💾 Archived View for clemat.is › saccophore › library › ezines › textfiles › ezines › HNS › issue036.… captured on 2022-01-08 at 15:57:07.
⬅️ Previous capture (2021-12-03)
-=-=-=-=-=-=-
Net-Sec newsletter Issue 36 - 30.10.2000 http://net-security.org This is a newsletter delivered to you by Help Net Security. It covers weekly roundups of security events that were in the news the past week. Visit Help Net Security for the latest security news - http://www.net-security.org. Subscribe to this weekly digest on: http://www.net-security.org/text/newsletter Table of contents: 1) General security news 2) Security issues 3) Security world 4) Featured articles 5) Featured books 6) Security software 7) Defaced archives ============================================================ HELP NET SECURITY ANNIVERSARY We are proud to announce the second anniversary of HNS. In these 2 years the site has grown and with dedication and enthusiasm it became all we ever wanted it to be. This doesn't mean we are going to stop here, we'll keep on working to bring you even more updates in all the sections, as well as original content. We would like to take this opportunity to thank all the visitors, contributors, affiliates and advertisers who have been with us these past 2 years and that have supported us, giving us the opportunity to make the site better day by day. If you have any ideas, comments or suggestions, please e-mail us, we would like to hear from you. HNS staff staff@net-security.org ============================================================ General security news --------------------- ---------------------------------------------------------------------------- VIRUS THREAT'S BAD AND GETTING WORSE - ICSA SURVEY The number of corporations infected by viruses this year has risen by 20 percent, with the pace of infections accelerating rapidly, according to a report issued Monday by anti-virus consulting firm ICSA.net. Larry Bridwell, content security program manager for ICSA Labs, and a study co-author, said the company's 2000 report indicates the danger for corporate "virus disasters" is worse now than it has ever been in the six years that ISCA has been conducting its annual virus surveys. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.computeruser.com/news/00/10/24/news7.html SECURITY THROUGH OBSCURITY Is security through obscurity ever a useful way to protect your network, or does it just make things easier for corporate spies and hackers? This week in Unix Security, Carole Fennelly investigates who's benefiting from this security tactic. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.sunworld.com/sunworldonline/swol-10-2000/swol-1013-unixsecurity.html US AND EUROPEAN HACKERS "U.S. hackers are basically proving things to themselves for ego. European hackers include a significant number of individuals motivated by political, religious, and cultural deeply held beliefs," said Gartner Group computer security analyst William Malik. Bob Sullivan did an article, in which he is talking about difference between European and US hackers (at least his point of view). Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.zdnet.com/zdnn/stories/news/0,4586,2644086,00.html BAD SIGNS "Digital signatures are not signatures, and they will never fulfill their promise" - Bruce Schneier's opinion on The Standard. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://thestandard.com/article/display/0,1151,19485,00.html SDF PREPARES TO COMBAT CYBERTERRORISM Japan's Defense Agency (SDF) is set to develop computer systems to combat attempts by cyber attackers to disrupt the country's defense operation by breaking into key computer systems, sources said Monday. Link: http://www.japantimes.co.jp/cgi-bin/getarticle.pl5?nn20001024b5.htm DANISH VIGILANTE CRN has a piece on Danish security company Vigilante and their product - SecureScan - which is an automated Internet security assessment service. Link: http://www.crn.com/sections/Upstart/Upstart.asp?RSID=CRN&ArticleID=20749 FINAL VOTE ON SECRET SEARCHES BILL EXPECTED Urgent alert from DefendYourPrivacy.com's mailing list - "Two weeks ago we warned you about S. 2516, the Fugitive Apprehension Act of 2000, which would empower federal bureaucrats to subpoena your electronic records without a warrant. This bill has now been attached to another piece of legislation -- The Presidential Threat Protection Act (HR 3048) - and is expected to come up for a final vote on Wednesday or Thursday (October 24 or 25.)" Link: http://www.cluebot.com/article.pl?sid=00/10/20/2341243&mode=nested PROTECTING FREEDOM OF EXPRESSION The human rights body of the Organization of American States has approved a declaration that says the "consolidation and development of democracy depends on the very existence of freedom of expression." The OAS's Inter-American Commission on Human Rights calls the declaration, a "fundamental document for the defense of freedom within the inter-American system." Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://cipherwar.com/news/00/freedom_of_expression.htm 'RUMOR' - SHARING AV UPDATES Next week, a Network Associates subsidiary, MyCIO.com, will formally roll out Rumor, a Napster-like file-sharing technology for managing antivirus updates. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.zdnet.co.uk/news/2000/42/ns-18647.html MICROSOFT NETWORK TROJANED INTO Guardian Unlimited and some othr media outlets reportted that Hackers have broken into Microsoft's computer network and may have stolen blueprints to the latest versions of the company's Windows and Office software. And if you read the whole article you will come to the fact that attackers broken into the network by using simple trojan horse program with a bit of social engineering, so they were no hackers in this story. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.guardianunlimited.co.uk/internetnews/story/0,7369,388816,00.html CYBERCRIME DRAFT European Committee On Crime Problems and Committee Of Experts On Crime In Cyber-Space in april released a paper for "Draft Convention On Cyber-Crime" Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://conventions.coe.int/treaty/en/projets/cybercrime.htm MICROSOFT HACKED... NOT The Register - "MS hacked again - 'illuminati terrorists,' this time", IT-Analysis.com - "Microsoft domain falls foul to hacker terrorists" (I presume the first article on this story, as I bookmarked it yesterday, and today lot of online news sites have information on this "issue". So is Microsoft hacked? Not of course... Some reader sent a mail to IT-Analysis.com staff saying that he checked DNS record for Microsoft.com and that they were corrupted. By searching microsoft.com in whois lookup, you come to: MICROSOFT.COM.IS.SECRETLY.RUN.BY.ILLUMINATI.TERRORISTS.NET MICROSOFT.COM So as you could see there was no hacking activity in this case, but just some tactics of creating subdomains similiar to the Microsoft's domain, so it could come out as part of search results. Do whois on Microsoft.com (just whois not a search like these 'journalists' did), and you will see that everything is fine with DNS records. ISLAMIC ATTACKERS CRASH ISRAELI WEB SITES Several Israeli Web sites containing the government's perspective on the Mideast conflict crashed after Islamic groups abroad jammed them with fake traffic. The cyberattack was the most intense since Israel's government launched its Internet sites several years ago, and opens a new front in Israel's confrontation with the Arab world. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.salon.com/tech/wire/2000/10/26/cyberwar/index.html BLACKHAT '00 SINGAPORE - GREG HOGLUND Conference video from Blackhat '00 Singapore - Advanced Buffer Overflow Techniques. This is a technical talk aimed at people who have already been exposed to buffer overflows and want to learn more. The talk assumes the audience has at least some knowledge of CPU's and Processes. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.securityfocus.com/media/71 LINUX FIREWALL SURVEY PART 3 In the final entry of a three-part series of firewall product reviews, Pawel Leszek looks at dedicated appliance firewalls based on Linux. "Fire and forget" is the main idea behind hardware firewall appliances like WatchGuard's Firebox II, the Raptor Firewall from Cobalt and Axent, the Phoenix Adaptive Firewall from Progressive Systems, and the T.Rex firewall appliance from Freemont Avenue Software. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.linuxworld.com/linuxworld/lw-2000-10/lw-10-fwproducts3.html 0BLIVION Issue 8 of 0blivion, a monthly eZine dedicated to security, technology and internet issues, is out. 0blivion is released every month and is read by thousands around the world. So grab a copy today and get reading. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.0blivion.org GLOBAL HACKER AGREEMENT COULD AFFECT BUG HUNTERS The Council of Europe's Draft Convention on Cybercrime aims to foster a common international criminal policy that addresses offenses directed against computer systems, data or networks. The treaty is intended to encourage legislation around the world. More than 40 countries, including the United States, are participating in the treaty, which is set to be signed by December and adopted by the council's Committee of Ministers in early autumn 2001. The treaty could go too far by prohibiting tools commonly used by legitimate computer researchers to discover and fix software vulnerabilities, computer security experts say. