Chris Mosby at myITforum.com

I got an e-mail last night from one of the victims of the Katrina disaster that just really got to me.  I have replied so I could find out where he is at and see what I find out for him.  In the meantime if anyone knows any information that might be of help, please contact me.

Here is the e-mail, with the name removed.

How about some info on temporary housing. Such as where do I go to apply. Please don't say FEMA as I registered a month ago and still haven't heard from them for an appointment. MSEMA gives me a number that no one answers. I keep getting the runaround from every agency I call, if I am lucky enough to get thru. No One seems to know anything about anything except to pass the buck. As long as they don't have to answer with any kind of intelligent information. You seem to have access to more info than the Feds or the State. So, some info on how and where to go about housing would sure be appreciated.

I am aware that all the agencies are very busy, but surely someone must know something.

 

 

Thanks

[name removed]

I can only guess how this obviously and justifiably frustated person ended up on my blog looking for information. Maybe Google searches zeroed in on all the news info I was posting when the destruction was first coming to light.  This is a very sad thing, and the government has seemed to really fail to help the people that really need it.

Hey, it wasn’t me, I don’t drive Fords.

Monitor Duty: Has Anyone Checked On The Joker's Whereabouts?

September 29, 2005
Has Anyone Checked On The Joker's Whereabouts?

Last week during a trip thru Ohio NASCAR Nextel Cup driver Mark Martin's #6 Batman Begins Ford show car was stolen. The show car (worth around $250,000), along with the truck and trailer it was being transported in, was stolen from a hotel parking lot. The police have no leads.

Now this is a sad state of affairs..

ZDNet: India benefits as half the Valley outsources

By Dawn Kawamoto

More than half of Silicon Valley companies are outsourcing, and roughly half of those outsourced jobs are going to India, according to a survey released Thursday by Santa Clara University.

More than 53 percent of Silicon Valley companies surveyed this month reported that they outsource a portion, or all, of their operations, according to the survey. And India is benefiting.

"India has an educated work force, and its people speak English, so it makes it an attractive place for outsourcing," said Mario Belotti, an economics professor at the university's Leavey School of Business.

IT leaders in India, however, remain watchful of other nations that may take their lead away. China, Russia and the Philippines are regions that also receive their fair share of outsourcing.

China, for example, captured 8 percent of the outsourced jobs, and other Asian nations nabbed 11 percent, according to the survey.

While outsourcing remains a large component of how businesses operate in Silicon Valley, a couple sectors have been scaling back on their use. Manufacturing has seen a notable decline, Belotti said.

In August, 39 percent of companies surveyed reported that they outsourced their manufacturing operations during the past three months. That was down from 48 percent two years earlier.

"Much of this drop was in the semiconductor and electronics area," Belotti said.

He noted that the pullback may stem from more Silicon Valley companies hiring locally for manufacturing jobs, especially in the computing and electronics areas. In August, the region posted a 7 percent year-over-year increase in computing and electronics manufacturing jobs.

Hacker hits University of Georgia employee records server - Computerworld

As many as 1,600 Social Security numbers may have been exposed

News Story by Todd R. Weiss

SEPTEMBER 29, 2005 (COMPUTERWORLD) - About 1,600 current and former employees of the University of Georgia are being notified that their Social Security numbers, stored on a campus server, may have been seen by a hacker operating from a foreign country.

In an announcement yesterday, the Athens-based school said the security breach was discovered Sept. 19 by university IT staffers and that the intrusion was stopped. No credit card information was accessed during the incident, the university said.

The affected records belong to current and former employees of the university's College of Agricultural and Environmental Sciences. Some 2,429 Social Security numbers may have been exposed during the breach, but because about 800 of those are duplicate records, the actual number of affected individuals is about 1,600.

All potential victims are being notified of the breach by e-mail or postal mail and are being advised of an ongoing investigation by the Georgia Bureau of Investigation and by the FBI, said Tom Jackson, a university spokesman.

So far, there have been no reports of identity theft or any other illegal use of the information, Jackson said.

"While there is no evidence that information was actually accessed, the potential exists for the intruder to match names and Social Security numbers," said Stan Gatewood, the university's chief information security officer. "So it is imperative that we notify the individuals involved, so that they may take appropriate steps to protect against identity theft."

The university also faced a hacker incident in January 2004, Jackson said, when some 32,000 credit card numbers were exposed after a hacker broke into student application files (see "University of Georgia computer systems hacked"). No perpetrator was ever identified and no reports have ever been received of anyone using the stolen credit card numbers, he said.

Two weeks ago, a laptop computer that had been stolen in March from the University of California, Berkeley, was recovered after investigators discovered it had been bought over the Internet by a man in South Carolina (see "Laptop with personal data of 98,000 people recovered").

