not necessarily malicious.

I've received eight emails as of this moment. Last one being from 8:39a yesterday morning.
Email #1:
From: Matthew T. Kenner
Subject: Tim, question
Sent to: Tim M. on April 10 for a "COO Summit" @ www [DOT] theoperationssummit [DOT] org
(via 66.109.23.136 / Galaxyvisions Inc in Brooklyn, NY)

Email #2:
From: Matthew Kenner
Subject: Randy, question
Sent to: Randy G. on April 10 for a "Project Management Summit" @ www [DOT] projectmgmtsummit [DOT] com
(via 208.72.154.164 / Biz Summits in Marrietta, GA)

Email #3:
From: P. Hansen
Subject: Sally, question
Sent to: Sally C. on April 11 for "Engineering-Summits" @ www [DOT] theengineeringsummit [DOT] org
(via 207.234.177.42 / Affinity Internet in Ft. Lauderdale, FL)

Email #4:
From: Pat M. Hansen
Subject: Randy, question
Sent to: Randy S. on April 12 for a "Engineering-Summit" @ www [DOT] theengineeringsummit [DOT] org
(via 207.234.177.42 / Affinity Internet in Ft. Lauderdale, FL)

Email #5:
From: Chris Sanders
Subject: Obie, meeting request
Sent to: Obie D. on April 22 for a "Engineering Management Leaders group" @ engineering-summit [DOT] org
(via 209.85.213.198 / Google Gmail SMTP)

Email #6:
From: Patrick M. Hansen
Subject: Priscilla, question
Sent to: Priscilla D. on April 29 for a "Engineering Summit" @ www [DOT] theengineeringsummit [DOT] org
(via 207.234.177.42 / Affinity Internet in Ft. Lauderdale, FL)

Email #7:
From: Matt T. Kenner
Subject: Lynne, question
Sent to: Lynne B. on April 30 for a "Project Mgmt Summits" @ www [DOT] projectmgmtsummit [DOT] com
(via 208.72.154.164 / Biz Summits in Marrietta, GA)

Email #8:
From: Matt T. Kenner
Subject: Linda, question
Sent to: Linda A. on April 30 for a "Project Mgmt Summits" @ www [DOT] projectmgmtsummit [DOT] com
(via 208.72.154.164 / Biz Summits in Marrietta, GA)

Every email received is using a name of a (previous) peer to derive a @christoperj.com address using the same standard: First Initial + Last Name @ christoperj.com.

I worked with each of them somewhere within a five year range when I was doing Managed Firewall Engineering at EDS. And the groups or summits listed do seem to line up with what they would have been responsible at the time.

The general text matches up in each email, with only a few key details (such as the advertised summit/group name) changed from one message to the next. Spacing errors match up. As does the type in the footer address which shows 201 (Two-Zero-One) as 2O1 (Two-Letter O-One), leading me to believe the original template was created with some sort of voice recognition or OCR scanning.

Example Email:
Hi Linda, on behalf of our Board I wanted to ask if you would like to become a part of the Project Mgmt Summits because of your experience and key role.

We are a high level group comprised of top Project Management executives and visionaries. We meet monthly by phone to exchange what is working, what is not, strategies and ideas. Our main goal is to help each other achieve. For a list of those you would be interacting with and upcoming meeting dates see: www [DOT] projectmgmtsummit [DOT] com

I am certain you will find the experience really useful in your efforts. Let me know of your decision (or relay if you think another is more appropriate as we wish involvement from your company). Thanks Linda.


Truly,
Matt T. Keener
Project Mgmt Summits
The Organization of Project Management Executives



This message is confidential and intended only for the original recipient. If you have received this message in error, please delete it or mail us back with re move in the sub ject. If any follow-up is needed I show your contact information as: Linda A[MASKED], la[MASKED]@christoperj.com, Paul Anderson Robert 254-840-2781 and you may also reach us at 2O1 17th Street, 17th Floor, Atlanta Georgia 3O363 or through the contact page of our site.