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://news.cnet.com/news/0-1005-200-3314003.html YANKEES WEB SITE ATTACKED The team's official site, www.yankees.com, was temporarily closed early Friday. "There was a hacking incident. The Web site was temporarily shut down because of it," Yankees spokesman Rick Cerrone said. "We have turned it over to the FBI and intend to prosecute to the fullest extent of the law." Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.salon.com/tech/wire/2000/10/27/hacker/index.html WAY BACK - WAZZU Surfing trough PSS, I found an article in Cheyenne security newsline from October 1996 which pointed out that the September edition of Microsoft's Solution Provider CD contained a document infected with the WM.Wazzu virus. Old news, but it is interesting how Microsoft employees like viruses/trojans ;) Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://packetstorm.securify.com/advisories/cheyenne/cheyenne.003 DO YOU KNOW IF YOUR DATA IS SAFE? Brian Robison explains what companies need to do above and beyond the firewall level to ensure the protection and integrity of their information assets. This is an excellent non-technical article for the CTO or CIO trying to determine what kinds of safeguards need to be in place at their organization. Link: http://www.securityfocus.com/frames/?content=/templates/forum_message.html%3fforum=2%26head=3649%26id=3649 ---------------------------------------------------------------------------- Security issues --------------- All vulnerabilities are located at: http://net-security.org/text/bugs ---------------------------------------------------------------------------- PHP INFO WWW SEARCH AND SERVER INFO GATHERING The phpinfo() function available from PHP versions gives out a _LOT_ of server information, directories things are installed in, versions etc. Link: http://www.net-security.org/text/bugs/972433288,21401,.shtml POSSIBLE SECURITY ISSUE IN NAV2001 ON WIN2K If you place a virus or other known malware in the c:\_RESTORE folder Norton Antivirus will not scan that folder in a "full-system" scan. This seems to be Symantec�s poor choice not to scan such files? However if you manually scan C:\_RESTORE NAV will find the infected file but won�t be able to delete, repair nor quarantine the file? This could lead a malicious user to drop files into the restore folder - there�re a few obvious ways to exploit this. Link: http://www.net-security.org/text/bugs/972433331,66345,.shtml ALLAIRE'S JRUN PROBLEMS WITH WEB-INF DIRECTORY A severe security flaw exists with Allaire's JRun 3.0 allowing an attacker to access WEB-INF directories on the JRun 3.0 server. The WEB-INF directory tree contains web application classes, pre-compiled JSP files, server side libraries, session information and files such as web.xml and webapp.properties. Link: http://www.net-security.org/text/bugs/972433386,31966,.shtml ALLAIRE JRUN 2.3 ARBITRARY FILE RETRIEVAL Multiple show code vulnerabilities exist in Allaire's JRUN Server 2.3 allowing an attacker to view the source code of any file within the web document root of the web server. Using the same vulnerability, it is also possible to retrieve arbitrary files that lie outside the web document root on the host operating system's file system. Link: http://www.net-security.org/text/bugs/972433407,34255,.shtml ALLAIRE JRUN 2.3 REMOTE COMMAND EXECUTION It is possible to compile and execute any arbitrary file within the web document root directory of the JRUN's web server as if it were a JSP file, even if the file type is not .jsp. If applications running on the JRUN 2.3 server write to files within the web document root directory, it is possible to insert executable code in the form of JSP tags and have the code compiled and executed using JRUN's handlers. This can potentially cause an attacker to gain administrative control of the underlying operating systems. Link: http://www.net-security.org/text/bugs/972433423,22015,.shtml MS - "SESSION ID COOKIE MARKING" BUG PATCHED Microsoft has released a patch that eliminates a security vulnerability in Microsoft Internet Information Server. The vulnerability could allow a malicious user to "hijack" another user's secure web session, under a very restricted set of circumstances. Link: http://www.net-security.org/text/bugs/972435493,54113,.shtml IIS UNICODE - '>' REDIRECT "I was having problems executing a command that contains a redirect (>) using any of the IIS Unicode exploits. In order to get some interesting tools on the victim, you would probably want to have the victim to FTP to the attacker. Problem without redirect is that you cannot build the FTP command file, and you are a bit stuck." Link: http://www.net-security.org/text/bugs/972524142,79006,.shtml "VM FILE READING" VULNERABILITY PATCHED Microsoft has released a patch