Warung Bebas

Senin, 05 Agustus 2013

Tanaman-tanaman langka khas Daerah Puncak Gunung/Kawah Gunung

     Bagi yang suka mendaki gunung pastinya kalian pernah menjumpai tumbuhan-tumbuhan ini kan? yap, tumbuhan ini sering dijumpai di ketinggian lebih dari 2000 mdpl, dimana biasanya tanaman-tanaman besar mulai jarang dan hampir mendekati puncak gunung, langsung aja ya...

1. Uta Onga (Begonia kelimutuensis)

http://www.biologi.lipi.go.id

     Ini dia spesies terbaru yang baru ditemukan oleh tim LIPI pada 2008. Tanaman endemik NTT ini hanya ditemukan di Taman Nasional Kelimutu, sehingga oleh para ahli diberi nama Begonia kelimutuensis, sebab setelah diteliti tumbuhan jenis ini tak ditemukan di tempat lain di dunia.

2. Cantingi Ungu (Vaccinium varingiaefolium)

http://wallacefund.info
     Tanaman dapat ditemui di ketinggian 1500-3300 mdpl. Walaupun tumbuhan ini mendominasi sekitar kawah pegunungan Jawa, penelitian yang dilakukan untuk mengungkap potensinya masih sangat minim.Cantingi Ungu yang berbunga kecil putih dan akan berubah menjadi hitam ketika matang, diyakini masyarakat setempat sebagai makanan para dewa

3. Jamuju (Dacrycarpus imbricatus)

homepage.univie.ac.at
     Jamuju adalah semacam tumbuhan konifer yang sering ditemui di banyak wilayah di asia tenggara. Tumbuhan ini juga sering disebut "kayu embun".

4. Edelweiss Jawa (Anaphalis Javanica)

firmanjaya.lecture.ub.ac.id
     Tumbuhan langka ini sering disebut "Bunga Abadi" karena tak mudah layu apabila telah dipetik. Tumbuhan ini dapat mencapai ketinggian 8 m dan dapat memiliki batang sebesar kaki manusia walaupun umumnya tidak melebihi 1 m. Tumbuhan ini sekarang dikategorikan sebagai langka karena para pendaki sering memetik bunga ini dan membawanya turun sebagai "oleh-oleh". Ya, memang rasanya belum afdhol apabila mendaki gunung kita belum melihat dan memetik edelweiss.

5. Turuwara (Rhododendron renschianum)

sfbotanicalgarden.org
Jenis Rodondhedron ini endemik di NTT khususnya di daerah Taman Nasional Kelimutu

6. Rhododendron javanicum

uniprot.org
     Jenis Rhodondedron ini juga endemik Indonesia, dan hanya dapat ditemui di pulau jawa dan bali.

Anak Bayi

Anak Bayi - Semua Ibu tentu ingin memberi yang terbaik bagi anaknya, dan bahkan sejak ia masih anak bayi. Salah satu yang menjadi perhatia seorang Ibu terhadap anak adalah kecerdasannya, Ibu akan melakukan beragam cara untuk membuat anaknya menjadi cerdas dak aktif. Nah, sejak masih bayi, Bunda sudah dapat melakukan beberapa cara dan kiat untuk mebuat anak bayi lebih cerdas. Apa saja itu? Berikut

10 Pulau Terbesar di Dunia

Ini dia 10 pulau terbesar di Dunia..

1. Greenland 


Luas                 : 2.175.600 Km2
Wilayah Negara : Divisi otonomi Denmark

2. Irian (Papua) 


Luas                 : 890.000 Km2
Wilayah Negara : Papua Nugini dan Indonesia

3. Kalimantan


Luas                 : 743.330 Km2
Wilayah Negara : Brunei Darussalam, Indonesia dan Malaysia

4. Madagaskar 


Luas                  :587.041 Km2
Wilayah Negara  : Madagaskar

5. Pulau Baffin 


Luas                  :507.451 Km2
Wilayah Negara  :Kanada

6. Sumatra 


Luas                   :425.000 Km2
Wilayah Negara   :Indonesia

7. Honshu 


Luas                   :227.414 Km2
Wilayah Negara   :Jepang

8. Britania Raya 


Luas                   :219.000 Km2
Wilayah Negara   :Inggris

9. Pulau Victoria 


Luas                    : 217.291 Km2
Wilayah Negara    : Kanada

10. Ellesmere


Luas                    : 196.236 Km2
Wilayah Negara    : Kanada

Spesies burung ini punah hanya oleh seekor kucing!

     Burung dengan Nama Little Bird Stephen Wern dan dengan nama latin Xenicus (Traversia) lyalli ini punah sekitar tahun 1900-an. Burung nokturnal yang masih termasuk dalam New Zealand Wern ini punah akibat pengenalan kucing ke habitatnya.. wuih, sungguh miris. Kepunahan burung ini memberikan contoh bahwa penyebab kepunahan tidak hanya akibat dari kekejaman manusia, tapi juga kebodohoan. Jadi begini ceritanya..


     Tahun 1879, manusia mulai datang ke Pulau Stephen, dan memulai sepak terjang kehidupan di pulau ini.


     Pada tahun 1894, sebuah mercusuar dibangun dipulau Stephen, pulau yang terisolasi berada di selat antara pulau Utara dan Selatan Selandia Baru. Sebelumnya, pulau ini belum pernah diinjak oleh manusia. Penunggu mercusuar itu, bernama David Lyall, mempunyai seekor kucing yang bernama "Tibbles" yang sering membunuh dan membawa burung-burung kecil ke majikannya itu. David Lyall, penghuni satu-satunya dari pulau Stephen, mengirimkan suatu eksemplar (contoh spesies) ke museum di Wellington, Selandi Baru. Direktur museum ini sangat senang, karena burung kecil ini adalah satu-satunya contoh dari burung kecil yang bisa berkicau dan tidak dapat terbang. Dengan tergesa-gesa ia pergi ke pulau Stephen.