So all that said -- it's clear these emails want the readers to visit four specific websites:
www [DOT] theoperationssummit [DOT] org @ 50.63.202.4
www [DOT] projectmgmtsummit [DOT] com @ 66.240.166.202
www [DOT] theengineeringsummit [DOT] org @ 50.63.202.29
engineering-summit [DOT] org @ 208.76.222.197

Ran all of them through some standard online link security checkers.
www [DOT] theoperationssummit [DOT] org
Google Safe Browsing: Safe
PhishTank: Safe
Web Of Trust: Low Confidence Reputation
VirusTotal: Safe (0 Malware Detected vs. 38 Scanners, and no downloads detected)
www [DOT] projectmgmtsummit [DOT] com
Google Safe Browsing: Safe
PhishTank: Safe
Web Of Trust: Not Enough Ratings to Score
VirusTotal: Safe (0 Malware Detected vs. 38 Scanners, and no downloads detected)
www [DOT] theengineeringsummit [DOT] org
Google Safe Browsing: Safe
PhishTank: Safe
Web Of Trust: Poor Reputation (Reported Spam Domain)
VirusTotal: Safe (0 Malware Detected vs. 38 Scanners,and no downloads detected)
engineering-summit [DOT] org
Google Safe Browsing: Safe
PhishTank: Safe
Web Of Trust: Not Enough Ratings to Score
VirusTotal: Safe (0 Malware Detected vs. 38 Scanners,and no downloads detected)

I also opened up all four sites on my sandbox machine and dumped all the traffic to a PCAP -- but didn't find any weirdness in my picking through the packet stream.

Did, however, notice each of the domains are using an imbeded frame to mask how they are actually pulling their templates from a parent webserver @ http:// shrtct [DOT] net/[SPECIFIC SHORTCUT FOR DOMAIN]/
(Sanitized) HTML Code Pulling Template for Engineering Summit Version
frameset rows="100%,*" border="0"
frame src="http://shrtct [DOT] net/engineeringsummit/" frameborder="0" /
frame frameborder="0" noresize /
/frameset

In fact, all of the Summit page templates are basically the same. The title and the target audience seems to be the only thing which is different from one site to the next. They even all use the same four rotating stock images on the home page to help "sell" the site.
Home page of the COO Summit website
Home page of the COO Summit website
Home page of the Project Management Summit page
Home page of the Project Management Summit page
Home page of the Engineering Summit page
Home page of the Engineering Summit page (regardless of which version of the Engineering Summit link is clicked)

The root of the shrtct [DOT] net website identifies itself as "Arja: The Management ThinkTank." A "Members Only" section is offered, but is actually a dead link.
Webpage on the root of the three parent domains being used to host the various templates
Webpage on the root of the three parent domains being used to host the various templates
The secure login page was not found
The secure login page was not found

Did a DNS lookup on the actual destination server.
shrtct [DOT] net
A: 64.71.39.117, 66.113.129.243, 64.26.0.115

NS: a [DOT] dns [DOT] hostway [DOT] net
& b [DOT] dns [DOT] hostway [DOT] net

Reverse IP DNS: also hosting passto [DOT] org &
shrtcut [DOT] net
(all of which pull up the same "Arja: The Management ThinkTank." website

A Google site: search for everything hosted off on all three parent domains brings up a myriad of additional "Summit" sites.
Association Growth Summit @ www [DOT] associationgrowthsummit [DOT] net

BizSummits @ www [DOT] bizsummits [DOT] org

CFO Summit @ www [DOT] cfosummit [DOT] org

CIO Summit @ www [DOT] ciosummit [DOT] org

CMO Summit @ www [DOT] cmosummit [DOT] net

Corp Develop Summit @ www [DOT] corpdevsummit [DOT] org

Corporate Council Summit @ www [DOT] thecorporatecounselsummit [DOT] org

Customer Service Summit @ www [DOT] customerservicesummit [DOT] org

Engineering Summit @ www [DOT] theengineeringsummit [DOT] net

Hospital Growth Summit @ www [DOT] hospitalgrowthsummit [DOT] org

HR Summit @ www [DOT] hrsummit [DOT] org

Procurement Summit @ www [DOT] procurementsummit [DOT] org

Product Dev Summit @ www [DOT] productdevsummit [DOT] org

Project Management Summit @ www [DOT] projectmanagementsummit [DOT] org

Public Relations Summit @ www [DOT] thepublicrelationssummit [DOT] org

Quality Management Summit @ www [DOT] qualitymanagementsummit [DOT] org

Rick Management Summit @ www [DOT] riskmanagementsummit [DOT] org

Safety Management Summit @ www [DOT] safetymanagementsummit [DOT] org

Sales Summit @ www [DOT] salessummit [DOT] org

Supply Chain Summit @ www [DOT] supplychainsummit [DOT] org

Training Summit @ www [DOT] trainingsummit [DOT] org

As with the ones I received emails for -- all seemed to use the same general template, with only few words were tweaked from one version to the next. Sampled a few. Nothing malicious popped up here either.

