Copy Link
Add to Bookmark
Report
Net-Sec Issue 028
Net-Sec newsletter
Issue 28 - 06.08.2000
http://net-security.org
Net-Sec is a newsletter delivered to you by Help Net Security. It covers weekly
roundups of security events that were in the news the past week.
Visit Help Net Security for the latest security news - http://www.net-security.org.
Subscribe to this weekly digest on:
http://www.net-security.org/text/newsletter
Table of contents:
1) General security news
2) Security issues
3) Security world
4) Featured articles
5) Security books
6) Security software
7) Defaced archives
============================================================
Sponsored by VeriSign - The Internet Trust Company
============================================================
Secure all your Web servers now - with a proven 5-part strategy.
The FREE Server Security Guide shows you how:
* DEPLOY THE LATEST ENCRYPTION and authentication techniques
* DELIVER TRANSPARENT PROTECTION with the strongest security
without disrupting users. And more. Get your FREE Guide now:
http://www.verisign.com/cgi-bin/go.cgi?a=n061210570003000
============================================================
General security news
---------------------
----------------------------------------------------------------------------
INFO.SEC.RADIO
IFR broadcast featuring the 2nd installment in a new four part series on Hacking
Through the Ages, including part II of an interview with Kevin Mitnick. David A
hmed also takes a look at the previous weeks top vulnerabilities. Part two of the
Hot Topic series on Hacking Through the Ages looks at the following issues: The
hacking renaissance, The Legion of Doom and Masters of Deception.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.securityfocus.com/media/58
NORTON ANTIVIRUS FREEZES SOME PCS
Users of Norton AntiVirus 4.0 and later versions have reported a slew of problems
with the product, including annoying computer freeze-ups. With these system
hangs, pressing Ctrl-Alt-Delete produces the error message "Msgsrv32.exe (Not
responding)." ScanDisk may then create numerous temporary subdirectories
(named DIR00000, DIR00001, and so on) that you can't easily remove.
Link: http://www.pcworld.com/heres_how/article/0,1400,17680+1+0,00.html
RABOBANK DENIES RUMORED ATM BREACH
A rumor on the Dutch e-security site Security.nl suggested that between 10.30
and 11.00 p.m. on June 2, it was possible, due to a system error in Rabobank's
credit system, to empty ATMs across the Netherlands by simply entering a valid
account password.
Link: http://www.securitywatch.com/scripts/news/list.asp?AID=3796
ANCIENT VIRUS CATCHES OUT US GOVERNMENT
The US government has been accused of scaremongering after issuing a security
alert about a a Trojan horse called DonaldD.trojan which was discovered more
than a year ago.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.vnunet.com/News/1110145
PALM TROJAN UPDATE
Relating to all the hype about last week's situation with Palm trojan, read a brief
update. As posted on PalmStation.com by J.Brown - "I have learned from two
separate sources today that both Aaron Ardiri and Gambit Studios - creators of
the Liberty Gameboy emulator for Palm - will be sued for damages by an individual
who had their Palm data destroyed by Ardiri's fake Liberty crack last week."
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.palmstation.com/
SECURE REMOTE BACKUPS
What do you do when your site is attacked or your system fails? Backup, Avi
Rubin argues, is the most reliable way to ensure that what you've lost can be
recovered. Here he takes a look at protecting your backup and recommends some
products that can help.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.sunworld.com/sunworldonline/swol-08-2000/swol-0811-remote.html
NEW PHILIPPINES VIRUS A LOW RISK
The U.S. National Infrastructure Protection Center has issued a warning about a
new computer computer virus originating from the Philippines which bears a
resemblance to the 'Love' bug. The virus was first detected on Friday, and has
been infecting some computer users this Labor Day weekend. But anti-virus experts
told MSNBC that there have not been any reports of widespread infections.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.zdnet.com/zdnn/stories/news/0,4586,2623456,00.html
SITUATION IN AUSTRALIA
"There are at least 20 readily identifiable unauthorised attempts to access defence
systems through defence's firewalls each day," a Departmentof Defence report said.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://news.com.au/common/story_page/0,4057,1157013%255E421,00.html
HFCHECK (UN)AVAILABLE
Microsoft released a new tool that is designed to help administrators ensure that
their servers are up to date on all IIS 5.0 security patches. The link on their tools
section is broken, and in a real quick reply on my mail, they said: "We apologize for
the error. We are looking into the situation and will correct it as soon as we can -
it may be Tuesday until it is available - Monday is a holiday, and our team has no
access to the download center pages."
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.microsoft.com/technet/security
A POCKET GUIDE TO NSA SABOTAGE
"The NSA engages in sabotage, much of it against American companies and
products. One campaign apparently occurred at about the time when PGP's most
serious vulnerability was added."
