Copy Link
Add to Bookmark
Report
Net-Sec Issue 051
HNS Newsletter
Issue 51 - 20.02.2001
http://net-security.org
This is a newsletter delivered to you by Help Net Security. It covers weekly
roundups of security events that were in the news the past week. Visit Help
Net Security for the latest security news - http://www.net-security.org.
Subscribe to this weekly digest on:
http://www.net-security.org/text/newsletter
Archive of the newsletter in TXT and PDF format is available here:
http://www.net-security.org/news/archive/newsletter
Current subscriber count to this digest: 1925
Table of contents:
1) General security news
2) Security issues
3) Security world
4) Featured books
5) Security software
6) Defaced archives
General security news
---------------------
----------------------------------------------------------------------------
HACKERS SAY ATTACK WAS EASY
Uncovering confidential data, such as passwords and credit card numbers, on
business and government leaders who attended an annual meeting in the Swiss
Alps was easy, computer hackers were quoted as saying Sunday. The Zurich
weekly SonntagsZeitung, which last Sunday disclosed the capture of data on
27,000 leaders, listed on the Internet the type of information that was
compromised for each leader. Former President Bill Clinton's forum password
and actor Dustin Hoffman's e-mail address were included. The newspaper
lists the names and titles, but withholds the confidential numbers.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.nandotimes.com/technology/story/0,1643,500308974-500496290-503480397-0,00.html
NEW LOVELETTER VARIANTS APPEAR
Two new Loveletter virus variants have appeared over the weekend, but
antivirus companies appear to be divided on what level of importance to
attach to their arrival. While F-Secure issued a high-level alert to subscribers
of its Radar IT security alerting service early this morning, Kaspersky Lab said
that the rash of warnings about Loveletter virus variants "are simply a form
of virus hysteria."
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.newsbytes.com/news/01/161815.html
DAVOS HACK: "GOOD" SABOTAGE
A group called Virtual Monkeywrench has taken credit for the hack and said it
is an example of "good sabotage" that was intended to block "the operation of
this well-oiled machine." "The people from Monkeywrench said that the data
was not protected, that it was open and accessible. They say that the
information was just lying there, almost offering itself up to them," said
"Fillip," a computer systems specialist from Switzerland who said that he
has communicated with the crackers.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.wired.com/news/politics/0,1283,41760,00.html
ANNA VIRUS LOSES ITS SIZZLE
Variants of a virus capitalizing on the popularity of Anna Kournikova failed to
add momentum to the worm's spread Monday. "I think it is under control at
this point," said Vincent Gullotto, director of security software maker Network
Associates' antivirus emergency response team. "It had the potential to
become Love Letter-ish, but because we and others had protection, it
failed to spread too quickly."
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.zdnet.com/zdnn/stories/news/0,4586,2684871,00.html
FIREWALLS - IT'S TIME TO EVOLVE OR DIE
"Much may be said for the utility of network protection with firewalls, but too
often we forget about the vulnerable, pink, hairless underbelly of the firewall.
In this series of articles I will expose the weaknesses that are often ignored.
A disclaimer, however: Even though there are many problems with firewalls
and they are far from perfect, you are better off leaving them in. Firewalls
are better than nothing most of the time. They provide the only major line
of defense for many networks (more on this particular issue later), so please
do not remove your firewall unless you have given this some serious thought."
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://securityportal.com/articles/firewalls20010212.html
E-SIGNATURES WITH USB CRYPTO-TOKENS
The recently enacted Electronic Signatures in Global and National Commerce
Act grants electronic signatures and contracts the same legal weight as
handwritten signatures on printed documents. While the new law will almost
certainly accelerate the use of digital signatures for all sorts of e-commerce
transactions, the law does not specify a single de facto standard technology
used to generate digital signatures. One option is the use of a Universal Serial
Bus (USB) cryptographic token to generate digital signatures. USB cryptographic
tokens offer an easy and secure way to generate, store and deploy digital
identities for a host of e-commerce applications and transactions. These
tokens also have the unique ability to plug the security gap found in many
digital signature schemes.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.idg.net/ic_421607_1794_9-10000.html
TRACKING DESPERADOES, DOCUMENTS, COMPUTER FILES...
Investigating computer crime can mean wading through vast amounts of
dissimilar evidence. Websites, paper documents, public records, computer
files, personnel records, and online databases all top the list. Understanding
where you are in an investigation may be akin to sorting out your position in
a South Pacific archipelago; a navigational chart becomes invaluable. The
elements in any investigation are people, places, things, documents, and,
nowadays, electronic records, whether local or in cyberspace. Yet, the key
operation is not just collecting them but understanding how they relate to
each other. So, linking analysis becomes a vital tool in the investigative
process.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://securityportal.com/articles/desperadoes20010213.html
THE ANNA VIRUS THE WORK OF "SCRIPT KIDDIES"?
Eric Chien, chief researcher at Symantec, explained that the virus was actually
created with a virus writing kit, known as Vbs Worms Generator 1.50b, which
is readily available on the internet.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.vnunet.com/News/1117639
WINDOWS XP CAN SECURE MUSIC
A new digital media security solution developed by Microsoft provides protection
for content owners while excluding other digital rights management systems.
The Secure Audio Path (SAP) adds "static" interference to media files that
require video and audio cards to authenticate themselves with Windows
software before they can be played. The company would be able to verify
that a media player isn't playing an "unsecured" file, which according to
Microsoft would eliminate much of the threat of piracy.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.wired.com/news/technology/0,1282,41614,00.html
INTRUSION DETECTION SYSTEMS, PART IV: LOGCHECK
The last in this four part series on IDS, looks at Logcheck: a software package
that is designed to automatically run and check system log files for security
violations and unusual activity.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.freeos.com/articles/3540
RESTRICTANONYMOUS: ENUMERATION AND THE NULL USER
If you are an NT administrator, or if you provide security policies and audits for
clients, then you know all about the RestrictAnonymous value in the LSA key.
