HNS Newsletter
Issue 43 - 25.12.2000
http://net-security.org

[ -- Happy Holidays -- ]
 
This is a newsletter delivered to you by Help Net Security. It covers weekly 
roundups of security events that were in the news the past week. Visit Help 
Net Security for the latest security news - http://www.net-security.org.

Subscribe to this weekly digest on:
http://www.net-security.org/text/newsletter
 
Table of contents:
 
1) General security news
2) Security issues
3) Security world
4) Featured articles
5) Featured books
6) Security software
7) Defaced archives


========================================
Help Net Security in association with Viking Penguin gives 
you the chance to win two copies of Stephen Levy's new book 
called "Crypto". Steven Levy is the author of Hackers, which 
has been in print for more than fifteen years. Crypto is about 
privacy in the information age and about the nerds and 
visionaries who, nearly twenty years ago, predicted that the 
Internet's greatest virtue--free access to information--was also 
its most perilous drawback: a possible end to privacy. 

Visit http://www.net-security.org/various/bookstore/levy/
========================================




General security news
---------------------
 
----------------------------------------------------------------------------

PORT SCANS LEGAL, JUDGE SAYS
A tiff between two IT contractors that spiraled into federal court ended last 
month with a U.S. district court ruling in Georgia that port scanning a network 
does not damage it, under a section of the anti-hacking laws that allows 
victims of cyber attack to sue an attacker. Last week both sides agreed not 
to appeal the decision by judge Thomas Thrash, who found that the value of 
time spent investigating a port scan can not be considered damage. "The 
statute clearly states that the damage must be an impairment to the 
integrity and availability of the network," wrote the judge, who found 
that a port scan impaired neither.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.securityfocus.com/news/126


SERIOUS SECURITY SLIP AT BTOPENWOE
Due to a serious security lapse, users signing up to BTOpenworld's ADSL service 
have been invited to send credit card details over an insecure internet connection. 
A vulture-eyed Register reader, who tried to sign up to the telcom giant's domestic 
version of BTOpenworld, noticed he was invited to submit his credit card details 
over an insecure http connection. He had been trying to register for the home 
500 service. He also discovered that orders for the broadband service submitted 
over the phone were input by BT's operators using the same insecure web page.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.theregister.co.uk/content/5/15564.html


BUSH EYES OVERHAUL OF E-SECURITY
With George W. Bush striding toward the White House, national security experts 
are preparing for what could be a major change in the way the government and 
the private sector organize to defend against cyberattacks.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.infoworld.com/articles/hn/xml/00/12/18/001218hnbush.xml


IDC PUTS PKI ON FAST TRACK
Security has been an uncertain wonder of the Web, causing many companies 
to shy away from online transactions. But public-key infrastructure vendors 
seek to change all that, and according to research firm IDC, these vendors 
are seeing success.
Link: http://www.line56.com/articles/default.asp?NewsID=1874


THE CRUX OF NT SECURITY PHASE FOUR
This is the fourth in a series on NT security by Aaron Sullivan. In the previous 
article, the author discussed secure network design three common network 
configurations referred to as Networks A, B and C. This article will discuss a 
last design, Network D, for those with more performance and security 
demands, as well as a high availability feature, and the additional budget 
required to implement it. The article will examine issues surrounding 
implentation, strengths and weaknesses of the network.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.securityfocus.com/focus/microsoft/nt/crux4.html


SECURITY AGAINST COMPELLED DISCLOSURE
"Various existing and pending legislation can be used to force individuals and 
organizations to disclose confidential information. Courts may order a wide 
variety of data to be turned over by either party in civil and criminal cases. 
Government agencies are explicitly tasked with protecting "national economic 
security." And organised crime will target information just like any other valuable 
asset. In a less than perfectly ethical world, companies require means to protect 
their information assets against economic espionage, misuse of discovery 
processes and criminal coersion. We describe actual and potential examples 
of compelled disclosure abuses in the US and UK, and enhancements to 
conventional security services for protecting communications and stored 
data against their recurrence."
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.apache-ssl.org/disclosure.pdf


DIGITAL ASSAULT AGAINST PENTAGON RISES
The number of cyberattacks and intrusions into Pentagon computer networks 
this year is expected to top off at 24,000, an increase of 5 percent compared 
with last year, said the U.S. Department of Defense. However, the 
overwhelming majority of those intrusions are due to known vulnerabilities 
and poor security practices.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.cnn.com/2000/TECH/computing/12/18/pentagon.cyberattacks.idg/index.html


FBI: 'TIS THE SEASON FOR CYBERATTACKS
Malicious hacker activity targeting e-commerce sites has been heating up for 
the holidays, the FBI's National Infrastructure Protection Center said in a report 
released earlier this month. That should be no surprise. More people than ever 
are shopping online, said a report issued yesterday by Chicago-based Andersen 
Consulting, and a greater proportion of them - 92 percent as opposed to 75 
percent last year - are successfully completing their online purchases.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.cnn.com/2000/TECH/computing/12/18/increase.in.cyberattacks.idg/index.html


SECURITY AND ENCRYPTION TECHNOLOGIES BOOMING
"PKI is an important foundation for digital trust in enterprises and extranets," 
said Jeason Yeu, president of 3Rsoft.com, a subsidiary of 3R Soft Inc., which 
controls an 80 percent share of the security software market. Using a PKI
enabled mail server, the system's administrators can trace a visitor's personal 
information or the location of their personal computer and eventually protect 
additional crimes on the web. Furthermore, the system can provide legal 
evidence in the form of a log file. In addition, users can securely download 
digital credentials into their personal computer from anywhere over the 
Internet, allowing them to work from multiple systems both at their 
offices and at home.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.korealink.co.kr/kt_tech/200012/t20001219173631451127.htm


