Copy Link
Add to Bookmark
Report
Net-Sec Issue 044
Net-Sec Newsletter
Issue 44 - 01.01.2001
http://net-security.org
[ -- Happy 2001 -- ]
This is a newsletter delivered to you by Help Net Security. It covers weekly
roundups of security events that were in the news the past week. Visit Help
Net Security for the latest security news - http://www.net-security.org.
Subscribe to this weekly digest on:
http://www.net-security.org/text/newsletter
Archive of the newsletter in TXT and PDF format available here:
http://www.net-security.org/news/archive/newsletter
Table of contents:
1) General security news
2) Security issues
3) Security world
4) Featured articles
5) Featured books
6) Security software
7) Defaced archives
General security news
---------------------
----------------------------------------------------------------------------
EGGHEAD.COM SYSTEM COMPROMIZED
"Egghead.com has discovered that a hacker has accessed our computer
systems, potentially including our customer databases," the company
said in a statement released yesterday.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.timesofindia.com/today/24info5.htm
KASHMIR RELATED DEFACEMENTS
More than 40 Indian sites have been infiltrated this year by hackers like G Force
Pakistan and Doctor Nuker, who have left poignant pro-Pakistan slogans and
reasons why Kashmir belongs to that country. Wired has the report.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.wired.com/news/politics/0,1283,40789,00.html
PC GUARDIAN ENCRYPTION PLUS HARD DISK
Once Encryption Plus Hard Disk is installed on a users computer, the system
will not boot without the users password. Even if an experienced user were
to somehow work around the boot protection and access the hard disk, s/he
would only be able to read file names. The data would remain encrypted. This
feature alone should make encryption practically mandatory for notebook users.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.canadacomputes.com/v3/story/1,1017,5163,00.html
INFORMATION SYSTEMS AND SURVEILLANCE
The miniaturization of electronic equipment and the advances in the production
of armaments and computer science equipment, thanks to technological
advances of knowledge and Information Systems (IS) have led some
theoreticians to define war of the information era as digital war.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://cryptome.org/omni-is-spy.htm
THE LINUX YEAR IN REVIEW
Linux Weekly News has put together a great summary of the major events
surrounding Linux and open source over the past year. Continuing the popular
tradition of our 1998 and 1999 Linux Timelines, here is our attempt to summarize
what has happened in the Linux world over the last year. This is version 0.8.3
of the LWN 2000 Linux Timeline.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.lwn.net/2000/features/Timeline/
SECURITY-ENHANCED LINUX
As part of its Information Assurance mission, the NSA has long been involved
with the computer security research community in investigating a wide range
of computer security topics including operating system security. The results
of several previous research projects in this area have been incorporated in
a security-enhanced Linux system. This version of Linux has a strong, flexible
mandatory access control architecture incorporated into the major subsystems
of the kernel. The system provides a mechanism to enforce the separation of
information based on confidentiality and integrity requirements. This allows
threats of tampering and bypassing of application security mechanisms to be
addressed and enables the confinement of damage that can be caused by
malicious or flawed applications.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.nsa.gov/selinux/
ESTABLISHING EMAIL VALIDITY
Scenario: Christmas morning you get an angry phone call from one of your
contractors. They claim to have received an email outlining why you have
chosen to terminate their contract, that in no uncertain terms describes
relations with their mother, family pet, or what have you. The caller can't
believe how rampantly unprofessional this message is, and has already
contacted their legal department about suing for damages and breach of
contract. All of this information has taken you completely by surprise. As
far as you know, no message has been sent by anyone at your company,
especially given that you're the only employee currently employed by your
company. How can you prove that no email was sent by you? How can you
demonstrate in a court that no such email has originated from your system?
What if it has? Can you prove that you were not the sender?
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.securityportal.com/cover/coverstory20001225.html
ONLINE SECURITY KEY TO EMBRACING SMART CARDS
Imagine a single card that lets you purchase and download an airline ticket
using your PC. That same piece of plastic could also pay for a restaurant lunch,
open secure doors at the office, check out books at the library. It could even
become your car keys. Sound like a script from the Jetsons? Not really. Thanks
to the improving power and versatility of microprocessors embedded in the cards,
consumers will not only be able to better protect themselves against online fraud
as they bank or trade stocks. They will also be able to store digital cash, personal
information, Web site passwords and addresses, and such things as loyalty
coupons from merchants or frequent flyer points.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.cnn.com/2000/TECH/computing/12/25/smart.cards.ap/index.html
LINUX SECURITY WEEK
This week,advisories were released for ed, stunnel, bitchx, zope, nano, slocate,
procps, oops, halflifeserver, ethereal, netscape, pam, jpilot, rp-pppoe, kerberised
telnetd, ftpd, gnupg, mysql, and tcsh. The vendors include Conectiva, Debian,
FreeBSD, Mandrake, NetBSD, OpenBSD, Red Hat, and Trustix.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.linuxsecurity.com/articles/forums_article-2186.html
STIFFER PENALTIES IN HONG KONG
Hong Kong police on Monday warned would-be computer hackers of the
territory's stringent penalties against cybercrimes. The caution came as
official figures showed a 300 percent increase in the number of people
connected to the Internet across the territory in the last two years.