that eliminates a security vulnerability in the Microsoft virtual machine, that originally was discussed in Microsoft Security Bulletin MS00-011. Like the original vulnerability, the new variant could enable a malicious web site operator to read files from the computer of a person who visited his site or read web content from inside an intranet if the malicious site was visited by a computer from within that intranet. Link: http://www.net-security.org/text/bugs/972524163,7,.shtml SUN SECURITY BULLETIN - BROWSER CERTIFICATES Sun advises of a potential compromise of 2 specific security certificates which had limited distribution. Sun recommends that you follow the directions found at http://sunsolve5.sun.com/secbull/certificate_howto.html to determine if your web browser has accepted any of the potentially compromised certificates. Link: http://www.net-security.org/text/bugs/972524178,81366,.shtml HOTJAVA BROWSER 3.0 JAVASCRIPT BUG There is a security vulnerability in HotJava Browser 3.0 which allows accessing the DOM of arbitrary URLs after viewing a web page. This allows stealing of cookies. The problem is opening an javascript: URL in a named window, which allows accessing the DOM of the document in the named window. Link: http://www.net-security.org/text/bugs/972524196,6460,.shtml WINDOWS (ME) PRINTER SHARING VULNERABILITY "One of the new "features" of Windows ME that immediately caught my eye was that as soon as I got networking up and running it had gone ahead and created shortcuts to all visible network shares and installed all networked printers without even hassling me with one "are you sure" dialog. At first glance it appeared to be nothing more then an annoyance. Later I came to thinking that naturally host machines must keep a list of files needed to install their printer. What if we were to replace one of these files with a trojan? Or perhaps add a trojan onto this list of files?" Link: http://www.net-security.org/text/bugs/972650098,62744,.shtml RED HAT - UPDATED SECURE WEB SERVER PACKAGES Security bugs in versions of Apache prior to 1.3.14 also affect Secure Web Server. A new release which incorporates 1.3.14 is now available. Link: http://www.net-security.org/text/bugs/972694410,70614,.shtml SUSE LINUX - LOCAL ROOT COMPROMISE The ncurses library is used by many text/console based applications such as mail user agents, ftp clients and other command line utilities. A vulnerability has been found by Jouko Pynn�nen in the screen handling functions: Insufficient boundary checking leads to a buffer overflow if a user supplies a specially drafted terminfo database file. If an ncurses-linked binary is installed setuid root, it is possible for a local attacker to exploit this hole and gain elevated privileges. Link: http://www.net-security.org/text/bugs/972694424,49042,.shtml NETBSD - REMOTE EXECUTION OF SHELL COMMANDS When using the CGI interface of the Global v3.55 package, it's possible to execute random commands. The exploit of this is possible due to insufficient handling of quoted or escaped characters in this version, and command line arguments that are then handed off to shell commands. Link: http://www.net-security.org/text/bugs/972694452,89982,.shtml NETBSD - POSSIBLE REMOTE ROOT COMPROMISE The cfd daemon in GNU CFEngine contains several format string vulnerabilities in syslog() calls. This could permit remote hosts to inject the network daemon with a message causing a segmentation fault. As cfd is almost always run as root due to its nature (centralized configuration management), this could lead to a root compromise. Link: http://www.net-security.org/text/bugs/972694471,61555,.shtml PROBLEMS WITH CISCO VCO/4000 SNMP If an attacker knows the read-only community string of a VCO/4K, then they can obtain a list of users and their obfuscated passwords. The obfuscation can be easily reversed, allowing an attacker to obtain additional privileges on the VCO/4K. Link: http://www.net-security.org/text/bugs/972694517,63881,.shtml REMOTE AND LOCAL VULNERABILITIES IN PAM_MYSQL pam_mysql is a pluggable authentication module to allow user authentication against mysql databases. The module constructs SQL statements using user input (username and password) without escaping it. This leads to trivial attacks that can result in the exposure of plaintext passwords/hashes to remote unauthorized login. Link: http://www.net-security.org/text/bugs/972694530,83265,.shtml CISCO CATALYST REMOTE COMMAND EXECUTION Cisco Catalyst 3500 XL series switches have a webserver configuration interface. This interface lets any anonymous web user execute any command without supplying any authentication credentials by simply requesting the /exec location from the webserver. Link: http://www.net-security.org/text/bugs/972694543,5289,.shtml ---------------------------------------------------------------------------- Security world -------------- All press releases are located at: http://net-security.org/text/press ---------------------------------------------------------------------------- BETRUSTED CHOSEN BY NCIPHER TO GUARD ITS EMAIL - [25.10.2000] beTRUSTed(sm), the PricewaterhouseCoopers unit that offers trust services for Internet transactions, has been chosen by leading Internet security company nCipher to help provide its employees with secure email and authenticated network access. nCipher will use beTRUSTed digital certificates to ensure the security of its electronic transactions - nCipher is itself a leading developer of high performance hardware security products for e-commerce and public key infrastructure (PKI) applications. Press release: < http://www.net-security.org/text/press/972432017,44785,.shtml > ----------------------------------------------------------- SECOND G-8 CONFERENCE ON INTERNATIONAL SECURITY - [26.10.2000] Symantec Corp., a world leader in Internet security technology, today announced it has again been invited to join the U.S. delegation at the G-8 Government/Industry Workshop on Safety and Confidence in Cyberspace, to be held Oct. 24 through 26 in Berlin. Ron Moritz, senior vice president and chief technical officer at Symantec, will serve as one of only seven U.S. industry delegates to the conference. The G-8 conference offers a unique opportunity for international government and private sector representatives to meet to discuss ways to combat computer crime. Press release: < http://www.net-security.org/text/press/972432224,44203,.shtml > ---------------------------------------------------------------------------- POINT-AND-CLICK PKI-BASED SIGITAL SIGNATURES - [26.10.2000] E-business security leader Cylink Corporation today announced plans to bundle E-Lock Technologies' digital signature solution with Cylink's public key infrastructure (PKI) to provide a seamless point-and-click solution for securing electronic documents. Together, the solutions will enable healthcare providers, financial institutions and other organizations that handle sensitive electronic documents such as patient records and loan applications to maintain the highest levels of data confidentiality and dramatically streamline document processing Press release: < http://www.net-security.org/text/press/972515023,50852,.shtml > ---------------------------------------------------------------------------- SMART WATCH TOP RATED IN SC MAGAZINE - [26.10.2000] WetStone Technologies is pleased to announce that SMART Watch, the company's premier product offering, earned a perfect 5 star rating from SC Magazine's product review team this October. SMART Watch is a Preemptive Hacker Defense Tool and host based intrusion detection system that detects when key �Watched� Files or Directories have been maliciously or accidentally altered. Press release: < http://www.net-security.org/text/press/972523152,24040,.shtml > ---------------------------------------------------------------------------- NORTON ANTIVIRUS FOR MACINTOSH RELEASED - [26.10.2000] Symantec Corporation, today announced the latest versions of Norton Utilities for Macintosh and Norton AntiVirus for Macintosh. Norton Utilities for Macintosh 6.0 helps customers optimize performance and easily solve problems, such as disk errors, lost or accidentally erased data, or fragmented files. Norton AntiVirus for Macintosh 7.0 detects and repairs infected files to keep personal data safe and secure. Press release: < http://www.net-security.org/text/press/972523671,14261,.shtml > ---------------------------------------------------------------------------- PRIVACY CONFERENCE ANNOUNCED BY ZKS - [27.10.2000] Zero-Knowledge Systems, the leading developer of privacy solutions for consumers and companies, today announced the first annual "Privacy by Design: The Future of Privacy Compliance and Business" conference, sponsored by Royal Bank Financial Group, IBM, Merrill Lynch, and PricewaterhouseCoopers. Bringing world-class privacy experts together with companies implementing privacy practices and solutions, the conference will be held at Le Chateau Montebello, Quebec from November 19 to 21, 2000. Press release: < http://www.net-security.org/text/press/972648319,95401,.shtml > ---------------------------------------------------------------------------- VPN SECURITY FOR FEDERAL LAW ENFORCEMENT - [27.10.2000] V-ONE Corporation (Nasdaq:VONE), a leading provider of Virtual Private Networks (VPN), today announced it has been selected by Louisiana State University (LSU) and their subcontractor, Science Applications International Corporation (SAIC) to provide security for Law Enforcement Online (LEO), the