💾 Archived View for clemat.is › saccophore › library › ezines › textfiles › ezines › HNS › issue058.… captured on 2021-12-03 at 14:04:38.
-=-=-=-=-=-=-
HNS Newsletter Issue 58 - 09.04.2001 http://net-security.org http://security-db.com This is a newsletter delivered to you by Help Net Security. It covers weekly roundups of security events that were in the news the past week. Visit Help Net Security for the latest security news - http://www.net-security.org. Subscribe to this weekly digest on: http://www.net-security.org/text/newsletter Archive of the newsletter in TXT and PDF format is available here: http://www.net-security.org/news/archive/newsletter Current subscriber count to this digest: 2204 Table of contents: 1) General security news 2) Security issues 3) Security world 4) Featured article 5) Security software 6) Defaced archives ======================================================== Advertisement - HNS Security Database ======================================================== HNS Security Database consists of a large database of security related companies, their products, professional services and solutions. HNS Security Database will provide a valuable asset to anyone interested in implementing security measures and systems to their companies' networks. Visit us at http://www.security-db.com ======================================================== General security news --------------------- ---------------------------------------------------------------------------- STANFORD LAW SCHOOL DEAN WILL ARGUE 2600 CASE "In a major boost to our legal battle against the MPAA, Stanford Law School Dean Kathleen Sullivan has joined our team and will be arguing the case in front of the Second Circuit Court of Appeals on May 1. She joins Martin Garbus and the team from the Electronic Frontier Foundation who worked on the initial trial and continue to work diligently on the appeal. Sullivan brings an impressive combination of legal expertise and technical knowledge to this critical point of our case and it demonstrates not only that we intend to win, but that there are many experts in the field who understand the importance of the DeCSS case - and are willing to help." Link: http://www.2600.com/news/display.shtml?id=211 WIN-NT/IIS ADMINS MADE APRIL FOOLS BY HACKERS Several crews got busy on April Fools Day to make a mockery of Microsoft security by targeting Web sites running MS' IIS server over Windows NT/2K for defacement. Among the higher-profile victims were the Walt Disney Company; the Wall Street Journal's WebWatch; British Telecomms; HSBC; the US Navy's Center for Tactical Systems Interoperability (NCTSI); the US Army Training and Doctrine Command (TRADOC); Ringling Bros and Barnum & Bailey Circus; and the American Society for the Prevention of Cruelty to Animals (ASPCA). None of the sites appeared to have been attacked for any reason other than the fact that they were vulnerable. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.theregister.co.uk/content/8/18029.html HOW TO AVERT A VIRUS DISASTER Vinny Gullotto, head of the McAfee Anti-Virus Emergency Response Team (Avert), is a fast-talking techie who the Feds call when they're foxed by the latest virus. "I get a lot of calls from the FBI looking for virus samples," said Gullotto. "They want to know how we rate a particular virus and what threats they should look out for. We can deal with most viruses in somewhere between two and six hours." Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://thebusiness.vnunet.com/Features/1120000 THE NT LOCAL ADMINISTRATOR AND SHARED PASSWORDS There is a Local Administrator account on every NT machine currently deployed. It is extremely common to find many NT machines in an enterprise sharing the same password for this Local Administrator account. This article by SecurityFocus writer Daniel Marvin will establish that this shared password constitutes a security vulnerability. It will subsequently discuss various steps to mitigate the risk arising from the shared password, and make a case for applying unique passwords to every Local Administrator account in your enterprise. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.securityfocus.com/focus/microsoft/nt/sharedpass.html IT SECURITY PROFESSIONALS MAY BE LICENSED IT security professionals may require a government licence to work in future, Home Office minister Charles Clarke has warned, leaving the door open for further regulation of the UK IT industry. Clarke has refused to rule out including IT consultants in professions covered by the Private Security Industry (PSI) Bill, which was originally intended to cover bouncers and wheel-clampers. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://thebusiness.vnunet.com/News/1120010 HACKER SPEAK "Hackers and members of the Internet security industry, like workers in other specialty trades, have their own form of shop talk. The following is an abbreviated list of catch phrases and euphemisms used by hackers and security professionals." Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.pcworld.com/features/article/0,aid,44370,00.asp TO TRAP A THIEF If you want to break into a house, why spend time prying open the front door if the back door is wide open? Same goes when breaking into computer networks. Most networks and servers are set up with configuration errors that are well known to hackers, who can download free tools that will scan many different networks looking for those easy-open entry points. No genius-level code manipulation or high IQ is needed. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.computerworld.com/cwi/story/0,1199,NAV47_STO59072,00.html CHINESE FEDS DEMAND COMPUTER VIRUS SAMPLES China's Ministry of Public Security has been requiring Western anti-virus vendors to supply samples of malicious code as a condition of doing business with Mainland consumers, the Wall Street Journal reports. The official Chinese explanation would have us believe that the secret police have lately gone into the consumer protection business by claiming that the samples are necessary to enable the Feds to test the effectiveness of the software being sold. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.theregister.co.uk/content/8/18057.html SECURITY INDUSTRY SLAMS VIRUS REWARD The antivirus industry lambasted email firewall startup GateKeeper on Monday, after the company announced a reward for any virus writer who can infect a specific computer protected by its product. "It is probably one of the most irresponsible things that someone could do," said Vincent Gullotto, director of the Antivirus Emergency Response Team for security services company Network Associates. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.zdnet.co.uk/news/2001/13/ns-22031.html PERSONAL FIREWALL TEST: TERMINET This article is a part of a series of tests on Personal Firewalls/Intrusion Detection Systems. TermiNET, by DANU Industries, is a relatively simple firewall. It offers access control, stealth mode, web blocking, multiple user profiles, intrusion detection with blocking notification, flexible web browsing control, and restriction by by IP address, URL, port and protocol. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://securityportal.com/articles/pf_terminet20010403.html NEW CLOAKED-CODE THREAT TO SECURITY During a seminar last week at the CanSecWest conference in Vancouver, British Columbia, a hacker named "K2" revealed a program he created that can camouflage the tiny programs that hackers generally use to crack through system security. The cloaking technique is aimed at foiling the pattern-recognition intelligence used by many intrusion detection systems, or IDSes, known as the burglar alarms of the Internet. "Trust me, this will blow away any pattern matching," said K2, who would not reveal his real name because he also works as a security consultant. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.zdnet.com/zdnn/stories/news/0,4586,5080532,00.html DIRECTORS BLIND TO SECURITY WEAKNESSES Financial and managing directors are dangerously unaware of the risks surrounding digital business, according to a recent Mori poll. The survey, commissioned by digital risk insurance specialist Safeonline, showed that only 24 per cent of directors at small to medium sized enterprises could identify a security risk without being prompted. Mori found that damage caused by staff, whether by negligence or genuine error, is the most feared risk. When prompted by pollsters, 47 per cent of respondents said that innocent mistakes were the most likely cause of damage. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://thebusiness.vnunet.com/News/1120062 46,000 ADDR.COM STOLEN? A computer criminal claims to have stolen personal information on 46,000 customers from Web hosting company ADDR.com. The data includes account names and passwords that could be used to alter Web site content, as well as credit card information. ADDR.com has so far not commented on the alleged heist. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.msnbc.com/news/553615.asp GOVERNMENT BACKTRACKS ON ENCRYPTION ENQUIRY The Home Office has backtracked on a promise to commission an independent enquiry into the effects of legislation that will give police and other authorities the power to intercept data transmitted over private networks and demand decryption keys from the place where data is encrypted. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.zdnet.co.uk/news/2001/13/ns-22044.html INTERVIEW WITH ELIAS LEVY (BUGTRAQ) Bugtraq is probably the best security mailing list around. While the quasi founder (I was surprised to find that Aleph1 didn't technically start Bugtraq) is quite prominent online, I wasn't able to find any detailed information about him or Bugtraq (except for one old interview). So, here for you to enjoy is an interview with Aleph1. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://securityportal.com/closet/closet20010405.html ONE IN THREE UK COMPANIES HAVE BEEN HACKED A survey of IT professionals released today indicates that one in three UK businesses has been the victim of a major security break in. Almost half of those who took part in the poll said that the future of their organisation could be ruined by a serious hacker attack. The survey, commissioned by the Communications Management Association (CMA) questioned 2000 senior IT professionals and guaranteed anonymity to participants. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.zdnet.co.uk/news/2001/13/ns-22045.html NEW TECHNOLOGY ENABLES PORTABLE SECURITY Biocentric Solutions has unveiled its next generation of biometric technology for authentication with portable computing devices. Biocentric also rolled out two products based on its next generation technology, the BioSentry for the Compaq iPAQ Pocket PC, and BioHub for portable computing devices that run in Windows CE. A portable biometric fingerprint reader designed for the Compaq iPAQ Pocket PC, BioSentry is used in place of the iPAQ expansion pack to prevent unauthorised access to both the hardware and data on the Pocket PC. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://thebusiness.vnunet.com/News/1120091 HAVE MOVIES CREATED THE STEREOTYPE OF THE HACKER? No doubt you remember Matthew Broderick's portrayal of a hacker in the movie War Games. That film launched hacking as a popular pastime--at least for a specific demographic of teenage males. But it wasn't the first film to feature hacking, or the last. Movie hackers have had many faces: one-dimensional clowns, nefarious villains, mischievous geniuses, anarchic heroes. And as hackers and their motivations in the real world have changed, so have their counterparts in the movies. In more recent films they're more unrealistic, cartoonier, angrier, and able to perform completely impractical or impossible acts. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.pcworld.com/features/article/0,aid,45804,00.asp CHASING THE WIND, PART FIVE: THE DEVIL IN THE DETAILS At long last, SecurityFocus is pleased to present the fifth installment of Robert G. Ferrell's popular series, Chasing the Wind. As we left off last time, Ian, the aspiring hacker, had just successfully defaced Acme Ailerons' web site. Jake, Acme's new SysAdmin, slept peacefully, oblivious to the travails that awaited him. Douglas, a Systems Engineer at Acme Ailerons, was busy trying to decipher some the plans for a mysterious classified project. Meanwhile, Bob, the CIO of the company, had travelled to the high-security C4I center for a very high-level, top-secret meeting... Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.securityfocus.com/focus/ih/articles/chasing5.html WIRED REPORTER FORCED TO TESTIFY AT CYPHERPUNK TRIAL Wired chief Washington correspondent Declan McCullagh isn't merely covering the criminal trial of cypherpunk Jim Bell (who's in the dock accused of stalking federal agents); he's also been made a reluctant participant. McCullagh had sought to quash a subpoena requiring him to testify on concerns that he might be forced to disclose information related to Bell's case given to him in confidence, but his motion was denied. The Feds offered assurance that they would question him only on the accuracy of reports he'd already published so that they could be entered into evidence, which would of course be fair; but once a witness is on the stand, there's nothing to prevent a prosecutor asking whatever he or she might please. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.theregister.co.uk/content/6/18104.html BT HACKED TWICE IN THREE DAYS BT has had two of its UK websites defaced by hackers over the last three days. On Sunday hackers left a rant about ADSL on the search.bt.com site, and yesterday btworldwide.com was defaced by Prime Suspectz. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.vnunet.com/News/1120110 MORE ON ADORE WORM The third Linux worm in almost as many months hit the computer systems this week. Known as the Adore worm, the program is designed to create back doors in the security of Linux systems and send information identifying the compromised systems to four different e-mail addresses hosted on servers in China and the United State. If you have been noticing a large number of scans for port 515, it is recommended you take the necessary steps to patch the vulnerabilities noted below. - Multiple Vendor LPRng User-Supplied Format String Vulnerability - http://www.securityfocus.com/bid/1712 - Wu-Ftpd Remote Format String Stack Overwrite Vulnerability - http://www.securityfocus.com/bid/1387 - ISC Bind 8 Transaction Signatures Buffer Overflow Vulnerability - http://www.securityfocus.com/bid/2302 - Multiple Linux Vendor rpc.statd Remote Format String Vulnerability - http://www.securityfocus.com/bid/1480 NEW NSW CYBER CRIME LAWS SMH reported that New South Wales Government announced new laws dealing with cyber crime. Virus writers could get up to 10 years for their creations and maximum sentence of five years will be the result for online fraudsters. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.smh.com.au/news/0104/05/pageone/pageone4.html LION INTERNET WORM ANALYSIS This paper provides an introduction to the Lion (1i0n) Worm author and a technical analysis of the Lion Internet Worm. Three unique variations of the Lion Worm have been released on the Internet over the past month. All three versions of the Lion Worm are unsophisticated unix shellscript worms. BTW paper gives really comprehensive study on the mentioned worms. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://whitehats.com/library/worms/lion/ TURBOTAX SOFTWARE HAS PASSWORD GLITCH A programming glitch in TurboTax software has posed a potential security problem for as many as 150,000 users and may force them to change their passwords, Intuit Inc. said Thursday. Link: http://www.nandotimes.com/technology/story/0,1643,500470851-500721068-504029893-0,00.html VIRUS PESSIMISM FROM MESSAGELABS? Virus attacks may treble by the end of the year according to research from UK antivirus firm MessageLabs, which suggests that government departments as well as companies will collapse under the weight of malicious attachments and executables. Sophos' Graham Cluley answered to that: "I don't think there is any scientific evidence that the situation is going to get radically worse than it is now." Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.zdnet.co.uk/news/2001/13/ns-22102.html CURADOR 'TAKES CARE' OF BILL GATES The Sun reported that 'Curador' (look a year back for more information), who is awaiting sentence after pleading guilty to stealing credit card details from a number of insecure Web sites, has reportedly claimed he sent a shipment of Viagra to Bill Gates using the Microsoft boss's own credit card. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.theregister.co.uk/content/8/18124.html GOVERNMENT TARGETS Unauthorized people gained complete control of at least 155 government computer systems among 32 federal agencies last year, according to a review made public Thursday during a congressional hearing. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.cnn.com/2001/TECH/internet/04/05/computer.security.ap/index.html BIOPASSWORD SECURITY CHECKS USER'S TYPING PATTERN Call me paranoid, but I'm in good company. Most biometric security programs - which identify a person through their biological traits -store details about a user's unique physical characteristics on a hard drive, and Robert Flores, the CIA's chief technology officer, says it's easy enough for a hacker to get at the data. When I quoted Flores's statement to the five biometric vendors in this review, four of them either changed the subject or essentially said, "Well, nothing is foolproof." The representative of one company, Net Nanny Software Inc., not only agreed with Flores but also said that vulnerability is what makes the company's BioPassword effective. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.newsbytes.com/news/01/164151.html IMPROVING APACHE Unix admins swear by Apache's out-of-the-box robustness, but certain configuration steps are needed to ensure the Web server's security." I'm running Apache, not IIS. Therefore, I'm secure." When it comes to Web server security, many systems admins automatically assume Microsoft's Internet Information Server is the devil, while the open-source Apache is God. Diehard Unix admins swear up and down that they'll never go with IIS because it's a breach waiting to happen and Apache is so secure. Well, guess again. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.infosecuritymag.com/articles/april01/features1_web_server_sec.shtml BETA RELEASE OF TRUSTIX SECURE LINUX 1.4.80 "This is to announce the BETA release for the upcoming Trustix Secure Linux 1.5 release. It has version 1.4.80, and is nicknamed "Ooops". It is in serveral ways INCOMPATIBLE with 1.2, and you do not want to just continue without knowing a little more of what is ahead. If it breaks your system, let us know so we can prevent it from happening to others. But don't say you didn't know it would :-)" Link: http://linuxtoday.com/news_story.php3?ltsn=2001-04-05-020-20-SC HACKER TOOL THREATENS .NET Microsoft's .Net platform has been dealt a security blow before it has even been released. The discovery of what is thought to be the first C# decompiler for the software giant's much heralded next-generation operating system will undermine confidence in the platform. John Safa, a former cracker and CTO of security vendor BitArts, said: "The cracking community now has a C# decompiler, which unravels application code. If you got on the inside of a network using this tool, you could do anything." Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://thebusiness.vnunet.com/News/1120202 E-MAIL WIRETAPPING Corporate spies are using covert JavaScript code within email to track the contents of sensitive financial communications. That's the warning from managed service provider Activis which said that it is seeing increasing use of malicious JavaScript coding to create Web bug that spy on Internet traffic. These Web bugs can be embedded into HTML based emails before they are sent. The code then acts to covertly copy the original sender each time this email is forwarded on within the recipient's system. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.theregister.co.uk/content/8/18147.html DISTANT EARLY WARNING Keeping a pulse on national and international developments that impact computer security is like trying to catch a subway train just leaving the station. You do a lot of running, and maybe, you still miss the train. If your company does business across multiple political borders, strange questions may arise. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://securityportal.com/articles/earlywarning20010406.html MACINTOSH OS X SECURITY Security to the general Macintosh user has never been much of an issue. Turn it on, use it, turn it off when you�re done. And even if you�ve got a DSL or other dedicated line, warnings related to hack attempts on open and dedicated networks lines never seemed to instill fear in a Mac user. Sure there are products like Norton Personal Firewall or NetBarrier 2.0, but these are for professionals right? Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.securemac.com/macosxsecurity.cfm INTERVIEW WITH LANCE SPITZNER Introduction by Max Vision: "Lance is an absolutely essential leader in the whitehat community. He infects everyone with his passion and enthusiasm for network security. But more importantly, he organizes a fairly disparate group of security experts into a productive, cooperative team. This is no easy feat in an industry that increasingly favors non-disclosure. Lance is an exemplar of a true whitehat: curious, intelligent, and honest. He is simply good." Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.safemode.org/LanceSpitzner.html PASSWORD RECOVERY SOFTWARE Elcom is a private russian company established in 1990. They develop password recovery software: for archives (ZIP, RAR, ARJ, ACE), Adobe Acrobat PDF, Microsoft Office (Word, Excel, Access, Outlook, Visio, PowerPoint, VBA), MS Project, MS Backup, MS Mail, MS Schedule+, Symantec ACT!, Intuit Quicken & QuickBooks, Borland/Corel Paradox and Lotus WordPro, 1-2-3. Link: http://www.security-db.com/info.php?id=150 CAN YOU BREAK WINDOWS XP SECURITY? Microsoft quietly put a new test site online last Saturday to let hackers attempt to breach Windows XP's security. Microsoft placed a version of Windows XP Home Edition online in a configuration that resembles a typical user's home setup. The Web site will help Microsoft determine configuration settings that it can recommend to potential users of the new OS. Link: http://www.ntsecurity.net/Articles/Index.cfm?ArticleID=20596 WOH 'S INTERVIEW Alldas.de has an interview with RuBiX, a member of WoH (World Of Hell) - a defacing group that attacks web sites of rich and famous companies. Link: http://security.alldas.de/interviews/?id=2 ATTACKERS HIT CRICKET, BOLLYWOOD SITES Attackers have defaced two Indian internet sites catering to movie fans and cricket lovers, the chief of thecompany which runs the sites said on Saturday. One of the sites showed pasted statements criticising India's role in Kashmir. The other had a dark green colour resembling the Pakistani flag. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.economictimes.com/today/08tech05.htm ---------------------------------------------------------------------------- Security issues --------------- All vulnerabilities are located at: http://net-security.org/text/bugs ---------------------------------------------------------------------------- TOMCAT MAY REVEAL SCRIPT SOURCE CODE Tomcat (http://jakarta.apache.org/tomcat/), the Reference Implementation for the Java Servlet 2.2 and JavaServer Pages 1.1 Technologies, may be tricked into revealing the source code of JSP scripts by using simple URL encoding. Link: http://www.net-security.org/text/bugs/986039232,20871,.shtml BEA WEBLOGIC MAY REVEAL SCRIPT SOURCE CODE BEA WebLogic may be tricked into revealing the source code of JSP scripts by using simple URL encoding of characters in the filename extension. Link: http://www.net-security.org/text/bugs/986039343,69657,.shtml SILENT RUNNER COLLECTOR BUFFER OVERFLOW Silent Runner Collector (SRC) has a buffer overflow condition in the routines that parse SMTP traffic. SRC is the "sniffer" conponent of the Silent Runner network traffic analysis suite. The overflow was noticed in SRC v1.6.1 but is likely present in other versions as well. The actual buffer in question holds the SMTP HELO line. The overflow occurs when a HELO command in excess of 4096 bytes transits a network segment that the collector is monitoring. This vulnerability can be exploited by an intruder to crash the collector and thus stop the monitoring of transiting network traffic. Link: http://www.net-security.org/text/bugs/986039956,52213,.shtml VIRUS BUSTER 2001 BUFFER OVERFLOW The buffer overflow occurs when MUA received email with the header defined in RFC 822 including unusually long strings. As a result, the user of this software is not able to receive any e-mail(s) more. An attacker could use this vulnerability to execute arbitrary commands. A restart of the computer is required in order to gain normal functionality. Link: http://www.net-security.org/text/bugs/986040790,23239,.shtml PROBLEMS WITH INCORRECT MIME HEADER Microsoft has released a security bulletin http://www.microsoft.com/technet/security/bulletin/ms01-020.asp entitled "Incorrect MIME Header Can Cause IE to Execute E-mail Attachment". EML files are MIME multipart files that IE 5 will parse. There is a vulnerability allowing arbitrary code execution using this kind of files. This vulnerabiliy could allow an hostile page or e-mail to perform any action on your computer. The vulnerability affects IE 5, IE 5.5 over all windows platforms. Link: http://www.net-security.org/text/bugs/986042902,80256,.shtml TREND MICRO'S SCANMAIL FOR EXCHANGE BUG Several registry values are created during installation and during use of the product's Management Console to store the credentials of the last user to log on. These credentials are valid at least on the server, and possibly valid on the entire domain depending on the last user to log in. Additionally, these keys are created with Everyone set to Special Access, which includes the ability to read the values. The usernames and passwords are rolled right a number of characters and then XOR'ed with a constant key (0xB15A0E707EEDEB80F70FB78F1399). Link: http://www.net-security.org/text/bugs/986122048,75503,.shtml SECURITY BUG IN INTERNET EXPLORER By visiting a web page with IE it is possible to read arbitrary local files (in very rare cases small amount of the file's content is lost) if the file name is known and send them to an arbitrary server. It is also possible to read arbitrary web pages to which the victim has access. Probably this bug may be more serious, have not investigated further - an interesting scenario seems to be playing with C:\Documents and Settings\USERNAME\Local Settings\Temporary Internet Files\ Content.IE5\index.dat. which probably may lead to executing arbitrary programs. Link: http://www.net-security.org/text/bugs/986122152,59013,.shtml TOMCAT 3.2.1 FOR WIN2000 DIR. TRAVERSAL A security vulnerability has been found in Windows NT/2000 systems that have Tomcat 3.2.1 installed.The vulnerability allows remote attackers to access files outside the document root directory scope. Link: http://www.net-security.org/text/bugs/986122415,77089,.shtml WINAMP 2.63 FULL DISCLOSURE EXPLOIT I have written a full disclosure buffer overflow exploit for the winamp 2.63 buffer overflow found in the M3U file parser. Attached is a file called DROPPER.M3U, if you execute the following commands in dos : COPY /B DROPPER.M3U+C:\WINDOWS\CDPLAYER.EXE HACKME.M3U when you click HACKME.M3U, the file will drop and execute the appended exe file, CDPLAYER.EXE in this case... Link: http://www.net-security.org/text/bugs/986145682,48652,.shtml INTERNET & ACCELERATION SERVER EVENT DOS If an alert action has been chosen in the ISA server console, a malicious attacker can cause a Denial of Service situation on the ISA server. Link: http://www.net-security.org/text/bugs/986229749,12002,.shtml MALWARE.COM ADVISORY: THE BAT! We are able to blind the The BAT! with trivial file extension modifications and carefully calculated file name lengths: Content-Type:image/gif; Content-Transfer-Encoding: base64 Content-Disposition: inline; filename=" what's this? v .gif.exe" vWill create an inline attachment, which, while not important will not be indicted in the in-box. What is important is that the attachment viewed once the mail message has been opened will be with the icon of something else. On two win98 machines, we achieved the icon of a folder:vv (screen shot: http://www.malware.com/guano.jpg 32KB) and the icon of the local machine hard drive. BAT! worse, when clicking the icon, the *.exe is executed without warning. The comprehensive warning for *.exe attachments is bypassed. As far as the client is concerned there is no attachment and their is no file extension, other than what we decide to give it. Link: http://www.net-security.org/text/bugs/986301594,30398,.shtml RED HAT - UPDATED OPENSSH PACKAGES Updated openssh packages are now available for Red Hat Linux 7. These packages fix an error in the supplied init script and PAM configuration file. Link: http://www.net-security.org/text/bugs/986379615,60428,.shtml RED HAT - UPDATED KERBEROS 5 PACKAGES Updated Kerberos 5 packages are now available for Red Hat Linux 7. These updates resolve a linkage problem introduced in RHSA-2001:025. Link: http://www.net-security.org/text/bugs/986379723,44012,.shtml ANOTHER PHP-NUKE VULNERABILITY There is a bug in the banner section of PHP-Nuke (http://www.phpnuke.org). In order to change the URL of the first banner you should enter in your browser the following http://target/banners.php?op=Change&bid=bannerid&url=http://where.to If we want to change the banner number 1 to redir to www.you_are_redir we write http://www.foo.com/banners.php?op=Change&bid=1&url=http://you.are.redir where www.foo.com is the server running PHP-Nuke Link: http://www.net-security.org/text/bugs/986379826,58027,.shtml ORINOCO RG-1000 WEP KEY EXPOSURE An attacker can determine the network name (SSID), and current WEP encryption key - allowing unrestricted access to the LAN. Link: http://www.net-security.org/text/bugs/986379950,66980,.shtml NAVISION FINANCIALS SERVER DOS Sending a null character followed by approx. 30k of A's to TCP port 2407 causes a buffer overflow and terminates the process (SERVER.EXE). The overflow does not appear to be exploitable. A smaller amount can also be used, and will silently kill the process. This requires approx. 10 connections starting with a null character, followed by 100+ characters. Link: http://www.net-security.org/text/bugs/986380075,16618,.shtml MS PATCH Q292108 OPENS A VULNERABILITY Last MS patch Q290108 released with the bulletin MS01-020 opens a new vulnerability. A tricked EML file can confuse the user displaying him a fake downlodaded file name. Executable files can be disguised as other supposedly inocent files (text, sound or images). Link: http://www.net-security.org/text/bugs/986470161,75358,.shtml BINTEC X4000 ACCESS ROUTER DOS A simple nmap SYN scan (nmap -sS) will cause the machine to lock up completely. It can neither be accessed through LAN nor through a serial connection or the built in, LCD-display-based MMI (man-machine-interface). The only way of getting it back to life is to pull the plug and put it back in. Link: http://www.net-security.org/text/bugs/986470239,57678,.shtml CISCO CONTENT SERVICES SWITCH VULNERABILITY The Cisco Content Services (CSS) switch product, also known as Arrowpoint, has a security vulnerability in a previous release that allows non-privileged users to escalate their privilege level, permitting them configuration ability on affected units. This vulnerability can only be exercised from a valid user account. To remove the vulnerability, Cisco is offering free software upgrades to revision 4.01B19s for all affected platforms. This defect is documented as Cisco bug ID CSCdt32570. Link: http://www.net-security.org/text/bugs/986470409,87666,.shtml DEBIAN FIXES REMOTE ROOT EXPLOIT IN NTP Przemyslaw Frasunek reported that ntp daemons