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://cryptome.org/nsa-sabotage.htm
ICMP USAGE IN SCANNING VERSION 2.0
The Internet Control Message Protocol is one of the debate full protocols in the
TCP/IP protocol suite regarding its security hazards. There is no consent between
the experts in charge for securing Internet networks (Firewall Administrators,
Network Administrators, System Administrators, Security Officers, etc.) regarding
the actions that should be taken to secure their network infrastructure in order to
prevent those risks. In this paper Ofir Arkin has tried to outline what can be done
with the ICMP protocol regarding scanning.
Link: http://www.net-security.org/various/bookstore/ICMP_Scanning_v2.0.pdf
FREE 30 DAY TRIAL COPY OF SCANMAIL
Trend Micro is offering 30-day free trial copy of ScanMail for Exchange. Try it out
if you need that kind of protection.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.antivirus.com/products/smex
TOP TEN VIRUSES
Sophos published the latest in a series of monthly charts counting down the ten
most frequently occurring viruses compiled on one place. Kakworm leads in the top
ten with almost 19%.
Link: http://www.net-security.org/text/press/967860803,96551,.shtml
PRIVACY ADD-ON FROM MICROSOFT
Microsoft released a browser add-on Friday intended to provide users with greater
control over the browser-tracking cookies handed out by websites.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.wired.com/news/technology/0,1282,38578,00.html
ANOTHER "HACKING" CHALLENGE
Beginning today, you are invited to take a shot at penetrating the security of
Balistraria Technologies Inc. netMIND Internet firewall appliance. The prize is $1000.
Altought all contests are media stunts, why not to try to snatch their $1K :) More
information could be found on the URL below.
Link: http://www.net-security.org/text/press/967859104,50716,.shtml
TROUBLE WITH SMS MESSAGES FOR NOKIA PHONES
Security Watch reports that "Web2Wap has discovered that a Nokia 7110 mobile
phone can be jammed if it receives a malformed SMS message. The company says
the only way to restore service is to unplug and replug the phones batteries." Also
one of our readers Tom, replied on the article we run entitled "Kaspersky Lab
Demystifies the Discovery of the First True Wireless Virus", saying: "It obviously isn't
a virus. I'd more consider it a denial of service attack. Anyway I presume you know
how its done, but if you don't here is the info - just send a nokia 5110 160 full stops
in an sms message. It will only work on older software version's though. I'm not sure
what software versions exactly but this has be known for quite some time now." I just
tested this with my Nokia 3210 (running older software), and nothing happened.
Link: http://www.net-security.org/phorum/list.php?f=2
@STAKE JILTS PHIBER OPTIK
When Mark Abene aka Phiber Optik found himself being wooed last month by security
services firm @stake, he didn't expect his hacker earlier to come back to haunt him -
in the final phases of hiring they withdrew its offer saying: "We ran a background check".
BTW if you have any comments, HNS forum is alive you know :)
Link: http://www.securityfocus.com/news/79
CYBERCRIME LOSES
The figures in an annual computer crime and security survey presented to congress
by the Federal Bureau of Investigation and the Computer Security Institute polled
643 companies and government agencies, which reported total financial losses
of $265m last year, compared with $120m the previous year.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.bday.co.za/bday/content/direct/0,3523,688861-6129-0,00.html
ANTIFRAUD MEASURES
The Halifax bank has responded to growing concerns over online
security Monday by offering antifraud measures and antivirus services
to its customers.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.zdnet.co.uk/news/2000/34/ns-17551.html
INEXPENSIVE MEASURES TO SOLVE SECURITY PROBLEMS
Computer security is difficult to achieve. It requires constant vigilance, and it
involves inconvenience. Sometimes, expensive products are offered that are
claimed to solve your security problems with no problems, and they do not deliver.
However, there are a number of inexpensive measures that would seem to solve
a lot of security problems that aren't being used.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.securityportal.com/topnews/magic20000901.html
WATERMARKING TO PREVENT HOAXES
Blue Spike, a company that already produces digital watermarking technologies
for video and audio files, started to develop technology that would make it
possible for Internet Wire and others to verify the electronic text documents
they receive.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.techweb.com/wire/story/TWB20000831S0009
DOS ON ST GEORGE BANK SERVERS
After thousands of St George Bank customers were denied access to its online
banking service, police started investigating this Denial of Service attack.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://news.com.au/common/story_page/0,4057,1150199%255E421,00.html
ARRESTED IN EMULEX HOAX STORY
A 23-year-old college student was arrested Thursday and charged with staging
one of the biggest financial hoaxes ever on the Interne. Of course we are talking
about Emulex hoax.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://news.excite.com/news/r/000831/17/tech-emulex-arrest-dc
15 YEAR OLD FINED FOR THE ATTACK
An Indonesian teenager who penetrated to one Singapore site from, was slapped
with a hefty fine, and his parents told to reimburse the National University of
Singapore, it was reported yesterday.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.it.fairfax.com.au/breaking/20000901/A40585-2000Sep1.html
SECURITY MARKET
Lisa Meyer from RedHerring.com did an overview on the security market. According
to the article Baltimore Technologies was quick to deny rumors that U.S computer
giant Microsoft was considering a takeover bid.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://cgi.cnnfn.com/output/pfv/2000/08/31/technology/herring_security/
----------------------------------------------------------------------------
Security issues
---------------
All vulnerabilities are located at:
http://net-security.org/text/bugs
----------------------------------------------------------------------------
MICROSOFT NT "UN-REMOVABLE USER" VULNERABILITY.
