Malicious software has been found on Eastern European ATMs that allows criminals to steal account data and PINs and even empty the machine of its cash, a computer forensics expert said.

About 20 cash machines have been compromised in that manner, mostly in Russia and the Ukraine, but there are "early indications" of compromised ATMs in the US, said Nicholas Percoco of Trustwave, which provides data security and payment-card compliance services.

Percoco, who heads up Trustwave's SpiderLabs, the forensics team that discovered the malware on the ATMs, said he could not elaborate further on where the compromised ATMs were located and how they were used.

Someone had to manually install the malware on the machines, so it is likely that an insider is responsible--either an employee at the bank, the ATM vendor, a company that services the machines or someone close to an insider, Percoco said in a telephone interview late on Wednesday.

The machines, all running Windows XP, had an executable program on them that was masquerading as a legitimate Windows protected storage service, he said. The malware looks at all the data being processed by the ATM. It records the account information that is stored on the magnetic stripes on cards inserted into the machine and the encrypted PIN blocks that are generated when someone types in their number, Percoco said.

Although the PINs are encrypted, criminals could potentially intercept the encryption keys exchanged with the bank and use them to decrypt the PINs, he added.

Once the malware has been hidden on the ATM for a period of time, the criminal can return to the machine and use a special "trigger" card to control the ATM. The criminal can print out the stolen data directly from the machine, or instruct the the machine to dispense all the cash it has, according to Percoco. Bank cash machines can hold as much as $600,000 at a time, he said.

"There is evidence that [trigger] cards were used," he said, adding that he could not comment on the number of accounts affected or amount of money stolen. The malware was first installed on at least one of the machines in July 2007, he said.

This is not the first time that malware has been discovered on ATMs, Percoco said. "But this is probably the most sophisticated malware found on an ATM," he said. "In all the versions we've looked at [the criminals] are enhancing the application as they go. They must be getting feature requests from someone."

The latest version of the malware code found on some of the machines includes a function for writing the stolen data onto a card with a memory chip on it, which are commonly used in Europe, he said. However, that function does not appear to work, he added.

Although the malware was installed on the ATMs manually, it is possible that future attacks would involve the propagation of the malware through the ATM network, he said.

Michelle Genser, corporate communications manager for Trustwave, told ZDNet UK on Thursday that none of the compromised ATMs conformed to the Payment Card Industry Data Security Standard (PCI-DSS).

"These are non PCI-compliant ATMs, they don't have proper security in place, and they are not running antivirus," said Genser.

While the ATMs are not internet facing, Genser added that Trustwave has evidence the malware is being spread elsewhere. "We believe this is a test bed, and will probably propagate," said Genser.

ZDNet UK's Tom Espiner contributed to this story.

The Waledac worm is gearing up for a spam campaign related to the July 4 holiday, a security researcher has warned.

Researchers analyzing the code of the worm, which has been deploying updates to previously compromised PCs, have discovered that at least 18 domain names have been registered related to fireworks and Independence Day that will be used to trick people into visiting a malicious Web site, said Pierre-Marc Bureau, a senior researcher at antivirus vendor ESET.

Starting any time now and lasting through the weekend, the spam e-mail messages will arrive in inboxes with a message urging the recipient to watch a July 4 video. The e-mail messages are expected to include a link to a site with an executable that, instead of playing a video when double-clicked, will download malware that turns the visiting PC into another bot on the botnet, Bureau said.

The operators of Waledac are using holidays and other current events to lure new victims in order expand their botnet, and it's likely they are leasing out the botnet services to others, he said. Earlier this year, Waledac exploited Valentine's Day, spamming people with fake romantic greetings.

It is estimated that there are tens of thousands of computers infected with Waledac and that more than 20,000 will be used in the July 4 spam campaign, according to Bureau.

This article was first published as a blog post on CNET News.

