Network Security
Date Prev | Date Next |
Date Index |
Thread Index |
Author Index |
Historical
FW: Security In The News - February 19, 2004
- From: Howell, Paul
- Date: Thu Feb 19 17:54:52 2004
-----Original Message-----
From: dailyreport@ists.dartmouth.edu
To: subscriber (2554)
Sent: 2/19/2004 5:21 PM
Subject: Security In The News - February 19, 2004
Security In The News
LAST UPDATED: 2/19/04
This report is also available on the Internet at
http://news.ists.dartmouth.edu/todaysnews.html
<http://news.ists.dartmouth.edu/todaysnews.html> ,
Homeland Security & Infrastructure Protection
Critical infrastructure data sought
Federal Computer Week, 2/18/04
<http://www.fcw.com/fcw/articles/2004/0216/web-dhs-02-18-04.asp>
Cybercrime-Hacking
Computer program teaches kids safety on the Internet
USA Today (AP), 2/18/04
<http://www.usatoday.com/tech/news/internetprivacy/2004-02-18-net-safety
_x.htm>
Cyber-Age Goodfellas
The Village Voice, 2/18/04
<http://www.villagevoice.com/issues/0407/robbins.php>
Moves to give spy agencies more powers to intercept email
Sydney Morning Herald, 2/19/04
<http://www.smh.com.au/articles/2004/02/19/1077072767625.html>
Politics-Legislation
Judge OKs California e-voting
The Register, 2/19/04
<http://www.theregister.co.uk/content/6/35664.html>
Malware
Macs and viruses -- are users as safe as they think?
Computerworld, 2/18/04
<http://computerworld.com/securitytopics/security/story/0,10801,90263,00
.html>
Technology
Home Office to centralise police intelligence
The Register, 2/18/04
<http://www.theregister.co.uk/content/53/35648.html>
Military automates security reviews of its Web sites
Computerworld, 2/18/04
<http://computerworld.com/developmenttopics/websitemgmt/story/0,10801,90
273,00.html>
Hot-spot use to heat up in 2004
news.com.com, 2/18/04 <http://news.com.com/2100-7351_3-5161031.html>
PKI's alive and kicking
news.com.com, 2/19/04
<http://news.com.com/2010-7355_3-5161272.html?part=rss&tag=feed&subj=new
s>
Sorting e-mail friends from foes
Nature, 2/19/04 <http://www.nature.com/nsu/040216/040216-12.html>
Giants unite over security
vnunet.com, 2/19/04 <http://www.vnunet.com/News/1152897>
Vulnerabilities & Exploits
Massive hole undermines ZoneAlarm firewall
Techworld, 2/19/04
<http://www.techworld.com/news/index.cfm?fuseaction=displaynews&NewsID=1
063>
Another security hole found in Linux kernel
SearchEnterpriseLinux, 2/19/04
<http://searchenterpriselinux.techtarget.com/originalContent/0,289142,si
d39_gci951284,00.html>
Best Practices & Risk Management
Bugwatch: The aftermath of Valentine's Day
vnunet.com, 2/19/04 <http://www.vnunet.com/News/1152901>
Civil & Consumer Issues
ID theft victims face tough bank fights
MSNBC, 2/18/04 <http://msnbc.msn.com/id/4264051>
Homeland Security & Infrastructure Protection
Title: internal13261Critical infrastructure data sought
Source: Federal Computer Week
Date Written: February 18, 2004
Date Collected: February 19, 2004
The Department of Homeland Security (DHS) will launch the Protected
Critical Infrastructure Information (PCII) program to collect sensitive
data on physical and cyber infrastructures from private industry on a
voluntary basis. All data will be kept confidential, as data that meets
PCII requirements is exempt from the Freedom of Information Act, though
companies could be charged with federal felonies if they knowingly
submit false information. In order for the data to be so protected, the
submitter must ask for protection, certify that the data is being
provided voluntarily and not to comply with federal regulations, and the
information must meet the definition of "critical infrastructure
information" as defined in the Critical Infrastructure Information Act
of 2002. PCII may face issues regarding how to address vulnerabilities
detected through the program, how to contact local agencies if an
immediate danger is found, and whether information hides health and
safety problems.
