HNS Newsletter Issue 415 - 21.04.2008 http://www.net-security.org ================================================================ Free Webcast: Proactive Vulnerability Management http://www.qualys.com/forms/webcasts/forrester-pvm/?lsid=7194 ================================================================ Speaker: Dr. Chenxi Wang, Principal Analyst, Security and Risk Management, Forrester Research, Inc. In this talk, Dr. Chenxi Wang, Principal Analyst for Security and Risk Management at Forrester Research, will cover the key aspects of proactive vulnerability management and more importantly, the steps via which you can follow to achieve proactive vulnerability management. More specifically: * Continuing assessment of network and devices * Integration with your IT risk management systems * Effective analysis of assessment results * Implementation of proactive remediation http://www.qualys.com/forms/webcasts/forrester-pvm/?lsid=7194 ========================================================= Table of contents: 1) Security news 2) Advisories 3) Articles 4) Software 5) Conferences 6) Security World [ Security news ] ---------------------------------------------------------------- THREE WAYS TO TEST WEB FORM INPUT WITH A CAPTCHA Many Web forms these days feature a Completely Automated Public Turing test to tell Computers and Humans Apart (CAPTCHA) as an effort to stop people from setting up computers to automatically fill in Web forms. http://www.net-security.org/news.php?id=15852 ONLINE SECURITY: A CLOSER LOOK AT A NEGATIVE EXAMPLE It may be easier than you think for someone to steal your wireless phone records. At least, that's the case if you're a Sprint wireless phone user. http://www.net-security.org/news.php?id=15853 FEARS OVER ADVERT SYSTEM PRIVACY Online advert system Phorm could make the net less secure and breaches human rights, the service's creators have been told. http://www.net-security.org/news.php?id=15854 FBI CAUSED DELAY IN TERROR CASE AHEAD OF SENATE TESTIMONY Counterterrorism officials in FBI headquarters slowed an investigation into a possible conspirator in the 2005 London bombings by forcing a field agent to return documents acquired from a U.S. university. http://www.net-security.org/news.php?id=15855 THE PAYMENT APPLICATION DATA SECURITY STANDARD The PCI Security Standards Council announced the release of version 1.1 of the Payment Application Data Security Standard (PA-DSS). The goal of PA-DSS is to help software vendors and others develop secure payment applications that do not store prohibited data, such as full magnetic stripe, other sensitive authentication data or PIN data, and ensure their payment applications support compliance with the PCI DSS. http://www.net-security.org/news.php?id=15856 HNS PODCAST: PENETRATION TESTING CONSIDERATIONS In this HNS podcast, Anothony Alves from CORE Security Technologies talks about penetration testing. He dicusses the things you should look for when considering doing a penetration test. http://www.net-security.org/news.php?id=15857 CONSUMER GROUPS URGE "DO NOT TRACK" REGISTRY Two consumer groups asked the Federal Trade Commission on Tuesday to create a "do not track list" that would allow computer users to bar advertisers from collecting information about them. http://www.net-security.org/news.php?id=15858 BE SECURE, AND YOU'LL BE COMPLIANT There’s been some recent chatter and speculation on the upcoming enhancement to the PCI standard. http://www.net-security.org/news.php?id=15859 A HISTORY OF VIRUSES AND ANTIVIRUS In any field of human activity, the latest generation stands squarely on the shoulders of those who went before, learning from what has been done before, re-applying what has proved successful and also trying to break new ground. This is no less true of those who develop malicious code. Successive waves of malicious code have re-defined the threat landscape. http://www.net-security.org/news.php?id=15863 INSECURITY OVER SECURITY SOFTWARE It's time for a confession: I can't remember the last time a security program stopped me from accidentally opening a virus on any Windows machine--even though my public, widely