💾 Archived View for clemat.is › saccophore › library › ezines › textfiles › ezines › HNS › issue044.… captured on 2021-12-03 at 14:04:38.
-=-=-=-=-=-=-
Net-Sec Newsletter Issue 44 - 01.01.2001 http://net-security.org [ -- Happy 2001 -- ] This is a newsletter delivered to you by Help Net Security. It covers weekly roundups of security events that were in the news the past week. Visit Help Net Security for the latest security news - http://www.net-security.org. Subscribe to this weekly digest on: http://www.net-security.org/text/newsletter Archive of the newsletter in TXT and PDF format available here: http://www.net-security.org/news/archive/newsletter Table of contents: 1) General security news 2) Security issues 3) Security world 4) Featured articles 5) Featured books 6) Security software 7) Defaced archives General security news --------------------- ---------------------------------------------------------------------------- EGGHEAD.COM SYSTEM COMPROMIZED "Egghead.com has discovered that a hacker has accessed our computer systems, potentially including our customer databases," the company said in a statement released yesterday. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.timesofindia.com/today/24info5.htm KASHMIR RELATED DEFACEMENTS More than 40 Indian sites have been infiltrated this year by hackers like G Force Pakistan and Doctor Nuker, who have left poignant pro-Pakistan slogans and reasons why Kashmir belongs to that country. Wired has the report. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.wired.com/news/politics/0,1283,40789,00.html PC GUARDIAN ENCRYPTION PLUS HARD DISK Once Encryption Plus Hard Disk is installed on a user�s computer, the system will not boot without the user�s password. Even if an experienced user were to somehow work around the boot protection and access the hard disk, s/he would only be able to read file names. The data would remain encrypted. This feature alone should make encryption practically mandatory for notebook users. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.canadacomputes.com/v3/story/1,1017,5163,00.html INFORMATION SYSTEMS AND SURVEILLANCE The miniaturization of electronic equipment and the advances in the production of armaments and computer science equipment, thanks to technological advances of knowledge and Information Systems (IS) have led some theoreticians to define war of the information era as digital war. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://cryptome.org/omni-is-spy.htm THE LINUX YEAR IN REVIEW Linux Weekly News has put together a great summary of the major events surrounding Linux and open source over the past year. Continuing the popular tradition of our 1998 and 1999 Linux Timelines, here is our attempt to summarize what has happened in the Linux world over the last year. This is version 0.8.3 of the LWN 2000 Linux Timeline. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.lwn.net/2000/features/Timeline/ SECURITY-ENHANCED LINUX As part of its Information Assurance mission, the NSA has long been involved with the computer security research community in investigating a wide range of computer security topics including operating system security. The results of several previous research projects in this area have been incorporated in a security-enhanced Linux system. This version of Linux has a strong, flexible mandatory access control architecture incorporated into the major subsystems of the kernel. The system provides a mechanism to enforce the separation of information based on confidentiality and integrity requirements. This allows threats of tampering and bypassing of application security mechanisms to be addressed and enables the confinement of damage that can be caused by malicious or flawed applications. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.nsa.gov/selinux/ ESTABLISHING EMAIL VALIDITY Scenario: Christmas morning you get an angry phone call from one of your contractors. They claim to have received an email outlining why you have chosen to terminate their contract, that in no uncertain terms describes relations with their mother, family pet, or what have you. The caller can't believe how rampantly unprofessional this message is, and has already contacted their legal department about suing for damages and breach of contract. All of this information has taken you completely by surprise. As far as you know, no message has been sent by anyone at your company, especially given that you're the only employee currently employed by your company. How can you prove that no email was sent by you? How can you demonstrate in a court that no such email has originated from your system? What if it has? Can you prove that you were not the sender? Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.securityportal.com/cover/coverstory20001225.html ONLINE SECURITY KEY TO EMBRACING SMART CARDS Imagine a single card that lets you purchase and download an airline ticket using your PC. That same piece of plastic could also pay for a restaurant lunch, open secure doors at the office, check out books at the library. It could even become your car keys. Sound like a script from the Jetsons? Not really. Thanks to the improving power and versatility of microprocessors embedded in the cards, consumers will not only be able to better protect themselves against online fraud as they bank or trade stocks. They will also be able to store digital cash, personal information, Web site passwords and addresses, and such things as loyalty coupons from merchants or frequent flyer points. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.cnn.com/2000/TECH/computing/12/25/smart.cards.ap/index.html LINUX SECURITY WEEK This week,advisories were released for ed, stunnel, bitchx, zope, nano, slocate, procps, oops, halflifeserver, ethereal, netscape, pam, jpilot, rp-pppoe, kerberised telnetd, ftpd, gnupg, mysql, and tcsh. The vendors include Conectiva, Debian, FreeBSD, Mandrake, NetBSD, OpenBSD, Red Hat, and Trustix. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.linuxsecurity.com/articles/forums_article-2186.html STIFFER PENALTIES IN HONG KONG Hong Kong police on Monday warned would-be computer hackers of the territory's stringent penalties against cybercrimes. The caution came as official figures showed a 300 percent increase in the number of people connected to the Internet across the territory in the last two years. Link: http://www.dotcomdirectory.newsalert.com/bin/story?StoryId=CoKBuueibntaWmJKZndi2 "ANTITRUST" - HOLLYWOOD FILM ON TECH INDUSTRY DUE AntiTrust," a new motion picture from MGM scheduled to hit theaters Jan. 12, 2001. Tim Robbins plays Gary Winston, the brilliant and driven mastermind behind N.U.R.V., which stands for "Never Underestimate Radical Vision," a software company dedicated to monopolizing digital convergence. Winston dazzles promising young computer science student Milo, played by Ryan Phillippe, into abandoning his plans to launch a start-up company with his college buddy and come work for N.U.R.V. Winston's mantra is, "In this business, you are either a one or a zero." At the heart of N.U.R.V. is the Synapse project, which is described as the world's first satellite-delivered global communications system. "AntiTrust" explores the issues of surveillance, corporate espionage and intellectual property theft. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.computeruser.com/news/00/12/26/news20.html ETISALAT HACKING The lawyer representing a young Briton accused of hacking into Emirates Telecommunications Corp's (Etisalat) Internet system says he plans to ask the Public Prosecutor to produce its evidence or drop the case. Link: http://www.gulf-news.com/Articles/news.asp?ArticleID=5629 We covered the story closely, so you can find more information here: http://net-security.org/cgi-bin/pr0n/viewnews.cgi?searchetisalat HACKER ATTACKS ON SHARP RISE Safeguards against hacker attacks are urgently needed, the Korea Information Security Agency (KISA) said. The Ministry of Information and Communication- affiliated institute said there were a total of 1,858 cases of hacking detected in the nation as of November, more than triple the 572 cases found last year. There were a mere 147 hacker attacks in 1996, and the figure dropped to 64 in 1997. However, cyber crime began rising sharply again, with the figure climbing to 158 in 1998, and 572 last year. KISA noted that corporations appear to be the main target for hacker attacks. Ninety-two, or 40.5 percent of 227 hacker attacks that occurred in November were targeted against corporations, for example. "This is an indication that security systems at Korean corporations are frail and that companies lack mindset for security," a KISA official said. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.koreaherald.co.kr/SITE/data/html_dir/2000/12/27/200012270081.asp BAD DAYS FOR NETWORK ASSOCIATES Network Associates Inc.'s top three executives, including Chairman and Chief Executive William Larson, resigned suddenly Tuesday, shocking investors, who sliced the company's stock price in half in after-hours trading. As we could see from various news outlets their shares fell for 65% (according to ZDNet), 68% (according to InfoWorld) and 72% (according to Reuters). Below you can read a few articles that are covering the story. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.zdnet.co.uk/news/2000/51/ns-19913.html Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www0.mercurycenter.com/svtech/news/indepth/docs/networ122700.htm Link: http://www.crn.com/Sections/BreakingNews/dailyarchives.asp?ArticleID=22548 NATIONAL SECURITY RISK In a report released this month titled "Cyber Threats and Information Security: Meeting the 21st Century Challenge," the Center for Strategic and International Studies (CSIS) concluded that the government and the private sector should be concerned about the "trustworthiness" of future Microsoft products in the aftermath of the hack into the company's network. Link: http://www.net-security.org/cgi-bin/news.cgi?urlhttp://www.idg.net/ic_335424_1794_9-10000.html= DEMAND FOR NET-BASED SECURITY PRODUCTS Demand for Internet-based security products is exploding, as sales reached $243 million last quarter and are expected to more than double next year, a new study shows. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://news.cnet.com/news/0-1004-200-4290053.html HONG KONG POLICE OFFER CHRISTMAS WARNING TO HACKERS Computer whizzes in Hong Kong who like to test their skills on the Web sites of others will receive little sympathy from the Hong Kong Police who issued a warning about the consequences of such actions. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.computeruser.com/news/00/12/28/news16.html CRYPTOGRAPHY IN YOUR POCKET Recently, some announcements have been made of commercial encryption programs for the PalmPilot personal organizer. Some of these were for subroutines that might be used in programs whose primary purpose is not encryption, for purposes such as software registration. Also, Network Associates, the company that owns PGP, has a commercial product, PGPwireless, specifically aimed at those who use their Palm Pilots (and, shortly, other similar devices) to connect to the Internet. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.securityportal.com/articles/pocket20001228.html NO MONEY IN HACKERDOM, VERSION 1.0 "ESR has an article that explains some ways for you to become a Hacker. I'm not going to repeat all the points he has in that article, as you can look at that article for the specifics. I am going to make the argument that Hackers do not generally Hack because they have to for work. Instead, it is their passion, their life, in a dramatic way. Also, I'm going to make the argument that, and this is not how ESR feels, Hackers can be non-contributing authors to the code base of the world. That code base is better known as Open Source or Free Software today." Link: http://www.linuxpower.org/display.php?id=200 AN INTRODUCTION TO VIRUSES AND MALICIOUS CODE PART TWO In Part One of this series SecurityFocus.com writer Brad Griffin introduced readers to viruses and other forms of malicious code. He discussed the various ways in which viruses can infect a user's computer and how they can affect a user's important data. This article, the second in a three-part series, will discuss ways of protecting computers against virus infection, including: anti-virus software, proper handling of e-mail and external media such as floppy disks, the dangers of non-essential software, and the necessity of user education. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.securityfocus.com/focus/basics/articles/malintro2.html ANTI-DEFAMATION LEAGUE WEB SITE ATTACKED The ADL Web site was taken over for about 20 minutes by attackers who identified themselves as the "World's Fantabulous Defacers." In lieu of the ADL home page, the attackers posted threats to Israelis as well as pro Palestinian sentiment. The attackers did not gain access to any sensitive information. The group closed the site a few minutes after the attack was discovered, according to an ADL representative. Four hours later, the site was restored. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://news.cnet.com/news/0-1007-200-4292972.html THE STORY OF JEFF: PART VI This story is the ongoing saga of Jeff, a tragic tale full of hardship, heartbreak and triumph over impossible odds. Jeff is your average network administrator, responsible for Acme, Inc.'s Microsoft-based corporate network. A brightly lit server room. Fans humming quietly, a glass wall at one end; on the other side we see a table with several people sitting around it. Scattered on the table are several pads of paper, pencils, pagers and a laptop. We see Jeff, eyes a healthy shade of bloodshot pink accented by dark bags underneath. Lifting a cup of cold coffee to his lips, he grimaces and takes a deep gulp, swallowing it hurriedly. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://securityportal.com/articles/jeff20001229.html THE 101 USES OF OPENSSH: PART I This month we'll cover ssh's background and architecture, how to build and/or install OpenSSH, how to use ssh as an encrypted replacement for Telnet, how to set some basic ssh configuration options and how to use scp for encrypted file transfers. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www2.linuxjournal.com/lj-issues/issue81/4412.html UPDATE ON EGGHEAD.COM PENETRATION Egghead.com, the Internet firm that had 3.6 million credit cards compromised before Christmas when security on its e-commerce site was cracked, said it will know by the end of the week whether the hacker managed to steal the financial information of its customers. Link: http://www.nationalpost.com/tech/story.html?f=/stories/20001228/418915.html DAILY NEWS THAILAND DEFACED The Web site of the Daily News newspaper (www.dailynews.co.th) was defaced late on Tuesday night, the third such break-in in recent years, its webmaster said today. No information was destroyed or altered. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.newsbytes.com/news/00/159816.html BEWARE OF HAPPY NEW YEAR VIRUS A new e-mail virus is on the loose, according to Computer Associates International. The "Tqll-A" worm is typically found in electronic messages bearing a Happy New Year greeting in the subject field, said Ian Hameroff, business manager for antivirus solutions for Computer Associates. The latest threat, which CA detected at its global research centers, conveys itself via Microsoft Outlook. When people open the "happynewyear.txt.vbs" attachment, the virus then installs itself on the user's hard drive. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.techweb.com/wire/story/TWB20001229S0006 FEDS WARN OF CONCERTED ATTACKS ON NEW YEAR' EVE Federal computer security experts are urging system administrators to take added precautions in securing Web servers and network firewalls in advance of the New Year's holiday weekend, citing FBI reports indicating an increase in activity that often precedes widespread cyber attacks. Authorities at the National Infrastructure Protection Center - the FBI's cyber crime division - said data gleaned from FBI investigations and other sources indicate that many computer systems may already have been turned into "zombies" waiting for commands from hackers to cripple the Internet. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.newsbytes.com/news/00/159873.html REPORT: MICROSOFT HACK A U.S. SECURITY RISK Although Microsoft Corp. has denied that the hacker who penetrated its network in October gained access to any of the company's source code, a recent report by a Washington-based think tank is warning that the compromise may hold grave national security implications. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.cnn.com/2000/TECH/computing/12/29/csis.microsoft.report.idg/index.html NEW ATTACK ON DIGITAL PIRACY Hollywood has teamed up with some of the biggest players in computer storage technology to build a copy-prevention scheme into every hard drive and memory card - opening a new front in the war against online piracy. If widely adopted, the technology would make it more difficult for consumers to duplicate copyrighted files such as music and movies without the permission of the companies that own the rights. Hard drives and memory cards are used to store information on everything from personal computers and MP3 music players to digital cameras and palm-size organizers. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www0.mercurycenter.com/svtech/news/indepth/docs/copy122900.htm LINUXPPC SECURITY PRIMER, PART I "So you've bought that new G4 you've been eyeing for lo these many months. Or perhaps you've blown the dust off of some aging Performa you've kept in your basement. Either way, you've decided to install Linux on your PowerPC box, but you're worried about some '31337 haxOr d00dz' gaining control of your machine through some security hole. It turns out there's both good news and bad news for you." Link: http://linuxppc.org/security/articles/lppc_security_primer_I.php3 'THE ANALYZER' ADMITS SABOTAGE 'The Analyzer' was convicted yesterday by the Kfar Sava Magistrates Court after striking a plea bargain deal with prosecutors. Tannenbaum, a 21 year old Hod Hasharon resident, confessed to offenses of conspiracy, wrongful infiltration of computerized material, disruption of computer use, and destroying evidence. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www3.haaretz.co.il/eng/htmls/kat18_2.htm SO MANY PREDICT SO MUCH The three most important tech issues of 2001 will be free speech, privacy and e-money. ISPs will continue to be the targets of governments such as France who want to control what their citizens see and read. Privacy in all instances will be contentious, especially when it comes to genetics. E-money will appear back on the scene as countries other than the United States (for example, Japan), begin to experiment and succeed with viable e-money systems. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.wired.com/news/politics/0,1283,40906,00.html ---------------------------------------------------------------------------- Security issues --------------- All vulnerabilities are located at: http://net-security.org/text/bugs ---------------------------------------------------------------------------- THE END OF SSL AND SSH? FOLLOW-UP "Well, I certainly managed to kick over a hornet's next with my article "The End of SSL and SSH?". There were quite a few points I did not cover in the article, many I did not think of, and some I trimmed. This article will cover the reaction to SSL and SSH being "dead", as well as numerous implementation issues I did not cover. The real issue is that technology cannot solve problems completely." Link: http://www.net-security.org/text/bugs/977746823,69115,.shtml 1ST UP MAIL SERVER V4.1 VULNERABILITY The Ussr Team has recently discovered a Buffer Overflow in 1st Up Mail Server v4.1 where they do not use proper bounds checking. The overflow is in the field "mail from: < ", a large number of aaaaaa's "> (over 300). It then displays this message: "Application popup: smtp server: smtp server.exe - Application Error : The instruction at "0x00402f23" referenced memory at "0x61616161". The memory could not be "read". This results in a Denial of Service against the service in question. Link: http://www.net-security.org/text/bugs/977788101,95356,.shtml DEBIAN LINUX - DIALOG SYMLINK ATTACK Matt Kraai reported that he found a problem in the way dialog creates lock-files: it did not create them safely which made it susceptible to a symlink attack. This has been fixed in version 0.9a-20000118-3bis. Link: http://www.net-security.org/text/bugs/977886772,81869,.shtml DEBIAN LINUX - MULTIPLE STUNNEL VULNERABILITIES Lez discovered a format string problem in stunnel (a tool to create Universal SSL tunnel for other network daemons). Brian Hatch responded by stating he was already preparing a new release with multiple security fixes: 1. The PRNG (pseudo-random generated) was not seeded correctly. This only affects operation on operating systems without a secure random generator. 