[ISN] Linux Security Week - May 9th 2005
InfoSec News
isn at c4i.org
Tue May 10 03:16:13 EDT 2005
+---------------------------------------------------------------------+
| LinuxSecurity.com Weekly Newsletter |
| May 9th, 2005 Volume 6, Number 20n |
| |
| Editorial Team: Dave Wreski dave at linuxsecurity.com |
| Benjamin D. Thomas ben at linuxsecurity.com |
+---------------------------------------------------------------------+
Thank you for reading the LinuxSecurity.com weekly security newsletter.
The purpose of this document is to provide our readers with a quick
summary of each week's most relevant Linux security headlines.
This week, perhaps the most interesting articles include "Why Snort
makes IDS worth the time and effort," "Five Linux Security Myths You
Can Live Without," and "Backups tapes a backdoor for identity
thieves."
---
## Internet Productivity Suite: Open Source Security ##
Trust Internet Productivity Suite's open source architecture to
give you the best security and productivity applications available.
Collaborating with thousands of developers, Guardian Digital
security engineers implement the most technologically advanced
ideas and methods into their design.
Click to find out more!
http://store.guardiandigital.com/html/eng/products/software/ips_overview.shtml
---
LINUX ADVISORY WATCH
This week, perhaps the most interesting articles include ethereal,
prozilla, smartlist, kdewebdev, wireless-tools, gimp, bootparamd,
tcpdump, kdelibs, vte, php, words, util-linux, lapack, gnuutils,
and glibc. The distributors include Conectiva, Debian, Fedora,
Gentoo, and Red Hat.
http://www.linuxsecurity.com/content/view/119064/150/
---
Review: The Book of Postfix: State-of-the-Art Message Transport
I was very impressed with "The Book of Postfix" by authors Ralf Hildebrandt
and Pattrick Koetter and feel that it is an incredible Postfix reference.
It gives a great overall view of the operation and management of Postfix
in an extremely systematic and practical format. It flows in a logical
manner, is easy to follow and the authors did a great job of explaining
topics with attention paid to real world applications and how to avoid
many of the associated pitfalls. I am happy to have this reference in
my collection.
http://www.linuxsecurity.com/content/view/119027/49/
---
Introduction: Buffer Overflow Vulnerabilities
Buffer overflows are a leading type of security vulnerability. This
paper explains what a buffer overflow is, how it can be exploited,
and what countermeasures can be taken to prevent the use of buffer
overflow vulnerabilities.
http://www.linuxsecurity.com/content/view/118881/49/
---
Getting to Know Linux Security: File Permissions
Welcome to the first tutorial in the 'Getting to Know Linux Security'
series. The topic explored is Linux file permissions. It offers an
easy to follow explanation of how to read permissions, and how to set
them using chmod. This guide is intended for users new to Linux
security, therefore very simple.
http://www.linuxsecurity.com/content/view/118181/49/
--------
>> The Perfect Productivity Tools <<
WebMail, Groupware and LDAP Integration provide organizations with
the ability to securely access corporate email from any computer,
collaborate with co-workers and set-up comprehensive addressbooks to
consistently keep employees organized and connected.
http://ads.linuxsecurity.com/cgi-bin/newad_redirect.pl?id=gdn05
--> Take advantage of the LinuxSecurity.com Quick Reference Card!
--> http://www.linuxsecurity.com/docs/QuickRefCard.pdf
+---------------------+
| Security News: | <<-----[ Articles This Week ]----------
+---------------------+
* Review: Deep Inspection Firewalls
6th, May, 2005
If it were on public display, this portion of our Firewall Blowout
would be the geek equivalent of the Chicago Auto Show. Our Chicago
Neohapsis partner labs focused on the muscle cars: enterprise-class,
gigabit-capable network firewall appliances and turnkey systems that
support high-availability stateful failover, VPNs and centralized
management as well as DI (deep inspection), which we define as having
the ability not only to perform stateful packet filtering, but also
to inspect packet payloads higher up the OSI model using specific
attack signatures and Layer 7 protocol engines.
http://www.linuxsecurity.com/content/view/119072
* In praise of Gentoo
2nd, May, 2005
On the server end, you get the best release schedule in the business
for security updates and bug fixes. On the desktop, you get the
latest and greatest packages (if you enable 'beta' packages to be
used) like KDE 3.4 (which I'm running), X.org with awesome openGL
support, and a nicely compiled nvidia driver. Wonderful. Absolutely
wonderful.
http://www.linuxsecurity.com/content/view/119029
* From Operating System to Application: Web Survey Looks at Malware
Trends
5th, May, 2005
"Two years ago, this list was dominated completely by weaknesses in
operating systems," said SANS Institute Director of Research Alan
Paller. "Now we're seeing more and more vulnerabilities in
applications being exploited." The data also reveal that, for the
first time, some security Latest News about Security and anti-virus
software is vulnerable to hackers, creating a dangerous high-level
backdoor into users' systems.
http://www.linuxsecurity.com/content/view/119058
* Report: IT shops lax about logging
3rd, May, 2005
If a new report from the SANS Institute is any indication,
enterprises are jeopardizing security by taking a sloppy approach to
log keeping. As a result, the report recommends some companies
abandon home-grown logging systems in favor of commercial tools or
simply outsource the task.
http://www.linuxsecurity.com/content/view/119043
* Why Snort makes IDS worth the time and effort
5th, May, 2005
The decision of whether to implement an intrusion-detection system
(IDS) is a complicated one. Unfortunately, IDS has a well-deserved
reputation for requiring a lot of "care and feeding" and commercial
systems can be very expensive. However, there is an enterprise-grade
open source IDS called Snort that may tip the scales over to a "can't
lose" position.
