SANS NewsBites is a semiweekly high-level executive summary of the most important news articles that have been published on computer security during the last week. Each news item is very briefly summarized and includes a reference on the web for detailed information, if possible.
Spend five minutes per week to keep up with the high-level perspective of all the latest security news. New issues are delivered free every Tuesday and Friday.
Volume III - Issue #31
August 01, 2001
Kudos to the whole SANS community. You did a fantastic job in finding
the Code Red worm, in getting the word out, in patching your systems
and teaching others how to patch theirs, and in monitoring the
worm's spread.
Hour-by-hour infection data (from SANS Internet Storm
Center - the Internet's early warning system) is posted at
www.digitalisland.net/codered/
We didn't post it at our site because several hundred thousand visitors
an hour was too much for us to handle and because we wanted to give
the whole Windows community a free class on how to patch the current
problem and how to change the ISAPI mapping of IIS web servers so that
the Code Red vulnerability and future similar vulnerabilities cannot
hurt them. If you have any interest in this area, it's a great class
by Jason Fossen, takes only 30 minutes, and is free. And please tell
MCSEs you know about the short course. One of the saddest dimensions
of information security is that hundreds of thousands of people
earned MCSE certifications without being required to demonstrate any
competence in security. You'll find the short course at the same site
as the worm infection data: www.digitalisland.net/codered/
TOP OF THE NEWS
Code Red Worm25 July 2001 New Case of ID Theft Involves SSNs
24 & 26 July 2001 Sircam Infestation Slows
25 July 2001 NIPC Falls Prey to Sircam
THE REST OF THE WEEK'S NEWS
27 July 2001 Indian Cracker Alleges Police Brutality26 & 27 July 2001 Privacy Groups File Complaint with FTC Over Windows XP
26 July 2001 Teen Publishes "Ethical" Hacker Manual
26 July 2001 Google Removes Links to Threatening Pages
26 July 2001 NIPC Not Living Up to Potential, Says GAO Report
25 July 2001 The Worm That Wouldn't Leave
25 July 2001 Hacker Documentary
23 & 24 July 2001 Adobe Recommends Russian's Release
23 & 24 July 2001 Trojan Steals Big Pond Users' Data
23 & 24 July 2001 SSH Remote Access Software Flaw
23 July 2001 Financial Institutions Need Stronger Information Safeguards
23 July 2001 Yahoo Server IP Change Keeps Messages From Reaching AOL Members
*************** Sponsored by Check Point Software ********************
Special Promotion--Next Generation Internet Security
Check Point Software, VPN and Firewall market leader, is offering 4
limited time product promotions:
- -The enterprise management COMMAND CENTER
- -More performance with the NEXT GENERATION POWER BOOST
- -Remote Access VPN technology with the SECURECLIENT EDGE
- -The PROVIDER-1 ADVANTAGE for effective, multi-policy security
management
http://www.checkpoint.com/promos
**********************************************************************
TOP OF THE NEWS
01 August 2001 Code Red Worm
Coordinated efforts of the entire security community, the press, and individual IIS owners appear to have been sufficient to reduce the number of vulnerable systems below the level at which the current version of the Code Red worm goes into hypergrowth. Although huge numbers of systems were infected (more than 100,000) and significant damage has been done to sites that were taken offline because of routers and systems being halted or overloaded by the worm, much more damage may have been avoided. The watchers are maintaining vigilance, but they seem hopeful.25 July 2001 New Case of ID Theft Involves SSNs
Social security numbers (SSNs), credit card information, drivers license numbers and other personal data belonging to hundreds of people began appearing in an Internet chat room in mid-July. The common link between the victims may be the on-line purchase of a cellular phone. What distinguishes this occurrence of "identity theft" from others is the involvement of such immutable details as SSNs and birth date information; unlike credit cards, these data cannot be canceled and re- issued. Many victims have reported fraudulent charges on their credit cards.-http://www.msnbc.com/news/604496.asp?0dm=T1BNT
[Editor's (Murray) Note: The author is confusing "theft of identity" with "theft of identifiers." He may enjoy poetic license. We as security professionals have a responsibility to insist upon the distinction. ]
[(Schultz) What is so scary about incidents such as these is that so many organizations store sensitive customer information, but there are so few safeguards in the US and many other countries regarding the protection of this information. Worse yet, many organizations are downright sloppy in their protection of consumer information. Remember, too, that once a social security number is compromised, the person who has that number is now faced with a set of undesirable alternatives---to either stick with the same number (which is risky), or to obtain a new one (which is an incredible hassle). ]
24 & 26 July 2001 Sircam Infestation Slows
The spread of the destructive Sircam worm has slowed significantly, but antivirus companies still consider it a serious threat. However, variants will likely be slow in coming as Sircam is written in compiled code and is thus unavailable for script kiddie modification.-http://www.wired.com/news/business/0,1367,45570,00.html
Sircam FAQ:
-http://news.cnet.com/news/0-1003-200-6660198.html?tag=prntfr
-http://www.cert.org/advisories/CA-2001-22.html
25 July 2001 NIPC Falls Prey to Sircam
A researcher at the FBI's National Infrastructure Protection Center (NIPC) opened a Sircam-infected e-mail attachment; a number of documents were then sent, courtesy of the worm, to outsiders.-http://www.zdnet.com/zdnn/stories/news/0,4586,2798011,00.html?chkpt=zdhpnews01
******************* Also Sponsored by Trend Micro ********************
TRENDMICRO SCANMAIL FOR EXCHANGE 2000 -- SECOND to NONE
If you are worried about email viruses, you need Trend Micro ScanMail
for Exchange. ScanMail is the first antivirus solution that seamlessly
integrates with the Microsoft Exchange 2000 virus-scanning API 2.0.