A vulnerability exists in the Microsoft Windows NT operating system in which a
userid can be added which conations special characters which are normally not
allowed. These special userids can not be removed using the normal user
management interface as supplied from Microsoft.
Link: http://www.net-security.org/text/bugs/968205910,32013,.shtml
WIRELESS INC. WAVELINK 2458 FAMILY VULNERABILITY
I have recently been afforded the opportunity of playing with some of the
Wavelink equipment. Namely the Wavelink 2458. I noticed that the very
powerful HTML config (cgi?) engine required a password/username to
authenticate users before they could proceed...
Link: http://www.net-security.org/text/bugs/968178941,36972,.shtml
IE 5.5 CROSS FRAME SECURITY VULNERABILITY
Internet Explorer 5.5 under Windows 98 (suppose all other versions are also
vulnerable) allows circumventing "Cross frame security policy" by accessing
the DOM of documents using JavaScript and WebBrowser control. This
exposes the whole DOM of the target document and opens lots of security
risks. This allows reading local files, reading files from any host, window
spoofing, getting cookies, etc. Reading cookies from arbitrary hosts is
dangerous, because some sites use cookies for authentication.
Link: http://www.net-security.org/text/bugs/968176956,15888,.shtml
WFTPD/WFTPD PRO 2.41 RC12 VULNERABILITY
Problem: WFTPD will crash if a large string consisting of characters 128-255
is received. A valid user/pass combination is not required to take advantage
of this flaw.
Link: http://www.net-security.org/text/bugs/968165212,29464,.shtml
SCREEN 3.9.5 ROOT VULNERABILITY
A vulnerability exists in the program "screen" version 3.9.5 and earlier. If
screen is installed setuid root, a local user may gain root privilege. There
are many systems where the program isn't setuid root by default, but on
many systems (afaik at least SuSE Linux, Red Hat 5.2 and earlier, *BSD
ports packages, Solaris, other commercial unices) it is, making them vulnerable.
Link: http://www.net-security.org/text/bugs/968165118,74523,.shtml
ARBITRARY FILE DISCLOSURE THROUGH PHP FILE UPLOAD
The way that PHP handles file uploads makes it simple to trick PHP
applications into working on arbitrary files local to the server rather than
files uploaded by the user. This will generally lead to a remote attacker
being able to read any file on the server that can be read by the user
the web server is running as, typically 'nobody'.
Link: http://www.net-security.org/text/bugs/968074710,61298,.shtml
MULTIPLE QNX VOYAGER ISSUES
QNX is a whole operating system aimed at the embedded computing market.
They currently have on release two demo disks (One for network access,
one for modem access), which boast an integrated web server and web
browser (Voyager). The main problem stems from the ability to navigate
the whole file system by using the age old ".." paths. From the web
server root /../../ will take you to the file system root where there are
a number of interesting files which can be viewed...
Link: http://www.net-security.org/text/bugs/968007528,50501,.shtml
[CONECTIVA LINUX] GLIBC UPDATE
The ld.so dynamic library loader has a bug in its implementation of
unsetenv(). This function does not removes all instances of an environment
variable. Before running a SUID program, ld.so clears some dangerous
variables, LD_PRELOAD included. By crafting a special environment, an
attacker could make this variable slip through this inefficient check. If the
SUID application calls another program without cleaning up the environment,
this variable will be honored and shared libraries under the attacker's control
will be executed, most likely giving him/her a root shell.
Link: http://www.net-security.org/text/bugs/968007041,17867,.shtml
SUNFTP VULNERABLE TO TWO DOS ATTACKS
SunFTP is a small FTP server written in Delphi. This product contains a few
vulnerabilities in its socket module. First, it is possible to cause it to overflow
its receiving buffer. Second, SunFTP can be crashed remotely by disconnecting
the session without sending a complete command.