The endgame on each site seems to be to sell a membership to the networking group at a cost of $1250 for the first year, or $2250 for two years (at a 10% discount). Holy crap on a cracker!
(Cough) $1250 for a membership to stuff I can get for basiclly free elsewhere?
(Cough) $1250 for a membership to stuff I can get for basiclly free elsewhere?
Benefits included with the ginormous $1250 cost
Benefits included with the ginormous $1250 cost

Can't speak to the actual value of what benefits they claim are included. But what the benefits they advertise seem to easily equate to what I've seen for free through a wide variety of other internet based business networking resources. I'm guessing the mammoth $1250 cost is simply intended to catch those who are not remotely internet savvy or are just looking to spend their company's money without the same skepticism they would have if it was coming out of their own wallet.

These sites might be phishing for the valid credit card information. But it seems like if they were, the cost would be much much MUCH lower to make it far more enticing.

That said, I do think it's very likely that it's taking the phished contact information for whoever signs up and applying it to the affiliated sales leads database(s).

Particularly since the parent webservers also seem to be hosting quite a few other 'sales' related websites. Many of them seem to have specific pages promoting the use email marketing (ie. SPAM). And just as with the Summit pages, many of them also share the same template.
Exactleads @ exactleads [DOT] com

Finance LeadFunnel @ financeleadfunnel [DOT] com

GoPresent @ www [DOT] gopresent [DOT] com

HR LeadFunnel @ www [DOT] leadfunnel [DOT] com

LeadFunnel @ www [DOT] leadfunnel [DOT] com

Meeting Setters @ meetingsetters [DOT] com

Sales LeadFunnel @ salesleadfunnel [DOT] com

TCollaborate @ www [DOT] tcollaborate [DOT] com

TeamEX Strategy Execution System @ www [DOT] teamex [DOT] com

TInnovate @ www [DOT] tinnovate [DOT] com

Sampled a few of these too. Saw nothing malicious here either.

So that's that.

The question remains, however -- how the crap did this spam make the connection between my old peers and my website? Not sure. But I do have a theory.

I have connected to each of them via Linkedin. Must be more than that though, as these are only a small subset of my Linkedin connections. And these are ones I've directly worked with (unlike most of the full list out on Linkedin).

Looking closer -- each of the eight have posted professional recommendations for me out on Linkedin. And each of their good words are reflected out @ christoperj|[.com]: Professional Recommendations, complete with their name and what their job role was at the time.
All LinkedIn professional recommendations are echoed here
All LinkedIn professional recommendations are echoed here
One of the specific names for which I received an email
One of the specific names for which I received an email

Bingo.

I'm now all but certain a web spider came along and crawled my website doing social reconnaissance for employed users and their positions. Having found some that seemed to match it's predefined criteria, it blindly harvested the names and added them to the applicable marketing list. Oops.

Probably didn't even scan a ginormus section of the internet to find the site. I've been using my securityguy23@(harmonic:security) email address for years on all InfoSec and resume' related conversations/posts. And right now, (harmonic:security) cleanly redirects over to christoperj|[.com]. The spider script probably just saw the redirect and assumed the final destination was just an updated domain. Certainly not a stretch given how often companies are acquired and/or otherwise change names these days.

What I am still not sure about is how they came up with the email address format. It's not the format I use for either christoperj|[.com] or (harmonic:security) email domain addresses. And this seems to be the one only format attempted as I haven't seen any other emails hit the box using different variations. Also not sure why I have not received emails addressed to any of the others who's names are out there. Perhaps both are just a matter of time.

Whatever the case, the mystery solved of why I'm receiving emails for my old EDS peers has been solved.

Is this SPAM? -- Oh yes.

Is this a MALICIOUS attempt to do badness? -- Probably not.

Would I recommend doing business with any of these sites? -- Oh no no no no no no. . .

Good times.