    Sesampainya dia disana, ternyata kucing itu telah membunuh semua burung kecil yang ada di pulau itu. Binatang ini menjadi terkenal karena kepunahannya diakibatkan oleh seekor makhluk hidup saja, yaitu kucing. 


     Burung kecil ini berburu pada waktu malam, tidak bisa terbang dan memakan seranga. Burung ini sangat kecil, paruhnya berukuran 14mm, sayapnya mempunyai kepanjangan 46-49 mm, dan ekornya 17 mm. Jenis jantan sedikit lebih besar dari jenis betina. Hasil studi arkeologi menunjukkan bahwa burung ini hidup di daratan besar Selandia Baru di zaman dulu. Kemungkinan besar, populasi burung ini punah di daratan besar akibat kedatangan tikus yang dibawa orang Maori. Hanya sedikit populasi tersisa dari burung ini yang berdiam di pulau Stephen. Sayangnya, burung ini punah juga pada tahun 1894.

6 Jembatan Unik dan Menakjubkan di Indonesia!

     Ini dia Indonesia, negara dengan sejuta keajaiban! salah satunya adalah jembatan-jembatan berikut ini, unik, megah, dan menakjubkan. Langsung aja disimak ya gann..

1. Jembatan Palu IV

http://www.kidnesia.com

     Merupakan sebuah jembatan yang terletak di Kota Palu, Sulawesi Tengah. Jembatan ini diresmikan pada Mei 2006 oleh Presiden Susilo Bambang Yudhoyono. Yang menakjubkan dari jembatan ini adalah merupakan jembatan lengkung pertama di Indonesia dan ketiga di dunia setelah Jepang dan Perancis.

2. Jembatan Tukad Bangkung


     Jembatan yang menghubungkan tiga kabupaten, masing-masing Badung, Bangli, dan Buleleng itu menjadi jembatan terpanjang di Bali dan diklaim sebagai tertinggi di Asia Tenggara. Jembatan Tukad Bangkung mempunyai panjang 360 meter, lebar 9,6 meter, dengan pilar tertinggi mencapai 71,14 meter, dan pondasi pilar 41 meter di bawah tanah. Jembatan itu berteknologi balanced cantilever, dengan perkiraan usia pakai selama 100 tahun.

3. Jembatan Nasional Suramadu

infoberitaterbaru.blogspot.com
     Dengan panjang 5.438 m, jembatan ini merupakan jembatan terpanjang di Indonesia saat ini. Jembatan Suramadu terdiri dari tiga bagian yaitu jalan layang (causeway), jembatan penghubung (approach bridge), dan jembatan utama (main bridge).

     Jembatan ini diresmikan awal pembangunannya oleh Presiden Megawati Soekarnoputri pada 20 Agustus 2003 dan diresmikan pembukaannya oleh Presiden Susilo Bambang Yudhoyono pada 10 Juni 2009. Pembangunan jembatan ini ditujukan untuk mempercepat pembangunan di Pulau Madura.

4. Jembatan Barito

fotopurwoko.blogspot.com
     Adalah jembatan yang menghubungkan 2 daerah di Tepi Sungai Barito, Kalimantan Selatan. Jembatan ini memiliki panjang 1.082 meter yang melintasi Sungai Barito selebar 800 meter dan Pulau Bakut selebar 200 meter. Jembatan ini pertama kali diresmikan pada tanggal 23 April 1997 oleh Presiden Soeharto. Jembatan ini yang tercatat dalam rekor Muri sebagai jembatan gantung terpanjang di Indonesia.

5. Jembatan Akar Batang Bayang

jejak-jelajah.blogspot.com
     Wooow, ini baru menakjubkan! Jembatan yang terbentuk dari jalinan dua akar pohon yang tumbuh berseberangan ini membentang di atas aliran Batang Bayang Sumatera Barat. Dalam bahasa Minang, jembatan yang letaknya sekitar 88 km sebelah selatankota Padang ini oleh masyarakat dinamakan titian aka.

     Jembatan ini memiliki panjang 25 meter dan lebar 1,5 meter dengan ketinggian dari permukaan sungai sekitar 10 meter, mulai dibentuk pada tahun 1890 dan baru dapat digunakan pada tahun 1916. Dengan kata lain, proses merajut akar menjadi jembatan ini membutuhkan waktu lebih kurang 26 tahun. Saat ini, kondisinya semakin lama semakin kuat karena semakin besarnya akar pohon beringin yang membentuknya.

6. Jembatan Kelok 9

http://www.portalkbr.com
     Jalan dan jembatan ini membentang sepanjang 300 meter Kabupaten Lima Puluh Kota, Sumatera Barat. Jembatan ini membentang meliuk-liuk menyusuri dua dinding bukit terjal dengan tinggi tiang-tiang beton bervariasi mencapai 58 meter. Terhitung, jembatan ini enam kali menyeberangi bolak balik bukit. Rencananya, jembatan ini akan diresmikan penggunaannya pada bulan September 2013 dan akan mulai dibuka seminggu jelang lebaran untuk menunjang arus mudik.