Link: http://www.dotcomdirectory.newsalert.com/bin/story?StoryId=CoKBuueibntaWmJKZndi2
"ANTITRUST" - HOLLYWOOD FILM ON TECH INDUSTRY DUE
AntiTrust," a new motion picture from MGM scheduled to hit theaters Jan. 12,
2001. Tim Robbins plays Gary Winston, the brilliant and driven mastermind
behind N.U.R.V., which stands for "Never Underestimate Radical Vision," a
software company dedicated to monopolizing digital convergence. Winston
dazzles promising young computer science student Milo, played by Ryan
Phillippe, into abandoning his plans to launch a start-up company with his
college buddy and come work for N.U.R.V. Winston's mantra is, "In this
business, you are either a one or a zero." At the heart of N.U.R.V. is the
Synapse project, which is described as the world's first satellite-delivered
global communications system. "AntiTrust" explores the issues of surveillance,
corporate espionage and intellectual property theft.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.computeruser.com/news/00/12/26/news20.html
ETISALAT HACKING
The lawyer representing a young Briton accused of hacking into Emirates
Telecommunications Corp's (Etisalat) Internet system says he plans to ask
the Public Prosecutor to produce its evidence or drop the case.
Link: http://www.gulf-news.com/Articles/news.asp?ArticleID=5629
We covered the story closely, so you can find more information here:
http://net-security.org/cgi-bin/pr0n/viewnews.cgi?searchetisalat
HACKER ATTACKS ON SHARP RISE
Safeguards against hacker attacks are urgently needed, the Korea Information
Security Agency (KISA) said. The Ministry of Information and Communication-
affiliated institute said there were a total of 1,858 cases of hacking detected
in the nation as of November, more than triple the 572 cases found last year.
There were a mere 147 hacker attacks in 1996, and the figure dropped to 64
in 1997. However, cyber crime began rising sharply again, with the figure
climbing to 158 in 1998, and 572 last year. KISA noted that corporations
appear to be the main target for hacker attacks. Ninety-two, or 40.5 percent
of 227 hacker attacks that occurred in November were targeted against
corporations, for example. "This is an indication that security systems at
Korean corporations are frail and that companies lack mindset for security,"
a KISA official said.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.koreaherald.co.kr/SITE/data/html_dir/2000/12/27/200012270081.asp
BAD DAYS FOR NETWORK ASSOCIATES
Network Associates Inc.'s top three executives, including Chairman and Chief
Executive William Larson, resigned suddenly Tuesday, shocking investors, who
sliced the company's stock price in half in after-hours trading. As we could see
from various news outlets their shares fell for 65% (according to ZDNet), 68%
(according to InfoWorld) and 72% (according to Reuters). Below you can read
a few articles that are covering the story.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.zdnet.co.uk/news/2000/51/ns-19913.html
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www0.mercurycenter.com/svtech/news/indepth/docs/networ122700.htm
Link: http://www.crn.com/Sections/BreakingNews/dailyarchives.asp?ArticleID=22548
NATIONAL SECURITY RISK
In a report released this month titled "Cyber Threats and Information Security:
Meeting the 21st Century Challenge," the Center for Strategic and International
Studies (CSIS) concluded that the government and the private sector should
be concerned about the "trustworthiness" of future Microsoft products in the
aftermath of the hack into the company's network.
Link: http://www.net-security.org/cgi-bin/news.cgi?urlhttp://www.idg.net/ic_335424_1794_9-10000.html=
DEMAND FOR NET-BASED SECURITY PRODUCTS
Demand for Internet-based security products is exploding, as sales reached
$243 million last quarter and are expected to more than double next year,
a new study shows.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://news.cnet.com/news/0-1004-200-4290053.html
HONG KONG POLICE OFFER CHRISTMAS WARNING TO HACKERS
Computer whizzes in Hong Kong who like to test their skills on the Web sites
of others will receive little sympathy from the Hong Kong Police who issued a
warning about the consequences of such actions.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.computeruser.com/news/00/12/28/news16.html
CRYPTOGRAPHY IN YOUR POCKET
Recently, some announcements have been made of commercial encryption
programs for the PalmPilot personal organizer. Some of these were for
subroutines that might be used in programs whose primary purpose is
not encryption, for purposes such as software registration. Also, Network
Associates, the company that owns PGP, has a commercial product,
PGPwireless, specifically aimed at those who use their Palm Pilots (and,
shortly, other similar devices) to connect to the Internet.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.securityportal.com/articles/pocket20001228.html
NO MONEY IN HACKERDOM, VERSION 1.0
"ESR has an article that explains some ways for you to become a Hacker. I'm
not going to repeat all the points he has in that article, as you can look at
that article for the specifics. I am going to make the argument that Hackers
do not generally Hack because they have to for work. Instead, it is their
passion, their life, in a dramatic way. Also, I'm going to make the argument
that, and this is not how ESR feels, Hackers can be non-contributing authors
to the code base of the world. That code base is better known as Open
Source or Free Software today."