Satyam bullish under 'umbrella of governance'

update SINGAPORE--It has had the dubious honor of being dubbed the "Enron of India", but the revamped Satyam is now "extremely bullish" about its Asia-Pacific market prospects and confident of its governance, say company executives.

The newly-minted Mahindra Satyam--after the successful bid by Indian services giant Tech Mahindra--has tweaked its model of governance, which had been a "perceivable flaw", said Vineet Nayyar, executive vice chairman of Tech Mahindra and Mahindra Satyam.

Former Satyam Chairman B. Ramalinga Raju admitted to fraud and resigned in January amid a scandal over inflated profit reporting.

Speaking at a media briefing in Singapore Friday, Nayyar noted that the company's governance model has since been reorganized to allow greater responsibility and accountability. He added that incentives between sales and delivery teams have also been realigned, and there is greater transparency in the reporting of costs and profitability in the various business units.

Who's who in Mahindra Satyam
Executive	New post	Former post
Vineet Nayyar	Executive vice chairman, Tech Mahindra and Mahindra Satyam	Vice chairman and managing director, Tech Mahindra
C.P. Gurnani	CEO	Head of global operations, sales and marketing, Tech Mahindra
S. Durga Shankar	CFO	Senior vice president, mergers & acquisitions, Mahindra & Mahindra
A.S. Murthy	CTO	CEO, Satyam
Rakesh Soni	COO; head of delivery for manufacturing, banking and financial services, emerging verticals and strategic accounts	COO, Tech Mahindra
Keshab Panda	Head, business development and operations for manufacturing, banking and financial services, emerging verticals and strategic accounts	Chief of Continental Europe, energy and utilities and manufacturing operations, Satyam
Atul Kanwar	Head, business development and operations for regional business groups	Chief business development officer, Tech Mahindra
Manish Mehta	Head, delivery for regional business groups	Head, system, analysis and program (SAP) development, Satyam
T.R. Anand	Head, business development and operations for telecoms, tech infrastructure, media & entertainment, and semiconductor (TIMES); head, channel business	Director and senior vice president for TIMES, Satyam
Ravi Bommakanti	Head, delivery for TIMES	Director and senior vice president and global head of insurance, Satyam
Hari T	Chief people officer and chief marketing officer	Global marketing head, Satyam
Source: Mahindra Satyam and HT Media

"What you see in Mahindra Satyam is the congruence of the capabilities, skills and depth of knowledge of Satyam...now under the umbrella of governance which will adhere to the highest ethical standards [that Mahindra is known for]," he said.

Region's business picking up
Nayyar acknowledged that Satyam lost out on a large Telstra request-for-proposal issued earlier this year, but said the company's customers in the region still have "fairly positive" sentiments toward the company.

"It's not as if we've been banned or barred... We did lose a very large order, but there's still life beyond that [Telstra] order," he said. "On the other hand, all other clients [that] have stayed with us are staying with us, and are giving us further orders."

Philip Carter, IDC's associate research director for services in the Asia-Pacific region, told ZDNet Asia that apart from Mahindra Satyam losing a couple of key clients such as Telstra and the National Australia Bank, the company has made at least one recent deal in the region. Singapore's Land Transport Authority, he said, had awarded Mahindra Satyam a contract several weeks ago.

Over in the United Kingdom and Ireland, Satyam's existing clientele had signed US$2.5 million worth of contracts with the company during the first quarter of financial year 2009, Satyam's U.K. and Ireland head for noted earlier this month.

Carter said Tech Mahindra's coming into the Satyam picture has had a positive touch, but there were also challenges moving forward. A number of Mahindra Satyam executives hailed from Tech Mahindra, essentially a second-tier player focused on one vertical--telecoms. That presents management credibility issues, as well as a danger of talent attrition given management changes.

In addition, while the backing of Tech Mahindra may offer credibility in terms of financial stability and corporate governance, there is a "long process" in terms of sustaining and that credibility in the regional market, said Carter.