If not, you need to educate yourself about this setting- not so much because
of what it does, but more importantly, what it doesn't do. This article by
SecurityFocus.com writer Timothy M. Mullen will offer an overview of
RestrictAnonymous, the need for a RestrictAnonymous setting, some
inherent weaknesses in RestrictAnonymous and some developments
that aim to negate these weaknesses.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.securityfocus.com/focus/microsoft/nt/restrict.html
ANDES ASICS BYPASS TCP LAYER TO SECURE TRANSACTIONS
Andes Networks Inc. has devised a way to dramatically accelerate Secure
Socket Layer transactions by bypassing the Layer 4 TCP session. The
company is aiming for nothing less than a radical revision of how secure
HTTP transactions are conducted.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.electronicstimes.com/story/OEG20010212S0109
INTERNET GATEWAY CONFIGURATION AND MORE
This article gives an overview of ways to use your DSL machine as gateway for
your home or office network, and goes through the basic steps to setup and
maintain security to machines connected directly to the Internet.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.bsdtoday.com/2001/February/Features409.html
ANNA WORM WRITER TELLS ALL
A man from the Netherlands has admitted to writing and distributing the virulent
but short-lived "AnnaKournikova" e-mail worm. He also says he regrets it and
vows never to write another one again. He has put up a website where he
admits to authoring the worm, and also tells why he did it. The worm's writer,
who goes by the name "OnTheFly," writes on the site that he didn't create
the worm just "for fun." Instead, he says he did it to prove that people had
not learned anything from previous e-mail worms.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.wired.com/news/technology/0,1282,41782,00.html
SECURE REMOTE LOG SERVERS USING SCP
Currently there are not many elegant ways to implement a secure, centralized
systemlog server. Centralizing system log files can have several important
advantages: efficient management of log files, maximized disk space usage,
easier access for auditing purposes and more secure retention. This article
by Kristy Westphal will discuss a solution that is secure, affordable and easy
to run, especially on a Solaris system.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.securityfocus.com/focus/sun/articles/securelog.html
RECOGNIZING VIABLE PHYSICAL ATTACKS
When you talk to most IT managers about security, they will assure that they
have the latest firewall technology, 128 SSL encryption on their Websites, and
strong access controls. When you ask them about availability and redundancy,
they will talk about offsite backups, load-balancing their Web servers, and, if
they are really gung-ho, about the fact that they have a second data center
in San Jose. In most cases this is quite sufficient. However, there is a major
area that as of yet has gone unexplored by most non-governmental
organizations. This is the world of electromagnetic radiation, with exotic
technologies such as HERF, EMP and Tempest.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://securityportal.com/closet/closet20010213.html
INTEL DEFACED
A group known as the Sm0ked Crew managed to deface an Intel sub-domain
at talisman1.cps.intel.com leaving a short message. Intel pointed out that
the attackers failed to upload any HTML. The site is running Microsoft IIS4
on Windows NT4 - a combination that has been subjected to a raft of
exploits in recent weeks. Experts expressed surprise at the processor
giant's apparent lack of web security.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.vnunet.com/News/1117695
Mirror: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.attrition.org/mirror/attrition/2001/02/13/talisman1.cps.intel.com/
KOURNIKOVA CORNUCOPIA
Vmyths.com's Rob Rosenberger did a great rant on the whole situation regarding
the Anna Kournikova worm.
Link: http://www.vmyths.com/rant.cfm?id=302&page=4
ONTHEFLY IDENTIFIED
Dutch privacy laws prevent local authorities from releasing the identity of the
author of the "Onthefly" email worm, but an investigation by InternetNews
Radio reveals all roads lead to the Anna Kournikova fan Web site of Jan Dewit.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.internetnews.com/wd-news/article/0,,10_589521,00.html
SERVER BASED COMPUTING IS TECHNICALLY SECURE
With over 140 million PCs, workstations and servers deployed worldwide,
armed with Internet on one side and new computing devices on the other,
the complexity and cost of delivering business critical applications is becoming
overwhelming. Server-based computing, a model in which applications are
deployed, managed, supported and executed completely on a server, is fast
catching up across the world. Alan Pettit, in a conversation with Sofia Tippoo
explains about this architecture spreading in Asia Pacific.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.timesofindia.com/today/15info15.htm
INTERNET SECURITY AND ACCELERATION SERVER
Microsoft unveiled another of its .Net array of servers when it released its
Internet Security and Acceleration server. The server is essentially a
beefed-up firewall, designed to defend networks from external attacks and
prevent unauthorized access. With this release, Microsoft, of Redmond, Wash.,
hopes to challenge companies such as Check Point Software Technologies for
supremacy in the enterprise firewall market. Microsoft has not traditionally
been noted for its products' security features, which may be a hindrance to
widespread adoption of the ISA Server.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.zdnet.com/eweek/stories/general/0,11011,2685764,00.html
OPENSSH: LET THE COMMUNITY DECIDE TRADEMARK FIGHT
Theo de Raadt, co-creator of OpenSSH, says he hopes the community, not the
courts, will decide a trademark skirmish in which SSH Communications Security
Corp. is demanding that the project stop using the name it's been using since
1995.
Link: http://www.newsforge.com/article.pl?sid=01/02/14/1838201
NETFILTER FOR IP MASQUERADE
As of 2.4, ipchains is a thing of the past. The replacement for ipchains is
Netfilter's iptables. What does this mean to the end user? Typically it means
little beyond the fact that suddenly their ipmasq script doesn't work. So, for
starters let's get into setting up ipmasq under 2.4.x kernels.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.linux.com/tuneup/database.phtml/Networking/2188.html
PEDOS VOLUNTEERED SYSTEM PASSWORDS TO COPS
The investigation into the w0nderland paedophile ring could have been
scuppered at the last minute if the men had not given police their encryption
keys. A spokeswoman for the National Crime Squad told that "We were only
able to get into their systems when they voluntarily gave us their passwords."