DEFACEMENT STATISTICS
There is a new addon in 'Attrition Defacement Statistics', which is a graph 
called 'Top Groups OS breakdowns'. It is a graphical file containing all groups 
with more then 45 defacements and it shows the operating system stats of 
those defacements. Microsoft Windows NT is leading with 45%.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.attrition.org/mirror/attrition/graphs/groups_os.gif


VIRUS WRITERS AND CRACKER LOVE-IN
Crackers are using viruses to get their malicious code into corporate Intranets, 
according to Marc Blanchard, technical director at Trend Micro. This means 
antivirus companies will have to start working on ways to combat this code, 
as well as the viruses they are used to tackling. This is part of a general 
trend of convergence between the virus writers and crackers that would 
have seemed impossible a few years ago.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.theregister.co.uk/content/4/15585.html


CYBERCRIME TREATY CONDEMNED
A draft European treaty on cybercrime has been condemned as "appalling" by 
civil liberty groups around the globe. In all, 23 organisations have signed a 
letter warning that the treaty will do serious damage to civil liberties under 
the guise of helping law enforcers catch computer criminals.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://news.bbc.co.uk/hi/english/sci/tech/newsid_1072000/1072580.stm


EMAIL AND THE INTERNET: UNEXPECTED SECURITY RISKS
External email of all kinds can be filtered through a firewall system which strictly 
controls the addresses of inbound and outbound messages. Specifically, such a 
firewall must include detection of fraudulent addresses on inbound email: 
addresses implying that external email originated from within the organization. 
For consistency, and as a service to the greater community, such a firewall 
should also restrict outbound email to ensure that no such messages have 
addresses implying that they originated outside the organization. These 
measures help to fight unsolicited commercial email ("spam") on the Net.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://securityportal.com/articles/email20001219.html


PEACEFIRE TOSSES WEB-FILTER GRENADE
Porn-blocking Web filters from Net Nanny, CyberSitter, and five other companies 
can be disabled with a program released Monday by anti-filtering group Peacefire, 
the group claims. The program, available as a free download at the Peacefire 
Web site, was released in reaction to expected federal mandates for Web filters 
on school and library computers. "Peacefire" is actually an amalgam of the 
instructions for disabling filters that Peacefire has been posting on its site 
for months. But instead of having to input lines of code, the download 
makes disabling filters a "one-click process," said Peacefire's Bennett Haselton.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.zdnet.com/zdnn/stories/news/0,4586,2666010,00.html


VULNERABILITIES IN OS PATCH DISTRIBUTION
The bugtraq mailing list and other security forums regularly announce dozens 
of new security patches every month; however, there has been little or no 
mention that there are substantial differences across vendors in the extent 
to which their patch distributions offer authentication and integrity protection.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://razor.bindview.com/publish/papers/os-patch-sum.html


MCAFEE ANTIVIRUS UPDATE DAMAGES NT 4.0
Read on to find out how to stop the antivirus update messing with your master 
boot record. Windows 2000 users are not affected. A number of Windows NT 
4.0 users who updated Network Associate's McAfee VirusScan/Netshield 4.0.2 
using the 4120/4110 SuperDat utility were greeted with an ominous error 
message upon rebooting: "Operating System Not Found." This upgrade had in 
fact damaged the Master Boot Record of the NTFS partition. The MBR contains 
information that, among other things, tells the computer where to find the 
operating system when it starts up. In one worst-case scenario made very 
real, System Administrator Craig Hackl reports distributing the 4120/4110 
upgrade to 130 workstations on a Windows NT network and having to 
reinstall the OS on every PC.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.zdnet.co.uk/news/2000/50/ns-19841.html


WEB BUGS, PARANOIA AND MICROSOFT
"I don't think Microsoft will be getting anything for Christmas this year. Over the 
years Microsoft has certainly been very public about privacy, trumpeting how it 
respects consumer rights and protects your personal information. At the same 
time it has been deploying technology and services that intrude heavily into 
users' privacy."
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://securityportal.com/closet/closet20001220.html


SYSTEMS TO BE CHECKED
British police force computer systems are to be checked for illegal software 
in plans announced by junior Home Office minister Lord Bassam. Bassam 
pronounced in parliament yesterday that the Association of Police Chief 
Officers will audit a sample of police IT equipment, checking for the widely 
distributed counterfeit Microsoft software.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.silicon.com/a41646


THIS NAUGHTY BUG'S NOT NICE FOR CHRISTMAS
Makers of virus-protection software are warning PC owners about some rogue 
code that packs a Dec. 25 surprise. Although the virus, labeled W32.Kriz, 
caused barely a ripple during its first Christmas in 1999, experts at software 
maker Symantec Corp. say it's possible that "Kriz" has had a busy year 
piggybacking on some higher-profile visitors, such as the Happy99 worm. 
Marian Merritt, a group product manager for Symantec, makers of the Norton 
AntiVirus line, told Newsbytes that Kriz is a potentially nasty virus that infects 
32-bit Windows executable files. While it can infect new programs at any time, 
it turns destructive only on Dec. 25, when it attempts a two-pronged attack 
on a host PC by trying to destroy the contents of the chip-resident BIOS and 
erasing hard disk contents.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.computeruser.com/news/00/12/20/news13.html


