💾 Archived View for clemat.is › saccophore › library › ezines › textfiles › ezines › HNS › issue037.… captured on 2021-12-03 at 14:04:38.
-=-=-=-=-=-=-
Net-Sec newsletter Issue 37 - 06.11.2000 http://net-security.org This is a newsletter delivered to you by Help Net Security. It covers weekly roundups of security events that were in the news the past week. Visit Help Net Security for the latest security news - http://www.net-security.org. Subscribe to this weekly digest on: http://www.net-security.org/text/newsletter Table of contents: 1) General security news 2) Security issues 3) Security world 4) Featured articles 5) Featured books 6) Security software 7) Defaced archives ============================================================ We are glad to announce that, in association with Zero Knowledge Systems, you can win several copies of their cutting-edge Internet Privacy software - Freedom. For your chance to win, please submit your opinion on the following topic: What are the current Internet privacy threats? Opinion submit form is located on: http://www.net-security.org/your-opinion/zks/ ============================================================ General security news --------------------- ---------------------------------------------------------------------------- IT SECURITY SPENDING MISSING MARK Despite an expected 300 percent spending increase on information technology security over the next four years, bad decision-making will leave U.S. companies almost as vulnerable to security breaches as they are today, according to a new report issued by Forrester Research. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.ecommercetimes.com/news/articles2000/001030-3.shtml CANADA'S HOLES A THREAT TO U.S? "James Adams, who has worked with the NSA and the CIA, told the National Post Canada's vulnerability is a concern to security circles in Washington. That's because so many major U.S. corporations have offices in Canada". Hmm who would tell them that sytem administrators and their security expertise is crucial for the state of computer security in those "U.S. corporations", and not to generalize the security situation to the whole Canada... Link: http://www.nationalpost.com/home/story.html?f=/stories/20001030/445647.html DOWNPLAYING THE SITUATION On Friday, Microsoft said the attackers had roamed its systems for five weeks. Now, Microsoft insists that they had high-level access for just 12 days, were monitored during this time, and that no damage was done. Link: http://news.bbc.co.uk/hi/english/business/newsid_998000/998449.stm 'INFECTING' THE BACKBONE "The president of Israel's leading Internet-service provider, Gilad Rabinovich, tells Newsweek that hackers have tried 'to infect the Internet backbone' of the country". Strange but as article speaks about Denial of Service attacks and mass spamming, where should we put the verb infecting? Link: http://www.hoovershbn.hoovers.com/bin/story?StoryId=CoFU84bWbsfntvtaWnMe GATEWAY SECURITY "NOT TOTALLY WORKED OUT" The official charged with ensuring Britain's public bodies can interoperate electronically has shed more light on the confusion surrounding the Government Gateway project. Anwar Choudhury, deputy director in the Office of the e-Envoy at the Cabinet Office, said on 31 October 2000 that the security infrastructure of e-government "has not been totally worked out yet". Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.kablenet.com/kable.nsf/Frontpage/B59CDF190B182238802569890057D826 MIDDLE EAST CYBER TENSION COULD ESCALATE Some(?) security experts are warning that the electronic skirmish in the Middle East could escalate and spill over to the United States. Tensions in the Middle East have spread to the online arena, with an increased level of activity against Web sites related to Israel and pro-Palestinian organizations, according to the FBI's National Infrastructure Protection Center (NIPC). However, Yoran's firm services clients in the Middle East, and they have not been threatened. Link: http://www.crn.com/Sections/BreakingNews/dailyarchives.asp?ArticleID=21152 DECREASE YOUR STRESS Much of a systems administrator's stress comes from unexpected downtime and dissatisfied users. This month in Pete's Super Systems, Pete introduces two free tools that will help reduce the chances of both. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.sunworld.com/sunworldonline/swol-10-2000/swol-1027-supersys.html VNUNET WRITES ABOUT ANTIONLINE DEFACEMENT Vnunet picked up a story about AntiOnline defacement. While writing this item the web site was currently not available, but I read earlier that they published information about the break in. I remember that it started with something like 'between millions of hack attempts, we had a successfull break in'. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.vnunet.com/News/1113199 IT TASK FORCE DISCUSSES SECURITY The Indo-Singapore task force on IT, communication and systems has held its first meeting in New Delhi and discussed various issues related to e-commerce laws, content, online security and ways to establish joint research and development efforts Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://asia.internet.com/2000/11/1101-india.html DOES IT MEETS MINIMUM SECURITY STANDARDS? Benchmarks for measuring security got a boost this week when the Center for Internet Security released a first draft of consensus security actions for Solaris systems. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.sans.org/cissummary.htm SEACH, SPAM, ETC. If you often use search engines, next Wired story will look strange, because it talks of some current issues surrounding search inquieries. At least it looked strange to me ;) Slashdot also picked it of course... Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.wired.com/news/technology/0,1282,39896,00.html UBER ATTACKERS NewsMax.com has a FUD article saying that targets by 'Russian hackers' are "America's power plants, telecommunications systems, bridges, dams, sewage treatment plants, water stations and other key installations." Link: http://www.newsmax.com/showinsidecover.shtml?a=2000/11/1/24737 HUSHMAIL BACKS UK ANTI-SNOOPING EFFORT UK Internet civil liberties group Cyber Rights & Cyber Liberties has teamed up with US email encryption company Hush Communications to overcome the RIP Act, which was recently made law. Through a joint project 'Cyber-Rights.Net', the pair will provide a route to bypass snooping regulations in the UK and at the same time draw attention to what they view as international moves to synchronise Internet surveillance. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.zdnet.co.uk/news/2000/43/ns-18819.html HITACHI UNVEILS SECURE NOTEBOOK RANGE Electronics giant Hitachi has launched a range of secure notebook PCs specifically aimed at companies and users looking to safeguard their data and equipment from malicious attacks. The HN7200, 7300 and 8300 notebooks, which go on sale next month, come equipped with remote networking facilities, a configurable firewall and email filtering tools aimed at defending workers based outside the corporate firewall from attempted hacks and malicious code appended to emails. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.vnunet.com/News/1113381 MCAFEE VIRUS DEFINITION CRASHES WINDOWS Keeping virus scanning software files current is usually a good idea... except for today. Network Associates has confirmed a bug in the latest McAfee VirusScan's virus definition file that could cause many Windows systems to freeze during start up. The problem is an incompatibility between a recent virus remedy file and the scan engine software in VirusScan. For those bitten by this bug, the only solution is to boot Windows in Safe Mode and disable VirusScan's system scanning at start up. Then, when an upgraded version of the scan engine is applied to the system, the user can go back and re-enable startup scans. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.zdnet.co.uk/news/2000/43/ns-18853.html NEW SAFE HARBOR DATA PRIVACY WEBSITE LAUNCHES Commerce Department Under Secretary Robert LaRussa announced the opening of a new website that enables U.S. companies to sign up online to participate in the U.S.-European Union "safe harbor" data privacy framework and thus comply with EU privacy rules. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://cipherwar.com/news/00/safe_harbor_2.htm CRACKERS ATTACK PRO-ISRAELI SITE Pakistani-based attackers attacked a U.S. website belonging to a pro-Israel lobby, stealing credit card numbers and member records in the latest volley in what has become an online war. The attack, against the American-Israel Public Affairs Committee, consisted of the attackers defacing its website with pro-Palestinian slogans and e-mails downloaded from the webite databases. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.wired.com/news/politics/0,1283,39950,00.html NET DAD VINT CERF SLAMS RIP Vinton Cerf, one of the founding fathers of the Internet, has attacked the RIP bill as a dangerous new piece of legislation. Speaking at the Compsec conference in London yesterday he commented: "Oh my god. A lot of us in the US are very worried about the RIP Bill, it has raised some of the same concerns as Carnivore." Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.theregister.co.uk/content/1/14451.html MICROSOFT'S SLOPPY ADMINS The Dutch hacker Dimitri, said to IT World that Microsoft failed to install a patch for a known bug, which let him enter one of Microsoft's servers. A Microsoft spokesman confirmed that the hacker reached at least one server, but said that Microsoft security personnel were rechecking their servers for holes to patch. Funny (or tragic) thing is that Microsoft doesn't secure their servers with their own patches... Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www2.itworld.com/cma/ett_article_frame/0,,1_3315,00.html ---------------------------------------------------------------------------- Security issues --------------- All vulnerabilities are located at: http://net-security.org/text/bugs ---------------------------------------------------------------------------- IIS 5.0 CROSS SITE SCRIPTING VULNERABILITY Using specially designed URLs, IIS 5.0 may return user specified content to the browser. This poses great security risk, especially if the browser is JavaScript enabled and the problem is greater in IE. By clicking on links, just visiting hostile web pages or opening HTML email the target IIS sever may return user defined malicous active content. This is a bug in IIS 5.0, but it affects end users and is exploited with a browser. A typical exploit scenario is stealing cookies which may contain sensitive information. Link: http://www.net-security.org/text/bugs/972959321,32876,.shtml MICROSOFT TO GEORGI GUNINSKI Microsoft takes reports of all security vulnerabilities seriously. That being said, we'd like to share the events surrounding the receipt and impending resolution of this issue. The Microsoft Security Response Center received a report of this vulnerability on October 24th, as Georgi states below. Within 24 hours of r eceiving Georgi's notification, we had a draft patch designed to correct this problem. What's more at issue here is the manner in which Georgi has decided to release this security advisory. We informed Georgi that we were working to address the issue and would probably have a patch available in short order (within eight days of the time he reported it to us). We asked that he give us time to finish the patch so we could do a joint release, thus protecting our mutual customers and reporting the issue in a responsible manner. Link: http://www.net-security.org/text/bugs/972959339,58883,.shtml GEORGI GUNINSKI REPLIES TO MICROSOFT I did not reply to secure@microsoft.com's emails because they were just informative emails without any questions. Here are some quick checkable facts regarding Microsoft's time to release a patch: Since Microsoft claims "Microsoft takes reports of all security vulnerabilities seriously" I'd like to point out that Microsoft has not fixed several vulnerabilities for very long time. One of them is file reading bug in IE 5.5 and has not been fixed for 3 1/2 months. Has they taken them seriously? The least they could do would be to inform their customers about a workaround. Link: http://www.net-security.org/text/bugs/972959359,54942,.shtml REMOTE COMMAND EXECUTION VIA KW WHOIS 1.0 There is a vulnerability in Kootenay Web Inc's KW Whois v1.0 which allows malicious users to execute commands as the uid/gid of the webserver. The hole lies in unchecked user input via an input form box. The form element < input type=text name="whois"> is not checked by the script for unsafe characters. Link: http://www.net-security.org/text/bugs/972959380,40592,.shtml MINOR BUG IN PAGELOG.CGI Any file on the system with a '.log' extension readable by the uid/gid of the webserver can be viewed. In addition, two files with extensions of '.txt' and '.log' can be created in any directory on the system that is writable by the web server. This bug lies in the failure of the script to check for directory traversal. Link: http://www.net-security.org/text/bugs/972959395,24878,.shtml ADDITONAL THEORY ON PAGELOG.CGI SECURITY ISSUE At this time this is just a theory, since i can't seem to find any sites running pagelog.cgi to test it, or a copy of the code anywhere to take a look at it. But, in theory, if you were to append a %20 to the address you should be able to open any file it is capable of displaying. Link: http://www.net-security.org/text/bugs/972959438,13878,.shtml SAMBA 2.0.7 SWAT VULNERABILITIES The program swat included in the samba distribution allows username and password bruteforcing. An attacker can easily generate userlists and then bruteforce their passwords. Comments in the source code show that somebody tried to prevent this from happening. Link: http://www.net-security.org/text/bugs/972959456,32735,.shtml UNIFY EWAVE SERVLETEXEC DOS Unify's eWave ServletExec is a JSP and a Java Servlet engine which is to be used as a plug-in to popular web servers like Apache, IIS, Netscape, etc. It is possible to send a URL request which causes the ServletExec servlet engine to terminate abruptly. The web server, however, is not affected. Link: http://www.net-security.org/text/bugs/972959470,90979,.shtml PEGASUS MAIL FILE READING VULNERABILITY David Harris, the author of Pegasus Mail, has released a utility called WSendTo that protects against the file reading vulnerability discussed on BugTraq a few weeks ago. Link: http://www.net-security.org/text/bugs/973042673,34444,.shtml "MALFORMED MIME HEADER" VULNERABILITY PATCHED Microsoft has released a patch that eliminates a security vulnerability in Microsoft Exchange Server 5.5. The vulnerability could enable a malicious user to cause an Exchange server to fail. Link: http://www.net-security.org/text/bugs/973042712,32774,.shtml ALLAIRE'S JRUN DoS A denial of service vulnerability exists within the Allaire JRun 3.0 web application server which allows an attacker to bring down the JRun application server engine. Link: http://www.net-security.org/text/bugs/973132487,53954,.shtml HOTMAIL CAN ACT AS EMAIL AMPLIFIER Hotmail can act as email size amplifier with a factor of at least 1000, allowing flooding and mail-bombing a victim while using a negligible amount of your own bandwidth. Link: http://www.net-security.org/text/bugs/973132501,46670,.shtml UNIFY EWAVE SERVLETEXEC