Full Source Example #1:
Delivered-To: christoperj
Received: by [MASKED] with SMTP id jt9csp55099ldc;
Tue, 30 Apr 2013 06:55:40 -0700 (PDT)
X-Received: by 10.112.72.131 with SMTP id d3mr13193412lbv.18.1367330139498;
Tue, 30 Apr 2013 06:55:39 -0700 (PDT)
DomainKey-Status: bad format
Received-SPF: pass (: domain of mkeener@projectmgmtsummit.com designates 208.72.154.164 as permitted sender) client-ip=208.72.154.164;
Received: by [MASKED] with POP3 id p11mf383817lbi.6;
Tue, 30 Apr 2013 06:55:37 -0700 (PDT)
X-Gmail-Fetch-Info: [MASKED] 8 [MASKED] 995 [MASKED]
Return-Path:
Delivered-To: <[MASKED]>
Received: from mx1.[MASKED] ([[MASKED]])
by mss-us12.[MASKED] (Dovecot) with LMTP id VCvUHwHJf1EVBQAAkZ4h7A
for <[MASKED]>; Tue, 30 Apr 2013 13:39:32 +0000
Received: from mail.projectmgmtsummit.com (mail.projectmgmtsummit.com [208.72.154.164])
by mx1.[MASKED] (Postfix) with ESMTP id 99A184701FA
for ; Tue, 30 Apr 2013 13:39:32 +0000 (GMT)
Received: from 47503802.projectmgmtsummit.com
by mail.check-details.net (Exact Sender 3.8) with ASMTP id PRR18332
for ; Tue, 30 Apr 2013 09:39:32 -0400
Message-ID: <20130430093919.3e4c8b5b5b@4f4c>
From: "Matt T. Keener"
To: "Linda A[MASKED]"
Subject: Linda, question
Date: Tue, 30 Apr 2013 09:39:19 -0400
MIME-Version: 1.0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Hi Linda, on behalf of our Board I wanted to ask if you would like to =
become a part of the Project Mgmt Summits because of your experience and =
key role=2E

We are a high level group comprised of top Project Management executives =
and visionaries. We meet monthly by phone to exchange what is working, =
what is not, strategies and ideas. Our main goal is to help each other =
achieve. For a list of those you would be interacting with and upcoming =
meeting dates see: www [DOT] projectmgmtsummit [DOT] com

I am certain you will find the experience really useful in your efforts. =
Let me know of your decision (or relay if you think another is more =
appropriate as we wish involvement from your company). Thanks Linda=2E


Truly,
Matt T. Keener
Project Mgmt Summits
The Organization of Project Management Executives



This message is confidential and intended only for the original recipient. =
If you have received this message in error, please delete it or mail us =
back with re move in the sub ject. If any follow-up is needed I show your =
contact information as: Linda A[MASKED], la[MASKED]@christoperj.com, Paul =
A[MASKED] Robert 254-840-2781 and you may also reach us at 2O1 17th =
Street, 17th Floor, Atlanta Georgia 3O363 or through the contact page of =
our site.
Full Source Example #2:
Delivered-To: christoperj
Received: by [MASKED] with SMTP id jt9csp17044ldc;
Mon, 29 Apr 2013 07:18:53 -0700 (PDT)
X-Received: by [MASKED] with SMTP id vu3mr20512771lbb.109.1367245132353;
Mon, 29 Apr 2013 07:18:52 -0700 (PDT)
DomainKey-Status: bad format
Received-SPF: pass (: domain of patrick@theengineeringsummit [DOT] org designates 207.234.177.42 as permitted sender) client-ip=207.234.177.42;
Received: by [MASKED] with POP3 id o11mf2690184lbi.14;
Mon, 29 Apr 2013 07:18:51 -0700 (PDT)
X-Gmail-Fetch-Info: [MASKED] 8 [MASKED] 995 [MASKED]
Return-Path:
Delivered-To: <[MASKED]>
Received: from mx1.[MASKED] ([[MASKED]])
by mss-us12.[MASKED] (Dovecot) with LMTP id C2ohBlV0flEnCwAAkZ4h7A
for <[MASKED]>; Mon, 29 Apr 2013 13:24:07 +0000
Received: from mail.theengineeringsummit.org (unknown [207.234.177.42])
by mx1.[MASKED] (Postfix) with ESMTP id 409413F0031
for ; Mon, 29 Apr 2013 13:24:05 +0000 (GMT)
Received: from 101882955 [DOT] theengineeringsummit [DOT] org
by thecfosummit [DOT] org (Time Mail 5.5) with ASMTP id ORA01155
for ; Mon, 29 Apr 2013 09:23:55 -0400
Message-ID: <20130429092349.9d2e4e8d1d@2f5e>
From: "Patrick M. Hansen"
To: "Priscilla D[MASKED]"
Subject: Priscilla, question
Date: Mon, 29 Apr 2013 09:23:49 -0400
X-Priority: 3
X-Mailer: NoteForwarder
MIME-Version: 1.0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Hi Priscilla, on behalf of our Board I wanted to ask if you would like to =
become a part of the Engineering Summit because of your experience and =
key role=2E