Interesting idea to test security…

Microsoft gets hacker feedback on IE Version 7 Beta 2 - Computerworld

It sought advice at the Hack in the Box Security Conference

News Story by Dan Nystedt

SEPTEMBER 29, 2005 (IDG NEWS SERVICE) - Microsoft Corp. showed off the preliminary work it has done on the second beta version of its popular Internet Explorer Version 7 at the Hack in the Box Security Conference in Kuala Lumpur, Malaysia, and came away with good feedback, company officials said today.

"It's the first time we've ever come out ahead of a product release to present and get feedback," said Tony Chor, group program manager for Microsoft's Internet Explorer team, referring to the company's presentation to a hacker-specific group.

Chor and colleague Andrew Cushman, director of Microsoft's security engineering and communications group, spoke highly of the feedback they heard at the presentation and preferred to use the term security research community instead of hackers when referring to attendees.

"Hacker has a negative connotation, like a criminal," said Cushman. People such as attendees of the Hack in the Box conference approach security from a very different, very valuable perspective, he said. "This community is a good source of information, and we haven't availed ourselves of that source," Cushman added.

Chor went a step further, saying Microsoft has maintained an "adversarial" relationship with the hacking community in the past, but "that wasn't working. It just made them mad, and we didn't benefit from their passion and expertise."

The company is working to engage the "security research community" in the future by making presentations at more hacker conventions and giving attendees a chance to critique some of Microsoft's work ahead of releases.

Chor and Cushman handed out business cards liberally, and they said they hope to get more e-mail responses from people as well as notes on their blog. "People had a lot of good suggestions and asked a lot of good questions," said Chor.

Some hackers at the show gave Microsoft high marks for showing off some new security features on the Web browser and seeking their views. They added that they would have liked to hear more technical details on new features in the browser. But their impression was that the presenters appeared almost apologetic, and they said that they don't plan to switch to any Microsoft products in the near term at the expense of, say, Mozilla Corp.'s Firefox browser.

Chor said he plans to increase the amount of technical details in future presentations.

The Beta 2 version of IE Version 7, currently under construction at Microsoft, will likely be ready by the end of the year, said Chor.

One new feature in the Web browser is that it runs in higher security "protected mode" by default, set at a lower user privilege. In protected mode, all downloads and other packages are automatically dropped in the "temporary Internet files" folder, so malware can't be deposited on the hard disk. In the temporary folder, IE and Windows treat the files as dangerous, and they're given no privileges to move about.

With add-ons like a Google Inc. toolbar or ActiveX, IE Version 7 Beta 2 will offer more permission prompts, since downloads such as ActiveX opt-ins can be an avenue for attack, Chor said. Microsoft also plans to license its "protected mode" innovation to other developers for free to help spread its use, said Chor.

For businesses, Microsoft added a "compatibility mode" that works when a person is using a company's intranet. It allows them to drop files wherever they want to on their PCs.

Interesting post…

Welcome to the Microsoft Security Response Center Blog! : A Day in the Life of a Security Bulletin

A Day in the Life of a Security Bulletin

Hi all- Alexandra Huft here again! I thought you might find it interesting to see “behind the scenes” of how a security vulnerability eventually becomes a security bulletin.

So, I’ll start way back at the beginning. We receive reports from many different finders on issues that may or may not be a vulnerability. The first thing that we do is work to determine that we are able to duplicate what the finder has reported. Sometimes this is very simple, other times we need to go back to the finder for additional information, but whenever possible we try and recreate what they've discovered with our own research. We work with the affected product teams and our own experts on the Secure Windows Initiative team (SWI) to reproduce these reports. We also try to keep the finder updated with as much information as we can provide, so that they are aware of where we are in the process. We then work on determining the severity, which is not always the easiest thing. Like you, we all have our opinions, which lead to many a heated discussion in the MSRC Situation Room where we meet several times a week. We all want the best decision for all of our customers.

Okay, so fast forward a bit….after we have determined that it is a vulnerability, we then work with the product groups to build the security update. Here is where it can get tricky. Let’s say you have two product groups that need to work together on a particular update because both products have the vulnerable component. Because each group may run different testing, the possibility for one group to be ready to ship before the other is increased. We also work with other groups on extensive testing of the update to test things like application compatibility. So, what do you do? Ship one update for one product groups’ component, but not the other? Wait? What if the issue is ‘critical’ in severity? What if we find an issue in the last stages of testing that could impact customer's applications negatively? You would think that this would be an easy decision and before I came to the MSRC I would have sworn that this would be a no brainer. Well I was wrong! As with all of our security vulnerability reports, each security update gets looked over in depth and we find that it may not be in our customer’s best interest to provide one update before the other. If we did provide one update before the other, then that may leave the component that we do not have an update for vulnerable, making our customer more at risk because the information is now public.