Link: http://www.net-security.org/text/bugs/967856399,70947,.shtml
----------------------------------------------------------------------------
Security world
--------------
All press releases are located at:
http://www.net-security.org/text/press
----------------------------------------------------------------------------
INVINCIBLENET.COM - ADDITION TO THEIR SECURITY PRODUCTS - [28.08.2000]
Technology holding company M&A West Inc. announced that its subsidiary,
InvincibleNet.com is expanding its online suite of security products to include
VeriSign's Secure Site services. In keeping with its plan to build on its initial
successful launch and sales of Identix Inc.'s BioLogon technology, M&A West's
online security application site InvincibleNet.com has moved into its second
phase of development by signing a resale agreement with VeriSign, a leading
provider of online eCommerce functions including authentication, validation
and payment.
Press release:
< http://www.net-security.org/text/press/967471262,50129,.shtml >
----------------------------------------------------------------------------
SECURE ONLINE TRANSACTIONS FOR FOGDOG.COM - [28.08.2000]
Rainbow Technologies, a leading provider of high-performance security solutions
for the Internet and e-commerce, announced that online sporting goods retailer
Fogdog Sports has selected Rainbow CryptoSwift eCommerce accelerator to
power secure online customer transactions and optimize Web server performance.
"Now is the time for e-commerce retailers to prepare for the coming holiday
shopping season crush," said Robert Shields, director of strategic marketing,
Rainbow Technologies. "CryptoSwift will help Fogdog's customers quickly access
the online check-out counter.
Press release:
< http://www.net-security.org/text/press/967471329,54575,.shtml >
----------------------------------------------------------------------------
NEW INTRUSION PREVENTION PRODUCT BY SYMANTEC - [28.08.2000]
Symantec Corp. announced a new enterprise intrusion prevention product line,
Symantec Desktop Firewall 2.0. The product provides administrators and end
users a manageable, easy-to-use solution to protect corporate information that
resides on remote users' systems. Symantec Desktop Firewall prevents hackers
from gaining access to corporate networks through remote systems, and defends
organizations from involuntary involvement in Distributed Denial of Service (DoS)
attacks. The Symantec Desktop Firewall is also a key component of Symantec
Enterprise Security - a comprehensive, multi-tier and modular Internet security
solution for enterprise computing environments.
Press release:
< http://www.net-security.org/text/press/967471394,13603,.shtml >
----------------------------------------------------------------------------
iDEFENSE AND SCOWCROFT ANNOUNCE PARTNERSHIP - [28.08.2000]
iDEFENSE Inc., a leading provider of cyber intelligence and e-security services,
and the Scowcroft Group, a major strategic consulting firm, announced a
strategic partnership to work cooperatively in driving an awareness of
cyber-threat issues at the CEO and Boardroom level. General Brent Scowcroft,
CEO of the Scowcroft Group and former National Security Advisor, explains the
rationale for the alliance, "The Scowcroft Group's experience in supporting the
international activities of some of America's leading technology and financial
service firms give us insight into the need for the capabilities that iDEFENSE
offers. We look forward to cooperating with iDEFENSE to bring its unique
solutions to the attention of companies at risk."
Press release:
< http://www.net-security.org/text/press/967471453,34667,.shtml >
----------------------------------------------------------------------------
SONICWALL SHIPS TRUSTED VPN SOLUTION - [2.08.2000]
SonicWALL, Inc., the leading provider of Internet security for broadband access
customers, announced the availability of SonicWALL Trusted VPN. SonicWALL
announced an agreement with VeriSign, Inc., the leading provider of Internet
trust services, on April 11, 2000 to jointly develop strong authentication
services for small businesses such as professional offices, branch offices and
telecommuters. SonicWALL Trusted VPN leverages VeriSign's digital certificate
services to authenticate individuals and network devices for Virtual Private
Networking (VPN) and e-commerce applications.
Press release:
< http://www.net-security.org/text/press/967471499,66083,.shtml >
----------------------------------------------------------------------------
SECURANT TECHNOLOGIES AND SITELITE PARTNER - [28.08.2000]
Securant Technologies, the company that secures e-business, and SiteLite, a
management services provider (MSP) and founding member of the newly formed
MSP Association, today announced a strategic partnership to provide joint
solutions that protect e-business resources from application misuse and fraud.
Through the partnership, SiteLite will provide its eSystems Availability
Management (eSAM) services to monitor Securant's ClearTrust SecureControl
access management system. This integrated product monitors user access and
interaction with e-business resources on a 24 x 365 basis, and can take
aggressive counter measures in the event of a security breach.