http://www.fcw.com/fcw/articles/2004/0216/web-dhs-02-18-04.asp
<http://www.fcw.com/fcw/articles/2004/0216/web-dhs-02-18-04.asp>
Cybercrime-Hacking
Title: internal13256Computer program teaches kids safety on the Internet
Source: USA Today (AP)
Date Written: February 18, 2004
Date Collected: February 19, 2004
New Hampshire Governor Craig Benson, Attorney General Peter Heed, and
Education Commissioner Nicholas Donohue have unveiled the NetSmartz
Workshop, an interactive computer program to teach children how to
protect themselves on the Internet. NetSmartz was developed by the
National Center for Missing and Exploited Children with the Boys and
Girls Clubs of America. Jenn Gillins of the NetSmartz program says
children see NetSmartz as a sort of computer game. One study finds that
one in five children receive a sexual solicitation over the Internet,
while one in four are exposed to unwanted pictures of a sexual nature.
NetSmartz has four levels for different age groups ranging from
kindergarten to high school. Mr. Heed says law enforcement continue to
search for pedophiles, but knowledge is the best defense for children.
NetSmartz will be sent to seven schools in New Hampshire as a pilot
program, eventually going to every school in the state.
http://www.usatoday.com/tech/news/internetprivacy/2004-02-18-net-safety_
x.htm
<http://www.usatoday.com/tech/news/internetprivacy/2004-02-18-net-safety
_x.htm>
Title: internal13260Cyber-Age Goodfellas
Source: The Village Voice
Date Written: February 18, 2004
Date Collected: February 19, 2004
As New York's mafia loses traditional areas of business--racketeering,
unions, and garbage carting--it appears they may be diversifying into
high tech crimes. Federal prosecutors allege that two telecommunications
scams currently pending in a Brooklyn federal court are linked to the
Gambino crime family. Richard Martino and Salvatore LoCascio allegedly
ran a telephone number scam called "cramming," which advertised
area-code 800 numbers for sports information, weather, and adult
entertainment, with thousands of dollars in hidden charges. An Internet
scam offered surfers free previews of pornography sites in exchange for
a credit card number; the browser's back was then disabled, forcing
surfers to click through the site racking up charges. These scams made
$400 million in five years. Federal prosecutors show links between the
defendants and the Gambino crime family, such as recorded conversations
at known Gambino hangouts; Mr. LoCascio's father served as consigliere,
or counselor, to former mob boss John Gotti. Defense attorneys admit the
questionable nature of their clients' business, but argue that their
financial dealings were done in the open, without involvement of Gambino
gangsters.
http://www.villagevoice.com/issues/0407/robbins.php
<http://www.villagevoice.com/issues/0407/robbins.php>
Title: internal13263Moves to give spy agencies more powers to intercept
email
Source: Sydney Morning Herald
Date Written: February 19, 2004
Date Collected: February 19, 2004
The Australian government is considering a bill entitled "The
Telecommunications (Interception) Amendment Bill 2004," which would give
intelligence agencies greater powers in intercepting e-mails and widens
the scope of warrants for investigation of serious crimes, such as
terrorism. Attorney General Philip Ruddock says the amendment is
necessary since current telecommunications laws do not cover text and
image transmissions or recent advances in technology. The amendment also
extends the protections given by current legislation to such
transmissions.
http://www.smh.com.au/articles/2004/02/19/1077072767625.html
<http://www.smh.com.au/articles/2004/02/19/1077072767625.html>
Politics-Legislation
Title: internal13262Judge OKs California e-voting
Source: The Register
Date Written: February 19, 2004
Date Collected: February 19, 2004
A California judge has ruled against a group of campaigners requesting
that the court prevent Diebold electronic voting machines from being
used during primary elections in March 2004. The plaintiffs argued that
the Diebold machines, to be used in at least 14 counties, make the
election vulnerable to tampering, provide no way to verify the accuracy
of vote counts, and, according to a security audit, transmit vote totals
in plaintext over the Internet. California has mandated that electronic
voting machines must produce a paper audit trail by 2006.
http://www.theregister.co.uk/content/6/35664.html
<http://www.theregister.co.uk/content/6/35664.html>
Malware
Title: internal13257Macs and viruses -- are users as safe as they think?