If the same situation were to arise today, the suspect would be obliged, under
the RIP Act, to furnish the investigators with the key to decrypt their data.
However, the Operation Cathedral investigation predated the Act becoming law.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.theregister.co.uk/content/8/16918.html
LINUX KERNEL 2.4 FIREWALLING MATURES: NETFILTER
In yet another set of advancements to the kernel IP packet filtering code,
netfilter allows users to set up, maintain, and inspect the packet filtering
rules in the new 2.4 kernel. This document explains those changes and
tips on how to get started.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.linuxsecurity.com/feature_stories/kernel-netfilter.html
SCHOOLBOY CRACKER CAUGHT BY DIALLING 1471
A UK computer security consultant has revealed how he snared a hapless
computer cracker who made blackmail threats to his company. Rather than
tracing him through the latest computer security technology, he used a
rather simpler methood - the telephone callback facility.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.zdnet.co.uk/news/2001/6/ns-20991.html
SATANIK.CHILD VIRUS UNLEASHED
A Valentine's Day virus, called VBS.Satanik.Child, has been reported by Aladdin
Knowledge Systems. The statement described the bug as a VB Script vandal
embedded inside HTML formatted e-mail, which introduces a new type of
threat compared to the recently launched Anna Kournikova vandal.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.newsbytes.com/news/01/162014.html
WORM GENERATOR WENT OFFLINE
In the wake of the worldwide spread of the AnnaKournikova virus, an 18-year
old Argentinian claiming to be the creator of the Vbs Worm Generator - the
program used to create the Anna virus - has removed the application's files
from his Web site.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.zdnet.com/zdnn/stories/news/0,4586,2686768,00.html
SPAIN: ATTACKS RISE 210%
Cyberguardian, the Spanish internet security bank, has voiced its concern at
the rise in web server attacks during the first month of this year. Javier Lorenzo,
General Manager of Cyberguardian, said that during the first six weeks, the
number of hacked web sites of their clients had risen by 210 per cent.
Link: http://www.europemedia.net/shownews.asp?ArticleID=1531
FRAUD BUSTERS
The Net makes it easy for con artists to set up scams. But it also makes it
easy for federal investigators to pursue the bad guys.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.idg.net/ic_429148_2058_1-1474.html
MONITORING UNIX LOGINS
"In today's article, I'd like to take a look at utmp, wtmp, and lastlog. These
three files are read and updated whenever a user logs in to your FreeBSD
system. However, you can't read these files directly, so we'll also look at
the various utilities you can use to garner the information contained within
these files. We'll then finish off the article with some utilities that deal with
logins and terminals."
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.oreillynet.com/pub/a/bsd/2001/02/14/FreeBSD_Basics.html
JOB OFFER FOR ANNA WORM CREATOR
The mayor of the city of Sneek has offered the recently arrested 20 year-old
who created the Kournikova worm a job. According to mayor S. Hartkamp "We're
of course talking about a man who has shown he's capable of something" and
"for people like him we've always got a spot at our IT department". Also the
mayor says he's happy about the publicity his city is getting after this incident.
"I was watching CNN and all of a sudden I saw our policestation on international
television". This news comes after Jan DeWitt turned himself in earlier this week
and admitted he didn't know what he was doing and hadn't anticipated any of
the consequences his acts would have.
INTEL ATTACKER TALKS TO THE REG
A computer enthusiast who defaced Intel's Web site twice this week told The
Register about the techniques he uses to break into prestige Web sites and
what motivates him to tweak the nose of system administrators in the IT
industry. The-Rev, of cracker group sm0ked crew, has contributed to the
defacement of sub-domains on Web sites belonging to Hewlett-Packard,
Compaq and Intel twice this week alone. SmOked crew, which also includes
a member called splurge, had a pop at Gateway and the New York Times
this week just for good measure.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.theregister.co.uk/content/8/17000.html
NAPSTER'S NEW (SECURE) GROOVE
Details of Napster's new secure service are leaking, even as the recording
industry continues to tighten the legal screws on the file-trading company.
Napster formed an alliance with Bertelsmann's Digital World Services division
on Friday to develop a secure system for file-trading that can be built into
the existing service. Although Napster officials have been tight-lipped about
the new service, Bertelsmann executives said the new system will build
encryption into files currently being traded across the network.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.wired.com/news/technology/0,1282,41880,00.html
EDUCATION IS PRIMARY DEFENSE FOR SECURE MACHINES
It was with no small amount of irony that Jay Beale, lead developer for Bastille
Linux, was hired by MandrakeSoft last Fall to help the French Linux company
bolster the security of its Linux-Mandrake distribution. Now, after a few
months in the employ of MandrakeSoft, Beale has some definite ideas about
how he will be securing Linux-Mandrake and all of the other Linux distributions
as well. As he has said from day one, Beale's first set of priorities in his new
job is to make Linux-Mandrake and the other MandrakeSoft product more
secure. This does not mean he will be diverted from his work on Bastille. On
the contrary, through the support of MandrakeSoft, Beale is getting more
time and funding to work even more on Bastille than he did in the past.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.linuxplanet.com/linuxplanet/reports/3011/1/
UPDATE ON WEF 'HACK'
Swiss federal police knew anti-globalisation 'hackers' could try to steal
confidential data from the rich and powerful on the guest list at the
World Economic Forum (WEF) but did not warn organisers, a Swiss
newspaper said on Sunday.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.timesofindia.com/today/19info2.htm
----------------------------------------------------------------------------
Security issues
---------------
All vulnerabilities are located at:
http://net-security.org/text/bugs
----------------------------------------------------------------------------
THREE SECURITY HOLES FIXED IN NEW KERNEL
Three security holes have been fixed in the kernel. One involves ptrace, another
involves sysctl, and the last is specific to some Intel CPUs. All three security
holes involve local access only (they do not provide a hole to remote attackers
without a local account). The ptrace and sysctl bugs provide local users with
the potential to compromise the root account. Neither has an active exploit
available at the time of this writing. The last security hole is a DoS that does
not provide access to the root account but does allow any user with shell
access the ability to halt the CPU.