"There's been positive energy in terms of credibility building up, but I won't go as far to say they'll make the shortlist for every single major services contract," he pointed out.

Expansion in the pipeline
According to Mahindra Satyam's Asia-Pacific managing director Rohit Ghandi, the company is "extremely bullish" about the way forward.

The new Satyam, he added, would "be gunning very strongly for new business", through a combination of selling additional services to existing clients and pushing for new customer wins. For instance, the company is planning to roll out infrastructure services as well as BPO (business process outsourcing) services in Australia and New Zealand (ANZ).

Ghandi said Mahindra Satyam would concentrate on growing market share in countries Satyam formerly was active in--ANZ, China, Japan, Malaysia, Singapore and Thailand--before making expansion moves. However, Indonesia is a likely target as Tech Mahindra has an existing strong presence in the market.

The Asia-Pacific region, he added, is targeted to contribute 10 percent to 15 percent to Mahindra Satyam's overall revenues. Singapore, with headcount in excess of 400, will remain the regional headquarters for the company. Mahindra Satyam has over 2,000 employees across the region.

Nayyar added that Tech Mahindra and Mahindra Satyam will "for the time being" be run as separate entities but will tap on each other's relevant expertise as well as cross-selling opportunities. The two companies, he noted, have synergies that may result the merging of operations, but that would not take place at least in the next one to two years.

Open source is increasingly important to many organizations' smart technology strategies. Two new offerings from IBM Research and the Milepost consortium aim to make it even smarter.

The Milepost GCC open-source machine learning compiler lets users develop, test and optimize applications up to 10 times faster than current tools, according to partners. (Note: IBM sponsors Smarter Technology but does not control editorial content.) The first-of-its-kind offering, hailed as “the world’s first intelligent, open-source compiler” debuted June 25.

“Our technology automatically learns how to get the best performance from the hardware—whether mobile phones, desktops or entire systems, the software will run faster and use less energy," Bilha Mendelson, manager of code optimization technologies at IBM Research Haifa, said in the release. "We opened the compiler environment so it can access artificial intelligence and machine learning guidance to automatically determine exactly what specific optimizations should be used and when to apply them to ramp up performance."

Also introduced: a companion “Collective Tuning Center”—a collaborative community portal dedicated to creating software more quickly. Users share optimization best practices, organizer said, and development of common R&D tools with open APIs aimed at automating program optimization, compiler design and architecture tuning using empirical, statistical and machine learning techniques.

The project consortium includes the IBM Haifa Research Lab, Israel; the University of Edinburgh, United Kingdom; ARC International, United Kingdom; CAPS Enterprise, France; and INRIA, France.

The offerings are noteworthy for several reasons. They can potentially:

Speed SW roll out and enterprise innovation. The universal mandate to “do more with less” has expanded to “faster too.” As the developers note: In many organizations, software developers are fast becoming the nucleus of innovation, crucial to all business processes. They build the services and capabilities that will underlie future revenue and generate business opportunity.

Ease strains on IT resources. The average enterprise devotes 30 percent to 50 percent of its entire technology infrastructure to the development and testing of software, the partners said. Anything that reduces that burden frees precious resources for higher-value work.

Advance intelligent software development. What we’re talking about here is the shift from specialized compilers to automated code optimization. Unlike commercial compilers, The Milepost GCC uses machine learning to automatically optimize programs for reconfigurable heterogeneous embedded processors. Leveraging AI is a potentially important and long overdue way to combat the twin challenges of increasing development time and power usage and decreasing performance. Milepost could spark renewed interest in the long-overdue practical application of AI in code development.

Shorter software development times, bigger performance gains. What’s not to like? Intelligent compilers may not be the sexiest new smart technology. But history shows that big technology advances often are hidden under the hood. Hopefully Milepost will prove the first marker on a long new road to better, faster, greener software development.

LONDON, England (CNN) -- Personal details and photographs of the incoming head of Britain's international spy agency have been posted on Facebook, British Foreign Secretary David Miliband acknowledged Sunday.