2. Pid files were not created securely, making stunnel vulnerable to a symlink attack 3. There was an insecure syslog() call which could be exploited if the user could manage to insert text into the logged text. At least one way to exploit this using faked identd responses was demonstrated by Lez. These problems have been fixed in version 3.10-0potato1. Link: http://www.net-security.org/text/bugs/977886802,94324,.shtml DEBIAN LINUX - TWO GPG PROBLEMS There is a problem in the way gpg checks detached signatures which can lead to false positives. Detached signature can be verified with a command like this: gpg --verify detached.sig < mydata If someone replaced detached.sig with a signed text (ie not a detached signature) and then modified mydata gpg would still report a successfully verified signature. Link: http://www.net-security.org/text/bugs/977886820,3938,.shtml ORACLE INTERNET APPLICATION SERVER BUGS The first possible vulnerability is essentially a configuration issue associated with the Portal Listener and modplsql. When these are installed, the default configuration allows all users access to the Listener and modplsql administration pages. A second potential vulnerability may occur if customers grant public access to PL/SQL procedures, in particular those which access an Oracle database such as OWA, SYS and DBMS. Since publicly accessible procedures may be accessed through a URL, it may be possible to to invoke these procedures through a URL and cause SQL statements to be executed on a back-end Oracle database. Link: http://www.net-security.org/text/bugs/977886859,308,.shtml NSA SECURITY-ENHANCED LINUX PROBLEM The most recent version that appears to be available is dated last week, slinux-200012181053-release.tgz. In this distribution, the find_default_type function in libsecure/get_default_type.c attempts to extract a type field from the file /etc/security/default_type and copy it to a result buffer (specifically, to the argument "char **type"). Memory for this result buffer is allocated using malloc, but the argument to malloc is always one character too small. For example, the role argument might typically be "sysadm_r" and the len argument would then be 8. With the initial installation, the first value of buf would be "sysadm_r:sysadm_t\n". There are no leading spaces, so i is 0. In the statement (*type) = (char*) malloc (sizeof(char) * (strlen(buf)-i-len-1)); the argument to malloc is 18 - 0 - 8 - 1, which is 9. Then, strcpy ((*type), &buf[i]+len+1); attempts to copy the 10 characters "sysadm_t\n\0" into the 9-character buffer. Link: http://www.net-security.org/text/bugs/977971173,27822,.shtml MORE PROBLEMS FOR TECHNOTE in main.cgi ,failed properly validate user input which arguments a call to open(). FREE_BOARD is a default db http://localhost/technote/main.cgi/oops? board=FREE_BOARD&command= down_load&filename=/../../../main.cgi Link: http://www.net-security.org/text/bugs/977971189,41142,.shtml REMOTE VULNERABILITY IN IKONBOARD Ikonboard is a free forum system. Similair to UBB and UB. Versions up to and including 2.1.7b contain a vulnerability that allows commands to be executed as the script user. Therefore compromising security of the system running the board and allowing an attacker to get passwords of the board users, because they are in no way encrypted/hashed. Link: http://www.net-security.org/text/bugs/978186540,73624,.shtml ---------------------------------------------------------------------------- Security world -------------- All press releases are located at: http://net-security.org/text/press ---------------------------------------------------------------------------- EGGHEAD.COM INVESTIGATES PENETRATION - [24.12.2000] Egghead.com, Inc., released the following statement: "Egghead.com has discovered that a hacker has accessed our computer systems, potentially including our customer databases. As a precautionary measure, we have taken immediate steps to protect our customers by contacting the credit card companies we work with. They are in the process of alerting card issuers and banks so that they can take the necessary steps to ensure the security of cardholders who may be affected. Press release: < http://www.net-security.org/text/press/977664283,29904,.shtml > ---------------------------------------------------------------------------- RSA CONFERENCE 2001 ASIA RFP - [27.12.2000] RSA Security Inc. announced a call for papers and demonstrations for the first annual RSA Conference in Asia. RSA Conference 2001, Asia, is scheduled to be held July 9 - 12, 2001, at the Singapore International Convention and Exhibition Center in Suntec City, Singapore. The event is expected to bring together decision-makers and influencers from financial services, government, education, information technology, telecommunications and the media. Security professionals, cryptographers, analysts, developers and strategic partners are encouraged to submit presentations on their security implementations, applications or research. Press release: < http://www.net-security.org/text/press/977887231,94789,.shtml > ---------------------------------------------------------------------------- RSA KEON CERTIFICATE SERVER 5.5 CLOSE TO EAL4 - [27.12.2000] Reinforcing its commitment to product security, quality and reliability, RSA Security Inc., the most trusted name in e-Security, announced that the RSA Keon Certificate Server 5.5, RSA Security's digital certificate management system designed to add trust to e-government, has been accepted into evaluation against the Common Criteria (CC) for Information Technology Security Evaluations. The Common Criteria for Information Technology Security Evaluation (CC) V2.1/IS 15408 is an international standard for evaluating the security of IT products. This important achievement indicates that the RSA Keon Certificate Server is on its way to achieving CC evaluated status recognized by governments and businesses around the world, including Australia, Canada, France, Germany, the Netherlands, the United States, the United Kingdom, Italy, Spain, Greece, Norway, Finland, and New Zealand. Press release: < http://www.net-security.org/text/press/977887369,30178,.shtml > ---------------------------------------------------------------------------- BINDVIEW'S