such as that released with Debian GNU/Linux are vulnerable to a buffer overflow that can lead to a remote root exploit. This has been corrected for Debian 2.2 (potato) in ntp version 4.0.99g-2potato1. We recommend you upgrade your ntp package immediately. Link: http://www.net-security.org/text/bugs/986506509,167,.shtml 602PRO LAN SUITE DENIAL OF SERVICE Connect to lan suite on port 80 with telnet or somthing and send the following request. GET / HTTP/1.1 Proxy-Authorization:AAAAAAAAAAAAA..... Where A x 1033 or more characters, as long as its over 1032, it will work. Lan suite terminates, that means ALL services go with it. And YES you have to restart the program to get everything working. ALL services going again require restart of Lansuite.exe because its dead after it recieves the BAD header Link: http://www.net-security.org/text/bugs/986551102,54597,.shtml TRUSTIX - LOCAL ROOT EXPLOIT IN KERNEL Some time ago, a vulnerability was discovered that allowed for root access through ptrace call in the linux kernel. This was originally considered fixed in a previous patch, but as it turns out, it wasn't. This is fixed in kernel version 2.2.19. Link: http://www.net-security.org/text/bugs/986551308,48499,.shtml WATCHGUARD FIREBOX II KERNEL DOS This vulnerability makes it possible to force the Firebox into a condition where it stops responding to packets of a certain protocol after it has been sent large bursts of packets for that protocol. Link: http://www.net-security.org/text/bugs/986551556,48015,.shtml IMMUNIX OS - NTP AND XNTP3 UPDATE Przemyslaw Frasunek has found a buffer overflow in the ntpd package. The StackGuard protection in Immunix is effective at stopping this attack. If the published exploit is run against the Immunix version, it will cause ntpd to exit with a StackGuard detection message but no penetration vulnerability is possible. WireX is releasing updated packages to prevent the residual DoS attack. Link: http://www.net-security.org/text/bugs/986646295,76110,.shtml LINUX MANDRAKE - NTP/XNTP3 UPDATE Link: http://www.net-security.org/text/bugs/986646364,83413,.shtml ---------------------------------------------------------------------------- Security world -------------- All press releases are located at: http://net-security.org/text/press ---------------------------------------------------------------------------- SYBARI AWARDED "FIVE-STAR" RATING - [02.04.2001] Sybari Software, Inc., the premier anti-virus and security specialist for groupware solutions, announced its anti-virus solution, Antigen, has earned a five-star rating from SC Magazine. Five is the highest possible rating and indicates the importance of Sybari's anti-virus technology in delivering reliable e-mail security solutions for messaging infrastructures. SC Magazine's product reviews through its West Coast Labs are recognized globally as a prime source in providing functional measures on product effectiveness and performance. Press release: < http://www.net-security.org/text/press/986229209,98816,.shtml > ---------------------------------------------------------------------------- THE INTERNET SECURITY CONFERENCE IN JUNE - [02.04.2001] To be held June 4-8, 2001 at the Century Plaza Hotel in Los Angeles, The Internet Security Conference (TISC) offers a growing cast of the leading experts in the Internet security field. "Say TISC, and security professionals, CTOs and CIOs think quality, uncompromising education," says David Piscitello, TISC conference founder and program chairman. "We came strong out of the gate with some of the most respected security experts in the world - Radia Perlman, Stephen Kent, Tina Darmohray, and Charlie Kaufmann. As the word spreads, TISC is attracting new and rising stars of the Internet Security field to complement our already knowledgeable faculty." Press release: < http://www.net-security.org/text/press/986229300,66109,.shtml > ---------------------------------------------------------------------------- LOCKHEED MARTIN AND RIPTECH PARTNER - [02.04.2001] Lockheed Martin, a proven leader in information technology for both commercial and government clients, today announced a strategic alliance with Riptech Inc., the only provider of real-time managed security services. Through this arrangement, both commercial and government customers will benefit from a seamless offering that combines Riptech's around-the-clock managed security services with Lockheed Martin's broad engineering and consulting expertise. Press release: < http://www.net-security.org/text/press/986229334,85578,.shtml > ---------------------------------------------------------------------------- SOPHOS: TOP TN VIRUSES IN MARCH 2001 - [02.04.2001] This is the latest in a series of monthly charts counting down the ten most frequently occurring viruses as compiled by Sophos, a world leader in corporate anti-virus protection. Press release: < http://www.net-security.org/text/press/986229465,39850,.shtml > ---------------------------------------------------------------------------- SECURIFY SECURVANTAGE SERVICES ANNOUNCED - [02.04.2001] As part of its new strategic direction, Securify, Inc., a leading provider of security technologies and services for connected businesses, today introduced Securify SecurVantage Services, a managed security offering that connected organizations can use to control the quality of security as they extend their network infrastructures and applications to e-partners. By first setting baseline security metrics for "correct" network behavior and then continuously monitoring traffic, Securify SecurVantage Services offer businesses a unique way to verify the ongoing safety of their trust relationships with partners, suppliers and customers - as well as the safety of their Intranet - as they communicate and share critical business information. Press release: < http://www.net-security.org/text/press/986229615,14193,.shtml > ---------------------------------------------------------------------------- RSA HELPING GOVERNMENT CUSTOMERS - [03.04.2001] RSA Security Inc. announced that WareOnEarth Communications, Inc., a leading provider of network security and "Trusted Information Exchange" solutions, has licensed RSA BSAFE Cert-C and RSA BSAFE Cert-J security software. The company has incorporated this software into its Hypership peer-to-peer transport technology, which helps enable trusted information exchange over the Internet. Hypership relies on RSA Security software to help provide a complete public key infrastructure (PKI) solution - including authentication of senders and receivers, data security in transit and at rest, and binding non-repudiation. As a result, WareOnEarth is able to offer its government customers the security they require to leverage the speed and cost advantages of electronic delivery. Press release: < http://www.net-security.org/text/press/986299842,19253,.shtml > ---------------------------------------------------------------------------- AUTHENTIFY PROTECTS AGAINST INTERNET FRAUD - [0.04.2001] Authentify, Inc., an emerging provider of Internet identity solutions, introduced a first-of-its-kind product, Authentify|Register. The company also announced that leading middleware provider mVPN, LLC has integrated Authentify|Register into its mPKI Platform. The integration enables mVPN to provide a crucial layer of security for its e-business customers by providing them an enhanced process for the secure deployment of digital certificates. Press release: < http://www.net-security.org/text/press/986299926,82090,.shtml > ---------------------------------------------------------------------------- INTERNET GUARD DOG CAPTURES HIGHEST MARKS - [03.04.2001] McAfee Consumer Products Division, a business unit of Network Associates, Inc. announced that its Internet Guard Dog software was named Best Filtering Software by Family PC Magazine. Awarded the only "A" grade in a competitive roundup that included CyberPatrol, CyberSitter, NetNanny and SOS Kid Proof, Internet Guard Dog software was deemed "your child's best online friend," earning the highest marks for its easy installation and set-up. Press release: < http://www.net-security.org/text/press/986300214,22309,.shtml > ---------------------------------------------------------------------------- F-SECURE AND TELIA ANTIVIRUS DEPLOYMENT - [03.04.2001] F-Secure Corporation and the Swedish Telia e-bolaget AB in Sweden have signed a cooperation contract. The collaboration will offer a managed anti virus solution to consumers and the small-to-medium businesses. F-Secure Anti-Virus is a component in Telia's service Telia Antivirus. F-Secure Anti Virus provides simple and reliable protection against viruses, e-mail worms and malicious code. F-Secure Anti-Virus with service specifications by Telia, is targeted for Telia's Internet and broadband customers. The service has been available since March 19. Press release: < http://www.net-security.org/text/press/986301407,76377,.shtml > ---------------------------------------------------------------------------- CRYPTOSWIFT 400 ECOMMERCE ACCELERATOR OUT - [04.04.2001] iVEA Technologies, a Rainbow Technologies company and a leading provider of Internet and eCommerce security solutions, debuted the CryptoSwift 400, a new 400 transaction-per-second (TPS) PCI-based eCommerce accelerator that sets a new standard for entry-level cryptographic acceleration for fast, secure online transactions and Web-server performance enhancement. The CryptoSwift 400 optimizes Web-server performance without sacrificing the rapid acceleration of complex and robust encryption processes for today's high-capacity eCommerce Web servers. The new entry-level CryptoSwift 400 allows eCommerce Web sites to handle substantially more traffic, securely, with virtually no end-user waiting. Press release: < http://www.net-security.org/text/press/986381125,42907,.shtml > ---------------------------------------------------------------------------- CRYPTOSWIFT EN-2000 ECOMMERCE ACCELERATOR OUT - [04.04.2001] iVEA Technologies, a Rainbow Technologies company and a leading provider of Internet and eCommerce security solutions, today introduced the CryptoSwift EN-2000, the industry's fastest stand-alone SSL acceleration appliance designed for large business-to-business Web-server farms or high-end data centers when SSL acceleration is shared across multiple servers. The EN-2000 provides up to 2,000 transactions per second (TPS) performance, making it the fastest available SSL acceleration appliance on the market today. The CryptoSwift EN-2000's 100BaseT Ethernet rack-mountable appliance form factor permits high performance security acceleration to scale to a network of servers without consuming additional PCI slots. The EN-2000 offers twice the processing power of the first-generation EN-1000 accelerator and can easily be integrated into all popular server platforms including iPlanet Web Server, Apache, and Microsoft IIS. The large capacity provided by this processing power allows the EN-2000 to scale with the needs of today's ever-growing IT infrastructures. Like other members of iVEA's CryptoSwift family, the EN-2000 works with existing secure Web-server resources and makes an organization's Web server infrastructure investment last longer. Press release: < http://www.net-security.org/text/press/986381216,40945,.shtml > ---------------------------------------------------------------------------- DETECT COMPUTER ABUSE WITH BOSS EVERYWARE - [04.04.2001] Alexander Jmerik has released Boss Everyware v. 2.2, a powerful Windows security program that secretly records data about how your computer is being used. Boss Everyware keeps a log of which programs each user has run, and how much time they've spent on them. In addition, it records all of the users' keystrokes, allowing the computer owner or network administrator to answer questions about what correspondence is being created. Boss Everyware makes it easy to answer questions about what new software has been installed, and what specific web sites are being visited. Press release: < http://www.net-security.org/text/press/986381324,34086,.shtml > ---------------------------------------------------------------------------- FORENSICS EXPLORERS INTRODUCES NETWITNESS - [04.04.2001] Forensics Explorers introduces NetWitness, a suite of products that go far beyond other network security systems and solves problems most network security software cannot even detect. In addition, NetWitness is the only network security system that can guard against the most dangerous and difficult to detect threats: threats from an organization�s trusted employees, clients and strategic partners, the people who operate behind the firewall. Press release: < http://www.net-security.org/text/press/986400826,81864,.shtml > ---------------------------------------------------------------------------- LOCKHEED MARTIN SPONSORS BIOMETRIC TESTING - [05.04.2001] Lockheed Martin announced that it is an official sponsor of International Biometric Group's Comparative Biometric Testing. IBG's Comparative Biometric Testing is the de facto industry standard for evaluating the accuracy of leading biometric technologies. Round Three of Testing, to commence later this month, will address the following technical and marketing questions regarding biometrics: How do finger-scan, iris-scan, facial-scan and voice scan technologies compare in terms of accuracy? Within a given technology field, which vendors have the most effective technology? What are the exact accuracy rates that can be expected when applications are rolled out in the field? How easy are biometrics to use? Press release: < http://www.net-security.org/text/press/986483731,80761,.shtml > ---------------------------------------------------------------------------- NEW SSL AND PKI ENABLED SECURITY PRODUCTS - [05.04.2001] Andes Networks, a leading provider of next generation SSL acceleration systems and Chrysalis-ITS, the worldwide leader in the field of high security key protection in PKI, today announced the introduction of a new class of security products for both SSL and PKI enabled security on the Internet. Through the combination of Andes Networks Packetized SSL acceleration technology and FIPS 140-1 validated Ultimate Trust(TM) secure key management technology from Chrysalis-ITS, the companies plan to unveil joint product offerings that will dramatically increase the level of security and scalability associated with delivery of information over the Internet. Press release: < http://www.net-security.org/text/press/986483838,66032,.shtml > ---------------------------------------------------------------------------- EDS LAUNCHES CYBER SECURITY INSTITUTE - [05.04.2001] Continuing its fight against the rising tide of cyber crime, EDS launched its Cyber Security Institute (CSI) - a computer security curriculum to arm IT professionals and consumers with skills to battle hackers, security breaches and viruses. EDS launched the CSI for internal use at COMDEX Fall 2000 in November 2000. As of today, companies and consumers can access the CSI's interactive, on-demand, globally-available courseware. It offers a cost-effective method for training in critical security topics such as secure system administration, firewalls, network security, risk assessment, incident handling and response, threats, vulnerabilities and countermeasures. Press release: < http://www.net-security.org/text/press/986484228,80978,.shtml > ---------------------------------------------------------------------------- SOPHOS SHOWS MINISTER ABOUT VIRUS RISKS - [05.04.2001] Paddy Tipping, Parliamentary Secretary to the Privy Council Office, visited the Abingdon HQ of Sophos Anti-Virus, a world leader in corporate anti-virus protection. The minister used the visit to discuss the needs of fast-growing, hi-tech businesses such as Sophos and to benefit from advice on how organisations can protect against computer viruses. In his role in the Government's Business Coordination Unit, Mr Tipping regularly visits both small and large businesses to discuss their needs and what they feel is required from the Government. As part of the Government's initiative for all UK businesses to be online by 2005, Mr Tipping is keen to listen to the viewpoints