CHECK POINT RECOMMENDS AN UPDATE
Check Point has been made aware of security issues related to the FastMode 
service in VPN-1/FireWall-1. All known issues related to this issue are fully 
addressed in VPN-1/FireWall-1 4.1 SP3 which is available for immediate 
download. Check Point recommends that all users of VPN-1/FireWall-1 
upgrade to the new release.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.checkpoint.com/techsupport/alerts/index.html


VIRUS TROUBLE IN INDIA
A leading data recovery company has reported that a virus has caused data 
loss after spreading through major automobile, engineering, government and 
financial institutions and personal computers in India.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.timesofindia.com/today/20info9.htm


SOLARIS KERNEL TUNING FOR SECURITY
The Solaris kernel provides a great deal of user-configurable control over the 
system TCP/IP stack. Everything from cache table lifetimes to the number of 
TCP connections that the system can address are controllable. However, 
without understanding the underlying need for tuning these kernel parameters, 
many system administrators choose to ignore them - thereby leaving their 
systems vulnerable to a resourceful assailant. This article by Ido Dubrawsky 
discusses the ways in which these parameters can be adjusted to strengthen 
the security posture of a system.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.securityfocus.com/focus/sun/articles/kernel.html


HOSPITAL HACK POINTS TO NEED FOR STANDARDS
The recent hacking of 5,000 administrative patient files from one of the country's 
top hospitals underscores the lack of firm, clear, universal standards to ensure 
the security of online medical records. Although officials are crafting regulations 
governing electronic patient records for the health care industry, some analysts 
and industry players are skeptical about how effective these specifications will be.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.cnn.com/2000/TECH/computing/12/20/health.care.security.idg/index.html


TAIWAN GOVERNMENT WEB SITE ATTACKED
An attacker, possibly based on the Chinese mainland, invaded the principal Web 
site operated by Taiwan's Board of Foreign Trade sometime between 6 p.m. 
Sunday and 9 a.m. Monday, Taipei time. As of Wednesday morning, the site 
was still not operating. Board officials did not provide any explanation. Although 
the intruder called himself the "old cat from Chaozhou" - Chaozhou is a coastal 
city in eastern Guangdong province - and politically motivated China-based 
hackers have in the past attacked Taiwan government sites, officials said 
the attacker may be from Taiwan.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.internetnews.com/intl-news/article/0,,6_540731,00.html


SECURITY PATCH DISTRIBUTION - IT'S TROJAN TIME
The way operating system vendors issue security patches is insecure, in many 
cases, and could let crackers exploit this to trick users into loading trojan 
horses onto their systems. Security firm BindView, whose Razor team of 
security researchers completed the research, questioned 27 different 
vendors of commonly used products on whether patches are accompanied 
by digital signatures or other forms of cryptographic authentication. Its 
findings are a real eye-opener because they highlight glaring security 
gaps, not least that a minority of vendors, including Apple and Compaq, 
provide no authentication for their patches.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.theregister.co.uk/content/4/15618.html


SECURE CGI LIBRARY
The Secure CGI Library eases the development of C/C++ Web applications using 
the CGI interface. It's designed with security in mind and can enforce correct 
limits to avoid common denial-of-service attacks. It can also handle an unlimited 
number of variables with unlimited content size, and with very fast parsing and 
hashed lookups.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.jedi.claranet.fr


UPDATE ON DECSS TRIALS
"I am an avid DVD enjoyer. I love watching DVD movies. I've purchased many 
in the past. I've got a DVD player. I wanted to watch DVDs on my computer," 
said Hughes 29 year old Jeraimee Hughes who is being trialed for putting DeCSS 
on www.ct2600.org. DeCSS trials are still bugging people who mirrored DeCSS...
Link: http://www.ctnow.com/scripts/editorial.dll?fromspage=CG/articles/business.htm&categoryid=&bfromind=377&eeid=3678448&eetype=article&render=y&ck=&userid=206553684&userpw=.&uh=206553684,2,&ver=2.11


TOKYO STOCK EXCHANGE AND VIRUSES
Strange quote from Kyodo Magazine's article - "Someone has hacked into the 
server of the 'Mothers Supporters Club' e-mail magazine on the Internet home 
page of the Tokyo Stock Exchange (TSE), and has sent virus-infected e-mails 
to some club members, the TSE said Thursday." 
Link: http://home.kyodo.co.jp/fullstory/display.jsp?newsnb=20001221089


THE STORY OF JEFF: PART V
This story is the ongoing saga of Jeff, a tragic tale full of hardship, heartbreak 
and triumph over impossible odds. Jeff is your average network administrator, 
responsible for Acme, Inc.'s Microsoft-based corporate network. This week Jeff 
hears a knock on his door and answers it. He lets Cindy into his office, wondering 
what's up. "Jeff, I think we have a problem..." she starts, hoping to phrase it so 
he won't take it the wrong way. "You remember those phone logs I mentioned 
at the party?"
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.securityportal.com/articles/jeff20001222.html


HOW DOES YOUR NET SECURITY RATE?
The newly-formed Center for Internet Security hopes to answer that question 
by creating a suite of tests that would give computer owners a rating - on a 
scale of 1 to 10 - of how good their security is. A level-10 server could protect 
an e-commerce company's virtual gold, while a level-1 would be an online 
vandal's playground.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.zdnet.com/zdnn/stories/news/0,4586,2667644,00.html


