HNS Newsletter
Issue 417 - 05.05.2008
http://www.net-security.org

================================================================
HNS Book giveaway - win a copy of "Zero Day Threat"
================================================================
We are giving one of our readers a copy of the recently released
book "Zero Day Threat: The Shocking Truth of How Banks and Credit
Bureaus Help Cyber Crooks Steal Your Money and Identity".

For more information please visit:

http://www.net-security.org/secworld.php?id=6086
=========================================================

Table of contents:

1) Security news
2) Advisories
3) Articles
4) Software
5) Conferences
6) Security World
7) Virus News


[ Security news ]


----------------------------------------------------------------

THE NEW E-SPIONAGE THREAT
A BusinessWeek probe of rising attacks on America's most sensitive
computer networks uncovers startling security gaps.
http://www.net-security.org/news.php?id=15881


AUTOMATIC PATCH-BASED EXPLOIT GENERATION IS POSSIBLE
The automatic patch-based exploit generation problem is: given a
program P and a patched version of the program P', automatically
generate an exploit for the potentially unknown vulnerability present
in P but fixed in P'. In this paper, we propose techniques for
automatic patch-based exploit generation, and show that our
techniques can automatically generate exploits for vulnerable
programs based upon patches provided via Windows Update.
http://www.net-security.org/news.php?id=15882


LAWYERS FEAR MONITORING IN CASES ON TERRORISM
Thomas Nelson, an Oregon lawyer, has lived in a state of perpetual
jet lag for the last two years. Every few weeks, he boards a plane in
Portland and flies to the Middle East to meet with a high-profile
Saudi client who cannot enter the United States because he faces
charges here of financing terrorism.
http://www.net-security.org/news.php?id=15883


A CASE OF NETWORK IDENTITY THEFT?
Digital real estate leased to one of the Internet's oldest
landholders appears to have been quietly seized by e-mail marketers
closely associated with an individual once tagged by anti-spam groups
as one of the world's most notorious spammers.
http://www.net-security.org/news.php?id=15884


FIREFOX 3 IMPROVES HANDLING OF INVALID SSL CERTIFICATES
I have downloaded the beta of Firefox 3 to check out the improvements
related to SSL.
http://www.net-security.org/news.php?id=15885


BEATING THE CODEBREAKERS WITH QUANTUM CRYPTOGRAPHY
Quantum cryptography may be essentially solved, but getting the funky
physics to work on disciplined computer networks is a whole new
headache.
http://www.net-security.org/news.php?id=15886


HOW TO AVOID GETTING PHISHED
Millions of people have gotten "urgent" emails asking them to take
immediate action to prevent some impending disaster.
http://www.net-security.org/news.php?id=15887


STORM WORM Q&A WITH THE PRINCIPAL SECURITY STRATEGIST FOR IBM ISS
With more than ten years of experience in security and networking
software development, Corman is currently leading an industry charge
to evolve defenses against the latest generations and innovations of
malicious code. In this Q&A session he discusses the Storm Worm.
http://www.net-security.org/news.php?id=15888


WHITEPAPER - YOUR 10 BIGGEST NETWORK SECURITY WORRIES
Learn what threats and vulnerabilities today's small business IT
professionals need to defend against, along with tips on how to fight
them.
http://www.net-security.org/news.php?id=15889


DECLASSIFIED NSA DOCUMENT REVEALS THE SECRET HISTORY OF TEMPEST
It was 1943, and an engineer with Bell Telephone was working on one
of the U.S. government's most sensitive and important pieces of
wartime machinery, a Bell Telephone model 131-B2.
http://www.net-security.org/news.php?id=15890


ANATOMY OF SECURITY-ENHANCED LINUX
Linux has been described as one of the most secure operating systems
available, but the National Security Agency has taken Linux to the
next level with the introduction of Security-Enhanced Linux
(SELinux).
http://www.net-security.org/news.php?id=15891


THE ABCS OF SECURING YOUR WIRELESS NETWORK
In this practical introduction to the basics of securing your home
wireless network, we'll cover the important, high-level points that
ordinary users need to know in order to secure a network of game
consoles, phones, and PCs.
http://www.net-security.org/news.php?id=15892


A VISIT WITH INMATE NO. BFPS63 AKA HANS REISER
Inside the Cellblock 9 visiting room here at Santa Rita Jail, inmate
number BFPS63 looked like a man with a big hangover.
http://www.net-security.org/news.php?id=15893


CYBERWARFARE: DARPA'S NEW 'SPACE RACE'
Under a directive signed by the President - and OK'd by Congress -
nearly every arm of the government's security apparatus is starting
work on a massive national cybersecurity initiative, designed to
protect the United States from electronic attack (and strike at
adversaries online, as well).
http://www.net-security.org/news.php?id=15894