published e-mail address has to be on half the spam databases in the world. http://www.net-security.org/news.php?id=15860 CHINA DEFENDS ANTI-PIRACY EFFORTS Officials defended China's efforts to stop rampant copying of movies and other goods, saying Thursday that 4,322 people were convicted of product piracy last year and promising special efforts to protect Olympics-related trademarks. http://www.net-security.org/news.php?id=15861 WINDOWS VISTA SP1: NOT FOR THE IMPATIENT Microsoft has released a bundle of security and stability updates for Windows Vista users. What follows is a long-overdue primer on this package of goodies from Redmond known as Service Pack 1. http://www.net-security.org/news.php?id=15862 KEEPING YOUR MAC LOCKED DOWN In this article we'll take a look at some basic ways you can improve your Mac's security right out of the box. http://www.net-security.org/news.php?id=15864 SSMTP - A SIMPLE ALTERNATIVE TO SENDMAIL Linux distributions have relied on the venerable Sendmail package since the early days of Slackware. But Sendmail's rich mail server features aren't an ideal solution for the typical desktop user whose primary mail support is delivered through a remote ISP. That's the perfect place for a simpler solution: sSMTP. http://www.net-security.org/news.php?id=15865 SETTING UP FIRMWARE PASSWORD PROTECTION IN MAC OS X You can use the Open Firmware Password application to set up low-level password protection with Mac OS X 10.1 and later. http://www.net-security.org/news.php?id=15866 FREEDOM OF THE CYBER SEAS How lessons from the U.S. government's response to pirates in the early 1800s can help the next president of the United States improve information security. http://www.net-security.org/news.php?id=15868 CNN WEB SITE TARGETED CNN was targeted Thursday by attempts to interrupt its news Web site, resulting in countermeasures that caused the service to be slow or unavailable to some users in limited areas of Asia. http://www.net-security.org/news.php?id=15869 GSM RESEARCHER STOPPED AT HEATHROW BY UK GOVERNMENT OFFICIALS I was searched by the UK government while waiting at the Gate and reading a newspaper. A UK Government employee flipped his badge and said "Let's talk. Come over here". http://www.net-security.org/news.php?id=15870 ---------------------------------------------------------------- [ Advisories ] All advisories are located at: http://www.net-security.org/archive_advi.php ---------------------------------------------------------------- Mandriva Linux Security Update Advisory - clamav (MDVSA-2008:088) http://www.net-security.org/advisory.php?id=8795 Mandriva Linux Security Update Advisory - poppler vulnerability (MDVSA-2008:089) http://www.net-security.org/advisory.php?id=8794 Gentoo Linux Security Advisory - Sun JDK/JRE: Multiple vulnerabilities (GLSA 200804-20) http://www.net-security.org/advisory.php?id=8793 Gentoo Linux Security Advisory - PHP Toolkit: Data disclosure and Denial of Service (GLSA 200804-19) http://www.net-security.org/advisory.php?id=8792 Slackware Security Advisory - mozilla-firefox (SSA:2008-108-01) http://www.net-security.org/advisory.php?id=8791 Debian Security Advisory - suphp (DSA-1550-1) http://www.net-security.org/advisory.php?id=8790 Debian Security Advisory - clamav (DSA-1549-1) http://www.net-security.org/advisory.php?id=8789 Ubuntu Security Notice - poppler vulnerability (USN-603-1 ) http://www.net-security.org/advisory.php?id=8788 Ubuntu Security Notice - koffice vulnerability (USN-603-2) http://www.net-security.org/advisory.php?id=8787 Debian Security Advisory - xpdf (DSA-1548-1) http://www.net-security.org/advisory.php?id=8786 Gentoo Linux Security Advisory - Poppler: User-assisted execution of arbitrary code (GLSA 200804-18:02) http://www.net-security.org/advisory.php?id=8785 Gentoo Linux Security Advisory - Speex: User-assisted execution of arbitrary code (GLSA 200804-17) http://www.net-security.org/advisory.php?id=8784 Gentoo Linux Security Advisory - rsync: Execution of arbitrary code (GLSA 200804-16) http://www.net-security.org/advisory.php?id=8783 Debian Security Advisory - openoffice.org (DSA 1547-1 ) http://www.net-security.org/advisory.php?id=8782 Mandriva Linux Security Update Advisory - policykit (MDVSA-2008:087) http://www.net-security.org/advisory.php?id=8781 FreeBSD Security Advisory - OpenSSH X11-forwarding privilege escalation (FreeBSD-SA-08:05.openssh) http://www.net-security.org/advisory.php?id=8780 Apple Security Update - Safari 3.1.1 (APPLE-SA-2008-04-1) http://www.net-security.org/advisory.php?id=8779 Cisco Security Advisory - Cisco Network Admission Control Shared Secret Vulnerability (cisco-sa-20080416-nac) http://www.net-security.org/advisory.php?id=8778 Turbolinux Security Announcement - openssh, squid (16/Apr/2008) http://www.net-security.org/advisory.php?id=8777 Mandriva Linux Security Update Advisory - giftrans (MDVA-2008:044) http://www.net-security.org/advisory.php?id=8776 Mandriva Linux Security Update Advisory - kernel (MDVSA-2008:086) http://www.net-security.org/advisory.php?id=8775 Debian Security Advisory - lighttpd (DSA-1540-2) http://www.net-security.org/advisory.php?id=8774 Mandriva Linux Security Update Advisory - python (MDVSA-2008:085) http://www.net-security.org/advisory.php?id=8773 Gentoo Linux Security Advisory - libpng: Execution of arbitrary code (GLSA 200804-15) http://www.net-security.org/advisory.php?id=8772 Gentoo Linux Security Advisory - Opera: Multiple vulnerabilities (GLSA 200804-14) http://www.net-security.org/advisory.php?id=8771 Ubuntu Security Notice - squid vulnerability (USN-601-1) http://www.net-security.org/advisory.php?id=8770 Mandriva Linux Security Update Advisory - php-apc (MDVSA-2008:082) http://www.net-security.org/advisory.php?id=8769 Mandriva Linux Security Update Advisory - rsync (MDVSA-2008:084) http://www.net-security.org/advisory.php?id=8768 Gentoo Linux Security Advisory - gnome-screensaver: Privilege escalation (GLSA 200804-12) http://www.net-security.org/advisory.php?id=8767 Gentoo Linux Security Advisory - policyd-weight: Insecure temporary file creation (GLSA 200804-11) http://www.net-security.org/advisory.php?id=8766 SUSE Security Announcement - SUSE Security Summary Report (SUSE-SR:2008:009) http://www.net-security.org/advisory.php?id=8765 SUSE Security Announcement - flash-player (SUSE-SA:2008:022) http://www.net-security.org/advisory.php?id=8764 Ubuntu Security Notice - rsync vulnerability (USN-600-1) http://www.net-security.org/advisory.php?id=8763 Debian Security Advisory - gnumeric (DSA-1546-1) http://www.net-security.org/advisory.php?id=8762 Debian Security Advisory - rsync (DSA-1545-1) http://www.net-security.org/advisory.php?id=8761 Gentoo Linux Security Advisory - Tomcat: Multiple vulnerabilities (GLSA 200804-10) http://www.net-security.org/advisory.php?id=8760 Gentoo Linux Security Advisory - am-utils: Insecure temporary file creation (GLSA 200804-09) http://www.net-security.org/advisory.php?id=8759 ---------------------------------------------------------------- [ Articles ] All articles are located at: http://www.net-security.org/articles_main.php Articles can be contributed to articles@net-security.org ---------------------------------------------------------------- CHANGING THREATS, CHANGING SOLUTIONS: A HISTORY OF VIRUSES AND ANTIVIRUS It is more than 20 years since the first PC virus appeared. Since then, the nature of threats has changed significantly. Today’s threats are more complex than ever before. In any field of human activity, the latest generation stands squarely on the shoulders of those who went before, learning from what has been done before, re-applying what has proved successful and also trying to break new ground. This is no less true of those who develop malicious code. Successive waves of malicious code have re-defined the threat landscape. http://www.net-security.org/article.php?id=1127 HNS PODCAST: PENETRATION TESTING CONSIDERATIONS In this HNS podcast, Anothony Alves from CORE Security Technologies talks about penetration testing. He dicusses the things you should look for when considering doing a penetration test. http://www.net-security.org/article.php?id=1126 ---------------------------------------------------------------- [ Software ] Windows software is located at: http://net-security.org/software_main.php?cat=1 Linux software is located at: http://net-security.org/software_main.php?cat=2 Pocket PC software is located at: http://net-security.org/software_main.php?cat=3 Mac OS X software is located at: http://net-security.org/software_main.php?cat=5 ---------------------------------------------------------------- ANOTHER FILE INTEGRITY CHECKER 2.11.1 (Linux) afick is another file integrity checker, designed to be fast and fully portable between Unix and Windows platforms. http://www.net-security.org/software.php?id=667 BOTAN 1.7.5 (Linux) Botan aims to be a portable, easy to use, and efficient C++ crypto library. http://www.net-security.org/software.php?id=94 DEVICELOCK 6.3 Build 14161 (Windows) DeviceLock gives network administrators control over which users can access what devices on a local computer. http://www.net-security.org/software.php?id=121 DIGISECRET PRO 2.1 2.1 (Windows) DigiSecret is an easy-to-use, secure, and powerful application for file encryption and sharing http://www.net-security.org/software.php?id=693 ESSENTIAL NETTOOLS 4.2 (Windows) Essential NetTools is a set of network tools useful in diagnosing networks and monitoring your computer's network connections. http://www.net-security.org/software.php?id=511 FIREWALL BUILDER 2.1.18 (Linux) Firewall Builder consists of an object-oriented GUI and a set of policy compilers for various firewall platforms. http://www.net-security.org/software.php?id=230 NUFW 2.2.15 (Linux) NuFW is an "authenticating gateway". This means it requires authentication for any connections to be forwarded through the gateway. http://www.net-security.org/software.php?id=526 PHPKRM 1.5.2 (Linux) PHPkrm is a Web-based GNUPG keyring manager. http://www.net-security.org/software.php?id=347 REVEALER KEYLOGGER 1.33 (Windows) Revealer Keylogger is an easy way to record keyboard inputs. There is almost nothing to configure, in fact everything is configured internally with the best setting. http://www.net-security.org/software.php?id=688 SECURE IT EASY USB FIREWALL 2.0.1.0 (Windows) Secure it Easy USB Firewall is an easy to deploy endpoint security solution that acts like a Firewall for your PCs ports. http://www.net-security.org/software.php?id=669 SECURITY SYSTEM ANALYZER 1.6b2 (Windows) Security System Analyzer is free non-intrusive OVAL-Compatible software. It provides security testers, auditors with an advanced overview of the security policy level applied. http://www.net-security.org/software.php?id=676 SMARTWHOIS 4.3 (Windows) SmartWhois is a useful network information utility that allows you to find all the available information about an IP address, hostname, or domain. http://www.net-security.org/software.php?id=299 SPYTECH SPYAGENT 6.2 (Windows) Spytech SpyAgent is a solution used for computer monitoring and surveillance needs. http://www.net-security.org/software.php?id=694 SPYWARE TERMINATOR 2.2.0.411 (Windows) Free Spyware Terminator provides effective real-time detection and removal of spyware and incoming threats. http://www.net-security.org/software.php?id=681 STRONGSWAN 4.2.1 (Linux) strongSwan is a complete IPsec and IKEv1 implementation for Linux 2.4 and 2.6 kernels http://www.net-security.org/software.php?id=643 THE SLEUTH KIT 2.52 (Linux) The Sleuth Kit is a collection of UNIX-based command line file system forensic tools. http://www.net-security.org/software.php?id=215 ---------------------------------------------------------------- [ Conferences ] All conferences are located at: http://net-security.org/conferences.php ---------------------------------------------------------------- TRISC 2008 Organized by Texas Chapters of ISSA, ISACA, ASIS International and Infragard - 21 April-23 April 2008 http://www.net-security.org/conference.php?id=249 Infosecurity 2008 Organized by Reed Exhibitions - 22 April-24 April 2008 http://www.net-security.org/conference.php?id=245 LayerOne 2008 Organized by LayerOne - 17 May-18 May 2008 http://www.net-security.org/conference.php?id=250 OWASP AppSec Europe 2008 Belgium Organized by OWASP - 20 May-23 May 2008 http://www.net-security.org/conference.php?id=248 EUSecWest 