Link: http://www.linuxpower.org/display.php?id=200
AN INTRODUCTION TO VIRUSES AND MALICIOUS CODE PART TWO
In Part One of this series SecurityFocus.com writer Brad Griffin introduced
readers to viruses and other forms of malicious code. He discussed the various
ways in which viruses can infect a user's computer and how they can affect a
user's important data. This article, the second in a three-part series, will
discuss ways of protecting computers against virus infection, including:
anti-virus software, proper handling of e-mail and external media such as
floppy disks, the dangers of non-essential software, and the necessity of
user education.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.securityfocus.com/focus/basics/articles/malintro2.html
ANTI-DEFAMATION LEAGUE WEB SITE ATTACKED
The ADL Web site was taken over for about 20 minutes by attackers who
identified themselves as the "World's Fantabulous Defacers." In lieu of the
ADL home page, the attackers posted threats to Israelis as well as pro
Palestinian sentiment. The attackers did not gain access to any sensitive
information. The group closed the site a few minutes after the attack was
discovered, according to an ADL representative. Four hours later, the site
was restored.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://news.cnet.com/news/0-1007-200-4292972.html
THE STORY OF JEFF: PART VI
This story is the ongoing saga of Jeff, a tragic tale full of hardship, heartbreak
and triumph over impossible odds. Jeff is your average network administrator,
responsible for Acme, Inc.'s Microsoft-based corporate network. A brightly lit
server room. Fans humming quietly, a glass wall at one end; on the other side
we see a table with several people sitting around it. Scattered on the table
are several pads of paper, pencils, pagers and a laptop. We see Jeff, eyes a
healthy shade of bloodshot pink accented by dark bags underneath. Lifting a
cup of cold coffee to his lips, he grimaces and takes a deep gulp, swallowing
it hurriedly.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://securityportal.com/articles/jeff20001229.html
THE 101 USES OF OPENSSH: PART I
This month we'll cover ssh's background and architecture, how to build and/or
install OpenSSH, how to use ssh as an encrypted replacement for Telnet, how
to set some basic ssh configuration options and how to use scp for encrypted
file transfers.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www2.linuxjournal.com/lj-issues/issue81/4412.html
UPDATE ON EGGHEAD.COM PENETRATION
Egghead.com, the Internet firm that had 3.6 million credit cards compromised
before Christmas when security on its e-commerce site was cracked, said it
will know by the end of the week whether the hacker managed to steal the
financial information of its customers.
Link: http://www.nationalpost.com/tech/story.html?f=/stories/20001228/418915.html
DAILY NEWS THAILAND DEFACED
The Web site of the Daily News newspaper (www.dailynews.co.th) was defaced
late on Tuesday night, the third such break-in in recent years, its webmaster
said today. No information was destroyed or altered.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.newsbytes.com/news/00/159816.html
BEWARE OF HAPPY NEW YEAR VIRUS
A new e-mail virus is on the loose, according to Computer Associates
International. The "Tqll-A" worm is typically found in electronic messages
bearing a Happy New Year greeting in the subject field, said Ian Hameroff,
business manager for antivirus solutions for Computer Associates. The latest
threat, which CA detected at its global research centers, conveys itself via
Microsoft Outlook. When people open the "happynewyear.txt.vbs" attachment,
the virus then installs itself on the user's hard drive.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.techweb.com/wire/story/TWB20001229S0006
FEDS WARN OF CONCERTED ATTACKS ON NEW YEAR' EVE
Federal computer security experts are urging system administrators to take
added precautions in securing Web servers and network firewalls in advance
of the New Year's holiday weekend, citing FBI reports indicating an increase
in activity that often precedes widespread cyber attacks. Authorities at the
National Infrastructure Protection Center - the FBI's cyber crime division -
said data gleaned from FBI investigations and other sources indicate that
many computer systems may already have been turned into "zombies"
waiting for commands from hackers to cripple the Internet.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.newsbytes.com/news/00/159873.html
REPORT: MICROSOFT HACK A U.S. SECURITY RISK
Although Microsoft Corp. has denied that the hacker who penetrated its network
in October gained access to any of the company's source code, a recent report
by a Washington-based think tank is warning that the compromise may hold
grave national security implications.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.cnn.com/2000/TECH/computing/12/29/csis.microsoft.report.idg/index.html
NEW ATTACK ON DIGITAL PIRACY
Hollywood has teamed up with some of the biggest players in computer storage
technology to build a copy-prevention scheme into every hard drive and memory
card - opening a new front in the war against online piracy. If widely adopted,
the technology would make it more difficult for consumers to duplicate
copyrighted files such as music and movies without the permission of the
companies that own the rights. Hard drives and memory cards are used to
store information on everything from personal computers and MP3 music
players to digital cameras and palm-size organizers.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www0.mercurycenter.com/svtech/news/indepth/docs/copy122900.htm
LINUXPPC SECURITY PRIMER, PART I
"So you've bought that new G4 you've been eyeing for lo these many months.
