HNS Newsletter Issue 59 - 16.04.2001 http://net-security.org http://security-db.com This is a newsletter delivered to you by Help Net Security. It covers weekly roundups of security events that were in the news the past week. Visit Help Net Security for the latest security news - http://www.net-security.org. Subscribe to this weekly digest on: http://www.net-security.org/text/newsletter Archive of the newsletter in TXT and PDF format is available here: http://www.net-security.org/news/archive/newsletter Table of contents: 1) General security news 2) Security issues 3) Security world 4) Featured products 5) Featured article 6) Security software 7) Defaced archives ======================================================== Secure Exchange 2000 against email attacks/viruses! ======================================================== GFI’s Mail essentials for Exchange 2000 is now available! It can protect Exchange 2000 from all kinds of email-borne threats, like viruses, dangerous attachments, email attacks, spam and offensive content. Download your evaluation copy from: http://www.gfi.com/secdblanmesnl.shtml ======================================================== General security news --------------------- ---------------------------------------------------------------------------- CISCO SECURE PIX FIREWALL The Cisco Secure PIX Firewall is the dedicated firewall appliance in Cisco's firewall family and holds the top ranking in both market share and performance. The Cisco Secure PIX Firewall delivers strong security and, with market-leading performance, creates little to no network performance impact. The product line enforces secure access between an internal network and Internet, extranet, or intranet links. Link: http://www.security-db.com/product.php?id=680&cid=152 PORT NUMBERS 7001 THROUGH 65535 A port is a point of connection. In networking, a port acts as the door at each end of a connection through which client/server/peer programs tranfer information during a data exchange. Whenever a network program initiates activity with a remote system, a port is opened up, both locally and remotely, to allow the exchange to take place. Here are links to TCP/IP port lists, which are a valuable resource for anyone involved with firewall configuration or maintenance. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://securityportal.com/firewalls/ports/ HACKERS WORK FROM WITHIN A study of 1,238 companies, conducted by the KPMG consultancy, found that 90 percent of firms expected their e-commerce systems would be breached by hackers. But KPMG warned that most attacks would be carried out by members of staff. Norman Inkster, president of KPMG Investigation and Security, said studies by KPMG over the last decade had found that 70 percent of fraud was carried out by insiders. "Most security breaches are carried out by individuals who possess intimate knowledge of the systems which they are attacking," he added. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.zdnet.co.uk/news/2001/14/ns-22143.html AUSTRALIAN HACKERS FACE JAIL TIME "People who believe causing damage by hacking or spreading viruses to be trivial or even amusing activities are wrong. These are serious crimes in the 21st century and people can face up to 10 years in jail if convicted," State Attorney General Bob Debus said in a statement. The NSW Government has proposed amendments to the Crimes Act to include provisions covering cyberoffences. "The new offences are based on the latest international moves to fight cybercrime. They will ensure that NSW criminal laws keep pace with international technology and that appropriate penalties are in place," Debus said. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.zdnet.com/zdnn/stories/news/0,4586,2705803,00.html CONGRESS ADDRESSES CYBER SECURITY ONCE AGAIN The security of the U.S. government's information technology (IT) systems is receiving renewed focus in the U.S. Congress. The House Oversight and Investigations Subcommittee April 5 heard testimony on efforts that various government agencies are taking to protect these systems. Subcommittee Chairman Billy Tauzin, a Republican Congressman from Louisiana, opened the session expressing concern about reports of vulnerabilities across the government. Tauzin specifically referred to a newly completed independent auditor's report of the Department of Health and Human Services which showed that electronic data processing systems were weakly controlled, leaving them exposed to a variety of potential problems. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://cipherwar.com/news/01/usgov_comp_sec.htm SECURITY AUDITING TOOLS FOR THE MACINTOSH "There really aren't any 'security' tools for the Macintosh to ensure secure passwords. Just lots of text files and reports by hackers on how it's insecure. We will review two programs created by hackers, which can be used for security purposes, and can be used by a hacker. The reason we are reviewing these hackers programs is to bring to light that you need to know the tools that hackers are using to ensure your own security. Get the programs before the wrong people do and use them on your unsuspecting computers. We will review these programs from a system administrators' point of view." Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.securemac.com/secauditing.cfm CYPHERPUNK'S FREE SPEECH DEFENSE Jim Bell took the witness stand in federal court on Friday to argue he was attempting to document illegal behavior, not stalk government agents. Bell described his electronic research last year - which the Justice Department says led federal agents to fear for their safety - as entirely lawful and said he never intended to hurt or threaten anyone. The 43-year-old chemist and entrepreneur freely admitted he bought motor vehicle databases and did Internet searches on the names of Treasury Department agents as part of his effort to uncover illegal surveillance by the U.S. government. Bell is charged with five federal counts of interstate stalking. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.wired.com/news/politics/0,1283,42909,00.html HACKERS TURN RACIST IN ATTACK ON HARDWARE SITE PC motherboard specialist PC Chips has fallen victim to defacement in an attack that shows that hackers can be unthinking racists. The home page of the site, which runs Apache on a Red Hat Linux server, was replaced by a message from the 1i0n Crew, which contained in its headline the racist remark "Kill all the Japanese!". Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.theregister.co.uk/content/8/18181.html NEW VIRUS WRITTEN IN LOGO LANGUAGE A virus that announces itself with lyrics from a song performed by a Belgiantechno dance band is written in programming language by Logotron, a educational software publisher, an anti-virus service said today. The proof of concept I-Worm.LogoLogic.A is the first-ever virus written using SuperLogo, said Medina, Ohio-based Central Command Inc. The language is used to train programming students in application development, the company said. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.newsbytes.com/news/01/164290.html RSA SAYS DEMAND FOR SECURITY SERVICES STILL STRONG RSA Security Inc. said that demand remains strong for its authentication and encryption services, despite fears over a slowdown in information technology spending that has battered the shares of many Nasdaq-listed security vendors. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.siliconvalley.com/docs/news/tech/037891.htm BRUCE SCHNEIER: 'WE ARE LOSING THE BATTLE' Cryptographer Bruce Schneier reiterated his managed security services gospel in a talk here on the opening day of the RSA Security Conference. But if his message is really being heard, there should be general panic among CIOs in corporate America. "The future of Internet security is not very good," Schneier said. "New methods are being invented, new tricks, and every year it gets worse. We are not breaking even. We are losing the battle." Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.zdnet.com/zdnn/stories/news/0,4586,2705973,00.html PGP WORKING WITH NSA ON SELINUX A division od PGP Security has entered into a partnership with the National Security Agency and other partners to further develop the NSA's Security Enhanced Linux prototype. Under a $1.2 million 2-year contract, the NAI Labs division of PGP Security will focus on research and development to improve the security of open-source operating system platforms, particularly Linux, PGP Security said. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.infoworld.com/articles/hn/xml/01/04/09/010409hnselinux.xml COMPUTER FORENSICS Numerous companies may be battening down their hatches with this or that security tool, yet more than a few still experience payloads from viruses, breaches from script kiddies and data theft from internal employees. On the face of it, a cybercrime treaty that eases the investigative processes for police agencies around the world may be a move in the right direction, but for countless victims, just understanding what action they can take to determine how an assault on their networks happened at all is of more urgent concern. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.scmagazine.com/scmagazine/2001_04/cover/cover.html MEET THE ‘CYBER AVENGERS’ Kris Haworth pounded away at her keyboard, navigating a labyrinth of computer data in her search for evidence. The board of directors for a $5 billion company suspected revenues were being inflated. It was up to Haworth to fish out incriminating e-mails thought to have been deleted. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.msnbc.com/news/555451.asp DESIGNING SECURE NETWORKS It has been asserted that advancements in software development have come about mainly as a result of the introduction of the software process model or software lifecycle. SecurityFocus writer Paul Innella argues that, in a similar manner, network security designers can benefit from using the principles of the software process model. In this article, the author outlines eight phases of the software process models as they apply to the design of a secure network. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.securityfocus.com/focus/basics/articles/netsec.html INTRODUCTION TO DIGITAL SIGNATURES IN JAVA In public key cryptography, there are two keys. One is used by the sender and is usually private. One is used by the receiver and is usually public. The sender uses the private key to encode a message or data, and the receiver uses the public key to decode the message. Digital signatures work just like public key cryptography. The signer encodes data with his own private key, and then anyone with his public key can decode it. This allows any receiver to verify the source or signer of data as accurate and guarantee its integrity and authenticity. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://softwaredev.earthweb.com/java/sdjjavaee/article/0,,12396_630851,00.html GERMAN THREAT RAISES INFOWAR FEAR At least, that's the threat that Interior Minister Otto Schily has made, vowing the German government may resort to denial-of-service attacks as a way to shut down U.S. and other foreign websites that help German neo-Nazis. Condemnation of the plan was immediate. But as of Monday afternoon in Germany, Schily's office had reported no backtracking from his statement, which has been the focus of recent media attention in Germany. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.wired.com/news/politics/0,1283,42921,00.html ONLINE FRAUD WORRIES EBUSINESSES Forty-six percent of global companies doing business online believe that online fraud is either a "somewhat" or "very" significant problem, according to a recent survey of 140 members of the Worldwide E-Commerce Fraud Prevention Network. Only 1 percent do not worry about it. The study found that 70 percent believe there are prevention tools that can keep e-fraud to a minimum. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.business2.com/content/research/numbers/2001/04/10/29756 FREEDOM2SURF OFFERS FREE PRIVACY SUITE Freedom2Surf, one of the UK's most advanced ISPs, today built on the security and privacy already offered to its users by announcing it is the first company in the UK to offer its subscribers free access to a range of privacy and security features with the Freedom 2.0 Internet Privacy Suite from Zero-Knowledge Systems. Freedom 2.0 will be made available to all new and existing Freedom2Surf subscribers as a free download for a limited time. Link: http://www.net-security.org/text/press/986894868,73460,.shtml NFR NETWORK INTRUSION DETECTION NFR Network Intrusion Detection (NFR NID) is an intrusion detection system that unobtrusively monitors networks in real time for activity such as known attacks, abnormal behavior, unauthorized access attempts and policy infringements. Information associated with activity that may be suspicious is recorded and alerts raised as necessary. Link: http://www.security-db.com/product.php?id=688&cid=153 THE SILENCE OF THE HACKED Almost every day, Internet news sites break stories about newer and ever-more dangerous breaches in computer security. But unless the story involves a virus named after a good-looking tennis star, it probably won't make the national news. This worries Kevin Poulsen, a former hacker who now works as the editorial director of SecurityFocus.com. Poulsen said that because several of the biggest hacking stories don't make the headlines, the public is mostly ignorant about what's been hacked, and what companies are doing to bolster security. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.wired.com/news/technology/0,1282,42945,00.html SECURITY FLAW FOUND IN ALCATEL DSL MODEMS The security problems could allow a hacker to bypass users' passwords and alter the devices, making them temporarily or permanently unusable, researchers said. A hacker also could potentially install code to gather unencrypted credit card information or read unencrypted e-mail messages, investigators said. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://news.cnet.com/news/0-1004-200-5567751.html GERMAN POL BACKTRACKS ON HACK Germany Interior Minister Otto Schily has taken at least a half-step back from a threat to use denial-of-service attacks to shut down neo-Nazi websites in the United States and elsewhere. The statement Tuesday by Schily's spokesman was expected, given the furor in Germany and elsewhere over the idea of a government potentially getting into the hacking business. "It's wrong to talk about hacking," Schily spokesman Dirk Inger said, suggesting that media accounts had misinterpreted Schily's previous remarks. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.wired.com/news/politics/0,1283,42961,00.html RUSSIAN HACKER RECRUITED BY AMERICANS American diplomats in Moscow recruited a local hacker called 'Vers' to break into computers serving Russia's domestic security agency, the FSB, early this year, it was claimed yesterday. Link: http://www.telegraph.co.uk/et?ac=000579381554028&rtmo=gjngwNku&atmo=99999999&pg=/et/01/4/11/whack11.html CRACKS HAPPEN The various seminars and exhibits at the computer security show here occupy not only an entire wing of the Moscone Convention Center, but also the 15 movie theaters across the street at Sony's Metreon entertainment complex. The RSA Conference is huge; and its size is a testament to the fact that, given the increasing cost of computerized mischief, tech firms are starting to devote serious money to securing their data. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.wired.com/news/culture/0,1284,42984,00.html A CHINESE CALL TO HACK U.S. Chinese crackers are being encouraged to "hack the USA" in retaliation for the mid-air collision between a U.S. spy plane and a Chinese fighter jet which claimed the life of a Chinese pilot. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.wired.com/news/politics/0,1283,42982,00.html MICROSOFT MAKES 'CLEAN BREAK' ON SECURITY POLICY During his keynote speech at the RSA Security Conference, David Thompson, vice president for the Windows product server group, stressed that there has been a companywide focus on improving the security of Microsoft's products over the last year, from the top of the organization down. "We've made a clean break with our past policy on security," said Scott Culp, security program manager at Microsoft. "We recognize that every piece of software has vulnerabilities and bugs. We have to deal with them." Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.zdnet.com/eweek/stories/general/0,11011,2706838,00.html CARE AND FEEDING OF RPM RPM is a very complex and powerful tool for building software packages. Blindly downloading and installing RPM's is of course very dangerous (this goes for installing software on any operating system). If you choose to build foreign RPM's on your machine then you should inspect the SPEC file for malicious commands and also verify the source code used and any patches. The good news is that verifying the origin of RPM's is relatively easy, and as the majority of your RPM's will likely come from trusted sources, you should not have too many problems. Lastly, with the use of scripts and triggers you can easily build RPM's that will notify you when installed (e.g. implement a command to send mail out so you know when someone has upgraded a machine), or properly clean up after themselves. Used properly, RPM is a very powerful tool. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://securityportal.com/closet/closet20010411.html HACKER TOOLS AND THEIR SIGNATURES, PART ONE: BIND8X.C This article is the first in a series of papers detailing hacker exploits/tools and their signatures. This installment will examine the Berkley Internet Name Domain exploit bind8x.c. The discussion will cover the details of bind8x.c and provide signatures that will assist an IDS analyst in detecting it. This paper assumes that the reader has some basic knowledge of TCP/IP and understands the tcpdump format. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.securityfocus.com/focus/ids/articles/bind8.html ANTI-VIRUS WITH SENDMAIL AND FBSD This is a very nice add on for ISPs or someone that wants to safeguard all email coming into their system from viruses. The following article will walk you through installing and setting up several programs, to get this project done. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.defcon1.org/html/Linux_mode/install-swap/anti-virus-sendmail.html ALCATEL WORKING WITH CERT In response to security issues raised by the San Diego Supercomputer Center Monday regarding certain Alcatel ADSL modems, the French communications equipment maker said that it is aware of vulnerabilities and is working with the CERT Coordination Center to resolve the problems. Alcatel also said that it is not aware of any instance where a Speed Touch Home ADSL modem user's device has been compromised due to the reported vulnerabilities. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.internetnews.com/prod-news/article/0,,9_741871,00.html SECURITY FOR WEB DATABASE APPLICATIONS If you're using a development tool like ColdFusion, ASP, or PHP, your application developers have probably unknowingly opened holes directly into your database that could wreak havoc on your system. Not obscure, difficult-to-exploit holes, but real big delete-everything-from-the-database kind of holes. Today, we're going to discuss how those security holes arise and more importantly, how to plug them. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://webreview.com/2001/04_13/developers/index02.shtml MAKE SSH DO MORE Presumably you have already installed SSH and are using it to securely log in to remote systems. However, most people simply connect via SSH, enter their passwords, and type away. They don't realize that SSH has advanced key management features that allow them to avoid having to retype their passwords; that its port-forwarding options can secure other, normally insecure, packages; and that they can employ little tricks in SSH that would make their lives easier. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.itworld.com/Comp/2384/LWD010410sshtips/ LINUX SECURITY MODULE INTERFACE "One of the byproducts of the Linux 2.5 Kernel Summit was the notion of an enhancement of the loadable kernel module interface to facilitate security oriented kernel modules. The purpose is to ease the tension between folks (such as Immunix and SELinux) who want to add substantial security capabilities to the kernel, and other folks who want to minimize kernel bloat & have no use for such security extensions. We have started a new mailing list called linux-security-module. The charter is to design, implement, and maintain suitable enhancements to the LKM to support a reasonable set of security enhancement packages. The prototypical module to be produced would be to port the POSIX Privs code out of the kernel and make it a module. An essential part of this project will be that the resulting work is acceptable for the mainline Linux kernel." Link: http://linuxtoday.com/news_story.php3?ltsn=2001-04-12-021-20-SC-KN WAR DRIVING BY THE BAY In a parking garage across from Moscone Center, the site of this year's RSA Conference, Peter Shipley reaches up though the sunroof of his car and slaps a dorsal-shaped Lucent antenna to the roof. "The important part of getting this to work is having the external antenna. It makes all the difference" says Shipley, snaking a cable into the car and plugging it into the wireless network card slotted into his laptop. The computer is already connected to a GPS receiver. He starts some custom software on the laptop, starts the car and rolls out. Shipley, a computer security researcher and consultant, is demonstrating what many at the security super-conference are quietly describing as the next big thing in hacking. It doesn't take long to produce results. The moment he pulls out of the parking garage, the laptop displays the name of a wireless network operating within one of the anonymous downtown office buildings: "SOMA AirNet." Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.securityfocus.com/news/192 EX-CYBERCOP: HACKERS NOT THE ONLY PROBLEM Malicious intruders, corporate espionage and uneducated employees all contribute to make "network security" almost an oxymoron in today's wired world, four security experts agreed at the RSA Data Security Conference. "It's not just the hackers who are the threats but all of us who are part of the problem as well," said Vatis, former executive director of the federal government's National Infrastructure Protection Center. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://news.cnet.com/news/0-1003-200-5586254.html CAN MCVEIGH KILLING BE HACKED? Security experts said it would be difficult, but not impossible, to intercept and decode the closed-circuit video of Timothy McVeigh's execution. The Justice Department won't say much about the measures it is taking to ensure that the pictures of the May 16 execution are not made public. Attorney General John Ashcroft kept his description of the transmission methods vague when speaking to reporters. "The broadcast will use the latest encryption technology integrated with state-of-the-art video-conferencing over high-speed digital telephone lines," Ashcroft said. "Federal regulations prohibit any recording of the execution. Therefore, any closed-circuit transmission will be instantaneous and contemporaneous." Security experts say Ashcroft was describing ISDN, short for Integrated Services Digital Network. ISDN lines can transmit data at least twice as fast as normal telephone lines, although the data travels through public phone networks. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.wired.com/news/politics/0,1283,43040,00.html CLOSED SOURCE IS MORE SECURE - MS The head of Microsoft's security response team argued that closed source software is more secure than open source projects, in part because nobody's reviewing open source code for security flaws. "Review is boring and time consuming, and it's hard," said Steve Lipner, manager of Microsoft's security response center. "Simply putting the source code out there and telling folks 'here it is' doesn't provide any assurance or degree of likelihood that the review will occur." Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.theregister.co.uk/content/8/18286.html BADTRANS VIRUS FAILS TO SPREAD A virus that monitors a PC's network connections and sends itself in response to any incoming e-mail has apparently failed to spread, despite, or because of, warnings issued by several major antivirus software makers. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.zdnet.com/zdnn/stories/news/0,4586,5081157,00.html EICAR TEST FILE In 1996, the European Institute for Computer Antivirus Research (EICAR) developed the EICAR test file. The EICAR test file tests the functionality of antivirus software, by giving the antivirus software a chance to detect the EICAR file during antivirus scans. The test file may render a variety of results within various antivirus programs but is NOT a virus. All major antivirus software developers support the EICAR test file. If your antivirus software detects the EICAR test file it does NOT guarantee that it will catch all malware. In fact, no single antivirus solution is able to block all malware. Thus, the EICAR test file, safe computing practices, and updated antivirus software are just a few of the tools that users will want to employ to lower the risk of malware infections. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://securityportal.com/articles/eicar20010413.html ---------------------------------------------------------------------------- Security issues --------------- All vulnerabilities are located at: http://net-security.org/text/bugs ---------------------------------------------------------------------------- RED HAT LINUX - NTPD REMOTE ROOT EXPLOIT The Network Time Daemon (ntpd) supplied with all releases of Red Hat Linux is vulnerable to a buffer overflow, allowing a remote attacker to potentially gain root level access to a machine. All users of ntpd are strongly encouraged to upgrade. Link: http://www.net-security.org/text/bugs/986822554,64400,.shtml CALDERA - REMOTE ROOT EXPLOIT IN NTPD Link: http://www.net-security.org/text/bugs/986822600,4830,.shtml TALKBACK.CGI SECURITY VULNERABILITY Talkback.cgi may allow remote users (website visitors) to view any file on a webserver (depending on the user the webserver is running on). Regard this URL: http://www.VULNERABLE-HOST.com/cgi-bin/talkback.cgi?article= ../../../../../../ ../../etc/passwd%00&action=view&matchview=1 This will display the /etc/passwd (if the webserver user has access to this file). Link: http://www.net-security.org/text/bugs/986899132,17397,.shtml DEBIAN LINUX - NTP UPDATE Przemyslaw Frasunek reported that ntp daemons such as that released with Debian GNU/Linux are vulnerable to a buffer overflow that can lead to a remote root exploit. A previous advisory (DSA-045-1) partially addressed this issue, but introduced a potential denial of service attack. This has been corrected for Debian 2.2 (potato) in ntp version 4.0.99g-2potato2. We recommend you upgrade your ntp package immediately. Link: http://www.net-security.org/text/bugs/986899319,43520,.shtml SUSE LINUX - UPDATED XNTP PACKAGES Link: http://www.net-security.org/text/bugs/986899379,2605,.shtml PROGENY - MAILX BUFFER OVERFLOW Mailx is a simple program to read and send e-mail. Mailx is installed setgid mail on Progeny and Debian systems. A buffer overflow in mailx allows for a local user to gain access to the mail group, which would allow that user to read and write to other mail spools. Debian resolved this problem by no longer shipping mailx setgid mail. Progeny has decided to use Debian's fix. This means that on mail systems that do not have world writable mail spools one will not be able to properly lock one's mailbox. Link: http://www.net-security.org/text/bugs/986899525,60483,.shtml VULNERABILITIES IN MULTIPLE FTP DAEMONS Multiple FTP server implementations contain buffer overflows that allow local and remote attackers to gain root privileges on affected servers. These vulnerabilities are contingent upon the remote user having the ability to create directories on the server hosting the FTP daemon, with the exception of a few cases noted below. The vulnerabilities presented are all related to the use of the glob() function, and can be divided into the following two categories: - glob() expansion vulnerabilities User input that has been expanded by glob() can exceed expected lengths and trigger otherwise benign buffer mismanagement problems present in certain FTP daemons. - glob() implementation vulnerabilities Certain implementations of the glob() function contain buffer overflows. These vulnerabilities are exploitable through FTP daemons that utilize these problematic implementations. CVE Candidate numbers for these issues have been assigned and are listed in the Vulnerable Systems section. Link: http://www.net-security.org/text/bugs/986909866,42751,.shtml SOLARIS KCMS_CONFIGURE VULNERABILITY The problem exists in the parsing of command line options. By exploiting this vulnerability an attacker can achieve local root privileges. The Kodak Color Management System (KCMS) packages have contained many vulnerabilities in the past, we recommend disabling them if you are not currently using them. Link: http://www.net-security.org/text/bugs/986909911,14102,.shtml SUSE - MIDNIGHT COMMANDER VULNERABILITY The Midnight Commander, mc(1), is a ncurses-based file manager. A local attacker could trick mc(1) into executing commands with the privileges of the user running mc(1) by creating malicious directory names. This attack leads to local privilege escalation. Link: http://www.net-security.org/text/bugs/986980267,29692,.shtml ORACLE APPLICATION SERVER VULNERABILITY An exploitable buffer overflow has been identified in a shared library which is being shipped with Oracle Application Server 4.0.8.2, and used by iPlanet Web Server if it is configured as external web-listener. Link: http://www.net-security.org/text/bugs/986980304,50130,.shtml PGP 7.0 SPLIT KEY/CACHED PASSPHRASE VULNERABILITY Wkit Security AB has found that if any caching option in PGP Desktop Security 7.0 is activated there is a vulnerability that allows a malicious user to encrypt/ decrypt or sign any file or e-mail with a split key that has been previously authenticated by an appropriate number of split-key shareholders. Link: http://www.net-security.org/text/bugs/986980500,97972,.shtml RED HAT - NEW NETSCAPE PACKAGES New netscape packages are availabe to fix a problem with the handling of JavaScript in certain situations. By exploiting this flaw, a remote site could gain access to the browser history, and possibly other data. Link: http://www.net-security.org/text/bugs/986999609,13050,.shtml GHOST MULTIPLE DENIAL OF SERVICE The first flaw involves the database engine, which isn't a Symantec product, but it is shipped with Symantec Ghost 6.5 (and possibly older versions as well). The database engine is the run-time engine by Sybase. Connecting to the database engine on tcp port 2638 and sending a string of approx. 45Kb will cause a buffer overflow that results in registers being overwritten. The database engine needs to be restarted in order to regain functionality. "State Dump for Thread Id 0x5c8 eax=0063f0e4 ebx=0063f204 ecx=41414141 edx=41414141 esi=00630020 edi=00630000 eip=65719224 esp=08fbfbf0 ebp=00000000 iopl=0 nv up ei pl nz na po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010206" The Ghost Configuration Server is running on TCP port 1347. It is periodically vulnerable to crash triggered the same way as the database engine overflow. This is not a buffer overflow, and can only be used as a DoS attack. Link: http://www.net-security.org/text/bugs/987079641,96179,.shtml PROGENY - EXECVE()/PTRACE() EXPLOIT This vulnerability exploits a race condition in the 2.2.x Linux kernel within the execve() system call. By predicting the child-process sleep() within execve(), an attacker can use ptrace() or similar mechanisms to subvert control of the child process. If the child process is setuid, the attacker can cause the child process to execute arbitrary code at an elevated privilege. Link: http://www.net-security.org/text/bugs/987079790,60855,.shtml LOTUS DOMINO MULTIPLE DOS The Lotus Domino Web Server contains multiple flaws that could allow