MAKING RED HAT SECURE
In this article I will explain how to make your Linux box secure by taking basic 
security measures. This article will enable anybody to tighten the security of a 
redhat Linux box. Always set a password on BIOS to disallow booting from 
floppy by changing the BIOS settings. This will block undesired people from 
trying to boot your Linux system with a special boot disk and will protect you 
from people trying to change BIOS feature like allowing boot from floppy drive 
or booting the server without password prompt.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.linuxmonth.com/issue4/articles/redhat/redhat.html


CERT ON ACTIVEX
Past summer, CERT sponsored a two-day workshop on security issues with 
ActiveX controls. The final report was just released today and is available 
as a PDF file at the CERT Web site.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.cert.org/reports/activeX_report.pdf


RAID 2001 CFP
The RAID International Symposium series is intended to further advances in 
intrusion detection by promoting the exchange of ideas in a broad range of 
topics. They just issued Call For Paper.
Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.raid-symposium.org/Raid2001

----------------------------------------------------------------------------




Security issues
---------------

All vulnerabilities are located at:
http://net-security.org/text/bugs


----------------------------------------------------------------------------

SAFEWORD E.ID TRIVIAL PIN BRUTE-FORCE
An attacker that obtains access to the "sceiddb.pdb" file, part of Secure 
Computing's e.iD Authenticator for Palm, can determine the user's PIN.
Link: http://www.net-security.org/text/bugs/977145205,24054,.shtml


BUGS IN WATCHGUARD SOHO FIREWALL
ISS X-Force discovered the following vulnerabilities in the SOHO Firewall that 
may allow an attacker to compromise or deny service to the device:
1. Weak Authentication
2. GET Request Buffer Overflow
3. Fragmented IP Packet Attack
4. Password Reset Using POST Operation
Link: http://www.net-security.org/text/bugs/977145222,94540,.shtml


MDAEMON MAIL SERVER VULNERABILITY
If a mail server administrator wanted to deny access to MD server , he right 
clicks on the system tray Icon and select "lock server" and then MDaemon will 
ask for a password and again ask to confirm it. Whenever you wanted to open 
MD window, you double click on the icon at system tray, MD will ask for the 
password. If you enter the correct password, you will be allowed inside. The 
security could be bypassed here. Just double click on the system tray icon of 
MDaemon to start. Now, MDaemon will prompt for the password. Without 
entering any password the, just click on Cancel button. AND IMMEDIATELY 
PRESS THE ENTER KEY and YOU WILL BE TAKEN INTO MDAEMON. You can 
do whatever you wanted to do with MDaemon and then safe minimize it to 
close the window.
Link: http://www.net-security.org/text/bugs/977145237,83311,.shtml


LINUX MANDRAKE - JPILOT UPDATE
The jpilot program automatically creates a directory called .jpilot/ in the user's 
home directory with 777 (world read/write/execute) permissions. This directory 
is used to store all backups, configuration and synchronized Palm Pilot 
information.
Link: http://www.net-security.org/text/bugs/977183880,80077,.shtml


SONATA CONFERENCING VULNERABILITIES
The setuid binary doroot does exactly what it says. It executes its command 
line argument as root.
Link: http://www.net-security.org/text/bugs/977276142,19919,.shtml


OPENBSD SECURITY ADVISORY
A relatively obscure one-byte buffer overflow bug present in ftpd(8) turns out to 
be a serious problem, yielding remote users root access under certain conditions. 
For a system to be vulnerable, ftpd must have been explicitly enabled by the 
administrator (OpenBSD ships with it OFF by default) and the attacker must 
have write access to at least one directory. Therefore, anonymous read-only 
FTP servers are safe (we recommend applying the patch regardless, of course). 
Non-anonymous FTP administrators should seriously consider using a more secure 
transport like SSH.
Link: http://www.net-security.org/text/bugs/977276297,17614,.shtml


MICROSOFT SECURITY BULLETIN MS00-097
Microsoft Windows Media Services are the server-side component of Windows 
Media Technologies which provides streaming video and audio content 
capabilities. It is divided into types of services, Unicast and Multicast. 
Windows Media Unicast Services supplies media content to one client at 
a time as opposed to Multicast which serves multiple clients simultaneously. 
Windows Media Unicast Services are only affected by the vulnerability at hand. 
In the event that a client establishes a connection and then severs it abruptly 
in a particular fashion, Windows Media Services will not release the resources it 
has allocated to that particular client. If Windows Media Services were to 
receive these connections repeatedly, resources would become depleted and 
reach such a level that Windows Media Services would not be able to properly 
service clients. Restarting the service would be required in order to regain 
normal functionality and any client being serviced at the time would have 
to re-establish their connection.
Link: http://www.net-security.org/text/bugs/977359935,2693,.shtml


RED HAT LINUX - NEW SLOCATE PACKAGES
New slocate packages are availble for Red Hat Linux 6.x and Red Hat Linux 7. 
These fix a problem with the database parsing code in slocate. (slocate was 
not shipped with Red Hat Linux prior to version 6.0, so earlier versions are 
not affected.)
Link: http://www.net-security.org/text/bugs/977359967,76749,.shtml


PROFTPD 1.2.0 MEMORY LEAKAGE
This is sample code to demonstrate effects of memory leak in ProFTPD daemon. 
As far as I know all available versions up to date (19.12.2000) are vulnerable to 
this. http://www.net-security.org/text/bugs/dos.c This bug is not dangerous, if 
you run one instance of included code. But wonder, what will happen, if someone 
will run about 20 sessions... Wojciech Purczynski reported, that memory leak 
exists also, when other FTP commands are invoked (eg. STAT).
Link: http://www.net-security.org/text/bugs/977428179,1015,.shtml