Or perhaps you've blown the dust off of some aging Performa you've kept in
your basement. Either way, you've decided to install Linux on your PowerPC
box, but you're worried about some '31337 haxOr d00dz' gaining control of
your machine through some security hole. It turns out there's both good
news and bad news for you."
Link: http://linuxppc.org/security/articles/lppc_security_primer_I.php3
'THE ANALYZER' ADMITS SABOTAGE
'The Analyzer' was convicted yesterday by the Kfar Sava Magistrates Court after
striking a plea bargain deal with prosecutors. Tannenbaum, a 21 year old Hod
Hasharon resident, confessed to offenses of conspiracy, wrongful infiltration
of computerized material, disruption of computer use, and destroying evidence.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www3.haaretz.co.il/eng/htmls/kat18_2.htm
SO MANY PREDICT SO MUCH
The three most important tech issues of 2001 will be free speech, privacy and
e-money. ISPs will continue to be the targets of governments such as France
who want to control what their citizens see and read. Privacy in all instances
will be contentious, especially when it comes to genetics. E-money will appear
back on the scene as countries other than the United States (for example,
Japan), begin to experiment and succeed with viable e-money systems.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.wired.com/news/politics/0,1283,40906,00.html
----------------------------------------------------------------------------
Security issues
---------------
All vulnerabilities are located at:
http://net-security.org/text/bugs
----------------------------------------------------------------------------
THE END OF SSL AND SSH? FOLLOW-UP
"Well, I certainly managed to kick over a hornet's next with my article "The End
of SSL and SSH?". There were quite a few points I did not cover in the article,
many I did not think of, and some I trimmed. This article will cover the reaction
to SSL and SSH being "dead", as well as numerous implementation issues I did
not cover. The real issue is that technology cannot solve problems completely."
Link: http://www.net-security.org/text/bugs/977746823,69115,.shtml
1ST UP MAIL SERVER V4.1 VULNERABILITY
The Ussr Team has recently discovered a Buffer Overflow in 1st Up Mail Server
v4.1 where they do not use proper bounds checking. The overflow is in the
field "mail from: < ", a large number of aaaaaa's "> (over 300). It then displays
this message: "Application popup: smtp server: smtp server.exe - Application
Error : The instruction at "0x00402f23" referenced memory at "0x61616161".
The memory could not be "read". This results in a Denial of Service against
the service in question.
Link: http://www.net-security.org/text/bugs/977788101,95356,.shtml
DEBIAN LINUX - DIALOG SYMLINK ATTACK
Matt Kraai reported that he found a problem in the way dialog creates lock-files:
it did not create them safely which made it susceptible to a symlink attack. This
has been fixed in version 0.9a-20000118-3bis.
Link: http://www.net-security.org/text/bugs/977886772,81869,.shtml
DEBIAN LINUX - MULTIPLE STUNNEL VULNERABILITIES
Lez discovered a format string problem in stunnel (a tool to create Universal
SSL tunnel for other network daemons). Brian Hatch responded by stating he
was already preparing a new release with multiple security fixes:
1. The PRNG (pseudo-random generated) was not seeded correctly. This only
affects operation on operating systems without a secure random generator.
2. Pid files were not created securely, making stunnel vulnerable to a symlink
attack
3. There was an insecure syslog() call which could be exploited if the user
could manage to insert text into the logged text. At least one way to exploit
this using faked identd responses was demonstrated by Lez.
These problems have been fixed in version 3.10-0potato1.
Link: http://www.net-security.org/text/bugs/977886802,94324,.shtml
DEBIAN LINUX - TWO GPG PROBLEMS
There is a problem in the way gpg checks detached signatures which can lead
to false positives. Detached signature can be verified with a command like this:
gpg --verify detached.sig < mydata
If someone replaced detached.sig with a signed text (ie not a detached
signature) and then modified mydata gpg would still report a successfully
verified signature.
Link: http://www.net-security.org/text/bugs/977886820,3938,.shtml
ORACLE INTERNET APPLICATION SERVER BUGS
The first possible vulnerability is essentially a configuration issue associated
with the Portal Listener and modplsql. When these are installed, the default
configuration allows all users access to the Listener and modplsql administration
pages. A second potential vulnerability may occur if customers grant public
access to PL/SQL procedures, in particular those which access an Oracle
database such as OWA, SYS and DBMS. Since publicly accessible procedures
may be accessed through a URL, it may be possible to to invoke these
procedures through a URL and cause SQL statements to be executed on
a back-end Oracle database.