There is a lot of thought that goes into the security updates, and at times it may appear that we have forgotten or are just taking our time to get them out. However, like you, what we want is what is best for our customers, to be as secure as possible. As we continue to say we always appreciate feedback. If you think you may have a great idea, please share it with us. Having been in the field, like most, I know what it is like to have to deal with security issues in “real time”.

Have a fabulous rest of the week. Thanks for all you do. I appreciate it!



~Alexandra

Donna's SecurityFlash - ZoneAlarm Pro DDE-IPC Advanced Program Control ByPass Weakness

Posted on Thursday, September 29, 2005 6:51 PM

ZoneAlarm Pro is prone to a weakness that permits the bypassing of the Advanced Program Control feature settings. An attacker can exploit this weakness to bypass restrictive settings and transmit data to external sources through the use of permitted applications.

Solution: Reports indicate that this issue has been addressed in the latest release of Zone Labs Security Suite; this has not been confirmed by Symantec.

http://www.securityfocus.com/bid/14966/discuss
PoC in http://hackingspirits.com/vuln-rnd/vuln-rnd.htm

GAO says IT systems for air traffic vulnerable - Computerworld

Agency cites improvements but still finds gaps in security

News Story by Reuters

SEPTEMBER 27, 2005 (REUTERS) - WASHINGTON -- High-tech networks that link key parts of the U.S. air traffic control system lack important controls and may be vulnerable to hackers and others familiar with how those computer programs work, congressional investigators concluded yesterday.

The Government Accountability Office said in an update (download PDF) to a 2000 report that the Federal Aviation Administration has made progress in protecting its IT systems and noted the agency's contention that its interconnected networks are secure.

Greg Martin, an FAA spokesman, said separately that the investigation was too narrowly focused and that the agency has adequate controls in place nationwide.

"They are very secure systems," Martin said. "There is a lot that the [report] failed to take into account."

Martin said any vulnerabilities are countered by several redundancies and other controls built throughout the IT architecture.

But the GAO, the investigative arm of Congress, nevertheless disclosed a series of gaps that include outdated security plans, inadequate awareness training and questions about whether the FAA could detect intruders and keep the system up during a security breach.

"The agency has not adequately managed its networks, software updates, user accounts and passwords and user privileges," the GAO found.

Other information security controls -- including physical security and background investigations -- also have shortcomings that are not mitigated by special operating systems and custom software.

"The proprietary features of these systems cannot fully protect them from attacks by disgruntled current or former employees who are familiar with these features, nor will they keep out more sophisticated hackers," the GAO said.

These networks help provide flight tracking and other information to air traffic controllers and flight crews. They serve hundreds of airport towers, approach control centers and facilities for handling high-altitude traffic.

"Interruptions of service by these systems could have a significant impact on air traffic nationwide," the GAO concluded.

The nation's air traffic system handled more than 46 million flights in 2004. More than 640 million passengers flew on commercial planes. At any one time, as many as 7,000 aircraft could be in the air.

The GAO review was conducted at FAA headquarters and three other sites.

F-Secure integrates antispyware into new releases | InfoWorld | News | 2005-09-28 | By Jeremy Kirk, IDG News Service

F-Secure integrates antispyware into new releases
Software can also manage children's Internet use

By Jeremy Kirk, IDG News Service
September 28, 2005

F-Secure (Profile, Products, Articles) announced Tuesday the launch of F-Secure Internet Security 2006, consumer-oriented software that can also manage Internet use by children.

The company also released F-Secure Anti-virus 2006. Both products have real-time integrated antispyware, which the company said are the first antivirus products able to detect spyware before it is installed.

The products use F-Secure's BackLight technology that takes aim at rootkits, or malware that remains hidden in computers and is undetected by current security products, according to the company. Daily automatic updates are delivered over the Internet.

The Internet Security software uses an antispam feature that employes a database of verified spam IP addresses and spam gangs, a feature F-Secure said wards off common phishing techniques. An antidialer ensures against unexpected phone bills caused by hackers.

A child-lock feature allows parents to screen out questionable Web sites and set time limits on how long children can be on the Internet.

A one-year subscription to Internet Security 2006 is offered for $78 and Anti-Virus 2006 for $64 on F-Secure's Web site. Both prices exclude value added tax.

Washington Technology - Purdy: DHS will ramp up cybersecurity

Purdy: DHS will ramp up cybersecurity

By Alice Lipowicz
Staff Writer

The Homeland Security Department has drafted a set of key scenarios for possible cyberattacks against the Internet and critical IT systems, and is seeking comments from the private sector on how to best prepare and respond to such attacks, according to Andy Purdy, acting director of DHS’ National Cybersecurity Division.

DHS officials and the White House also are putting the finishing touches on a new national cybersecurity research and development plan, Purdy said earlier this week at a seminar on Capitol Hill. The event was sponsored by Nortel Networks Corp., a global telecommunications equipment manufacturer based in Brampton, Ontario.

