|
[networknewsletters]
||
[Date Prev]
[03-2005 Date Index]
[Date Next]
||
[Thread Prev]
[03-2005 Thread Index]
[Thread Next]
Security-News February 28, 2005 update
- From: Educational CyberPlayGround <admin@xxxxxxxxxxxxxxx>
- To: NetworkNewsletters@xxxxxxxxxxxxx
- Date: Tue, 01 Mar 2005 12:22:09 -0500
**************************************************************
-- Educational CyberPlayGround Community
http://www.edu-cyberpg.com/
-- Network Newsletters Mailing List ©1994
-- Subscribe - Unsubscribe - Email Preferences
http://www.edu-cyberpg.com/Community/NetworkNewsletters.html
-- Advertise on Network Newsletters Mailing List
http://www.edu-cyberpg.com/Community/Subguidelines.html
-- Mailing Lists
http://www.edu-cyberpg.com/Community/
**************************************************************
*************************************************************
NATIONAL WOMEN'S HISTORY MONTH
http://www.edu-cyberpg.com/Teachers/womenmonth.html
SPECIAL EDITION
Women In Science
Changing Girls' Attitudes About Computers
Educating Girls in the New Computer Age (2000)
HERSTORIES Classroom Project
Best Online Resources For Women and Minorities in Science and Technolgy
Computer Wonder Women
What you can do to help GRRLS get into technology!
http://www.edu-cyberpg.com/Teachers/womenspecialedition.html
*************************************************************
SECURITY IN THE NEWS
updated on February 28, 2005
This report is available on the web at
http://www.thei3p.org/news/today.html
and as an RSS feed at
http://www.thei3p.org/news/today.xml
HOMELAND SECURITY & INFRASTRUCTURE PROTECTION
Cyber warriors anticipate center:
Federal Computer Week, 2005-02-25
CYBERCRIME-HACKING
Hackers invaded state Web sites 72 times in five years:
The Journal News - New York, 2005-02-26
Bank loses credit card info of 1.2M federal workers:
Computerworld, 2005-02-26
Known Hole Aided T-Mobile Breach:
Wired News, 2005-02-28
Limp Bizkit porn leak could lead to Hilton hacker:
C-Net News, 2005-02-25
eBay provides a backdoor for phishers:
The Register, 2005-02-28
Webcam Trojan perv gets slapped wrist:
The Register, 2005-02-28
POLITICS-LEGISLATION
European Commission Stands by IT Patent Proposal:
EWeek.com, 2005-02-28
TECHNOLOGY
'No Execute' Flag Waves Off Buffer Attacks:
Washington Post, 2005-02-27
VULNERABILITIES & EXPLOITS
Opera brings down curtain on phishing vulnerability:
ZDNet Australia, 2005-02-28
BEST PRACTICES & RISK MANAGEMENT
Security Firms Follow Unwritten Code When Digging Up Dirt On Each Other:
Information Week, 2005-02-25
Security pros get tough with users:
SearchSecurity, 2005-02-28
CIVIL & CONSUMER ISSUES
Microsoft admits targeting Wine users:
ZDNet Australia, 2005-02-28
True love with a criminal-background check:
C-Net News, 2005-02-28
HOMELAND SECURITY & INFRASTRUCTURE PROTECTION
Title: Cyber warriors anticipate center
Source: Federal Computer Week
Date Written: 2005-02-25
Date Collected: 2005-02-28
The US military's Joint Task Force-Global Network Operations (JTF-
GNO) organization, devoted to cyberdefense, expects to have a new
state-of-the-art command center by May 2005. In preparation, the
military will update the secure compartmentalized information
facility (SKIF) of JTF-GNO predecessor, the Joint Task Force-
Computer Network Operations. Work on the center started in
December 2004, however, a JTF-GNO spokesman declined to comment
on its cost or contractors. The center and the May release of the
Joint Concept of Operations guidelines for defending military
networks will make JTF-GNO fully operational. JTF-GNO falls under
the aegis of Strategic Command. In 2004, Defense counted 74,053
attempted intrusions into US military networks, compared to
40,076 in 2001, 43,086 in 2002, and 53,688 in 2003.