PROTECTING YOURSELF FROM SUSPICIONLESS SEARCHES WHILE TRAVELING
The Ninth Circuit's recent ruling in United States v. Arnold allows
border patrol agents to search your laptop or other digital device
without limitation when you are entering the country.
http://www.net-security.org/news.php?id=15895

----------------------------------------------------------------




[ Advisories ]


All advisories are located at:
http://www.net-security.org/archive_advi.php


----------------------------------------------------------------

Mandriva Linux Security Update Advisory - openoffice.org
(MDVSA-2008:095)
http://www.net-security.org/advisory.php?id=8842


Debian Security Advisory - cpio (DSA-1566-1)
http://www.net-security.org/advisory.php?id=8841


Debian Security Advisory - wordpress (DSA-1564-1)
http://www.net-security.org/advisory.php?id=8840


Debian Security Advisory - asterisk (DSA-1563-1)
http://www.net-security.org/advisory.php?id=8839


Debian Security Advisory - asterisk (DSA-1563-1)
http://www.net-security.org/advisory.php?id=8838


Turbolinux Security Announcement - JavaScript garbage collector
(30/Apr/2008)
http://www.net-security.org/advisory.php?id=8837


Mandriva Linux Security Update Advisory - speex: User-assisted
execution of arbitrary code (MDVSA-2008:094)
http://www.net-security.org/advisory.php?id=8836


Mandriva Linux Security Update Advisory - gstreamer-plugins-good
(MDVSA-2008:092)
http://www.net-security.org/advisory.php?id=8835


Mandriva Linux Security Update Advisory - vorbis-tools
(MDVSA-2008:093)
http://www.net-security.org/advisory.php?id=8834


Gentoo Linux Security Advisory - KDE start_kdeinit: Multiple
vulnerabilities (GLSA 200804-30)
http://www.net-security.org/advisory.php?id=8833


Slackware Security Advisory - libpng (SSA:2008-119-01)
http://www.net-security.org/advisory.php?id=8832


Debian Security Advisory - iceape (DSA-1562-1)
http://www.net-security.org/advisory.php?id=8831


Debian Security Advisory - ldm (DSA-1561-1 )
http://www.net-security.org/advisory.php?id=8830


Debian Security Advisory - kronolith2 (DSA-1560-1 )
http://www.net-security.org/advisory.php?id=8829


Debian Security Advisory - perl (DSA-1556-2 )
http://www.net-security.org/advisory.php?id=8828


Symantec Security Advisory - phpgedview (DSA-1559-1)
http://www.net-security.org/advisory.php?id=8827


Debian Security Advisory - wml (DSA 1492-2)
http://www.net-security.org/advisory.php?id=8826


Slackware Security Advisory - kdelibs (SSA:2008-116-01)
http://www.net-security.org/advisory.php?id=8825


Gentoo Linux Security Advisory - Comix: Multiple vulnerabilities
(GLSA 200804-29)
http://www.net-security.org/advisory.php?id=8824

----------------------------------------------------------------




[ Articles ]


All articles are located at:
http://www.net-security.org/articles_main.php

Articles can be contributed to articles@net-security.org


----------------------------------------------------------------

INTERVIEW WITH JOSH CORMAN, PRINCIPAL SECURITY STRATEGIST FOR IBM
INTERNET SECURITY SYSTEMS
With more than ten years of experience in security and networking
software development, Corman is currently leading an industry charge
to evolve defenses against the latest generations and innovations of
malicious code. In this Q&A session he discusses the Storm Worm.
http://www.net-security.org/article.php?id=1130


AUTOMATIC PATCH-BASED EXPLOIT GENERATION IS POSSIBLE: TECHNIQUES AND
IMPLICATIONS
The automatic patch-based exploit generation problem is: given a
program P and a patched version of the program P', automatically
generate an exploit for the potentially unknown vulnerability present
in P but fixed in P'. In this paper, we propose techniques for
automatic patch-based exploit generation, and show that our
techniques can automatically generate exploits for vulnerable
programs based upon patches provided via Windows Update.
http://www.net-security.org/article.php?id=1129

----------------------------------------------------------------




[ Software ]


Windows software is located at:
http://net-security.org/software_main.php?cat=1

Linux software is located at:
http://net-security.org/software_main.php?cat=2

Pocket PC software is located at:
http://net-security.org/software_main.php?cat=3

Mac OS X software is located at:
http://net-security.org/software_main.php?cat=5


----------------------------------------------------------------

AD-AWARE 2007 FREE 7.0.2.7 (Windows)
Ad-aware is a free multi spyware removal utility.
http://www.net-security.org/software.php?id=135


BOTAN 1.7.6 (Linux)
Botan aims to be a portable, easy to use, and efficient C++ crypto
library.
http://www.net-security.org/software.php?id=94


PASSWORD SAFE 3.13 (Windows)
Password Safe is a password database utility.
http://www.net-security.org/software.php?id=172