7. Jembatan Cikurutug

semboyan35.com
     Jembatan dan juga jalur kereta api ini memang sangat ekstrim, bahkan jembatan ini masuk dalam 10 besar Jalur kereta api aling menyeralkan di Dunia! Kereta api yang lewat pun harus dengan kecepatan yang sangat pelan karena saking tingginya jembatan ini. hihi ngeri juga ya..

Cara Melahirkan Bayi

Cara Melahirkan Bayi - Peristiwa melahirkan bayi merupakan sebuah
tugas mulia dari seorang ibu. Akan tetapi tidak jarang ibu yang saat masuk
ruang  bersalin jadi begitu cemas. Rasa cemas ini dapat di mengerti,
terutama untuk ibu hamil yang baru pertama kali melahirkan. Penyebab kecemasan diantaranya seperti apa kuat untuk menahan sakit, apa dapat mengejan
dengan baik, apa bayi yang dikandung

"Muhammad Thaha AL-Junayd' Seorang Qari yang Memiliki Suara Merdu

Limit Komputer | "Muhammad Thaha AL-Junayd' Seorang Qari yang Memiliki Suara Merdu - Saat sedang asyik-asyik browsing sambil nunggu berakhirnya imsak, saya mencari-cari nama salah satu Muadzin Adzan subuh yang terdapat di Trans TV. saya begitu penasaran dengan suara merdu tersebut lalu selang beberapa lama saya coba ngecek di Youtube, Eh tidak nyangka saya mendapatkan salah satu Qari Cilik bernama "Muhammad Thaha Al-Junayd" beliau memiliki suara yang sangat merdu serta fasih.

Saya begitu terpakau mendengar suara Al-Junayd melantukan ayat-ayat suci dengan sangat merduanya dan fasih walaupun masih anak-anak (Cilik). sungguh ini hal yang sangat luar biasa bagi saya mendengarkan seorang Qari Cilik yang memiliki suara khas nan merdu setiap lantunan-lantunan ayat suci Al-Qur'an.


Kalian bisa lihat beberapa videonya dibawah ini :

Saat Imam



Saat Adzan



Saat Melantunkan Surah Al-Baqarah



Gangguan Kesehatan Psikologi saat Lebaran





Gangguan Kesehatan Psikologi juga bisa ketika
mendekati hari raya idul fitri. Gangguan kesehatan tersebut salah satunya
adalah sulitnya manahan keinginan untuk berbelanja. Tawaran diskon di semua
pusat perbelanjaan sulit ditolak. Alasan kebutuhan yang memang terlalu banyak
di hari raya dan memang karena ada uang Tunjangan Hari Raya (THR) sudah anda
dapatkan.



Namun apabila anda mulai

Calories, Starvation, and Bygone Gurus

As I am spending more time working on my upcoming book, Calorie Clarity: Entropic Thoughts on a Hot Topic,  I have had a bit less time for blogging of late.  I don't know what it is about this calorie debate, but just when you think the latest scheme to convince you that calories don't count has been beaten back, another huckster comes flying down the poop slide regurgitating the crap they swallowed on the way down.  Apologies to those who have eaten recently.  I use the term huckster because my name was used in vain in an exchange with one of the best hucksters in the low carb sphere, Dr. Mike Eades.

Who?  If you're asking that question, congratulations, you've either forgotten everything you've ever read on his blog or never read it at all.  Either of which would be a good thing.   Eades imagines himself a scientist in a doctor's coat and apparently still tweets his pearls of critical thinking wisdom.  Yeah, I'm being snarky because, well, it's a goose gander thing ... or is there a black swan needing some love somewhere?    Now a little while ago now, Tim Noakes gave leave of his own critical thinking skills and jumped on the LC "science" wagon.  A couple of days ago, Noakes tweeted a link to a 2007 post by Dr. Eades hailing it as an example of "supreme logic" in the (for some reason ongoing) debate over calories.
Read more »

Cerita Lucu Bikin Ngakak Terbaru

Cerita Lucu Bikin Ngakak. di indonesia ini sangat banyak, etah dari mana asalnya namun banyak sekali cerita -cerita lucu di sekitar kita. mungkin karena budaya di setiap daerah mungkin banyak sekali cerita lucu terutama banyak di temukan di pulau jawa (java). cerita yang lucu sering membuat kita lupa akan masalah, menghilangkan stress, membuat rilex bagi si pembaca. cerita lucu yang bikin ngakak

The Mystery of the Northwestern Settlement

Watson, quick, the game's afoot.  We have discussed a large number of legal settlements by large health care organizations that serve as markers of misbehavior and often lack of leaderships' responsibility for same.  These settlements often follow a common pattern.  Yet this week a settlement appeared that was quite different, and hence raised some important questions.

The Basics of the Settlement

I will summarize the settlement as described by the Wall Street Journal.  The basic points were:

Northwestern University agreed to pay nearly $3 million to settle claims that a former cancer researcher fraudulently used federal grant money for personal expenses, including food, hotels and airfare for family trips between 2003 and 2010.

The settlement in the civil suit was unsealed Tuesday by the U.S. Attorney for the Northern District of Illinois, which investigated claims brought by a whistle blower under the False Claims Act.

The settlement seemed to be more about the researcher, Dr Charles L Bennett, than Northwestern,


At the time of the alleged fraud, Dr. Bennett was the principal investigator on research funded by the National Institutes of Health, studying adverse drug events, multiple myeloma, a blood disorder known as thrombotic thrombocytopenic purpura, and quality of care for cancer patients.

According to the settlement agreement, he allegedly billed federal grants for family trips, meals and hotels for himself and friends, and for 'consulting fees' for unqualified friends and family. Northwestern also allegedly improperly subcontracted, at Dr. Bennett's request, with various universities for services that were paid for by the NIH grants.

