[Windows 2000 Magazine Security UPDATE] 2000 - February 2 ********************************************************** WINDOWS 2000 MAGAZINE SECURITY UPDATE **Watching the Watchers** The weekly Windows NT and Windows 2000 security update newsletter brought to you by Windows 2000 Magazine and NTsecurity.net http://www.win2000mag.com/update/ ********************************************************** This week's issue sponsored by Trend Micro-Your Internet Virus Wall http://antivirus.com/SecureValentine.htm WebTrends Firewall Suite 2.0 - New Version! http://www.webtrends.com/redirect/fire-sec1.htm (Below Security Roundup) |-+-|-+-|-+-|-+-|-+-|-+-|-+-|-+-|-+-|-+-|-+-|-+-|-+-|-+-|-+- February 2, 2000 - In this issue: 1. IN FOCUS - How Do You Want Your Patches: Sooner or Later? 2. SECURITY RISKS - Outlook Express Object Access - Firewall-1 Allows Script Rule Circumvention - Index Server Exposes File System 3. ANNOUNCEMENTS - Windows 2000 Magazine Launches Three Free Email Newsletters - Conference: Windows 2000 in the Enterprise - Security Poll: Do You Think Online Credit Card-Based Purchasing is Safe Yet? 4. SECURITY ROUNDUP - News: Visa Admits Its Sites Were Hacked - News: Security Holes Bite Online Bank - Feature: Kerberos 5 in Windows 2000 - How-To: Creating a Special TSE Logon Script 5. NEW AND IMPROVED - Secure Desktop and Notebook Systems - e-Security Announces Extended Integration 6. HOT RELEASES (ADVERTISEMENT) - VeriSign - the Internet Trust Company - Network-1 Security Solutions – Embedded NT Firewalls - ISS Connect 2000: Information Security Summit 7. SECURITY TOOLKIT - Book Highlight: IIS 4 and Proxy Server 2 24Seven - Tip: Unmap Unused File Extension in IIS - Review: eEye Digital Security's Retina Security Scanner 8. HOT THREADS - Windows 2000 Magazine Online Forums: * Local Proxy Server Blocking Site Access - Win2KSecAdvice Mailing List: * ZBServer 1.50-r1x Risk Example Code - HowTo Mailing List: * Windows 2000 and Default Security * Reverse Proxying with Microsoft Proxy 2.0? * IOMega Tools Keeps an Insecure Copy of the SAM ~~~~ SPONSOR: TREND MICRO-YOUR INTERNET VIRUS WALL ~~~~ Your network can be "broken" much like your heart. So this Valentine's Day find the ideal partner for your network with the Trend Interscan product family. Protect the heart of your network with Trend's wide range of antivirus solutions. Trend is a leader in antivirus technologies, offering protection and security for the Internet gateway, Notes and Exchange email servers, the desktop, and everywhere in between. Building a protective, virtual VirusWall around the pulse- the network. http://antivirus.com/SecureValentine.htm For more information call 800-228-5651, or click the link above. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Want to sponsor Windows 2000 Magazine Security UPDATE? Contact Vicki Peterson (Western and International Advertising Sales Manager) at 877- 217-1826 or vpeterson@win2000mag.com, OR Tanya T. TateWik (Eastern Advertising Sales Manager) at 877-217-1823 or ttatewik@win2000mag.com. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1. ========== IN FOCUS ========== Hello everyone, The security world has been rather quiet over the past week. One significant event that did occur was that Microsoft released its first Windows 2000 (Win2K) security hotfix. The hotfix corrects a problem with the Win2K Indexing Service and Windows NT 4.0 Index Server. Although some readers might wince at the fact that Microsoft has already released a security hotfix for a brand-new OS--an OS not even on store shelves yet--there is no cause for alarm. We can expect to see bugs in Win2K are to be expected, especially security bugs, because hackers spend more time banging away against security subsystems than they do against other system components. I've noticed that some technologists have hammered Microsoft over the past week because a security patch actually beat the new OS to market. I think those people are being shortsighted. Expecting a perfect set of code from day one is incredibly unrealistic. I appreciate the fact that a security patch is already available for Win2K. I'd rather have a patch than a hole in my OS, and the sooner I get that patch the better. Most of you realize that bug-free software is unlikely, and Win2K is no exception. Odds dictate that other security risks are present in the Win2K code, so the question is, "Where are the risks and how soon can we find them?" Obviously, no blanket answer exists for that question. We can expect hackers and crackers alike to try most of the commonly known Windows- related exploits against the new OS and any services running on the new platform. The Indexing Service risk is a good example; similar path revelation problems have appeared in the past, and I'd be willing to speculate that at least one or two other security bugs have carried over from older NT 4.0-based code as well. Only time will tell. On another note, starting this week, we launch the first of several new columns scheduled on the NTSecurity.net Web site. The first column, The Ultimate Security Toolkit, is a biweekly column by Steve Manzuik. Every other week, Steve will review a new security product. Steve offers his professional, from-the-trenches opinion about each tool and his personal recommendation to help you make buying decisions. This week, Steve reviews eEye's Retina security scanner, so be sure to check it out. Until next time, have a great week. Sincerely, Mark Joseph Edwards, News Editor mark@ntsecurity.net 2. ========== SECURITY RISKS ========= (contributed by Mark Joseph Edwards, mark@ntsecurity.net) * OUTLOOK EXPRESS OBJECT ACCESS Georgio Guninski reported a problem with Outlook Express that could let an intruder open and read email messages without a user's permission. Microsoft is aware of the problem but has issued no response at the time of this writing. http://www.ntsecurity.net/go/load.asp?iD=/security/outlook3.htm * FIREWALL-1 ALLOWS SCRIPT RULE CIRCUMVENTION Arne Vidstrom discovered a problem with the Firewall-1 script filtering rules that might let unwanted scripts execute on the desktop. According to Vidstrom's report, an intruder can circumvent the Strip Script Tags feature by adding an extra less than sign (<) to the