of organisations such as Sophos. Press release: < http://www.net-security.org/text/press/986505498,96592,.shtml > ---------------------------------------------------------------------------- BIOMETRIC SINGLE SIGN-ON DEMONSTRATION - [06.04.2001] SAFLINK Corporation, a leading provider of biometric software solutions, and a Computer Associates (CA) Development Partner and Novell Industry Partner, will be attending the upcoming RSA Security Conference to support its partners' presentations of biometric solutions for the enterprise market. The Conference will be held April 8-12 at San Francisco's Moscone Center. Press release: < http://www.net-security.org/text/press/986509672,97322,.shtml > ---------------------------------------------------------------------------- VERISIGN CEO TO SPEAK AT RSA 2001 CONFERENCE - [06.04.2001] Stratton Sclavos will offer a visionary perspective on digital identity and the Internet's central role as an easily accessed, universal locator and repository of personal information. Attendees will walk away with a better understanding on the latest technologies available to deliver robust methods of seamless authentication and trusted transactions on the Internet. Press release: < http://www.net-security.org/text/press/986509820,60827,.shtml > ---------------------------------------------------------------------------- AUTHENTIFY TEAMS WITH RSA SECURITY - [06.04.2001] Authentify, Inc., an emerging provider of Internet identity solutions, announced it has joined the RSA Secured(TM) Partner Program to support interoperability between Authentify|Register service and RSA Keon PKI software. Authentify|Register delivers real-time authentication of a user's identity during the online registration process. By synchronizing an Internet session with an automated telephone call to the end user, Authentify|Register provides an added level of security to the RSA Keon OneStep(TM) registration process by utilizing the world's most widely deployed infrastructure, the telephone network. The Authentify|Register process is highly scalable and provides an enhanced audit trail for increased security. The automation provided by Authentify|Register reduces costs and eliminates the risk of human error or omission. Authentify's customizable application provides two-factor authentication and, integrated with RSA Keon OneStep, it allows an organization to quickly, securely and cost-effectively deploy digital certificates. Press release: < http://www.net-security.org/text/press/986509886,31224,.shtml > ---------------------------------------------------------------------------- TREND MICRO'S OFFERS OUTLOOK ON VIRUS INDUSTRY - [06.04.2001] David Perry, global director of education for Trend Micro, Inc., a worldwide leader in network antivirus and Internet content security solutions, will be a featured speaker at the RSA Conference held at San Francisco's Moscone Center. This e-Security Expo will be held April 8-12 and will address the latest issues surrounding current implementations of enterprise security and secure electronic commerce. Perry will be speaking on April 12, at 11 a.m. Given the recent onslaught of viruses, Perry will provide attendees with an analysis of significant malicious code exploits seen thus far in 2001. In addition, Perry will touch on the newest challenges to the security industry, viruses for broadband and wireless, as well as a discussion of the specific solutions that are currently in place to combat these threats. Perry will round out the presentation with suggestions for how to best combat the myths, hypes, hoaxes, and common misperceptions surrounding viruses. Press release: < http://www.net-security.org/text/press/986562195,19617,.shtml > ---------------------------------------------------------------------------- NETWORK ICE DE-ROBES LATEST CLOAKING HACK - [06.04.2001] Network ICE, a leading provider of consumer and corporate intrusion detection systems, has warned users to be wary of a cloaking technique, known as polymorphic coding, designed to disguise buffer overflow code. The camouflage code was revealed at the recent CanSecWest conference in Vancouver, British Columbia by a hacker going by the alias 'K2'. This cloaking technique allows intruders to evade network-based intrusion detection system (IDS's). This is an important development because it means while IDSs may detect the common 'script kiddies', they are useless against the serious, expert hacker. Press release: < http://www.net-security.org/text/press/986562666,36028,.shtml > ---------------------------------------------------------------------------- SECUNET SECURITY NETWORKS OPENS SECULAB - [06.04.2001] Germany's secunet Security Networks AG, one of Europe's leading IT security service companies, announced its entry into the U.S. market with the opening of Seculab, Inc., headquartered in Austin, Texas. Seculab is one of only five Common Criteria testing labs in the United States accredited by the National Security Agency (NSA) and National Institute for Standards and Technology (NIST). Seculab is the world's only Common Criteria lab accredited in both the United States and Europe. In addition to Common Criteria testing, Seculab provides IT security consulting services and has access to secunet's global network of security experts. Seculab offers client companies services that include security audits, vulnerability assessments and PKI consulting and implementation. Press release: < http://www.net-security.org/text/press/986570488,96969,.shtml > ---------------------------------------------------------------------------- MASTERING THE ART OF NETWORKED SECURITY SEMINARS - [06.04.2001] Rainfinity, the provider of continuous availability software for business transactions over the Internet, in conjunction with Check Point Software, Compaq Computer Corporation, NetIQ and Trend Micro Inc., launched a seminar series entitled 'Mastering the Art of Networked Security.' The focus of the seminar series is to help IT managers learn how to create a more secure enterprise by integrating high availability and security best practices within their server and network infrastructures. The first seminar will take place on April 17, 2001, in Washington, D.C. at the American Institute of Architects. Other seminars will follow throughout April and May 2001 at museums and cultural venues in locations across North America. Press release: < http://www.net-security.org/text/press/986570605,2425,.shtml > ---------------------------------------------------------------------------- Featured article ---------------- All articles are located at: http://www.net-security.org/text/articles Articles can be contributed to staff@net-security.org ---------------------------------------------------------------------------- ISSUES: "SAVE A BUG, SAFE A LIFE?" by Thejian Above exchange, from the novel "Hogfather" by Terry Pratchett, holds quite an accurate description of what hacking is, or at least of the ideal of what hacking should be. That is, to me personally, because one of the things coherent with the scene where this practice thrives is the many different clashing opinions and ideas. You may "smash the stack" for fun, for profit, or maybe just because you�re a vicious lil� bugger with too much time on his hands, but the ideal most people have concerning what a hacker is, is someone who opens stuff up to find out the why and the how. Read more: < http://www.net-security.org/text/articles/thejian/bug.shtml > ---------------------------------------------------------------------------- Security Software ------------------- All programs are located at: http://net-security.org/various/software ---------------------------------------------------------------------------- INTRUDER PROTECTION 1.0 Intruder Protection is a program to keep anyone you dont want on your computer off. Whenever the computer is started it will ask for a password before windows starts. If you do not know the password you can not get into the computer. The default password is 0000 you will need to change this to something that you want. Info/Download: < http://www.net-security.org/various/software/986746031,94910,windows.shtml > ---------------------------------------------------------------------------- SYGATE PERSONAL FIREWALL 4.0 Sygate Personal Firewall is a bi-directional intrusion defense system for your personal computer. It ensures that your computer is protected from hackers and other intruders while preventing unauthorized programs on your computer from accessing the network. Sygate Personal Firewall makes machines invisible to the outside world. It works on computers connected to a private network or the Internet. This program assures that your business, personal, financial and other data is safe and secure. This version includes advanced active-scan vulnerability assessment to pinpoint your every weakness and fine-tune your security policy. Info/Download: < http://www.net-security.org/various/software/986746226,47831,windows.shtml > ---------------------------------------------------------------------------- FREEVSD 1.4.7 FreeVSD facilitates true Linux Virtual Servers within a 'chroot' environment, allowing Web servers and other applications to be deployed and administered discretely, without compromise to security. Each Virtual Server has its own IP address(es), Apache webserver, and view of the process table. FreeVSD expands the Linux system by creating a pseudo-'super user' (admin) for each Virtual Server. The admin user has the ability to create extra POP3/FTP and Telnet users and also administrate vital services such as the webserver. Info/Download: < http://www.net-security.org/various/software/986746661,92183,linux.shtml > ---------------------------------------------------------------------------- PROCWATCH Procwatch is a perl script which watches a /proc filesystem for new processes. When a process is created, procwatch reports the time, the username, the PID, and the binary that was run. Its output is suitable for logging to log files and is geared for system administrators who are testing a new but as yet untrusted UNIX system. Although it cannot detect, and is not proof against, hacked loadable kernel modules that have modified /proc, it is useful in watching for possible rogue binaries. Info/Download: < http://www.net-security.org/various/software/986302285,89785,linux.shtml > ---------------------------------------------------------------------------- REMOTE NMAP 0.5.2 BETA Remote Nmap is a python client/server package which allows many authorized clients to connect to a centralized nmap server to do their port scanning. This could be useful for security companies who want to have all their scans come from a dedicated machine. Info/Download: < http://www.net-security.org/various/software/986746439,36162,linux.shtml > ---------------------------------------------------------------------------- Defaced archives ------------------------ [02.04.2001] Original: http://www.efdpac.navfac.navy.mil/ Defaced: http://defaced.alldas.de/mirror/2001/04/02/www.efdpac.navfac.navy.mil/ OS: Windows Original: http://www.toshiba.cz/ Defaced: http://defaced.alldas.de/mirror/2001/04/02/www.toshiba.cz/ OS: IRIX Original: http://www.volvo.fr/ Defaced: http://defaced.alldas.de/mirror/2001/04/02/www.volvo.fr/ OS: Unknown Original: http://www.martini.nl/ Defaced: http://defaced.alldas.de/mirror/2001/04/02/www.martini.nl/ OS: Unknown Original: http://route.opel.com/ Defaced: http://defaced.alldas.de/mirror/2001/04/02/route.opel.com/ OS: Windows Original: http://www.opelhaendler.de/ Defaced: http://defaced.alldas.de/mirror/2001/04/02/www.opelhaendler.de/ OS: Windows Original: http://www.canon.co.nz/ Defaced: http://defaced.alldas.de/mirror/2001/04/02/www.canon.co.nz/ OS: Windows Original: http://www.macromedia.cl/ Defaced: http://defaced.alldas.de/mirror/2001/04/02/www.macromedia.cl/ OS: Unknown Original: http://www.goodyearmotors.net/ Defaced: http://defaced.alldas.de/mirror/2001/04/02/www.goodyearmotors.net/ OS: Windows Original: http://www.goodyear.se/ Defaced: http://defaced.alldas.de/mirror/2001/04/02/www.goodyear.se/ OS: Windows Original: http://webwatch.wsj.com/ Defaced: http://defaced.alldas.de/mirror/2001/04/02/webwatch.wsj.com/ OS: Windows Original: http://www2.disney.go.com/ Defaced: http://defaced.alldas.de/mirror/2001/04/02/www2.disney.go.com/ OS: Windows Original: http://www.toyota-esbjerg.dk/ Defaced: http://defaced.alldas.de/mirror/2001/04/02/www.toyota-esbjerg.dk/ OS: Windows [03.04.2001] Original: http://www.hyundai.co.za/ Defaced: http://defaced.alldas.de/mirror/2001/04/03/www.hyundai.co.za/ OS: Windows Original: http://www.btworldwide.com/ Defaced: http://defaced.alldas.de/mirror/2001/04/03/www.btworldwide.com/ OS: Windows Original: http://www.toyota-ghana.com/ Defaced: http://defaced.alldas.de/mirror/2001/04/03/www.toyota-ghana.com/ OS: Windows Original: http://www.toyota-ep.co.jp/ Defaced: http://defaced.alldas.de/mirror/2001/04/03/www.toyota-ep.co.jp/ OS: Unknown Original: http://thestore.sonymusic.com/ Defaced: http://defaced.alldas.de/mirror/2001/04/03/thestore.sonymusic.com/ OS: Unknown Original: http://www.ace.bridgestone.co.jp/ Defaced: http://defaced.alldas.de/mirror/2001/04/03/www.ace.bridgestone.co.jp/ OS: Windows Original: http://cfdev.wwf.com/ Defaced: http://defaced.alldas.de/mirror/2001/04/03/cfdev.wwf.com/ OS: Windows [04.04.2001] Original: http://www.mitsubishi-engine.com/ Defaced: http://defaced.alldas.de/mirror/2001/04/04/www.mitsubishi-engine.com/ OS: Windows Original: http://www.mitsubishi-electric.it/ Defaced: http://defaced.alldas.de/mirror/2001/04/04/www.mitsubishi-electric.it/ OS: Windows Original: http://3mdweb.3com.com/ Defaced: http://defaced.alldas.de/mirror/2001/04/04/3mdweb.3com.com/ OS: Windows Original: http://www.delphi.fi/ Defaced: http://defaced.alldas.de/mirror/2001/04/04/www.delphi.fi/ OS: Windows Original: http://www.visa.de/ Defaced: http://defaced.alldas.de/mirror/2001/04/04/www.visa.de/ OS: Windows [05.04.2001] Original: http://restaurantrow.lycos.com/ Defaced: http://defaced.alldas.de/mirror/2001/04/05/restaurantrow.lycos.com/ OS: Windows Original: http://www.activebuyersguide.looksmart.com/ Defaced: http://defaced.alldas.de/mirror/2001/04/05/www.activebuyersguide.looksmart.com/ OS: Windows Original: http://www.compaq-novell.com/ Defaced: http://defaced.alldas.de/mirror/2001/04/05/www.compaq-novell.com/ OS: Windows Original: http://www.compaq-ontraq.com/ Defaced: http://defaced.alldas.de/mirror/2001/04/05/www.compaq-ontraq.com/ OS: Windows Original: http://www.polizei.co.at/ Defaced: http://defaced.alldas.de/mirror/2001/04/05/www.polizei.co.at/ OS: Unknown [06.04.2001] Original: http://www.packardbell.com.my/ Defaced: http://defaced.alldas.de/mirror/2001/04/06/www.packardbell.com.my/ OS: Windows Original: http://www.xerox.com.cn/ Defaced: http://defaced.alldas.de/mirror/2001/04/06/www.xerox.com.cn/ OS: Windows Original: http://www.compaq-signup.com/ Defaced: http://defaced.alldas.de/mirror/2001/04/06/www.compaq-signup.com/ OS: Windows Original: http://www.compaq-pshk.com/ Defaced: http://defaced.alldas.de/mirror/2001/04/06/www.compaq-pshk.com/ OS: Windows [07.04.2001] Original: http://www.sony-center.ch/ Defaced: http://defaced.alldas.de/mirror/2001/04/07/www.sony-center.ch/ OS: Windows Original: http://www.quiksilver.com/ Defaced: http://defaced.alldas.de/mirror/2001/04/07/www.quiksilver.com/ OS: Windows Original: http://www.bc.gov.cu/ Defaced: http://defaced.alldas.de/mirror/2001/04/07/www.bc.gov.cu/ OS: Unknown [08.04.2001] Original: http://www.casio.co.id/ Defaced: http://defaced.alldas.de/mirror/2001/04/08/www.casio.co.id/ OS: Windows Original: http://3comleads.3com.com/ Defaced: http://defaced.alldas.de/mirror/2001/04/08/3comleads.3com.com/ OS: Windows Original: http://www.shell.se/ Defaced: http://defaced.alldas.de/mirror/2001/04/08/www.shell.se/ OS: Windows Original: http://www.sony-center.ch/ (Redefacement) Defaced: http://defaced.alldas.de/mirror/2001/04/08/www.sony-center.ch/ OS: Windows ---------------------------------------------------------------------------- Questions, contributions, comments or ideas go to: Help Net Security staff staff@net-security.org http://net-security.org http://security-db.com