“At DHS we recognize the importance of cybersecurity risks and we are energized by that risk,” Purdy said.

Homeland Security Secretary Michael Chertoff also is preparing to name an assistant secretary for cybersecurity and telecommunications, he said.

Purdy outlined several initiatives undertaken by his division to bolster cybersecurity and to prepare for a national cyberattack exercise known as Cyber Storm in November.

As part of their planning for disaster recovery for IT systems, DHS officials are looking at key dependency elements, such as maintaining adequate electrical power supplies, as critical parts of the recovery, Purdy said.

The department is working with advisers to prepare plans for maintaining Internet operation following a catastrophe, and also focusing on Internet-based control and process systems, which are IT systems that control the daily operations and interrelations of many plants and utilities.

“Control and process systems are one of our major priority efforts—it’s a huge challenge and a significant cybersecurity risk,” Purdy added.

DHS also is meeting with software industry groups to promote shared responsibility for cybersecurity. “It’s not just the responsibility of end users. The hardware and software makers need to do a better job to reduce vulnerabilities so we can all be safer,” he said. For example, the industry needs to develop tools to make sure that software does not include secret back doors and malicious code, he said.

Also at the event, Nortel CEO Bill Owens warned that a catastrophic cyberattack against the Internet could create a “virtual [Hurricane] Katrina” that would reverberate throughout the U.S. economy.

Owens said the growing threat over the next two or three years is coming from new viruses that may attack wireless devices and mobile phones, which can then infect broadband networks, government computers and mission-critical IT systems. He said China, India and South Korea take the risks more seriously than does the United States.

“I am frightened as hell about this issue of cybersecurity because we see it in spades around the world,” Owens said.

Donna's SecurityFlash - Vulnerability found in several antivirus & antispyware program

SANS - Internet Storm Center - Cooperative Cyber Threat Monitor And Alert System - Current Infosec News and Analysis

Potential New AOL Chait Virus (NEW)
Published: 2005-09-28,
Last Updated: 2005-09-28 16:26:38 UTC by Chris Carboni (Version: 2(click to highlight changes))
We have a report that a new virus may be making the rounds being distributed via AOL chat.

Details are sketchy so far but we have the following thanks to Alan and Chris.

McAfee deletes the viruses but every time the user logs of and back onto the system it regenerates the batch file.

User gets a chat via AOL

"Checkout this JPEG" with a link

After clicking the link it sends to everyone on their buddy list and creates the file

C:\xz.bat

Contents of the file: it is set to disable MS security, firewall

Creates 3 registry entries one of which is a service

Hkey_local_machine\Software\Microsoft\Windows\Current Version\Run

Name :Strtax Data: lock.exe (Delete)

Hkey_local_machine\Software\Microsoft\Windows\Current Version\Run Services

Name :Strtax Data: lock.exe (Delete)

Hkey_User\Software\Microsoft\Windows\Current Version\Run Services

Name :Strtax Data: lock.exe (Delete)

After deleting those three keys and a reboot the xz.bat file stopped trying to reload itself.

If you have a copy of xz.bat or lock.exe please submit it by using the contact form at http://isc.sans.org/contact.php

More about the IE hole that I posted about yesterday, and is also similar to a vulnerability that is fixed in Firefox 1.07 

The Secunia advisory his here: http://secunia.com/advisories/16942/ 

MS Investigates New IE Security Hole

September 27, 2005
By Ryan Naraine

Users of Microsoft's flagship Internet Explorer browser are sitting ducks for security bypass attacks, according to a warning from a private researcher.

A spokesperson for the software giant acknowledged the MSRC (Microsoft Security Response Center) is investigating public reports of the flaw, which has been rated "moderately critical" by Secunia Inc.

"We are not aware of attacks that try to use the reported vulnerabilities or of customer impact at this time," the spokesperson said in a statement released to Ziff Davis Internet News.

Even as Microsoft Corp. is describing the issue as a "possible vulnerability" that "may impact" Internet Explorer, the researcher who discovered the bug has posted a detailed explanation of the risks involved.

In an advisory posted to cgisecurity.net, researcher Amit Klein warned that the bug can be exploited by malicious people to manipulate certain data and conduct HTTP request smuggling attacks.

The flaw was identified in IE's implementation of XmlHttpRequest, the Javascript object that allows a client-side Javascript code to send almost raw HTTP requests to the origin host and to access the response's body in raw form.

Klein discovered that input passed to the method parameter in the "open()" function in the "Microsoft.XMLHTTP" ActiveX control isn't properly sanitized before being used in a HTTP request.

This error can be exploited to inject arbitrary HTTP requests via specially crafted input containing tab and newline characters.

Successful exploitation requires that the HTTP request be sent to a server or via a proxy allowing tab characters instead of spaces in certain parts of the HTTP request.