NETBSD SECURITY ADVISORY 2000-017
The combination of a too liberal implementation in telnetd and bugs in libkrb 
combines to make it possible for authorized users of a system to obtain root 
access on a system.
Link: http://www.net-security.org/text/bugs/977428196,62700,.shtml


NORTON ANTIVIRUS 5.0 AND EMBEDDED FILES
Files 'embedded' in Word and Excel documents appear to evade scanning.
Link: http://www.net-security.org/text/bugs/977428211,77420,.shtml


MULTIPLE VULNERABILITIES IN ZONEALARM
ZoneAlarm does not detect several types of common Nmap scans. It is also 
possible for a remote attacker, under certain circumstances, to gain complete 
access to the file system and disable ZoneAlarm.
Link: http://www.net-security.org/text/bugs/977428230,93713,.shtml


BS SCRIPTS VULNERABILITIES
There are a couple of scripts from bsScripts (www.stanback.net), that have 
holes in them because the author did not filter out; from the form input. The 
scripts that this affects is bsguest (a guestbook script) and bslist (a mailing 
list script). The hole allows anyone to execute commands on the server. The 
author has been informed and the holes are now patched in the latest release. 
Link: http://www.net-security.org/text/bugs/977428251,12200,.shtml


INFINITE INTERCHANGE DOS
One of Interchange's main features is a popular webmail interface. This interface 
and it's supporting HTTP server are subject to a Denial of Service attack through 
a malformed POST request.
Link: http://www.net-security.org/text/bugs/977448625,43634,.shtml


ZOPE DTML ROLE ISSUE
The issue involves security registration of "legacy" names for certain object 
constructors such as the constructors for DTML Method objects. Security 
was not being applied correctly for the legacy names, making it possible to 
call those constructors without the permissions that should have been required. 
This issue could allow anonymous users with enough internal knowledge of Zope 
to instantiate new DTML Method instances through the Web.
Link: http://www.net-security.org/text/bugs/977572733,90410,.shtml

----------------------------------------------------------------------------




Security world
--------------

All press releases are located at:
http://net-security.org/text/press

----------------------------------------------------------------------------

LINK ENCRYPTOR FOR E-BUSINESS SECURITY - [18.12.2000]

E-business security provider Cylink Corporation introduced the Cylink Link 
Encryptor HSSI, the fastest member of Cylink's link encryptor family with 
encryption rates of up to 52 Mbps for high-speed data communications. 
The CLE HSSI (High-Speed Serial Interface), the latest addition to Cylink's 
comprehensive set of encryption solutions, supports the X.509 digital 
certificate and 1024 bit DSS digital signature industry standards. X.509 
defines what information can go into a certificate and the format in 
which it is to be recorded.

Press release:
< http://www.net-security.org/text/press/977145426,38251,.shtml >

----------------------------------------------------------------------------

THE INTERNET SECURITY CONFERENCE 2001 - [19.12.2000]

The Internet Security Conference (TISC) will be held June 4-8, 2001, at the 
Century Plaza Hotel in Los Angeles. TISC is the industry leading technical 
event addressing the issues of safeguarding enterprise networks and 
Internet connections.

Press release:
< http://www.net-security.org/text/press/977182677,55154,.shtml >

----------------------------------------------------------------------------

CYBERGUARD STARLORD SECURITY SOLUTION - [19.12.2000]

When it comes to providing security for the most demanding environments, 
specifically key Web hosting companies who provide Internet services to 
others, a growing number of those companies have turned to CyberGuard's 
new super-powerful firewall appliance, STARLord.

Press release:
< http://www.net-security.org/text/press/977182980,19721,.shtml >

----------------------------------------------------------------------------

CYBERGUARD'S KNIGHTSTAR - "PICK OF 2000" - [19.12.2000]

CyberGuard Corporation, the technology leader in network security, announced 
that its KnightSTAR premium appliance firewall has been named a "Pick of 2000" 
by SC Magazine, a magazine devoted entirely to computer security. KnightSTAR 
received a five-star rating in the magazine's December 2000 issue, which 
includes the prestigious "Buyer's Bible 2001." KnightSTAR is among the select 
IT security products listed in the guide, featuring the "best of the best" 
security products reviewed by the SC labs throughout the year.

Press release:
< http://www.net-security.org/text/press/977183096,38879,.shtml >

----------------------------------------------------------------------------

ALADDIN PARTNERS WITH RSA SECURITY TO OFFER TRUSTED ENVIRONMENTS 
FOR DIGITAL CERTIFICATES - [19.12.2000]

Aladdin Knowledge Systems, a global leader in the field of Internet content and 
software security, announced they have signed a strategic partnership agreement 
with RSA Security, the most trusted name in e-security, in which RSA Security's 
RSA Keon digital certificate management system will be used with eToken, 
Aladdin's USB-based user authentication device to enable customers to securely 
store private keys and digital certificates to conduct e-business transactions.

Press release:
< http://www.net-security.org/text/press/977183135,96159,.shtml >

----------------------------------------------------------------------------

BLACK HAT WINDOWS 2000 SECURITY CON - [19.12.2000]
February 14-15, 2001 @ Caesars Palace Hotel in Las Vegas, NV USA
The Black Hat Briefings Win2K Security conference features a proven format 
emphasizing in-depth technical presentations and peer-to-peer networking. It 
will provide you with specific solutions to your most pressing security challenges. 
If you¹re responsible for Win2K systems security in your organization you need 
to attend the Black Hat Briefings Windows 2000 conference.

