💾 Archived View for clemat.is › saccophore › library › ezines › textfiles › ezines › HNS › issue033.… captured on 2022-01-08 at 15:57:00.
⬅️ Previous capture (2021-12-03)
-=-=-=-=-=-=-
HNS Newsletter Issue 33 - 02.10.2000 http://net-security.org This is a newsletter delivered to you by Help Net Security. It covers weekly roundups of security events that were in the news the past week. Visit Help Net Security for the latest security news - http://www.net-security.org. Subscribe to this weekly digest on: http://www.net-security.org/text/newsletter Table of contents: 1) General security news 2) Security issues 3) Security world 4) Featured articles 5) Security books 6) Defaced archives ========================================================== Sponsored by Kaspersky Lab - You Personal Anti-Virus Guard ========================================================== The Breakthrough Technology Protecting Your Computers From Viruses! Subscribe to Kaspersky Lab's FREE newsletter delivering you the latest and trustworthy information source on computer viruses and their counter measures. You will always be up to date when securing your computer! Join now! http://www.kasperskylab.ru/eng/news/maillist.asp ========================================================== General security news --------------------- ---------------------------------------------------------------------------- BUSH CAMPAIGN MOUNTS EMAIL ASSAULT "A strangely spamlike viral marketing campaign is being cranked-up in support of George W Bush's campaign for the US presidency. We use the term "spamlike" advisedly; as we all know, spamming is what other people do, we do permissions based email marketing, right?" Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.theregister.co.u k/content/1/13824.html WHY KIDS SHOULDN'T BE CRIMINAL HACKERS "Many kids who become criminal hackers think that what they're doing is just good harmless fun - like a neat video game. They are wrong. To understand why using a computer system without permission causes problems, you have to understand the goals of information security: confidentiality, control, integrity, authenticity, availability, and utility." Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://securityportal.com/c over/coverstory20001009.html A YEAR AGO: SOFTSEEK INFECT USERS WITH NETBUS TROJAN Internet security Web site, PCHelp, Thursday evening issued a security alert accusing popular download site Softseek.com of infecting the computers of users with Trojan horse program, NetBus, leaving them vulnerable to remote attack. Within the alert, PCHelp alleges that "Windows security program" WinSec, supposed to enable administrators to restrict user access to different Windows features, carries the well-known back door Trojan, Net Bus 170 W95. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.zdnet.co.uk/news /2000/40/ns-18324.html OPENBSD PLUGS A RARE SECURITY LEAK "For most open source projects, news of an overlooked security hole is simply part of the debugging process. But for the developers of OpenBSD, an operating system whose design motto is "secure by default," it's nothing short of an affront." Link: http://www.upside.com/texis/mvm/story?id=39dceffe0 OMTOOL UNVEILS EASY-TO-USE E-MAIL ENCRYPTION TOOL Client-server software vendor Omtool has launched an encrypted messaging application that it said is simpler to use and deploy than complex PKI-based systems. Although the security level is not as high as with PKI, Omtool's product offers an elevated degree of protection for companies that currently have to send confidential messages via unsecured email. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.telekomnet.com/n ews_security/10-6-00_omtool_encrypttool.asp SECPROG MAILING LIST SecurityFocus has opened a new mailing list called SECPROG. It is dedicated to the discussion of secure programming methods and techniques. One of the goals of the mailing list is to work on a comprehensive document that will serve as a secure programming guideline. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.securityfocus.co m/forums/secprog/secure-programming.html CYBERCRIME OUTPACING SECURITY SPENDING Cybercrime is skyrocketing despite increased spending on security measures, according to "The 2000 Information Security Survey," a study released by Information Security magazine. The survey found that more media attention is given to so-called "sexy cyberattacks" - such as denial-of-service (DoS), Web defacements, and buffer overflows - committed by outsiders. However, most cybercrimes are committed by insiders. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.ecommercetimes.c om/news/articles2000/001006-1.shtml EXPERTS APPLAUD MOVE TO CLOSE WAP SECURITY HOLE European experts welcomed news that US authorities have finally standardised an encryption algorithm, saying that it will help close a security hole in WAP gateways. William Whyte, senior cryptographer at Baltimore Technologies, said: "The point of vulnerability lies at the gateway of a WAP server which potentially could allow anyone to read that message. The universal adoption of AES should make it possible for people to encrypt directly from the wireless device to any web server and it will subsequently remove the point of vulnerability." Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.silicon.com/a400 75 NEW CERT/CC VULNERABILITY DISCLOSURE POLICY Effective October 9, 2000, the CERT Coordination Center will follow a new policy with respect to the disclosure of vulnerability information. All vulnerabilities reported to the CERT/CC will be disclosed to the public 45 days after the initial report, regardless of the existence or availability of patches or workarounds from affected vendors. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.cert.org/faq/vul disclosurepolicy.html SECURE SHELL NOW IN NETBSD MAINLINE An OpenSSH-based Secure Shell is now available in the main NetBSD sources. And it will be pulled into the netbsd-1-5 branch, so it will be available inNetBSD 1.5. (ssh-1.2.27 and OpenSSH were already available in the NetBSD packages collection.) According to an NetBSD announcement, the OpenSSH-based implementation is temporary. They believe it will be replaced within the next couple months with a "completely independent implementation". Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.bsdtoday.com/200 0/October/News299.html BINDV9 AND INTERNET SECURITY RELATED INTERVIEW In this interview, Paul Vixie and David Conrad talk about the Internet Software Consoritum, the changes in the latest major version of bind, the security features designed into it, and the future of Internet security. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.linuxsecurity.co m/feature_stories/conrad_vixie-1.html SECURITY BREACH CONCERNS ARE UP Audits conducted last year by the General Accounting Office and agency inspectors general show that 22 of the largest federal agencies have significant computer security weaknesses. Among the common problems cited were poor controls over system access, data access and software development. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.latimes.com/busi ness/cutting/20001003/t000093746.html BOSSES GAIN EMAIL SNOOPING RIGHTS The Government has abandoned "impractical" plans to force companies to seek permission from their staff to monitor email and phone usage at work. From October 24th, companies will be permitted "routine access" to any business emails and phone calls to see if they are business-related. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.theregister.co.u k/content/1/13722.html WARNER MUSIC PLAYS WITH DIGITAL SECURITY In an effort to develop new digital products and thwart Internet piracy, Warner Music Group is expanding its partnerships with secure online distributors and preparing to unveil a new, high-quality DVD-audio format with anti-copying features. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://news.cnet.com/news/0 -1005-200-2925971.html INTERVIEW WITH MARK ABENE A.K.A. PHIBER OPTIK Mark Abene, former member of MOD and founder of Crossbar Security talks candidly about his early hacking and the supposed "war" with LOD as well as offering his thoughts on the "Golden Age" of hacking. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.securityfocus.co m/media/65 AOL, HP EXECS CALL FOR NET PRIVACY LAWS America Online and Hewlett Packard executives told U.S. lawmakers that industry efforts alone are insufficient to protect consumer privacy online and legislation is needed to guard personal data. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.usatoday.com/lif e/cyber/tech/cti608.htm FIRSTGOV.GOV FLUNKS SECURITY TEST A one-stop gateway to all 27 million U.S. government Web pages set up last month is inadequately protected from attackers. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.zdnet.com/zdnn/s tories/news/0,4586,2635962,00.html VIRUS NAMING CHAOS CAUSES CONFUSION A need to standardise the naming of viruses has become apparent after the same virus was given at least four different names by antivirus vendors. Trend Micro this week issued an alert for a virus it calls VBS_Columbia, a Love Bug variant, which spreads itself by email. Rival vendor Symantec said the virus was actually discovered several weeks ago and is called VBS.Plan.A. Sophos calls it Loveletter.AS and Network Associates calls it Loveletter.AV. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.vnunet.com/News/ 1112012 LINUX VIRUS SCANNERS: COMMON PROBLEMS "So, we've covered Virus scanning for Linux in general, as well as where to place the scanning software. Even if you do all that perfectly, though, you can still run into problems." Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://securityportal.com/a rticles/linuxscan20001003-1.html FBI RELEASES FIRST BATCH OF CARNIVORE DOCUMENTS The Electronic Privacy Information Center, which sued the FBI for the information through the Freedom of Information Act, is reviewing the documents and will soon release its analysis based on the data. The FBI is required to release additional files at regular intervals, until all 3,000 pages have been delivered to EPIC. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://news.cnet.com/news/0 -1005-200-2917414.html ---------------------------------------------------------------------------- Security issues --------------- All vulnerabilities are located at: http://net-security.org/text/bugs ---------------------------------------------------------------------------- VULNERABILITY IN MOREOVER.COM'S CACHED_FEED.CGI Yet another CGI that lacks sufficient (or in this case -any-) input validation, leading to the exposure of readable files on the system. Link: http://www.net-security.org/text/bugs/970533061,34083,.shtml GNORPM LOCAL /TMP VULNERABILITY While fixing other problems with the gnorpm package a locally exploitable security hole was found where a normal user could trick root running GnoRPM into writing to arbitary files due to a bug in the gnorpm tmp file handling. A new release of GnoRPM (0.95.1) is now available. This fixes significant numbers of gnorpm bugs including the security hole. Administrators who use this program on multi-user machines may well want to update it, and anyone who uses it regularly will probably appreciate the fact it now works rather better than before. Link: http://www.net-security.org/text/bugs/970533126,51743,.shtml VULNERABILITY IN CYBEROFFICE SHOPPING CART It is possible with default installations (according to vendor instructions) of CyberOffice to gain access to the database which holds information on customer orders, details and credit card information. This data is held in an unprotected and un-encrypted Microsoft Access Database. Link: http://www.net-security.org/text/bugs/970533370,54017,.shtml WINGATE 4.0.1 DENIAL-OF-SERVICE The Wingate engine can be disabled by sending an abnormal string to the Winsock Redirecter Service. The attack is not logged. Vulnerable: Wingate Home/Standard/Pro 4.0.1, possible prior versions (untested). Link: http://www.net-security.org/text/bugs/970533572,73497,.shtml LOCAL VULNERABILITY IN XFCE 3.5.1 XFCE 3.5.1 ships with the following entry in /etc/X11/xfce/xinitrc: xhost +$HOSTNAME If a person is using this on a multiuser system, all local users may connect to their X session and capture keystrokes, etc. Link: http://www.net-security.org/text/bugs/970575943,34613,.shtml PROBLEMS WITH THTTPD 2.19 SSI The included cgi-bin program "ssi" (combined with a lesser bug in the thttpd server) allows the viewing of arbitrary files on the remote server. This includes files outside of the web root and files in cgi-bin directories (that would normally only be executed). However, only files readable by the user that the server is running under (usually user 'nobody') can be viewed. This typically limits the exposure to world-readable files only. Link: http://www.net-security.org/text/bugs/970576048,12856,.shtml RESOURCES NOT FOR ALL This patch gives limited access for non-root to process table ,only root see all process and have access to their entries in proc filesystem. Permission to directories in proc filesystem is changed to 550 (dr-xr-x---). Non-root users can only see own proceses. Link: http://www.net-security.org/text/bugs/970576193,14761,.shtml PEGASUS MAIL FILE READING VULNERABILITY The default setup of Pegasus Mail contains a remotely exploitable security hole that allows a remote website to gain copies of files on the users hard drive. Link: http://www.net-security.org/text/bugs/970621168,87016,.shtml CALDERA LINUX - GNORPM PACKAGE Gnorpm versions prior to 0.95 use files in the /tmp dir in an insecure manner. If gnorpm is run as root, this vulnerability could lead to any file on the system being overwritten by gnorpm. Link: http://www.net-security.org/text/bugs/970621281,58939,.shtml PROBLEM WITH GNU GROFF UTILITIES The vulnerability is particularly dangerous in Linux distributions that have the "lesspipe" feature. By default, a "LESSOPEN" environment variable is set which