A successful attacker could launch security bypass, data manipulation and information disclosure attacks.

Security alerts aggregator Secunia rates the issue as "moderately critical" and confirmed the vulnerability exists on a fully patched system with Internet Explorer 6.0 and Microsoft Windows XP SP2 (Service Pack 2).

Secunia recommended that IE users set the browser's security level to "High" as a temporary precaution.  Blogger’s Note: Our you could just drop that browser and … well you know

Now this is interesting…

Digital plague hits online game World of Warcraft
Robert Lemos, SecurityFocus 2005-09-27

A digital virus spread by terrorists left bodies on the streets and cities quarantined by the government.

“ Not only does it present an in-game dynamic that was not expected by players or Blizzard developers, it reminds us that even in seemingly controlled online atmospheres unexpected consequences can occur. While not as serious as a classic computer virus, it reminds us that computer code can impact us and we're not always safe, regardless of what precautions we take. ”

Brian Martin, independent security consultant and World of Warcraft player

Fortunately, the epidemic was not real, but the aftermath of an inadvertent digital plague caused by a simple change to the massively multiplayer online roleplaying game, World of Warcraft.

The change? Giving a monster the ability to curse in-game avatars with a self-propagating, albeit temporary, disease. While the developers only intended the disease to affect the group of characters fighting the monster, the infectious malady quickly became a tool in the hands of malicious players known as griefers, who found ways to bring the digital virus into heavily inhabited areas of the world.

For a week, the efforts of malicious players left behind massive casualties, made cities nearly uninhabitable, and became a reminder of the uncontrollability of self-propagating code.

"There are three things you can do: infect people, die, and watch other people do the first two," said one person posting to the World of Warcraft community forum under the handle 'Modahan.' "There's no way to rush for a cure; there's no way to stop the plagued idiots from coming in, there's no quest, no change, no nothing."

Read the rest of the article here: Digital plague hits online game World of Warcraft

CounterSpy goes 1.5
 Posted on Tuesday, September 27, 2005 10:31 AM

 Sunbelt CounterSpy Version 1.5 Now Available.

Another article about the Yahoo Photo phishing story, these guys are pretty tricky.

Security Pipeline | Phishers Take Aim At Yahoo Photo Sharing

Phishers have switched tactics in their ongoing attempt to lift usernames and passwords from unsuspecting Yahoo users, a security company said, by turning to secondary sign-on pages, such as that for the Yahoo Photos image sharing service.

San Diego-based Websense said that crooks are sending out spam that claims to contains photos from a friend wanting to show off some recent pics, such as ones from a wedding or birthday. The messages include a link to a phony site, which captures the user's Yahoo ID and password, then passes the data to the real Yahoo Photos site.

Websense also reported that the majority of the spoofed sites using this trick are hosted by Yahoo's own GeoCities service, which offers 15MB of data storage and 3GB of data transfer per month at no charge.

Phishing criminals are always searching for sneakier ways to deceive Internet users. Last week, for instance, security vendor SurfControl noted that some phishers were using phony digital certificates to calm users' worries about suspicious sites.

Symantec updates consumer security lineup

By Stacy Cowley, IDG News Service, 09/26/05

Symantec released the latest version of its Norton security software on Monday, adding a new "protection center" to its Norton Internet Security 2006 applications suite.

The Norton Protection Center aggregates a variety of security information and presents it in a straightforward format intended to help consumers more easily understand what security features they need to enable. It will be included in the Norton Internet Security 2006 suite and in the company's two stand-alone products, Norton AntiVirus 2006 and Norton Personal Firewall 2006.

Dropped from the company's stand-alone list this year is Norton AntiSpam, which will now only be available in the Internet Security 2006 suite. That bundle, priced at $70, ties together Norton AntiVirus, Personal Firewall, AntiSpam, Privacy Control and Parental Control. Current Symantec customers, as well as users of competitive products, will be able to upgrade to the new Norton Internet Security suite for $50. Prices for all of Symantec's consumer security software include a one-year subscription for updates.

Purchased as a stand-alone product, Norton AntiVirus 2006 is priced at $40. The new version includes enhanced detection tools for zapping spyware and adware. Low-risk adware programs are flagged but not automatically removed, Symantec said.

Norton Personal Firewall 2006 can also be purchased on its own, for $50. The software is designed to analyze applications already installed on a user's PC and configure itself around them, a feature Symantec expects to reduce the number of alert messages customers encounter during setup.

Other new features in Norton Internet Security 2006 include a "security inspector" feature to help customers examine and fix security holes like permissive browser settings or weak Windows passwords, and new antispam functionality aimed at better identifying and blocking phishing e-mails.

Cupertino, Calif.-based Symantec is now selling its updated software though its Web site's online store. Packaged versions of the software are expected to be available for purchase at retail outlets within the next two weeks.

