Net-Sec newsletter 
Issue 18 - 19.06.2000 
http://net-security.org 

Net-Sec is a newsletter delivered to you by Help Net Security. It covers weekly 
roundups of security events that were in the news the past week. 
Visit Help Net Security for the latest security news - http://www.net-security.org. 


Subscribe to this weekly digest on: 
http://www.net-security.org/news/mailing_list 

Table of contents: 

1) General security news 
2) Security issues 
3) Security world 
4) Defaced archives 



General security news 
--------------------- 


---------------------------------------------------------------------------- 

RETROSPECTIVE ON LOVE LETTER 
Sun World published Brian Martin's article which is a retrospective on the "Love 
bug" fever. Article is entitled "Social aspects of the Love Bug virus". 
Link: http://www.sunworld.com/sunworldonline/swol-06-2000/swol-06-lovebug.html 


TECHNOLOGY FABLE 
Bruce Sterling offers you his imaginate predictions about future of technology, 
which could be a scenario for some Hollywood movie producers. "..Picture this 
scene from the near future: organized crime gets hold of encryption technology 
so powerful even IRS supercomputers can't crack it. An underground electronic 
economy emerges, invisible to U.S. tax code..." 
Link: The http://www.time.com/time/magazine/articles/0,3266,47159,00.html 


SECURITY PICTURE NOT TOO PRETTY 
When it comes to security in the Internet age, the picture is not too pretty. 
That was the message Bruce Schneier, founder and chief technology officer 
of Counterpane Internet Security Inc., gave during a session Monday at 
NetSec2000 conference. 
Link: http://www.crn.com/dailies/digest/breakingnews.asp?ArticleID=17456 


TECHNIQUES TO SECURE YOUR LINUX SYSTEM 
"Linux, despite its incredible stability, is insecure in its generally distributed 
form. Almost all major distributions - including Red Hat, Corel, Caldera, Debian, 
SuSE, TurboLinux, and others - have major unpatched vulnerabilities. Staying 
on top of security alerts for your distribution is one half of keeping your 
system secure." 
Link: http://www.geeks404.com/networking/articles/net.061400.securelinux1.php 


MAC SECURITY NEWS 
Logik (developer of Caem and xCGI) has released his latest project, 
Silo, to the public. The program, which can be downloaded for free from 
Logik's website, is a remote system analysis tool designed specifically for 
macintosh. The software features remote concept directory and passwd 
generation, OS fingerprinting, along with full address, protocol, client, 
system, and network analysis reports. 
Link: http://logik.accesscard.org/project.html 


US ENERGY DEPARTMENT IS INSECURE 
Audit project showed that several unclassified computer networks belonging 
to the U.S. Energy Department are so vulnerable that anyone could gain 
control of them. 
Link: http://news.excite.com/news/r/000613/18/crime-nuclear-computers 


CRACKED! PART 5: REBUILDING 
This is the fifth part of the story of a community network that was cracked 
and what was done to recover from it. By this point we have realized that 
we must get the cracker off of our machines before it is to late. It is only 
a matter of time before he trashes our system to clean up his tracks, 
gets a sniffer running under a different architecture or uses us to launch 
some denial of service attack. 
Link: http://www.rootprompt.org/article.php3?article=536 


KERNEL BASICS 
Having a basic knowledge of the internal mechanisms of the Linux kernel is 
important. This article describes what the kernel effectively is and what it does. 
Link: http://www.linuxpapers.org/show_article.html?KERNEL_BASICS 


SOFTWARE THAT CAN SPY ON YOU 
Why did Mattel include technology that can encrypt and send data to and 
from your PC in its children's CD-ROMs? 
Link: http://www.salon.com/tech/col/garf/2000/06/15/brodcast 


MORE ON RIP BILL 
by BHZ Friday 16 June 2000 on 12:34 PM 
Bob Satchwell, director of the Society of Editors, said the RIP Bill was only 
one of four pieces of forthcoming legislation that will adversely affect the 
ability of journalists to do their jobs. 

Sunday Times article 
http://www.sunday-times.co.uk/news/pages/tim/2000/06/16/timmdamda01005.html 

What is RIP bill? 
http://net-security.org/cgi-bin/reports/fullnews.cgi?newsid957739742,92588, 


FIGHTING PEDOPHILES 
ABC News reporter Sascha Segan did an article on anti child porn groups 
that are fighting on-line pedophiles. Articles features groups like Condemned, 
ACPO and EHAP. 
Link: http://abcnews.go.com/sections/tech/DailyNews/antiporn000616.html 


CONTROL 
According to the State Department, China has created "special police units 
to monitor and increase control of Internet content and access." Since last 
year, Human Rights Watch reports, the Ministry of State Security "has been 
able to track individual e-mail accounts through monitoring devices on 
Internet Service Providers. Internet bulletin boards were subject to 
round-the-clock monitoring; several were closed for hosting political discussions 
or postings critical of government policies." 
Link: http://www.washingtonpost.com/wp-dyn/articles/A10217-2000Jun16.html 


LOOKS LIKE SUB7 HAS DoS CAPABILITIES 
by BHZ Monday 19 June 2000 on 4:14 AM 
After last weeks' article by in The Register, which was dealing with "Serbian 
trojan" case, where the author ranted on NETSEC company who said that it 
has DoS capabilities, they learned that NETSEC was on the right track after all.. 

