Greetings! We would like to take a moment to thank our readers for all of
your support. The response has been tremendous for both our newsletter
and website, LinuxSecurity.com. If you have any suggestions reguarding the
website, newsletter, or anything else, please let us know! We are here to
serve the open-source community; your voice should be heard.
In the news, a few good articles were released. A few of my favorites
included, "Cracked! Part 4: The Sniffer", "The Shell Game", and "Who's
Sniffing Your Network?." 'Cracked!' and 'Who's Sniffing your network' both
are written about the use of packet sniffers. While both take different
approaches to explain this topic, they are interesting to read. The Shell
Game explains the rational for SSH and using encrypted communications.
Take a moment to treat yourself to these three articles.
Last week, the major topic of concern was The Top 10 System Security
Threats released by SANS. Articles such as "FBI, DOJ issue list of worst
Internet threats and IT, Company Execs Add To Security Holes" spawned from
SANS' initial release.
This list should be familiar to most of you. If you are unaware of any of
the ten problems listed in the report, be sure to educate yourself and
your users to these potential threats. In a few instances, I saw the
mainstream media portray this as "SANS is revealing the hacker's secrets."
This really isn't the case. I think it is a wake up call for us all.
Many of us like to romanticize system intrusions by thinking of them as
being "clever", while in reality, almost all of the intrusions that occur
are a direct result of administrators not taking the proper steps to
maintain a secure system. Want a real challege? Try to crack a properly
secured Linux system. "Security is a Process, Not a Single Solution." Take
time each day to address security issues. This should be done by
developing a security policy, patching your system, and helping others
gain a better security awareness.
Last week's feature was an interview with Frank van Vliet. He is the
author of AuditFile, many security advisories, and recently pointed out
configuration errors on apache.org . In the interview, Frank explains how
he audits a systems security, major pitfalls administrators fall into, and
how he attempts to uncover bugs. We believe that everyone can learn
something from this interview.
Also recently added to the site is the WebTrends Security Analyzer. The
WedTrends Security Analyzer has the most vulnerability tests for Red Hat &
VA Linux. Using advanced agent-based technology, you can scan your Linux
servers from your Windows NT/2000 console and protect them against
potential threats. Now with over 1,000 tests available.
Thank you for reading LinuxSecurity.com's weekly security newsletter. The
purpose of this document is to provide our readers with a quick summary of
each week's most relevant Linux security headlines and system advisories.
It is distributed each Monday by Guardian Digital, Inc.
Would you like to contribute to this newsletter? We'd love to hear from
you. Email newsletter-admins@linuxsecurity.com with comments, suggestions,
or information on projects you're working on. To subscribe, send an email
to newsletter-request@linuxsecurity.com with "subscribe" in the subject.
May 30th, 2000 TurboLinux: local users can view shadowed password file
"The xlock program locks an X server until a valid password is entered. The command line option -mode provides a user with a mechanism to change the default display shown when the X server is locked. xlock is installed with privileges to obtain password information, although these are dropped as early as possible. An overflow in the -mode command line option allows a malicious attacker to reveal arbitrary portions of xlock's address space including the shadow password file."
During a recent review of our published PGP 5.0 for Linux source code, researchers discovered that under specific, rare circumstances PGP 5.0 for Linux will generate weak, predictable public/private keypairs.
The KDE CD player kscd is setgid disk to be able to access the device file of the CDROM. To perform some action kscd calls the unix command shell specified in the environment variable SHELL with the privileges of group disk.
Problem: A vulnerability in kdesud will allow any user to exploit a buffer overflow. This user then can have a root group access on the machine, by exploiting a bug in the kdesud program.
May 29th, 2000 NetBSD: Local "cpu-hog" denial of service
Untrusted local processes can hog cpu and kernel memory by tricking the kernel into running exclusively on their behalf, denying other processes the CPU.