Link: http://www.net-security.org/text/bugs/977886859,308,.shtml
NSA SECURITY-ENHANCED LINUX PROBLEM
The most recent version that appears to be available is dated last week,
slinux-200012181053-release.tgz. In this distribution, the find_default_type
function in libsecure/get_default_type.c attempts to extract a type field from
the file /etc/security/default_type and copy it to a result buffer (specifically,
to the argument "char **type"). Memory for this result buffer is allocated
using malloc, but the argument to malloc is always one character too small.
For example, the role argument might typically be "sysadm_r" and the len
argument would then be 8. With the initial installation, the first value of
buf would be "sysadm_r:sysadm_t\n". There are no leading spaces, so i is 0.
In the statement
(*type) = (char*) malloc (sizeof(char) * (strlen(buf)-i-len-1));
the argument to malloc is 18 - 0 - 8 - 1, which is 9. Then,
strcpy ((*type), &buf[i]+len+1);
attempts to copy the 10 characters "sysadm_t\n\0" into the 9-character buffer.
Link: http://www.net-security.org/text/bugs/977971173,27822,.shtml
MORE PROBLEMS FOR TECHNOTE
in main.cgi ,failed properly validate user input which arguments a call to open().
FREE_BOARD is a default db
http://localhost/technote/main.cgi/oops?
board=FREE_BOARD&command=
down_load&filename=/../../../main.cgi
Link: http://www.net-security.org/text/bugs/977971189,41142,.shtml
REMOTE VULNERABILITY IN IKONBOARD
Ikonboard is a free forum system. Similair to UBB and UB. Versions up to and
including 2.1.7b contain a vulnerability that allows commands to be executed
as the script user. Therefore compromising security of the system running the
board and allowing an attacker to get passwords of the board users, because
they are in no way encrypted/hashed.
Link: http://www.net-security.org/text/bugs/978186540,73624,.shtml
----------------------------------------------------------------------------
Security world
--------------
All press releases are located at:
http://net-security.org/text/press
----------------------------------------------------------------------------
EGGHEAD.COM INVESTIGATES PENETRATION - [24.12.2000]
Egghead.com, Inc., released the following statement: "Egghead.com has
discovered that a hacker has accessed our computer systems, potentially
including our customer databases. As a precautionary measure, we have
taken immediate steps to protect our customers by contacting the credit
card companies we work with. They are in the process of alerting card
issuers and banks so that they can take the necessary steps to ensure
the security of cardholders who may be affected.
Press release:
< http://www.net-security.org/text/press/977664283,29904,.shtml >
----------------------------------------------------------------------------
RSA CONFERENCE 2001 ASIA RFP - [27.12.2000]
RSA Security Inc. announced a call for papers and demonstrations for the first
annual RSA Conference in Asia. RSA Conference 2001, Asia, is scheduled to be
held July 9 - 12, 2001, at the Singapore International Convention and Exhibition
Center in Suntec City, Singapore. The event is expected to bring together
decision-makers and influencers from financial services, government, education,
information technology, telecommunications and the media. Security professionals,
cryptographers, analysts, developers and strategic partners are encouraged to
submit presentations on their security implementations, applications or research.
Press release:
< http://www.net-security.org/text/press/977887231,94789,.shtml >
----------------------------------------------------------------------------
RSA KEON CERTIFICATE SERVER 5.5 CLOSE TO EAL4 - [27.12.2000]
Reinforcing its commitment to product security, quality and reliability, RSA
Security Inc., the most trusted name in e-Security, announced that the RSA
Keon Certificate Server 5.5, RSA Security's digital certificate management system
designed to add trust to e-government, has been accepted into evaluation against
the Common Criteria (CC) for Information Technology Security Evaluations. The
Common Criteria for Information Technology Security Evaluation (CC) V2.1/IS
15408 is an international standard for evaluating the security of IT products.
This important achievement indicates that the RSA Keon Certificate Server is
on its way to achieving CC evaluated status recognized by governments and
businesses around the world, including Australia, Canada, France, Germany,
the Netherlands, the United States, the United Kingdom, Italy, Spain, Greece,
Norway, Finland, and New Zealand.
Press release:
< http://www.net-security.org/text/press/977887369,30178,.shtml >
----------------------------------------------------------------------------
BINDVIEW'S BV-CONTROL FINALISTS IN INFOSEC MAG - [2.12.2000]
BindView Corporation, a leading provider of IT security management solutions,
announced that its bv-Control product family has been selected as a finalist
in the Security Management & Auditing Category for the Information Security
Excellence Award given by Information Security Magazine. The winners will be
announced at an awards luncheon in February at the MIS Training Institute's
InfoSec World Conference in Orlando.