Press release:
< http://www.net-security.org/text/press/967471597,92575,.shtml >
----------------------------------------------------------------------------
XCERT ANNOUNCES SENTRY KEY RECOVERY MODULE - [29.08.2000]
Xcert, a leading provider of software products for securing Internet business-to
-business transactions and communications, has announced a new software
module enabling users to store and recover encrypted data without compromising
security. Developed in response to regulations mandating minimum storage and
retrieval periods for data, the Sentry Key Recovery Module(TM), supported by
nCipher hardware, is an optional software package for Xcert's Sentry CA, a full
-featured certificate authority application for Public Key Infrastructure solutions.
Press release:
< http://www.net-security.org/text/press/967518355,22044,.shtml >
----------------------------------------------------------------------------
eTOKEN TECHNOLOGY EXTENDS TO INDIA - [29.08.2000]
Aladdin Knowledge Systems, a global leader in the field of Internet content and
software security, announced its eToken Technology partnership with India
based Miel e-Security will provide the region's users with a variety of e-security
solutions, including enhanced authentication and mobile computing. "Our
Technology Partnership with Miel e-Security recognizes the innovative PKI and
e-commerce solutions Miel is developing for the exciting Indian Internet
economy," said Joe Krull, CPP, Aladdin's Vice President, eToken.
Press release:
< http://www.net-security.org/text/press/967570334,93369,.shtml >
----------------------------------------------------------------------------
TOSHIBA PARTNERS WITH SYMANTEC - [29.08.2000]
Toshiba America Information Systems Inc., Network Products Division announced
that it has signed an agreement with Symantec Corp. to add an additional layer
of security for Toshiba's cable modem customers against risks associated with
Internet usage. The agreement will allow Toshiba to bundle Symantec's award
winning Norton Internet Security 2000 Family Edition, an integrated security and
privacy suite for the family, with all of its Data Over Cable Service Interface
Specification PCX1100 cable modems sold via retail. The software will begin
shipping with Toshiba's retail cable modems in Q3 2000.
Press release:
< http://www.net-security.org/text/press/967570384,16051,.shtml >
----------------------------------------------------------------------------
FOUNDSTONE OFFERS HACKER INVESTIGATION CLASSES - [30.08.2000]
Foundstone, the premier computer security training and consulting company,
announced a new series of computer security classes, Ultimate Incident
Response: Hands On. The classes will teach the computer forensics techniques
to recognize, respond to, and recover from outsider and insider attacks to the
network. The first class will be held in Washington DC on Sept. 11, with additional
classes scheduled for New York and Boston. Participants will learn the science of
incident response through four days of presentations and hands-on lab exercises.
Topics covered will include "Incident Detection," "Tracking Backdoor and Privilege
Escalation Attacks," "Incident Investigation," and "Evidence Collection."
Press release:
< http://www.net-security.org/text/press/967668358,65315,.shtml >
----------------------------------------------------------------------------
TRIPWIRE PARTNERS WITH SECURITYFOCUS.COM - [30.08.2000]
Tripwire Inc., the leading provider of integrity assessment solutions, announced
its partnership with SecurityFocus.com, the premier security information portal,
to provide critical security industry content in an effort to expand the knowledge
-level and education of Tripwire's customer base. The first initiative from the
partnership will be the Tripwire Newsletter, a monthly online publication providing
critical and timely industry updates such as security alerts, market news and
events, recommended reading, and the latest Tripwire product information.
Press release:
< http://www.net-security.org/text/press/967668802,93468,.shtml >
----------------------------------------------------------------------------
CYLINK ACQUIRES CELOTEK CORPORATION - [31.08.2000]
Cylink Corporation has completed its previously announced acquisition of Celotek
Corporation, a privately held developer of high-performance Asynchronous
Transfer Mode (ATM) network security appliances used to secure voice, video
and data transmissions over high-speed public and private wide area networks.
Celotek has supplied the ATM encryption appliances that Cylink, under private
label, sells to Fortune 500 companies, government agencies, and major financial
organizations around the world.
Press release:
< http://www.net-security.org/text/press/967742394,69718,.shtml >
----------------------------------------------------------------------------
Featured articles
-----------------
All articles are located at:
http://www.net-security.org/text/articles
Articles can be contributed to staff@net-security.org
Listed below are some of the recently added articles.
----------------------------------------------------------------------------
INTRUSION DETECTION WITHIN A SECURED NETWORK by OptikNerve
This file describes how to detect an intrusion within a secured network for the
system's administrator. The programs that are used in this text file are:
RealSecure 3.0, Centrax 2.2, and AXENT NetProwler.
Article:
< http://www.net-security.org/text/articles/intrusion-detection.shtml >
----------------------------------------------------------------------------
INTERVIEW WITH MATT CONOVER (SHOK)
He is the author of "Console IOCTLs Under Linux" and member of w00w00
Security Development, that with 30+ active members, is currently the largest
non-profit security team in the world.
