******************** Windows & .NET Magazine Security UPDATE--brought to you by Security Administrator, a print newsletter bringing you practical, how-to articles about securing your Windows .NET Server, Windows 2000, and Windows NT systems. http://www.secadministrator.com ******************** ~~~~ THIS ISSUE SPONSORED BY ~~~~ Security Auditing and Configuration Analysis! http://list.winnetmag.com/cgi-bin3/flo?y=eMgt0CJgSH0CBw03C30A2 VeriSign - The Value of Trust http://list.winnetmag.com/cgi-bin3/flo?y=eMgt0CJgSH0CBw01bI0As (below IN FOCUS) ~~~~~~~~~~~~~~~~~~~~ ~~~~ SPONSOR: SECURITY AUDITING AND CONFIGURATION ANALYSIS! ~~~~ How many people have administrative rights in your network? How many unused user accounts are in your domains? What changes were made to your directories during the last week? Security vulnerabilities occur when you can't answer these questions. Don't be vulnerable to attacks from inside and outside your network. Aelita Enterprise Directory Reporter offers a comprehensive directory reporting and security assessment solution for Windows NT/2000, Active Directory, and Exchange. Improve security with network configuration, Group Policy, and user information that lets you locate and correct problems and implement enterprise-wide policies. Download a FREE evaluation copy. Put Aelita in the lab! http://list.winnetmag.com/cgi-bin3/flo?y=eMgt0CJgSH0CBw03C30A2 ~~~~~~~~~~~~~~~~~~~~ July 17, 2002--In this issue: 1. IN FOCUS - Unwise Connectivity; Microsoft Obtains Third-Party Protection; and Camera/Shy 2. SECURITY RISKS - Multiple Vulnerabilities in Microsoft SQL Server 2000 and MSDE 2000 - DoS in WatchGuard Firebox VPN Appliance - DoS in BEA WebLogic for Win2K and NT 3. ANNOUNCEMENTS - Register Today for Our Win2K Migration Web Seminar! - Enter the Windows & .NET Magazine/Transcender Sweepstakes! 4. SECURITY ROUNDUP - News: Survey Says Web Is More Vulnerable Than Ever - Feature: Security Holes Pop Up in Unexpected Places - Feature: Best Practices for Secure Administrator Accounts 5. HOT RELEASES - Sprint IP VPN Services: Special Offer - IBM E-Business Integration White Paper 6. SECURITY TOOLKIT - Virus Center - FAQ: How Can I Force a User to Use a Machine-Specific Group Policy Rather Than a User-Specific Group Policy? 7. NEW AND IMPROVED - Submit Top Product Ideas - Protect Your Valuable Notebook from Theft - Invisible Means Invulnerable 8. HOT THREADS - Windows & .NET Magazine Online Forums - Featured Thread: Blocking IRC Scripts 9. CONTACT US See this section for a list of ways to contact us. ~~~~~~~~~~~~~~~~~~~~ 1. ==== IN FOCUS ==== (contributed by Mark Joseph Edwards, News Editor, markat_private) * UNWISE CONNECTIVITY; MICROSOFT OBTAINS THIRD-PARTY PROTECTION; AND CAMERA/SHY According to a provocative article from the Associated Press (AP) wire last week (which draws information from a Los Angeles Times report), US power and energy companies "have become targets for computer hackers who have managed to penetrate energy control networks as well as administrative systems." http://www.cbsnews.com/stories/2002/07/08/tech/main514426.shtml The article reports that the online power and energy companies surveyed have experienced an average of 1280 attacks in the past 6 months alone. Riptech, which performed the study, said that the number of attacks represents a 77 percent increase over the number of attacks experienced last year. According to the article, FBI Cybercrime Director Ronald Dick said, "The event that I fear most is a physical attack in conjunction with the success of a cyber attack on an infrastructure such as electric power or 911." The report points out the weakest link in the energy and power companies' infrastructure: control systems that monitor power grids and govern the flow of oil and water through pipelines. Formerly, these systems weren't connected to public networks such as the Internet, but now they are--and, as a result, they're vulnerable to attack. The story begs the obvious question: Why would any entity connect extremely critical infrastructures (e.g., power companies, national 911 services) to the Internet? By doing so, they ask for serious trouble. Is that wise in times such