UPLOAD Unify's eWave ServletExec is a JSP and a Java Servlet engine which is used as a plug-in to popular web servers like Apache, IIS, Netscape, etc. ServletExec has a servlet called "UploadServlet" in its server side classes. UploadServlet, when invokable, allows an attacker to upload any file to any directory on the server. The uploaded file may have code that can later be executed on the server, leading to remote command execution. Link: http://www.net-security.org/text/bugs/973132522,4578,.shtml NETSCAPE SERVERS HEAP BUFFER OVERFLOW An exploitable heap buffer overflow vulnerability was discovered in the Netscape Directory Server product. The Netscape Certificate Management System also has several server components that share the problem. Vulnerable systems allow the execution of arbitrary code as the user running the services. Link: http://www.net-security.org/text/bugs/973132538,13785,.shtml NETSCAPE SERVERS DENIAL OF SERVICE A bug in several components of the Netscape Servers suite of products allows and attacker to successfully conduct a denial of service attack against the vulnerable systems. The Netscape Certificate Management System has also several server components that share the problem. Link: http://www.net-security.org/text/bugs/973132561,625,.shtml "NETMON PROTOCOL PARSING" BUG PATCHED Microsoft has released a patch that eliminates a security vulnerability in Microsoft Windows NT and Windows 2000 server products and Systems Management Server. The vulnerability could allow a malicious user to gain control of an affected server. Link: http://www.net-security.org/text/bugs/973135591,74009,.shtml "INDEXING SERVICES CROSS SITE SCRIPTING" PATCH Microsoft has released a patch that eliminates a security vulnerability in Microsoft Indexing Services for Windows 2000. This vulnerability could allow a malicious web site operator to misuse another web site as a means of attacking users. Link: http://www.net-security.org/text/bugs/973261837,75960,.shtml MULTIPLE NETWORK MONITOR OVERFLOWS The Windows Network Monitor tool allows an administrator to capture network traffic destined to the local host or all traffic on a local network. Network Monitor is designed to capture network traffic before the information can be viewed in the graphical interface. Individual packets received from the network are parsed to provide a readable representation in the user interface. Each application level protocol is parsed by a separate dynamic linked library within Network Monitor. One of the vulnerable libraries, 'browser.dll', is documented in the samples section of the Visual C++ documentation in the MSDN library. Multiple stack overflows in various function calls within Network Monitor's parsing libraries may allow remote attackers to gain control of the Network Monitor application and execute arbitrary code. Link: http://www.net-security.org/text/bugs/973261858,1489,.shtml NAI'S DISTRIBUTED SNIFFER AGENT PROBLEMS NAI's Distributed Sniffer Agent can be overflowed remotely to grant SYSTEM privilege. Additional vulnerabilities exist in the management protocol to allow an attacker to recover logins passwords, take control of the agent, and delete logs. Link: http://www.net-security.org/text/bugs/973261889,85022,.shtml "ACTIVEX PARAMETER VALIDATION" PATCH An ActiveX control that ships as part of Windows 2000 contains an unchecked buffer. If the control was called from a web page or HTML mail using a specially malformed parameter, it would be possible to cause code to execute on the machine via a buffer overrun. This could potentially enable a malicious user to take any desire action on the user's machine, limited only by the permissions of the user. Microsoft has released a patch that eliminates this vulnerability. Link: http://www.net-security.org/text/bugs/973261905,68040,.shtml BUFFER OVERFLOW IN NETWORK MONITOR Internet Security Systems (ISS) X-Force has discovered a buffer overflow vulnerability in Microsoft's Network Monitor utility. The vulnerability allows code to be executed on the remote computer with the privilege levels of the current user. Administrative privileges are required to run Network Monitor. Link: http://www.net-security.org/text/bugs/973261921,19800,.shtml ---------------------------------------------------------------------------- Security world -------------- All press releases are located at: http://net-security.org/text/press ---------------------------------------------------------------------------- ZKS INTRODUCES MANAGED PRIVACY SERVICES - [31.10.2000] Zero-Knowledge Systems, the leading developer of privacy solutions, introduced its new Managed Privacy Services offering to solve the privacy challenges of businesses and enable enterprise to thrive in a privacy-conscious climate. Delivering a unique combination of technology, policy and strategy expertise, Zero-Knowledge Managed Privacy Services (MPS) enables clients to turn privacy into a competitive advantage by leveraging rich data resources while building stronger and more profitable relationships with customers, employees and partners. MPS is based on responsible and ethical information management in accordance with