Linux Security Week: July 18th 2005

A free monthly newsletter providing summaries, analyses, insights, and commentaries on security: computer and otherwise.

What is the secret to network security? In the wake of recent high-profile security breaches like at LexisNexis and MasterCard, it's worth asking what it takes to nail down network security --- and what are the secrets not everyone knows?

news/network-security/the-five-top-network-security-secrets

Software maker Opera's decision to support BitTorrent has added to some security experts' worries that applications which require open connections through firewalls are becoming increasingly popular.

news/network-security/desktop-port-proliferation-a-security-risk

Representatives from 37 e-mail technology companies used a one-day Summit in New York on Tuesday to exhort private sector administrators and online marketers to adopt e-mail sender authentication technology that helps block spam and phishing attacks.

news/network-security/speakers-at-e-mail-summit-push-authentication-reputation-tools

A U.K.-based security firm is touting a new service that scours corporate networks for zombies -- PCs that have been hijacked without the owner's knowledge and turned into spam-spewing engines.

news/network-security/zombiealert-scours-corporate-networks-for-spam-spewing-pcs

You've got to hand it to the IT security industry for its ability to coin new and impressive sounding terms for security threats. Hot on the hells of WiPhishing and Evil Twins comes the latest buzz word for wireless Lan security: phlooding.

news/network-security/phlooding-attack-could-leave-enterprises-high-and-dry

A Korea-UK team (contact Myungshik Kim, Queen's University, Belfast, This email address is being protected from spambots. You need JavaScript enabled to view it., or Chilmin Kim, Paichai University) has introduced a method for preventing several clever attacks against quantum cryptography, a form of message transmission that uses the laws of quantum physics to make sure an eavesdropper does not covertly intercept the transmission. Making the message sender and receiver a little blind to each other's actions, the researchers have shown, can bolster their success against potential eavesdroppers.

news/network-security/strengthening-quantum-cryptography-by-putting-on-blinders

Web sites both big and small face the risk of having their Web addresses stolen because of flaws in the way domain names are registered, transferred and tracked, a report released this week found.

news/network-security/domain-hijacking-takes-icann-spotlight-7880

OSSEC HIDS is a self-contained system for Host-based intrusion detection. It performs log extraction, integrity checking and health monitoring. All this information is correlated and analyzed by a single engine, creating a very powerfull detection tool.

John Leyden from The Register writes: "Net infrastructure firm VeriSign has bought security intelligence firm iDefense for $40m in cash. iDefense's 45 employees will join VeriSign in a move designed to bolster its managed security services offering with proactive threat warning and security remediation advice."

news/vendors-products/verisign-buys-idefense-for-40m

Sun Microsystems plans to open-source its Web site authentication and single sign-on technology.

Eric Leach, director of product management at Sun, said the Santa Clara, Calif.-based company will open-source the technology through the Open Source Web Single Sign-On, or OpenSSO project. That effort includes technology related to authentication, single domain, single sign-on, Web agents and J2EE agents, he said.

news/vendors-products/sun-to-open-source-web-authentication-single-sign-on

Knowledgecave is proud to announce that KCPenTrix Ver 1.0 is now available.

news/security-projects/kcpentrix-10-pentesting-livecd-released

NetWhistler 2.6 is a easy to use Network monitoring software that offers integrated fault and performance management functionality.

news/security-projects/netwhistler-26-release

Nmap ("Network Mapper") is a free utility for network exploration and security auditing. It was designed to rapidly scan large networks, although it works fine against single hosts. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. Nmap runs on most types of computers and both console and graphical versions are available. Nmap is free software, available with full source code under the terms of the GNU GPL. Read at TuxJournal.net

news/security-projects/interview-with-fyodor-of-nmap

The IT world may be an insecure place, but don't blame Linux. In fact, very few IT pros participating in InformationWeek Research's Linux and open-source survey say Linux has introduced security problems into their IT environments.

Only 6% of 225 user sites report security issues from Linux deployments on their servers, while 6% of 165 Linux PC users attribute a security problem to the open-source operating system. The results indicate a slight decrease in complaints about Linux security from a year ago, when 11% of IT pros encountered security issues with Linux servers and 7% had problems with Linux PCs.

Microsoft has claimed that open source database products and servers such as Linux have had a "significantly greater number and severity of vulnerabilities compared with Windows Server 2003 and SQL Server 2000".