ScanMail ensures 100% inbound and outbound email virus scanning and
provides remote software management.
Download a FREE 30-day trial copy of ScanMail and find out why it is
the best:
http://www.antivirus.com/banners/tracking.asp?si=19&bi=169&ul=/smex2000
**********************************************************************
THE REST OF THE WEEK'S NEWS
27 July 2001 Indian Cracker Alleges Police Brutality
Anand Khare, a cracker arrested in India for defacing ccicmumbai.com, a Mumbai police cyber crime web site, has alleged police broke his hand during interrogation. While police deny the incident, they make no bones about the fact that they are sometimes faced with "tough situations." One hacker essentially called Khare a script kiddie and accused him of casting aspersions on "a cerebral activity."-http://www.wired.com/news/politics/0,1283,45569,00.html
26 & 27 July 2001 Privacy Groups File Complaint with FTC Over Windows XP
A consortium of privacy groups has filed a complaint with the Federal Trade Commission (FTC) asking that the planned October release of the Windows XP operating system be postponed because of security and privacy concerns. Among the issues raised is that of the enormous database of consumer information Microsoft will store on central servers; such a trove of personal data would be irresistible to crackers.-http://www.zdnet.com/zdnn/stories/news/0,4586,5094763,00.html?chkpt=zdnnp1tp02
-http://www.computerworld.com/storyba/0,4125,NAV47_STO62559,00.html
-http://www.msnbc.com/news/605166.asp?0dm=L18NT
The text of the complaint is available as a .pdf file. (20 pages)
-http://www.epic.org/privacy/consumer/MS_complaint.pdf
The Register observes that the real issue here is .NET, not the new operating system.
-http://www.theregister.co.uk/content/4/20680.html
[Editor's (Schultz) Note: Given all the security-related incidents that have been reported at Microsoft, this concern appears to be well-justified. ]
26 July 2001 Teen Publishes "Ethical" Hacker Manual
An Indian teenager has written a book titled "The Unofficial Guide to Ethical Hacking," which includes information about a variety of hacker tools as well as advice on writing and dealing with viruses.-http://dailynews.yahoo.com/h/nm/20010726/tc/tech_india_hacking_dc_1.html
[Editor's (Ranum) Note: "Writing viruses" and "ethical" anything do not mix. ]
26 July 2001 Google Removes Links to Threatening Pages
Google has removed pages from its website that allowed people to search for and exploit e-commerce sites running DCShop, a shopping cart software system in beta production with a known vulnerability.-http://it.mycareer.com.au/breaking/2001/07/26/FFXB87FPLPC.html
26 July 2001 NIPC Not Living Up to Potential, Says GAO Report
Hindered by staff shortages and companies unwilling to share security incident information, the FBI's National Infrastructure Protection Center (NIPC) has not fulfilled its potential, according to a General Accounting Office (GAO) report. The center has been helpful with computer crime investigations.-http://www.cnn.com/2001/TECH/internet/07/26/crime.reut/index.html
[Editor's (Murray) Note: One cannot put investigation for purposes of prosecution in the same mission as the collection and dissemination of intelligence, and expect a good result. If the mission is placed inside a police agency, it is predictable in advance which task will suffer. ]
25 July 2001 The Worm That Wouldn't Leave
A forehead-slapping anecdote about a state agency's recurring Outlook e-mail worm infection.-http://www.computerworld.com/cwi/stories/0,1199,NAV47_STO62531,00.html
25 July 2001 Hacker Documentary
Hackers: Computer Outlaws, a documentary that premiered on The Learning Channel (TLC) last week, presents hackers as misunderstood people who are largely responsible for the ubiquitous state of technology today. The film profiles John Draper, Steve Wozniak, and Kevin Mitnick.-http://www.wired.com/news/culture/0,1284,45515,00.html