Link: http://www.net-security.org/text/bugs/981998065,83491,.shtml
NOVELL GROUPWISE CLIENT VULNERABILITY
with zen polices or NT Polices installed properly on a windows machine GroupWise
can view the file system while policies do not allow local access to view the files
system of local or remote drives. The GroupWise client allows permission to see
and call files on all drives. This does not change or proxy the rights of another
user it simply allows them to see what policies should be hiding. This problem
was caused when Novell used an API that did not check with OS policies that
have been applied to the user. This problem has been reported and confirmed
by Novell Tech Support.
Link: http://www.net-security.org/text/bugs/981998342,24809,.shtml
DEBIAN LINUX - PROFTPD UPDATE
The following problems have been reported for the version of proftpd in Debian
2.2 (potato):
1. There is a memory leak in the SIZE command which can result in a denial of
service, as reported by Wojciech Purczynski. This is only a problem if proftpd
cannot write to its scoreboard file; the default configuration of proftpd in
Debian is not vulnerable.
2. A similar memory leak affects the USER command, also as reported by
Wojciech Purczynski. The proftpd in Debian 2.2 is susceptible to this
vulnerability; an attacker can cause the proftpd daemon to crash by
exhausting its available memory.
3. There were some format string vulnerabilities reported by Przemyslaw
Frasunek. These are not known to have exploits, but have been corrected
as a precaution.
Link: http://www.net-security.org/text/bugs/982076610,8446,.shtml
WEBSPIRS CGI SCRIPT VULNERABILITY
Problem lyes in incorrect validation of user submitted-by-browser information,
that can show any file of the system where script installed.
Link: http://www.net-security.org/text/bugs/982077684,43757,.shtml
COMMERCE.CGI VULNERABILITY
Adding the string "/../%00" in front of a webpage document will allow an remote
attacker to be able to view any files on the server, provided that the httpd has
the correct permissions. You need to know the directory and file for it to be
viewable, and directory listing and remote command execution doesn't appear
to be possible. Although it may be possible to view some transactions of cc#'s
with the proper tinkering, and depending on if the admin has set proper
directory permissions.
Link: http://www.net-security.org/text/bugs/982077748,40437,.shtml
TRUSTIX SECURITY ADVISORY - PROFTPD, KERNEL
A race condition in ptrace allows a malicious user to gain root. A signedness
error in the sysctl interface also potentially allows a user to gain root.
Link: http://www.net-security.org/text/bugs/982189417,54382,.shtml
SECURITY HOLE IN KICQ
kicq is a free icq client clone available at http://kicq.sourceforge.net/.
Unfortunately received (untrusted!) URLs are passed to the specified
webbrowser (standard is kfmclient) without any sanity checking using
system(). The only user action needed for this is to click "Open" in a
popup menu.
Link: http://www.net-security.org/text/bugs/982202806,24596,.shtml
MITM ATTACKS AGAINST NOVELL NETWARE
Novell has implemented RSA's public/private key technology for encryption and
part of their authentication process. Due to protocol implementation problems,
a man-in-the-middle attack could allow for password hash recovery, and even
a user's RSA private key.
Link: http://www.net-security.org/text/bugs/982293844,88586,.shtml
WEBACTIVE HTTP SERVER 1.0 VULNERABILITY
Adding the string "/../" to an URL allows an attacker to view any file on the
server provided you know where the file is at in the first place. Only Win9x &
NT are affected.
Link: http://www.net-security.org/text/bugs/982378705,521,.shtml
THINKING ARTS STORE.CGI DIRECTORY TRAVERSAL
Adding the string "/../" to an URL allows an attacker to view any file on the
server, and also list directories within the server which the owner of the
vulnerable httpd has permissions to access. Remote execution of commands
does not apear to be possible with this directory traversal bug, but directory
listings are. Please note that you do need the %00.html at the end of your
command.
Link: http://www.net-security.org/text/bugs/982378729,75704,.shtml
SUSE LINUX - SSH UPDATE
SuSE distributions contain the ssh package in the version 1.2.27. No later
version is provided because of licensing issues. SuSE maintains the 1.2.27
version in a patched package. Three new patches have been added that
workaround three independent security problems in the ssh package.
Link: http://www.net-security.org/text/bugs/982378844,18801,.shtml
----------------------------------------------------------------------------
Security world
--------------
All press releases are located at:
http://net-security.org/text/press
----------------------------------------------------------------------------
WATCHGUARD SERVERLOCK INTRODUCED - [12.02.2001]
WatchGuard Technologies, Inc., a leader in Internet security solutions, extended
its award-winning Firebox firewall and VPN appliances with the introduction of
WatchGuard ServerLock, new software that locks-down Microsoft NT and
Microsoft Windows 2000 servers.
Press release:
< http://www.net-security.org/text/press/981997982,33252,.shtml >
----------------------------------------------------------------------------
F-SECURE: ANNA KOURNIKOVA THEMED WORM - [13.02.2001]
F-Secure Corporation, a leading provider of centrally-managed, widely distributed
security solutions is alerting computer users worldwide about a new, rapidly
spreading e-mail worm. Known as "Onthefly", this worm sends itself in an Anna
Kournikova -themed attachments in e-mails titled as "Here you have,;o)".
Ms. Kournikova is known as an international tennis star.
Press release:
< http://www.net-security.org/text/press/982075911,58240,.shtml >
----------------------------------------------------------------------------
FINLAND'S FIRST SECURITY SOLUTION FOR ADSL CLIENTS - [13.02.2001]
2001 F-Secure Online Solutions, a leading provider of centrally managed security
services, and Elisa Communications announced the first bundled personal
anti-virus and personal firewall services for ADSL users in Finland. The companies
have entered into an agreement whereby F-SOS is the premier Security Service
partner for Elisa Communications. The first result of the partnership is the launch
of Personal Anti-Virus and Personal Firewall Services for Elisa Communications'
ADSL customers.