http://www.fcw.com/fcw/articles/2005/0221/web-jtfg-02-25-05.asp
CYBERCRIME-HACKING
Title: Hackers invaded state Web sites 72 times in five years
Source: The Journal News - New York
Date Written: 2005-02-26
Date Collected: 2005-02-28
According to a report by the a New York State Assembly=92s
Committee on Oversight, Analysis, and Hackers, the websites of
New York state agencies and authorities have been hacked at least
72 times between 1999 and December 2004. The computer systems of
the state's Department of Motor Vehicles, the Department of
Education, the Department of Correctional Services, and the New
York Power Authority were defaced or attacked, leading to
increased worries about identity theft. State Senator Jeff Klein,
who headed the committee responsible for the report, said state
and private companies are not keeping information safe enough,
possibly exposing citizens to ID theft. William Pelgrin, director
of the state Office of Cyber Security and Critical Infrastructure
Coordination, said the report is misleading and inaccurate, and
that no consumer information was compromised.
http://www.thejournalnews.com/apps/pbcs.dll/article?AID=3D/20050226/BUSINESS=
01
/502260306/1066/BUSINESS01
Title: Bank loses credit card info of 1.2M federal workers
Source: Computerworld
Date Written: 2005-02-26
Date Collected: 2005-02-28
Bank of America officials have announced that tapes containing
credit card data, Social Security numbers, and addresses for US
Senators and more than a million government employees--including
a third of the Pentagon's staff--have gone missing. Bank of
America would not comment on how the tapes were lost, but Senator
Charles Schumer (D-New York) says the Senate Rules Committee
believe they were stolen from a commercial airplane by baggage
handlers. Of the 1.2 million account holders affected, over
900,000 belong to Defense employees. The tapes were lost in
December 2004, but Bank of America did not inform account holders
until recently under orders from federal law enforcement. No
identity thefts have been reported, and Bank of America considers
the tapes 'lost'. Senator Patrick Leahy (D-Vermont) hopes this
incident will push Congress to examine the threats faulty
security practices pose to privacy rights.
http://www.computerworld.com/securitytopics/security/story/0,10801,100061,00
.html
Title: Known Hole Aided T-Mobile Breach
Source: Wired News
Date Written: 2005-02-28
Date Collected: 2005-02-28
A late 2003 cyberattack that allowed Nicholas Jacobsen, 22, to
access T-Mobile servers holding government documents, customer
records, and celebrities' personal photos may have been enabled
by T-Mobile's failure to patch a security hole. In March 2003,
BEA Systems released a patch for a high-severity flaw that would
allow an attack to read or replace any file on a WebLogic
application server through a specially crafted web address. The
flaw and exploit were outlined in July 2003 at the Black Hat
Briefing conference in Las Vegas, attended by over 1,700 security
professionals. Mr. Jacobsen developed an exploit on his own after
the release of the BEA advisory and looked for vulnerable servers
on the Internet; he access T-Mobile in October 2003. T-Mobile has
refused to comment on its security and patching policies, citing
ongoing investigations and customer protection.
http://www.wired.com/news/privacy/0,1848,66735,00.html
Title: Limp Bizkit porn leak could lead to Hilton hacker
Source: C-Net News
Date Written: 2005-02-25
Date Collected: 2005-02-28
A tentative link has been found between the hackers who posted a
private video of Limp Bizkit lead singer Fred Durst with a young
woman and the hackers who posted the contents of Paris Hilton's
mobile Sidekick online. David Hans Schmidt, a publicist who
represents celebrities for the sale of nude photos, negotiated a
deal with a group of hackers to prevent the release of the
explicit video, but the hackers backed out and published the
video online. The hackers also included Mr. Schmidt's contact
information. The hackers claimed they were also responsible for
the attack that published the contents of Paris Hilton's T-Mobile
Sidekick online; Mr. Schmidt says he will cooperate with
investigators to determine if the claim is true. Reports that the
video was also stolen from a Sidekick device are false, since Mr.
Durst is not a Sidekick subscriber and Sidekicks have no video
capabilities.
http://news.com.com/Limp+Bizkit+porn+leak+could+lead+to+Hilton+hacker/2100-7
349_3-5590569.html
Title: eBay provides a backdoor for phishers
Source: The Register
Date Written: 2005-02-28
Date Collected: 2005-02-28
According to reader reports, phishers are exploiting a
redirection script on eBay's website. Security firm MessageLabs
confirmed the vulnerability, and says it has detected and blocked
it for weeks. The flaw can be exploited to host an eBay look-
alike, and make a link pointing to eBay redirect to the bogus
website. The Register notified eBay of the issue on February 23,
2005, and the company has not responded.
http://www.theregister.co.uk/2005/02/28/ebay_phishing_backdoor/
Title: Webcam Trojan perv gets slapped wrist
Source: The Register
Date Written: 2005-02-28
Date Collected: 2005-02-28
A court in Malaga, Spain, has fined an unnamed computer science
student =804,000 (US$5,300) for using the Subseven Trojan to spy on
a young woman through her webcam. =803,000 will go to the woman as
compensation while =801,000 will go to the court. The woman only
learned of the spyware when the culprit sent photos taken from
the webcam to her by accident. Sophos' Graham Cluley notes that
while Subseven may be the first malware to include webcam
features, it has become a standard tool among virus writers.
