Linux Security Week: January 1st 2007

HNS is running an article with a list of those malicious codes which, although they may not have caused serious epidemics, have stood out in one way or another.

The basis of the attack is rather old. It was described by the Princeton University in 1996 [1] and was recently brought to my attention by Amit Klein [3]. For the attack to succeed the attacker needs to control the DNS entry for his web server (http://www.attacker.org/ in the following example).

If you're talking over your IP network right now, then voice-over-IP should be at the top of your security priorities for next year. Securing enterprise IP voice hasn't been on most organizations' radar screens, mostly because VOIP so far hasn't been a popular target of attackers or bug hunters, nor have many organizations torn out their traditional voice systems altogether, anyway. But security experts say it's time to make VOIP security a priority.

news/network-security/voip-more-vulnerable

I am frequently asked questions, many of the questions are the same things over and over again, and I always see the same mistakes being made when setting it up. So, i've compiled a list of the top ten mistakes and commonly misconfigured or overlooked things when configuring everyone's favorite IDS.

Once again it is time to take note of those security blunders from the past year that have given us so many opportunities to learn from our mistakes.

news/government/and-the-worst-security-idea-of-2006-was

As an online shopper, Claudia Race knows she must look out for scams. So as an Internet entrepreneur working out of her home in New Braunfels, Texas, Race wants to use all the tools available to assure customers they can trust the vacation-rentals service she is about to launch. But because her small business is so new, Race said she might not qualify for the online seals of approval that Overstock.com Inc. and other larger, established companies are getting to instruct Microsoft Corp.'s Internet Explorer browser to display a green address bar for "safe" when people visit her site.

A new study warns that Web sites containing security certificates are not necessarily safe. The results were somewhat surprising when Web sites bearing the TRUSTe security certificate were compared against a list of known malware sites from McAfee's Siteadvisor product, a service that black-lists Web sites containing spyware, spam, viruses and online scams.

Sensors monitored by Symantec's DeepSight threat management service have reported a significant spike in traffic related to TCP port 2967, which Symantec has traced to scans generated by the "Sagevo" worm.

Asymmetric warfare is hell. Sure, you may have night-vision goggles, body armor, and air support, but you're also working for a bureaucratic organization built to fight a war that doesn't look much like the one you're in. Your adversary, on the other hand, is poorly equipped, yet nimble, resourceful, and adept at spotting and exploiting the slightest weakness. So much so, you may not even know you're under attack.

Take the U.S. Department of Commerce's Bureau of Industry and Security, which just this month confirmed that intruders, traced to servers in China, had spread a massive rootkit infection that will result in the replacement of hundreds of desktop computers. The attack, first discovered in July, eventually forced the Department of Commerce to suspend employee Internet access. A Department of Commerce spokesman admitted that, at first, the Department didn't recognize the extent of the problem.

The Electronic Frontier Foundation (EFF) welcomes the newest member of its Board of Directors, computer security expert Edward W. Felten. A professor of Computer Science and Public Affairs at Princeton University, Felten recently demonstrated the ability to manipulate results on a Diebold electronic voting machine -- showing that the equipment was extremely vulnerable to "vote-stealing" attacks that would undermine the accuracy of vote counts.

Felten's research interests include computer security and privacy -- especially relating to media and consumer products -- and technology law and policy. He has published about 80 papers in the research literature and two books. Felten was the lead computer science expert witness for the Department of Justice in the Microsoft antitrust case. He has also testified before the Senate Commerce Committee on digital television technology and regulation and before the House Administration Committee on electronic voting.

news/privacy/computer-security-expert-joins-eff

Due to an increased network threat condition, the Defense Department is blocking all HTML-based e-mail messages and has banned the use of Outlook Web Access e-mail applications, according to a spokesman for the Joint Task Force for Global Network Operations. An internal message available on the Internet from the Defense Security Service (DSS) states that JTF-GNO raised the network threat condition from Information Condition 5, which indicates normal operating conditions, to Infocon 4 "in the face of continuing and sophisticated threats" against Defense Department networks.

news/government/dod-bars-use-of-html-e-mail

This website details the design and construction Wave Bubble: a self-tuning, wide-bandwidth portable RF jammer. The device is lightweight and small for easy camoflauging: it is the size of a pack of cigarettes. An internal lithium-ion battery provides up to 2 hours of jamming (two bands, such as cell) or 4 hours (single band, such as cordless phone, GPS, WiFi, bluetooth, etc). The battery is rechargeable via a mini-USB connector or 4mm DC jack (a common size). Alternately, 3 AAA batteries may also be used.

Matthew Schuster began work as a computer technician for Alpha Computer Services in Wausau, Wisc., in 2000. Schuster provided technical support for a wireless Internet system called CWWIS and also was a paying subscriber to CWWIS for his home.

Schuster was fired in May 2003. His home CWWIS account was terminated and the balance of his monthly payment refunded. But he continued to use CWWIS by using "access information" belonging to Alpha customers such as the Central Wisconsin Convention and Visitors Bureau--and, according to the FBI, he intentionally disrupted CWWIS as well.