Press release:
< http://www.net-security.org/text/press/982075986,21559,.shtml >
----------------------------------------------------------------------------
KASPERSY LABS - KOURNIKOVA WORM - [13.02.2001]
Kaspersky Labs, an international data-security software development company,
reports the discovery "in the wild" of the new modification of the "Lee" worm
going by the moniker of "Kournikova". The new worm already has managed to
infect many computer systems in both North America and East Asia. At the
same time, the worm poses no threat to Kaspersky Anti-Virus users due to
the program's unique integrated heuristic code analyser designed to combat
against unknown viruses - Kaspersky AV is able to detect the worm without
any additional updates to the anti-virus database.
Press release:
< http://www.net-security.org/text/press/982076214,24241,.shtml >
----------------------------------------------------------------------------
Securing Capacity Group of Companies - [14.02.2001]
Trend Micro Inc., the leading provider of antivirus security, shares news of the
successful defense of yesterday's "Anna Kournikova" virus outbreak by Capacity
Group of Companies, using Trend Micro's ScanMail for Exchange. One of the top
100 insurance brokers in the country, Capacity Group of Companies, weathered
the worldwide virus outbreak unscathed. By using Trend Micro's ScanMail for
Exchange, incoming infected messages, spreading via Outlook, were stopped
at Capacity Group of Companies' Exchange mail server without disruption to
its employees or its communications system.
Press release:
< http://www.net-security.org/text/press/982115915,61092,.shtml >
----------------------------------------------------------------------------
SECURITY DEPLOYMENT IN WESTERN EUROPE - [14.02.2001]
Infonetics Research's latest market research study, "Network Technology
Adoption Forecasts, Europe 2001," shows growth in almost every area of
network build-out among organizations in Western Europe, particularly in
security technologies and services. The results of this study closely parallel
those found in a study Infonetics Research published just a few weeks ago
on the U.S. and Canadian markets.
Press release:
< http://www.net-security.org/text/press/982115972,30596,.shtml >
----------------------------------------------------------------------------
TRUSECURE CORPORATION EXPANDS EXECUTIVES - [.02.2001]
In support of its continued growth and global expansion, TruSecure Corporation,
the leader in Internet security assurance, today announced the appointment
of three new executives: Greg Coticchia as chief operating officer, Jef Loos
as senior vice president, general manager of European operations, and Sanjay
Mehta as vice president of business development. Together this team brings
more than forty years of additional senior executive experience to TruSecure.
Press release:
< http://www.net-security.org/text/press/982116034,90742,.shtml >
----------------------------------------------------------------------------
SOPHOS - KOURNIKOVA WORM CREATOR ARRESTED - [14.02.2001]
Sophos, a world leader in corporate anti-virus protection, has welcomed the
arrest of a man in the Netherlands in connection with the VBS/SST-A computer
worm. Dutch police spokesman Robert Rambonnet confirmed that the police
force in the Netherlands have arrested a 20 year old in connection with the
recent "Anna Kournikova" virus outbreak on suspicion of damaging computer
programs and property. The man, who lives in Friesland, turned himself into
the authorities after apparently posting a bizarre apology for his actions on
the internet. His identity has not been revealed, but the author of the
computer worm and self-confessed fan of Anna Kournikova uses the
pseudonym "OnTheFly".
Press release:
< http://www.net-security.org/text/press/982164133,56196,.shtml >
----------------------------------------------------------------------------
F-SECURE PRODUCTS INTEGRATE WITH CA'S EMS - [14.02.2001]
Secure Corporation, a leading provider of centrally managed security solutions
for the mobile, distributed enterprise, today announced integration of F-Secure
products with the enterprise management systems [EMS] from Computer
Associates and BMC Software. Organizations that have standardized on
Unicenter TNG and BMC PATROL can now use the familiar management
consoles of these three market-leading frameworks to control and monitor
most aspects of F-Secure's products. As a result, IT administrators can
more effectively and efficiently manage their networks and security, while
preserving their investments in those management frameworks.
Press release:
< http://www.net-security.org/text/press/982164488,68552,.shtml >
----------------------------------------------------------------------------
TELE DANMARK SELECTS SONICWALL - [14.02.2001]
SonicWALL, Inc. (NASDAQ:SNWL), a leading provider of Internet security
products, announced that it has been selected by TDC Internet, a division
of Denmark's leading telecommunications company Tele Danmark Communications
(TDC), as a foundation for the company's new managed security solutions. With
SonicWALL's Internet security appliances and Global Management System (GMS),
TDC will be able to deliver managed security and value added services to its
small to medium-sized enterprise customers (SME).
Press release:
< http://www.net-security.org/text/press/982203363,39069,.shtml >
----------------------------------------------------------------------------
WEST COAST LABS CERTIFY APPGATE V.3.2 - [.02.2001]
Network security experts appGate, Inc., announced that West Coast Labs, a
division of West Coast Publishing Limited, has awarded them the first Checkmark
certificate for secure application gateways. West Coast Labs sets and publishes
standards for computer security products and awards its Checkmark certificate
to those manufacturers who meet or exceed those standards. The newly
introduced Checkmark for secure application gateways was awarded to
appGate for its latest software release, appGate Version 3.2. The company
was awarded Level 2 of the West Coast Labs standard, currently the highest
level of certification that the Checkmark provides.
Press release:
< http://www.net-security.org/text/press/982203401,66068,.shtml >
----------------------------------------------------------------------------
FREE VIRUS PROTECTION FOR WIRELESS DEVICES - [15.02.2001]
Trend Micro Inc., a leading provider of network antivirus and content security
for the Internet age, today announced the availability of free antivirus software
for the most popular handheld mobile and wireless device platforms, including
Palm OS, Windows CE, and Symbian EPOC. Based on Trend Micro's award-winning
PC-cillin desktop antivirus software, PC-cillin for Wireless resides on Palm OS,
Pocket PC (Windows CE), and EPOC handheld devices to protect users from
potentially malicious code including viruses, scripts, Trojan horses, and worms.