Every new instance of the Rbot worm carries code to take pictures
from webcams.
http://www.theregister.co.uk/2005/02/28/webcam_trojan_case/
POLITICS-LEGISLATION
Title: European Commission Stands by IT Patent Proposal
Source: EWeek.com
Date Written: 2005-02-28
Date Collected: 2005-02-28
The European Commission (EC) has rejected the European
Parliament's (EP) request that controversial IT patenting
legislation be thrown out. The decision allows the EC to send the
proposal to the next stage of the process, without being
discussed by any specialized bodies. EC President Jose Manuel
Barroso said the EC will submit a new proposal on the patent
issue, and that the EC expects the European Union (EU) to adopt
the proposal quickly, and pass it to the EP for a second reading.
Florian Mueller, manager of the NoSoftwarePatents.com campaign,
said the decision negates democracy, and called upon the EU
council to reopen negotiations.
http://www.eweek.com/article2/0,1759,1770806,00.asp
TECHNOLOGY
Title: 'No Execute' Flag Waves Off Buffer Attacks
Source: Washington Post
Date Written: 2005-02-27
Date Collected: 2005-02-28
Buffer overflows are a common attack method used by hackers and
Windows Service Pack 2 added a new defense. Special code called a
no execute (NX) flag was built in that blocks code from running
in the memory areas targeted by overflow attacks on compatible
processors. However, while AMD offers NX support on all of its
Athlon 64 chips, Intel offers the functionality on a seemingly
random selection of chips, including the 520J, 530J, 540J, 550J,
560J, 570J, 630, 640, 650, 660, and Extreme Edition Pentium 4
desktop processors, and the 730, 740, 750, 753, 758, 760, and 770
Pentium M laptop processors. Red Hat Enterprise Linux 3 Update 3
and SuSE Linux 9.2 also include NX. While the combination of an
NX inclusive operating system and an NX enabled processor will
block a single buffer overflow, it will cause the computer to
crash while blocking the attack.
http://www.washingtonpost.com/wp-dyn/articles/A55209-2005Feb26.html
VULNERABILITIES & EXPLOITS
Title: Opera brings down curtain on phishing vulnerability
Source: ZDNet Australia
Date Written: 2005-02-28
Date Collected: 2005-02-28
Software developer Opera released February 26, 2005 a second beta
version of its browser, addressing vulnerability that could be
exploited to execute phishing attacks. The flaw stems from the
browser=92s support of the International Domain Name (IDN)
standard, and affects non-Microsoft browsers including Opera,
Safari, and Firefox. The bug can allow attackers to fool users by
spoofing the browser=92s address bar. Christen Krogh, vice
president of engineering at Opera, said the browser will now
display a yellow security bar with the name of the organization
that owns a website=92s security certificate when visiting secure
websites, and will only display trusted top level domains (TLDs),
meaning those on a regularly updated list of TLDs registered with
the company.
http://www.zdnet.com.au/news/security/0,2000061744,39182702,00.htm
BEST PRACTICES & RISK MANAGEMENT
Title: Security Firms Follow Unwritten Code When Digging Up Dirt On Each
Other
Source: Information Week
Date Written: 2005-02-25
Date Collected: 2005-02-28
Internet Security Systems (ISS) discovered a critical
vulnerability in Trend Micro=92s anti-virus engine February 24,
2005. The flaw relates to the ARJ file format, and could be
exploited by an attacker to gain unauthorized access to networks
and machines protected by the software. The flaw marked the third
vulnerability in security software discovered by ISS in February
2005, following instances with Symantec and F-Secure, which also
dealt with compressed-file handling. John Pescatore, vice
president at Gartner, said there is an unwritten protocol to give
a vendor time to patch a vulnerability before disclosing it to
the public. ISS followed this protocol in all three instances,
and Mr. Pescatore said he has heard no negative sentiments about
ISS for disclosing the flaws in other security products. Mr.
