Linux Security Week: January 17th 2005

The engineers at vulnerability testing tool vendor nCircle Network Security spend US$100 per month at the coffee shop in the lobby of their office building in downtown San Francisco. But there is one day each month when a trip to the cafe is more urgent than at any other time: Patch Tuesday.

A group of security volunteers on Tuesday released a new version of an advanced open-source framework for developing, testing and using exploits.

Although Microsoft has repeatedly warned users of Windows NT that security fixes would cease and desist as of Jan. 1, 2005, January's regularly-scheduled patches actually included one for the obsolete and retired operating system.

A computer hacker apparently broke into a George Mason University database containing student and employee Social Security numbers, leaving 32,000 people uncertain whether their finances or identities might be compromised.

A major update to highly regarded open-source penetration testing tool Metasploit Framework (MSF) has been released by its volunteer developers. MSF is designed to exploit dozens of security holes with just a few clicks.

Linux vendors have patched a flurry of flaws uncovered in multiple distros by independent security firms.

Locking down the network and patrolling the perimeter is a never-ending job. Still, it feels good to get through another shift on the Forbidden Planet without an invisible force penetrating your shield and setting off alarms. But there's a change: now, other humans want to work from their home worlds -- but by mind alone, over the computer screen. It's up to you to create for them a safe passage (one that won't have Robby the Robot all stirred up and carrying Anne Francis around like a rag doll) and to make sure the Krell don't come sneaking in, under the fence, behind the newcomers.

news/network-security/letting-the-telecommuters-into-the-network

With the launch of its Aspen 8800 enterprise LAN switches, Extreme Networks Inc. is challenging network designers to rethink the way they build systems to deal with voice traffic and growing internal security threats.

news/network-security/voip-security-gets-extreme

Spyware is challenging spam and viruses for the top spot on IT worry lists. Spyware poses considerable threats and risks to enterprise networks and remediation and countermeasures are now being regarded as critical to network security.

news/network-security/how-to-keep-spyware-off-your-enterprise-network

Don't say we didn't warn you: At some point in the next decade, there will be a "devastating attack" on the Internet or power grid.

news/network-security/cyberterrorism-could-devastate-us-economy

A hacker broke into a wireless carrier's network over at least seven months and read e-mails and personal computer files of hundreds of customers, including the Secret Service agent investigating the hacker, the government said Wednesday.

news/network-security/hacker-takes-seven-month-spree-on-t-mobile-network

This paper looks at the evolution of firewall technology towards Deep Packet Inspection, and then discusses some of the security issues with this evolving technology.

news/network-security/the-perils-of-deep-packet-inspection

The Southern California Linux expo has announced that Sophos has signed on as one of the latest sponsors of SCALE 3x, the Third Annual Southern California Linux Expo. SCALE 3x has been called " .. one of the few good grass-root level technical conferences for Linux" by Linux Kernel Developer Robert Love.

news/organizations-events/sophos-to-join-2005-southern-california-linux-expo

Finally the first Linux Netwosix Virtual Community is born.

news/vendors-products/linux-netwosix-virtual-community-is-born

The adoption of the Mozilla Foundation's browser by millions of non-technical users could be the biggest test yet of open source development.

news/vendors-products/firefox-the-ultimate-test-for-open-source

A new product from VMware stands to parlay its profitable virtualization technology into the growing enterprise desktop management and security space.

news/vendors-products/vmware-introducing-secure-desktop-provisioning-for-remote-workers

PIKT, Problem Informant/Killer Tool, v1.18.0 has been released. PIKT is a cross-categorical, multi-purpose toolkit to monitor and configure computer systems, organize system security, format documents, assist command-line work, and perform other common systems administration tasks.

news/vendors-products/pikt-1180-for-linux-released

Guardian Digital, Inc., the worldÕs premier provider of open source security solutions, today announced the expansion of its product portfolio with the launch of EnGarde Secure Linux: Basic Edition, a low-cost alternative to the award-winning EnGarde Secure Linux operating platform. Responding to the economic and network security requirements of individuals and small business users, EnGarde Basic is a flexible platform upon which users can build a comprehensive Internet infrastructure including features that provide leading-edge security, ease of management and standard Internet functions.

news/vendors-products/guardian-digital-launches-new-edition-of-award-winning-engarde-secure-linux-distribution

BitDefender has unveiled three new products for its 1.6.1 generation of BitDefender for Linux mail servers, in a bid to bolster its offering for the Linux community.

news/vendors-products/bitdefender-ups-linux-av-offering

Although some ISPs and legislators are crediting the year-old CAN-SPAM Act and better technology for recent gains in the war on spam, many in the industry say the advances are forcing spammers to employ new tactics, which are destabilizing the Internet's crucial DNS.

There will be more new Windows computers booting up than those running Linux after the most recent season of giving. But there's no safety in numbers; recent analysis and expert opinion indicates the Microsoft machines will be quickly and heavily targeted by attackers, while Linux computers are largely left alone.

Opinion: Clean software at the start will save time and moneyÑnot to mention customersÑdown the road.

Linux creator Linus Torvalds had a few things to say this week about the way potential security issues are disclosed to fellow open sourcers. And it wasn't all good.

Opinion: The development cycle of vulnerability definition, exploit programming and attack deployment is moving at full speed. The prospects for a 2005 full of grief for users and IT are excellent.

The Linux in Government series has taken a new format for 2005. This year's articles will provide fundamental information to government technologists about Linux and open-source software. Although we will continue to inform you about agencies and projects specifically using open-source solutions, we also are going to provide information about open-source resources available to governments.

news/government/linux-in-government-how-security-exploits-threaten-government-infrastructures

Fashioned after online self-assessment tools used by authorities to assess vulnerabilities at airports, the Department of Homeland Security on Friday unveiled software it developed to let officials identify vulnerabilities and assess the security at stadiums with large seating capacity.

news/government/homeland-security-offers-online-tool-to-assess-stadium-security