Devices are susceptible to these threats whenever users receive email, browse
the Web, or receive information via beaming and synching.
Press release:
< http://www.net-security.org/text/press/982203494,36531,.shtml >
----------------------------------------------------------------------------
FIPASS NOVEL TOKEN PASSWORD SECURITY SYSTEM - [15.02.2001]
FiPoint is proudly sponsoring the World Boxing Association Heavyweight
Contender, John "The Quiet Man" Ruiz for the Holyfield -Ruiz 2 fight which will
be broadcast live on SET -Showtime Event Television from Mandalay Bay in Las
Vegas on March 3rd 2001. FiPoint, the financial integrator, is sponsoring Ruiz to
introduce its premier security product "the FiPass" which will position FiPoint to
lead the fight to "protect yourself online." The FiPass logo will be in the ring
with Ruiz on his fighting shorts, on the Ruiz Team gear and in Ruiz's corner.
Press release:
< http://www.net-security.org/text/press/982260460,54584,.shtml >
----------------------------------------------------------------------------
CYBERGUARD'S SECURITY SCOOP IN SINGAPORE - [15.02.2001]
With Internet security a serious global issue, Paul Henry of CyberGuard
Corporation, the technology leader in network security, will divulge his
security secrets at a National University of Singapore seminar on February
23 at 10:30 a.m. local time. Henry, managing director of Asian operations
for CyberGuard, will be presenting "Hacking Exposed: The Hacking Tools of
Script Kiddies" as part of the university's "You are the TARGET" seminar on
information security.
Press release:
< http://www.net-security.org/text/press/982260499,29458,.shtml >
----------------------------------------------------------------------------
FIRST KOREA SECURITY INFORMATION SHARING CREATED - [15.02.2001]
Predictive Systems, a leading network infrastructure consulting firm, announced
that it has entered into an agreement with Infosec Corporation, a leading South
Korean information security services provider, to create the Korea Security
Information Sharing and Analysis Center (KS/ISAC) to facilitate the sharing of
sensitive information about cyber attacks and security vulnerabilities that pose
threats to Korean businesses. As a participating bureau of the Worldwide ISAC
(WW/ISAC), which was launched last year, the KS/ISAC provides a secure
database, analytical tools, and information gathering and distribution facilities
designed to allow authorized participants to submit either anonymous or
attributed reports about information security threats, vulnerabilities,
incidents, and solutions.
Press release:
< http://www.net-security.org/text/press/982260554,78205,.shtml >
----------------------------------------------------------------------------
PROTECTING ENTERPRISE FROM MALICIOUS CODE - [20.02.2001]
F-Secure Corporation, a leading provider of centrally managed security for the
mobile enterprise, today announced the general availability of F-Secure Anti-Virus
for Internet Mail. The product protects all email traffic against inbound and
outbound security threats in real time, including internal SMTP mail traffic.
Since email can bypass traditional workstation and server-based virus
protection, businesses need an anti-virus solution at the gateway level. In
today's corporate environment, the ability to protect sensitive data from
viruses outside the corporate network has become a necessity. F-Secure
Anti-Virus for Internet Mail incorporates multiple scanning engines, creating
superior detection rates and ensuring that these threats never penetrate
the network.
Press release:
< http://www.net-security.org/text/press/982633450,84386,.shtml >
----------------------------------------------------------------------------
PARA-PROTECT SERVICES APPOINTS CFO - [20.02.2001]
Para-Protect Services Inc., a managed security and support services provider
for the global 500 and trusted partner providers, announced the appointment
of Joseph D. Ragan III, CPA. as Chief Financial Officer. Ragan joins Para-Protect
Services, Inc. after serving as CFO, US Operations for Winstar Communications
for the past two years. Winstar is a publicly traded company in the broadband
services market serving over 60 domestic markets and 12 international markets.
With the firm, Ragan improved quality and timeliness of financial reporting,
internal controls, and asset management reporting and substantially reduced
telecommunications costs.
Press release:
< http://www.net-security.org/text/press/982633974,29797,.shtml >
----------------------------------------------------------------------------
Featured books
----------------
The HNS bookstore is located at:
http://net-security.org/various/bookstore
Suggestions for books to be included into our bookstore
can be sent to staff@net-security.org
----------------------------------------------------------------------------
CISCO IP ROUTING HANDBOOK
The book approaches the more complicated and capable routing protocols first
by explaining Routing Information Protocol (RIP) and the fundamental principles
that it incorporates in a way that's understood relatively easily. The explanations
require readers to pay close attention to text that's interspersed with routing
tables and input/output sequences from Cisco's Internetworking Operating
System (IOS). Given the proper attention, this text does a fine job of explaining
how Interior Gateway Routing Protocol (IGRP), Enhanced IGRP (EIGRP), and Open
Shortest Path First (OSPF) routing work, along with static routing and other
simpler concepts. Topics covered: Routing protocols, as implemented by Cisco
Systems routers and configured on the Cisco Internetworking Operating System
(IOS). Routing Information Protocol (RIP), Interior Gateway Routing Protocol
(IGRP), Enhanced IGRP (EIGRP), Open Shortest Path First (OSPF), Integrated
System to Integrated System (IS-IS), and Border Gateway Protocol (BGP)
version 4 all are covered.