We are a high level group comprised of top Engineering executives and =
visionaries. We meet monthly by phone to exchange what is working, what is =
not, strategies and ideas. Our main goal is to help each other achieve. =
For a list of those you would be interacting with and upcoming meeting =
dates see:=20
www [DOT] theengineeringsummit [DOT] org

I am certain you will find the experience really useful in your efforts. =
Let me know of your decision (or relay if you think another is more =
appropriate as we wish involvement from your company). Thanks Priscilla=2E


Truly,
Patrick M. Hansen
Engineering Summit
The Organization of Engineering Executives



This message is confidential and intended only for the original recipient. =
If you have received this message in error, please delete it or mail us =
back with re move in the sub ject. If any follow-up is needed I show your =
contact information as: Priscilla D[MASKED], pd[MASKED]@christoperj.com, Paul =
A[MASKED] Robert 254-840-2781 and you may also reach us at 1200 Abernathy =
Road #1700, Atlanta Georgia 30328 or through the contact page of our site.
Full Source Example #3:
Delivered-To: christoperj
Received: by [MASKED] with SMTP id h2csp110878ldy;
Wed, 10 Apr 2013 07:28:49 -0700 (PDT)
X-Received: by [MASKED] with SMTP id od6mr1310224lbb.122.1365604125298;
Wed, 10 Apr 2013 07:28:45 -0700 (PDT)
DomainKey-Status: bad format
Received-SPF: pass (: domain of matthew@theoperationssummit.org designates 66.109.23.136 as permitted sender) client-ip=66.109.23.136;
Received: by [MASKED] with POP3 id 10mf470264lbf.11;
Wed, 10 Apr 2013 07:28:44 -0700 (PDT)
X-Gmail-Fetch-Info: [MASKED] 8 [MASKED] 995 [MASKED]
Return-Path:
Delivered-To: <[MASKED]>
Received: from mx1.[MASKED] ([10.98.98.247])
by mss-us12.[MASKED] (Dovecot) with LMTP id T/TPIdFzZVGdIAAAkZ4h7A
for <[MASKED]>; Wed, 10 Apr 2013 14:22:15 +0000
Received: from theoperationssummit.org (unknown [66.109.23.136])
by mx1.[MASKED] (Postfix) with ESMTP id 469DC5406C3
for ; Wed, 10 Apr 2013 14:22:15 +0000 (GMT)
Received: from 95652785.theoperationssummit.org
by mail.teamexcollaboration.net (Time Sender 3.5) with ASMTP id VSG11909
for ; Wed, 10 Apr 2013 10:22:09 -0400
Message-ID: <20130410102159.8b7b5f8d8b@5b3d>
From: "Matthew T. Keener"
To: "Tim M[MASKED]"
Subject: Tim, question
Date: Wed, 10 Apr 2013 10:21:59 -0400
X-Priority: 3
X-Mailer: Email Mailer
MIME-Version: 1.0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Hi Tim, on behalf of our Board I wanted to ask if you would like to become =
a part of the COO Summit because of your experience and key role=2E

We are a high level group comprised of top COOs and Operations executives =
and visionaries. We meet monthly by phone to exchange what is working, =
what is not, strategies and ideas. Our main goal is to help each other =
achieve. For a list of those you would be interacting with and upcoming =
meeting dates see:=20
www [DOT] theoperationssummit [DOT] org

I am certain you will find the experience really useful in your efforts. =
Let me know of your decision (or relay if you think another is more =
appropriate as we wish involvement from your company). Thanks Tim=2E


Sincerely yours,
Matthew T. Keener
COO Summit
The Organization of COOs and Operations Executives



This message is confidential and intended only for the original recipient. =
If you have received this message in error, please delete it or mail us =
back with re move in the sub ject. If any follow-up is needed I show your =
contact information as: Tim M[MASKED], tm[MASKED]@christoperj.com, Paul =
A[MASKED] Robert 254-840-2781 and you may also reach us at 12OO Abernathy =
Road #1700, Atlanta Georgia 30328 or through the contact page of our site.


Update May 15th, 2013 @ 8:48a
Full email from latest derivative. . .