"Sub7 Trojan can launch distributed attacks" 
http://www.theregister.co.uk/content/6/11424.html 

iDefense report on the trojan 
http://www.idefense.com/pages/ialertexcl/eccentric0001.Sub7.pdf 


"VIRAL WARS" 
Viruses and other wildlife, so far, have been the product of mischievous 
"wanton boys," not nihilists. The weaponry's been conventional, not nuclear. 
And, self-limited in destructive power, no virus yet has sought the annihilation 
of the Information Society or the Internet. Probably, virus designers don't want 
to destroy their own playground. 
Link: http://www.securityportal.com/cover/coverstory20000619.html 

---------------------------------------------------------------------------- 



Security issues 
--------------- 

All vulnerabilities could be found on: 
http://net-security.org/text/misc/bugs 

Note: 
Please pay attention when browsing to following links - the comma ( , ) at the 
end of the URL is part of the URL and the link won't work without it. 


---------------------------------------------------------------------------- 

REMOTE DOS ATTACK IN NAI PGP CERTIFICATE SERVER 
The Ussr Labs team has recently discovered a null memory problem in the PGP 
Certificate Server, The issue we found is if anyone connect to the PGP Certificate 
Server Command Port (used for manage Server operations) default (Port 4000) and 
the server is unable to resolve your IP address to a host name it will cause the 
process containg the services to crash. 
Link: < http://net-security.org/cgi-bin/bugs/fullnews.cgi?newsid960997097,57620, > 


SMARTFTP DAEMON V0.2 VULNERABILITY 
There is a bug in the SmartFTP-D Server which will give an attacker full access to 
the server, if he has the right to write files on the server. For every user, the 
program is checking if a special Userfile exists (Sample: Username=hacker & 
Userfile=hacker.FTP_User). If it exists, the configuration, like password, rights, 
etc. will be read out of this file. 
Link: < http://net-security.org/cgi-bin/bugs/fullnews.cgi?newsid961010462,37358, > 


PATCH AVAILABLE FOR "DTS PASSWORD" VULNERABILITY 
Microsoft has released a patch that eliminates a security vulnerability in a 
component that ships with Microsoft(r) SQL Server 7.0. If the component is 
configured improperly, the vulnerability could allow passwords to be compromised. 
Link: < http://net-security.org/cgi-bin/bugs/fullnews.cgi?newsid961021876,58518, > 


MICROSOFT SECURITY BULLETIN #35 - REVISION 
On May 30, 2000, Microsoft released the original version of this bulletin, to 
announce the availability of a patch that eliminates a security vulnerability in 
Microsoft(r) SQL Server(r) 7.0 Service Packs 1 and 2 installation routine. When 
run on a machine that is configured in a non-recommended mode, the routines 
record the administrator password in a log file, where it could be read by any 
user who could log onto the server at the keyboard. On June 15, 2000, the bulletin 
was updated to note that, under the same conditions as originally reported, the 
password also is recorded in a second file. 
Link: < http://net-security.org/cgi-bin/bugs/fullnews.cgi?newsid961102919,60318, > 


REMOTE DOS ATTACK IN ANALOGX SIMPLESERVER WWW VERSION 1.05 
The Ussr Labs team has recently discovered a null memory problem inthe 
SimpleServer WWW Version 1.05 What happens is by preforming an attack with 
a malformed urlinformation to port 80 it will cause the proccess containg the 
services to stop responding. 
Link: < http://net-security.org/cgi-bin/bugs/fullnews.cgi?newsid961102735,89375, > 


RE-RELEASE OF IIS 5.0 PATCH FOR MS00-031 
"On May 10, 2000, we released Microsoft Security Bulletin MS00-031 
(http://www.microsoft.com/technet/security/bulletin/ms00-031.asp), discussing 
a pair of vulnerabilities affecting Internet Information Server (IIS) 4.0 and 5.0. 
Both of the vulnerabilities, known as the "Undelimited HTR Request" and "File 
Fragment Reading via .HTR" vulnerabilities, should have been eliminated by 
the patches discussed in the bulletin. In the case of the IIS 4.0 patch, this 
was the case. However, we have recently discovered that the IIS 5.0 patch 
only eliminated the "Undelimited HTR Request" vulnerability, and not the "File 
Fragment Reading via .HTR" vulnerability. " 
Link: < http://net-security.org/cgi-bin/bugs/fullnews.cgi?newsid961264302,50180, > 