as these? I don't think so. In other recent and interesting news, PC World reported that Microsoft has adopted NetScreen-500 to help protect its corporate network (see the first URL below). NetScreen Technologies (see the second URL below) issued a press release regarding the adoption. NetScreen-500 is a firewall/VPN combination appliance that, among other things, helps stop viruses and worms from propagating into a network. What makes this news strange is that Microsoft touts its Internet Security and Acceleration (ISA) Server 2000 (see the third URL below) as a product that "protects the enterprise network from hacker intrusion and malicious worms through application-level filtering." http://www.pcworld.com/news/article/0,aid,102626,tk,dn071202X,00.asp http://www.netscreen.com/products/index.html http://www.microsoft.com/isaserver/howtobuy/upgrade.asp Are you looking for a way to transmit sensitive information? A group that calls itself Hacktivismo has released a new tool called Camera/Shy at the Hackers On Planet Earth (HOPE) Conference in New York. Camera/Shy is a steganography tool that encrypts and stores data in graphical image files. Steganography adds extra data to a typical image file so that when someone views the file, it seems to contain an ordinary image. After data is stored in an image file, you can transmit the file, and the recipient can recover the data stored therein. According to Hacktivismo, the tool is easy to use. Camera/Shy targets users who work behind network border devices that filter or censor Internet content. You can find a temporary download site for Camera/Shy and its documentation at the first URL below. Let's hope nobody uses Camera/Shy to attack power and energy companies. For additional information about steganography, go to the second URL below. http://members.cox.net/osioniusx/CameraShy.exe http://www.secadministrator.com/articles/index.cfm?articleid=20057 ~~~~~~~~~~~~~~~~~~~~ ~~~~ SPONSOR: VERISIGN - THE VALUE OF TRUST ~~~~ FREE E-COMMERCE SECURITY GUIDE Is your e-business built on a strong, secure foundation? Find out with VeriSign's FREE White Paper, "Building an E-Commerce Trust Infrastructure." Learn how to authenticate your site to customers, secure your web servers with 128-Bit SSL encryption, and accept secure payments online. Click here: http://list.winnetmag.com/cgi-bin3/flo?y=eMgt0CJgSH0CBw01bI0As ~~~~~~~~~~~~~~~~~~~~ 2. ==== SECURITY RISKS ==== (contributed by Ken Pfeil, kenat_private) * MULTIPLE VULNERABILITIES IN SQL SERVER 2000 AND MSDE 2000 Cesar Cerrudo and Mark Litchfield of Next Generation Security Software discovered multiple vulnerabilities in Microsoft SQL Server 2000 and Microsoft SQL Server Desktop Engine (MSDE) 2000, the most severe of which can lead to remote compromise of the vulnerable server. Microsoft has released Security Bulletin MS02-034 (Cumulative Patch for SQL Server) to address this vulnerability and recommends that affected users download and apply the appropriate patch mentioned in the bulletin. These patches are cumulative and address all previously discovered vulnerabilities in the affected product. http://www.secadministrator.com/articles/index.cfm?articleid=25868 * DoS IN WATCHGUARD FIREBOX VPN APPLIANCE Andreas Sandor and Peter Grundl discovered a Denial of Service (DoS) condition in WatchGuard Technologies' Firebox with firmware 5.x.x. By sending a malformed packet to the listener service on TCP port 4110, an attacker can cause the Dynamic VPN Configuration Protocol (DVCP) service to fail. The vendor, WatchGuard, recommends that affected users upgrade their firmware to version 6.x.x, available through the company's LiveSecurity Service. http://www.secadministrator.com/articles/index.cfm?articleid=25812 * DoS IN BEA WEBLOGIC FOR WIN2K AND NT Peter Grundl discovered a Denial of Service (DoS) condition in BEA Systems' WebLogic Server when used with the performance pack, which installs by default. By data or connection flooding, an attacker can crash the Web service with a report of an error in ntdll.dll. The vendor, BEA Systems, has released a security advisory to address this problem and recommends that affected users apply the appropriate