an attacker to cause a Denial of Service situation. Link: http://www.net-security.org/text/bugs/987079825,54870,.shtml CFINGERD REMOTE VULNERABILITY There is a critical bug in cfingerd daemon <= 1.4.3, (a classic format bug) that makes possible to acquire full control over the remote machine if it runs the cfingerd program, the configurable and secure finger daemon. Link: http://www.net-security.org/text/bugs/987151748,43182,.shtml IBM WEBSPHERE/NETCOMMERCE3 DOS Exploit: http://host/cgi-bin/ncommerce3/ExecMacro/macro.d2w/NOEXISTINGHTMLBLOCK Result: DTWP029E: Net.Data is unable to locate the HTML block NOEXISTINGHTMLBLOCK in file /usr/NetCommerce3/macros/en_US/macro.d2w +DoS with Long URL Link: http://www.net-security.org/text/bugs/987151822,94005,.shtml CALDERA - VIM EMBEDDED MODLINE EXPLOITS There exists a possibility for an attacker to embed special modelines into a text file which when opened with vim could compromise the account of the user. Also editing files in world writeable directories like /tmp could lead to a local attacker gaining access to the editing users account due to possible symlink attacks on editor backup and swap files. Link: http://www.net-security.org/text/bugs/987171863,30479,.shtml OPENSSH SUBJECT TO TRAFFIC ANALYSIS Solar Designer has conducted a very thorough analysis of several weaknesses in implementations of the SSH protocol. These weaknesses allow for an attacker to significantly speed up brute force attacks on passwords. Solar Designer's complete analysis can be found at the following page: http://www.openwall.com/advisories/OW-003-ssh-traffic-analysis.txt In February of 2001, Core SDI released a security announcement which described ways in which would allow an attacker to compromise the session of an SSH protocol 1.5 session. The detailed report is at the following URL: http://www.core-sdi.com/advisories/ssh1_sessionkey_recovery.htm Link: http://www.net-security.org/text/bugs/987171905,95561,.shtml ---------------------------------------------------------------------------- Security world -------------- All press releases are located at: http://net-security.org/text/press ---------------------------------------------------------------------------- SYMANTEC'S SECUREXCHANGE 2001 CONFERENCE - [09.04.2001] Symantec Corporation opened electronic registration for the company's Worldwide Users' Conference, SecureXchange 2001, formerly AXENT Technologies, Inc.'s Users' Conference. The conference focuses on solutions to organizations' security issues with over 30 classes on product integration, expert case studies, technical tips, and e-security strategies and management. Press release: < http://www.net-security.org/text/press/986818398,42999,.shtml > ---------------------------------------------------------------------------- SSH SECURE SHELL 3.0 ANNOUNCED - [09.04.2001] SSH Communications Security, a world-leading developer of Internet security technologies, announced SSH Secure Shell 3.0, the next-generation of its leading encryption software product designed to protect end-users, businesses and developers from the most common break-in method used by hackers - stealing passwords from the Internet. SSH Secure Shell 3.0's new functionality includes support for PKI (Public Key Infrastructure), smart cards and the Rijndael (proposed AES - Advanced Encryption Standard) algorithm. The SSH Secure Shell 3.0 product provides transparent, strong security over any IP-based connection for both client and server applications by authenticating and encrypting terminal connections and file transfers over the Internet. Press release: < http://www.net-security.org/text/press/986818611,16882,.shtml > ---------------------------------------------------------------------------- VIGILANTE AND ISS PARTNER - [09.04.2001] VIGILANTe, a leading provider of automated security assessment services, and Internet Security Systems, the world's leading provider of security management solutions for the Internet, today announced a strategic partnership. The agreement allows VIGILANTe to integrate Internet Security Systems'market-leading network security assessment software, Internet Scanner, into their award-winning security assessment service, SecureScan. SecureScan is an automated service, delivered via the Internet, which conducts intelligent assessments of Internet security perimeters. The SecureScan service is updated weekly and available on demand - providing security assurance when and where it is needed. Press release: < http://www.net-security.org/text/press/986818730,92501,.shtml > ---------------------------------------------------------------------------- ALADDIN ANNOUNCES ETOKEN ENTERPRISE 2.0 - [09.04.2001] Aladdin Knowledge Systems, a global leader in the field of Internet content and software security, today announced the release of eToken Enterprise 2.0, the latest set of "out of the box" plug and play 2-factor security solutions that provides quick implementation for a variety of network security and e-Business solutions. Using Aladdin's USB-based eToken security key, eToken Enterprise 2.0 allows organizations to implement the use of eTokens with a minimal amount of effort. eToken Enterprise 2.0 consists of several pre-packaged security clients that erase the need for organizations to modify their existing software, create custom applications or write additional code. Press release: < http://www.net-security.org/text/press/986818832,29750,.shtml > ---------------------------------------------------------------------------- FREEDOM2SURF OFFERS FREE PRIVACY SUITE - [10.04.2001] Freedom2Surf, one of the UK's most advanced ISPs, today built on the security and privacy already offered to its users by announcing it is the first company in the UK to offer its subscribers free access to a range of privacy and security features with the Freedom 2.0 Internet Privacy Suite from Zero-Knowledge Systems. Freedom 2.0 will be made available to all new and existing Freedom2Surf subscribers as a free download for a limited time. The suite was developed by Zero-Knowledge Systems, the leading provider of privacy technologies and services for consumers and business, and is the only solution that protects and secures the privacy and personal information of Internet users without requiring users to trust their data to a third party. Press release: < http://www.net-security.org/text/press/986894868,73460,.shtml > ---------------------------------------------------------------------------- RAINBOW SHIPS NEW SENTINEL 7.1.1 - [10.04.2001] The