relevant legislation and industry standards. Press release: < http://www.net-security.org/text/press/973006780,81960,.shtml > ---------------------------------------------------------------------------- INFOEXPRESS STRENGTHENS PRESENCE IN CANADA - [31.10.2000] Responding to exponential growth in demand for effective remote access security for enterprises, InfoExpress announced the opening of a new office in Ottawa, Canada, the fast growing high-tech capital city. The new office will focus on marketing InfoExpress' award-winning CyberArmor Enterprise Personal Firewall Suite(TM) and FireWalker VPN Suite(TM) to companies in Ottawa, Toronto, Montreal, and the northeastern United States. In addition to sales activity, engineering support will also be available from the Ottawa office. Press release: < http://www.net-security.org/text/press/973006842,37204,.shtml > ---------------------------------------------------------------------------- ERAP VIRUS SUSPECT ARRESTED IN PHILIPPINES - [31.10.2000] Reports from the Philippines indicate that a 19 year old male youth has been questioned by the authorities about the so-called "Erap Estrada" worm. The youth, who has not been named, was arrested on October 22 by agents of the National Bureau of Investigation (NBI) at his house in Laguna. Floppy disks and other computer equipment were seized by the Anti-Fraud and Computer Crimes division of the NBI. The man was later released pending further investigation. Press release: < http://www.net-security.org/text/press/973009201,9686,.shtml > ---------------------------------------------------------------------------- TOP TEN VIRUSES REPORTED TO SOPHOS IN OCTOBER - [01.11.2000] This is the latest in a series of monthly charts counting down the ten most frequently occurring viruses as compiled by Sophos, the world leaders in corporate anti-virus protection. Press release: < http://www.net-security.org/text/press/973009653,81553,.shtml > ---------------------------------------------------------------------------- VENTUREWORX ANNOUNCES STAKE IN SECURITY FIRM - [01.11.2000] VentureWorx announced an equity stake in Vynamic� an Internet infrastructure company providing security solutions expressly designed to support the needs of the e-Learning marketplace. Vynamic utilizes a proprietary, secure student ID technology, which insures that students are authenticated and all online learning transactions are encrypted and protected. In addition, Vynamic's secure student ID enables both corporate training and academic e-Learning platforms the ability to protect their intellectual property by "locking in" their course content. Press release: < http://www.net-security.org/text/press/973041155,37624,.shtml > ---------------------------------------------------------------------------- ALADDIN AND DST PARTNER - [01.11.2000] Aladdin Knowledge Systems, a global leader in the field of Internet content and software security, and Digital Signature Trust, an affiliate of Zions Bancorporation and an issuer of trusted digital identity certificates, announced a partnership that combines Aladdin's eToken and DST's TrustID certificates to provide highly secure digital certificate storage and authentication. Press release: < http://www.net-security.org/text/press/973041378,67098,.shtml > ---------------------------------------------------------------------------- NEW ENCRYPTIONT TECHNOLOGY PREMIERED - [01.11.2000] CNET's Download.com launched the world's first encrypted Instant Messenging utility. The Encrypted Messenger program is unique in that it protects user's online chat and instant messenging by encrypting the text in real-time. The program will help quell the fear of consumers who are wary of potential online privacy invasions both from hackers and from accidental eavesdropping by programs such as Carnivore and Echelon. Press release: < http://www.net-security.org/text/press/973086289,42744,.shtml > ---------------------------------------------------------------------------- SC MAGAZINE AWARDS LATEST CYBERWALLPLUS - [01.11.2000] Security Solutions, Inc., a leader in distributed intrusion prevention solutions for e-Business networks, announced that SC Magazine has performed a technical product review of its CyberwallPLUS family of firewall products and awarded them its highest overall rating of 5 stars. The review is published in the October issue of SC Magazine. Press release: < http://www.net-security.org/text/press/973087847,13789,.shtml > ---------------------------------------------------------------------------- SECUREPRINT BIOMETRIC SOLUTION UNVEILED - [02.11.2000] Intermate and LCI SMARTpen Inc. introduce SECUREprint, an elegant solution that enables the secure printing of confidential or sensitive data to any standard laser printer through biometric authentication. The concept consists of two parts, the LCI SMARTpen, a biometric authentication system based on the users unique signature, and LCI Intermate's SECUREprint card for standard laser printers. Press release: < http://www.net-security.org/text/press/973135001,25125,.shtml > ---------------------------------------------------------------------------- INTEL SELECTS SAFENET'S