Interview:
< http://www.net-security.org/text/articles/interviews/matt.shtml >
----------------------------------------------------------------------------
KASPERSKY LAB DEMYSTIFIES THE DISCOVERY OF THE FIRST WIRELESS VIRUS
Because of the numerous user requests regarding the discovery of the first true
wireless virus for mobile phones, Kaspersky Lab, an international anti-virus
software development company, considers it necessary to clarify the issue.
Article:
< http://www.net-security.org/text/articles/viruses/wireless.shtml >
----------------------------------------------------------------------------
INTERVIEW WITH LANCE SPITZNER
We interviewed Lance Spitzner, a former officer in the Army's Rapid Deployment
Force, and the author of numerous Whitepapers on computer security. In his
own words: "I'm a geek who constantly plays with computers, especially network
security. I love security because it is a constantly changing environment, your
job is to do battle with the bad guys."
Interview:
< http://www.net-security.org/text/articles/interviews/spitzner.shtml >
----------------------------------------------------------------------------
A NEW GENERATION OF WINDOWS 2000 VIRUSES
Kaspersky Lab announces the discovery of W2K.Stream virus, which represents
a new generation of malicious programs for Windows 2000. This virus uses a
new breakthrough technology based on the "Stream Companion" method for
self-embedding into the NTFS file system.
Interview:
< http://www.net-security.org/text/articles/viruses/generation.shtml >
----------------------------------------------------------------------------
HYPE AROUND MALICIOUS CODE FOR HANDHELDS
The new virus war zone: Your PDA", "Take care of the Palm virus", "Virus attacks
portable devices" etc - these are titles of some of the articles that pointed out
"serious security issue" with Palm Pilot hand held device. I read literally about
30-40 different articles, and the main point of most of them was - raising FUD.
Interview:
< http://www.net-security.org/text/articles/hype.shtml >
----------------------------------------------------------------------------
Featured books
----------------
The HNS bookstore is located at:
http://net-security.org/various/bookstore
Suggestions for books to be included into our bookstore
can be sent to staff@net-security.org
----------------------------------------------------------------------------
CCNA VIRTUAL LAB E-TRAINER
This book puts you in charge of a simulated network with three Cisco routers
(two attached to token rings), two host computers, a Catalyst 1900 switch,
and a couple of WAN links. The Cisco simulations are well done and appear to
be thoroughly customizable. A large number of commands are supported, with
the appropriate options enabled - it's not enough to quite get you through the
next level of CCDP exams, but all of the major commands you need to know for
the CCNA are feigned properly. A couple of hours spent tinkering around in the
Virtual Laboratory is worth weeks of book memorizing; the commands come to
mind a lot more quickly when you've "seen" them in action, and the responses
are generally what you'd expect from a real router.
Book:
< http://www.amazon.com/exec/obidos/ASIN/0782127282/netsecurity >
----------------------------------------------------------------------------
DEVELOPING ASP COMPONENTS
This book offers comprehensive instruction for creating and implementing
server-side components for the Microsoft Web server platform. You can build
Microsoft components with different languages, and author Shelley Powers
covers the bases with equal coverage of Visual Basic, Visual C++, and Visual
J++ development. The first part of the book offers a very readable introduction
to ASP components, the COM, thread implementation, and transactions. This
section explains how the elements of the ASP processing environment work
together and forms the foundation for the remainder of the book. The next
section covers Visual Basic component building, access to ActiveX Data Objects,
and building multiple-tier ASP components. This section illustrates how VB can
offer great productivity. C++ is then covered, with a focus on the language's
additional control and possibilities for object linking and embedding database
data access. For Java, the author includes coverage of JavaBeans and data
access with the Windows Framework Classes.
Book:
< http://www.amazon.com/exec/obidos/ASIN/1565924460/netsecurity >
----------------------------------------------------------------------------
DIGITAL MYTHOLOGIES : THE HIDDEN COMPLEXITIES OF THE INTERNET
The 33 short essays here shine a light on the assumptions of technophiles,
which they might prefer be left in shadow: electronic democracy, scientific
spirituality, and portable offices all look distinctly sinister when seen from a
new perspective. What if the ritual of voting every other year commanded a
different, more considered way of thinking than instantaneous direct polling?
How can the materialism inherent in technological solutions transcend itself to
give substance to cyber-religion? Why is it a good thing to be able to draft
memos and rearrange spreadsheets while sitting in coffee shops? Valovic asks
these questions relatively free from constraining values and finds in favor of
technology as long as it is used intelligently for benign purposes; unfortunately,
our thinking about this use is often deeply flawed.
