30. 9. 2003 - Glossary of watermarking online
Those interested in watermarking may find useful online glossary of watermarking terms placed at www.sarnoff.com/products_services/video_vision/digital_watermarking/glossary/index.asp.
25. 9. 2003 - Dominance of Microsoft products poses a risk to security
Seven prominent security professionals authored report "CyberInsecurity: The cost of monopoly". Its Executive Summary states among others "Most of the world’s computers run Microsoft’s operating systems, thus most of the world’s computers are vulnerable to the same viruses and worms at the same time. The only way to stop this is to avoid monoculture in computer operating systems ...". The report is available at www.ccianet.org/papers/cyberinsecurity.pdf.
22. 9. 2003 - Internet security threat display
Those interested in "real-time" display of Internet security threats can make use of the page where different sources are shown together so that one can correlate their outputs. The page refreshes every 15 minutes providing a near live display. See www.securitywizardry.com/radar.htm .
9. 9. 2003 - Cryptanalysis of GSM encrypted communications
Three Israeli researchers got press after publishing their paper describing practical cryptanalysis of GSM encrypted communications. Attacks described there allow attackers to tap conversations and decrypt them either in real-time, or at any later time. The paper "Instant Ciphertext-Only Cryptanalysis of GSM Encrypted Communications," by Elad Barkan, Eli Biham, and Nathan Keller is available e.g. at cryptome.org/gsm-crack-bbk.pdf.
25. 8. 2003 - Technology and organized crime in Canada
Criminal Intelligence Service Canada made available its "2003 Annual Report on Organized Crime in Canada". For its Technology and crime part see www.cisc.gc.ca/AnnualReport2003/Cisc2003/technology2003.html.
14. 8. 2003 - New issue of Phrack
Phrack Magazine Vol 11 Number 61, Build 2, Aug 13, 2003 is available at www.phrack.org.
12. 8. 2003 - Identity Theft: Do you know the signs?
The British "Fraud Advisory Panel" made available its report "Identity Theft: Do you know the signs?". For this interesting document see www.fraudadvisorypanel.org/pdf/Identity%20Theft%20Final%20Proof%2011-7-03.pdf.
6. 8. 2003 - Top Ten vulnerabilities - real time
Security firm Qualys has started producing a real-time top ten ranking of the software vulnerabilities that are currently being exploited most frequently by hackers. The new index is based on information from thousands of networks operated by the company's customers. See www.qualys.com/threats.
2. 8. 2003 - Black Hat USA 2003 presentations available
Presentations from the well known Black Hat conference 2003 USA are already available. See www.blackhat.com/html/bh-multimedia-archives/bh-multimedia-03-04.html.
25. 7. 2003 - Risk management principles for electronic banking
The Basel Committee on Banking Supervision published a report examining security and risk management practices for growing electronic banking operations. See www.bis.org/publ/bcbs98.pdf.
17. 7. 2003 - Checklist for ISO 17799 audit
The System Administration, Networking, and Security (SANS) Institute's SCORE Project made available version 1.1 of its ISO 17799 Checklist appropriate (in conjuction with ISO 17799 standard) to review and evaluate IT security of the organization. For information of this SCORE project as well as links to the document see www.sans.org/score/ISO_17799checklist.php.
7. 7. 2003 - New website on wireless networking security and wardriving
New website focused on wireless networking security and wardriving issues has been announced. Papers, articles, tools, links, etc., all related to wireless security and wardriving should be there. See www.wardrive.net/.
2. 7. 2003 - Issues in testing Intrusion Detection Systems
U.S. National Institute for Standards and Technology (NIST) released its Inter-agency Report (NISTIR) 7007 "An Overview of Issues in Testing Intrusion Detection Systems". To view or download the document one needs to visit csrc.nist.gov/publications/nistir/.
27. 6. 2003 - Online vulnerability scanner
The Secunia company now offers its free service - Vulnerability Scanner that scans IP-addresses for open ports, and tries to determine what software and which software versions are running and are implemented. Furthermore it will try to advise on the current security issues. The result is a full scan report which can be downloaded from a secure web-interface only from the same IP-address from which the scan was was requested. See testzone.secunia.com/online_vulnerability_scanner/.