Delivered-To: christoperj@
Received: by 10.23.23.23 with SMTP id k10csp18424ldd;
Wed, 15 May 2013 07:27:39 -0700 (PDT)
X-Received: by 10.152.120.4 with SMTP id ky4mr18170590lab.5.1368628054568;
Wed, 15 May 2013 07:27:34 -0700 (PDT)
DomainKey-Status: good
Received-SPF: pass (: domain of 3D5aTUREJCRw49JAKK2F56JK6TTUU8E2AD.4GE87GFL6FGL49JAKLGH6JB.4GE@maestro.bounces. designates 209.85.223.197 as permitted sender) client-ip=209.85.223.197;
Received: by 10.152.100.212 with POP3 id fa20mf387742lab.27;
Wed, 15 May 2013 07:27:33 -0700 (PDT)
X-Gmail-Fetch-Info: [MASKED] 8 pop.[MASKED] 995 [MASKED]
Return-Path: <3D5aTUREJCRw49JAKK2F56JK6TTUU8E2AD.4GE87GFL6FGL49JAKLGH6JB.4GE@maestro.bounces.>
Delivered-To: <[MASKED]>
Received: from mx1.[MASKED] ([10.98.98.247])
by mss-us12.[MASKED] (Dovecot) with LMTP id ApWJF2KVk1ELTAAAkZ4h7A
for <[MASKED]>; Wed, 15 May 2013 14:05:06 +0000
Received: from mail-ie0-f197. (mail-ie0-f197. [209.85.223.197])
by mx1.[MASKED] (Postfix) with ESMTP id 6BE4E5427DE
for ; Wed, 15 May 2013 14:05:04 +0000 (GMT)
Received: by mail-ie0-f197. with SMTP id 16so6662803iea.0
for ; Wed, 15 May 2013 07:05:04 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=; s=20120113;
h=mime-version:x-received:message-id:date:subject:from:to
:content-type;
bh=BKgtY2minLkUh5aGZJb5V6P5iEwxjeOjpWkAVGPDmJU=;
b=JDbCAMFDEVOQ9HqfPWfBJBYDsDDlhD5x1ylWuow8Hs+YWC9GMtV3x/IRHHMI4q2ASv
OnYgxsUaHDm+Ji+o3OwtDrQKnentZjkmhVc4FdfX96jUzIvtI/6IxVzyWH9T9WYUC2/R
FlwtdMHnUkM8/KcJt4MKoouo7D2UL27ZGaKdbKFZGjjLqJ7JYQbBZRBIftSr9Jyt5LaR
njStB0/Io4Juq+sWoOUQqiza2FCW5xvLqNqatacqn7a+YjMFLRVZyu9xQe8GTUC7bKbS
p4D+xhAPVsyMBNzh2cqqlYU9cyu1KtxFiz73V+/6ToQnXVmhAPTbEZF1IYXElYbRVUni
z/dg==
MIME-Version: 1.0
X-Received: by 10.23.23.23 with SMTP id az1mr10871160obb.26.1368626703763;
Wed, 15 May 2013 07:05:03 -0700 (PDT)
Message-ID: <089e01176259825ca904dcc23c19@>
Date: Wed, 15 May 2013 14:05:03 +0000
Subject: Gabriel, question
From: Chris H Sanders
To: g[MASKED]@christoperj.com
Content-Type: multipart/alternative; boundary=089e01176259825c9f04dcc23c16

--089e01176259825c9f04dcc23c16
Content-Type: text/plain; charset=ISO-8859-1; format=flowed; delsp=yes
Content-Transfer-Encoding: base64