Source: Computerworld
Date Written: February 18, 2004
Date Collected: February 19, 2004
Users of Apple computers generally have not had to worry about viruses
as Windows users have, however, many companies and systems
administrators are growing more concerned about Apple viruses. Intego
Inc. says it has seen a steady growth in sales of its Macintosh-only
VirusBarrier antivirus product. Antivirus experts warn that virus
writers are ego-driven, and someone will eventually see it as a
challenge to produce the first Mac OS X virus. Current Unix viruses
could be modified to run on Mac OS X. Even if a Macintosh does not get
infected, it can pass a virus on to other vulnerable machines. Security
professionals recommend that Mac users stay educated about viruses to
adapt to evolving threats.
http://computerworld.com/securitytopics/security/story/0,10801,90263,00.
html
<http://computerworld.com/securitytopics/security/story/0,10801,90263,00
.html>
Technology
Title: internal13254Home Office to centralise police intelligence
Source: The Register
Date Written: February 18, 2004
Date Collected: February 19, 2004
The United Kingdom's Police Federation reports that police officers are
deleting important records because they fear prosecution under the Data
Protection Act for otherwise mishandling the data. The organization has
submitted a request to the Brichard Inquiry to clarify how the Data
Protection Act should be implemented. The Brichard Inquiry was set up to
examine police handling of data after a man, accused of rape on four
occasions and of indecent assault of a minor, was convicted for the
murder of two eleven-year old girls. The five previous accusations were
not shared among police agencies, possibly enabling the murders. The
Home Office has outlined plans for the Criminal Records Bureau (CRB) to
build a database to facilitate data sharing. Rather than collect data in
a central database, the CRB would keep metarecords of which agencies
hold what intelligence.
http://www.theregister.co.uk/content/53/35648.html
<http://www.theregister.co.uk/content/53/35648.html>
Title: internal13258Military automates security reviews of its Web sites
Source: Computerworld
Date Written: February 18, 2004
Date Collected: February 19, 2004
The Pentagon has contracted Coast Software's Web Quality Central to
manage Defense Department websites, keeping them clean of sensitive data
and protecting web visitors' privacy. The purchase is part of a Defense
effort to comply with it own guidelines on Web content and the
E-Government Act of 2002, which requires agencies to adhere to Office of
Management and Budget (OMB) privacy guidelines. Web Quality Central
provides summary reports on privacy, operational security, and
accessibility compliance, as well as trend analysis. The new version 3.1
now offers policy enforcement for non-HTML (hypertext markup language)
content, such as Adobe .pdf, Microsoft Word, Excel and Powerpoint
documents, and Corel WordPerfect files. The Pentagon considers constant
review of Web content critical to ensuring secrecy of military plans. In
2000, a survey of 800 Defense websites revealed over 1,300
discrepancies--some involving classified material--ten posts describing
war plans, and twenty detailed maps of military facilities.
http://computerworld.com/developmenttopics/websitemgmt/story/0,10801,902
73,00.html
<http://computerworld.com/developmenttopics/websitemgmt/story/0,10801,90
273,00.html>
Title: internal13259Hot-spot use to heat up in 2004
Source: news.com.com
Date Written: February 18, 2004
Date Collected: February 19, 2004
Research firm Gartner forecasts the global number of wireless hotspots
to triple in 2004, rising from 9.3 million to 30 million. More than half
of business laptops will have wireless capabilities. Mobile workers will
gain an average of 30 minutes a day in productivity using wireless.
Wireless demand will compel many businesses to deploy wireless networks.
Mobile network providers will have to build business models around how
remote workers use wireless services. Companies will also have to
develop wireless security strategies, including personal firewalls and
virtual private network login for remote access.
http://news.com.com/2100-7351_3-5161031.html
<http://news.com.com/2100-7351_3-5161031.html>
Title: internal13265PKI's alive and kicking
Source: news.com.com
Date Written: February 19, 2004
Date Collected: February 19, 2004
The author recalls battles between two technologies. First came TCP/IP
(transfer control protocol/Internet protocol) against OSI (Open Systems
Interconnection). In 1991, many researchers thought that the inelegant
legacy TCP/IP would soon be replaced by the more efficient OSI. However,
ten years later, TCP/IP has become the standard network protocol.