Digital Rights Management (DRM) group of Rainbow Technologies, Inc. a leading provider of high-performance security solutions for the Internet, eCommerce and software protection, is now shipping the newest version of the industry's leading solution for secure electronic management, licensing, and distribution. The new SentinelLM 7.1.1's leading-edge software licensing and management tools are designed to secure applications from unauthorized execution and software piracy. The newest version includes new usability features and stronger security to combat online software piracy. Press release: < http://www.net-security.org/text/press/986900556,82853,.shtml > ---------------------------------------------------------------------------- F-SECURE INTEGRATES PRODUCTS WITH HP - [10.04.2001] F-Secure Corp., a leading provider of centrally managed security solutions for the mobile, distributed enterprise, today announced integration of its F-Secure products with the HP OpenView VantagePoint enterprise management system [EMS] from Hewlett-Packard. By integrating F-Secure applications into HP OpenView VantagePoint, companies can now control most aspects of the applications through the familiar HP OpenView console, thus protecting their existing investment. F-Secure is believed to be the only security vendor offering true security suite integration for HP's EMS platform. Press release: < http://www.net-security.org/text/press/986900647,92025,.shtml > ---------------------------------------------------------------------------- PGP SECURITY'S PARTNERS WITH NSA - [10.04.2001] NAI Labs, a division of PGP Security, a Network Associates, Inc. company, announced they are joining with the National Security Agency (NSA) and its other partners to further develop the NSA's Security-Enhanced Linux (SELinux) prototype. The $1.2 million will be paid over the life of the two-year contract, and the work will focus on research and development to improve the security of open-source operating system platforms, the core of Internet infrastructures that have become business critical in today's economy. Press release: < http://www.net-security.org/text/press/986910796,64451,.shtml > ---------------------------------------------------------------------------- VIGILANTE AND NETWORKS VIGILANCE MERGER - [11.04.2001] VIGILANTe and Networks Vigilance, a subsidiary of Cyrano, have announced plans to combine their businesses, with the new company retaining the name VIGILANTe. The companies signed an agreement on March 31st and intend to merge no later than April 13th. The deal will create a global company with an array of security assessment solutions. The combination of VIGILANTe and Networks Vigilance technology, products, services, and global partners will allow VIGILANTe to extend security assurance to the widest possible range of customers in North America, Europe and Asia. VIGILANTe will immediately combine the companies' award-winning assessment methodologies to extend its services beyond the Internet to the IT infrastructure. Customers will benefit from automated real-time security risk analysis of both their internal and external networks. Press release: < http://www.net-security.org/text/press/986979179,92457,.shtml > ---------------------------------------------------------------------------- RAINBOW'S IKEY 2000 IS ENTRUST-READY - [11.04.2001] The Digital Rights Management group of Rainbow Technologies, Inc., a leading provider of high-performance security solutions for the Internet and eCommerce, announced that the company's iKey 2000 series workstation security solution has been awarded the Entrust-Ready, the leading global provider of Trust Relationship Management( software and managed services. The Entrust-Ready designation means that the iKey 2000 PE for Entrust has been tested for compatibility and interoperability with Entrust's market-leading PKI software. Press release: < http://www.net-security.org/text/press/986981381,14396,.shtml > ---------------------------------------------------------------------------- RAINBOW'S SMART TOKENS REACH CRITICAL MASS - [11.04.2001] The Digital Rights Management group of Rainbow Technologies, Inc. a leading provider of high-performance security solutions for the Internet, eCommerce and software protection, today claimed leadership of the worldwide smart-token security market by announcing that Rainbow has sold 26 million software security keys, high-security authentication tokens, and workstation security solutions. Rainbow made the announcement at today's 2001 RSA Data Security Conference and Software Development West trade shows. Press release: < http://www.net-security.org/text/press/986981568,39553,.shtml > ---------------------------------------------------------------------------- PGP SECURITY AND RAINBOW TECHNOLOGIES PARTNER - [13.04.2001] PGP Security, a Network Associates Company, announced a partnership with Rainbow Technologies, a leading provider of Internet and eCommerce security solutions, to improve security for electronic transactions and communications. PGP Security's private key technology will be incorporated into Rainbow's iKey authentication-token family, which enables users to store their private keys securely on the token rather than on a PC where it is vulnerable to unauthorized access and privacy. Press release: < http://www.net-security.org/text/press/987151028,7348,.shtml > ---------------------------------------------------------------------------- PITBULL LX TECHNOLOGY ON SOLARIS 8 RELEASED - [13.04.2001] Argus Systems Group, Inc., the global leader in Internet security and intrusion prevention systems, announces the availability of its award-winning PitBull LX security technology on the Solaris 8 platform. PitBull LX on Solaris delivers the strength and power of market-leading PitBull security in a simple to install, intuitive and non-intrusive implementation. The availability of PitBull LX on Solaris 8 marks the latest in a series of security developments by Argus this year, following the release of PitBull LX for Linux and a Trusted Web Server Appliance software suite. Press release: < http://www.net-security.org/text/press/987151117,12009,.shtml > ---------------------------------------------------------------------------- TOP SECURITY FIRMS JOIN MSSPP - [13.04.2001] Microsoft Corp. announced at RSA Conference 2001 that three of the top names in computer security - Computer Sciences Corp. (CSC), Foundstone Inc. and Guardent Inc. - will join with Microsoft to provide security