May 29th, 2000 NetBSD: SysV semaphore denial-of-service
An undocumented system call permits any user process to lock up the entire semaphore subsystem, preventing processes using semaphores from locking or unlocking them, and preventing processes holding semaphores from exiting.
May 29th, 2000 NetBSD 1.4.2: /etc/ftpchroot parsing broken
A fix which attempted to make ftpd's parsing of /etc/ftpusers more robust was incorrect, and broke parsing of /etc/ftpchroot, allowing users listed in /etc/ftpchroot access to files outside their home directory.
May 29th, 2000 NetBSD: Exploitable Vulnerability in Xlockmore
The advisory outlines how xlock can be manipulated to print the shadow password information even though it drops root privileges before an overflow occurs.
xlockmore has a localhost attack against it which allows recovery of the encrypted hash of the root password. The damage to systems using DES passwords from this attack is pretty heavy, but to systems with a well-chosen root password under blowfish encoding (see crypt(3)) the impact is much reduced
A misuse of ipf(8) keep-state rules can result in firewall rules being bypassed. This patch also includes fixes for an unaligned timestamp issue, and reliability fixes for ipmon and the in-kernel ftp proxy. A jumbo patch exists, which remedies this problem, and updates ipf to version 3.3.16
June 2nd, 2000 An Introduction to IP Masquerading - Part 2
In mid-May, Linux.com released Part 1 - 'An Introduction to IP Masquerading.' Here is 2nd and final part of this article. "Now that relatively high-bandwidth Internet connections are becoming both commonplace and inexpensive, cable modem and DSL users wanting to put more than one computer on the Internet find that their Internet service provider will not allow them to do so. Typically, an ISP will grant a user a single, dynamically-allocated IP address to be used by only one computer at the user's home, in order to conserve their precious pool of IP addresses."
We are linking our company to the Internet, and we are discussing the placement of the firewall. I feel that the firewall should reside in-house for the best security; others want to put the firewall at our ISP and run a point-to-point T-1 between us. Although the risk is small, I think there is a risk of having an unprotected circuit between us and the firewall. Am I off-base?
Here is a pretty good article; you'll find the most relevant Linux information midway down..."The biggest security problem with Linux is its ability to run multiple processes with relative ease and giving certain users a lot of access to these processes. Those of you new to Linux might be scratching their heads since it looks like I just indicated one of Linux biggest strengths. "
"Each quarter, the CERT Coordination Centern issues the CERT Summary to draw attention to the types of attacks reported to our incident response team, as well as other noteworthy incident and vulnerability information. The summary includes pointers to sources of information for dealing with the problems."
Noel continues the story of when some Unix boxes that he helped admin were cracked. This article tells how they found the sniffer that the cracker was running on their network and what they did next. "We had thousands of logins each day from a large selection of places all over the world. Many of these users then connected to other systems using telnet or FTP. Each time one of our users connected to a system somewhere else the cracker had a new door that he could open. A new system that he could crack or just use to store things. To run his port redirector all he needed was a regular user account on a machine and then he had a new system to cover his tracks with. "
The System and Network Security group is is meeting with several key players in the information security arena on Friday to discuss and outline the 10 top security threats. "Tomorrow (June 1) the FBI, Justice Department, GSA, the CIAO and CERT/CC will join with SANS and two dozen leading security gurus to unveil the Top Ten Security Threats on the Internet. These are vulnerability clusters that account for the majority of all successful attacks. At noon (EST) on Thursday, you'll find the Top Ten posted at http://www.linuxsecurity.com/articles/projects_article-773.html
May 29th, 2000 IPv6 wins support as third-generation multimedia protocol
"... The proposal, which paves the way to make IPv6 the standard protocol in third-generation mobile multimedia networks, was accepted this week in a plenary session of the system architecture group of the 3GPP (Third-Generation Partnership Project), Nokia said in a statement."