Sophisticated phishing targets Yahoo users | InfoWorld | News | 2005-09-26 | By Jeremy Kirk, IDG News Service

Sophisticated phishing targets Yahoo users
New method records username and password while logging users into legitimate part of Yahoo site

By Jeremy Kirk, IDG News Service
September 26, 2005

A new phishing method is targeting users of Yahoo Inc. by recording their user name and password while logging them into a legitimate area of the portal, according to Websense Inc., a Web security software firm.

Users receive an instant message or e-mail purporting to be from a friend wanting to show photos from a vacation or birthday party. The message has a link to the phishing site, which records the user's ID and password while forwarding the user to the real Yahoo Photos site.

Yahoo officials were not immediately available for comment.

"It would be difficult for the user to know they'd actually been phished," said Ross Paul, Websense product manager for Europe, the Middle East and Africa.

And it appears the phishers are close to home: The actual phishing site is hosted in free Web space provided by Yahoo Geocities service in the U.S., Websense said.

The method is unique in the fact that not only are the phishers using a fake logo to trick users, but also forwarding the person to another site, a method that has been used before but not on such a large scale, Paul said. Websense's worldwide network, which monitors Internet traffic, detected the technique.

"That leads us to believe it is fairly widespread," Paul said, adding, however, "It's difficult to quantify."

The advice for users is similar to prior warnings: Be leery of unexpected e-mails and check with the sender. Users can also always check with Yahoo to see if a specific e-mail is legitimate, Paul said.

"I think what you are seeing is criminals are getting more sophisticated in social engineering," Paul said.

Schneier on Security: Forging Low-Value Paper Certificates

Forging Low-Value Paper Certificates

Both Subway and Cold Stone Creamery have discontinued their frequent-purchaser programs because the paper documentation is too easy to forge. (The article says that forged Subway stamps are for sale on eBay.)

It used to be that the difficulty of counterfeiting paper was enough security for these sorts of low-value applications. Now that desktop publishing and printing is common, it's not. Subway is implementing a system based on magnetic stripe cards instead. Anyone care to guess how long before that's hacked?

Secunia - Advisories - Check Point Firewall CIFS Service Group Rule Bypass

 Description:
fitz has reported a security issue in Check Point Firewall, which potentially can be exploited by malicious people to bypass certain security restrictions.

The security issue is caused due to an error in the CIFS service group implementation. This may cause all traffic from a network in the CIFS service group to either pass through the firewall or be dropped at the firewall, depending on the configured rule.

The security issue has been reported in the following products:
* VPN-1/FireWall-1
* VPN-1 VSX
* Provider-1

Solution:
The vendor suggests renaming the CIFS service group.

Refer to the vendor's advisory for instructions.

As well they should…

Security Pipeline | Credit Companies Promise Tighter Security

Credit Companies Promise Tighter Security

By Gregg Keizer Courtesy of TechWeb News

The big three U.S. credit reporting firms -- Equifax, Experian, and TransUnion -- promised last week that they would come up with an encryption standard all would use to protect sensitive customer data as it's moved between information providers and themselves.

"This cooperative effort to simplify, clarify, and accelerate the use of industry-level encryption standards is necessary," said Stuart Pratt, the head of the Consumer Data Industry Association. "These standards make the implementation of encryption a single straight-forward choice for all, from the largest financial institutions to the smallest market lenders."

The three will work out a standard scheme that includes Consumer Data Industry Association (AES) and Triple Data Encryption Standard (3DES) algorithms, and a minimum of 128-bit key encryption.

Experian was hacked three years ago, when some 13,000 consumers had credit report information stolen. However, 2005's wave of disclosed data breaches -- caused by the California law that requires consumers be informed when their personal information is put at risk -- have not directly affected the three credit reporting firms. Still, the hope is that the single standard will boost encryption at data furnishers, such as credit card companies, banks, and mortgage firms, which report findings to Equifax, Esperian, and TransUnion.

Americans are guaranteed free access to their credit report yearly through the AnnualCreditReport.com site that's hosted by the three firms.

Rod and Ron must be napping, I can’t believe they let this one by..

Secunia - Advisories - Netscape Multiple Vulnerabilities

 Description:
Some vulnerabilities have been discovered in Netscape, which can be exploited by malicious people to manipulate certain data, conduct spoofing attacks, bypass certain security restrictions and potentially compromise a vulnerable system.

For more information, see vulnerabilities #2, #3, #4 and #7 in:
SA16911

The vulnerabilities have been confirmed in version 8.0.3.3. Other versions may also be affected.

Solution:
Use another product.

Provided and/or discovered by:
Originally discovered in Firefox by:
Mats Palmgren, Tim Altman, Yutaka Oiwa and moz_bug_r_a4

These are the same vulnerabilites that were discovered in Firefox, but were fixed in version 1.0.7

As usual, there is already someone working on the latest IE vulnerability.  These guys need a hobby.  I suggest comic books.