points to a wrapper script for the "less" pager program named "/usr/bin/lesspipe.sh". If less is passed a filename with any of the extensions ".1" through ".9", ".n", or ".man", it automatically calls groff to handle the file. Link: http://www.net-security.org/text/bugs/970702976,58239,.shtml UNAUTHORIZED "DIRECTORY LISTINGS" UNDER IIS 5.0 It is possible to gain a directory listing of the root directory and every sub directory. The impact of this is such that attackers may be able to discover "hidden" files or enumerate .inc files used in ASP applications and then directly download them. .inc files can contain sensitive information such as database login names and passwords. Link: http://www.net-security.org/text/bugs/970703043,90499,.shtml IMMUNIX OS SECURITY UPDATE FOR LPR RedHat has put out an update to the lpr package due to a potential format string security bug. Link: http://www.net-security.org/text/bugs/970703094,39891,.shtml AOL INSTANT MESSENGER DOS AOL Instant Messenger version 4.1.2010 (others?) appears to be vulnerable to a DoS attack when handling file transfers with filenames containing %s. This DoS is apparently related to a problem with format strings. Link: http://www.net-security.org/text/bugs/970703303,25609,.shtml "WORD MAIL MERGE" VULNERABILITY PATCHED Microsoft has released a patch that eliminates a security vulnerability in Microsoft Word 2000 and 97. The vulnerability could allow a malicious user to run arbitrary code on a victim's computer without their approval. Link: http://www.net-security.org/text/bugs/970836665,24380,.shtml ANOTHER IE 5.5/OUTLOOK SECURITY VULNERABILITY Internet Explorer 5.5/Outlook allow executing arbitray programs after viewing web page or email message. This may lead to taking full control over user's computer. Link: http://www.net-security.org/text/bugs/970837661,95810,.shtml RED HAT LINUX - TRACEROUTE SETUID ROOT EXPLOIT A root exploit due to a segfault when using multiple -g options is fixed for Red Hat Linux 6.x and Red Hat Linux 5.x. A potential denial-of-service attack is alleviated by enforcing a maximum buffer size of 64Kb. On Red Hat Linux 6.x, loose source routing (LSRR) now works correctly. Link: http://www.net-security.org/text/bugs/970919340,13901,.shtml RED HAT LINUX - ESOUND CONTAINS A RACE CONDITION Esound, the Gnome sound server, contains a race condition that a malicious user could exploit to change permissions of any file owned by the esound user. Link: http://www.net-security.org/text/bugs/970919495,33832,.shtml INSECURE CALL OF EXTERNAL PROGRAMS IN RH LINUX TMPWATCH The tmpwatch utility is used in Red Hat Linux to remove temporary files. This utility has an option to call the "fuser" program, which verifies if a file is currently opened by a process. The fuser program is invoked within tmpwatch by calling the system() library subroutine. Insecure handling of the arguments to this subroutine could potentially allow an attacker to execute arbitrary commands. Link: http://www.net-security.org/text/bugs/971105993,28410,.shtml IMMUNIX OS SECURITY UPDATE FOR TMPWATCH RedHat has put out an update to the tmpwatch package due to a local denial of service problem and a potential root exploit Link: http://www.net-security.org/text/bugs/971106040,86351,.shtml PHPIX 1.0.X DIRECTORY TRAVERSAL VULNERABILITY Synnergy has discovered a flaw within PHPix that allow a remote user to traverse a directory as a request to the script using the $mode=album&album=_some_dir_variable. It is then possible to read any file or folder's contents with priviledges as the httpd. Link: http://www.net-security.org/text/bugs/971106264,49747,.shtml ---------------------------------------------------------------------------- Security world -------------- All press releases are located at: http://net-security.org/text/press ---------------------------------------------------------------------------- ADVANCED ENCRYPTION STANDARD FROM BALTIMORE TECH. - [03.10.2000] Baltimore Technologies, a global leader in e-security, announced that it will fully support the new AES algorithm, Rijndael, across its full product range, including both its hardware and software products. The AES algorithm, chosen today by the United States National Institute of Standards and Technology (NIST), will be incorporated in all Baltimore products including Baltimore KeyTools, a radical new suite of developer products and Baltimore SureWare, a range of next generation e-security hardware products. The AES algorithm will be available within the KeyTools family beginning Wednesday, October 11th. Press release: < http://www.net-security.org/text/press/970533748,63057,.shtml > ---------------------------------------------------------------------------- NOKIA