BV-CONTROL FINALISTS IN INFOSEC MAG - [2.12.2000] BindView Corporation, a leading provider of IT security management solutions, announced that its bv-Control product family has been selected as a finalist in the Security Management & Auditing Category for the Information Security Excellence Award given by Information Security Magazine. The winners will be announced at an awards luncheon in February at the MIS Training Institute's InfoSec World Conference in Orlando. Press release: < http://www.net-security.org/text/press/977948954,9040,.shtml > ---------------------------------------------------------------------------- TRIPWIRE GETS "NSS APPROVED" STATUS - [28.12.2000] Tripwire Inc., the leading provider of data and network integrity software, announced that Tripwire HQ Manager and Tripwire HQ Connector for NT were awarded the internationally recognized "NSS Approved" status for their exceptional performance. Tripwire's products were thoroughly tested in the Intrusion Detection Software (IDS)/Vulnerability Assessment Group Test 2000 by The NSS Group, Europe's foremost independent test organization focusing on security issues. Press release: < http://www.net-security.org/text/press/978020664,85700,.shtml > ---------------------------------------------------------------------------- SYMANTEC CEO COMMENTS SECURITY MARKET - [28.12.2000] On the heels of a recent Network Associates announcement, Symantec Corp. issued the following statement to its investors and customers: "We have never been more confident in our future," said John W. Thompson, chairman, president and CEO of Symantec. "Symantec continues to gain momentum in the enterprise security business. Industry leaders such as Oracle, Cobalt, Yahoo and Earthlink have recently chosen Symantec's security technology. Global leaders in industries ranging from automotive, telecommunications and financial services are showing increasing confidence in our products and our company. In addition, our recently completed merger with AXENT Technologies makes Symantec the largest Internet security company in the world." Press release: < http://www.net-security.org/text/press/978020871,73838,.shtml > ---------------------------------------------------------------------------- 475,000 DOWNLOADS OF AVX VIRUS PROTECTION - [29.12.2000] At a time when other anti-virus software providers are posting losses, Central Command Inc., a leader in the anti-virus industry, announced that within the last 45 days more than 475,000 people have downloaded AVX virus protection to protect their computers from viruses. AVX Professional software, with its new virus prevention technology designed around an open plug-in architecture, is quickly becoming a standard among Internet users. Press release: < http://www.net-security.org/text/press/978091342,18550,.shtml > ---------------------------------------------------------------------------- FLORIDA SUPREME COURT SELECTS IDENTIX - [29.12.2000] Identix Incorporated, the worldwide leader in providing user authentication, security and identification solutions, announced that the Florida State Supreme Court has selected Identix's fingerprint biometric security solutions to secure its 650 seat Wide Area Network (WAN) enterprise-wide, which encompasses five District Courts of Appeal and the State Supreme Court. Press release: < http://www.net-security.org/text/press/978091572,661,.shtml > ---------------------------------------------------------------------------- NEW CUSTOMERS USING CERTICOM'S SSL - [29.12.2000] Continuing to strengthen its position as a leading provider of e-business security, Certicom, announced that is has signed license agreements with five new companies. Additional licensees are Alteon WebSystems, i-drive, Five Nine Solutions, Inc., Ponoi Corp. and Tempest Software. These companies have licensed Certicom's leading SSL Plus software to enhance the security and trust of their respective internal applications and e-business offerings. Press release: < http://www.net-security.org/text/press/978091709,67478,.shtml > ---------------------------------------------------------------------------- Featured articles ----------------- All articles are located at: http://www.net-security.org/text/articles Articles can be contributed to staff@net-security.org Below is the list of the recently added articles. ---------------------------------------------------------------------------- YOUR OPINION: "WHAT ARE THE CURRENT PRIVACY THREATS?" Recently we held a survey on HNS regarding the current privacy threats. Many visitors decided to share their opinions with us. In this article you can read some of the most interesting opinions. Read more: < http://www.net-security.org/text/articles/opinion.shtml > ---------------------------------------------------------------------------- ICMP USAGE IN SCANNING VERSION 2.5 by Ofir Arkin "The Internet Control Message Protocol may seem harmless at first glance. Its goals and features were outlined in RFC 792 (and than later cleared in RFCs 1122, 1256, 1349, 1812), as a way to provide a means to send error messages, troubleshoot networking problems, and more. There is no consent between the experts in charge for securing Internet networks (Firewall Administrators, Network Administrators, System Administrators, Security Officers, etc.) regarding the actions that should be taken to secure their network infrastructure in order to prevent those risks. The risks involved in implementing the ICMP protocol in a network, regarding