💾 Archived View for clemat.is › saccophore › library › ezines › textfiles › ezines › HNS › issue061.… captured on 2021-12-03 at 14:04:38.
-=-=-=-=-=-=-
HNS Newsletter Issue 61 - 30.04.2001 http://net-security.org http://security-db.com This is a newsletter delivered to you by Help Net Security. It covers weekly roundups of security events that were in the news the past week. Visit Help Net Security for the latest security news - http://www.net-security.org. Subscribe to this weekly digest on: http://www.net-security.org/text/newsletter Archive of the newsletter in TXT and PDF format is available here: http://www.net-security.org/news/archive/newsletter Current subscriber count to this digest: 2284 Table of contents: 1) General security news 2) Security issues 3) Security world 4) Featured products 5) Featured article 6) Security software 7) Defaced archives ======================================================== Secure Exchange 2000 against email attacks/viruses! ======================================================== GFI�s Mail essentials for Exchange 2000 is now available! It can protect Exchange 2000 from all kinds of email-borne threats, like viruses, dangerous attachments, email attacks, spam and offensive content. Download your evaluation copy from: http://www.gfi.com/secdblanmesnl.shtml ======================================================== General security news --------------------- ---------------------------------------------------------------------------- IMPROVING OUR NETWORK KNOWLEDGE TO DEFEAT HACKERS The most serious vulnerabilities are software or application bugs. Network insecurities are generally less important because they do not permit to gain privileges on systems under attack. However, an internet hacker has to use the network to reach vulnerable systems. So, a good network configuration can complicate or prevent an intrusion, by forbidding access to vulnerable systems. Link: http://www.linuxguru.com/stories.php?story=107 PITBULL LX REVIEW PitBull LX is the Linux version of Argus's Solaris- and AIX-based security software. Unlike firewalls that are primarily meant to prevent intrusion into your server but can allow access once they've been circumvented, PitBull LX's job is to deny someone access, no matter how they've intruded, even if they're logged in over the network as a super user. It does this by allowing you to create segregated access domains that isolate subsystems and processes from each other. You can then assign similar--or different--access rules to any or all of the domains you've created. If an intruder is detected, PitBull LX traps the intruder in the affected domain, leaving the remainder of your server otherwise untouched. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://linux.cnet.com/linux/0-2136888-7-5641577.html TOTEM AND TABOO IN CYBERSPACE Cyberspace, the realm of computer networks, voice mail and long-distance telephone calls, is increasingly important in our lives. Unfortunately, morally immature phreaks, cyberpunks and criminal hackers are spoiling it for everyone. Security professionals must speak out in the wider community and change the moral universe to include cyberspace. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://securityportal.com/kfiles/files/totemtaboo.html A COMPARISON OF IPTABLES AUTOMATION TOOLS Over the past several years, the use of Linux as a firewall platform has grown significantly. Linux firewalling code has come a long way since the time ipfwadm was introduced in kernel 1.2. This discussion will look at IP firewalling code in Linux kernel and its configuration via various interfaces such as GUIs or scripts (written in shell scripting language, Perl or special configuration language). Specifically, this article will offer a brief overview of the means of configuring iptables, and will offer a brief review of some tools that have been developed to automate the configuration of iptables. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.securityfocus.com/focus/linux/articles/iptables.html LAW NOT ON SIDE OF AMERITECH HACKER Earlier this month when a computer hacker accessed information about customers' phone bills from Ameritech's Web site, he publicized the security breach and was sued by the SBC Communications Inc. A federal judge then issued a temporary injunction, effectively shutting down the site. The hacker, Keith Kimmel, vows to be in court later this week to fight the shutdown of his site but the law may go against him, says the security director of a local technology services firm. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://chicagotribune.com/tech/news/article/0,2669,ART-51332,FF.html SDMI CRACKS REVEALED The academic cracker crew led by Princeton University Computer Science Professor Edward Felten, which answered the HackSDMI public challenge of last September with 'unqualified' results, has received veiled threats of criminal prosecution under the Digital Millennium Copyright Act from the SDMI Foundation in hopes that the team will be cowed into withholding what it's learned from an upcoming computer science conference... Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.theregister.co.uk/content/8/18434.html ARGUS PITBULL LOSES, BUT BLAMES OS Last Stage of Delirium (LSD) are the winners of the 5th Argus Hacking Challenge. As Argus Systems noted "LSD is an extraordinarily talented and professional group from Poland, and they commend them for their dedicated effort in analyzing and attacking the system. They didn't find a vulnerability in Pitbull suite that secured the server but in the Solaris x86 base operating system (exploits were added on their site). Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.argus-systems.com/events/infosec/ Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.wired.com/news/technology/0,1282,43234,00.html DDOS ATTACKS CARRY ON IN CROATIA We lost our nervs today, when Distributed Denial of Service attacks again hit Croatian largest Internet Service Provider, which by the way has a monopoly on telecommunication infrastructure and outside links from Croatia. We were just one part of about 90% of Internet users in Croatia which use HThinet and Iskon Internet for connecting on-line. According to the press release we got, police was contacted and maybe even Interpol will come in to the game of finding and sentencing the attackers. Link: (in Croatian) http://www.net-security.org/cgi-bin/news.cgi?url=http://www.hinet.hr/info-obav-sisadmin.html FBI NABS RUSSIAN HACKERS Two Russians were indicted on computer-crime charges stemming from a rash of intrusions into the networks of banks, Internet service providers and other companies. The two alleged network intruders, identified as 20-year-old Alexey Ivanov and 25-year-old Vasiliy Gorshkov, were indicted earlier this month on counts of conspiracy, wire fraud and violations of the Computer Crime and Abuse Act, said Assistant U.S. Attorney Stephen Schroeder. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.zdnet.com/zdnn/stories/news/0,4586,5081599,00.html TELECOMMUNICATIONS AND INFORMATION SECURITY WORKSHOP This web site contains the presentations of a Telecommunications and Information Security Workshop with the University of Tulsa, NIST, and NSA September 27-28 2000, in Tulsa, Oklahoma. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.ntia.doc.gov/osmhome/cip/workshop/ MOD CLAIMS E-MAIL VIRUS BREAKTHROUGH The Ministry of Defence claims it has developed a tool that could mark the end of the e-mail virus. Officials say the answer lies in simple software developed to protect highly sensitive government documents and computer systems. The system turns the premise of conventional anti-virus security on its head by preventing viruses from spreading once they have infected a computer. MoD software team leader Simon Wiseman said the Ministry's focus on protecting confidential information enabled them to arrive at an innovative way of tackling the problem. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.ananova.com/news/story/sm_270384.html BT'S SECURITY SAVAGED AFTER RECENT GLITCH BT has taken another broadside from security professionals only days after a glitch on its website compromised customer details. According to UK-based security firm MIS, BT's website is still insecure and the telecoms giant has been accused of being "naive" in its attitude to security. Paul Rogers, network security analyst at MIS, said that although BT has fixed the problem, which left customer details vulnerable on Friday, it is still possible to view other customers details if you have certain information. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.vnunet.com/News/1120939 FIREWALLS, VPNS, AND REMOTE OFFICES "This month I will look at what we might call "best practices" for internetworking remote offices. It is arguably an old topic - we've been connecting remote offices over Virtual Private Networks (VPNs) for a few years now. It is one of the main purposes for VPNs, second only to secure dial-in connections. And yet, I think most of us do it wrong. I want to suggest a way to do it better. (So maybe I'm addressing better practices.) I will do this by referring to how we did it wrong in my last job, and in retrospect, how we should have done it." Link: http://www.avolio.com/columns/fwvpns+remote.html CURADOR'S VICTIMS INCLUDED 'BILL J. CLINTON' Raphael Gray, the Welsh computer attacker who is awaiting sentencing for a string of online shopping site break-ins, counts Bill Gates among his victims. But an investigation by InternetNews has revealed that Microsoft's chairman is not the only high-profile name among the thousands of credit card records Gray stole during a hacking spree last year. Former US President William "Bill" J. Clinton and political commentator and reformed party candidate Patrick "Pat" J. Buchanan were also among the names of victims listed in a customer database Gray lifted from Salesgate.com, a Buffalo, NY-based ecommerce provider. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.internetnews.com/wd-news/article/0,,10_751441,00.html EUROS CONTINUE ECHELON PROBE A European Parliament committee studying U.S. surveillance technology Echelon is about to take a field trip to the National Security Agency. Members of the 33 person committee charged with investigating the U.S. government's surveillance apparatus are planning a series of meetings in the nation's capital next month in hopes of learning more about Echelon. In addition to a scheduled visit to the NSA's high-security campus in Fort Meade, Maryland, the group will meet with the House Intelligence Committee, which held a hearing on Echelon in April 2000. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.wired.com/news/privacy/0,1848,43270,00.html MANAGING OUTGOING VIRUSES "Every once in a while, I see some new security development that really sets me on edge. The latest one is courtesy of DERA (Defense Evaluation and Research Agency), an agency of the MoD (Ministry of Defense) in Britain. Like many agencies that deal with computer security, they periodically come out publically with some new idea or product that solves a popular problem." Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://securityportal.com/articles/outgoingviruses20010424.html PASSIVE ANALYSIS OF SSH TRAFFIC It's widely known that applications like telnet, rsh, and rlogin are vulnerable to attacks that can monitor or "sniff" network traffic and obtain login passwords or other data sent over unencrypted connections. Protocols like SSH have been assumed to be safe even if an attack does monitor network traffic, because thetransmitted data is encrypted. Unfortunately, this is no longer the case, according to an advisory that was sent out by the Openwall Project and that discusses weaknesses in the SSH-1 and SSH-2 protocols. Although attackers may not be able to "read" transmitted data sent in a Secure Shell session, it's possible that they could guess the length of passwords and shell commands. The captured data could be used to try brute-force attacks on passwords. It should be noted, however, that it is still preferable to utilize encrypted protocols. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.unixreview.com/articles/2001/0104/0104i/0104i.htm MORE ON DDOS ATTACKS IN CROATIA After 3 days and 8 attacks of which 2 were heavy, the Croatian newspaper Vecernji List claims it knows who is behind the attacks. Apparently the people responsible are two Croatians backed up by people from another country. The person who spoke with the journalist said that the attacks are the answer to the monopoly of HThinet in Croatia. It is unknown why they attack Iskon on the other hand, since Iskon is the biggest ISP that's fighting HThinet for a place on the market despite it's unadvantaged status. Natasa Glavor of the Croatian CERT said that the analysis provided information that most of the attacks came from Korea, but she also said that this information can be faked. In the last couple of weeks many attacks from Korea have been reported on the Incidents mailing list by SecurityFocus. Is this coming from Korea too or is it faked on purpose? Link: (in Croatian) http://www.net-security.org/cgi-bin/news.cgi?url=http://www.vecernji-list.hr/2001/04/25/Pages/PLUS-NAJ.html HANDS OFF MY PC! "A maniacal army from Alabama is attacking my home computer and trying to seize control of it. I know that sounds a little paranoid, but it�s true. And your computer could be next. Let me explain." Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.onmagazine.com/on-mag/reviews/article/0,9985,107351,00.html HOW TO SECURE INSTANT MESSAGING Instant messaging is popular and convenient. You can get a quick yes or no from a colleague without even leaving your desk. But, unfortunately, convenience has its price. An innocent chat with a co-worker using your favorite instant messaging software could expose you to eavesdroppers or make it possible for someone to send you malicious code. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.msnbc.com/news/564171.asp PROTECT YOURSELF WITH SUNSCREEN LITE "Traditionally, firewalls have been used to protect an organization from its own Internet connection. However, evidence suggests that information misuse is more commonly caused by internal employees rather than external hackers. While there are many possible ways to secure a workstation from internal abuse, deploying firewalls on them has recently become more commonplace, especially with the advent of high-speed DSL or cable modem connections causing customers to consider firewalls a personal security device. In this article, we'll explain Sun Microsystems' SunScreen Lite product and provide an example of s ecuring a workstation in a corporate network. This is accomplished by defining security rules as shown in Figure A. In this article we'll show you how to set SunScreen Lite up to maximize your workstation protection." Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.elementkjournals.com/sun/0105/sun0151.htm U.S., OTHERS BEGIN ANTI-FRAUD DATABASE The United States and 12 other countries will start sharing confidential data about the complaints they receive from consumers in a bid to crack down on cross-border Internet fraud, the Federal Trade Commission said on Tuesday. The FTC voted unanimously to begin pooling its U.S. complaints with those from other countries to create a single database, something it said "will greatly improve international law enforcement agencies' ability to address cross-border Internet fraud and deception." Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.zdnet.com/zdnn/stories/newsbursts/0,7407,2712132,00.html OPENSSL-0.9.6A WITH SECURITY FIXES OpenSSL-0.9.6a appears to have been released somewhat quietly, and also appears to include several security fixes: - Security fix: change behavior of OpenSSL to avoid using environment variables when running as root. - Security fix: check the result of RSA-CRT to reduce the possibility of deducing the private key from an incorrectly calculated signature. - Security fix: prevent Bleichenbacher's DSA attack. - Security fix: Zero the premaster secret after deriving the master secret in DH ciphersuites. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.openssl.org/news/announce.html DENIAL-OF-SERVICE TOOL VARIANT "The CERT/CC has received reports that a distributed denial-of-service (DDoS) tool named Carko is being installed on compromised hosts. Based on our analysis, Carko is a minor variant of stacheldraht, a widely used DDoS tool. The source code for Carko is almost identical to the source code for stacheldraht. As a result, there is no additional functionality in this tool. Based on reports to the CERT/CC, intruders are using the snmpXdmid vulnerability described in the following document to compromise hosts and then install Carko." Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.cert.org/incident_notes/IN-2001-04.html WIN2K IS EVEN EASIER TO DEFACE THAN NT Firms upgrading their computer systems to the Windows 2000 operating systems from NT 4 are exposing themselves to greater security risks from Web site defacement. Records kept by security site Attrition.org indicate that an average of 55 per cent of Web site defacements so far this year are linked to exploitation of Windows NT operating systems vulnerabilities. Linux is the second most commonly hacked Web server and accounted for around 21 per cent of Web page defacement last month. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.theregister.co.uk/content/8/18515.html SECURITY THROUGH CENSORSHIP Researchers who exposed the shortcomings of a security system to protect music on the net are being asked to tell no-one about their findings. This week a group of academics is poised to go public with research which shows music industry efforts to make digital music pirate proof are doomed. But the music industry is threatening legal action to gag the group and stop their findings being widely distributed. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://news.bbc.co.uk/hi/english/sci/tech/newsid_1296000/1296384.stm DTI REPORT HIGHLIGHTS SECURITY FAILINGS Around 60 per cent of UK businesses have suffered a security breach over the last two years, according to the latest survey from the Department of Trade and Industry (DTI). Published this week in conjunction with the Infosec security conference, the Information Security Breaches Survey 2000 worryingly revealed that over 30 per cent of the 1000 organisations questioned do not recognise that their business information is either sensitive or critical and, therefore, a business asset. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://thebusiness.vnunet.com/News/1121046 MICROSOFT EXPOSES CUSTOMERS TO VIRUS RISK Microsoft representatives acknowledged on Wednesday that the company may have infected up to 26 of its top support customers with a tenacious virus that spread to a key server late last week. Known as FunLove, the virus was first discovered in November 1999 and is known for its ability to infect Windows NT servers - in addition to computers running Windows 95, Window 98 and Windows Millennium Edition - by posing as a system program. The virus also spreads automatically throughout a network via any hard drives shared with the infected system. Though managers at the company did not yet know how the virus got in, they did figure out where the infection started. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.zdnet.co.uk/news/2001/16/ns-22474.html EB DEFACED IN PORN HACK Hackers posted some deeply unpleasant porn on the web site of a leading games retailer. Electronics Boutique (EB) took down its Web site, built on the IIS Web server platform, for repairs. But surfers visiting its UK site were exposed to a full screen Windows popup of a Web site featuring pornographic images related to incest and underage sex. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.theregister.co.uk/content/8/18541.html INTERNET SECURITY SYSTEMS VS. THE SPY All it takes is a little creativity, a comfy place to sit, a laptop, and a handful of wireless hardware, and cracker types can clandestinely monitor wireless network traffic, boot up applications, or steal data outright. Software maker Internet Security Systems (ISS) says: That ain't right. The company aims to make wireless networks at least as secure as their tethered counterparts. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.informationweek.com/story/IWK20010426S0006 EGGHEAD CREDIT CARD HACK: SERIOUS QUESTIONS REMAIN It started with a tip from a Register reader whose bank advised him to cancel his Visa credit card after shopping at on-line retailer Egghead.com, then developed into a tour de force of public-relations worst practices, and finally ended in lingering doubts about whether Egghead's vehement claim that no credit card data was compromised during its Christmas hack is trustworthy. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.theregister.co.uk/content/8/18547.html PERSONAL FIREWALLS/INTRUSION DETECTION SYSTEMS The complexity of Microsoft Windows and browsers/PC applications, and the pervasiveness of networking, have contributed to continual discovery of security weaknesses - which the typical user cannot be expected to follow or understand. Until now the standard tool for defending Windows was the antivirus scanner, but this is no longer enough. The personal firewall has made its debut and may become an essential tool for Windows users connected to hostile networks. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://securityportal.com/articles/pf_main20001023.html WINDOWS 2000, SNMP AND SECURITY Simple Network Management Protocol (SNMP) was developed in the early days of the Internet to help administrators manage increasingly complex networks. Supporting SNMP soon became a necessity for any box that could be connected to the Internet. Unfortunately, in striving for simplicity, the designers of early versions of SNMP overlooked some basic security features. Although recent versions have placed increasing emphasis on security, concerns persist. In this article, the authors will examine security aspects of SNMP in the context of Windows 2000. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.securityfocus.com/focus/microsoft/nt/snmp.html CERT/CC STATISTICS 1988-2001 The CERT/CC publishes statistics for: number of incidents reported, vulnerabilities reported, security alerts published, security notes published, mail messages handled and hotline calls recieved. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.cert.org/stats/cert_stats.html FEDS WARN OF MAY DAY ATTACKS ON U.S. WEB SITES Federal authorities warn that U.S. Web sites and e-mail servers are coming under an increasing number of attacks and that the malicious hacking could escalate in the next few days because of upcoming memorial days in China. The recent tension between the United States and China was cited by the National Infrastructure Protection Center when it issued the warning Thursday. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.cnn.com/2001/TECH/internet/04/26/hacker.warning/index.html YOU CAN HIDE FROM PRYING EYES It's a refrain so common it's unremarkable: Privacy is dead on the Net, and being able to shield your identity online is about as likely as winning the lottery. Twice. Just don't tell that to the researchers who gathered this week for the fourth Information Hiding Workshop, an event that's on the front lines of the pitched battle over anonymity vs. traceability. These roughly 100 scientists, engineers, and mathematicians don't want you to have to rely on the law to shield your online identity from prying eyes. After all, laws can change, some countries lack legal protection, and even websites you trust may surreptitiously leak information or suffer security. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.wired.com/news/politics/0,1283,43355,00.html IBM PLANS HACKER-BEATING COMPUTER The aim: to create "intelligent" computers capable of handling simple tasks, such as correcting system failures and warding off attacks from hackers. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.zdnet.com/zdnn/stories/news/0,4586,5081927,00.html "VIRTUAL CARD" VIRUS HOAX Computer users who receive an email warning of a "Virtual Card" virus should ignore it, as antivirus experts are confident it is a hoax. The email, which has the subject line "Important - Please read this warning about a Destructive Virus" first appeared late last year. It says that users should watch out for an email-propagated virus entitled "A Virtual Card for You", which it claims will wipe vital information from a hard drive. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.zdnet.co.uk/news/2001/16/ns-22500.html HOW TO CRACK OPEN AN E-BOOK A hacker claims he or she has cracked the code and can remove the encryption on e-books in the RocketBook format, allowing the extraction of the content as plain text. At the end of March, the hacker started making this information available publicly, and posted one URL to Gemstar's forums and the code and instructions to other Web forums. "My goal was, and continues to be, to point out the weaknesses of DRM (digital rights management) systems, in the hope that these systems will either grow so much to collapse under their own weight or be abandoned as futile," the poster said. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.wired.com/news/business/0,1367,43401,00.html BSD FIREWALLS: IPFW "Your FreeBSD system comes with two built-in mechanisms for inspecting IP packets: ipfw and ipfilter. Both have their own peculiar syntax for creating rulesets to determine which packets to allow and which packets to discard, so I'd like to demonstrate the usage of both. Since you can only run one or the other, I'll start with ipfw; once we've had a good look at it, I'll switch gears and move on to ipfilter." Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.onlamp.com/pub/a/bsd/2001/04/25/FreeBSD_Basics.html DOES ANYBODY KNOW WHO'S IN CHARGE OF SECURITY HERE? Confusion between the level of security an ISP is willing to provide, and the level of protection users understand they receive, leaves companies vulnerable to attacks by crackers. That's one of the main conclusion of a survey of ISP and end-user attitudes to security by consultant MIS Corporate Defence Systems which found that 54 per cent of the organisations it questioned have been victims of an attack by hackers. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.theregister.co.uk/content/8/18571.html COMPANIES HIT BY HACKERS FIGHT BACK Companies are taking the law into their own hands to beat hackers who cost them millions of pounds each year. They are going on the offensive and adopting hacking tools and techniques themselves, according to a former director of information warfare for the US Department of Defense. Bob Ayers, director of UK security consultancy Para-Protect, says companies are frustrated by limitations in law enforcement methods, and some are now fighting back. A popular tactic is hiring experts to trace the source of a hack and find weaknesses in a culprit's system. One website was offering the facility to overload a hacker's own computer with spam email, said Ayers. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.vnunet.com/News/1121182 LINUX NETWORK SECURITY There are several methods remote attackers can use to break into your machine. Usually they are exploiting problems with existing programs. The Linux community always quickly spots these 'exploits' and releases a fix. Linux fixes are usually out long before the equivalent programs in other operating systems are mended. The issue here though is how to prevent your machine from suffering any sort of problem of this sort. Below we will see many methods to batten down the hatches and set up a really secure Linux. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.linuxplanet.com/linuxplanet/tutorials/211/1/ DECSS APPEAL HEARING TUESDAY On Tuesday, May 1st, while May Day is being celebrated in various ways around the world, 2600 will be in court fighting for freedom to link to and publish DeCSS. Stanford Law School dean, and remarkable constitutional scholar, Kathleen Sullivan will be arguing their case before Judges Newman, Cabranes, and Thompson, a visiting judge from the District Court of Connecticut. Link: http://www.2600.com/news/display.shtml?id=294 HOW TO SET UP A LINUX-BASED FIREWALL FOR A SOHO With telecommuters and small-office workers relying more on the Internet, security is becoming an increasingly important issue for systems administrators. To combat the wily hacker, many companies are turning to lightweight Linux based firewalls. But doing so is no small feat, especially for the Unix-weary. To assuage any fears, this article will show you how to set up a Linux-based personal firewall for the SOHO (small office, home office), broadband-attached network. It also takes a look at several SOHO firewalls and determines whether or not they can keep your systems safe from intruders. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.networkcomputing.com/unixworld/1209/1209uw.html ---------------------------------------------------------------------------- Security issues --------------- All vulnerabilities are located at: http://net-security.org/text/bugs ---------------------------------------------------------------------------- MERCURY FOR NETWARE POP3 SERVER VULNERABILITY All versions of widely-used POP3 server from Mercury MTA package for Netware are vulnerable to remote buffer overflow allowing to crash Netware server: perl -e 'print "APOP " . "a"x2048 . " " . "a"x2048 . "\r\n"' | nc host 110 Remote execution of malicious code is also theoretically possible. Link: http://www.net-security.org/text/bugs/988020052,81531,.shtml REDHAT 7 INSECURE UMASK The Redhat useradd script creates a group for the new user with the same name as the username by default. When the user logs in, any shell that uses /etc/profile will set the umask to 002 if the user's username and groupname match and their uid is greater than 14. If the user then issues su to become root without specifying the -l option the root account inherits the umask of 002. As root the user may then create files with somewhat insecure permissions. Redhat seemed to understand that system users should have a umask of 022, because /etc/profile will set the umask that way for users loging in with a uid less than 14, but they forgot about su. Link: http://www.net-security.org/text/bugs/988020106,54964,.shtml NOVELL BORDERMANAGER 3.5 VPN DENIAL OF SERVICE Novell BorderManager is described on Novell's web site as "a powerful Internet security management suite that offers industry leading firewall, authentication, virtual private network (VPN), and caching services to organizations of all sizes." Client to site VPN services can be halted by a SYN flood attack on port 353, causing the port to close and the service to cease functioning until the server is rebooted. Link: http://www.net-security.org/text/bugs/988020192,71661,.shtml NEW VERSION OF SENDFILE FIXES LOCAL ROOT EXPLOIT Colin Phipps and Daniel Kobras discovered and fixed several serious bugs in the daemon `sendfiled' which caused it to drop privileges incorrectly. Exploiting this a local user can easily make it execute arbitrary code under root privileges. We recommend you upgrade your sendfile packages immediately. Link: http://www.net-security.org/text/bugs/988021801,67488,.shtml PERL WEB SERVER VULNERABILITY Perl Web Server has a simple dot dot bug bug. Link: http://www.net-security.org/text/bugs/988199446,66919,.shtml IPSWITCH IMAIL 6.06 SMTP VULNERABILITY There exists a vulnerability within IMail that allows remote attackers to gain SYSTEM level access to servers running IMail's SMTP daemon. The vulnerability stems from the IMail SMTP daemon not doing proper bounds checking on various input data that gets passed to the IMail Mailing List handler code. If an attacker crafts a special buffer and sends it to a remote IMail SMTP server its possible that an attacker can remotely execute code (commands) on the IMail system. In order to overwrite EIP you must know the name of a valid mailing list. IMail will happily provide you with a list of mailing lists by sending imailsrv@example.com an eMail with the word "list" (without the quotes) in the body of an eMail msg. Now take any valid mailing list name and put it into the following SMTP session request and you will succesfully cause a buffer overflow to happen within the IMail service which, if you supply a specially crafted buffer, will result in the ability to remotely execute code on the IMail server. Link: http://www.net-security.org/text/bugs/988199503,37695,.shtml LINUX MANDRAKE - HYLAFAX UPDATE A problem exists with the HylaFAX program, hfaxd. When hfaxd tries to change it's queue directory and fails, it prints an error message via syslog by directly passing user supplied data as the format string. If hfaxd is installed setuid root, this behaviour can be exploited to gain root access locally. Note that Linux Mandrake does not ship hfaxd setuid root by default. Link: http://www.net-security.org/text/bugs/988233581,73315,.shtml DEBIAN'S NEW ZOPE PACKAGES This is an addition to DSA 043-1 which fixes several vulnerabilities in Zope. Something went wrong so it has to be corrected. The previous security release 2.1.6-7 has two severe problems: 1. zope 2.1.6-7 erronously included Hotfix 2000-10-02 (a fix for a vulnerability, which does only affect Zope 2.2.0 and later). The inclusion of this Hotfix completely broke the authentification, which rendered zope 2.1.6-7 practically unusable. Link: http://www.net-security.org/text/bugs/988289179,69331,.shtml KRB5 FTPD BUFFER OVERFLOWS Buffer overflows exist in the FTP daemon included with MIT krb5. If anonymous FTP is enabled, a remote user may gain unauthorized root access. A user with access to a local account may gain unauthorized root access. A remote user who can successfully authenticate to the FTP daemon may obtain unauthorized root access, regardless of whether anonymous FTP is enabled or whether access is granted to a local account. This vulnerability is believed to be somewhat difficult to exploit. Link: http://www.net-security.org/text/bugs/988289269,91226,.shtml VULNERABILITIES IN RAIDENFTPD SERVER Vulnerabilities exist which allow users to break out of the ftp root. Link: http://www.net-security.org/text/bugs/988289602,39368,.shtml VULNERABILITY IN WEBXQ SERVER A vulnerability exists which allows a remote user to break out of the ftp root. Link: http://www.net-security.org/text/bugs/988368638,26944,.shtml PROGENY - VULNERABILITIES IN FTP DAEMONS Recently, several bugs have been discovered in various FTP servers. If your Progeny Debian system runs either bsd-ftpd or ftpd, you may be vulnerable to a remote security bug. Link: http://www.net-security.org/text/bugs/988370697,33213,.shtml RED HAT - GFTP FORMAT STRING VULNERABILITY An updated gftp package is available for Red Hat Linux 6.2 and 7.1. This package contains an upgrade to gftp version 2.0.8, which improves functionality and fixes a format string vulnerability. Link: http://www.net-security.org/text/bugs/988370730,8363,.shtml DEBIAN LINUX - NEDIT SYMLINK ATTACK