This Linux.com article talks about a few of the sniffer tools that are available, and what can be done to detect their presence. "Sniffers represent a high level of risk because: they can capture passwords; they can capture confidential or proprietary information; and they can be used to breach security of neighboring networks, or gain leveraged access."
Jose Nazario has updated the .cf/.mc patch on his mirror site to include "Killer Resume" and was kind enough to share the fix with us. The patch, designed to block the ILOVEYOU worm and related worm/virus medleys, works on sendmail 8.9.x and above using the subject line checking options available.
May 31st, 2000 CIAC Revision: Buffer Overrun Vulnerabilities in Kerberos
The CERT Coordination Center has recently been notified of several buffer overflow vulnerabilities in the Kerberos authentication software. The most severe vulnerability allows remote intruders to gain root privileges on systems running services using Kerberos authentication. If vulnerable services are enabled on the Key Distribution Center (KDC) system, the entire Kerberos domain may be compromised
Dug Song has contributed Kerberos v4 (KPOP) and APOP authentication patches for popa3d v0.4. I've mirrored them into popa3d/contrib on the FTP and added links to the popa3d page at the usual location: http://www.openwall.com/popa3d/
This article talks about the need for encryption. Email, e-commerce, digital cash, the NSA's Echelon Project all lead to reasons why crypto is necessary. "... more and more of our private communications are being routed through electronic channels. Channels like e-mail are simply too easy to intercept and scan for interesting keywords. This can be done routinely, automatically, and imperceptibly on a very large scale."
This article explains the need and rationale for Secure SHell, an encrypted communications channel which functions as a telnet replacement, and also guides you through the process of installing and using SSH on your own system.
May 29th, 2000 Maths prize could revolutionise encryption
A £3.6m mathematics competition announced Wednesday could spark a revolution in computer security and online privacy experts believe. The competition is sponsored by the Clay Mathematics Institute in the US and was revealed at the Millennium Mathematics Conference in France. Entrants must tackle some of the world's most perplexing unsolved mathematical problems including the Reimann Hypothesis.
May 29th, 2000 Life in an Era of Cryptographic Abundance
In the Palo Alto area on June 20th? Xerox PARC is holding a free conference on the abundance of cryptography. "It seems clear to some that by 2010 cryptographic operations of all sorts will be as cheap and as plentiful as dirt, and that they will be as unremarkable then as IP stacks have become today. How will things be different in the coming era of abundant cryptography? How will our children keep a secret? What new businesses will arise?"
Reto Haeni has written this paper that gives a brief overview of the features of IPv6 and discuss its security specifications. In the later sections of the paper, he compares the security specifications of IPv6 to one of today's available security protocols, SSL (Secure Sockets Layer).
June 2nd, 2000 Retina™ The Network Security Scanner
"Retina is a network security scanner and monitor that helps discover and fix all known security vulnerabilities on your Internet, Intranet and Extranet systems. Retina includes easy to navigate reporting tools to help you prioritize and isolate high priority fixes giving you total control over auditing your network security and open gateways to your internal network."
June 2nd, 2000 Information on SANS Security DC2000
SANS Security DC2000 will be here July 5-10th, 2000. It is located at the JW Marriot Hotel in Washington DC. SANS will provide "In-depth training for people interested in developing skills and confidence as technical security professionals." The training includes security essentials, intrusion detection, firewalls, and Linux security.
June 1st, 2000 WetStone & SM&A Release Linux Deleted File Recovery Tool
WetStone Technologies, Inc. and SM&A are announcing the release of Extractor, a Linux RedHat deleted file recovery tool. The technology will assist law enforcement, goverment and commercial organizations in retrieving maliciously or accidentally deleted files within a Linux environment.
The latest version of nmap, a utility for port scanning networks, has been released. This tool should be in everyone's security arsenal. "The main addition is IP Protocol scan mode (-sO) which tells you what protocols the host allows over IP (such as TCP, UDP, IGMP, ICMP, SWIPE, EGP, etc). This release also includes some minor fixes & enhancements."