Press release:
< http://www.net-security.org/text/press/977223815,41962,.shtml >

----------------------------------------------------------------------------

SECURE COMPUTING RELEASED SIDEWINDER 5.1 - [20.12.2000]

Secure Computing announced the release of its Sidewinder 5.1 security gateway. 
The world's most secure firewall delivers greater ease of use, new features, 
extended performance and enhanced interoperability with other market leading 
security products.

Press release:
< http://www.net-security.org/text/press/977274769,39099,.shtml >

----------------------------------------------------------------------------

CREATING A XML BASED SECURITY STANDARD - [20.12.2000]

Marking a significant step towards the establishment of a unified XML-based 
approach for securing Web transactions, 10 leading Web access management 
vendors announced that they would work together to develop a common 
industry standard for sharing security information. The group of vendors will 
work together towards this common goal in the recently announced OASIS 
XML-Based Security Services Technical Committee (TC) where they plan to 
discuss existing standard initiatives. The vendors participating in this OASIS 
Technical Committee include, Baltimore Technologies, Entegrity Solutions, 
Entrust Technologies, Hewlett Packard, IBM's Tivoli Systems, iPlanet 
E-Commerce Solutions, a Sun-Netscape Alliance, Oblix, OpenNetwork 
Technologies, Securant Technologies, and TransIndigo.

Press release:
< http://www.net-security.org/text/press/977321010,17352,.shtml >

----------------------------------------------------------------------------

EVINCI SECURITY INFRASTRUCTURE SOLUTIONS - [21.12.2000]

EVINCI is focused on providing its partners with the E-Security Infrastructure 
to power a leading-edge Internet Threat Management Service, said Len Netti, 
president and Chief Executive Officer of EVINCI, in an announcement today.

Press release:
< http://www.net-security.org/text/press/977360168,85775,.shtml >

----------------------------------------------------------------------------

NEW VPN SERVICE BY GENUITY AND CISCO - [21.12.2000]

Genuity Inc., a Tier 1 provider of Internet infrastructure, and Cisco Systems, 
Inc., the worldwide leader in networking for the Internet, announced the 
newest member of Genuity's VPN family of managed security services. 
Powered by VPN-optimized Cisco routers, the new service line will be 
named VPN Service for Cisco. This new service is the first IPsec-based 
virtual private network service deployed on industry-leading Cisco 7200 
and 2600 modular multiservice routers and delivered over the quality of 
Genuity's Tier 1 Backbone. Designated as a Cisco Powered Network service, 
it is designed to suit the needs of customers seeking to establish secure, 
economical VPN connections between corporate headquarters, company 
branches, customers, suppliers, and business partner locations.

Press release:
< http://www.net-security.org/text/press/977360416,8707,.shtml >

----------------------------------------------------------------------------

NEW INTERNET PRIVACY PRODUCTS UNVEILED - [21.12.2000]

Encrypt-Now.com announced the launch of a line of consumer-level products 
that not only cloak an Internet user in anonymity, at both the source and the 
destination, but also enable a user to acquire and transfer data without 
detection. Since the service does not require user software, it can be 
used from any PC, whether it's at home or at work.

Press release:
< http://www.net-security.org/text/press/977360454,73689,.shtml >

----------------------------------------------------------------------------

ANTI-VIRUS SOLUTION FOR LOTUS NOTES/DOMINO - [21.12.2000]

Kaspersky Lab, an international data-security software-development company, 
announces the beta-version release of its flagship anti-virus product, KasperskyT 
Anti-Virus (AVP), for Lotus Notes/Domino e-mail gateways running on the Linux 
or Windows NT operating system.

Press release:
< http://www.net-security.org/text/press/977414170,58227,.shtml >

----------------------------------------------------------------------------

THE VIRUSMD FAMILY WEBFILTER ANNOUNCEMENT - [21.12.2000]

CNET's Download.com today launched a new software product designed to help 
parents protect their children when they use the Internet. The VirusMD Family 
Webfilter premieres as the world's easiest-to-use content filtering software 
designed for parents. The VirusMD Family Webfilter is unique in that it was 
designed to the specifications of Board-Certified medical doctors. It is the 
best software for parents to help keep their children safe on the Internet. 
Unlike other content filters that grow outdated or stale because they are 
based on a static list of blocked websites, the VirusMD program stays 
up-to-date by encouraging close supervision and monitoring by parents.

Press release:
< http://www.net-security.org/text/press/977428744,88625,.shtml >

----------------------------------------------------------------------------

SMART CARDS READY FOR U.S. PRIME TIME - [21.12.2000]

Unlike Europe where smart cards are a part of everyday life, U.S. use has been 
limited in part due to availability and widespread use of magnetic strip credit 
cards. But with the advent and growth of electronic and mobile commerce 
projected to increase dramatically in 2001, and the need to provide new 
services requiring high security such as Internet banking and stock trading, 
financial institutions have begun to enhance regular credit cards with chips 
transforming them into smart cards.

Press release:
< http://www.net-security.org/text/press/977428943,7860,.shtml >

----------------------------------------------------------------------------




Featured articles
-----------------

All articles are located at:
http://www.net-security.org/text/articles

Articles can be contributed to staff@net-security.org

Below is the list of the recently added articles.

----------------------------------------------------------------------------

VIRUSES, TROJANS, AND CIA by Randy M. Nash

Trojan horse programs used to be simple programs that would masquerade as 
some type of new utility program available to be downloaded, but would then 
destroy your precious information. Today trojans are not just destructive, but 
manipulative. They provide back doors into your systems, remote administrative 
capabilities, and covert tunnels through your firewalls. Just ask Microsoft 
executives how damaging or embarrassing this sort of program can be.

