[Moderator: Ugh. This kind of announcement is akin to me saying in tomorrow's paper: "Guns are a problem plaguing our society". A few problems come up in this piece. 1) It's amusing to see companies make announcements like this some year and a half after Aleph's paper on Buffer Overflows. 2) Buffer overflows have existed have been actively exploited for years. 3) They claim to have the only automated protection against overflows, yet Solar Designer released a linux kernel patch designed to automatically prevent Overflow attacks. 4) The wild claim at the end of protecting against everything, including "prevent the hacking of Web scripts and Sendmail programs". So now the program is protecting against ALL overflow attacks? I'd love to see what platforms this exists on, and has been thoroughly tested for. 5) The 'concrete' examples they list include the New York Times. Details of how the site was exploited have not been released as far as I have seen.] Forwarded From: darek milewski <darekmat_private> http://www.news.com/Investor/NewsItem/0,213,0~3~2~Computer%20Data%20Security~MEMCF~BLO~369703770~~~~~,00.html HURWITZ GROUP NAMES BUFFER OVERFLOW ATTACKS AS SIGNIFICANT THREAT Business Wire February 3, 1999, 9:25 a.m. PT t to Web Security; MEMCO's New SECURED for Internet Product Line Cited as Proactive Solution Business Editors/High Tech Writers REDWOOD CITY, Calif.--(BUSINESS WIRE)--Feb. 3, 1999--MEMCO Software, Inc. (Nasdaq: MEMCF), a leading provider of information security software, today announced the availability of a report issued by Hurwitz Group, a leading analyst firm specializing in strategic business applications, that explains the danger of buffer overflow attacks to Web security. The report describes traditional and new approaches to preventing this favorite hacker technique that is growing in popularity with the expansion of the Internet. MEMCO's recently announced SECURED for Internet, a new class of "Intrusion Prevention" products, is named in the report as proactively stopping the problem of buffer overflow attacks. The Hurwitz Group report entitled "The Buffer Overflow Problem," explores how corporate Internet servers have now become the most important line of communication with customers, partners and investors. With this increased connectivity, however, comes the real threat of criminal activity and exploitation due to unavoidable security holes and an increased knowledge of vulnerabilities on the part of hackers. Concrete examples of this security threat include the recently publicized attacks on corporate Web sites including the New York Times, the CIA and the Department of Justice. The Hurwitz report describes MEMCO's new SECURED product line with its patent-pending Stack Overflow Protection (STOP), and proven Dynamic Security Extension (DSX) technologies, as a "proactive" approach to preventing security attacks against the root or administrator account via buffer overflow. A complete copy of the Hurwitz report is available at www.memco.com. "Buffer overflow will continue to be a security problem until all system vulnerabilities are revealed and solutions are put in place," said Steven Foote, senior vice president of Hurwitz Group Inc. "MEMCO offers a proactive solution that makes it significantly easier to protect Internet applications by locking down critical operating system and application resources, preventing both external and internal hacker attacks." "With this report on buffer overflow, Hurwitz Group has exposed a serious obstacle for companies looking to adopt Internet technology for e-commerce and business-to-business communication," said Eli Singer, president of MEMCO software. "With SECURED for Internet, we have been able to neutralize buffer overflow attacks and place control back in the hands of our customers, enabling safe e-business." MEMCO's new SECURED for Internet product line protects the content and availability of Web, email and firewall servers against hacker attacks. This product line features MEMCO's STOP technology. STOP is the only automated solution that protects against stack (or buffer) overflow attacks, a primary technique used by hackers to gain administrator authority and unrestricted access to server content and resources. With SECURED, companies are able to protect home pages from unauthorized modifications, prevent the hacking of Web scripts and Sendmail programs, and keep firewalls properly configured and running. -o- Subscribe: mail majordomoat_private with "subscribe isn". Today's ISN Sponsor: Internet Security Institute [www.isi-sec.com]
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 13:18:08 PDT