In the following interview with company president, CEO and founder Moiz Kahari, conducted as he was preparing to speak at the European Linux@Work Conference, the E-Commerce Times explores all things Linux and the operating system's role in the future of e-commerce.
June 3rd, 2000 Domain Hijacking Raises Security Issue
web.net and bali.com were stolen from their rightful owners last week. "In spite of a recent May 5th U.S. district court decision which declared that domain names are not property, and hence, can't be "stolen," domain thieves last weekend successfully hijacked two web site/domains from their rightful owners."
June 2nd, 2000 IT, Company Execs Add To Security Holes
The SANS threat list has become the focus this week. "The majority of successful attacks on computer systems via the Internet can be traced to exploitation of one of a small number of security flaws, SANS said. Most of the systems compromised in the Solar Sunrise Pentagon hacking incident were attacked through a single vulnerability. A related flaw was exploited to break into many of the computers later used in massive denial-of-service attacks."
June 2nd, 2000 Hackers' favorite security holes revealed
More on the recent SANS report. ""Many of the vulnerabilities on that list are well-known vulnerabilities that everyone knows about," said Sean Hernan, team leader for vulnerability handling at the Computer Emergency Response Team (CERT) Coordination Center at Carnegie Mellon University and one of more than 40 contributors to the report."
The CIO Council is asking every federal chief information officer to find and fix the lapses that made a top 10 list of critical Internet security threats. The list, released Thursday, includes problems that have solutions, but the solutions have not been put in place by federal systems administrators. So agency World Web Web sites keep getting hacked, and agencies keep ending up in the news after being hit by attacks that should not have happened, said Allan Paller, director of research at the SANS Institute, a group of federal, industry and academic experts that coordinated the list.
To retaliate or not to retaliate? In cyberspace, there is no simple answer. ... Most IT professionals interviewed for this story said they would not strike back in cyberspace, for fear of hitting an innocent bystander. But they're not averse to taking some action when they're sure of the perpetrator's identity.
May 31st, 2000 Internet to Transmit "Notarized" Documents
The 150,000-member National Notary Association (NNA) announced Friday that it would be introducing a "new and revolutionary" method to send secure, authenticated documents via the Internet. The formal introduction of what the NNA said was "groundbreaking" technology is scheduled to take place during the 22nd Annual National Notary Association Conference that will take place next month in Las Vegas.
A new law that lets banks, insurers, and brokerage houses merge and share your personal data has frightening implications for consumers. Your insurance company can now find out that you use your credit card to buy lots of big boxes of chocolate and bottles of wine. Never mind that these gifts were for business clients. Suddenly, your health and car insurance premiums rise because the company's actuarial computers think you're more likely to drive drunk or have a heart attack from eating all that chocolate.
ComputerCurrents reviews Simson Garfinkel's new book, "Database Nation". "Privacy? The very rich still can buy it. For the rest of us, however, it's almost dead. This is not news, Garfinkel concedes in his heavily researched, well-written study. Still, "Database Nation" dramatically chronicles a growing range of threats against information once considered personal, such as buying habits, credit histories, medical records, and telephone records."
If your agency deals in classified or sensitive information, you probably wage an ongoing war against Internet hackers. The danger isn’t so much from hackers’ creativity as much as it’s due to managers’ failures to seal security holes, establish policies for information sharing on intranets and public Web sites, and protect the data physically.
May 30th, 2000 Cross-Company Applications Open Up Security
The profusion of supply chain and other applications that involve data sharing between companies raises a number of security issues IT managers must sort through, including the ability of current security products to filter based on specific application and data types.
May 30th, 2000 Senate hears computer export control arguments
WASHINGTON--Efforts to ease Cold War export controls on high-performance computers could sacrifice national security interests for business gains, experts told a Senate hearing today. But an industry representative disagreed, saying change is essential if computer companies are to compete in a rapidly changing marketplace.
News: Forums