Federal Bureau of Investigation (FBI) project which established the nation's first-ever communications mechanism to link all levels of law enforcement across the country Press release: < http://www.net-security.org/text/press/972648475,5255,.shtml > ---------------------------------------------------------------------------- SPHINX FIREWALL SOLUTION FROM BIODATA - [31.10.2000] Biodata Information Technology, global leader in network and communications security, is recommending that home PC users as well as large corporations take further steps to protect their internal network or personal PC's connected to the Internet through `always on' cable, T1 or DSL connections. The announcement comes as attackers based in St. Petersburg, Russia, successfully employed an attack on Microsoft's network - stealing source code to the company's Windows operating system and Office software suite. Press release: < http://www.net-security.org/text/press/972960020,30864,.shtml > ---------------------------------------------------------------------------- PANEL DISCUSSION ON CYBERCRIME - [31.10.2000] Symantec Corp., a world leader in Internet security, today announced Ron Moritz, senior vice president and chief technical officer at Symantec, has been invited to participate as a panel speaker at the Software Development Conference & Expo (SD 2000), to be held Oct. 29 - Nov. 2, at the Washington Convention Center in Washington D.C Press release: < http://www.net-security.org/text/press/972960112,41653,.shtml > ---------------------------------------------------------------------------- E-SECURITY EXECUTIVE BREAKFAST SERIES - [31.10.2000] AXENT Technologies, Inc., one of the world's leading Internet security solutions providers for e-business, which recently entered into a definitive merger agreement with Symantec Corporation, today announced their sponsorship of AXENT's Executive Breakfast Series for CXOs, senior level VPs, and senior management of Fortune 1000 companies. The series will feature Scott Charney, former Department of Justice chief of computer crime division, who will engage attendees by discussing his cyber-crime experiences and will offer a vision for executives on how to effectively minimize their e-business security risks. Press release: < http://www.net-security.org/text/press/972960272,57108,.shtml > ---------------------------------------------------------------------------- TRIPWIRE LINUX EDITION NOW AVAILABLE - [31.10.2000] Tripwire, Inc., the leading provider of data and network integrity solutions, today announced the availability of its Open Source product for the Linux operating system. Delivering on the commitment made earlier this year, Tripwire Open Source, Linux Edition is hosted on VA Linux Systems' SourceForge, the world's largest Open Source development center. The software is also included on the recently announced Red Hat Linux 7 Open Source Operating System. Tripwire Open Source, Linux Edition will continue to be integrated into other Linux solutions. Press release: < http://www.net-security.org/text/press/972960761,34362,.shtml > ---------------------------------------------------------------------------- Featured articles ----------------- All articles are located at: http://www.net-security.org/text/articles Articles can be contributed to staff@net-security.org Below is the list of the recently added articles. ---------------------------------------------------------------------------- BEWARE THE PIF! - A DANGEROUS MONSTER CAN HIDE BENEATH HARMLESS FILES Kaspersky Lab, an international anti-virus software development company, considers it necessary to draw users' attention to a threat that programs with PIF extension can pose to the normal operating of personal computers and corporate networks. Because of the lack of awareness of this problem Kaspersky Lab has began to receive numerous reports of virus infections caused by this type of malicious program. Read more: < http://www.net-security.org/text/articles/viruses/pif.shtml > ---------------------------------------------------------------------------- VIRUSES: THEN AND NOW by Randy M. Nash Computer viruses and the people who engineer them have grown smarter and more devious as technology has grown. Early computer viruses would attach themselves to executable files (either .COM or .EXE), or would infect diskettes and hard drives. They were silent, irritating, and sometimes devastating. They were commonly passed via floppy diskette when sharing files between one computer and another. They had such names as Stoned and Anti.Exe. That was then. Read more: < http://www.net-security.org/text/articles/viruses/tan.shtml > ---------------------------------------------------------------------------- THE HISTORY OF ZERO KNOWLEDGE SYSTEMS by