Book:
< http://www.amazon.com/exec/obidos/ASIN/0813527546/netsecurity >
----------------------------------------------------------------------------
TELECOSM : HOW INFINITE BANDWIDTH WILL REVOLUTIONIZE OUR WORLD
After a cataclysmic global run of thirty years, it has given birth to the age of
the telecosm - the world defined by new communications technology. Chips
and software will continue to make great contributions to our lives, but the
action is elsewhere. To seek the key to great wealth and to understand the
bewildering ways that high tech is restructuring our lives, look not to chip
speed but to communication power, or bandwidth. George Gilder is one of the
great technological visionaries, and "the man who put the 's' in 'telecosm'. He is
equally famous for understanding and predicting the nuts and bolts of complex
technologies, and for putting it all together in a soaring view of why things
change, and what it means for our daily lives. His track record of futurist
predictions is one of the best, often proving to be right even when initially
opposed by mighty corporations and governments. He foresaw the power of
fiber and wireless optics, the decline of the telephone regime, and the
explosion of handheld computers, among many trends. His list of favored
companies outpaced even the soaring Nasdaq in 1999 by more than double.
Book:
< http://www.amazon.com/exec/obidos/ASIN/0684809303/netsecurity >
----------------------------------------------------------------------------
THE AGE OF ACCESS : THE NEW CULTURE OF HYPERCAPITALISM WHERE ALL
OF LIFE IS A PAID-FOR EXPERIENCE
Using examples from business and government experiments with just-in-time
access to goods and services and resource sharing, Rifkin defines a new society of renters who are too busy breaking the shackles of material possessions to
mourn the passing of public property. Are we encouraging alienation or
participation? Can we trust corporations with stewardship of our social lives?
True to form, the author asks more questions than he answers--a sign of an
open mind. Destined to become one of the most talked-about books of 2000,
here is a journey into the new world of hyper-capitalism where accessing
experiences becomes more important than owning things and all of life is a
paid-for activity.
Book:
< http://www.amazon.com/exec/obidos/ASIN/1585420182/netsecurity >
----------------------------------------------------------------------------
THE EVOLUTION OF WIRED LIFE : FROM THE ALPHABET TO THE SOUL-CATCHER
CHIP-HOW INFORMATION TECHNOLOGIES CHANGE OUR WORLD
This is hardly the first book that promises to answer the question of how digital
technologies are changing the nature of human reality. What's surprising is its
answer: not much. In this book, Charles Jonscher argues lucidly against the
oft-heard proposition that computers are here to revolutionize, or even replace,
the workings of our minds and societies. Drawing partly on the long prehistory
of today's information technologies--reaching back all the way to the invention
of alphabetic writing in the ancient Middle East--he makes a strong case for the
contrary view: that human thoughts and interactions have always had, and
always will have, more importance than the tools used to convey them.
Book:
< http://www.amazon.com/exec/obidos/ASIN/0471357596/netsecurity >
----------------------------------------------------------------------------
Security Software
-------------------
All programs are located at:
http://www.net-security.org/various/software
----------------------------------------------------------------------------
RETURN-RST 1.1 (LINUX)
Return-RST is a firewalling tool for Linux 2.2.xx systems using IPCHAINS. It
uses the netlink device to capture packets and sends TCP RST packets in
response to TCP connection requests. Normal IPCHAINS only allows you to
drop packets, or reject packets with an ICMP error message. With Return-RST,
you can make it look like there is no server listening, rather than giving away
that they're being filtered to the attacker.
Link:
< http://net-security.org/cgi-bin/file.cgi?return-rst-1.1.tar.gz >
----------------------------------------------------------------------------
TKPASMAN 2.0 (LINUX)
TkPasMan is a simple program that lets you store usernames and passwords for
access to forums, mailing lists, and other websites. It is inspired by gpasman,
but has more `paste' possibilities. For example, you can just paste username
and then password behind it.
Link:
< http://net-security.org/cgi-bin/file.cgi?TkPasMan-2.0.tar.gz >
----------------------------------------------------------------------------
MIMEDEFANG 0.4 (LINUX)
MIMEDefang is a flexible MIME e-mail scanner designed to protect Windows
clients from viruses. It can alter or delete various parts of a MIME message
according to a very flexible configuration file. It can also bounce messages
with unnaceptable attachments. MIMEDefang works with Sendmail 8.10/8.11's
new "Milter" API, which gives it much more flexibility than procmail-based
approaches.