25. 6. 2003 - Venona Project Homepage
VENONA was the codename used for the U.S. Signals Intelligence effort to collect and decrypt the text of Soviet KGB and GRU messages from the 1940's. National Security Agency now offers these documents on its homepage to provide a window into Soviet espionage during the 1940's, but also to give a glimpse of the important contributions made by signals intelligence and cryptographic expertise. See www.nsa.gov/docs/venona/.
19. 6. 2003 - Microsoft's "Improving Web Application Security: Threats and Countermeasures"
Microsoft has announced the release of "Improving Web Application Security: Threats and Countermeasures" - a guide on how to build hack-resilient applications. The guide is divided into five parts
Part I, Introduction to Threats and Countermeasures
Part II, Designing Secure Web Applications
Part III, Building Secure Web Applications
Part IV, Securing Your Network, Host and Application
Part V: Assessing Your Security
Finally, there are two extra sections, Checklists and and How-to Articles:
Checklist: Architecture and Design Review
Checklist: Security Review for Managed Code
Checklist: Securing ASP.NET
Checklist: Securing Enterprise Services
Checklist: Securing Web Services
Checklist: Securing Remoting
Checklist: Securing Data Access
Checklist: Securing Your Network
Checklist: Securing Your Web Server
Checklist: Securing Your Database Server
How To: Implement Patch Management
How To: Harden the TCP/IP Stack
How To: Secure Your Developer Workstation
How To: Use IPSec for Filtering Ports and Authentication
How To: Use IISLockdown.exe
How To: Use the Microsoft Baseline Security Analyzer
How To: Use URLScan
How To: Create a Custom Encryption Permission
How To: Use Code Access Security Policy to Constrain an Assembly
This 900+ page PDF/e-book guide is available at: msdn.microsoft.com/library/en-us/dnnetsec/html/ThreatCounter.asp.
9. 6. 2003 - EU ministers approved plans for European Network and Information Security Agency
The EU's telecommunications ministers endorsed in principle plans to create the European Network and Information Security Agency. The new body would function as an advisory body on how to combat hacking, virus attacks and threats to information networks, and it would also formulate pan-EU guidelines. Changes in relation to the Commission's initial proposal include limitation of the Agency's activities to an advisory role, modification of the composition of the Management Board and extension of the Management Board's functions and its involvement in the day-to-day operation of the Agency. See www.euractiv.com/cgi-bin/cgint.exe/1?204&OIDN=1505652.
6. 6. 2003 - Draft version of guidelines on security vulnerability disclosure best practices.
Organization for Internet Safety (OIS), released a draft version of guidelines on security vulnerability disclosure best practices. The OIS is soliciting comments on the draft until July 4, 2003. A final version of the bug disclosure standards are expected for release at the end of July. See www.oisafety.org/.
30. 5. 2003 - Algorithmic complexity attack
Scott A. Crosby and Dan S. Wallach have described a new class of attack named 'Algorithmic Complexity Attacks'. This new class of denial of service attacks work by exploiting the difference between average case performance and worst-case performance. In short, the data structures used by an application may be forced to experience their worst case performance. For instance, hash tables are usually thought of as being constant time operations, but with large numbers of collisions will degrade to a linked list and may lead to a 100-10,000 times performance degradation. Because of the widespread use of hash tables, the potential for attack is extremely widespread. Confirmed vulnerable applications include Perl, the Linux kernel, the Bro IDS, and the Squid HTTP proxy cache. Although unconfirmed, vulnerablities appear to be in the GLIB utility library, DJBDNS cache, TCL, Python, and Mozilla.
Research paper and small demonstration files for several applications are available at www.cs.rice.edu/~scrosby/hash/.
22. 5. 2003 - Techniques to reduce a Win2K system's vulnerability to DoS attacks
Microsoft has documented five TCP registry modifications one can implement to reduce a Windows 2000 system's vulnerability to Denial of Service (DoS) attacks and other common exploits. These techniques are suitable for Win2K systems connected to a WAN or the Internet and for sites operating under strict security controls. See www.secadministrator.com/articles/index.cfm?articleid=25027.
19. 5. 2003 - Draft standard for security categorization
The National Institute of Standards and Technology's Computer Security Division released draft of a new Federal Information Processing Standard, FIPS 199, which dictates how agencies should categorize their systems based on the security risk faced by each. See csrc.nist.gov/publications/drafts/FIPS-PUB-199-ipd.pdf.