ENCRYPTION BOARD - [02.11.2000] SafeNet, Inc., formerly IRE, the foundation of Internet security and de facto leader of VPN technology, announced that Intel has licensed its SafeNet PCI board to accelerate encryption functionality of the Intel NetStructure 3130 VPN Gateway. The integration of SafeNet PCI into Intel's NetStructure product offers the highest performing VPN gateway available for fast and secure Internet communications for mobile users, between offices and partners, and over corporate networks. Press release: < http://www.net-security.org/text/press/973135554,92946,.shtml > ---------------------------------------------------------------------------- CONTROL RISKS GROUP RELEASES RISKMAP 2001 - [03.11.2000] The business risk consultancy, Control Risks Group, launches its annual survey, RiskMap 2001 detailing the political, security and reputational risks that will define the international environment in the year ahead. Press release: < http://www.net-security.org/text/press/973262892,95889,.shtml > ---------------------------------------------------------------------------- BINDVIEW'S FREE TROJAN SCOUT FINDS QAZ TROJAN - [03.11.2000] Following recent hacks exposing Microsoft product code, BindView Corporation, a leading provider of IT administration and security management solutions, announced Trojan Scout, software that not only identifies the security vulnerability created by the QAZ Trojan, but also offers instruction for closing the "backdoor" created as a result of the intrusion. Press release: < http://www.net-security.org/text/press/973264008,56796,.shtml > ---------------------------------------------------------------------------- ANOTHER TREND MICRO PARTNERSHIP DEAL - [03.11.2000] Trend Micro Inc. has joined forces with Taiwan Telecommunications Network Services Co., Ltd., Taiwan's largest value-added network service provider and third-largest ISP, to protect TTN customers from the threat of Internet-borne viruses. Through this strategic alliance, TTN will offer its dial-up, broadband and lease-line Internet subscribers an optional virus scanning and cleaning service for their email messages and user mailboxes, using Trend Micro's award-winning antivirus technology Press release: < http://www.net-security.org/text/press/973264084,15124,.shtml > ---------------------------------------------------------------------------- BRILAW INTERNATIONAL WINS GOLD AGAIN - [04.11.2000] Stockport based Brilaw International has been re-accredited as a " Gold CSN Partner". This is an accreditation that relates to the reselling and adding value to Citrix. Citrix is the ultimate solution for organisations wishing to speed up applications, reduce their IT overhead and improve security. Brilaw International has renewed its commitment to the Citrix brand by complying with the new demands Citrix has placed on its premier resellers. Press release: < http://www.net-security.org/text/press/973337772,2484,.shtml > ---------------------------------------------------------------------------- Featured articles ----------------- All articles are located at: http://www.net-security.org/text/articles Articles can be contributed to staff@net-security.org Below is the list of the recently added articles. ---------------------------------------------------------------------------- SONIC: SELF-UPDATING INTERNET WORM DISCOVERED "IN THE WILD" Kaspersky Lab, an international anti-virus software development company, is warning users of the discovery of a new internet-worm, Sonic. This worm was discovered in France and Germany on the morning of 30th October 2000. The distinctive feature of this malicious program is its ability to update itself (ie: to automatically download additional component functionality) via the Internet. Read more: < http://www.net-security.org/text/articles/viruses/sonic.shtml > ---------------------------------------------------------------------------- RISK E-BUSINESS by Randy M. Nash Well, it's finally happened. I had my first close encounter with real life crackers! A good friend of mine recently went to work for a small Internet startup company (I generally refer to them as "3 Men and a Web Server"). I sent him an email Tuesday morning after the long President's Day weekend. His response came as a complete surprise, "Hey, I was just thinking about calling you. We've been hacked! Can you help us out?" Read more: < http://www.net-security.org/text/articles/risk.shtml > ---------------------------------------------------------------------------- We have a new section opened in cooperation with Newtork World Fusion, listed below are the seven articles added to that section. WATCH OUT FOR FAX VOTE SCAM by M. E. Kabay < http://www.net-security.org/text/articles/nwf/fax-vote.shtml > BANKS AND BIOMETRICS by M. E. Kabay < http://www.net-security.org/text/articles/nwf/banks.shtml > FORGED HEADERS AND THE LAW by M. E. Kabay < http://www.net-security.org/text/articles/nwf/forged.shtml > HOW TO RESPOND TO A HOAX by M. E. Kabay < http://www.net-security.org/text/articles/nwf/hoax.shtml > PEER-TO-PEER SOFTWARE AND SECURITY by M. E. Kabay < http://www.net-security.org/text/articles/nwf/peer.shtml > UNAUTHORIZED VULNERABILITY SCANS by M. E. Kabay < http://www.net-security.org/text/articles/nwf/scans.shtml > SNIFFING E-MAIL by M. E. Kabay < http://www.net-security.org/text/articles/nwf/sniffing.shtml > ---------------------------------------------------------------------------- Featured books ---------------- The HNS bookstore is located at: http://net-security.org/various/bookstore Suggestions for books to be included into our bookstore can be sent to staff@net-security.org ---------------------------------------------------------------------------- CISCO ROUTERS FOR IP NETWORKING BLACK BOOK: A PRACTICAL IN DEPTH GUIDE FOR CONFIGURING CISCO ROUTERS FOR INTERNETWORKING IP-BASED NETWORKS Explores complex topics in-depth, in the popular Black Book format, using a complete systematic approach to Cisco IP networking along with examples and diagrams. Covers the most important routing concepts by introducing the subject and then going through relevant practical examples. The configurations in this book were implemented in a lab with real Cisco routers. Especially written as a comprehensive guide for intermediate and advanced network professionals, or network specialists studying for the CCIE certification, to help answer all major router configuring and troubleshooting issues. Book: < http://www.amazon.com/exec/obidos/ASIN/1576106101/netsecurity > ---------------------------------------------------------------------------- WINDOWS 2000 REGISTRY (NETWORKING SERIES) This book targets professional users, system administrators, and support specialists. It enables the reader to master Registry concepts, properly use all of its features, plan and implement the most appropriate Registry backup strategy, and solve the most common problems using the Registry. This book contains in-depth information,and offers tips, tricks, and useful techniques for editing, customizing, and securing the Registry. Book: < http://www.amazon.com/exec/obidos/ASIN/1584500816/netsecurity > ---------------------------------------------------------------------------- UNIX NETWORK PROGRAMMING, VOLUME 1: NETWORKING APIS - SOCKETS AND XTI The classic programming text Unix Network Programming has been updated by author W. Richard Stevens to encompass three new volumes. There have been a few changes in the computing world since 1990 (the year the original was published), and Stevens has taken the opportunity to create a complete set of reference manuals for programmers of all skill levels. The first volume, Networking APIs: Sockets and XTI, covers everything you need to know to make your programs communicate over networks. Stevens covers everything from writing your programs to be compatible with both Internet Protocol version 4 (IPv4) and IPv6, to raw sockets, routing sockets, User Datagram Protocol (UDP), broadcasting/multicasting, routing sockets, server internals, and more, plus a section covering Posix threads. Stevens also notes compatibility issues with different operating systems so that readers can create code that is more portable, and he offers plenty of advice on how to make code more robust. Book: < http://www.amazon.com/exec/obidos/ASIN/013490012X/netsecurity > ---------------------------------------------------------------------------- DNS AND BIND This book's early chapters give a view of DNS from high altitude, explaining basic concepts such as domains, name servers, and name resolution. From there, the authors proceed on a more practical tack, presenting specific instructions for setting up your own domain and DNS server using BIND. The authors then tell you what to do as your domain grows and you need to add more machines, subdomains, and greater throughput capacity. They also talk a lot about nslookup and C programming with the various DNS and BIND libraries. Administrators will find the chapter on BIND debugging output particularly helpful. Here, the authors translate BIND's mysterious error messages and offer specific strategies for fixing and optimizing the program. This edition covers BIND 8.1.2, but pays lots of attention to older versions that are still in wide use (4.8.3 and 4.9). The authors are careful to note differences among the versions. Book: < http://www.amazon.com/exec/obidos/ASIN/1565925122/netsecurity > ---------------------------------------------------------------------------- Security Software ------------------- All programs are located at: http://net-security.org/various/software ---------------------------------------------------------------------------- SAINT VERSION 3.1 SAINT (Security Administrator's Integrated Network Tool) is a security assessment tool based on SATAN. Features include scanning through a firewall, updated security checks from CERT & CIAC bulletins, 4 levels of severity (red, yellow, brown, & green) and a feature rich HTML interface. Changes: Check for folder traversal vulnerability in IIS 4.0 and 5.0, JRun server vulnerabilities, iPlanet Directory Server and Certificate Management System, hex-encoded dot-dot-slash vulnerability in web servers, dot-dot -slash vulnerability in Web+, and HTTP PUT vulnerabilities. This version has a new custom scan level, giving