-----Original Message----- From: InfraGard [mailto:infragard@private] Sent: Friday, June 06, 2003 6:41 AM To: Information Technology Subject: [Information_technology] Daily News 6/06/03 June 05, Reuters Variant of Bugbear virus spreading on PCs. A variant of the Bugbear worm, which spread around the Internet last October, opening back doors on computers and logging keystrokes, has started to infect users around the world, putting them at risk of losing confidential information. According to Mikael Albrecht of computer security company F-Secure, the worm includes a large list of domains belonging mostly to banks. "The list...includes banks from all over the world; Europe, US, Asia and Africa. Bugbear.B changes system settings if activated in one of these banks," he said. The worm variant is better at using addresses in a user's e-mail program than the original, sending itself to those addresses using the infected user's identity, said David Emm of anti-virus company Network Associates Inc. Once activated, Bugbear.B tries to disable some security programs and starts to snoop on an infected system. Bugbear.B takes advantage of a known vulnerability in Microsoft Corp.'s Internet Explorer and can be run automatically simply by reading the e-mail and not opening the attachment. Users are advised to keep their anti-virus software updated. Source: http://www.nytimes.com/reuters/technology/tech-tech-virus-bu gbear.html June 05, eSecurity Planet Draft vulnerabilities warning guidelines released. The Organization for Internet Safety (OIS) is proposing the use of binding arbitration to resolve conflicts and deadlocks between vendors and researchers. The OIS, a consortium of software vendors, security researchers and consultancies, issued a preliminary draft of best practices for reporting and responding to security vulnerabilities. "The Finder and Vendor must work together to develop a target timeframe that balances the risk posed by a particular vulnerability versus the engineering challenges associated with thoroughly investigating and effectively remedying it," the group said. Within that agreed-upon timeframe, the OIS proposes that predictable and regular communications occur between the Finder and Vendor. Once the investigation is complete and a remedy has been delivered, the Finder and Vendor observe a 30-day grace period during which they provide such details only to people and organizations that play a critical role in advancing the security of users, critical infrastructures, and the Internet. Upon the expiration of the grace period, these details can be shared more broadly," the group said. Source: http://www.esecurityplanet.com/trends/article.php/2217751 June 05, Federal Computer Week Bush proposes spectrum management plan. President Bush announced Thursday an initiative to improve the efficiency and management of radio frequency spectrum to keep pace with the expanding technologies. The spectrum policy initiative is intended balance the often competing interests of promoting economic growth, ensuring national security, and satisfying public safety, research and transportation infrastructure needs, according to White House officials. "The existing legal and policy framework for spectrum management has not kept pace with the dramatic changes in technology and spectrum use." The initiative, chaired by the Commerce Department, includes two actions: the development of an interagency federal spectrum task force and the convening of a series of public meetings. There are more than 140 million wireless phone customers, and businesses are increasing the installation of Wi-Fi systems for wireless computing, White House officials said. The government uses spectrum for radars, communications, geolocation and space operations. The Presidential Memo on Spectrum Policy is on the White House Website: http://www.whitehouse.gov/news/releases/2003/06/20030605-4.html. Source: http://fcw.com/fcw/articles/2003/0602/web-spectrum-06-05-03.asp June 04, National Journal Security officials urge more research into supercomputing. The nation's investment in supercomputing research and development has played a crucial role in national security, but more investment is needed to resolve numerous computational problems, a key National Security Agency (NSA) official said on Wednesday. George Cotter, chief of NSA's Office of Corporate Assessments, told attendees of an Army High-Performance Computing Research Center luncheon that the conclusion of a congressionally mandated study on high-end computing R&D determined a need for faster computing to enable the military to create better weapons, aircraft and ships, as well as to improve the nation's ability to monitor its nuclear-weapons stockpile. Faster computers also are needed to analyze intelligence data and build better mapping capabilities for the military, he said. The center has received $4 million in research funding annually over the past two years from the Army as the Pentagon decided to increase its focus on using supercomputing for military purposes. The program was initiated in 1990. Source: http://www.govexec.com/dailyfed/0603/060403td1.htm June 01, Information Security Cyber Corps' failing grades. Federal administrators are overhauling Cyber Corps because conflicting policies and management structures are making it increasingly difficult to place graduates of the infosec training program in government jobs. University coordinators say getting the first 50 Cyber Corps graduates into federal jobs proved extremely difficult. Federal agencies were unwilling to hire inexperienced security admins when more senior infosec positions went unfilled. Complicating the situation is the Office of Personnel Management (OPM), which is responsible for placing students but has little authority to compel placements. Officials are still working on details, but it has already been decided to reorganize Cyber Corps based on the Department of Defense's Information Assurance Scholarship Program. The government launched Cyber Corps in 2001 under the scholarship for service model. Students receive tuition and a stipend in exchange for serving in a summer internship and working at a government agency for up to two years. Cyber Corps has distributed nearly $30 million to upgrade university infosec programs and fund scholarships for 200 students at 13 universities certified as Centers for Academic Excellence by the National Security Agency. Source: http://www.infosecuritymag.com/2003/jun/cybercorps.shtml Internet Security Systems - AlertCon: 2 out of 4 https://gtoc.iss.net/ Last Changed 6 June 2003 Security Focus ThreatCon: 2 out of 4 www.securityfocus.com Last Changed 6 June 2003 Current Virus and Port Attacks Virus: #1 Virus in USA: BAT_SPYBOT.A Source: http://wtc.trendmicro.com/wtc/wmap.html, Trend World Micro Virus Tracking Center [Infected Computers, North America, Past 24 hours, #1 in United States] Top 10 Target Ports: 137 (netbios-ns), 80 (www), 1434 (ms-sql-m), 445 (microsoft-ds), 113 (ident), 139 (netbios-ssn), 53 (domain), 0 (---), 25 (smtp), 41170 (---) Source: http://isc.incidents.org/top10.html; Internet Storm Center _______________________________________________ Information_technology mailing list Information_technology@listserv
This archive was generated by hypermail 2b30 : Fri Jun 06 2003 - 09:32:27 PDT