Similarly, processors would be divided into RISC (reduced instruction
set computing) and CISC (complex instruction set computing)
architectures; today, the two have merged. The author sees a similar
turning point for cybersecurity with digital certificates and public key
infrastructure (PKI). PKI solutions were once considered the wave of the
future, but initial problems have caused the industry to struggle,
despite innovations addressing those problems. Meanwhile, an outage in
VeriSign's certificate system made people realize how ubiquitous
certificates had become. Vendors have begun moving away from the idea of
security technologies, and are instead melding PKI and certificate
concepts together to create security applications.
http://news.com.com/2010-7355_3-5161272.html?part=rss
<http://news.com.com/2010-7355_3-5161272.html?part=rss&tag=feed&subj=new
s> &tag=feed&subj=news
Title: internal13266Sorting e-mail friends from foes
Source: Nature
Date Written: February 19, 2004
Date Collected: February 19, 2004
P. Oscar Boykin and Vwani Roychowdhury of the University of California,
Los Angeles, have developed a spam filtering method based on the
structures of social networks. Social networks tend to be clustered into
clumps where everyone knows each other; Bob and Chris are more likely to
e-mail each other if they both e-mail Alice. Spams, as anonymous
mass-mailings, do not cluster in this way. The method is simple to
implement and works quickly. By examining the e-mails in a user's inbox,
a system can build up a white list and black list, putting e-mails above
a certain clustering threshold on the white list, and those below
another threshold on the blacklist. The system apparently never produces
false positives. However, as many as half of all e-mails fall in between
in the "I don't know" category. Still, this cuts down the e-mail load by
half, which then can be examined by other means.
http://www.nature.com/nsu/040216/040216-12.html
<http://www.nature.com/nsu/040216/040216-12.html>
Title: internal13268Giants unite over security
Source: vnunet.com
Date Written: February 19, 2004
Date Collected: February 19, 2004
Cisco and IBM have teamed up to better integrate their security
solutions to help firms protect their networks. IBM has joined Cisco's
Network Admission Control (NAC) program and announced that Tivoli
Identity Manager for Cisco's Secure Access Control Server should be
available in March 2004. Other products and services are already
available. IBM's Embedded Security System hardware, available on
Thinkpads and ThinkCentre desktops, integrates with Cisco's virtual
private network (VPN) client. Cisco's Security Agent works with those
machines as well as the eServer xSeries range. IBM spokesman Peter
Jopling notes "Cisco is number one in VPNs, firewalls and network
security and IBM is number one in identity management and security
services. This is a powerful combination which gives clarity for dealing
with internal and external security issues . . . ."
http://www.vnunet.com/News/1152897 <http://www.vnunet.com/News/1152897>
Vulnerabilities & Exploits
Title: internal13264Massive hole undermines ZoneAlarm firewall
Source: Techworld
Date Written: February 19, 2004
Date Collected: February 19, 2004
Zone Labs has released an advisory regarding a critical buffer overflow
in its ZoneAlarm version 4 firewall. The flaw, found in the firewall's
SMTP (simple mail transfer protocol) engine, would allow an attacker to
execute arbitrary code or escalate the privileges of malicious code.
Zone Labs only rates the hole as a medium risk, however, since it does
not recommend using ZoneAlarm as a mail server. Zone Labs recommends
that users upgrade their software, and has released a 4.8 MB patch. The
hole was discovered by eEye Digital Security.
http://www.techworld.com/news/index.cfm?fuseaction=displaynews
<http://www.techworld.com/news/index.cfm?fuseaction=displaynews&NewsID=1
063> &NewsID=1063
Title: internal13269Another security hole found in Linux kernel
Source: SearchEnterpriseLinux
Date Written: February 19, 2004
Date Collected: February 19, 2004
Paul Starzetz, researcher for Polish security firm iSEC Security, has
discovered a flaw in the Linux kernel, version 2.4, mremap system call
which could allow an attacker to gain root access or deny service to a
vulnerable machine. On a scale from 0 to 10, with 10 being the most
vulnerable, Mr. Starzetz rate this flaw as a ten. Mr. Starzetz
discovered an unrelated critical flaw in the same function in January
2004. New 2.4 and 2.6 version kernels have been released to fix the
flaw, and major distributions have released patches.