you more control over which probes SAINT will run. Link: < http://net-security.org/various/software/973132818,56196,.shtml > ---------------------------------------------------------------------------- POWER CRYPTO 1.0 PowerCrypto lets you type in, or paste in, messages for instant encryption. The encrypted nonsense text can then be copied into e-mails, as ordinary text. The receiver then copies this nonsense text into PowerCrypto and decrypts your secret message, IF and ONLY IF, he has your secret key. The program also handles all types of files; documents, programs, pictures, and music files, for example. Link: < http://net-security.org/various/software/973043805,81111,.shtml > ---------------------------------------------------------------------------- COMPUTER SOUND SECURITY SYSTEM 1.04 CSSS programme provides effective premises guarding by means of a microphone or several microphones, which act as sensors and a modem, which acts as a signaling (informing) device. The CSSS principle of action consists in microphone (microphones) survey on the scale of real time and highly intellectual analysis of coming signals on the basis of special algorithms based on the methods of speech cognition. Due to the flexible system of tooling the user is able to adjust the action of the programme himself in accordance with the specific requirements of the premises. The system can be adjusted for different frequency ranges and different levels of average total sound signals amount received from the microphone or all microphones in the system. So, it�s possible to adjust the system e.g. for human steps only (low frequency sound signals) i.e. the level will start rising considerably after the appearance of low frequency sound signals. Link: < http://net-security.org/various/software/973043978,70494,.shtml > ---------------------------------------------------------------------------- OKIDOKI GUARD 1.1.2 (MACOS) Okidoki Guard is a simple program designed to password-protect your computer. After you put in your name and password, an icon will be placed in the startup folder. After you reboot your Mac, a password prompt screen will come up, asking for your password. Link: < http://net-security.org/various/software/973044264,7082,.shtml > ---------------------------------------------------------------------------- STEALTH SIGNAL 3.8 Stealth Signal is a laptop security system that specializes in providing peace of mind to you, the laptop owner. Stealth Signal equips your computer with an undetectable software-based transmitter that sends homing signals to our monitoring network. These signals are transmitted at random times over any Internet connection or phone line. Link: < http://net-security.org/various/software/973044421,5870,.shtml > ---------------------------------------------------------------------------- Defaced archives ------------------------ [01.11.2000] - Silverton Chamber of Commerce Original: http://www.silverton.org/ Defaced: http://www.attrition.org/mirror/attrition/2000/11/01/www.silverton.org/ [01.11.2000] - Royal Jordainian Web Site Original: http://www.rja.com.jo/ Defaced: http://www.attrition.org/mirror/attrition/2000/11/01/www.rja.com.jo/ [02.11.2000] - Governo do Estado da Paraiba Original: http://ntiserv1.saude.pb.gov.br/ Defaced: http://www.attrition.org/mirror/attrition/2000/11/02/ntiserv1.saude.pb.gov.br/ [02.11.2000] - Cybernet Original: http://www.cybernetinc.net/ Defaced: http://www.attrition.org/mirror/attrition/2000/11/02/www.cybernetinc.net/ [02.11.2000] - The American Israel Public Affairs Committee Original: http://www.aipac.org/ Defaced: http://www.attrition.org/mirror/attrition/2000/11/02/www.aipac.org/ [02.11.2000] - SCM Labs, Inc. Original: http://www.scmlabs.com/ Defaced: http://www.attrition.org/mirror/attrition/2000/11/02/www.scmlabs.com/ [02.11.2000] - SimTel Computers DBA Original: http://www.simtelcomputers.com/ Defaced: http://www.attrition.org/mirror/attrition/2000/11/02/www.simtelcomputers.com/ [03.11.2000] - Jewish Bible Association Original: http://www.jewishbible.org/ Defaced: http://www.attrition.org/mirror/attrition/2000/11/03/www.jewishbible.org/ [03.11.2000] - Yizrael Valley College (Mihlelet Emek Yizrael) Original: http://www.yvc.ac.il/ Defaced: http://www.attrition.org/mirror/attrition/2000/11/03/www.yvc.ac.il/ [03.11.2000] - Quantum Computer Services Original: http://www.myownemail.com/ Defaced: http://www.attrition.org/mirror/attrition/2000/11/03/www.myownemail.com/ [03.11.2000] - the hehe.com e-mail service Original: http://www.hehe.com/ Defaced: http://www.attrition.org/mirror/attrition/2000/11/03/www.hehe.com/ [03.11.2000] - Visiting Israel Students Association Original: http://www.visa.org.il/ Defaced: http://www.attrition.org/mirror/attrition/2000/11/03/www.visa.org.il/ [03.11.2000] - Health Infosystems Association, Israel Original: http://www.healthinfonet.co.il/ Defaced: http://www.attrition.org/mirror/attrition/2000/11/03/www.healthinfonet.co.il/ ---------------------------------------------------------------------------- Questions, contributions, comments or ideas go to: Help Net Security staff staff@net-security.org http://net-security.org