Linux Advisory Watch: March 28th 2005

Bruce Schneier, founder and chief technical officer of Counterpane Internet Security, might be as close as the computer security industry gets to its own celebrity. Although not as well known as Larry Ellison at Oracle or Bill Gates at Microsoft, Schneier is still the public face of his company, recognized by industry insiders as one of their gurus. Businesses hire Counterpane to guard their networks from hackers and viruses in the same way a nervous homeowner would pay a home-security provider like ADT to watch for fires or burglars.

news/cryptography/schneiers-fame-drives-counterpanes-success

In this paper we describe our new CS2 block cipher which is an extension of the original CS-Cipher. Our new design inherits the efficiency of the original design while being upgraded to support a larger block size as well as use a slightly improved substitution box. We prove that our design is immune to differential and linear cryptanalysis as well as argue it resists several other known attacks.

news/cryptography/the-cs2-block-cipher

Its getting hard not to notice the number of large websites advertising white papers. The catch is, most only contain a listing of vendor sponsored marketing brochures. This isn't very helpful if you're looking for detailed information about a technology.

Two researchers surprised the audience at a computer-security convention last month with their finding that a version of Microsoft Windows was more secure than a competing Linux operating system. This week, the researchers released their finished report, and it included another surprise: Microsoft was funding the project all along.

Companies face greater risks if they run their Web sites on Linux rather than Windows, a Microsoft-funded study has concluded. Last year, Web servers based on Windows Server 2003 had fewer flaws to fix than those based on Red Hat Enterprise Linux ES 3 in a standard open-source configuration, researchers said in a paper released on Tuesday. Moreover, the study indicated that the Microsoft-based Web server had far fewer "days of risk"--a measure of the number of days that each vulnerability is known, but unpatched--than the open-source rival.

The woman who cut me off on the freeway because she was too busy talking on her cell phone might not have had a clue, but she probably had an IP address. Mobile devices, from cell phones to PDAs to the automobiles themselves, increasingly require always-on Internet connectivity. According to at least one report, the average U.S. home has over 250 devices that could benefit from Internet connectivity. While the number of IP addresses in the world is large -- IPv4's 32-bit addressing scheme enables 4 billion addresses -- it is not infinite. And the woman applying blue eyeshadow on the 101 freeway is using up one of them.

news/network-security/mobile-ipv6-on-linux

One often-overlooked requirement of a functioning VPN is DNS. For any host-network or network-network VPN, you will be enabling access to machines that are not available on the Internet at large. Unless you want to access machines only by their IP address, you want to have DNS work cleanly.

news/network-security/how-to-set-up-dns-for-linux-vpns

There is a widespread and wholly inaccurate impression that open source development is somehow haphazard and undisciplined, a free-for-all among brilliant but uncoordinated individuals. In fact, most major open source projects are very tightly managed highly disciplined teams.

news/network-security/open-source-for-perimeter-security

If you're an IT manager, introducing Linux into your enterprise is a tough decision. Choosing to take the plunge at all is one thing, but facing the myriad choices is another. At last count, the database at DistroWatch.com racked some 345 actively maintained Linux and BSD distributions. Although most enterprises are likely to consider only a fraction of that catalog, the number of decision points it represents is potentially much larger.

news/server-security/the-good-and-bad-of-linux-livecds

The Linux Intrusion Detection System (LIDS) is a kernel patch for both 2.4 and 2.6 kernels that adds Mandatory Access Control (MAC) and other security enhancements to the Linux kernel. The main feature of LIDS is its ability to limit the power of the root account. LIDS uses Access Control Lists (ACLs) to control access to files, processes, and network resources. Once these permissions are set, they cannot be overridden, even if a user or process has root privileges. You may be wondering why anyone would choose LIDS over its more popular counterpart, SELinux. Both have their advantages. Both add MAC and the ability to limit the damage that can be done by the root account. There are two reasons why you may want to consider LIDS instead of SELinux.

news/server-security/secure-your-server-with-lids

Australian company Cybersource says it's currently talking to two banks in Australia about providing Linux-based bootable CDs to consumers to ensure Internet banking security. The company yesterday released information about its Online Banking Coastguard solution. Coastguard is based upon Knoppix, a Linux distribution which boots entirely from CD and is known for its automatic hardware detection features. Cybersource has included Mozilla Firefox as the sole browser for Internet banking.

news/server-security/linux-touted-as-the-solution-to-online-banking-problems

Security vendor Symantec is warning that Apple's OS X operating system is increasingly becoming a target for hackers and malware authors. In its seventh bi-annual Internet Security Threat Report, Symantec said over the past year, security researchers had discovered at least 37 serious vulnerabilities in the Mac OS X system. According to Symantec, as Apple increases its market share - with new low cost products such as the Mac mini - its userbase is likely to come under increasing attack.

While many websites and papers discuss incident handling and incident response plans, aside from RFC 2350 very few of these lay out exactly what an actual plan might look like. The following is an outline of a typical generalized incident handling and response plan for a small to mid-sized organization that doesn't have a dedicated incident response staff.

Enterprises are no longer restricted to the networked systems bounded by the building in which the company is housed. Modern enterprises span the globe and employees can easily access the corporate network from outside the office, opening many more productivity channels. The proliferation of broadband has enabled home working to become an economically viable option while the dramatic fall in the price of laptops allied with the explosion in WiFi technology has made mobile working the norm for many companies.

Opening its annual BrainShare user conference, Novell CEO Jack Messman took the opportunity to remind the technology world that Novell has "a truly global ecosystem, unmatched by other Linux vendors" - with offices in 43 countries and over 5,000 technology, services and training partners delivering support for its customers worldwide. "We give our customers real choice," he added.

An "independent" report that claims Linux security vulnerabilities are more numerous and severe than in Windows has been confirmed as having been funded by Microsoft. The Role Comparison Report report by Richard Ford of the Florida Institute of Technology's College of Engineering, and Herbert Thompson of security company Security Innovation, was originally previewed in draft form at the RSA conference in February, where it attracted inevitable criticism for its methodology and claimed bias.

Laws against theft don't end stealing, and laws against the ills of the Internet age aren't likely to stop the spread of computer spyware, the Legislature's Judiciary Committee was told Friday. But such laws are worth passing, said Alex Nicoll, associate director of technologies for the Nebraska University Consortium on Information Assurance. The spyware programs "are causing people grief. They are causing people loss. We should not just say we should give up," Nicoll said at a committee hearing.

news/government/senators-address-spyware-spam

Brazilian police last week arrested the suspected kingpin of a gang which looted an estimated $37m from online banking accounts. Valdir Paulo de Almeida allegedly masterminded a scam to raid accounts using a Trojan horse sent by email to thousands of victims, mostly Brazilian.

news/hackscracks/brazilian-cops-net-phishing-kingpin