MULTIPLE REMOTE DOS ATTACKS IN DRAGON SERVER V1.00 AND V2.00 
The Ussr Labs team has recently discovered a null memory problem in the 
Dragon Server, Ussr Labs found multiple places in Dragon Server where they 
do not use proper bounds checking. The following all result in a Denial of Service 
against the servicein question. 
Link: < http://net-security.org/cgi-bin/bugs/fullnews.cgi?newsid961149637,24205, > 


AOL INSTANT MESSENGER DENIAL OF SERVICE 
The bug in the program comes about when one user (We will call the user Foo 
for now) attempts to send a file to another user (which we will refer to as Bar). 
When Foo tries to send the file to Bar, Bar's aim crashes. Bar does not even 
see any indication that Foo has attempted to send a file, or anyone has 
attempted to send a file for that matter. 
Link: < http://net-security.org/cgi-bin/bugs/fullnews.cgi?newsid961379795,80441, > 

---------------------------------------------------------------------------- 



Security world 
-------------- 

All press releases could be found on: 
http://net-security.org/text/press 

Note: 
Please pay attention when browsing to following links - the comma ( , ) at the 
end of the URL is part of the URL and the link won't work without it. 


---------------------------------------------------------------------------- 

BULL ANNOUNCES METHODOLOGIES RELATED TO SMART CARDS - [13.06.2000] 
On the eve of the conference on smart card security organised by EuroSmart 
in Marseilles (France), Bull announces its plan to release a new generation 
of cards offering unprecedented levels of security. The new cards, due for 
release in 2001, will address the growing security demands of card issuers 
and consumers. 

Press release: 
< http://www.net-security.org/cgi-bin/press/fullnews.cgi?newsid960891662,76571, > 

---------------------------------------------------------------------------- 

WINROUTE PRO FIREWALL FOR U.S. NAVAL AIR SYSTEMS - [14.06.2000] 
Tiny Software Inc., a leader in router and firewall software solutions for 
small- to medium-sized networks, today announced that it has supplied its 
award-winning, ICSA-certified WinRoute Pro to the U.S. Naval Aviation 
Systems Team. "The Naval Air Systems Team has selected WinRoute Pro for its 
profound security features within its certified firewall," said Brandon 
Talaich, vice president of marketing at Tiny Software. 

Press release: 
< http://www.net-security.org/cgi-bin/press/fullnews.cgi?newsid961011015,10555, > 

---------------------------------------------------------------------------- 

MARSH OFFERS E-BUSINESS SECURITY ASSESSMENTS ONLINE - [14.06.2000] 
Marsh, the world's leading insurance broker and risk advisor, is offering 
South Carolina companies e- business security assessments and the 
opportunity to apply for related insurance coverage over the Internet 
through a dedicated Web site at netsecuresite.com. Available free of charge, 
the e-business security assessments gauge a company's responses to 67 
multiple-choice questions, covering such areas as security policy and 
organization; assets and related controls; personnel; third-party 
relationships; physical and environmental security; systems, networks and 
applications; and business continuity planning and compliance. 

Press release: 
< http://www.net-security.org/cgi-bin/press/fullnews.cgi?newsid961011158,11815, > 

---------------------------------------------------------------------------- 

RELIABLE SOFTWARE TECHNOLOGIES RELEASES JUSTBEFRIENDS - [15.06.2000] 
To help businesses avoid productivity and financial loss resulting from 
e-mail viruses, Reliable Software Technologies (RST) today announced that it 
has developed a software program that can stop viruses from automatically 
propagating via Microsoft Outlook e-mail. JustBeFriends.dll supports and 
enhances Microsoft's recently announced Outlook E-mail Security Update by 
monitoring the Visual Basic scripting engine's interactions with Microsoft 
Outlook and immediately identifying and terminating any virus attempting to 
propagate via e-mail. With this simple program, businesses can apply added 
security to their e-mail systems and avert the exponential spread of viruses 
and the resulting disruption of e-mail service and networking. 

Press release: 
< http://www.net-security.org/cgi-bin/press/fullnews.cgi?newsid961063793,68189, > 

---------------------------------------------------------------------------- 

TREND MICRO CHANGES ORGANIZATIONAL STRUCTURE - [15.06.2000] 
Trend Micro, Inc., a leading provider of Internet content security, today 
announced that its Tokyo headquarters has modified its organizational 
structure by establishing new departments and reorganizing existing 
departments. 
Trend Micro provides centrally controlled server-based virus protection and 
content-filtering products and services. By protecting information that 
flows through Internet gateways, email servers, and file servers, Trend 
Micro allows companies worldwide to stop viruses and other malicious code 
from a central point before they ever reach the desktop. 