patch listed in this bulletin. http://www.secadministrator.com/articles/index.cfm?articleid=25811 3. ==== ANNOUNCEMENTS ==== (brought to you by Windows & .NET Magazine and its partners) * REGISTER TODAY FOR OUR WIN2K MIGRATION WEB SEMINAR! You can make the Windows 2000 road less bumpy--if you know how. Hear Jeremy Moskowitz talk about what to do before your Win2K migration actually begins, and what to be on the lookout for during the migration process. This special online event is scheduled for Thursday, July 18, so sign up today! http://list.winnetmag.com/cgi-bin3/flo?y=eMgt0CJgSH0CBw022F0A3 * ENTER THE WINDOWS & .NET MAGAZINE/TRANSCENDER SWEEPSTAKES! Nothing can help you prepare for certification like Transcender products, and no one can help you master your job like Windows & .NET Magazine. Enter our combined sweepstakes contest, and you could win a Transcender Deluxe MCSE Core Pak (a $569 value) or one of several other great prizes. Sign up today! http://list.winnetmag.com/cgi-bin3/flo?y=eMgt0CJgSH0CBw028j0Ak 4. ==== SECURITY ROUNDUP ==== * NEWS: SURVEY SAYS WEB IS MORE VULNERABLE THAN EVER A June 2002 Netcraft survey shows that Web sites are more vulnerable than ever because of several recently reported security problems with Microsoft IIS and Apache Web server. Netcraft polled 38,807,788 Web servers and found that 59.67 percent (more than 23 million sites) run Apache Web server and 28.96 percent run IIS. http://www.secadministrator.com/articles/index.cfm?articleid=25846 * FEATURE: SECURITY HOLES POP UP IN UNEXPECTED PLACES With so many obvious security holes that systems administrators must watch for, keeping up with all the potential problem areas that the Windows OSs present is tough. It's even worse when the security problems occur in a little-used but ubiquitous application such as the Windows Media Player (WMP). http://www.secadministrator.com/articles/index.cfm?articleid=25840 * FEATURE: BEST PRACTICES FOR SECURE ADMINISTRATOR ACCOUNTS Creating unique passwords for your Administrator accounts is one important step you can take to keep your systems secure. Dick Lewis offers best practices that can help you protect the powerful Administrator account from intruders. Be sure to read the article on our Web site! http://www.secadministrator.com/articles/index.cfm?articleid=25721 5. ==== HOT RELEASES ==== * SPRINT IP VPN SERVICES: SPECIAL OFFER For secure, global network access and great savings, visit http://ad.doubleclick.net/clk;4366192;7296505;q?http://www.sprintbiz.com/apps/tag/sprintbizQ2Growth/,16,27,S3,199/bsgpromo/ip1.html * IBM E-BUSINESS INTEGRATION WHITE PAPER Learn to remain competitive as e-business technologies evolve. The IBM white paper, "Managing e-business integration challenges," will help you understand how to identify key integration components. Get your complimentary copy at http://www.ibm.com/e-business/playtowin/n122 6. ==== SECURITY TOOLKIT ==== * VIRUS CENTER Panda Software and the Windows & .NET Magazine Network have teamed to bring you the Center for Virus Control. Visit the site often to remain informed about the latest threats to your system security. http://www.secadministrator.com/panda * FAQ: HOW CAN I FORCE A USER TO USE A MACHINE-SPECIFIC GROUP POLICY RATHER THAN A USER-SPECIFIC GROUP POLICY? ( contributed by John Savill, http://www.windows2000faq.com ) A. Typically, the settings that the OS applies when a user logs on are based on the user's account container (e.g., a domain, a site, an organizational unit--OU), regardless of which container the user's machine belongs to. In some instances, you might want to forgo using this default behavior and instead associate a user's settings with the location of the user's computer within Active Directory (AD). For example, you might want to set a strict, defined set of policies for a publicly accessible computer, regardless of who logs on to that computer. To establish machine-specific settings, use Group Policy to set the computer's container to "loopback" mode--so that the computer's client settings take precedence--by performing the following steps: 1. Start Group Policy Editor (GPE) and load the policy that affects the computer whose behavior you want to modify (alternatively, you can start the Microsoft Management Console--MMC--Active Directory Users and Computers snap-in, right-click the container, select Properties, then select the Group Policy tab). 