[Editors' (multiple) Note: It's difficult to understand the motivation for a recruiting video that increase the number of outlaws. ]
23 July 2001 Financial Institutions Need Stronger Information Safeguards
Some major financial institutions are not using passwords or codes to ensure customer account security; instead, they are relying on the old standbys of such readily available information as Social Security numbers (SSNs) and mothers' maiden names as identifiers. As a result, the banks can easily fall prey to social engineering ploys and release sensitive data to identity thieves.-http://www.washingtonpost.com/wp-dyn/articles/A27475-2001Jul20.html
23 & 24 July 2001 Adobe Recommends Russian's Release
After a meeting with Electronic Frontier Foundation (EFF) board members, Adobe's general counsel offered the following statement: "[T ]
he prosecution of
[Dmitry Sklyarov ]
is not conducive to the best interests of any of the parties involved or the industry." Sklyarov authored a program, legal in his home country of Russia, that breaks the copy protection on Adobe's eBook; he was arrested after a presentation at a security meeting. Demonstrators calling for Sklyarov's release have turned to federal targets as his fate now rests in the hands of the U.S. Attorney's Office.
-http://www.msnbc.com/news/604420.asp?0dm=T23AT
-http://news.cnet.com/news/0-1003-200-6651535.html?tag=prntfr
-http://www.wired.com/news/politics/0,1283,45484,00.html
23 & 24 July 2001 Trojan Steals Big Pond Users' Data
Telstra Big Pond customers were advised to change their passwords after the account details of 69 customers were posted on a website. Rejecting allegations that the system was hacked, a Telstra spokesman said a SubSevenTrojan on the systems of affected clients mined the data which a cracker then posted on the Internet. (The second article also contains brief stories on the CERT warning to home users, the Code Red worm, and the SSH Secure Shell vulnerability.)-http://www.smh.com.au/news/0107/23/national/national14.html
-http://it.mycareer.com.au/opinion/networkpawn/2001/07/24/FFXAL7U4HPC.html
23 & 24 July 2001 SSH Remote Access Software Flaw
A password authentication vulnerability in SSH Secure Shell 3.0.0 could permit unauthorized people to gain control of servers running a variety of Linux versions, including Red Hat, SuSE, and Debian.-http://news.cnet.com/news/0-1003-200-6649868.html?tag=prntfr
-http://www.infoworld.com/articles/hn/xml/01/07/24/010724hnssh.xml
[Editor's (Murray) Note: Not all flaws are vulnerabilities, not all vulnerabilities are problems, not all problems are material. This vulnerability is a problem only in combination with practice so bad that one can hardly visualize it in the context of SSH. The occurrence of the problem is likely to be so sparse that an attacker is as likely to be struck by lightening and bitten by a snake before he finds an instance of it to exploit. ]
23 July 2001 Yahoo Server IP Change Keeps Messages From Reaching AOL Members
An AOL filtering system designed to protect members from unsolicited e- mail actually kept legitimate Yahoo Groups messages from getting through for several days. Yahoo has changed some server IP addresses as part of routine maintenance and had not informed AOL of the shift.-http://news.cnet.com/news/0-1005-200-6651241.html?tag=prntfr
[Editor's (Murray) Note: Not only is security a difficult problem, it is also thankless. Yahoo and AOL are the villains for misconfiguring a control that would not even have to exist were it not for the spammers and those ISPs that host, not to say support, them. ]
==end==
Please feel free to share this with interested parties via email (not
on bulletin boards). For a free subscription, (and for free posters)
e-mail sans@sans.org with the subject: Subscribe NewsBites
Editorial Team:
Kathy Bradford, Roland Grefer, Bill Murray, Stephen Northcutt,
Alan Paller, Marcus Ranum, Howard Schmidt, Eugene Schultz