Hacking magazine Phrack is closing after 20 years of publishing after its editorial team decided to call it a day. The final date for submissions for the special hardback last issue of the mag was Sunday 10 July. Issue 63 will be released at the Defcon and WhatTheHack2005 hacker conventions later this month.

A group of leading technology companies that includes Microsoft Corp., IBM, Yahoo Inc. and Cisco Systems Inc. has submitted a new e-mail authentication standard to the Internet Engineering Task Force for consideration, eWEEK has learned.

Personal computers that play unwitting host to "zombie" code are proliferating at a startling pace, according to a new report.

The Mozilla Foundation updated the Firefox Web browser Tuesday in order to patch a series of security vulnerabilities, including widely publicized browser spoofing issue and a frame-injection issue.

Jurgen Geck held what looked like a silver bullet between his thumb and index finger. "This is a Fisher Space Pen," he said -- a pen developed for NASA astronauts in space, a pen with ink that just keeps on flowing. A pen able to write upside down and even underwater.

"It's sophisticated, it's costly, it's very nice and very shiny," Geck said. Geck is chief technology officer at SuSE Linux, an open-source software outfit now owned by Novell, and he's about to make his point: "The Russians just used a pencil."

Web sites both big and small face the risk of having their Web addresses stolen because of flaws in the way domain names are registered, transferred and tracked, a report released this week found.

news/network-security/domain-hijacking-takes-icann-spotlight-7880

There is little to choose between Microsoft and Linux in terms of operating system security, according to experts, but misleading figures and surveys are muddying the waters for IT managers evaluating the platforms.

Cisco Systems identified several vulnerabilities in its products this week that could lead to denial-of-service attacks.

Which not entirely security-related, this article caught my attention:

"INTEL IS ABOUT TO CUT Linux out of the legitimate content market, and hand the keys to the future of digital media to Microsoft at your expense. ... The vehicle to do this is called East Fork, the upcoming and regrettable Intel digital media 'platform'. The funny part is that the scheme is already a failure, but it will hurt you as it thrashes before it dies. Be afraid, be very afraid."

Bank of America is rolling out its new online security system, SiteKey, this week in Virginia, Maryland and Washington, D.C. It launched last month in Tennessee, and should be available nationwide by the fall. By Paul Nowell, The Associated Press

The Mozilla Foundation this week updated its rival to Microsoft Outlook, the Thunderbird stand-alone POP3 e-mail and news client, to plug some of the same security holes that earlier were fixed in the open-source group's popular Firefox browser.

Anti-spyware vendors and consumer groups took a stab at issuing uniform definitions for "spyware" and "adware" on Tuesday in hopes of giving computer users more control over their machines.

The definitions seek clarity that could help improve anti-spyware products, educate consumers and fend off lawsuits from developers of software that sneaks onto computers.

news/privacy/coalition-issue-definitions-for-spyware

Identity thieves and impersonators thrive on publicly available personal information and data pilfering. Now that information, along with some bogus data on would-be fraud victims, is being used against the thieves in an identity verification scheme from StrikeForce Technologies.

news/privacy/personal-data-quiz-throws-wrench-into-id-theft

Congress will vote any day now on new legislation that would renew parts of the USA PATRIOT Act scheduled to expire or "sunset" at the end of the year, while possibly handing the FBI even more unchecked power to snoop on your mail and private records, including logs of your Internet activities.

news/privacy/last-chance-to-stop-renewal-of-the-usa-patriot-act

In the Internet criminal justice system the people are betrayed by two separate, yet equally important groups: the hackers who investigate and exploit security problems and the legal authorities who don't take the offenders seriously. These are their stories.

news/government/law-and-order-on-the-internet

It appears as if a popular Firefox community site, Spread Firefox!, was hacked: It appears that a part of Spread Firefox was hacked in an attempt to use it to send out spam. It doesn't look like the attacker accessed any personal data on the site, but to be safe, we're encouraging all of our users to log in and change their passwords..

Doesn't look like a big deal but if you're a member of that site you may want to go change your password.

news/hackscracks/popular-firefox-community-site-hacked

The basic facts are that Benjamin Smith III used someone else's WiFi network. The facts aren't in dispute; Smith parked his vehicle outside the home of Richard Dinon, logged onto the network, and did some surfing.

"Surprise! Stealing is illegal!" bellowed Larry Seltzer in his ZD security blog.