Jordan Socran Austin & Hamnett Hill - the brothers behind Zero-Knowledge Systems, were involved with the Internet at a very young age. At 21 Austin founded the ISP Infobahn Online Services with money from his father and a small group of investors. They soon called upon Hamnett, a 23 year-old reformed Deadhead studying accounting in Montana, to be CFO... Read more: < http://www.net-security.org/text/articles/zks.shtml > ---------------------------------------------------------------------------- PASSWORDS - THE WEAK LINK by Randy M. Nash A chain is only as strong as its weakest link. In the security world, that weak link is the human element, and it manifests in the poor management of user passwords. As our society becomes increasingly wired we need to remember an increasingly large number of accounts, PINs, and passwords. Read more: < http://www.net-security.org/text/articles/passwords.shtml > ---------------------------------------------------------------------------- ONLINE SECURITY: WHAT'S YOUR APPROACH? by Randy M. Nash In the rush to get online, many companies consider security as an afterthought. The hurry to develop an online presence causes them to overlook the obvious... they could be compromised. Many companies are willing to accept this. They consider themselves too "low profile" to be at risk. The reality is, you don't have to be an e-Bay, Yahoo, or e-Trade to get attacked. Systems are compromised for several reasons. Read more: < http://www.net-security.org/text/articles/approach.shtml > ---------------------------------------------------------------------------- Featured books ---------------- The HNS bookstore is located at: http://net-security.org/various/bookstore Suggestions for books to be included into our bookstore can be sent to staff@net-security.org ---------------------------------------------------------------------------- LINUX KERNEL INTERNALS This book is written for anybody who wants to learn more about Linux. It explains the inner mechanisms of Linux from process scheduling to memory management and file systems, and will tell you all you need to know about the structure of the kernel, the heart of the Linux operating system. CD-ROM included. Book: < http://www.amazon.com/exec/obidos/ASIN/0201331438/netsecurity > ---------------------------------------------------------------------------- EXAM CRAM CCNP ROUTING (EXAM CRAM) The book sports some of the snappiest writing ever to grace an Exam Cram book which is good, because routing concepts are tricky little devils that you just can't memorize. You need to internalize how each of the various protocols works, and not just snarf down some list of functions. The explanations for the reason that each protocol (RIP, OSPF, EIGRP, BGP) was developed and how it's implemented are well written and concise. The occasional spot illustration helps flesh out your knowledge of how routers share information under each protocol. If you've been a trifle unclear on what the precise differences are between the various routing approaches, this is where all will be revealed. Later sections of the book deal with traffic management and routing updates, and do it well, mixing a bit of real-world experience with lectures to give a well-rounded approach. Sadly, information on actual router configuration is fairly spotty, so probably you'll want to write down some additional cheat sheets for the actual configuration commands. Book: < http://www.amazon.com/exec/obidos/ASIN/1576106330/netsecurity > ---------------------------------------------------------------------------- MICROSOFT WINDOWS ME SECRETS For nearly a decade, Brian Livingston and Davis Straub have been tracking down the shortcuts, fixes, and workarounds that let you get more done - and have more fun - with Microsoft Windows. From streamlining Internet access to tweaking the Registry, their latest guide delivers hundreds of Windows Me secrets that will take your productivity to a new level. Book: < http://www.amazon.com/exec/obidos/ASIN/0764534939/netsecurity > ---------------------------------------------------------------------------- THE NEW HACKER'S DICTIONARY This third edition of the tremendously popular Hacker's Dictionary adds 100 new entries and updates 200 entries. In case you aren't familiar with it, this is no snoozer dictionary of technical terms, although you'll certainly find accurate definitions for most techie jargon. It's the slang and secret language among computer jocks that offers the most fun. Don't know what the Infinite-Monkey Theorem is? Or the meaning of "rat dance?" It's all here. Most people don't sit down to read dictionaries for entertainment, but this is surely an exception. Book: < http://www.amazon.com/exec/obidos/ASIN/0262680920/netsecurity > ---------------------------------------------------------------------------- Security Software ------------------- All programs are located at: http://net-security.org/various/software ---------------------------------------------------------------------------- FWLOGWATCH 0.0.22 fwlogwatch 0.0.22 is a RUS-CERT (Universitat Stuttgart Computer Emergency Response Team) project to build an ipchains packet filter log analyzer with text and html summary output, interactive incident report generator, and realtime anomaly response capability Link: < http://net-security.org/various/software/972384323,89827,.shtml > ---------------------------------------------------------------------------- ETHEREAL 0.8.13 Ethereal is a free network protocol analyzer for Unix and Windows. It allows you to examine data from a live network or from a capture file on disk. You can interactively browse the capture data, viewing summary and detail information for each packet. Ethereal has several powerful features, including a rich display filter language and the ability to view the reconstructed stream of a TCP session Link: < http://net-security.org/various/software/972687117,59532,.shtml > ---------------------------------------------------------------------------- MIMEDEFANG V.0.5 With the proliferation of e-mail trojans and viruses, e-mail is becoming a preferred mechanism for attacking PC's. The best way to avoid these trojans and viruses is not to use any insecure client software on your PC (especially software from Microsoft, which is notorious for security problems.) Use Linux as your operating system and one of many excellent e-mail packages as your mail client Link: < http://net-security.org/various/software/972729772,36460,.shtml > ---------------------------------------------------------------------------- TRIPWIRE 2.3.47 Tripwire is a very popular file integrity checker which saves checksums of selected files in a database. Any changes to these files are flagged and logged, including those that were added or deleted, with optional email / pager reporting. Databases and reports are cryptographically signed. Link: < http://net-security.org/various/software/972961108,21294,.shtml > ---------------------------------------------------------------------------- Defaced archives ------------------------ [23.10.2000] - North Eastern Wisconsin Linux Users Group Original: http://www.newlug.org/ Defaced: http://www.attrition.org/mirror/attrition/2000/10/23/www.newlug.org/ [24.10.2000] - Easy (YU) Original: http://www.easy.co.yu/ Defaced: http://www.attrition.org/mirror/attrition/2000/10/24/www.easy.co.yu/ [24.10.2000] - Philippine Air Force Original: http://paf.mil.ph/ Defaced: http://www.attrition.org/mirror/attrition/2000/10/24/paf.mil.ph/ [25.10.2000] - FSCIT Mil (SE) Original: http://www.fscit.mil.se/ Defaced: http://www.attrition.org/mirror/attrition/2000/10/25/www.fscit.mil.se/ [25.10.2000] - FHS Mil (SE) Original: http://www.fhs.mil.se/ Defaced: http://www.attrition.org/mirror/attrition/2000/10/25/www.fhs.mil.se/ [25.10.2000] - Honda Motor Company Singapore Original: http://www.honda.com.sg/ Defaced: http://www.attrition.org/mirror/attrition/2000/10/25/www.honda.com.sg/ [25.10.2000] - Letterkenny Institute of Technology Original: http://dns2.lyit.ie/ Defaced: http://www.attrition.org/mirror/attrition/2000/10/25/dns2.lyit.ie/ [26.10.2000] - Mercedes Benz Original: http://www.mercedes-benz.ca/ Defaced: http://www.attrition.org/mirror/attrition/2000/10/26/www.mercedes-benz.ca/ [26.10.2000] - World Brokers Original: http://www.world-brokers.com/ Defaced: http://www.attrition.org/mirror/attrition/2000/10/26/www.world-brokers.com/ [26.10.2000] - Leonardo DiCaprio Original: http://www.leonardodicaprio.com/ Defaced: http://www.attrition.org/mirror/attrition/2000/10/26/www.leonardodicaprio.com/ [27.10.2000] - Atlas Security Original: http://www.atlassecurity.co.za/ Defaced: http://www.attrition.org/mirror/attrition/2000/10/27/www.atlassecurity.co.za/ [27.10.2000] - Ford Motors, Brasil Original: http://www.ford.com.br/ Defaced: http://www.attrition.org/mirror/attrition/2000/10/27/www.ford.com.br/ [27.10.2000] - Windows Guru Original: http://www.windowguru.com/ Defaced: http://www.attrition.org/mirror/attrition/2000/10/27/www.windowguru.com/ [28.10.2000] - Governo Do Estado De Sao Paulo Original: http://www.araraquara.sp.gov.br/ Defaced: http://www.attrition.org/mirror/attrition/2000/10/28/www.araraquara.sp.gov.br/ [28.10.2000] - AntiOnline Original: http://www.antionline.com/ Defaced: http://www.attrition.org/mirror/attrition/2000/10/28/www.antionline.com/ ---------------------------------------------------------------------------- Questions, contributions, comments or ideas go to: Help Net Security staff staff@net-security.org http://net-security.org