'Allowing researchers to use federal grant money to pay for personal travel, hotels, and meals and to hire unqualified friends and relatives as 'consultants' violates the public trust and federal law,' U.S. Attorney Gary S. Shapiro said in a statement.

Meanwhile,

 Northwestern, which is in Evanston, Ill., cooperated with the investigators and didn't admit to any wrongdoing, according to a statement by the university.

The settlement was the result of the actions of a purported whistle-blower,


The whistleblower, Melissa Theis, worked as a purchasing coordinator in the Feinberg school's department of hematology and oncology, processing invoices when she 'noticed some red flags,' according to her attorney, Linda Wyetzner, of the Evanston firm Behn & Wyetzner Chartered.

The federal False Claims Act allows private citizens who allege government programs are being defrauded to file actions on behalf of the government and receive a portion, usually 15% to 30%, of any recovered damages. Ms. Theis will get $498,100 in settlement proceeds, according to the agreement.

The settlement resulted from the efforts of multiple federal agencies,

 The allegations were investigated by the NIH, Federal Bureau of Investigation, U.S. Department of Health and Human Services Office of Inspector General and the U.S. attorney's office.

Curious Aspects and the Questions They Raise

So here is yet another settlement by a large health care organization, in this case, the prestigious academic medical center of a well known university.  This one, however, does not follow the usual pattern, and includes some quite curious aspects.

Media Attention vs Severity

The settlement so far has generated articles in the WSJ (above), the Chicago Tribune, the Chicago Sun-Times, Crains Chicago Business, Medscape, Modern Healthcare, UPI, Bloomberg, other local Chicago and university publications, and local outlets in South Carolina, the state in which Dr Bennett currently works.
 
The amount of the grants that Dr Bennett allegedly misused was $8 million, according to the University Herald.

There are no allegations that any activities of Dr Bennett or the university affected the quality of clinical research, clinical teaching, or patient care.

Contrast that substantial media attention to that generated by another recent settlement we just discussed, that of Pfizer misbranding of Rapamune (look here.)  This involved the excess promotion of a relatively dangerous drug that likely resulted in harm to many patients.  The over-promotion may have caused up to 90% of the drug's $200 million yearly sales.  The settlement itself was for $491 million.  Yet while it got more coverage, mainly from local media outlets which covered it because the settlement will result in payments to individual states, only four big national outlets have covered it so far, again the Wall Street Journal, and  the New York Times, Reuters and Businessweek.

Why did a relatively small settlement of alleged financial misbehavior without clinical implications get nearly as much attention as a settlement fifty times bigger that involved actions that likely harmed patients?

Intensity of the Government Response

Dr Bennett's alleged misuse of grant funds required investigation by four different federal agencies, including the FBI.  Pfizer's misbranding of a dangerous drug seemingly was handled only by one, and the FBI was not obviously involved.  In fact, the FBI rarely has rarely been mentioned in the media coverage of most of the legal settlements we have discussed.

Why did again a case of relatively small alleged financial misbehavior require such massive federal resources when much bigger cases which had implications for clinical care, policy, or research seemed to command lesser resources?

Naming and Shaming

The settlement did not involve any admission of any wrongdoing by Northwestern.

In contrast, nearly all the news coverage of this settlement emphasized the role of Dr Charles L Bennett.  The coverage seemed to be following the lead of the Department of Justice press release, which included,

 Northwestern allegedly allowed one of its researchers, Dr. Charles L. Bennett, to submit false claims under research grants from the National Institutes of Health. The settlement covers improper claims that Dr. Bennett submitted for reimbursement from the federal grants for professional and consulting services, subcontracts, food, hotels, travel and other expenses that benefited Dr. Bennett, his friends, and family from Jan. 1, 2003, through Aug. 31, 2010.

Yet Dr Bennett appeared not to be a party in this settlement, and it was unclear whether he had a direct opportunity to respond to it.  The Wall Street Journal did note that after it was announced,

 James M. Becker, an attorney for Dr. Bennett, said, 'We deny the allegations.…We are actively engaged in discussions to resolve the allegations.'

We have discussed numerous legal settlements by large health care organizations, often involving hundreds of millions or even billions of dollars, sometimes involving guilty pleas by the companies involved or their subsidiaries.  Almost never do these settlements name or involve in any way persons who authorized, directed, or implemented the misbehavior.  In fact, we have commented again and again about the impunity of health care organizational managers and executives.  For example, the recent $491 million Pfizer settlement did not name or punish any individuals.  Furthermore, Pfizer's $2.3 billion settlement for deceptive marketing of a drug later pulled from the market (Bextra) did not name much less penalize any responsible individuals (look here.)  Also, GlaxoSmithKline's $3 billion settlement of numerous unethical practices did not name much less penalize any responsible individuals (look here).

So why was naming and shaming Dr Charles L Bennett such an important part of the relatively small Northwestern settlement, when much larger settlements, many involving unethical behavior that could have harmed patients or distorted medical research, and some of which involved corporate guilty pleas to criminal charges did not involve naming and shaming any responsible person?    
 
How Accountable was Dr Bennett?

As in the Wall Street Journal version, the settlement implies that Dr Bennett was the person most responsible.  The Chicago Sun-Times put it this way,

 Dr. Charles L. Bennett allegedly took his wife on personal trips, then illegally billed the flights, hotels and meals to the National Institutes of Health, claiming it was part of his cancer-fighting work. And he allegedly submitted phony bills for his work over a seven-year period beginning in 2003.