Pescatore added that looking for holes in competitors=92 security
products could be inappropriate it abused, and while ISS is not a
direct competitor, it does stand to gain from the publicity.
http://www.informationweek.com/story/showArticle.jhtml?articleID=3D60403683
Title: Security pros get tough with users
Source: SearchSecurity
Date Written: 2005-02-28
Date Collected: 2005-02-28
As companies devote more resources to protect their systems from
cyberattack, employees continue to act as one of the largest
security holes, sometimes giving out sensitive data over phone
and e-mail or surfing unsafe websites. This has lead the Business
Software Alliance (BSA) and the Information Security Systems
Association (ISSA) to call for strong penalties for workers who
do not abide by security policies and aggressive criminal and
civil action against perpetrators of fraud and identity theft.
Such policies mark a change in corporate management, since most
companies used to encourage information technology staff to avoid
upsetting other employees.
http://searchsecurity.techtarget.com/originalContent/0,289142,sid14_gci10623
59,00.html
CIVIL & CONSUMER ISSUES
Title: Microsoft admits targeting Wine users
Source: ZDNet Australia
Date Written: 2005-02-28
Date Collected: 2005-02-28
Microsoft admitted February 25, 2005 that it prioritized making
its anti-piracy tool prevent Wine, an open source toolkit that
can run Windows applications using Linux, from downloading
Windows updates. A company spokesperson said the validation tool
used by the Windows Genuine Advantage (WGA) program identifies
Wine users, and the company does not knowingly provide
copyrighted files to users of third-party emulators or cross-
platform API translators. The spokesperson said users not running
Windows XP or 2000 natively can download updates for Microsoft
Office through the Office Update website.
http://www.zdnet.com.au/news/software/0,2000061733,39182686,00.htm
Title: True love with a criminal-background check
Source: C-Net News
Date Written: 2005-02-28
Date Collected: 2005-02-28
Online dating service True.com offers its customers criminal
background checks of potential partners as its competitive
advantage against other dating services. True.com chief executive
Herb Vest is also lobbying legislators in California, Texas,
Virginia, and Michigan to require dating services that do not
conduct background check to post a warning at the top of every
e-mail and personal advertisement, possibly putting competing
services at a disadvantage. A California version of the proposal
would cover any site offering "compatibility" or "social
referral" services, potentially affecting website devoted to
class reunions or tennis tournaments. While True.com admits that
background checks are not foolproof, government regulations could
give users a false sense of security. Mr. Vest admits that his
proposed laws could be too broad and is open to narrower
definitions, but argues that 20% of users falsely believe dating
services conduct background checks, showing they already have a
false sense of security.
http://news.com.com/True+love+with+a+criminal-background+check/2010-1071_3-5
591000.html
The Institute for Information Infrastructure Protection (I3P)
accepts no responsibility for any error or omissions in this e-mail.
The information presented is a compilation of material from various
sources and has not been verified by staff of the I3P. Therefore,
the I3P cannot be made responsible for the factual accuracy of
the material presented. The I3P is not liable for any loss or
damage arising from or in connection with the information
contained in this report. It is the responsibility of the user to
evaluate the content and usefulness of this information.
References in this e-mail to any specific commercial products,
processes, or services by trade name, trademark, manufacturer, or
otherwise, does not constitute or imply endorsement,
recommendation, or favoring by the I3P. I3P is a research, not
operational, organization, and makes its Security in the News
e-mail available as a public service on a best-effort basis.
Security in the News will be sent out on most business days, but
not all.
The Institute for Information Infrastructure Protection
45 Lyme Road, Suite 300
Hanover, NH 03755
Tel: (603) 646 0700
E-mail: listmanager@xxxxxxxxxx
<>~~~~~<>~~~~~<>~~~~~<>~~~~~<>~~~~~<>~~~~~<>~~~~~<>~~~~~<>~~~~~<>
EDUCATIONAL CYBERPLAYGROUND
http://www.edu-cyberpg.com
Copyright statements to be included when reproducing
annotations from Network Newsletter.
The single phrase below is the copyright notice to be used when
reproducing any portion of this report, in any format.
> From Network Newsletter copyright
> Educational CyberPlayGround.
http://www.edu-cyberpg.com/Community/NetworkNewsletters.html
Net Happenings, K12 Newsletters, Network Newsletters
http://www.edu-cyberpg.com/Community/
FREE EDUCATION VENDOR DIRECTORY LISTING
http://www.edu-cyberpg.com/Directory/
HOT LIST REGISTRY OF K12 SCHOOLS ONLINE
http://www.edu-cyberpg.com/Schools/
<>~~~~~<>~~~~~<>~~~~~<>~~~~~<>~~~~~<>~~~~~<>~~~~~<>~~~~~<>~~~~~<>
|
|