Press release:
< http://www.net-security.org/text/press/977948954,9040,.shtml >
----------------------------------------------------------------------------
TRIPWIRE GETS "NSS APPROVED" STATUS - [28.12.2000]
Tripwire Inc., the leading provider of data and network integrity software,
announced that Tripwire HQ Manager and Tripwire HQ Connector for NT
were awarded the internationally recognized "NSS Approved" status for
their exceptional performance. Tripwire's products were thoroughly tested
in the Intrusion Detection Software (IDS)/Vulnerability Assessment Group
Test 2000 by The NSS Group, Europe's foremost independent test
organization focusing on security issues.
Press release:
< http://www.net-security.org/text/press/978020664,85700,.shtml >
----------------------------------------------------------------------------
SYMANTEC CEO COMMENTS SECURITY MARKET - [28.12.2000]
On the heels of a recent Network Associates announcement, Symantec Corp.
issued the following statement to its investors and customers: "We have never
been more confident in our future," said John W. Thompson, chairman, president
and CEO of Symantec. "Symantec continues to gain momentum in the enterprise
security business. Industry leaders such as Oracle, Cobalt, Yahoo and Earthlink
have recently chosen Symantec's security technology. Global leaders in
industries ranging from automotive, telecommunications and financial services
are showing increasing confidence in our products and our company. In addition,
our recently completed merger with AXENT Technologies makes Symantec the
largest Internet security company in the world."
Press release:
< http://www.net-security.org/text/press/978020871,73838,.shtml >
----------------------------------------------------------------------------
475,000 DOWNLOADS OF AVX VIRUS PROTECTION - [29.12.2000]
At a time when other anti-virus software providers are posting losses, Central
Command Inc., a leader in the anti-virus industry, announced that within the
last 45 days more than 475,000 people have downloaded AVX virus protection
to protect their computers from viruses. AVX Professional software, with its
new virus prevention technology designed around an open plug-in architecture,
is quickly becoming a standard among Internet users.
Press release:
< http://www.net-security.org/text/press/978091342,18550,.shtml >
----------------------------------------------------------------------------
FLORIDA SUPREME COURT SELECTS IDENTIX - [29.12.2000]
Identix Incorporated, the worldwide leader in providing user authentication,
security and identification solutions, announced that the Florida State Supreme
Court has selected Identix's fingerprint biometric security solutions to secure
its 650 seat Wide Area Network (WAN) enterprise-wide, which encompasses
five District Courts of Appeal and the State Supreme Court.
Press release:
< http://www.net-security.org/text/press/978091572,661,.shtml >
----------------------------------------------------------------------------
NEW CUSTOMERS USING CERTICOM'S SSL - [29.12.2000]
Continuing to strengthen its position as a leading provider of e-business security,
Certicom, announced that is has signed license agreements with five new
companies. Additional licensees are Alteon WebSystems, i-drive, Five Nine
Solutions, Inc., Ponoi Corp. and Tempest Software. These companies have
licensed Certicom's leading SSL Plus software to enhance the security and
trust of their respective internal applications and e-business offerings.
Press release:
< http://www.net-security.org/text/press/978091709,67478,.shtml >
----------------------------------------------------------------------------
Featured articles
-----------------
All articles are located at:
http://www.net-security.org/text/articles
Articles can be contributed to staff@net-security.org
Below is the list of the recently added articles.
----------------------------------------------------------------------------
YOUR OPINION: "WHAT ARE THE CURRENT PRIVACY THREATS?"
Recently we held a survey on HNS regarding the current privacy threats. Many
visitors decided to share their opinions with us. In this article you can read
some of the most interesting opinions.
Read more:
< http://www.net-security.org/text/articles/opinion.shtml >
----------------------------------------------------------------------------
ICMP USAGE IN SCANNING VERSION 2.5 by Ofir Arkin
"The Internet Control Message Protocol may seem harmless at first glance. Its
goals and features were outlined in RFC 792 (and than later cleared in RFCs
1122, 1256, 1349, 1812), as a way to provide a means to send error messages,
troubleshoot networking problems, and more. There is no consent between the
experts in charge for securing Internet networks (Firewall Administrators,
Network Administrators, System Administrators, Security Officers, etc.)
regarding the actions that should be taken to secure their network
infrastructure in order to prevent those risks. The risks involved in
implementing the ICMP protocol in a network, regarding scanning,
are the subject of this research paper".
PDF Version:
< http://www.net-security.org/text/articles/index-download.shtml#ICMP >
----------------------------------------------------------------------------
THE ABC OF COMPUTER SECURITY by Paul Ducklin
This White Paper gives an introduction to computer security and its significance
for businesses, followed by an alphabetical guide to common security measures
and threats.