Read more:
< http://www.net-security.org/text/articles/cia.shtml >

----------------------------------------------------------------------------

PRIVACY, IS IT REAL? by Crawl-X

In our daily lives a persons privacy is violated countless times. So many in fact, 
we tend to catch less and less of them as we become more desensitized. In the 
making of this article, I decided to document the different ways a persons 
privacy (in this case mine) was at risk and how.

Read more:
< http://www.net-security.org/text/articles/real.shtml >

----------------------------------------------------------------------------

LAPTOP ENCRYPTION AND INTERNATIONAL TRAVEL by M. E. Kabay

"However, if your staff travels to North Korea (although recent political 
developments may change this), Libya, Iraq, Syria, Iran, Afghanistan, Burma 
and other totalitarian states, I recommend that your legal department establish 
the current state of their regulations before you enter with a computer. Even if 
encryption is allowed in such places under certain circumstances, the last thing 
you want is rubber-truncheon techniques for (literally) brute-force cracking of 
your keys. You might want to restrict information on a laptop to the absolute 
minimum you need for that particular trip. In addition to crypto, your staff should 
also be well informed about laws pertaining to Internet access. I suggest that 
you work with a firm such as Kroll Associates in preparing for such adventurous 
trips."

Read more:
< http://www.net-security.org/text/articles/nwf/laptop.shtml >

----------------------------------------------------------------------------

SOCIAL ENGINEERING SIMULATIONS by M. E. Kabay

We know that social engineering is an important tool for criminal hackers. Social 
engineering refers to lying, cheating, tricking, seducing, extorting, intimidating 
and even threatening employees into revealing confidential information that can 
then be used to break into systems. Social engineering is based on deception 
and on violation of social norms of fairness and honesty.

Why not use social engineering in penetration testing?

Read more:
< http://www.net-security.org/text/articles/nwf/simulations.shtml >

----------------------------------------------------------------------------




Featured books
----------------

The HNS bookstore is located at:
http://net-security.org/various/bookstore

Suggestions for books to be included into our bookstore 
can be sent to staff@net-security.org

----------------------------------------------------------------------------

CISCO CCNP PREPARATION LIBRARY, SECOND EDITION

Cisco Certified Network Professional (CCNP) exams tests your skill in installing, 
configuring, operating, and troubleshooting complex routed LANs, routed WANs, 
switched LANs, and dial access services. This challenging certification requires 
you to pass four written exams, including: Routing Exam #640-503, Switching 
Exam #640-504, Remote Access Exam #640-505, and Support Exam #640-506. 
The recommended training courses for each of these exams have been ported 
into Coursebooks by Cisco Press, and are now available in this value price 
bundle. These books, Building Scalable Cisco Networks, Building Cisco Multilayer 
Switched Networks, Building Cisco Remote Access Networks , and Cisco 
Internetwork Troubleshooting, cover all the key topics that appear on each 
of the CCNP exams in great detail. They are derived from official training 
courses developed by Cisco Systems for CCNP preparation.

Book:
< http://www.amazon.com/exec/obidos/ASIN/1587050137/netsecurity >

----------------------------------------------------------------------------

SECURING WINDOWS NT/2000 SERVERS FOR THE INTERNET: 
A CHECKLIST FOR SYSTEM ADMINISTRATORS

This is a guide that pares down installation and configuration instructions into a 
series of checklists aimed at Windows administrators. Topics include: Introduction 
- Windows NT/2000 security threats, architecture of the Windows NT/2000 
operating system and typical perimeter networks. How to build a Windows NT 
bastion host. Configuring Windows and network services, encrypting the password 
database, editing the registry, setting system policy characteristics, performing 
TCP/IP configuration, configuring administrative tools, and setting necessary 
permissions. Differences between Windows NT and Windows 2000 security 
including IPSec (IP Security Protocol) configuration. Secure remote administration 
- SSH, OpenSSH, TCP Wrappers, the Virtual Network Console, and the new 
Windows 2000 Terminal Services. Windows NT/2000 backup, recovery, auditing, 
and monitoring - event logs, the audit policy, time synchronization with NTP 
, remote logging, integrity checking, and intrusion detection.

Book:
< http://www.amazon.com/exec/obidos/ASIN/1565927680/netsecurity >

----------------------------------------------------------------------------

SPARC ARCHITECTURE, ASSEMBLY LANGUAGE PROGRAMMING, AND C

Introduces the SPARC assembly language from a programmer's perspective, 
and covers making use of UNIX tools, and the von Neumann machine and its 
relationship to programmable calculators and to the JAVA bytecode and JAVA 
virtual machine. Can be used by students in introductory computer architecture 
courses, and by those programming SPARC architecture machines in languages 
such as C and C++. This second edition offers more material on the new Ultra 
SPARC architecture, and on floating point, traps, and other architectures.

Book:
< http://www.amazon.com/exec/obidos/ASIN/0130255963/netsecurity >

----------------------------------------------------------------------------

BUILDING SCALABLE CISCO NETWORKS

Cisco Certified Network Professional and Cisco Certified Design Professional 
certifications require candidates to pass four exams. This book is a direct 
port of the BSCN instructor-led training course and helps prepare readers 
for the Routing Exam #640-503. Building Scalable Cisco Networks addresses 
tasks that network managers and engineers need to perform when managing 
access and controlling overhead traffic in growing, routed networks. This book 
discusses router capabilities used to control multi-protocol traffic over LANs 
and WANs, as well as connecting corporate network to an Internet Service 
Provider (ISP). Divided into three parts (Scalable Internetworks, Scalable 
Routing Protocols, and Controlling Scalable Internetworks), this book 
covers a broad range of technical details on topics related to routing, 
including routing summarization, IP traffic management, access lists, 
and protocol redistribution. OSPF, EIGRP, and BGP are all investigated 
in detail.