http://searchenterpriselinux.techtarget.com/originalContent/0,289142,sid
39_gci951284,00.html
<http://searchenterpriselinux.techtarget.com/originalContent/0,289142,si
d39_gci951284,00.html>
Best Practices & Risk Management
Title: internal13267Bugwatch: The aftermath of Valentine's Day
Source: vnunet.com
Date Written: February 19, 2004
Date Collected: February 19, 2004
The days surrounding Valentine's Day mean increased traffic and virus
threats for network administrators. Many black hats see it as an
opportune time to launch viruses under social engineering attacks, as
many expect e-mails from their loved ones. Organizations should have
spam filters and antivirus screening against all e-mails as a matter of
course. White lists and black lists of approved and forbidden e-mail
recipients can make the filtering process more effective. Firms should
advise staff to be wary of tricksy e-mails around Valentine's Day and
other important calendar dates, and to avoid opening file attachments.
Global organizations should be sure to account for multiple languages in
their scanning software. Firms should also consider investments toward
letting their various protections work in an integrated complementary
manner.
http://www.vnunet.com/News/1152901 <http://www.vnunet.com/News/1152901>
Civil & Consumer Issues
Title: internal13255ID theft victims face tough bank fights
Source: MSNBC
Date Written: February 18, 2004
Date Collected: February 19, 2004
Consumers are discovering that identity theft can not only cost them
large sums of money and time to fix the problem, but that they can also
be held liable for the theft. Most credit cards only hold consumers
liable for $50 in the case of fraud, a fee most banks usually waive.
However, the Federal Deposit Insurance Corporation (FDIC) has a
different standard, called "Regulation E," regarding debit cards and
checking accounts. Under Regulation E, consumers have two days to report
a problem with electronic funds transfers and are liable for $50; taking
up to sixty days to report a problem increases the liability to $500.
When funds are directly drained from bank accounts, banks often will not
cover the fraud. In one case, a couple found someone had collected
$75,000 in debt in their name. They notified the Homecomings Financial
Network, who held the debt, and resolved the matter. Homecomings
Financial later sued the couple for $75,000, claiming they were
negligent in failing to notice and report the identity theft, causing
injury to the bank.
http://msnbc.msn.com/id/4264051 <http://msnbc.msn.com/id/4264051>
To change your delivery preferences please go to:
http://news.ists.dartmouth.edu/cgi-bin/change.cgi
If you wish to stop receiving the 'Security in the News' service please
go to:
http://news.ists.dartmouth.edu/substop.html
The Institute for Security Technology Studies (ISTS) accepts no
responsibility for any error or omissions in this e-mail. The
information presented is a compilation of material from various sources
and has not been verified by staff of the ISTS. Therefore, the ISTS
cannot be made responsible for the factual accuracy of the material
presented. The ISTS is not liable for any loss or damage arising from or
in connection with the information contained in this report. It is the
responsibility of the user to evaluate the content and usefulness of
this information. References in this e-mail to any specific commercial
products, processes, or services by trade name, trademark, manufacturer,
or otherwise, does not constitute or imply endorsement, recommendation,
or favoring by the ISTS. ISTS is a research, not operational,
organization, and makes its Security in the News e-mail available as a
public service on a best-effort basis. Security in the News will be sent
out on most business days, but not all.
Institute for Security Technology Studies
Dartmouth College
45 Lyme Road, Suite 200
Hanover, NH 03755
Tel: (603) 646 0700
E-mail: dailyreport@ists.dartmouth.edu
------------------------------------------------------------------------
To unsubscribe from netsec, send mail to majordomo@merit.edu
with a body consisting of the words "unsubscribe netsec" --
without the quotes. For more help, send a message to majordomo@merit.edu
with the word "help" as the body.
------------------------------------------------------------------------
|