PDF Version:
< http://www.net-security.org/text/articles/index-download.shtml#ABC >
----------------------------------------------------------------------------
RESULTS OF THE SECURITY IN ACTIVEX WORKSHOP
On August 22-23, 2000, the CERT Coordination Center hosted a workshop in
Pittsburgh, Pennsylvania, for twenty invited experts to address security issues
related to ActiveX controls. The primary goal of the workshop was to identify
the situations under which ActiveX and related technologies may be used safely
and to produce a paper describing security concerns and configuration guidance.
That goal was achieved and the result of the workshop, this paper, serves not
only to dispel unwarranted myths about the safety of using ActiveX but also to
furnish guidance to network administrators and others faced with security issues
involving mobile code in general and ActiveX in particular.
Read more:
< http://www.net-security.org/text/articles/index-download.shtml#active >
----------------------------------------------------------------------------
Featured books
----------------
The HNS bookstore is located at:
http://net-security.org/various/bookstore
Suggestions for books to be included into our bookstore
can be sent to staff@net-security.org
----------------------------------------------------------------------------
CIM IP ROUTING DVP SIMULATOR (CISCO CAREER CERTIFICATIONS)
With CIM IP Routing: Distance-Vector Protocols, you can master protocols that
are the backbone of the Internet and enable traffic to move across business
networks. Offering self-paced instruction and practice, this robust learning tool
gives you a quick and cost-effective way to acquire Cisco knowledge and
expertise. From an overview of IP routing concepts to the development of
IP access lists, youll learn the difference between routing functions and
strategies, routing traffic using multiple paths, and how to implement routing
protocols for quick convergence times with minimal network traffic through
Cisco internetworking devices. Mastering techniques developed by Cisco
Technical Assistance Center engineers, youll practice configuring and
troubleshooting RIP, IGRP, and EIGRP over IP networks. CIM IP Routing:
Distance-Vector Protocols is an excellent preparation tool for the Cisco
Certified Network Associate (CCNA) exam.
Book:
< http://www.amazon.com/exec/obidos/ASIN/1587200120/netsecurity >
----------------------------------------------------------------------------
IN THE TRENCHES: CUSTOMIZING AND UPGRADING LINUX
A reference for the busy professional to installing and administering Linux,
detailing the difference between Linux and other Unix systems. The CD-ROM
contains Red Hat Linux 6.2, to enable the reader to follow along with the
text and see how Linux works.
Book:
< http://www.amazon.com/exec/obidos/ASIN/1930713010/netsecurity >
----------------------------------------------------------------------------
GNU AUTOCONF, AUTOMAKE, AND LIBTOOL
This is a technically adept and expert guide to using these utilities effectively.
Any C/C++ or script programmer who writes software under Unix/Linux will want
to have a copy of this book to make better use of these powerful and sometimes
obscurely documented tools. This text is filled with the nuts-and-bolts details
of running these three utilities, including command-line switches and the actual,
generated files that automate the build process and help programmers port code
between different environments. As such, this title will be appreciated by those
at their workstations who want a hands-on guide to using the autotools. There's
a danger of missing the forest for the trees here, with all of this necessary detail,
but the middle sections of this book pull back a little with several useful chapters
on the bigger picture of code "portability." Chapters on both C and C++ portability
explore language features that likely will cause trouble when code is moved
between different versions of Unix (or even between Unix and Windows). A
similar section also discusses the issues when developing portable shell scripts.
Book:
< http://www.amazon.com/exec/obidos/ASIN/1578701902/netsecurity >
----------------------------------------------------------------------------
LINUX IP STACKS COMMENTARY
The book is an in-depth look at the TCP/IP protocol implementation as
implemented in Linux. Using the style of John Lion's original much-photocopied
A Commentary on the Unix Operating System, Linux IP Stacks Commentary
guides you through the ins and outs of TCP, UDP, ICMP, routing, IPCHAIN
firewall code, and the Linux TCP/IP applications interface. The source for
the network code is included in the book and on the CD-ROM.
Book:
< http://www.amazon.com/exec/obidos/ASIN/1576104702/netsecurity >
----------------------------------------------------------------------------
APACHE SERVER COMMENTARY
A guide for programmers and developers who need to understand and master
the source code that runs the world's mot popular Web server. Holden (author
and president of Stylus Media), Nicholas Wells (technical writer and consultant),
and Matthew Keller (programmer/analyst for Distributed Computing and
Telemedia department at the State U. of New York College) conduct a
line-by-line examination of the core code, as well as the standard Apache
modules that control logging, directory indexing, access control, CGI, and
other essential aspects of running a full-featured Web site. Flow charts
illustrate how individual modules work. The included CD-RRM contains the
complete source code for version 1.3.6 of the Apache Web server package,
a precompiled binary version of Apache for Windows 32- bit platforms,
ApacheWrapper version 1.3.29, Comanche, IPTraf version 1.4.3, and
Chili!Soft ASP 3.0.