Here I will have to interject a bit of information about how federal grants work.  As I learned when I was a young faculty member, and as I confirmed with several other experienced researchers who have run and reviewed federal grants, these grants are made to institutions.  In the current case, the grant apparently went to Northwestern University.  The institution that receives the grant is responsible for making all payments and disbursements related to that grant.  The grant's Principal Investigator is responsible for the scientific conduct of the grant, but NOT payments, disbursements, business management or accounting.  The Principal Investigator can request that payments be made for various things, including travel expenses and consulting work.  But the Principal Investigator cannot directly authorize or make these payments.  They are authorized, signed, and made by institutional administrators, usually in grants and contracts offices or the equivalent, and usually only after copious paperwork to justify the payments.

So Dr Bennett may have requested reimbursement for travel expenses, or requested the university to hire a consultant.  But university managers must have made those payments, unless the university's grants administration mechanism had completely broken down.  Note that given the usual ways grants are administered, it would appear that Ms Theis, the ostensible whistle-blower, who will receive nearly one half of a million dollars from this settlement, actually may have had more direct responsibility for making the payments in question than did Dr Bennett.

Presumably, that is why the settlement was made by Northwestern.

Why then did the settlement, the DOJ press release, and the media coverage so emphasize Dr Bennett's responsibility, and so minimize the role of the university?  

Was Anyone Else Accountable?

The DOJ press release, and all the media articles on the case,  save one, mention only Dr Bennett as the person at fault.  Crain's Chicago Healthcare Daily, however, suggested someone else was responsible,


Northwestern University's nearly $3 million settlement of fraud claims by the federal government protects the director of the school's cancer center, who allegedly failed to supervise a researcher who used grant money to cover personal expenses over a seven-year period.

Dr. Steven Rosen, director of the Robert H. Lurie Comprehensive Center for Cancer, and Dr. Charles L. Bennett, a researcher who is no longer with the center, were both named in a whistleblower complaint unsealed on Tuesday, when the settlement was announced.

Dr. Bennett used federal grant money for family trips and fraudulent consulting fees for his brother and cousin from 2003-10, the government alleges.

Dr. Rosen 'failed to exercise appropriate responsibility,' Randall Samborn, a spokesman for the U.S. Attorney's office said. 'It was a supervisory function that he didn't adequately fulfill.'

When the settlement was announced, Mr. Samborn said the agreement did not cover either doctor. On Wednesday, he corrected himself, saying that settlement covered Dr. Rosen, but not Dr. Bennett.

As I noted above, the way federal grants work, it was the university, and its managers and leaders, who were responsible for making all payments on this and other federal grants.

Why did the government press release and the media coverage emphasize Dr Bennett's alleged role, while ignoring any possible responsibility of anyone else, especially his supervisor?


Backgrounds of the Principles

Dr Bennett and Dr Rosen, who seemingly were treated so differently in this settlement, travel in very different circles.

Most media articles described Dr Bennett as a prolific researcher and medical academic.  Although some described his areas of interest in hematology and oncology, only Medscape described one particular project of his.  

Dr. Bennett's research efforts included a 2008 study on which he was the first author (JAMA. 2008;299:914-924). The study was the first meta-analysis to identify an increased mortality risk in cancer patients associated with erythropoiesis-stimulating agents.(1)

In fact, as we discussed here,  Dr Bennett was the first author of a meta-analysis that was the first to show that epoetins increased the rates of adverse effects and death for cancer patients.  This evidence lead to reduced use of some very expensive drugs made by Johnson and Johnson and Amgen, and hence reduced revenues for both companies.

The JAMA article noted that at the time he wrote it, Dr Bennett had financial relationships with Amgen.  He and a coauthor "reported serving as consultants to AMGEN and Dr Bennett reported he has received grant support from AMGEN previously."

Note that Amgen pleaded guilty to misbranding its epoetin, Aranesp, and therefore paid fine and a civil settlement totaling $762 million.  Given the data on this drug class' adverse events, as shown by Dr Bennett and others, it is likely that the misbranding lead to patients being harmed by the drug without receiving any benefits (look here.) 

After writing that article, Dr Bennett became known as a strong skeptic of the pharmaceutical industry.  Just before the JAMA article was published, he coauthored an editorial which wondered if conflicts of interest would ever prove to be acceptable once sufficient research was done.(2)  In that article, he disclosed consulting for, and receiving honoraria and research grants from Amgen.  In 2010, he published research showing the effects of conflicts of interest on reporting of possible adverse effects based on basic science research about epoetins.(3)  By then he apparently no longer had financial relationships with Amgen.  In 2011, he reported a survey of major cases of pharmaceutical fraud resulting in legal actions.(4)

Dr Bennett became known for skepticism about the practices of pharmaceutical companies, and for publishing about the harms of specific drugs, despite his previous financial relationships with Amgen. 

However, Dr Rosen apparently has continued to work closely with industry.  His faculty disclosure page revealed  the following industry relationships

Consulting / Related Activities
Faculty member engaged in activities such as speaking, advising, consulting, or providing educational programs for the following companies or other for-profit entities:
  • Allos Therapeutics, Inc.
  • Carden Jennings Publishing Co., Ltd.
  • Cerner Corporation
  • Dava Oncology, LP
  • Elorac, Inc.
  • Envision Communications
  • Health Practices Consulting - unverified entity
  • Plexus Communications
  • Prostrakan, Inc.
  • Seattle Genetics, Inc.
  • Studio ER Congressi (Triumph Group, Inc.)
  • The Medal Group Corp.
In addition, faculty member received compensation for medical record consultation and/or expert witness testimony.