AND MCAFEE TEAM UP - [03.10.2000] Nokia, a proven leader in network security infrastructure and McAfee, a Network Associates, Inc. business unit and the recognized leader in virus protection, announced the WebShield for Nokia Appliance, a joint offering designed to leverage the growing trend toward network appliance implementations and managed services. Press release: < http://www.net-security.org/text/press/970575888,50055,.shtml > ---------------------------------------------------------------------------- ADDITIONS TO BALTIMORE'S SOLUTIONSPLUS - [03.10.2000] Baltimore Technologies, a global leader in e-security solutions, announced the addition of its Signature Validation Platform as part of SolutionsPlus for the Identrus system. Baltimore's SolutionsPlus for the Identrus system is designed to provide leading financial institutions worldwide with all the tools they need to quickly implement Identrus systems that enable secure business-to-business e-commerce transactions in a private, confidential, non-reputable manner. Press release: < http://www.net-security.org/text/press/970591283,10421,.shtml > ---------------------------------------------------------------------------- MVPN SELECTS BALTIMORE'S SECURE VPN SOLUTION - [03.10.2000] Baltimore Technologies, a global leader in e-security solutions, announced that mVPN has deployed Baltimore's Secure VPN solution, part of the Baltimore SolutionsPlus line of e-business solutions. The Secure VPN solution is a combination of best-of-breed partners and leading PKI technology for the implementation of Virtual Private Networks (VPNs). Secure VPN ensures highly scalable, cost-effective and easy-to-deploy, yet secure, access to protected corporate data using public networks such as the Internet. Press release: < http://www.net-security.org/text/press/970591356,78974,.shtml > ---------------------------------------------------------------------------- E-SECURITY EXPO AND CONFERENCE INFORMATION - [04.10.2000] The e-Security Expo and Conference, to be held November 7-8 at the San Francisco Hilton & Towers will provide executives and technology professionals the information they need to protect their customer data, business intelligence, and minimize disruptions to their businesses. The conference also focuses on new opportunities that can be advantageous for their company's e-business provided the right e-security measures are taken. Press release: < http://www.net-security.org/text/press/970621097,14964,.shtml > ---------------------------------------------------------------------------- ALADDIN RELEASES ETOKEN ENTERPRISE 1.1 - [0.10.2000] Aladdin Knowledge Systems, a global leader in the field of Internet content and software security, released the beta version of eToken Enterprise 1.1. Providing simple implementation of two-factor authentication, secure login, secure messaging, digital signatures and GINA replacement, eToken Enterprise is truly an out-of-the-box solution for securing corporate networks, e-commerce, e-banking and Virtual Private Networks (VPNs). Press release: < http://www.net-security.org/text/press/970700204,76777,.shtml > ---------------------------------------------------------------------------- SECURE COMPUTING ANNOUNCES Q3 RESULTS - [05.10.2000] Secure Computing Corporation, will announce third quarter results on Thursday, October 19, after market close. A one-hour conference call has been scheduled at 2:00 p.m. PDT (5:00 p.m. EDT). John McNulty, chairman and CEO, Tim McGurran, SVP of operations and CFO, and Carr Biggerstaff, SVP product planning, marketing & business development, will discuss the results followed by a question-and-answer session. Press release: < http://www.net-security.org/text/press/970702188,50462,.shtml > ---------------------------------------------------------------------------- E-MAIL ENCRYPTION FOR WEB BASED EMAIL PROVIDERS - [06.10.2000] Sigaba Corporation, a secure Internet communications company, announced Sigaba's Software Developer's Kit that lets web-based email companies offer their users a one click security solution to encrypt their mail. "Email users today are more savvy than ever and they are very aware of the online threats to their privacy," said Gary B. Friedman, Sigaba Chairman/co-founder. Press release: < http://www.net-security.org/text/press/970835866,84227,.shtml > ---------------------------------------------------------------------------- BALTIMORE TECH. ANNOUNCES NEW DEPUTY CHAIRMAN - [06.10.2000] Baltimore Technologies, a global leader in e-security, announced that Mr. Fran Rooney, Chief Executive Officer of the Company, has also been appointed to the position