2008 Organized by dragostech.com inc. - 21 May-21 May 2008 http://www.net-security.org/conference.php?id=254 Hacker Halted USA 2008 Organized by EC-Council - 28 May-4 June 2008 http://www.net-security.org/conference.php?id=244 Shakacon 2008 Organized by Shakacon - 9 June-13 June 2008 http://www.net-security.org/conference.php?id=252 Recon 2008 Organized by recon - 13 June-15 June 2008 http://www.net-security.org/conference.php?id=253 SyScan 2008 Organized by SyScan - 3 July-4 July 2008 http://www.net-security.org/conference.php?id=251 Second International Symposium on Human Aspects of Information Security & Assurance Organized by Information Security & Network Research Group, University of Plymouth - 8 July-10 July 2008 http://www.net-security.org/conference.php?id=238 ---------------------------------------------------------------- [ Security World ] All security world articles are located at: http://www.net-security.org/secworld_main.php Send your press releases to press@net-security.org ---------------------------------------------------------------- Hackontest aims to enhance software http://www.net-security.org/secworld.php?id=6038 Medium businesses in the US to invest US$7.8B on storage and security http://www.net-security.org/secworld.php?id=6037 eBay applauds arrest of a Romanian cyber-criminal http://www.net-security.org/secworld.php?id=6036 The security content of Safari 3.1.1 http://www.net-security.org/secworld.php?id=6035 Virtualized "concrete bunker" to prevent identity theft and cyber crime http://www.net-security.org/secworld.php?id=6034 Former federal agents open identity theft protection company http://www.net-security.org/secworld.php?id=6033 Smart Card Alliance spearheads new agenda for CTST 2008 conference http://www.net-security.org/secworld.php?id=6032 New book: "Vulnerability Management For Dummies" http://www.net-security.org/secworld.php?id=6031 Roaming workers up to no good on the web http://www.net-security.org/secworld.php?id=6030 Global Security Challenge offers $500K in grants http://www.net-security.org/secworld.php?id=6029 RFID solution for IT asset tracking http://www.net-security.org/secworld.php?id=6028 Windows Live Hotmail CAPTCHA cracked by spambots http://www.net-security.org/secworld.php?id=6027 Unique exploitation scenario using a recently disclosed Flash vulnerability http://www.net-security.org/secworld.php?id=6026 PCI Security Standards Council issues Payment Application Data Security Standard http://www.net-security.org/secworld.php?id=6025 Data at rest security for Oracle customers goes global http://www.net-security.org/secworld.php?id=6024 New version of Zertificon secure virtual mailroom http://www.net-security.org/secworld.php?id=6023 Post-April tips to prevent identity theft http://www.net-security.org/secworld.php?id=6022 Check Point delivers new Power-1 appliances http://www.net-security.org/secworld.php?id=6021 New book: "Crimeware: Understanding New Attacks and Defenses" http://www.net-security.org/secworld.php?id=6020 New book: "iPhone Open Application Development" http://www.net-security.org/secworld.php?id=6019 Top four malware security tips http://www.net-security.org/secworld.php?id=6018 ZombiCop for Internet Service Providers http://www.net-security.org/secworld.php?id=6017 Latest report on top spam relaying countries http://www.net-security.org/secworld.php?id=6016 New book: "Building a Server with FreeBSD 7" http://www.net-security.org/secworld.php?id=6015 IronKey gets FIPS 140-2 Level 2 Validation http://www.net-security.org/secworld.php?id=6014 Tenable earns NIST validation http://www.net-security.org/secworld.php?id=6013 Campuses embrace emergency notification systems http://www.net-security.org/secworld.php?id=6012 ---------------------------------------------------------------- Questions, contributions, comments or ideas go to: Help Net Security staff staff@net-security.org http://net-security.org ---------------------- Unsubscribe from this weekly digest on: http://www.net-security.org/subscribe.php The archive of the newsletter in TXT and PDF format is available http://www.net-security.org/newsletter_archive.php