Press release: 
< http://www.net-security.org/cgi-bin/press/fullnews.cgi?newsid961064181,5585, > 

---------------------------------------------------------------------------- 

ECOMCARD SECURITY WILL BOOST INTERNET PURCHASES - [15.06.2000] 
Allnet Secom Inc. of Markham, Ontario, through EcomCard Inc., a Delaware 
Corporation, announces the launch of the EcomCard, a safe, secure and 
universal way to make purchases on and off the Internet. The EcomCard allows 
everyone, including teens and others without access to credit cards, to 
conduct e-commerce. There is no need for expensive credit checks, processing 
time or fees for financial institutions. The cards may be made available at 
the corner store for activation. 

Press release: 
< http://www.net-security.org/cgi-bin/press/fullnews.cgi?newsid961064398,52049, > 

---------------------------------------------------------------------------- 

OBERTHUR CARD SYSTEMS TEAMS UP WITH ACTIVCARD - [15.06.2000] 
Oberthur Card Systems today announced a partnership with ActivCard, a world 
leader in the delivery of digital identity and electronic certification 
technology for e-business communications and transactions. The partnership 
will bring together Oberthur's expertise in the field of advanced smart card 
e-business technology and ActivCard's proven excellence in the development 
of digital identity software and management tools to develop a range of 
secure, integrated transaction solutions for e-business and e-commerce. 

Press release: 
< http://www.net-security.org/cgi-bin/press/fullnews.cgi?newsid961064587,85605, > 

---------------------------------------------------------------------------- 

WIN INVESTS IN LATEST BIOMETRICS SYSTEM FROM NEC - [19.06.2000] 
NEC Technologies, Inc., a biometrics pioneer and world leader in the development, 
marketing and implementation of Automated Fingerprint Identification System 
(AFIS) technology for law enforcement, today announced that the Western 
Identification Network (WIN) has upgraded its current NEC AFIS to NEC's 
AFIS21(TM) product. WIN is the country's first multi-state AFIS network and 
supports combined databases of more than 17 million fingerprint records. NEC 
completed the upgrade last month, and the system is now operational. 

Press release: 
< http://www.net-security.org/cgi-bin/press/fullnews.cgi?newsid961423207,48874, > 

---------------------------------------------------------------------------- 

AXENT OFFERS FREE SECURITY WEBCAST - [19.06.2000] 
AXENT Technologies, Inc. (NASDAQ: AXNT), one of the world's leading Internet 
security solutions providers for e-business, today announced "Everything you 
Need to Know About Intrusion Detection." In this Webcast on intrusion detection, 
attendees will discover what measures can be taken to help keep intruders where 
they belong--out of organizations' confidential digital assets--in just 60 minutes 
from the convenience of their own office 

Press release: 
< http://www.net-security.org/cgi-bin/press/fullnews.cgi?newsid961423564,64949, > 

---------------------------------------------------------------------------- 



Defaced archives 
------------------------ 


[12.06.2000] - CNT: Computer Network Technology 
Original: http://www.cnt.com/ 
Defaced: http://www.attrition.org/mirror/attrition/2000/06/12/www.cnt.com/ 


[12.06.2000] - Telecommunications Reports International 
Original: http://www.brp.com/ 
Defaced: http://www.attrition.org/mirror/attrition/2000/06/12/www.brp.com/ 


[12.06.2000] - Corporate Intranet @ Black & Decker 
Original: http://www.bdk.com/ 
Defaced: http://www.attrition.org/mirror/attrition/2000/06/12/www.bdk.com/ 


[14.06.2000] - Bulgarian Posts 
Original: http://www.bgpost.bg/ 
Defaced: http://www.attrition.org/mirror/attrition/2000/06/14/www.bgpost.bg/ 


[15.06.2000] - National Archives of Canada 
Original: http://www.archives.ca/ 
Defaced: http://www.attrition.org/mirror/attrition/2000/06/15/www.archives.ca/ 


[16.06.2000] - U.S. Office of Special Counsel 
Original: http://www.osc.gov/ 
Defaced: http://www.attrition.org/mirror/attrition/2000/06/16/www.osc.gov/ 


[18.06.2000] - Texas School for the Blind and Visually Impaired 
Original: http://www.tsbvi.edu/ 
Defaced: http://www.attrition.org/mirror/attrition/2000/06/18/www.tsbvi.edu/ 



HNS staff 
staff@net-security.org 
http://net-security.org