Book:
< http://www.amazon.com/exec/obidos/ASIN/0764546953/netsecurity >
----------------------------------------------------------------------------
MICROSOFT SQL SERVER 2000 ADMINISTRATOR'S POCKET CONSULTANT
If specialization is for insects, those of us who have only two legs are bound
to need reminders when we sit down to perform a specialized task. For those
times in which the specialized task at hand involves the latest version of
Microsoft's high-end database management system (DBMS), Microsoft SQL
Server 2000 Administrator's Pocket Consultant will provide how-to answers
on the double-quick. This small, inch-thick volume fits nicely into a briefcase,
and opens flat for easy reference. It makes little attempt to explain how SQL
Server works, assuming instead that the reader knows what he or she needs.
For example, a quick scan of the index for "Logins, Assigning Roles for Multiple"
yields a reference to a page that explains exactly what to do, step by step.
Procedures are a large part of the appeal of this book; value tables and
Transact-SQL syntax documentation contribute the rest. A typical value
table lists all standard database roles, along with commentary on what sort
of user is appropriate for each role. Transact-SQL documentation includes
generic "all available options" statements of syntax, followed by usage
examples. Deeper explanations of what each option does would make the
syntax documentation stronger, but what's here is certainly enough to jog
readers' memories and point them to heavier reference material, if they
need it. Keep this book handy if your job requires you to hop from DBMS
to DBMS.
Book:
< http://www.amazon.com/exec/obidos/ASIN/0735611297/netsecurity >
----------------------------------------------------------------------------
THE OFFICIAL GUIDE TO INFORMIX/RED BRICK DATA WAREHOUSING
The book covers all the features of RedBrick in the process of building a data
warehouse through its complete lifecycle, beginning with planning the project,
designing the database, building and loading the database, deploying the
database to business users and maintaining the data warehouse in the future.
Each of the topics is presented in a straightforward fashion by discussing in
detail the objective, concepts, and implementation techniques and briefly
touching on the more advanced components. One ongoing case study used
throughout the book allows the reader to build upon it with each major area
to create a sample data warehouse. Sample forms and documents as well
as completed exercises are provided on the CD-ROM.
Book:
< http://www.amazon.com/exec/obidos/ASIN/0764546945/netsecurity >
----------------------------------------------------------------------------
POSTGRESQL: INTRODUCTION AND CONCEPTS
(Pearson Education) Presents the fundamentals of PostgreSQL, an advanced,
feature-filled database server. Assumes no background in databases at all, but
still moves quickly, going beyond mechanics and into the applications of simple
commands in working database applications. Highlights common pitfalls and
offers time and trouble-saving tips.
Book:
< http://www.amazon.com/exec/obidos/ASIN/0201703319/netsecurity >
----------------------------------------------------------------------------
PLANNING EXTREME PROGRAMMING (THE XP SERIES)
The Extreme Programming (XP) paradigm has developers doing things like
programming in pairs, writing tests to verify all code, and continuously
refactoring designs for improved performance. Written by two of its
inventors, Planning Extreme Programming shows you how to implement
XP by using a simple, effective process. This remarkably short (yet
remarkably useful) title will give any XP manager or programmer a
perspective on delivering software that meets the needs of customers
better. Simplicity is the watchword of the XP software process. This
book is virtually devoid of traditional software-engineering jargon and
design diagrams, and yet does a good job of laying the foundation of
how to perform XP--which is all about working with a customer to
deliver features incrementally.
Book:
< http://www.amazon.com/exec/obidos/ASIN/0201710919/netsecurity >
----------------------------------------------------------------------------
Security Software
-------------------
All programs are located at:
http://net-security.org/various/software
----------------------------------------------------------------------------
NESSUS 1.0.7A
Nessus is a free, up-to-date, and full featured remote security scanner for Linux,
BSD, Solaris and some other systems. It is multithreaded, plugin-based, has a
nice GTK interface, and currently performs over 531 remote security checks.
It has powerful reporting capabilities (HTML, LaTeX, ASCII text) and not only
points out problems, but suggests a solution for each of them. Changes: 1.0.7a
fixes bugs in the scanner timeout.
Info/Download:
< http://www.net-security.org/various/software/982454976,58605,linux.shtml >
----------------------------------------------------------------------------
BLACKICE DEFENDER 2.1
BlackICE Defender delivers bulletproof intrusion detection and personal firewall
protection to your PC. It scans your DSL, cable, or dial-up Internet connection
looking for hacker activity, much like antivirus programs scan your hard disk
looking for viruses. BlackICE will not slow down your PC or your Internet
experience.
Info/Download:
< http://www.net-security.org/various/software/982455317,56745,windows.shtml >
----------------------------------------------------------------------------
ZONEALARM 2.1.44
ZoneAlarm is designed to protect your DSL or cable-connected PC from hackers.
This program includes four interlocking security services: a firewall, an Application
Control, an Internet Lock, and Zones. The firewall controls the door to your
computer and allows only traffic that you understand and initiate. The Application
Control allows you to decide which applications can and cannot use the Internet.
The Internet Lock blocks Internet traffic while your computer is unattended or
while you are not using the Internet, and it can be activated automatically with
your computer's screensaver or after a set period of inactivity. Zones monitor all
activity on your computer and alert you when a new application attempts to
access the Internet. This version includes protection from emailborne worms.
Info/Download:
< http://www.net-security.org/various/software/982455527,33047,windows.shtml >
----------------------------------------------------------------------------
PALMPASSWORD 1.51
With PalmPassword, you will never again have to remember account names
and passwords, or which one is used where. PalmPassword will completely
automate the process of using login names and passwords, whenever and
wherever you need them.
Info/Download:
< http://www.net-security.org/various/software/982084445,35396,palm.shtml >
----------------------------------------------------------------------------
TEAL LOCK 3.21
TealLock replaces the standard Palm security application with a system that
offers many activation and customization options. These include activation
by shortcut strokes, custom locking of screen text and images, optional
auto-locking of private records, and file-hiding immediately at shutdown
or after a specified period of time.
Info/Download:
< http://www.net-security.org/various/software/982084525,67290,palm.shtml >
----------------------------------------------------------------------------
INTERNET EXPLORER SECURITY 1.1
From the developer: "Internet Explorer Security is a free utility that customizes
many aspects of the Internet Explorer Web browser. It's a snap to use and
provides the tools you need to retain and manage your Web browser settings.