of Deputy Chairman on the Board of Directors, with immediate effect. Press release: < http://www.net-security.org/text/press/970836014,73596,.shtml > ---------------------------------------------------------------------------- ALADDIN'S ESAFE PROTECTS AGAINST NEW IE EXPLOIT - [06.10.2000] Aladdin Knowledge Systems, a global leader in the field of Internet content and software security, today announced its eSafe content security solutions protect against a new security hole discovered in Internet Explorer. Though the exploit itself is not a vandal, it allows hackers to infect user's PCs with dangerous trojans, vandals and other malicious code. Press release: < http://www.net-security.org/text/press/970843885,74986,.shtml > ---------------------------------------------------------------------------- LATEST NEWS FROM BINDVIEW CORPORATION - [09.10.2000] BindView Corporation, a leading provider of IT administration and security management solutions, today announced that it identified and Microsoft eliminated recent vulnerabilities in the Microsoft operating system. These latest vulnerabilities could allow a range of effects, including possible Denial of Service Attacks and privilege elevation. The two companies have created a well-defined process for efficiently working together to identify and close these type of vulnerabilities. Press release: < http://www.net-security.org/text/press/971105242,81029,.shtml > ---------------------------------------------------------------------------- CISCO IP VPN SOLUTION FOR SERVICE PROVIDERS - [09.10.2000] Cisco Systems, Inc., the worldwide leader in networking for the Internet, announced a complete network-based IPsec VPN solution. Based on the new Cisco VPN 5000 concentrator and client, and available today, the new Virtual Private Network (VPN) platform securely connects remote users and branches to their corporate networks and business partners across the Internet. Cisco's new VPN 5000 solution brings service providers a new revenue generating opportunity by allowing them to offer their customers a single, secure solution for both remote access and Intranet and Extranet VPNs from a variety of client platforms. Press release: < http://www.net-security.org/text/press/971105289,22829,.shtml > ---------------------------------------------------------------------------- SIGABA ANNOUNCES EMAIL ENCRYPTION FOR USE WITH MS IE 5.5 - [09.10.2000] Sigaba Corporation, a secure Internet communications company, announced that SigabaSecure(TM), an email encryption client, is now available for use with Microsoft Internet Explorer 5.5 to encrypt Hotmail and Yahoo! Mail. SigabaSecure for IE 5.5 is a plug-in which allows users to send encrypted mail, shred mail so it cannot be re-opened, and confirm that mail has been read from their Yahoo! Mail and Hotmail accounts. Press release: < http://www.net-security.org/text/press/971105808,83402,.shtml > ---------------------------------------------------------------------------- SECURE COMPUTING SUPPORTS CISCO'S SAFE E-BUSINESS - [09.10.2000] Secure Computing Corporation, a leading provider of safe, secure extranets for e-Business, today announced that Secure's SafeWord and SafeWord Plus AAA servers provide managed, secure access for the new SAFE security blueprint from Cisco Systems, Inc. SAFE is a flexible, comprehensive security blueprint that is designed to help organizations securely, reliably and cost-effectively engage in e-business. Press release: < http://www.net-security.org/text/press/971105865,58560,.shtml > ---------------------------------------------------------------------------- TELERELAY TEAMS WITH TREND MICRO - [09.10.2000] Trend Micro Inc., a leading provider of enterprise antivirus and content security solutions, and messaging outsourcing specialist TeleRelay today announced that they are working together to provide a safer electronic messaging environment by delivering reliable, managed virus protection to the business community. Press release: < http://www.net-security.org/text/press/971105924,88098,.shtml > ---------------------------------------------------------------------------- Featured articles ----------------- All articles are located at: http://www.net-security.org/text/articles Articles can be contributed to staff@net-security.org Listed below are some of the recently added articles. ---------------------------------------------------------------------------- ISSUES: THE MEDIA'S GUIDE TO TALKING TO HACKERS by Thejian Two years ago, the then just started HNN, published an article in their Buffer Overflow section called "A hacker's guide to talking to the media". It was received with different opinions around the scene (I