Ownership or Investment Interests
Faculty member had an ownership or investment interest in the following companies:
  • AuraSense, LLC
  • Nanosphere, Inc.
Royalty Payments and Inventor Share
Faculty member has the right to receive payments or may receive future financial benefits for inventions or discoveries related to the following companies or other entities:
  • Nanosphere, Inc. 
We have seen various important effects of individual and institutional conflicts of interest in health care.  We have seen corporatism and regulatory capture affecting government and its dealings in health care.  

Did Dr Bennett's break with a powerful industry make it easier to set him up as the villain in this story?

Summary   

The settlement by Northwestern University, which was mainly about allegations made against Dr Charles L Bennett, who was not a party to the settlement, was very different that the vast majority of the march of legal settlements whose continuation we have frequently discussed.

The settlement and its media coverage raised important questions whose answers would be important to the assessment of  our current regulatory and legal response to misbehavior by and within large health care organizations.  Health Care Renewal is about raising such issues by commenting on public information, media reports, and research.  I hope those with capacity to investigate will consider these questions.  Inquiring minds want to know.

Roy M. Poses MD in Health Care Renewal 

References

1.  Bennett CI, Silver SM, Djulbegovic B et al.  Venous thromboembolism and mortality associated with recombinant erythropoietin and darbepoetin adminstration for the treatment of cancer-associated anemia.  JAMA 2008; 299: 914-924.
2.  Djulbegovic B, Angolotta C, Knox KE, Bennett CI. The sound and the fury: financial conflicts of interest in oncology.  J Clin Oncol 2007; 25:3567-3568.  Link here 
3.  Bennett CI, Lai SY, Henke M et al.  Association between pharmaceutical support and basic science research on erythropoiesis-stimulating agents.  Arch Intern Med 2010; 170: 1490-1498.  Link here.
4.  Qureshi Z, Sartor O, Xirasagar S, Liu Y, Bennett CI.  Pharmaceutical fraud and abuse in the United States, 1996-2010.  Arch Intern Med 2011; 171: 1503-1506.  Link here.

Daily Blog #43: Sunday Funday Winner 8/5/13

Hello Reader,
      Another Sunday Funday is behind us and some more great answers were given, thanks to everyone who submitted on Google+ and anonymously! I've learned from this week challenge that I need to be a bit more specific to help for more focused answers, I'll make sure to do that for next weeks challenge. This week Eric Zimmerman turned in a great answer sharing the win with Jake Williams.

Here was the challenge:
The Challenge:     SInce we are giving away a copy of Triage, lets have a question related to manually triaging a system.
For a Windows XP system:
You have arrived onsite to a third party company that is producing a product for your company. It is believed that one of the employees of the company has ex-filtrated the database of your customers information your provided for mailing and processing sometime in the last 30 days, While the third party company is cooperating with the investigation they will not allow you image every system and take the images back to your lab. However, they will allow you to extract forensic artifacts to determine if there is evidence of ex-filtration present and will then allow a forensic image to be created and taken offsite.
With only forensic artifacts available and a 32gb thumbdrive what artifacts would you target to gather the information you would need to prove ex-filtration?