PGRpdiBkaXI9Imx0ciI+PGRpdj5EZWFyIEdhYnJpZWwsPC9kaXY+PGRpdj6gPC9kaXY+PGRpdj5J
IHdhbnRlZCB0byByZWFjaCAgDQpvdXQgYW5kIHNlZSBpZiB5b3Ugd291bGQgbGlrZSB0byBiZWNv
bWUgYSBwYXJ0IG9mIGEgRW5naW5lZXJpbmcgTWFuYWdlbWVudCAgDQpMZWFkZXJzIGdyb3VwLCB3
ZSB0aGluayB0aGF0IHlvdSB3b3VsZCBiZSBhIGdyZWF0ICANCmFkZGl0aW9uLjwvZGl2PjxkaXY+
oDwvZGl2Pg0KDQoNCg0KDQoNCg0KPGRpdj5PdXIgbmV4dCBtZWV0aW5nIGlzIG9uIDYvMjAuIFRo
ZSBFbmdpbmVlcmluZyBNYW5hZ2VtZW50IGxlYWRlcnMgdGhhdCAgDQp3aWxsIGJlIHByZXNlbnRp
bmcgdGhlaXIgYmVzdCBwcmFjdGljZXMgYW5kIGlkZWFzIGluY2x1ZGUgQmFyY2xheXMsIFVOVU0g
IA0KYW5kIENoaXF1aXRhLiBXZSBtZWV0IG9uY2UgcGVyIG1vbnRoIHZpYSB0ZWxlY29uZmVyZW5j
ZSBhbmQgdGhlIG1lZXRpbmdzICANCnR5cGljYWxseSBsYXN0IGZvciBhbiBob3VyLjwvZGl2Pg0K
DQoNCg0KDQoNCg0KPGRpdj6gPC9kaXY+PGRpdj5TZWUgPGEgaHJlZj0iaHR0cDovL3RoZWVuZ2lu
ZWVyaW5nc3VtbWl0Lm5ldCIgIA0KdGFyZ2V0PSJfYmxhbmsiPnRoZWVuZ2luZWVyaW5nc3VtbWl0
Lm5ldDwvYT4gdG8gYmVjb21lIGEgcGFydCBvZiB0aGUgZ3JvdXAuICANCkp1c3QgZW50ZXIgdGhl
IGxldHRlcnMgQ1MzIGluIHRoZSBjb21tZW50cyBmaWVsZCBvZiB0aGUgc2lnbnVwIGZvcm0gdG8g
IA0KaW5kaWNhdGUgdGhhdCBJIGFza2VkIHlvdS4gRHVlIHRvIGxpbWl0ZWQgc3BhY2UgSSB3b3Vs
ZCBhZHZpc2UgdGhhdCB5b3UgIA0KYmVjb21lIGEgcGFydCBvZiB0aGUgZ3JvdXAgYmVmb3JlIG91
ciBuZXh0IG1lZXRpbmcgb24gNi8yMCwgdGhhbmsgeW91LjwvZGl2Pg0KDQoNCg0KDQoNCg0KPGRp
dj6gPC9kaXY+PGRpdj5LaW5kIFJlZ2FyZHMsPC9kaXY+PGRpdj6gPC9kaXY+PGRpdj5DaHJpcyBI
LiAgDQpTYW5kZXJzPC9kaXY+PGRpdj5FbmdpbmVlcmluZyBNYW5hZ2VtZW50IExlYWRlcnM8L2Rp
dj48ZGl2PlJlcGx5IHdpdGggIA0Kc3ViamVjdCCgUmUgbW92ZSBpZiB3aXNoZWQ8YnI+PC9kaXY+
PGRpdj42MDAgoE5vcnRoIKBQYXJrLCCgMTd0aCAgDQpGbG9vcjwvZGl2PjxkaXY+QXRsYW50YSwg
oEdlb3JnaWEgoDMwMzI4PC9kaXY+DQoNCg0KDQoNCg0KDQo8L2Rpdj4NCg==
--089e01176259825c9f04dcc23c16
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<[HTML DIV] dir=3D"ltr"><[HTML DIV]>Dear Gabriel,< [BACKSLASH] [HTML DIV] ><[HTML DIV]>=A0< [BACKSLASH] [HTML DIV] ><[HTML DIV]>I wanted to rea=
ch out and see if you would like to become a part of a Engineering Manageme=
nt Leaders group, we think that you would be a great addition.< [BACKSLASH] [HTML DIV] ><[HTML DIV]>=
=A0< [BACKSLASH] [HTML DIV] >






<[HTML DIV]>Our next meeting is on 6/20. The Engineering Management leaders that w=
ill be presenting their best practices and ideas include Barclays, UNUM and=
Chiquita. We meet once per month via teleconference and the meetings typic=
ally last for an hour.< [BACKSLASH] [HTML DIV] >






<[HTML DIV]>=A0< [BACKSLASH] [HTML DIV] ><[HTML DIV]>See theengineeringsummit [DOT] net to become a part of the group. Jus=
t enter the letters CS3 in the comments field of the signup form to indicat=
e that I asked you. Due to limited space I would advise that you become a p=
art of the group before our next meeting on 6/20, thank you.< [BACKSLASH] [HTML DIV] >






<[HTML DIV]>=A0< [BACKSLASH] [HTML DIV] ><[HTML DIV]>Kind Regards,< [BACKSLASH] [HTML DIV] ><[HTML DIV]>=A0< [BACKSLASH] [HTML DIV] ><[HTML DIV]>Chris H. Sanders<[HTML DIV]>Engineering Management Leaders< [BACKSLASH] [HTML DIV] ><[HTML DIV]>Reply with subject =A0Re =
move if wished
< [BACKSLASH] [HTML DIV] ><[HTML DIV]>600 =A0North =A0Park, =A017th Floor< [BACKSLASH] [HTML DIV] ><[HTML DIV]>=
Atlanta, =A0Georgia =A030328< [BACKSLASH] [HTML DIV] >






< [BACKSLASH] [HTML DIV] >

--089e01176259825c9f04dcc23c16--


Update July 13th, 2013 @ 12:41p
Full email from latest version. . .