But he insisted that no compromising information had been revealed.

"You know that he wears Speedo swimsuits. That is not a state secret," Miliband said on a BBC Sunday morning talk show. Have you ever posted something you should not have on a social-networking Web site?

The man in question, John Sawers, is currently the British ambassador to the United Nations.

His wife posted details about their family, vacations and residence on the social-networking site, British media reported Sunday. Her Web site has since been taken down, reports said.

Sawers "was appointed 10 days ago to be the head of MI6," said Miliband, using the common term for the Secret Intelligence Service.

"He is an outstanding professional," Miliband added. "That the head of MI6 goes swimming? That's not a state secret."

Foreign service officers "are advised to exercise caution" on social-networking Web sites, a Foreign Office representative said, declining to be named, in line with government policy

WASHINGTON (CNN) -- The Swedish ambassador met with two imprisoned U.S. journalists in Pyongyang on Tuesday, a U.S. State Department spokesman said, in their first meeting since a North Korean court handed the reporters their 12-year sentence.

The spokesman said he could not provide details of the conversation between the Swedish ambassador and Current TV journalists Euna Lee and Laura Ling.

The journalists were apprehended in March near North Korea's border with China and accused of illegally crossing the border and plotting a smear campaign against North Korea. After a closed trial, Lee and Ling were sentenced to 12 years in prison earlier this month.

Also on Tuesday, a statement obtained by CNN from the families of Ling and Lee expressed gratitude that North Korean officials permitted the Swedish ambassador's visit.

"The families of Laura Ling and Euna Lee are grateful to the North Korean government for allowing the Swedish ambassador to visit Laura and Euna. We continue to appeal for their release on humanitarian grounds," the statement read.

The Swedish ambassador met with the journalists in March and May. He last visited them June 1, said State Department spokesman Ian Kelly. The ambassador has requested more access to the journalists, but has not received it.

"Well, I know that he's in constant contact with the North Korean foreign ministry, is constantly pressing them for more information about these two young women," Kelly said.

The Swedish ambassador represents U.S. interests in the country because the United States does not have diplomatic relations with North Korea.

The United States, though, is "pursuing many different avenues" to free the journalists, Kelly said. He declined to elaborate.

Secretary of State Hillary Clinton has called on North Korea to release the journalists on humanitarian grounds.

Families of the women said they were shocked and devastated after the trial and subsequent sentences of Ling and Lee.

Family members have said Ling suffers from an unspecified serious medical condition and that Lee has a 4-year-old daughter "who is displaying signs of anguish over the absence of her mother."

(CNN) -- North Korea said Saturday it would strengthen its nuclear capabilities, a defiant protest against the U.N. Security Council's move to tighten sanctions against it.

North Korea officials said they were enriching uranium and would weaponize all plutonium, according to KCNA, the state-run North Korean news agency.

When enriched to a high degree, uranium can be used for weapons-grade material. Plutonium can be used in atomic bombs.

These moves are in response to Friday's U.N. resolution, according to the news agency, which referred to the resolution as a blockade.

"No matter how hard the U.S.-led hostile forces may try all sorts of isolation and blockade, the DPRK (Democratic People's Republic of Korea), a proud nuclear power, will not flinch from them," KCNA said.

The U.N. Security Council unanimously voted Friday to expand and tighten sanctions on North Korea after the nation's recent nuclear test. Watch as China backs sanctions »

The 15-0 vote on U.N. Resolution 1874 imposes an embargo on the shipment of arms from the communist regime and broadens a ban on the import of weapons.

The resolution comes amid rising tension surrounding North Korea, which recently conducted a nuclear test, fired test rockets and threatened United States and South Korean ships near its territorial waters. The nuclear test and the firing of six short-range rockets occurred in late May.