http://www.linuxsecurity.com/content/view/119057
* BlueCat Networks Previews its Proteus Enterprise IP Address
Management
3rd, May, 2005
Networks, Inc., a leading provider of simple, secure and affordable
network security appliances, today announced that it is previewing
Proteus, its new enterprise class Internet protocol (IP) Address
Management (IPAM) system at Networld+Interop in booth # 1124.
http://www.linuxsecurity.com/content/view/119041
* Linux Labs International consolidates SELinux with Bproc
6th, May, 2005
Linux Labs International, Inc. ( LLII ), the world leader in
Linux-based clustered supercomputer engineering, announced today a
key milestone for security in supercomputing technology. With today's
release of Nimbus 4.0, its out-of-the-box Linux cluster distribution,
the leading Single System Image cluster architecture ( bproc ) is now
seamlessly integrated with SELinux, the Security Enhanced Linux
platform ( SELinux ).
http://www.linuxsecurity.com/content/view/119068
* Backups tapes a backdoor for identity thieves
2nd, May, 2005
Large companies are reconsidering their security and backup policies
after a handful of financial and information-technology companies
have admitted that tapes holding unencrypted customer data have gone
missing.
http://www.linuxsecurity.com/content/view/119030
* Netcraft Phishing Site Feed Available
2nd, May, 2005
Netcraft launched an anti-phishing system at the start of 2005:
people install a toolbar and effectively become part of a giant
neighbourhood watch system whereby the most experienced members of
the community can report phishing sites and effectively block them
for the rest of the community.
http://www.linuxsecurity.com/content/view/119035
* Infosecurity Europe 2005 Interviews
3rd, May, 2005
Rootsecure.net recently recorded a series of interviews with
attendees at .Infosecurity Europe 2005., .Europe's number one,
dedicated Information Security event.. Those interviewed include
representatives from eEye Digital Security, Zone-H, Forensic
Computing Ltd, British Computing Society, and a reformed serial
website defacer. They are downloadable in MP3 or OGG Vorbis format
http://www.linuxsecurity.com/content/view/119039
* China's largest bank switches to Linux
3rd, May, 2005
The Industrial Commercial Bank of China (ICBC) has decided to switch
its servers to the Linux operating system after signing an agreement
with Turbolinux.
http://www.linuxsecurity.com/content/view/119040
* Moving IT management to a new paradigm
4th, May, 2005
IT management software ranges from hundreds of point solutions to
huge integrated bundles for high-end enterprises. Aiming for a target
in between is Robert Fanini, co-founder and CEO of GroundWork Open
Source Solutions Inc., a startup in Emeryville, Calif., that has
built its simple, low-priced IT management package on open source
code. In this interview, Fanini explains how open source will open
the eyes of now-doubting chief information officers
(CIOs).
http://www.linuxsecurity.com/content/view/119048
* Is VoIP Service the Next Big Target for Hackers?
5th, May, 2005
Internet telephone service's appeal as a cutting-edge technology for
cutting phone costs is convincing more and more people to ditch their
landlines and go hi-tech with Voice over Internet Protocol.
http://www.linuxsecurity.com/content/view/119056
* Five Linux Security Myths You Can Live Without
6th, May, 2005
Before I wrote this article, I went to some Linux newsgroups to find
out what typical concerns among security-conscious Linux users might
be. I asked, simply, what they felt were the biggest myths
surrounding Linux security.
http://www.linuxsecurity.com/content/view/119065
* Sober Hasn't Slowed, Still Accounts For Four Of Five Worms And
Viruses
6th, May, 2005
Sober.p, the worm that stormed the Internet Monday, showed no signs
of fading away as of Thursday morning, an anti-virus vendor said.
http://www.linuxsecurity.com/content/view/119066
* Business inaction could lead to data privacy laws
2nd, May, 2005
U.S. businesses for years have urged the government to let them set
computer-security standards of their own, but their inability to do
so could now prompt Congress to step in, experts say.
http://www.linuxsecurity.com/content/view/119031
* House subcommittee elevates cybersecurity position
6th, May, 2005
A bill that would create a high-level cybersecurity official in the
U.S. Department of Homeland Security (DHS) was approved Wednesday by
a House of Representatives subcommittee.
http://www.linuxsecurity.com/content/view/119071
* How a Bookmaker and a Whiz Kid
Took On an Extortionist . and Won
3rd, May, 2005
The e-mail began, "Your site is under attack," and it gave Mickey
Richardson two choices: "You can send us $40K by Western Union [and]
your site will be protected not just this weekend but for the next 12
months," or, "If you choose not to pay...you will be under attack
each weekend for the next 20 weeks, or until you close your doors."
http://www.linuxsecurity.com/content/view/119042
* Hackers Widen Their Attacks
4th, May, 2005
Hackers continue to develop new ways to infiltrate computer systems,
staying one step ahead of software providers by targeting an array of
applications, according to a recent report from the SANS Institute
Latest News about SANS Institute.
http://www.linuxsecurity.com/content/view/119047
* Spying on the spyware makers
5th, May, 2005
The 25-year-old researcher has spent years analyzing how spyware and
adware programs work and publicizing his findings. That often results
in red faces and, occasionally, lawsuit threats from companies like
WhenU and Claria, formerly known as Gator.
http://www.linuxsecurity.com/content/view/119059
------------------------------------------------------------------------
Distributed by: Guardian Digital, Inc. LinuxSecurity.com
To unsubscribe email newsletter-request at linuxsecurity.com
with "unsubscribe" in the subject of the message.
------------------------------------------------------------------------
More information about the ISN
mailing list