Exploiting The XmlHttpRequest Object In IE 25 Sep. 2005

Summary
XmlHttpRequest is a Javascript object that allows a client side Javascript code to send almost raw HTTP requests to the origin host and to access the response's body in raw form. As such, XmlHttpRequest is a core component of AJAX.

XmlHttpRequest implementation in IE can be exploited to perform Referer spoofing, HTTP Request Smuggling and web-scanning.

Credit:
The information has been provided by Amit Klein (AKsecurity).

Jeez, lets make it easy for the script-kiddies

Rest of the article is here: SecuriTeam.com \

I just read Reed’s post about going to a pre-screening of Serenity and I can’t gorram believe that he is going to see the BDM before me!!  I would have signed up for a screening like that but I never heard anything about one in my area over the pipeline. 

I watched Firefly from day one and have loved it ever since.  When the show went off the air, I got bootleg copies of the show on EBay so I could watch it over and over.  When Firefly came out on DVD, I bought it the second it hit the shelves.  I am even an offical Browncoat and was one of the many fans that helped Firefly get enough backing to make the BDM possible.

When the BDM comes out here, you just bet that nothing in the ‘verse is going to stop me from seeing it.  Not even an entire army of purple bellies!!

 You can’t stop the signal…

Symantec has updated their Beagle removal tool to include the following

 September 23, 2005: Updated removal tool to version 1.11.0 to support minor versions of Trojan.Tooso.

At this point, this tool covers the following: 

• W32.Beagle.A@mm
• W32.Beagle.B@mm
• W32.Beagle.C@mm
• W32.Beagle.E@mm
• W32.Beagle.F@mm
• W32.Beagle.G@mm
• W32.Beagle.H@mm
• W32.Beagle.I@mm
• W32.Beagle.J@mm
• W32.Beagle.K@mm
• W32.Beagle.U@mm
• W32.Beagle.W@mm
• W32.Beagle.X@mm
• W32.Beagle.Y@mm
• W32.Beagle.Z@mm
• W32.Beagle.AB@mm
• W32.Beagle.AC@mm
• W32.Beagle.AG@mm
• W32.Beagle.AO@mm
• W32.Beagle.AR@mm
• W32.Beagle.AU@mm
• W32.Beagle.AV@mm
• W32.Beagle.AW@mm
• W32.Beagle.AY@mm
• W32.Beagle.AZ@mm
• W32.Beagle.BA@mm
• Trojan.Tooso
• Trojan.Tooso.B
• Trojan.Tooso.C
• Trojan.Tooso.D
• Trojan.Tooso.E
• Trojan.Tooso.F
• Trojan.Tooso.H
• Trojan.Tooso.J
• Trojan.Tooso.Q

You can download a copy of the tool here: Symantec Security Response - W32.Beagle@mm Removal Tool

SANS - Internet Storm Center - Cooperative Cyber Threat Monitor And Alert System - Current Infosec News and Analysis

'Pump and Dump' Spam Messages (NEW)
Published: 2005-09-26,
Last Updated: 2005-09-26 05:15:04 UTC by Scott Fendley (Version: 1)


Just a quick note for everyone as you return to the office on Monday morning. There have been a few reports of a new spam message that has been getting thrown out on the net over the weekend that will have security implications for some. `Pump and Dump' spam messages are email messages that appear to give the reader an insiders edge to a particular stock that will have some amazing growth. The people involved in this spam have undoubtedly bought many shares of the stock ahead of time and will dump them after unsuspecting users push the stock price up with their purchases. This type of spam has been around for a while, and usually doesn't make it to my inbox that often. However, since Saturday morning I have had upwards of 100 reach one of my older email addresses, and many more have been sent in to the postmaster and abuse addresses.

However, upon looking closely at the headers and looking at a very high end view, this appears to be related to exploitation of some type of cgi or php application. After exploitation, the attacker can proxy, or otherwise relay their junk mail. Unfortunately, I have not been able to get close enough to one of these relay machines to determine precisely what application has come under fire.

So, if you find that your company has had a large uptick in `pump and dump' spams, know that you are not the only ones. If you find webserver logs, or better yet, an actual compromised host that was sending out this junk, then please let us know what application it is that is being exploited.

Scott Fendley
ISC Handler

Why are we worried about Linux all of a sudden?  Is someone thinking about switching??

Secunia - Advisories - Thunderbird Command Line URL Shell Command Injection

This vulnerability can only be exploited on Unix / Linux based environments.

JD caught a good article over at ZDNet on virus naming conventions.  Look like something is finally being done, and I am glad to see it. 