Here is Eric Zimmerman's winning answer:
Since this is a triage question, the goals are to get as much info in as short a time frame as possible. the idea is to cast as wide a net into a computers data as possible and intelligently look at that data for indicators of badness.
i am not going to include every key, subkey, querying lastwrite times/value and how to decode things from the registry or otherwise mundane details. these steps should be automated as much as possible for consistency and efficiency anyways.
the first thing i would do is interview management at the company to find out what kind of usage policies they have: are employees allowed to install whatever software they want? any access controls? who has rights to where? What kind of database was my customers stored in? who has rights to that database? and so on
i would also ask management who their competitors are and then locate their web sites, domain names, etc.
once i had the basic info i would assemble a list of relevant keywords (competitor names, relevant file extensions, etc). i would also look specifically for tools that can be used to connect to the database server and interact with it. this of course changes depending on which database it is (mysql i may look for putty or other terminal programs, oracle = the oracle client, sql server = that client, LinqPad, etc.)
with that basic info in hand i would triage each computer follows:
1. collect basic system information such as when windows was installed, last booted etc.
2. check running processes for things like cloud storage (dropbox, skydrive, teamviewer, other remote access tools)
3. look for any out of the ordinary file shares on the computer that can be used to access the computer from elsewhere on the network
4. check MRU keys for network shares, both mapped and accessed via command line
5. dump DNS cache and compare against keyword lists
6. dump open ports and compare against a list of processes of interest.
are any remote access tools running? file sharing?
7. Look to see what data, if any, is present on the clipboard. are there any suspicious email addresses or the text of an email or other document? what about a file or a list of files?
8. unpack all prefetch files and see what applications have been executed recently (certainly within the last 30 days, but expand as necessary). again we key in on processes of interest, etc
9. look at all the installed applications on a computer and specifically those installed within the last 30 days
10. dump a list of every USB device ever connected to the machine including make, model and serial #. also reference, when available, the  last inserted date of the device. cross reference this list with any issued thumb drives the company provided from interviews. make a note of any drive letters devices were last mounted to. also process and cross reference setupapi.log for devices connected within the last 30 days.
11. dump web browser history for IE, FireFox, Chrome, and Safari and look for keywords, competitor URLs, etc. hone in on last 30 days, but look for keywords thru entire history in case things were initiated previous to the data being exfil'ed. look for hits against cloud storage, VNC, and similar.
12. dump web browser search history including google, yahoo, youtube, twitter, social networks, etc and again filter by last 30 days with keyword hits across all date ranges. Also look for references to file activity such as file:///D:/somePath, etc.
13. dump passwords for browsers (all of them), mail clients, remote access tools, network passwords (RDP, etc). are any webmail addresses saved by the browsers?
14. dump keys from registry including CIDSizeMRU, FirstFolder, LastVisitedMIDMRU, LastVisitedMIDMRULegacy, MUICache, OpenSavePidlMRU, RDP sessions, RecentDocs, TypedPaths, TypedURLs, UserAssist, appcompatcache and of course ShellBags. all of these keys should be checked for keyword hits as before. specifically, look for any USB
15. Look for instant messaging programs and chat history for skype to include who they are talking to, if any files were xfered, and so on.
16. look for any p2p programs that could have been used to xfil data.
17. search the file systems for such things as archives, shortcut files (lnk), evidence eliminator type programs, drive and file wiping programs, etc. cross reference any lnk files with paths used by USB devices and shellbags to get an idea of what kinds of files were kept on any externally connected devices. look inside any archives found (zip, rar, tar, 7zip, etc) for any keywords of interest (like a text file containing my customers). filter based on MAC dates for files and of course look for keyword hits.
18. look at event logs for relevant entries (what is relevant would be determined by how the computers are configured. what kind of auditing is enabled by the network admins, etc). things like remote access and logins, program execution, etc would be key here.
19. time permitting, and based upon the results from above, use a specialized tool to unpack restore points and look for files as outlined above (lnk files, programs installed, etc)
20. look in the recycle bin for files (hey, ive worked plenty of cases where the incriminating evidence was in there!)
21. dump ram and run a quick "strings" against the binary, then look for keywords. going crazy with volatility is beyond triage, so this will suffice.
depending on where the database lives i would triage that system in the same way (if windows based) but if its mysql on linux or something i would review bash history files, sign ins, FTP logs, etc for signs of data being ex-filed. i would look at the database log files for logins and, if available, sql statements executed, errors, etc from the last 30 days.
finally i would ask about and review any web proxy logs or other logging systems the company has to look for suspicious activity.
all of this data would be automatically added to a timeline that could then be used to further narrow in on interesting periods of activity on each system.
with all the data collected i would want to start looking for default export names or extensions, keyword hits, and whatnot. the machines that have more indicators would go up on my list of machines to want to image. machines with little to no indicators would be removed from consideration.
ShellBags are going to be a key artifact in this case because they contain sooo much good data on Win XP. what other files were on any external devices connected to the systems? do i see the presence of "hacking" tools, ftp clients, putty, etc? are there folders or files indicative of my data or any of my competitors?
32GB is more than enough space to triage all the computers found at the business as there isnt a ton of need to copy files off the computer.
now all those steps are a heck of a lot to do manually (and several of them would be near impossible to do by hand), so in my case i would just run osTriage on each computer and it would pull all that info (and more) in a few seconds. add a bit of time to review the results and i would know which machines i wanted to image for a more thorough review.
with that info in hand i would most likely already know who exfi'led the data, but i would still request an image be made of each machine where suspicious activity was found.
(all of those steps could be further unpacked, but since this is a triage based funday question my response is kept in true triage style, fast and just enough of a deep dive to hone in on computers of interest).

However, Special Agent Zimmerman cannot accept the prize. So Jake Williams hard work in his winning answer seen below wins the prize of a year license of AccessData Triage:
 