scanning, are the subject of this research paper". PDF Version: < http://www.net-security.org/text/articles/index-download.shtml#ICMP > ---------------------------------------------------------------------------- THE ABC OF COMPUTER SECURITY by Paul Ducklin This White Paper gives an introduction to computer security and its significance for businesses, followed by an alphabetical guide to common security measures and threats. PDF Version: < http://www.net-security.org/text/articles/index-download.shtml#ABC > ---------------------------------------------------------------------------- RESULTS OF THE SECURITY IN ACTIVEX WORKSHOP On August 22-23, 2000, the CERT Coordination Center hosted a workshop in Pittsburgh, Pennsylvania, for twenty invited experts to address security issues related to ActiveX controls. The primary goal of the workshop was to identify the situations under which ActiveX and related technologies may be used safely and to produce a paper describing security concerns and configuration guidance. That goal was achieved and the result of the workshop, this paper, serves not only to dispel unwarranted myths about the safety of using ActiveX but also to furnish guidance to network administrators and others faced with security issues involving mobile code in general and ActiveX in particular. Read more: < http://www.net-security.org/text/articles/index-download.shtml#active > ---------------------------------------------------------------------------- Featured books ---------------- The HNS bookstore is located at: http://net-security.org/various/bookstore Suggestions for books to be included into our bookstore can be sent to staff@net-security.org ---------------------------------------------------------------------------- CIM IP ROUTING DVP SIMULATOR (CISCO CAREER CERTIFICATIONS) With CIM IP Routing: Distance-Vector Protocols, you can master protocols that are the backbone of the Internet and enable traffic to move across business networks. Offering self-paced instruction and practice, this robust learning tool gives you a quick and cost-effective way to acquire Cisco knowledge and expertise. From an overview of IP routing concepts to the development of IP access lists, you�ll learn the difference between routing functions and strategies, routing traffic using multiple paths, and how to implement routing protocols for quick convergence times with minimal network traffic through Cisco internetworking devices. Mastering techniques developed by Cisco Technical Assistance Center engineers, you�ll practice configuring and troubleshooting RIP, IGRP, and EIGRP over IP networks. CIM IP Routing: Distance-Vector Protocols is an excellent preparation tool for the Cisco Certified Network Associate (CCNA) exam. Book: < http://www.amazon.com/exec/obidos/ASIN/1587200120/netsecurity > ---------------------------------------------------------------------------- IN THE TRENCHES: CUSTOMIZING AND UPGRADING LINUX A reference for the busy professional to installing and administering Linux, detailing the difference between Linux and other Unix systems. The CD-ROM contains Red Hat Linux 6.2, to enable the reader to follow along with the text and see how Linux works. Book: < http://www.amazon.com/exec/obidos/ASIN/1930713010/netsecurity > ---------------------------------------------------------------------------- GNU AUTOCONF, AUTOMAKE, AND LIBTOOL This is a technically adept and expert guide to using these utilities effectively. Any C/C++ or script programmer who writes software under Unix/Linux will want to have a copy of this book to make better use of these powerful and sometimes obscurely documented tools. This text is filled with the nuts-and-bolts details of running these three utilities, including command-line switches and the actual, generated files that automate the build process and help programmers port code between different environments. As such, this title will be appreciated by those at their workstations who want a hands-on guide to using the autotools. There's a danger of missing the forest for the trees here, with all of this necessary detail, but the middle sections of this book pull back a little with several useful chapters on the bigger picture of code "portability." Chapters on both C and C++ portability explore language features that likely will cause trouble when code is moved between different versions of Unix (or even between Unix and Windows). A similar section also discusses the issues when developing portable shell scripts. Book: < http://www.amazon.com/exec/obidos/ASIN/1578701902/netsecurity > ---------------------------------------------------------------------------- LINUX IP STACKS COMMENTARY The book is an in-depth look at the TCP/IP protocol implementation as implemented in Linux. Using the style of John Lion's original much-photocopied A Commentary on the Unix Operating System, Linux IP Stacks Commentary guides you through the ins and outs of TCP, UDP, ICMP, routing, IPCHAIN firewall code, and the Linux TCP/IP applications interface. The source for the network code is included in the book and on the CD-ROM. Book: < http://www.amazon.com/exec/obidos/ASIN/1576104702/netsecurity > ---------------------------------------------------------------------------- APACHE SERVER COMMENTARY A guide for programmers and developers who need to understand and master the source code that runs the world's mot popular Web server. Holden (author and president of Stylus Media), Nicholas Wells (technical