The nedit (Nirvana editor) package as shipped in the non-free section accompanying Debian GNU/Linux 2.2/potato had a bug in its printing code: when printing text it would create a temporary file with the to be printed text and pass that on to the print system. The temporary file was not created safely, which could be exploited by an attacked to make nedit overwrite arbitrary files. Link: http://www.net-security.org/text/bugs/988478957,51857,.shtml MIRABILIS ICQ WEBFRONT PLUG-IN DoS The web server on which this plugin relies is susceptible to a DoS attack through a malformed GET request. If this request contains 86 or more %'s or combinations of %'s with other characters (for example ascii encoded dots or backslashes) the ICQ program will begin consuming 100% cpu and will become unresponsive. A restart of the program is required to regain full functionality. Link: http://www.net-security.org/text/bugs/988479363,64744,.shtml ---------------------------------------------------------------------------- Security world -------------- All press releases are located at: http://net-security.org/text/press ---------------------------------------------------------------------------- NEW INTELLIGENT INVESTOR IN CRYPTOMATHIC - [23.04.2001] In August last year, we announced Maersk NetSecurity A/S from the Maersk group as our first investor and we are now proud to present our second investor. As of April 2001, Infineon Technologies AG is CRYPTOMAThIC�s investor. With this step, our investor programme has come to a successful completion. Infineon Technologies AG, Munich, Germany, offers semiconductor and system solutions for applications in the wired and wireless communications markets, for security systems and smartcards, for the automotive and industrial sectors, as well as memory products. Press release: < http://www.net-security.org/text/press/988020558,81402,.shtml > ---------------------------------------------------------------------------- CYLINK CORPORATION INTRODUCES NETHAWK 3.0 - [23.04.2001] E-business security provider Cylink Corporation introduced NetHawk 3.0, its next-generation virtual private network solution featuring client software that brings remote-access VPN capabilities to desktop and notebook computers for telecommuting and other remote computing applications. NetHawk 3.0's client software brings the remote computing capabilities to a high-performance IPSec VPN that delivers industry-leading scalability and speed, operating at 100 Mbps (200 Mbps full duplex) with up to 20,000 simultaneous connections. The client enables Microsoft Windows operating systems to secure client-to-client or client to-gateway communications over TCP/IP networks such as the Internet, allowing remote computer users to communicate as securely through an ISP or other dial in remote access device as desktop users do across a private local area network (LAN) or wide area network (WAN). Press release: < http://www.net-security.org/text/press/988020703,35906,.shtml > ---------------------------------------------------------------------------- F-SECURE PARTNERS WITH SYMBIAN - [23.04.2001] F-Secure announced that it has signed an agreement with Symbian to cooperate in the development and worldwide marketing of a range of security technologies for next generation mobile phones based on the Symbian platform. In joining the Embedded Technology Partner program of Symbian, F-Secure, the leading provider of content security applications for wireless devices, intensifies its development efforts for one of the most important and fastest-growing platforms in the world. The joint agreement gives F-Secure advance access to technology information from Symbian. Press release: < http://www.net-security.org/text/press/988106514,93232,.shtml > ---------------------------------------------------------------------------- UNISYS AND NORTEL UNVEILED SECURE VPN - [24.04.2001] Unisys Corporation and Nortel Networks have developed a virtual private network (VPN) solution - called Secure VPN - that is expected to help financial institutions, government departments and commercial enterprises conduct secure, cost effective eBusiness over the Internet. Demand for VPN products and services continues to rise sharply according to Infonetics Research, with global VPN expenditures expected to increase 528 percent by 2004. To meet the needs of this expanding market, Unisys and Nortel Networks have created an end-to-end VPN solution by combining Unisys professional consulting and integration services with Nortel Networks Contivity platform. Press release: < http://www.net-security.org/text/press/988124092,64536,.shtml > ---------------------------------------------------------------------------- RAINBOW AND KYBERPASS TEAM UP - [24.04.2001] Kyberpass Rainbow Technologies a leading provider of high-performance security solutions for the Internet and e-commerce, and Kyberpass Corporation, a leading provider of e-security software for trusted e-business, announced a strategic teaming agreement designed to increase one another's presence in the European e-security marketplace. The partnership allows both companies to combine unique and complementary qualifications that elevate the level of their professional services to a more competitive solution. Press release: < http://www.net-security.org/text/press/988124191,31631,.shtml > ---------------------------------------------------------------------------- NEW MANAGED SERVICES BY EXODUS - [24.04.2001] Introduces Internet Security Alliance, Enhances Integrated Security Offerings for Maximum Customer Protection Exodus Communications, Inc., the leader in complex Internet hosting and managed services, today announced the addition of three new security offerings to expand its robust portfolio of global Information Security services. The new solutions -- gateway-to-gateway VPNs; the latest version of Exodus Cyber Attack Management Service(tm), CAMS 2.0; and Managed Extranet services -- are ideal for customers that want to use best in-class technologies and security experts to protect their online assets. Press release: < http://www.net-security.org/text/press/988124422,51775,.shtml > ---------------------------------------------------------------------------- JAWZ ANNOUNCED MANAGED SECURITY CONTRACT - [25.04.2001] JAWZ Inc., a leading provider of secure information management solutions is pleased to announce that it has once again been selected as Union Townships IT Security partner to perform Managed Security for Union Township, New Jersey. JAWZ had previously conducted an information systems and network security analysis for the Township of Union to map out the system architecture, networks and information security infrastructure. Press release: < http://www.net-security.org/text/press/988219090,13281,.shtml > ---------------------------------------------------------------------------- INTEGRATING ALADDIN'S ETOKEN PRO SOLUTIONS - [27.04.2001] Aladdin Knowledge Systems, a global leader in the field of Internet content and software security, today announced a significant eToken partnership