13. 5. 2003 - Open source computer forensics manual project
A new project aimed to prepare open-source computer forensics manual started ... See sourceforge.net/projects/oscfmanual/ for the project's main page.
7. 5. 2003 - Free forensic analysis e-book
Jason Coombs
29. 4. 2003 - Windows 2000 security hardening guide available
Microsoft's activities in the security area continued by releasing "Windows 2000 Security Hardening Guide" - guidance, tools, and templates to effectively secure Windows 2000 in a variety of enterprise environments. It documents how a number of security settings can be configured based on specific requirements and scenarios, as well as new settings which are available in Windows 2000 Service Pack 3. See www.microsoft.com/technet/security/prodtech/windows/win2khg.asp.
26. 4. 2003 - Windows Server 2003 security guides
Microsoft announced the release of the "Windows Server 2003 Security Guide". It is intended to provide guidance, tools, and templates to effectively secure Windows Server 2003 in a variety of enterprise environments. The guide can be found online at go.microsoft.com/fwlink/?LinkId=3D14845. In the same time Microsoft released companion guide, "Threats and Countermeasures: Security Settings in Windows Server 2003 and Windows XP", a reference to many of the security settings available in the current versions of Windows operating systems. See go.microsoft.com/fwlink/?LinkId=3D15159.
12. 4. 2003 - Disaster recovery guidelines for financial institutions
Three U.S. regulatory agencies (The Federal Reserve, the Office of the Comptroller of the Currency and the Securities and Exchange Commission) have released an interagency paper describing objectives for disaster recovery and business continuity plans that should be set in place. See www.sec.gov/news/studies/34-47638.htm.
7. 4. 2003 - Security reports - Top 10 vulnerabilities, Top 10 open ports
Inprotect.com made available top 10 vulnerabilities and top 10 open TCP ports reports based on the results of the free security scans performed from it's site since October 2002. Top 10 vulnerabilities and open TCP ports reports are also available for the period of the last 30 days, which may show statistics on newly discovered vulnerabilities. See www.inprotect.com.
25. 3. 2003 - New vulnerability mailing list
Danish security company Secunia Ltd. launched its own vulnerability mailing list out of protest against the way security organizations like SecurityFocus and the CERT Coordination Center distribute vulnerability information. See www.secunia.com.
19. 3. 2003 - Czech attack on SSL/TLS
Czech cryptologists Vlastimil Klima, Ondrej Pokorny, and Tomas Rosa have come up with an extension of the "Bleichenbacher attack" on RSA with PKCS #1 v1.5 padding as used in SSL 3.0 and TLS 1.0. Their attack requires the attacker to open millions of SSL/TLS connections to the server under attack; the server's behaviour when faced with specially made-up RSA ciphertexts can reveal information that in effect allows the attacker to perform a single RSA private key operation on a ciphertext of its choice using the server's RSA key. However, the server's RSA key is not compromised in this attack. OpenSSL Project already provided appropriate patch. For the original Klima-Pokorny-Rosa paper see eprint.iacr.org/2003/052/.
18. 3. 2003 - Best security practices
A telecom industry advisory committee "Network Reliability and Interoperability Council" (NRIC) has completed a set of best practices to ensure the security and availability of US communications infrastructure. Approved practices will be available on the NRIC web site www.nric.org.
14. 3. 2003 - Timing attack against OpenSSL
Timing attacks are usually used to attack weak computing devices such as smartcards. D.Brumley and D.Boneh successfully developed and mounted timing attacks against software crypto libraries running on general purpose PC's. According to them OpenSSL and some derived crypto libraries are vulnerable to this attack, while others are not. For their paper see crypto.stanford.edu/~dabo/abstracts/ssl-timing.html.
13. 3. 2003 - Some chapters of security related books available online
Chapter 12 from the upcoming book "Special Ops: Host and Network Security for Microsoft, UNIX, and Oracle" titled "Attacking and Defending the Microsoft SQL Server" has been made available on www.specialopssecurity.com. Also, three chapters of yet another book "Secure Messaging with Microsoft Exchange Server 2000" were released at www.e2ksecurity.com.
Continue...