Book:
< http://www.amazon.com/exec/obidos/ASIN/1576104680/netsecurity >
----------------------------------------------------------------------------
Security Software
-------------------
All programs are located at:
http://net-security.org/various/software
----------------------------------------------------------------------------
W32.KRIZ PREVENTION TOOL
This tool is a preventive measure against the W32.Kriz virus. It will not repair
damage done after the virus has been launched.
Info/Download:
< http://net-security.org/various/software/977614917,63951,.shtml >
----------------------------------------------------------------------------
KILL_CIH REMOVAL TOOL
The KILL_CIH tool is designed to safely detect and remove all known strains
of the W95.CIH (Chernobyl) virus (known strains as of August 3rd, 1998) from
memory under Windows 95 and Windows 98 (the W95.CIH virus cannot infect
Windows NT systems). If the tool is run before the virus has infected the
system, it will also "inoculate" the computer's memory to prevent the W95.CIH
virus from infecting the system until the next system reboot.
Info/Download:
< http://net-security.org/various/software/977615146,72255,.shtml >
----------------------------------------------------------------------------
W32.NAVIDAD REMOVAL TOOL
This tool will only work for W32.Navidad and it will not work for the
W32.Navidad.16896 variant.
Info/Download:
< http://net-security.org/various/software/977615252,711,.shtml >
----------------------------------------------------------------------------
CHKROOTKIT-0.19
chkrootkit locally checks for signs of a rootkit. Includes detection of LKM
rootkits, ifpromisc.c to check and see if the interface is in promisc mode,
chklastlog.c to check lastlog for deletions, and chkwtmp.c to check wtmp
for deletions. Tested on Linux, FreeBSD, Solaris, and OpenBSD.
Info/Download:
< http://net-security.org/various/software/978188214,78469,.shtml >
----------------------------------------------------------------------------
SECURE DISK EXPLORER 1.1.3
Secure Explorer is a full-featured file manager similar to Windows Explorer.
However, the biggest difference is that this program provides a completely
secure environment for data and documents on your system. It's capable of
encrypting files and locking folders, thus making them inaccessible to other
users. Like Explorer, Secure Explorer supplies its very own shell context menu.
As you browse your hard drive, simply right-click an item and select the
appropriate protection option from the menu. The program gives you the
option of preventing Explorer from displaying these items. Meanwhile, files
and folders are stored inside tabs on the interface, which require passwords
for entry. Like Explorer, Secure Explorer supplies its very own shell context
menu.
Info/Download:
< http://net-security.org/various/software/978188372,43683,.shtml >
----------------------------------------------------------------------------
Defaced archives
------------------------
[25.12.2000] - ChangChun Sience&Technology, China
Original: http://www.ccst.gov.cn/
Defaced: http://www.attrition.org/mirror/attrition/2000/12/25/www.ccst.gov.cn/
[25.12.2000] - Slackware
Original: http://www.slackware.com/
Defaced: http://www.attrition.org/mirror/attrition/2000/12/25/www.slackware.com/
[25.12.2000] - Nasdaq Japan
Original: http://www.nasdaq.co.jp/
Defaced: http://www.attrition.org/mirror/attrition/2000/12/24/www.nasdaq.co.jp/
[25.12.2000] - Administrative Office of the U.S. Courts
Original: http://www.nywd.uscourts.gov/
Defaced: http://www.attrition.org/mirror/attrition/2000/12/25/www.nywd.uscourts.gov/
[26.12.2000] - Hizbollah
Original: http://www.hizbollah.org/
Defaced: http://www.attrition.org/mirror/attrition/2000/12/26/www.hizbollah.org/
[27.12.2000] - Government Republic Of Moldova Site
Original: http://ministry.moldova.md/
Defaced: http://www.attrition.org/mirror/attrition/2000/12/27/ministry.moldova.md/
[27.12.2000] - National Oceanic and Atmospheric Administration
Original: http://www.fob.noaa.gov/
Defaced: http://www.attrition.org/mirror/attrition/2000/12/27/www.fob.noaa.gov/
[28.12.2000] - US DOI, Bureau of Land Management
Original: http://www5.ca.blm.gov/
Defaced: http://www.attrition.org/mirror/attrition/2000/12/28/www5.ca.blm.gov/
[29.12.2000] - Embassy of Israel, Wellington, New Zealand
Original: http://www.israel.org.nz/
Defaced: http://www.attrition.org/mirror/attrition/2000/12/29/www.israel.org.nz/
[29.12.2000] - Human Right Education Programme, Pakistan
Original: http://www.hrep.com.pk/
Defaced: http://www.attrition.org/mirror/attrition/2000/12/29/www.hrep.com.pk/
----------------------------------------------------------------------------
Questions, contributions, comments or ideas go to:
Help Net Security staff
staff@net-security.org
http://net-security.org