The resolution strengthens provisions already in U.N. Resolution 1718, passed in 2006. But there are also new provisions in the resolution, said Susan E. Rice, U.S. ambassador to the United Nations.

The new resolution requires states to "exercise vigilance" over the direct or indirect supply, sale or transfer to North Korea of small arms or light weapons.

Nations would be required to notify the sanctions committee at least five days prior to selling, supplying or transferring small arms or light weapons to North Korea.

The resolution calls on all states to inspect vessels suspected of containing contraband. If a ship refuses, it is to proceed to the closest port for a mandatory inspection.

A new regulation would prohibit nations from providing bunkering services, such as fuel, to North Korean ships believed to be carrying contraband. The draft also broadens authority to prevent the flow of funds that could benefit North Korea's missile, nuclear or proliferation activities.

Late last month, two Defense Department officials said U.S. satellite imagery spotted "vehicle activity" at a North Korean ballistic missile facility. The officials said the images showed vehicles used to transport Taepodong-2 missiles, but no missile parts. The Taepodong-2 is a long-range missile North Korea tested in April.

That test showed a significant improvement in range from North Korea's initial long-range missile test in 2006.

This week, a U.S. official who was not authorized to speak on the record told CNN that Washington had "indications" that North Korea may be planning another test. The official would not provide any details, however.

U.S. President Barack Obama's special envoy to North Korea, Stephen Bosworth, called "simply groundless" accusations by Pyongyang that its nuclear and rocket tests were in response to American aggression.

Washington officials have said the United States' goal is for North Korea to return to nuclear negotiations with the United States, China, South Korea, Japan and Russia, known as the six-party talks.

WASHINGTON (CNN) -- U.S. officials are downplaying any imminent threat of a North Korean missile strike or confrontation between the two countries at sea.

The U.S. intelligence community does not believe North Korea intends to launch a long-range missile in the near future, a U.S. intelligence official told CNN, despite reports in Japanese media citing intelligence that the North Korean regime intends to fire a missile toward Hawaii on July 4.

Shortly after that report, Defense Secretary Robert Gates said he was deploying defensive measures around Hawaii.

But a recent warning to mariners issued by North Korea suggests the country only intends short- and medium-range missile tests, according to one U.S. intelligence official.

The North Korean government issued a warning to mariners to avoid an area in the Sea of Japan at certain times between June 24 and July 9 because of a "military firing exercise," according to a U.S. military communication about the warning provided to CNN.

The North Koreans had issued a similar warning prior to testing a long-range missile in April, but that warning indicated two potential danger areas more indicative of a long-range missile test.

The official said that these shorter-range missiles can be "rolled out on a dime," but the U.S. intelligence community sees no "readily observable" indication of an imminent long-range missile launch.

Vehicular activity had been spotted around a long-range missile site in late May, U.S. Defense Department officials told CNN at the time. But the officials said the activity was very preliminary, with no missile parts seen, and any launch would take a lot more time to prepare.

The U.S. intelligence official said there is always concern that a shorter-range test "could go wrong," but for the most part the North Koreans have short and medium missile tests "down pat," and those missiles are "pretty accurate."

The official added, "It's not particularly difficult to fire off" short- and medium-range missiles.

North Korea recently threatened to "wipe out" the United States if provoked. Watch the Pentagon reaction to the threat »

The official said the United States "assumes" North Korea will "continue its provocations." The official acknowledged this phase of the usual ebb and flow of North Korean behavior seems to be lasting longer.

This has been a "protracted period," said the official, with the change in U.S. leadership being a "big factor." The North Korean leadership seems to be "testing the new administration."

Pentagon spokesman Geoff Morrell defended Gates' decision to deploy defensive measures around Hawaii.

"Previous long-range ballistic missile tests by the North have been failures. But they obviously are intent on developing that capability, and so long as they are, we need to do responsible, prudent things," Morrell said at a news conference Wednesday. "And in this case [Gates] thinks the responsible, prudent thing is to deploy those assets."