writer and consultant), and Matthew Keller (programmer/analyst for Distributed Computing and Telemedia department at the State U. of New York College) conduct a line-by-line examination of the core code, as well as the standard Apache modules that control logging, directory indexing, access control, CGI, and other essential aspects of running a full-featured Web site. Flow charts illustrate how individual modules work. The included CD-RRM contains the complete source code for version 1.3.6 of the Apache Web server package, a precompiled binary version of Apache for Windows 32- bit platforms, ApacheWrapper version 1.3.29, Comanche, IPTraf version 1.4.3, and Chili!Soft ASP 3.0. Book: < http://www.amazon.com/exec/obidos/ASIN/1576104680/netsecurity > ---------------------------------------------------------------------------- Security Software ------------------- All programs are located at: http://net-security.org/various/software ---------------------------------------------------------------------------- W32.KRIZ PREVENTION TOOL This tool is a preventive measure against the W32.Kriz virus. It will not repair damage done after the virus has been launched. Info/Download: < http://net-security.org/various/software/977614917,63951,.shtml > ---------------------------------------------------------------------------- KILL_CIH REMOVAL TOOL The KILL_CIH tool is designed to safely detect and remove all known strains of the W95.CIH (Chernobyl) virus (known strains as of August 3rd, 1998) from memory under Windows 95 and Windows 98 (the W95.CIH virus cannot infect Windows NT systems). If the tool is run before the virus has infected the system, it will also "inoculate" the computer's memory to prevent the W95.CIH virus from infecting the system until the next system reboot. Info/Download: < http://net-security.org/various/software/977615146,72255,.shtml > ---------------------------------------------------------------------------- W32.NAVIDAD REMOVAL TOOL This tool will only work for W32.Navidad and it will not work for the W32.Navidad.16896 variant. Info/Download: < http://net-security.org/various/software/977615252,711,.shtml > ---------------------------------------------------------------------------- CHKROOTKIT-0.19 chkrootkit locally checks for signs of a rootkit. Includes detection of LKM rootkits, ifpromisc.c to check and see if the interface is in promisc mode, chklastlog.c to check lastlog for deletions, and chkwtmp.c to check wtmp for deletions. Tested on Linux, FreeBSD, Solaris, and OpenBSD. Info/Download: < http://net-security.org/various/software/978188214,78469,.shtml > ---------------------------------------------------------------------------- SECURE DISK EXPLORER 1.1.3 Secure Explorer is a full-featured file manager similar to Windows Explorer. However, the biggest difference is that this program provides a completely secure environment for data and documents on your system. It's capable of encrypting files and locking folders, thus making them inaccessible to other users. Like Explorer, Secure Explorer supplies its very own shell context menu. As you browse your hard drive, simply right-click an item and select the appropriate protection option from the menu. The program gives you the option of preventing Explorer from displaying these items. Meanwhile, files and folders are stored inside tabs on the interface, which require passwords for entry. Like Explorer, Secure Explorer supplies its very own shell context menu. Info/Download: < http://net-security.org/various/software/978188372,43683,.shtml > ---------------------------------------------------------------------------- Defaced archives ------------------------ [25.12.2000] - ChangChun Sience&Technology, China Original: http://www.ccst.gov.cn/ Defaced: http://www.attrition.org/mirror/attrition/2000/12/25/www.ccst.gov.cn/ [25.12.2000] - Slackware Original: http://www.slackware.com/ Defaced: http://www.attrition.org/mirror/attrition/2000/12/25/www.slackware.com/ [25.12.2000] - Nasdaq Japan Original: http://www.nasdaq.co.jp/ Defaced: http://www.attrition.org/mirror/attrition/2000/12/24/www.nasdaq.co.jp/ [25.12.2000] - Administrative Office of the U.S. Courts Original: http://www.nywd.uscourts.gov/ Defaced: http://www.attrition.org/mirror/attrition/2000/12/25/www.nywd.uscourts.gov/ [26.12.2000] - Hizbollah Original: http://www.hizbollah.org/ Defaced: http://www.attrition.org/mirror/attrition/2000/12/26/www.hizbollah.org/ [27.12.2000] - Government Republic Of Moldova Site Original: http://ministry.moldova.md/ Defaced: http://www.attrition.org/mirror/attrition/2000/12/27/ministry.moldova.md/ [27.12.2000] - National Oceanic and Atmospheric Administration Original: http://www.fob.noaa.gov/ Defaced: http://www.attrition.org/mirror/attrition/2000/12/27/www.fob.noaa.gov/ [28.12.2000] - US DOI, Bureau of Land Management Original: http://www5.ca.blm.gov/ Defaced: http://www.attrition.org/mirror/attrition/2000/12/28/www5.ca.blm.gov/ [29.12.2000] - Embassy of Israel, Wellington, New Zealand Original: http://www.israel.org.nz/ Defaced: http://www.attrition.org/mirror/attrition/2000/12/29/www.israel.org.nz/ [29.12.2000] - Human Right Education Programme, Pakistan Original: http://www.hrep.com.pk/ Defaced: http://www.attrition.org/mirror/attrition/2000/12/29/www.hrep.com.pk/ ---------------------------------------------------------------------------- Questions, contributions, comments or ideas go to: Help Net Security staff staff@net-security.org http://net-security.org