that integrates eToken PRO into four major security solutions offered by iT SEC iT Security AG, a leading European smartcard-based solutions vendor. Press release: < http://www.net-security.org/text/press/988370262,43051,.shtml > ---------------------------------------------------------------------------- ESOFTS'S INSTAGATE EX GETS ICSA CERTIFICATE - [27.04.2001] eSoft Inc., a leading provider of Internet security appliances that include firewall and VPN for small and medium enterprises (SMEs), announced that its InstaGate EX Internet security appliance and its downloadable Firewall Policy Manager SoftPak passed ICSA Lab's strict certification requirements for firewall functionality and security. Press release: < http://www.net-security.org/text/press/988370378,74955,.shtml > ---------------------------------------------------------------------------- SECURITY SYSTEM FOR MPEG ANNOUNCED - [27.04.2001] SecureMedia, the leader in IP Broadband Media Security, announced it has developed a revolutionary new security system that protects broadcast-quality MPEG-2 and MPEG-4 media streams delivered to digital set top boxes over IP networks. Using its patented Encryptonite Encryption Engine and breakthrough Indexed Encryption technology, the new security system dramatically increases protection of MPEG streams for Video-on-Demand applications, while greatly simplifying key management, reducing bandwidth requirements, and ensuring the highest-quality user experience. Press release: < http://www.net-security.org/text/press/988370538,44714,.shtml > --------------------------------------------------------------------------- BRILAW INTERNATIONAL A PREMIER PARTNER OF NOKIA - [27.04.2001] Leading UK IT Security specialists Brilaw International are proud to announce that they have been appointed as a premier partner of Nokia Internet Communications, the Internet and E-commerce division of Nokia Communications. This accreditation is only for a handful of specialist resellers in the UK. The accreditation involves volume and training commitments, which add value to both Brilaw and Nokia. The training will ensure that Brilaw can offer expertise regarding Nokia Security Solutions, therefore informing customers of which solution suits every individual customer. Press release: < http://www.net-security.org/text/press/988370829,77220,.shtml > ---------------------------------------------------------------------------- SOPHOS DEFENDS NHS FROM VIRUSES - [27.04.2001] Sophos, a world leader in corporate anti-virus protection, announced that it now defends over 100,000 NHS computer users from virus attack. This landmark was achieved when Sophos reseller Foursys closed a deal with Southern Derbyshire Acute Hospitals NHS Trust to provide Sophos Anti-Virus protection for all the Trust's 2,500 computers. One of the Trust's sites, The Derbyshire Royal Infirmary, covers an area of thirty acres and is the sole accident-receiving centre for Southern Derbyshire. Hospital facilities include surgical and medical services, trauma and orthopaedics, critical care and support. Press release: < http://www.net-security.org/text/press/988381349,23300,.shtml > ---------------------------------------------------------------------------- Featured products ------------------- The HNS Security Database is located at: http://www.security-db.com Submissions for the database can be sent to: staff@net-security.org ---------------------------------------------------------------------------- AKER FIREWALL With the advance of the Internet phenomenon, it has become vital for all businesses to guarantee the security of their networks, as well as the maintenance of all data stored in their systems. As an answer to those needs, Aker has created Aker Firewall. This new version allows the definition of user access profiles to all services supported by the firewall, allowing for a specific user to guarantee his/her access rights, independently of the machine he/she is using at any given moment. The access rights also include the viewing of Web pages, accessed through Firewall Aker's own WWW proxy. Installing the Aker authentication client for Windows 95/98/NT does this. It will also be possible to do so by using the radius server True Access. Read more: < http://www.security-db.com/product.php?id=717 > This is a product of Aker Security Solutions, for more information: < http://www.security-db.com/info.php?id=160 > ---------------------------------------------------------------------------- PRIVACYX MAIL PrivacyX is an email system which uses anonymous digital certificates to provide maximum levels of privacy and security. Key Features: - Strong encryption - impervious to all known attacks - Digital signatures for authentication and non-repudiation - Email headers are stripped of all personally identifiable information - Inter-operates seamlessly with other email systems - Spam management & deterrence Read more: < http://www.security-db.com/product.php?id=314 > This is a product of PrivacyX, for more information: < http://www.security-db.com/info.php?id=61 > ---------------------------------------------------------------------------- REPORTING MODULE Check Point�s Reporting Module delivers actionable audit, trend and cost information from VPN-1 and FireWall-1 log file entries, presenting critical facts and relationships in simple, easy to understand reports. VPN-1 and FireWall-1 log file entries contain a rich set of information gathered while enforcing security policy rules. Each log file entry includes important network, security, and accounting data that can help security managers develop a detailed picture of network use and abuse. Read more: < http://www.security-db.com/product.php?id=425 > This is a product of Check Point, for more information: < http://www.security-db.com/info.php?id=93 > ---------------------------------------------------------------------------- Featured article ---------------- All articles are located at: http://www.net-security.org/text/articles Articles can be contributed to staff@net-security.org ---------------------------------------------------------------------------- START YOUR DAY WITH A CUP OF DoS Denial of Service, or a DoS, is an action undertaken by someone, usually with a single goal, to render your host or system useless for other users, by making its services unreachable. DoS attacks can be pulled both on hardware or software. What basically happens is that your host, or some particular service it offers, becomes overloaded with requests for initializing a TCP/IP three-way handshake. Your system then tries to comply, but it gets so much requests or, it cannot identify a sender so it simply chokes itself by sending so many responses to nobody, expecting an answer for intialization of a connection. An answer he's likely never to get... That's the shortest way to explain a DoS. Of course, that is only a simplified example. Read more: < http://www.net-security.org/text/articles/dos.shtml > ---------------------------------------------------------------------------- Security Software ------------------- All programs are located at: http://net-security.org/various/software ---------------------------------------------------------------------------- SWB 0.10 SWB enables the SMB(CIFS) session setup without depending on the version and the registry setting of your Windows machines. The SMB session is established in the following steps. 