It certainly has been a while since I got a response back on that “Open Letter to Anti-Virus Software Companies” that I wrote, and I pleased to see that all of the groups that responded are following through with what they said they would.

Virus Name Game - Is it game over?

I caught an article on zdnet this morning that talks about the Common Malware Enumeration (CME) initiative.

"There is a lot of confusion over the way that malware is referred to," Desiree Beck, the technical lead for the CME initiative, said in an interview. "We're trying to alleviate that by giving malware a common identifier, so everybody is talking about the same thing when some malware event happens."

It has been a while since this tool has been updated, glad to see that Symantec is still maintaining it.

Here is what is in the latest version:

•  September 21, 2005: Updated removal tool to version 1.10.1 to support Trojan.Tooso.Q.

At this point, this tool covers the following:

• W32.Beagle.A@mm
• W32.Beagle.B@mm
• W32.Beagle.C@mm
• W32.Beagle.E@mm
• W32.Beagle.F@mm
• W32.Beagle.G@mm
• W32.Beagle.H@mm
• W32.Beagle.I@mm
• W32.Beagle.J@mm
• W32.Beagle.K@mm
• W32.Beagle.U@mm
• W32.Beagle.W@mm
• W32.Beagle.X@mm
• W32.Beagle.Y@mm
• W32.Beagle.Z@mm
• W32.Beagle.AB@mm
• W32.Beagle.AC@mm
• W32.Beagle.AG@mm
• W32.Beagle.AO@mm
• W32.Beagle.AR@mm
• W32.Beagle.AU@mm
• W32.Beagle.AV@mm
• W32.Beagle.AW@mm
• W32.Beagle.AY@mm
• W32.Beagle.AZ@mm
• W32.Beagle.BA@mm
• Trojan.Tooso
• Trojan.Tooso.B
• Trojan.Tooso.C
• Trojan.Tooso.D
• Trojan.Tooso.E
• Trojan.Tooso.F
• Trojan.Tooso.H
• Trojan.Tooso.J
• Trojan.Tooso.Q

You can download the tool from here: Symantec Security Response - W32.Beagle@mm Removal Tool

I read about this yesterday and I have to say that I was shocked and disgusted about what has been going on under our noses.

The Pentagon has been compiling sensitive data on 30 million youth ages 16-to-25 using a private marketing firm, without the knowledge or consent of individuals or their families. You can opt-out of this database by following instructions at www.LeaveMyChildAlone.org.

How can this be possible?

The Pentagon announced just this summer it has been collecting and using data—including such sensitive personal information as Social Security numbers, ethnicity, GPA, personal email addresses, height, weight, and even the cell phone numbers of kids, without their parent's permission. They had been keeping the database secret for more than three years—a violation of federal privacy laws and the privacy of tens of millions of young Americans. In addition, a little known provision in the federal No Child Left Behind Act is forcing public high schools to release the personal information of their students to local military recruiters, again without the consent of their families.

Don’t believe it?  Neither did I at first, until I read the requirements that are contained in Section 9528 of PL-107-110, the No Child Left Behind Act of 2001 (codified in 20 USC 7908). (http://www.ed.gov/policy/elsec/leg/esea02/pg112.html#sec952 This is what it says:

 SEC. 9528. ARMED FORCES RECRUITER ACCESS TO STUDENTS AND STUDENT RECRUITING INFORMATION.

(a) POLICY-

(1) ACCESS TO STUDENT RECRUITING INFORMATION- Notwithstanding section 444(a)(5)(B) of the General Education Provisions Act and except as provided in paragraph (2), each local educational agency receiving assistance under this Act shall provide, on a request made by military recruiters or an institution of higher education, access to secondary school students names, addresses, and telephone listings.

(2) CONSENT- A secondary school student or the parent of the student may request that the student's name, address, and telephone listing described in paragraph (1) not be released without prior written parental consent, and the local educational agency or private school shall notify parents of the option to make a request and shall comply with any request.

(3) SAME ACCESS TO STUDENTS- Each local educational agency receiving assistance under this Act shall provide military recruiters the same access to secondary school students as is provided generally to post secondary educational institutions or to prospective employers of those students.

(b) NOTIFICATION- The Secretary, in consultation with the Secretary of Defense, shall, not later than 120 days after the date of enactment of the No Child Left Behind Act of 2001, notify principals, school administrators, and other educators about the requirements of this section.

(c) EXCEPTION- The requirements of this section do not apply to a private secondary school that maintains a religious objection to service in the Armed Forces if the objection is verifiable through the corporate or other organizational documents or materials of that school.

(d) SPECIAL RULE- A local educational agency prohibited by Connecticut State law (either explicitly by statute or through statutory interpretation by the State Supreme Court or State Attorney General) from providing military recruiters with information or access as required by this section shall have until May 31, 2002, to comply with that requirement.

I don’t have any children, but this really angers me.&n