Book:
< http://www.amazon.com/exec/obidos/ASIN/1578702283/netsecurity >

----------------------------------------------------------------------------

HACKER ATTACK

This is the only book about computer security that is at once entertaining, 
understandable, and practical. You'll be fascinated as you read about hackers, 
crackers and whackers - people who spend their time trying to break into your 
computer, spreading computer viruses, or peeping (and recording what they 
see!) as you surf the Internet or send email. Best of all, this book provides 
simple but powerful solutions to all these security needs. It's all on the book's 
CD. Protect yourself right now with firewalls, anonymisers, and virus-guards.

Book:
< http://www.amazon.com/exec/obidos/ASIN/0782128300/netsecurity >

----------------------------------------------------------------------------




Security Software
-------------------

All programs are located at:
http://net-security.org/various/software

----------------------------------------------------------------------------

SUPER CODE 1.0

Super Code encrypts and secures email and PC files using a powerful encryption 
management facility. Security Folder automatically encrypts PC files at close-
down and decrypts at start-up, safeguarding PC folders even if a PC is stolen. 
Time-stamped log facility records the history of encryption-decryption 
operations. Password Directory aids the tracking of numerous email passwords. 
Multiple system IDs offer separate privacy to each shared user of a PC. 
Self-Extracting email attachment can be prepared and sent to anyone who 
has a private password to decrypt.

Info/Download:
< http://net-security.org/various/software/976900267,30745,.shtml >

----------------------------------------------------------------------------

DSNIFF V.2.3

dsniff is a suite of utilities that are useful for penetration testing. It consists of 
the following programs: arpredirect intercepts packets from a target host on 
the LAN intended for another host on the LAN by forging ARP replies. findgw 
determines the local gateway of an unknown network via passive sniffing. 
macof floods the local network with random MAC addresses. tcpkill kills 
specified in-progress TCP connections. dsniff is a powerful sniffer which 
automatically detects and parses many protocols, only saving the interesting 
bits. filesnarf saves files sniffed from network file system traffic. mailsnarf 
outputs all messages sniffed from SMTP traffic in Berkeley mbox format. 
webspy sends URLs sniffed from a client to your local Netscape browser 
for display, updated in real-time.

Info/Download:
< http://net-security.org/various/software/977185968,29675,.shtml >

----------------------------------------------------------------------------

TROJAN DEFENSE SUIT 3

TDS lets you attack Trojans from more angles than any other program in the 
world. Anti-virus scanners are not doing the job, detecting appallingly low 
numbers of commonly used Remote Access Trojans (RAT). This simply isn't 
good enough. If you're infected with a RAT, chances are VERY high that 
TDS will find it.

Info/Download:
< http://net-security.org/various/software/977571672,20567,.shtml >

----------------------------------------------------------------------------

WORMGUARD 2.1

DiamondCS WormGuard is the only system in the world that: 
- Analyses files generically using heuristic and intelligent rule-sets rather than 
relying on signatures for known worms - this is the future of worm interception. 
- Provides worm-detection for ALL executed files, ensuring the file is safe BEFORE 
it is allowed to run.
- Has four primary and six secondary core detection engines built-in to handle 
executed files depending on their type.
- And more.

Info/Download:
< http://net-security.org/various/software/977572084,68112,.shtml >

----------------------------------------------------------------------------




Defaced archives
------------------------

[19.12.2000] - U.S. Foreign and Commercial Service
Original: http://www.usatrade.gov/
Defaced: http://www.attrition.org/mirror/attrition/2000/12/19/www.usatrade.gov/

[19.12.2000] - HMC Internetworking Services
Original: http://www.hmcnet.com/
Defaced: http://www.attrition.org/mirror/attrition/2000/12/19/www.hmcnet.com/

[19.12.2000] - Islamic Society of North America
Original: http://www.isna.net/
Defaced: http://www.attrition.org/mirror/attrition/2000/12/19/www.isna.net/

[19.12.2000] - National Centre for Radio Astrophysics
Original: http://sakthi.ncra.tifr.res.in/
Defaced: http://www.attrition.org/mirror/attrition/2000/12/19/sakthi.ncra.tifr.res.in/

[21.12.2000] - United Arts
Original: http://www.unitedarts.com/
Defaced: http://www.attrition.org/mirror/attrition/2000/12/21/www.unitedarts.com/

[21.12.2000] - US Bankruptcy Court - Eastern District of North Carolina
Original: http://www.nceb.uscourts.gov/
Defaced: http://www.attrition.org/mirror/attrition/2000/12/21/www.nceb.uscourts.gov/

[21.12.2000] - Advanced Network Technology Ltd.
Original: http://www.anet-brno.cz/
Defaced: http://www.attrition.org/mirror/attrition/2000/12/21/www.anet-brno.cz/

----------------------------------------------------------------------------


Questions, contributions, comments or ideas go to:
 
Help Net Security staff
 
staff@net-security.org
http://net-security.org


---------------------------------------------------------------------
To unsubscribe, e-mail: news-unsubscribe@net-security.org
For additional commands, e-mail: news-help@net-security.org