Delivered-To: christoperj@
Received: by 10.23.23.23 with SMTP id es4csp259639ldc;
Mon, 8 Jul 2013 08:53:01 -0700 (PDT)
X-Received: by 10.112.155.161 with SMTP id vx1mr11057914lbb.78.1373298778073;
Mon, 08 Jul 2013 08:52:58 -0700 (PDT)
DomainKey-Status: bad format
Received-SPF: pass (: domain of mkeener@projectmanagementsummit.net designates 66.232.113.10 as permitted sender) client-ip=66.232.113.10;
Received: by 10.112.34.75 with POP3 id x11mf3389953lbi.35;
Mon, 08 Jul 2013 08:52:57 -0700 (PDT)
X-Gmail-Fetch-Info: [MASKED] 8 pop.[MASKED] 995 [MASKED]
Return-Path:
Delivered-To: <[MASKED]>
Received: from mx1.[MASKED] ([10.98.98.136])
by mss-us12.[MASKED] (Dovecot) with LMTP id rVuOI5PS2lE6XAAAkZ4h7A
for <[MASKED]>; Mon, 08 Jul 2013 14:54:52 +0000
Received: from mail.projectmanagementsummit.net (mail.projectmanagementsummit.net [66.232.113.10])
by mx1.[MASKED] (Postfix) with ESMTP id 3B6563F1253
for ; Mon, 8 Jul 2013 14:54:48 +0000 (GMT)
Received: from 20607534.projectmanagementsummit.net
by associationgrowthsummit.net (Merak 8.9.1) with ASMTP id TVK26442
for ; Mon, 08 Jul 2013 10:54:42 -0400
Status:
Message-ID: <20130708105428.6f1c9c7b2c@1f2d>
From: "Matt Keener"
To: "Sherrie [MASKED]"
Subject: Sherrie, following up.
Date: Mon, 8 Jul 2013 10:54:28 -0400
X-Priority: 3
X-Mailer: Microsoft Windows Mail 6.0.6001.18000
MIME-Version: 1.0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit

Hi Sherrie, I was just checking back to see if you had reached a decision
per my original email below. We have a couple of openings and I thought
you would enjoy the group. Here's a partial list of some of our members
and speakers:

- Adobe
- Sony
- Bank of America
- Bristol-Myers
- Garmin

And also a number of smaller companies where we thought the head of
Project Management had a lot of creativity and ideas to share.

Can you look at the www [DOT] projectmanagementsummit [DOT] net meeting schedule and
get back to me or relay if you think another is more appropriate? The
others would really enjoy your participation.

Truly,
Matt Keener
Project Management Summits
The Organization of Project Management Executives
www [DOT] projectmanagementsummit [DOT] net

----- Original Message -----

To: Sherrie [MASKED]
From: Matt Keener
Subject: Sherrie, question.

Hi Sherrie, on behalf of our Board I wanted to ask if you would like to
become a part of the Project Management Summits because of your
experience and key role.

We are a high level group comprised of top Project Management executives
and visionaries. We meet monthly by phone to exchange what is working,
what is not, strategies and ideas. Our main goal is to help each other
achieve. For a list of those you would be interacting with and upcoming
meeting dates see: www [DOT] projectmanagementsummit [DOT] net

I am certain you will find the experience really useful in your efforts.
Let me know of your decision (or relay if you think another is more
appropriate as we wish involvement from your company). Thanks Sherrie.

Truly,
Matt Keener
Project Management Summits
The Organization of Project Management Executives



This message is confidential and intended only for the original recipient.
If you have received this message in error, please delete it or mail us
back with re move in the sub ject. If any follow-up is needed I show your
contact information as: Sherrie [MASKED], s[MASKED]@christoperj.com, Paul
Anderson Robert 254-840-2781 and you may also reach us at 2O1 17th
Street, 17

Friday, January 3, 2014

Now Heptatriaconta-Certified with Palo Alto ACE Goodness. . .

From Palo Alto Networks on January 3rd, 2014:

Christopher J. Marcinko -- Palo Alto Networks Accredited Configuration Engineer (ACE)
Designation:
Accredited Configuration Engineer (ACE)

Date of Certification:
January 3rd, 2014

Wednesday, January 1, 2014

@christoperj:

Should auld acquaintance be forgot, and auld lang syne. . .