The U.S. military has positioned its Terminal High Altitude Area Defense (THAAD) missile defense system and its X-band radar system in the event a missile were to be launched toward Hawaii.

Morrell said that no additional defenses were being deployed in the region because the defenses in place are sufficient.

"I think we're perfectly comfortable with the assets that are in place," he said. "This threat that is posed by North Korea is not a new one, so we have adjusted our assets that are normally in that area some time ago."

Separately, the United States has not yet decided to seek permission to board and inspect a North Korean vessel it suspects of carrying illicit weapons or technology in violation of U.N. sanctions against that country, despite a recent promise by President Obama that North Korean violations would "be met with significant, serious enforcement of sanctions."

Morrell told reporters that while the United States is "interested" in the Kang Nam -- a North Korean-flagged vessel believed by officials to be carrying weapons or illegal technology -- no decision has been made to stop the ship and search it. The ship departed North Korea last week and is currently headed south toward Myanmar, U.S. officials believe.

The decision to enact the U.N. Security Council Resolution to investigate will most likely not be made just by the United States but in coordination with other countries, Morrell told reporters on Wednesday.

"That's a decision that will have to be made at some point, and not necessarily just by us or this government," Morrell said. "But that is a decision I think we will likely take collectively with our allies and partners out there, and make a determination about whether we choose to hail and query this particular ship. And if we make that decision, when and where to do so." Watch why U.S. officials are watching the Kang Nam »

Asked about the Myanmar connection Wednesday, Morrell would only say there is "some notion of that" but would not elaborate.

The United States has been tracking the ship's progress with air assets including the P-3 spy plane and the USS McCampbell, which recently replaced the USS John McCain in trailing the Korean ship.

The ship is suspected of carrying weapons because it is known to have carried proliferation materials previously, though U.S. officials concede they are not certain of the ship's holdings.

SEOUL, South Korea (CNN) -- North Korea fired several short-range missiles toward the Sea of Japan on Saturday, an act that the U.S. watched closely and South Korea called provocative.

Pyongyang fired six short-range missiles in less than seven hours, South Korea's Foreign Ministry said.

The missiles were apparently Scud-type, estimated to have a range of about 500 kilometers (310 miles), according to South Korea's Yonhap news agency.

South Korean intelligence estimates that North Korea has about 700 such missiles in its arsenal.

Pyongyang test-fired four such missiles off the east coast Thursday, Yonhap reported.

South Korea called the launches a provocative act, according to a government statement.

North Korea had issued a warning to mariners to avoid an area in the Sea of Japan at certain times between June 24 and July 9 because of a "military firing exercise," according to a U.S. military communication about the warning provided to CNN.

The recent firings come amid heightened tensions on the Korean peninsula. North Korea conducted a nuclear test in May, fired test rockets and threatened U.S. and South Korean ships near its territorial waters. Watch S. Korea confirm firing of missiles »

The first two missiles were fired about 8 a.m. and 8:30 a.m., Yonhap reported. Another missile was launched about 10:45 a.m., the agency reported. A fourth one came some time after that.

The U.S. Navy and other U.S. officials said they are ready to track any missiles.

"The United States is aware of possible missile launches by North Korea. We are closely monitoring North Korea's activities and intentions," a U.S. official said.

"This type of North Korea behavior is not helpful. What North Korea needs to do is fulfill its international obligations and commitments."

Earlier this week analyst Daniel Pinkston said the reported test might be training for a future test but it could also just be a routine military exercise.

"It is worrisome to some degree, but it is different from a ballistic missile launch," said Pinkston, of the International Crisis Group in Seoul, South Korea.

"It's part of military training, but there seem to be no movements of troops or anything that would suggest preparations for military operations.

(CNN) -- Michael Jackson and Diana Ross shared a bond that he apparently thought would last long after his death.

In his will Jackson wanted Ross -- who took him under her wing and who he called one of his dearest friends -- to take care of his children if his mother, Katherine Jackson, was not alive or was unable to do so.