Link:
< http://net-security.org/cgi-bin/file.cgi?mimedefang-0.4.tar.gz >
----------------------------------------------------------------------------
THE ANOMY MAIL SANITIZER 1.25 (LINUX)
The Anomy mail sanitizer is a filter designed to block email-based attacks such
as trojans, viruses, and hostile java. It reads an RFC822 or MIME message and
removes or renames attachments, truncates unusually long MIME header fields
and sanitizes HTML by disabling Javascript and Java. It uses a single-pass pure
Perl MIME parser, which can make it both more efficient and more precise than
other similar programs and has built-in support for third-party virus scanners.
Link:
< http://net-security.org/cgi-bin/file.cgi?anomy-sanitizer-1.25.tar.gz >
----------------------------------------------------------------------------
HACK TRACER V.1.2
Hack Tracer will make your computer "stealthed." Any attempts at pinging or
port scanning will receive no response. Unsolicited UDP packets and TCP
connections will not get through. In short, the computer cannot be detected
from outside. Hack Tracer introduces a feature that lets you geographically
trace hack attempts. Hack Tracer will bring up a map and trace the route from
your computer through every step back to the hacker's computer. The program
also allows you the option to upload the data from a hack attempt to Sharp
Technologies security center for study, investigation, and product improvement.
This is a 30-day trial. Registration costs $40.
Link:
< http://net-security.org/cgi-bin/file.cgi?HackTracerPreview.EXE >
----------------------------------------------------------------------------
OPENSSH UNIX PORT
This is a Linux port of OpenBSD's excellent OpenSSH. OpenSSH is based on the
last free version of Tatu Ylonen's SSH with all patent-encumbered algorithms
removed, all known security bugs fixed, new features reintroduced, and many
other clean-ups. OpenSSH also features an independent implementation of the
SSH2 protocol.
Link:
< http://net-security.org/cgi-bin/file.cgi?openssh-2.1.1p4.tar.gz >
----------------------------------------------------------------------------
Defaced archives
------------------------
[27.08.2000] - Webspace USA
Original: http://www.webspaceusa.com/
Defaced: http://www.attrition.org/mirror/attrition/2000/08/27/www.webspaceusa.com/
[27.08.2000] - World Football Foundation
Original: http://www.worldfootball.org/
Defaced: http://www.attrition.org/mirror/attrition/2000/08/27/www.worldfootball.org/
[27.08.2000] - Indian Institute of Management
Original: http://www.iimidr.ernet.in/
Defaced: http://www.attrition.org/mirror/attrition/2000/08/27/www.iimidr.ernet.in/
[28.08.2000] - Control Chemical, Inc.
Original: http://www.cryoguard.com/
Defaced: http://www.attrition.org/mirror/attrition/2000/08/28/www.cryoguard.com/
[28.08.2000] - National Science Foundation
Original: http://roga.nsf.gov/
Defaced: http://www.attrition.org/mirror/attrition/2000/08/28/roga.nsf.gov/
[28.08.2000] - Israeli Governmental
Original: http://www.tel-aviv.gov.il/
Defaced: http://www.attrition.org/mirror/attrition/2000/08/28/www.tel-aviv.gov.il/
[29.08.2000] - Worldwide Keysurance
Original: http://www.keysurance.com/
Defaced: http://www.attrition.org/mirror/attrition/2000/08/29/www.keysurance.com/
[29.08.2000] - Web Networks
Original: http://www.buddies.web.net/
Defaced: http://www.attrition.org/mirror/attrition/2000/08/29/www.buddies.web.net/
[30.08.2000] - Massachusetts Institute of Technology
Original: http://helice.mit.edu/
Defaced: http://www.attrition.org/mirror/attrition/2000/08/30/helice.mit.edu/
[30.08.2000] - GSA Soft Italy
Original: http://www.gsasoft2000.com/
Defaced: http://www.attrition.org/mirror/attrition/2000/08/30/www.gsasoft2000.com/
[30.08.2000] - DEQ State of MI
Original: http://www.deq.state.mi.us/
Defaced: http://www.attrition.org/mirror/attrition/2000/08/31/www.deq.state.mi.us/
[31.08.2000] - Princeton
Original: http://haozhang.princeton.edu/
Defaced: http://www.attrition.org/mirror/attrition/2000/08/31/haozhang.princeton.edu/
[01.09.2000] - Massachusetts Institute of Technology #2
Original: http://loser.mit.edu/
Defaced: http://www.attrition.org/mirror/attrition/2000/09/01/loser.mit.edu/
[01.09.2000] - Planter's Seed
Original: http://www.planters.org/
Defaced: http://www.attrition.org/mirror/attrition/2000/09/01/www.planters.org/
[02.09.2000] - PGI
Original: http://www.pgi.com/
Defaced: http://www.attrition.org/mirror/attrition/2000/09/02/www.pgi.com/
----------------------------------------------------------------------------
Questions, contributions, comments or ideas go to:
Help Net Security staff
staff@net-security.org
http://net-security.org