1.TCP Connection 2.NetBIOS Session Request 3.SMB Negotiate Protocol 4.SMB Session Setup 5.SMB Tree Connect The parameters usually used in each of these steps is automatically decided from the version and the registry setting of the Windows machine of the client and the server. Using SWB, you can flexibly set parameters and try the SMB session setup. Info/Download: < http://www.net-security.org/various/software/988369131,9958,windows.shtml > ---------------------------------------------------------------------------- GETACCT 1.0 GetAcct sidesteps "RestrictAnonymous=1" and acquires account information on Windows NT/2000 machines. Input the IP address or NetBIOS name of a target computer in the "Remote Computer" column. Input the number of 1000 or more in the "End of RID" column. The RID is user's relative identifier by which the Security Account Manager gives it when the user is created. Therefore, it is input as 1100, if there are 100 users. Finally push the "Get Account" button. GetAcct works only on Pentium compatible computers. It also, works on Windows NT/2000. GetAcct is free regardless of a non-commercial or commercial use. Info/Download: < http://www.net-security.org/various/software/988369332,85231,windows.shtml > ---------------------------------------------------------------------------- LCRZOEX Lcrzoex contains over 180 functionnalities to test an Ethernet/IP network (sniff, spoof, configuration, clients, servers, etc.). Lcrzo is the network library which permitted to create lcrzoex. Info/Download: < http://www.net-security.org/various/software/988369505,5313,linux.shtml > ---------------------------------------------------------------------------- ASSAULT HACKWORKS 1.0 BETA Assault Hackworks is intended to be a useful tool not just showing vulnerabilities but also allowing to exploit them. This feature makes the danger more clear and facilitates the task of improving security by visualizing threats that otherwise may seem enterily theoretical. You can scan your servers from the Interent and see what is possible and what is not. Info/Download: < http://www.net-security.org/various/software/988369762,74327,windows.shtml > ---------------------------------------------------------------------------- IRCR IRCR is a collection of tools that gathers and/or analyzes forensic data on a Microsoft Windows system. You can think of this as a snapshot of the system in the past. It is similar to TCT by Dan Farmer and Wietse Venema, as most of the tools are oriented towards data collection rather than analysis. The idea of IRCR is that anyone could run the tool and send the output to a skilled Windows forensic security person for further analysis. Info/Download: < http://www.net-security.org/various/software/988369912,16679,windows.shtml > ---------------------------------------------------------------------------- Defaced archives ------------------------ [23.04.2001] Original: http://www.peugeot.com.tn/ Defaced: http://defaced.alldas.de/mirror/2001/04/23/www.peugeot.com.tn/ OS: Windows Original: http://www.daewoo.es/ Defaced: http://defaced.alldas.de/mirror/2001/04/23/www.daewoo.es/ OS: Windows Original: http://www.macase.com.tw/ Defaced: http://defaced.alldas.de/mirror/2001/04/23/www.macase.com.tw/ OS: Linux [24.04.2001] Original: http://www.unix.ch/ Defaced: http://defaced.alldas.de/mirror/2001/04/24/www.unix.ch/ OS: Linux Original: http://www.javapowered.com/ Defaced: http://defaced.alldas.de/mirror/2001/04/24/www.javapowered.com/ OS: BSDI Original: http://www.madonna.org/ Defaced: http://defaced.alldas.de/mirror/2001/04/24/www.madonna.org/ OS: Unknown Original: http://www.unicef.it/ Defaced: http://defaced.alldas.de/mirror/2001/04/24/www.unicef.it/ OS: Windows Original: http://www.detrannet.prodemge.gov.br/ Defaced: http://defaced.alldas.de/mirror/2001/04/24/www.detrannet.prodemge.gov.br/ OS: Windows [25.04.2001] Original: http://www.bankerindia.com/ Defaced: http://defaced.alldas.de/mirror/2001/04/25/www.bankerindia.com/ OS: Windows Original: http://www.mcdonalds.cl/ Defaced: http://defaced.alldas.de/mirror/2001/04/25/www.mcdonalds.cl/ OS: Windows Original: http://www.guardian-insurance.com.my/ Defaced: http://defaced.alldas.de/mirror/2001/04/25/www.guardian-insurance.com.my/ OS: Windows Original: http://www.esamsung.com/ Defaced: http://defaced.alldas.de/mirror/2001/04/25/www.esamsung.com/ OS: FreeBSD [26.04.2001] Original: http://www.digital-samsung.com/ Defaced: http://defaced.alldas.de/mirror/2001/04/26/www.digital-samsung.com/ OS: Windows Original: http://www.bbu.acer.com.tw/ Defaced: http://defaced.alldas.de/mirror/2001/04/26/www.bbu.acer.com.tw/ OS: Windows Original: http://www.acer.com.cn/ Defaced: http://defaced.alldas.de/mirror/2001/04/26/www.acer.com.cn/ OS: Windows Original: http://www2.acer.co.ae/ Defaced: http://defaced.alldas.de/mirror/2001/04/26/www2.acer.co.ae/ OS: Windows Original: http://www.sharp.se/ Defaced: http://defaced.alldas.de/mirror/2001/04/26/www.sharp.se/ OS: Windows [27.04.2001] Original: http://www.bingolotto.se/ Defaced: http://defaced.alldas.de/mirror/2001/04/27/www.bingolotto.se/ OS: Windows Original: http://www.cisco.co.kr/ Defaced: http://defaced.alldas.de/mirror/2001/04/27/www.cisco.co.kr/ OS: Windows Original: http://www.wii.ericsson.net/ Defaced: http://defaced.alldas.de/mirror/2001/04/27/www.wii.ericsson.net/ OS: Windows Original: http://www.honda.co.th/ Defaced: http://defaced.alldas.de/mirror/2001/04/27/www.honda.co.th/ OS: Windows Original: http://www.philips.monitors.com.cn/ Defaced: http://defaced.alldas.de/mirror/2001/04/27/www.philips.monitors.com.cn/ OS: Windows [28.04.2001] Original: http://www.sgi.com.cn/ Defaced: http://defaced.alldas.de/mirror/2001/04/28/www.sgi.com.cn/ OS: IRIX Original: http://www.creative-computer.com/ Defaced: http://defaced.alldas.de/mirror/2001/04/28/www.creative-computer.com/ OS: Windows Original: http://www.nxinfo.gov.cn/ Defaced: http://defaced.alldas.de/mirror/2001/04/28/www.nxinfo.gov.cn/ OS: Windows ---------------------------------------------------------------------------- ======================================================== Advertisement - HNS Security Database ======================================================== HNS Security Database consists of a large database of security related companies, their products, professional services and solutions. HNS Security Database will provide a valuable asset to anyone interested in implementing security measures and systems to their companies' networks. Visit us at http://www.security-db.com ======================================================== Questions, contributions, comments or ideas go to: Help Net Security staff staff@net-security.org http://net-security.org http://security-db.com