SAMHAIN 2.4.4 (Linux)
Samhain is an open source file integrity and host-based intrusion
detection system.
http://www.net-security.org/software.php?id=125


STUNNEL 4.23 (Linux)
Stunnel is a program that allows you to encrypt arbitrary TCP
connections inside SSL (Secure Sockets Layer).
http://www.net-security.org/software.php?id=271


WINSCP 4.1.1 (Windows)
WinSCP is an open source SSH file transfer protocol and secure copy
client for Windows using SSH.
http://www.net-security.org/software.php?id=6

----------------------------------------------------------------




[ Conferences ]


All conferences are located at:
http://net-security.org/conferences.php


----------------------------------------------------------------

LayerOne 2008
Organized by LayerOne - 17 May-18 May 2008
http://www.net-security.org/conference.php?id=250


OWASP AppSec Europe 2008 Belgium
Organized by OWASP - 20 May-23 May 2008
http://www.net-security.org/conference.php?id=248


EUSecWest 2008
Organized by dragostech.com inc. - 21 May-21 May 2008
http://www.net-security.org/conference.php?id=254


Hacker Halted USA 2008
Organized by EC-Council - 28 May-4 June 2008
http://www.net-security.org/conference.php?id=244


Shakacon 2008
Organized by Shakacon - 9 June-13 June 2008
http://www.net-security.org/conference.php?id=252


Recon 2008
Organized by recon - 13 June-15 June 2008
http://www.net-security.org/conference.php?id=253


SyScan 2008
Organized by SyScan - 3 July-4 July 2008
http://www.net-security.org/conference.php?id=251


Second International Symposium on Human Aspects of Information
Security & Assurance
Organized by Information Security & Network Research Group,
University of Plymouth - 8 July-10 July 2008
http://www.net-security.org/conference.php?id=238

----------------------------------------------------------------




[ Security World ]


All security world articles are located at:
http://www.net-security.org/secworld_main.php

Send your press releases to press@net-security.org


----------------------------------------------------------------

Three steps for PCI DSS Compliance on Wi-Fi devices
http://www.net-security.org/secworld.php?id=6087


Book giveaway - win a copy of "Zero Day Threat"
http://www.net-security.org/secworld.php?id=6086


April highlights: new spamming technique and Olympics themed targeted
attacks
http://www.net-security.org/secworld.php?id=6085


Abraxas acquires Anonymizer, Inc
http://www.net-security.org/secworld.php?id=6084


IronKey unveils 8GB version of secure USB drive
http://www.net-security.org/secworld.php?id=6083


87 percent of consumers question safety of personal information
http://www.net-security.org/secworld.php?id=6082


Spam reaches its 30th anniversary
http://www.net-security.org/secworld.php?id=6081


Banks are not doing enough to protect customer data
http://www.net-security.org/secworld.php?id=6080


New TRENDnet Internet security camera solutions
http://www.net-security.org/secworld.php?id=6079


Fresh Netgear NAS devices
http://www.net-security.org/secworld.php?id=6078


Comprehensive study of wireless security in Las Vegas
http://www.net-security.org/secworld.php?id=6077


Increasing competition shows huge expectations for NAC market
http://www.net-security.org/secworld.php?id=6076


Private eyes jailed in industrial espionage spyware case
http://www.net-security.org/secworld.php?id=6075


Data integrity and confidentiality at Layer 2
http://www.net-security.org/secworld.php?id=6074


New security gateway virtual appliances
http://www.net-security.org/secworld.php?id=6073


Data encryption solution that maintains hard disk bootability
http://www.net-security.org/secworld.php?id=6072


Centennial Software acquired by FrontRange Solutions
http://www.net-security.org/secworld.php?id=6071


Hitachi ID releases ID-Archive 5.0
http://www.net-security.org/secworld.php?id=6070


Password management solution with hardware-based encryption
http://www.net-security.org/secworld.php?id=6069


Virtualization technology enables secure wireless access
http://www.net-security.org/secworld.php?id=6068


Exaprotect unveils LogManager 3.0
http://www.net-security.org/secworld.php?id=6067


BIO-key granted image identification system patent
http://www.net-security.org/secworld.php?id=6066

----------------------------------------------------------------




[ Virus News ]


All virus news are located at:
http://www.net-security.org/viruses.php


----------------------------------------------------------------

Storm botnet calms down
http://www.net-security.org/virus_news.php?id=938


Top malware pests in April
http://www.net-security.org/virus_news.php?id=937


Alleged webcam hacker accused of spying on girls
http://www.net-security.org/virus_news.php?id=936

----------------------------------------------------------------





Questions, contributions, comments or ideas go to:

Help Net Security staff
staff@net-security.org
http://net-security.org

----------------------

Unsubscribe from this weekly digest on:
http://www.net-security.org/subscribe.php

The archive of the newsletter in TXT and PDF format is available
http://www.net-security.org/newsletter_archive.php