What artifacts would you look for across multiple Windows XP machine with only a 32GB USB drive to hold them all?
So we think that an evil user exfiltrated a database we provided to the business partner.  Because of the verbiage, we’re working under the assumption here that they were provided with an actual database file (.mdb).
Great. That probably wasn’t bright. In the future, we should NOT provide the business partner the database file and rather provide secure and AUDITABLE access to the data.  This seems like a good idea. There are other issues here, such as revocation of access and even keeping the current data picture (including opt outs for example) that further reinforce why this is better than a file. So we should definitely provide auditable access to the DB in the future, not a database file.
For this writeup, I’ll focus on evidence of execution, evidence of access, and then touch on potential evidence of exfiltration.  Here’s why: under the best of circumstances, we can have a hard time finding evidence of exfiltration. But these aren’t the best of circumstances. 
1. We have no information about how the partner may have exfiltrated the data.  
2. We have limited space in which to collect our data for further probable cause.
We’re really looking for suspicious activity on the machines that will open the door to full images for a complete investigation.  For that reason, we have to keep the scope small and limit it to that which will cover the most ground.
Evidence of execution:
So the first thing I want is access to prefetch files on all the machines.  This is my first stop.  If the user exfiltrated the database AND we have a DLP solution in place, they may need to encrypt the file first. I’d want to look for rar.exe, winzip.exe, or 7z.exe to look for evidence of execution of those utilities. Also, we’re looking for evidence of execution of any anti-forensics tools (commonly used when users are doing illegal stuff).  As a side note here, I’ve performed forensic investigations where I’ve found stuff like wce.exe or other “hacking tools” in prefetch.  In at least one particular case, this discovery was not part of the investigation specifically.  However, the fact that we highlighted it bought us a lot of good will with the client (since this was an indicator of a compromise or an AUP violation).
We’d want to know if the users used any cloud services that aren’t explicitly allowed by policy. For example, Dropbox, SkyDrive, GoogleDrive, etc. would be interesting finds.  While use of these services doesn’t necessarily imply evil, they can be used to exfil files.  Evidence of execution for any of these services would provide probable cause to get the logs from the devices.  For those who don’t know, this is a real passion of mine.  I did a talk at the SANS DFIR Summit looking at detecting data exfiltration in cloud file sharind services and the bottom line is that it isn’t easy. Because of the complexity, I expect criminals to use it more.  Those logs can contain a lot of information, but grabbing all logs in all possible user application directories might be too broad (especially given the 32gb USB drive limitation).  We’ll just start small with Prefetch. 
I’d also want to get uninstall registry keys (HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall). My thoughts here are that 32GB is so little data for an enterprise that I’d be looking for evidence of programs installed that may have been used to read the data from the database or exfiltrate the data.  Again, this is so little data that we can store it easily.
UserAssist registry keys from all users would also be on my shopping list.  If the company uses a domain (and honestly what business doesn’t) this will be easier if roaming profiles are enabled.  We want to pull from these two keys for windows XP:
▪ HKEY_USERS\{SID}\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count\
▪ HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count\
Where GUIDs are usually {75048700-EF1F-11D0-9888-006097DEACF9} or {5E6AB780-7743-11CF-A12B-00AA004AE837}
 Again, I’m focusing on evidence of execution because space is tight. These entries won’t cover everything that was executed, generally it only includes items opened via Explorer.exe (double click).  Also, the entries are ROT13 encoded, but that’s easily overcome. Because it is possible that users deleted data, we might also want to grab UserAssist from NTUSER.DAT files in restore points.  This might be pushing the limit of my storage depending on how many machines our target has to triage (and how many Restore Points they each have).
Evidence of Access:
In this category, I’d be looking at MRU keys for Access.  Now these change with the version of MS Office, but a good starting point is to look in these subkeys in the user’s profile (where X.X is the version):
• Software\Microsoft\Office\X.X\Common\Open Find\Microsoft Access\Settings\Open\File Name MRU
• Software\Microsoft\Office\X.X\Common\Open Find\Microsoft Access\Settings\File New Database\File Name MRU
• Software\Microsoft\Office\X.X\Access\Settings
Locating our filename doesn’t prove anything, presumably we gave it to them to open, but it gives us a start.
If we know that the file was placed on a network share with auditing enabled, we want to identify who had access to that share using the records in the Security event log.  If auditing wasn’t enabled, we may still be able to find evidence of failed logon attempts to the share in the event logs on the file server.  Successful connections to the share may be found be in the MountPoints2 (Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2) key so we want to grab that from user’s profiles.  Of course, it goes without saying that just because someone mapped a share doesn’t mean they even read our file (let alone exfiltrated it).
Event logs:
Depending on the event logs available, we may be able to tell if a user has accessed the database via an ODBC connector.  Usually users just open an Access file, but they could add it as an ODBC data source.  I don’t have my systems available here at DEFCON to do testing, but if the file was added as an ODBC source, there should be some remnants left over to locate.  But often there will show up in event logs. We want to check event logs for our database file name.
Possible Evidence of Exfiltration:
Firewall logs are another item I’d collect.  Yes, I know some people will laugh at me here, but we are looking for data exfiltration and that may have happened over the network.  If we have some idea of where the data was exfiltrated to, firewall logs, if enabled, are a useful source of information.  Fortunately for our case with only a 32GB USB drive for the whole network, the logs capped at 4M by default.  This allows us to collect a lot of them without taking up lots of space.  We could get logs from 100 machines and only consume 4GB of our space.
Setupapi.log is another file I’d like to collect.  This log shows first insertion time for USB devices (a common exfiltration point).  While this log can’t tell us if a file was copied to a USB, analyzing setupapi.log files over an enterprise can show patterns of USB use (or misuse).  Correlating that with information with their security policy may yield some suspicious behavior that may be probable cause for further forensic images.
If there are other logs (from an endpoint protection suite) that log connections, I’d want to see if I could pull those as well.  While we’re at it, we’d want to filter event logs (particularly application event logs) for detection notices from the AV software.  What we are looking for here is to determine if any of the machines in scope have had infections since we turned over our database file.  We can filter by the log provider and we probably want to eliminate startup, shutdown, and update messages for the AV software.
If I had more space, I’d grab index.dat files from profile directories.  Depending on the number of systems and profiles, we’d probably run out of space pretty quickly though.  What we’re looking for here are applications that may use WinInet APIs and inadvertently cache information in index.dat files.  This happens sometimes in malware and certainly data exfiltration applications might also fit the bill.  However, my spidey-sense tells me that these index.dat files alone from many profiles/machines could exhaust my 32GB of space.
Parting thoughts:
Forensics where we rely on minimal information is a pain.  You have to adapt your techniques and triage large numbers of machines while collecting minimal data (32GB in this case).  I’d like to do more disk forensics and build timelines. I might even use the NTFS triforce tool.  If this were a single machine we were performing triage on, then my answer would certainly involve pulling the $USNJrnl, $LogFile, and $MFT files to start building timelines. The SYSTEM, SOFTWARE, and NTUSER.DAT hives on the machine would also be on my short shopping list.  However, over the multiple machine I believe the scenario covers, this just isn’t feasible in the space we’ve been given.

I'll follow up this contest with how I approached this case in real life in a later blog post. I will say that in my case the first thing I did was triage which systems showed access to the database itself to create a pool of possible ex-filtraters. Then I went back and started pulling the data discussed in our two winning answers! From there I was able to discover enough suspicious activity and patterns of access to the underlying data through the userassist, shellbags and lnk files to get approval to create a forensic image.

Tomorrow we continue the web 2.0 forensics series as I look to see when I should stop and move on and then come back to it later with other services besides Gmail.

 

ZOOM UNIK::UNIK DAN UNIK Copyright © 2012 Fast Loading -- Powered by Blogger