It lets you disable individual menu items and prevent others from editing your
Favorites. It also allows you to disable individual tabs in the Internet Options
dialog, as well as specific settings from each tab. Still other settings let you
change the title caption, toolbar background, and animated icon; change
default folders; and replace standard error information pages. Multiuser
support and password protection are also offered."
Info/Download:
< http://www.net-security.org/various/software/982084622,69048,windows.shtml >
----------------------------------------------------------------------------
ONLYME 2.15
OnlyMe automatically locks your Palm whenever the device is turned off.
Entering your password is the only way to turn it on. This version stops
the Palm V from turning on when the case pushes the up/down arrow keys,
and handles certain conflicts with upcoming versions of the Palm OS and
with certain game programs.
Info/Download:
< http://www.net-security.org/various/software/982440775,76206,palm.shtml >
----------------------------------------------------------------------------
12GHOSTS WASH 21.03
This will cover your tracks and clean out folders of unused and unwanted data.
It includes options for Windows, browsers, and other applications. You can even
turn on the included shredder for total security. In Windows, it can clear the Run
history, recent documents, Find-files history, and the Temp folder. In your
browser, it will clear the typed address list, cached files, history, and cookies.
This program can also remove WinZip's Most-Recently used file list, or the Last
Open folder in ACDsee. Command-line control is available to create automatic
"wash" times (prior to shutdown, for example).
Info/Download:
< http://www.net-security.org/various/software/982440911,87752,windows.shtml >
----------------------------------------------------------------------------
Defaced archives
------------------------
[10.02.2001] - SecureNet BR
Original: http://www.securenet.com.br/
Defaced: http://www.attrition.org/mirror/attrition/2001/02/10/www.securenet.com.br/
[11.02.2001] - Asia-Pacific Service Network
Original: http://www.apsn.com/
Defaced: http://www.attrition.org/mirror/attrition/2001/02/11/www.apsn.com/
[11.02.2001] - CompUSA Inc.
Original: http://commercial.compusa.com/
Defaced: http://www.attrition.org/mirror/attrition/2001/02/11/commercial.compusa.com/
[11.02.2001] - Pinnacle Communications
Original: http://dev.ldd.com/
Defaced: http://www.attrition.org/mirror/attrition/2001/02/11/dev.ldd.com/
[11.02.2001] - Gateway 2000, Inc.
Original: http://jobs.gateway.com/
Defaced: http://www.attrition.org/mirror/attrition/2001/02/11/jobs.gateway.com/
[12.02.2001] - British Columbia Courts
Original: http://www.courts.gov.bc.ca/
Defaced: http://www.attrition.org/mirror/attrition/2001/02/12/www.courts.gov.bc.ca/
[13.02.2001] - Intel Corporation
Original: http://talisman1.cps.intel.com/
Defaced: http://www.attrition.org/mirror/attrition/2001/02/13/talisman1.cps.intel.com/
[13.02.2001] - Walt Disney Company: Go.Com
Original: http://remote.go.com/
Defaced: http://www.attrition.org/mirror/attrition/2001/02/13/remote.go.com/
[14.02.2001] - Linux Mania
Original: http://www.linuxmania.org/
Defaced: http://www.attrition.org/mirror/attrition/2001/02/14/www.linuxmania.org/
[14.02.2001] - Hewlett-Packard Company
Original: http://e-learning.hp.com/
Defaced: http://www.attrition.org/mirror/attrition/2001/02/14/e-learning.hp.com/
[14.02.2001] - AltaVista Company
Original: http://merchant.shopping.altavista.com/
Defaced: http://www.attrition.org/mirror/attrition/2001/02/14/merchant.shopping.altavista.com/
[14.02.2001] - Compaq Computer Corporation
Original: http://www.weft2.emea.compaq.com/
Defaced: http://www.attrition.org/mirror/attrition/2001/02/14/www.weft2.emea.compaq.com/
[15.02.2001] - Software Patent Institute
Original: http://www.spi.org/
Defaced: http://www.attrition.org/mirror/attrition/2001/02/15/www.spi.org/
[15.02.2001] - The New York Times Company
Original: http://business.nytimes.com/
Defaced: http://www.attrition.org/mirror/attrition/2001/02/15/business.nytimes.com/
[17.02.2001] - Fuji Film
Original: http://www.fujifilm.se/
Defaced: http://www.attrition.org/mirror/attrition/2001/02/17/www.fujifilm.se/
[17.02.2001] - Zavod za zaposlovanje Republike Slovenije
Original: http://www.ess.gov.si/
Defaced: http://www.attrition.org/mirror/attrition/2001/02/17/www.ess.gov.si/
[17.02.2001] - Iomega Corp.
Original: http://search.iomega.com/
Defaced: http://www.attrition.org/mirror/attrition/2001/02/17/search.iomega.com/
[18.02.2001] - Financial Institutions Commission Homepage
Original: http://www.fic.gov.bc.ca/
Defaced: http://www.attrition.org/mirror/attrition/2001/02/18/www.fic.gov.bc.ca/
[18.02.2001] - Comite International Olympique
Original: http://atlanta.olympic.org/
Defaced: http://www.attrition.org/mirror/attrition/2001/02/18/atlanta.olympic.org/
[18.02.2001] - Idaho State Government
Original: http://www.doi.state.id.us/
Defaced: http://www.attrition.org/mirror/attrition/2001/02/18/www.doi.state.id.us/
[18.02.2001] - Hewlett-Packard Company
Original: http://openview.hp.com/
Defaced: http://www.attrition.org/mirror/attrition/2001/02/18/openview.hp.com/
----------------------------------------------------------------------------
Questions, contributions, comments or ideas go to:
Help Net Security staff
staff@net-security.org
http://net-security.org