remember it referred to as "a hackers guide to talking to your local newspaper") but what people failed to grasp at that point was the importance of the attempt to educate the hax0rs on relations with the media. Wether you like it or not, especially in this scene, what one person says WILL affect us all. Article: < http://www.net-security.org/text/articles/thejian/media.shtml > ---------------------------------------------------------------------------- USING CONSERVATION OF FLOW AS A SECURITY MECHANISM IN NETWORK PROTOCOLS by Tuomas Aura, Matt Bishop and John Hughes The law of Conservation of Flow, which states that an input must either be absorbed or sent on as an output (possibly with modification), is an attractive tool with which to analyze network protocols for security properties. One of its uses is to detect disruptive network elements that launch Denial of Service attacks by absorbing or discarding packets. Its use requires several assumptions about the protocols being analyzed. In this paper, the authors examine the WATCHERS algorithm to detect misbehaving routers. They show that it uses Conservation of Flow without sufficient verification of its assumptions, and can consequently be defeated. They suggest improvements to make the use of Conservation of Flow valid. Article: < http://www.net-security.org/text/articles/index-download.shtml#Flow > ---------------------------------------------------------------------------- SECURING A DEFAULT LINUX INSTALLATION by Aleksandar Stancin aka D'Pressed This article is written for a linux newbie or anybody who cares, at least a bit about the data stored on his hard drive. You'll notice that it's aimed mainly for home-users, not for large network administrators or similar. All procedures have been done and checked on an installed SuSE 6.4 linux distribution. Article: < http://www.net-security.org/text/articles/default.shtml > ---------------------------------------------------------------------------- KASPERSKY LAB LAUNCHES A NEW VERSION OF ANTIVIRAL TOOLKIT PRO Kaspersky Lab announces the launch of a new version, 3.5, of its world famous, award-winning virus hunter, AntiViral Toolkit Pro (AVP). It is powered by numerous unique anti-virus technologies and features a new design of the main user interface. Article: < http://www.net-security.org/text/articles/viruses/newavp.shtml > ---------------------------------------------------------------------------- Featured books ---------------- The HNS bookstore is located at: http://net-security.org/various/bookstore Suggestions for books to be included into our bookstore can be sent to staff@net-security.org ---------------------------------------------------------------------------- UPGRADING AND TROUBLESHOOTING NETWORKS: THE COMPLETE REFERENCE Read this one if you're new to data communications, seeking any of several professional certifications that have to do with computer connectivity, or even if you've established yourself as a networking pro and want a solid reference on hand. This book generally deals with network equipment and protocols in a platform-independent way, although it dips into the specifics of Novell NetWare and Microsoft Windows networking after the foundation is laid. Topics covered: Local and wide area networking for personal computers, both generically and as implemented under Windows NT, Windows 2000, and Novell NetWare. Hardware and architecture coverage is followed by a detailed discussion of protocols, naming schemes and name-allocation services, directory services (notably Novell Directory Services and Active Directory), and Internet services. Book: < http://www.amazon.com/exec/obidos/ASIN/0072122560/netsecurity > ---------------------------------------------------------------------------- UNDERSTANDING MICROSOFT WINDOWS 2000 DISTRIBUTED SERVICES This book explains the big picture in its latest Windows DNA and Windows 2000 incarnations. This isn't strictly a programmer's text (it doesn't give recipes for building distributed applications), but neither is it just an administrator's guide (instructions for configuring Active Directory appear in other books). Instead, it's a thorough and carefully written explanation of how Windows 2000 and its applications run in a distributed environment, and how Windows supports distributed software and data in a secure way. Topics covered: Windows 2000 and the Windows DNA distributed computing technologies, including Active Directory, the Component Object Model (COM), COM+, ActiveX Data Objects, Distributed Transaction Services, and Microsoft Message Queuing Services. Also, there's in-depth discussion of how they all fit together. Book: < http://www.amazon.com/exec/obidos/ASIN/157231687X/netsecurity > ---------------------------------------------------------------------------- UNDERSTANDING SQL AND JAVA TOGETHER : A GUIDE TO SQLJ, JDBC, AND RELATED TECHNOLOGIES Many books on Java cover JDBC in detail, but this title goes much further by surveying a handful of other database standards from a variety of vendors, including Oracle and Sybase. (Don't worry: there's full coverage of JDBC for versions 1.0 and 2.0.) The real focus of this book is on SQLJ, which really comprises three standards. SQLJ Part 0 is the easiest to understand, as it supports embedded SQL calls within Java code. Next comes SQLJ Part 1, by which a database product (like Oracle) can use Java to define stored procedures. Here, the authors take care to show off how to deploy JAR files into a database. (Their sample movie database, used throughout this book, is both comprehensible and a little more entertaining than most sample database schemas.) Next, the authors look at SQL user-defined types (UDTs) and SQLJ Part 2, which allows Java code to make use of these UDTs directly, as well as store Java objects in a database. The last stop on the tour is a "true" object/relational mapping, Sun's Java Blend standard, which allows Java objects to be saved and restored from a database transparently. Book: < http://www.amazon.com/exec/obidos/ASIN/1558605622/netsecurity > ---------------------------------------------------------------------------- WEB SECURITY Tiwana, who writes a monthly column for Information Technology, offers a guide for systems administrators, security consultants, and others concerned about the security of web sites. He explains how to create and execute a comprehensive strategy, identify and eliminate potential vulnerabilities, frame a security policy, and test existing security measures. The CD-ROM contains security and weakness scanners, log analysis tools, firewalls, and other software. Book: < http://www.amazon.com/exec/obidos/ASIN/1555582109/netsecurity > ---------------------------------------------------------------------------- BEGINNING VISUAL BASIC 6 APPLICATION DEVELOPMENT This book puts enterprise-level programming into the hands of intermediate VB users with a capable tour of every facet of multitiered development. This book is all you need to start using server-side objects and Web-based interfaces with VB. What's best here is the comprehensive yet approachable guide to all of the Microsoft tools, APIs, and standards that are needed for using VB to create large enterprise-level applications. This means looking at the three tiers for application partitioning--user, business, and data services--along the lines of Microsoft's recommended practice. The authors cover all of the steps needed to design and code applications in today's corporate environments, along with a solid introduction to UML diagrams. Wherever possible, they make use of tools (like the VB Class Builder) to speed up development; also, the title is chock full of actual screenshots to help you along. Book: < http://www.amazon.com/exec/obidos/ASIN/1861001096/netsecurity > ---------------------------------------------------------------------------- Defaced archives ------------------------ [01.10.2000] - Stanford University Original: http://almond.stanford.edu/ Defaced: http://www.attrition.org/mirror/attrition/2000/10/01/almond.stanford.edu/ [02.10.2000] - Ministerio de Economia, El Salvador Original: http://www.minec.gob.sv/ Defaced: http://www.attrition.org/mirror/attrition/2000/10/02/www.minec.gob.sv/ [03.10.2000] - NTAS Gov (TW) Original: http://www.ntas.gov.tw/ Defaced: http://www.attrition.org/mirror/attrition/2000/10/03/www.ntas.gov.tw/ [03.10.2000] - State of Washington Original: http://dor.wa.gov/ Defaced: http://www.attrition.org/mirror/attrition/2000/10/03/dor.wa.gov/ [03.10.2000] - US DOI, Bureau of Land Management Original: http://adoptahorse.blm.gov/ Defaced: http://www.attrition.org/mirror/attrition/2000/10/03/adoptahorse.blm.gov/ [04.10.2000] - Society for Electronics Test Engineering, India Original: http://www.sete.gov.in/ Defaced: http://www.attrition.org/mirror/attrition/2000/10/04/www.sete.gov.in/ [04.10.2000] - IntiGov (AR) Original: http://ayelen.inti.gov.ar/ Defaced: http://www.attrition.org/mirror/attrition/2000/10/04/ayelen.inti.gov.ar/ [07.10.2000] - Moscow Institute of Physics and Technology Original: http://games.mipt.ru/ Defaced: http://www.attrition.org/mirror/attrition/2000/10/07/games.mipt.ru/ ---------------------------------------------------------------------------- Questions, contributions, comments or ideas go to: Help Net Security staff staff@net-security.org http://net-security.org