While the public may have been surprised at Jackson's decision, the two have a long history together.

"I think it's very interesting," Jermaine Jackson, Michael's brother told CNN's Larry King on Thursday. "There's been a long, close relationship with Michael and Diana for many, many years. And I think it's great." Watch Jermaine Jackson on Michael's death »

The star of the Supremes met Michael Jackson when he was a 9-year-old sensation after she saw him perform with his family at the Apollo Theater.

She helped catapult The Jackson 5 to stardom when her name was used to release their debut album, "Diana Ross Presents The Jackson 5."

After The Jackson 5's debut album success, the pair appeared together in a variety of sketches, sang at each other's concerts, performed at the Hollywood Palace together, and starred in "The Wiz" together with her as Dorothy to his Scarecrow.

"You see skits from variety shows where they are doing Frank Sinatra songs and Casablanca," Emil Wilbekin, managing editor of Essence.com and a founding member of Vibe magazine under Quincy Jones told CNN.

"Although she was older than Michael, they had a real connection and that connection, I think, and that friendship really moved throughout his career."

Jackson even wrote Ross' famous "Upside Down" for her, Wilbekin said.

In a 1982 interview for the Ebony Jet Showcase, Jackson said he considered Ross, now 65 years old, to be one of his true personal friends. Watch how Jackson, Ross became close »

"Diana Ross, very dear friend Diana Ross," he said when asked who he considered to be his closest friends. "She is the kind of person, I can tell her anything, the most private of secrets. And she tells me her secrets as well."

That friendship was something of a motherly love on Ross' part and an idolization from Jackson, according to Wilbekin. And the bond they formed could explain why Jackson chose her to care for his kids, if his mother could not, Wilbekin said.

Ross raised five children of her own who grew up to become extremely "normal and successful children of a superstar," Wilbekin said.

"The other thing interesting about Diana and Michael's relationship: They both were a part of groups, they both ended up eclipsing their groups, so they had a shared experience that nobody else could really realize," he said. "I think in that they had a very special bond."

The two also were the subject of gossip regarding the nature of their relationship, fueled by Jackson's song "Dirty Diana." But Jackson said the hit was about groupies.

Jackson also starred in "Diana," produced in 1981 by Diana Ross Productions -- her first TV special not produced by Motown Productions.

In that show, Ross introduced Jackson as "the talent," and "my baby Michael Jackson" before the two sang "Ease on Down the Road," and other songs.

But it was their banter that received most of the attention.

"I knew you were going to be a star, I really did," Ross said to Jackson during the special. "What I didn't know, what I didn't know, is that you were going to get so sexy."

Jackson, in turn, said he always knew Ross would be sexy, and then motioned for the crowd when he asked, "Don't you guys think she's sexy?"

They were so close that when he first underwent plastic surgery, some speculated he was trying to look like his mentor.

Regardless of that speculation, it's clear the two shared a connection deep enough that Jackson trusted her with his children in the event of his death.

"The point that nobody has brought up -- Diana Ross happens to be a phenomenal mother. [Her kids are] kind of balanced, normal celebrity kids. And I think that's the part people aren't really looking at," Wilbekin said.

While some people may have been surprised another Jackson family member didn't follow Katherine Jackson in the will, Wilbekin said he believes that by picking Diana Ross, "he named someone who was super-responsible."

And because Jackson's children, have been growing up in the limelight because of their father, he may have wanted someone familiar with that, Wilbekin said.

"That just shows Michael's foresight, his emotional wisdom and his ultimate love for his family and protecting them," he said. "These are not normal kids, they did not live a normal life, and she totally completely understands that." Ross has not spoken about Jackson's death outside of a statement released on her behalf.

"I can't stop crying, this is too sudden and shocking," Ross says in the statement. "I am unable to imagine this. My heart is hurting. I am in prayer for his kids and the family."