2. Expand the Computer Configuration, Administrative Templates, System, Group Policy branches. 3. Double-click the "Loopback Policy" option (or "User Group Policy loopback processing mode" in Windows .NET Server--Win.NET Server). 4. Select the Enabled option, then select the Mode: - Merge Mode--loads a user's normal settings first, then loads any settings based on the computer's location, thus overwriting any conflicting user settings - Replace Mode--loads only settings based on the computer's location 5. Click OK. 7. ==== NEW AND IMPROVED ==== (contributed by Judy Drennen, productsat_private) * SUBMIT TOP PRODUCT IDEAS Have you used a product that changed your IT experience by saving you time or easing your daily burden? Do you know of a terrific product that others should know about? Tell us! We want to write about the product in a future What's Hot column. Send your product suggestions to whatshotat_private * PROTECT YOUR VALUABLE NOTEBOOK FROM THEFT Belkin released SafeTech, a line of security products for notebook computers, dock stations, flat-screen monitors, and other expensive computer devices. The SafeTech line features two locks: a keyless version, the SafeTech C100 Combo Security Lock at $24.95 and a keyed version, the SafeTech K100 Security Lock at $29.95. For more information, go to the Belkin Web site. http://www.belkin.com * INVISIBLE MEANS INVULNERABLE Gianus Technologies introduced Phantom Total Security (PTS), security software that can protect any type of computer data by making it invisible to attackers, unauthorized users, and even viruses. PTS splits a computer hard disk into two parts, then makes one part disappear with the simple click of an icon. PTS costs $190 and runs on multiple OSs on the same computer, each OS transparent to the other. Contact Gianus Technologies at 212-838-7070. http://www.phantomts.com 8. ==== HOT THREADS ==== * WINDOWS & .NET MAGAZINE ONLINE FORUMS http://www.winnetmag.com/forums Featured Thread: Blocking IRC Scripts (Two messages in this thread) Brett writes that one of his clients found that someone has gained access to the client's Windows 2000 server and installed an Internet Relay Chat (IRC) script that lets a remote user control the server. The script uses two programs, firedeamon.exe and srchost.exe. Brett wants to know the best way to prevent the installation of such scripts. http://www.secadministrator.com/forums/thread.cfm?thread_id=108852 9. ==== CONTACT US ==== Here's how to reach us with your comments and questions: * ABOUT IN FOCUS -- markat_private * ABOUT THE NEWSLETTER IN GENERAL -- vpattersonat_private (please mention the newsletter name in the subject line) * TECHNICAL QUESTIONS -- http://www.winnetmag.com/forums * PRODUCT NEWS -- productsat_private * QUESTIONS ABOUT YOUR SECURITY UPDATE SUBSCRIPTION? Customer Support -- securityupdateat_private * WANT TO SPONSOR SECURITY UPDATE? emedia_oppsat_private ******************** This email newsletter is brought to you by Security Administrator, the print newsletter with independent, impartial advice for IT administrators securing a Windows 2000/Windows NT enterprise. Subscribe today! http://www.secadministrator.com/sub.cfm?code=saei25xxup Receive the latest information about the Windows and .NET topics of your choice. Subscribe to our other FREE email newsletters. http://www.winnetmag.com/email |-+-|-+-|-+-|-+-|-+-| Thank you for reading Security UPDATE. MANAGE YOUR ACCOUNT You can manage your entire Windows & .NET Magazine Network email newsletter account on our Web site. Simply log on and you can change your email address, update your profile information, and subscribe or unsubscribe to any of our email newsletters all in one place. http://www.winnetmag.com/email Thank you! - ISN is currently hosted by Attrition.org To unsubscribe email majordomoat_private with 'unsubscribe isn' in the BODY of the mail.
This archive was generated by hypermail 2b30 : Thu Jul 18 2002 - 08:03:01 PDT