consulting services as part of the Microsoft Security Services Partner Program. Designed to provide customers with an online directory of consulting companies with security expertise, the Microsoft Security Services Partner Program supports a community of technical professionals - over 50 partners in 16 countries - that specialize in securing Microsoft environments. Participants have ongoing access to quality security information and training from Microsoft as well as support for managed security services that assist customers in securing their individual environments. Press release: < http://www.net-security.org/text/press/987151241,64199,.shtml > ---------------------------------------------------------------------------- Featured products ------------------- The HNS Security Database is located at: http://www.security-db.com Submissions for the database can be sent to: staff@net-security.org ---------------------------------------------------------------------------- GUARDIAN FIREWALL-5 Guardian Firewall-5 is a low cost security solution for the small office/home office (SOHO) market. NetGuard is currently offering Guardian Firewall-5 to the North and South American market in a concerted effort to ensure that all companies are secured against malicious attacks. Guardian Firewall-5 allows small networks to achieve the utmost in security while maintaining the ease of installation that smaller companies require. Guardian Firewall-5 is based on MAC-Layer Stateful Inspection technology to ensure superior protection and performance. Read more: < http://www.security-db.com/product.php?id=135 > This is a product of NetGuard, for more information: < http://www.security-db.com/info.php?id=24 > ---------------------------------------------------------------------------- HP IPSEC/9000 HP IPSec/9000 provides secure, private communication over the Internet and within the enterprise without having to modify a single application. Along with authentication, data integrity, and confidentiality, IPSec/9000 offers protection against replays, packet tampering, and spoofing—and it keeps others from intercepting critical data such as passwords and credit card numbers sent over the Internet. Whether or not a public key infrastructure (PKI) has been implemented, HP IPSec/9000 easily integrates into the existing enterprise infrastructure. It has the flexibility to create an authenticated tunnel, using either digital certificates from Entrust and Verisign or self-generated pre-shared keys. Read more: < http://www.security-db.com/product.php?id=707 > This is a product of HP Internet Security, for more information: < http://www.security-db.com/go.php?id=156 > ---------------------------------------------------------------------------- NETRECON NetRecon is a network vulnerability assessment tool that discovers, analyzes and reports holes in network security. NetRecon achieves this by conducting an external assessment of network security by scanning and probing systems on the network. NetRecon reenacts common intrusion or attack scenarios to identify and report network vulnerabilities, while suggesting corrective actions. Read more: < http://www.security-db.com/product.php?id=303 > This is a product of AXENT, for more information: < http://www.security-db.com/info.php?id=60 > ---------------------------------------------------------------------------- SDK SOFTWARE DEVELOPMENT KIT Veridicom´s software creates and identifies a unique representation of an individual´s fingerprint-enabling reliable, convenient personal authentication solutions. Veridicom´s proprietary software is available in modules that perform image capture, quality control, processing, and one-to-one or one-to-few verification matching. The Imaging Suite software modules and Verification Suite modules are based on open architecture standards. They can be used with either Veridicom 5thSense personal authentication peripherals or your own hardware based on Veridicom´s solid-state fingerprint sensors. Read more: < http://www.security-db.com/product.php?id=299 > This is a product of Veridicom, for more information: < http://www.security-db.com/info.php?id=59 > ---------------------------------------------------------------------------- DISKGUARD If you are the only person working on your Macintosh, you can protect your computer by typing in one password. That's all there is to it. If your computer is shared with other people, give them a second password which limits their access, according to your own requirements, to certain days of the week or to specific hours during the day. At start-up, DiskGuard requests a password. No one will be able to start the Macintosh without supplying the proper password, even if he tries to boot with a System disk or holds down the Shift key to bypass extensions. DiskGuard also keeps a close watch on your computer while you are at work. When you take a moment's leave, DiskGuard automatically hides your screen from prying eyes. As soon as someone tries to access the computer, DiskGuard will prompt for the proper password. DiskGuard also keeps track of valid and invalid access attempts to your hard disk so you can see at any time if somebody tried accessing your computer during your absence. Read more: < http://www.security-db.com/product.php?id=605 > This is a product of Highware, for more information: < http://www.security-db.com/info.php?id=131 > ---------------------------------------------------------------------------- Featured article ---------------- All articles are located at: http://www.net-security.org/text/articles Articles can be contributed to staff@net-security.org ---------------------------------------------------------------------------- "LOGIC" WORM - PROOF-OF-CONCEPT MALICIOUS CODE Recently, some anti-virus vendors have been touting the discovery of a new Internet-worm "Logic" - the first malicious code written in the Logo programming language used in a limited number of schools for educational purposes only. Kaspersky Labs firmly states that this Internet-worm still has not yet been found "in-the-wild," and poses absolutely no threat to the majority of computer users, simply because, in order to be activated, "Logic" requires the Logo interpreter to be installed on the target systems (for example, SuperLogo for Windows). Read more: < http://www.net-security.org/text/articles/viruses/logic.shtml > ---------------------------------------------------------------------------- Security Software ------------------- All programs are located at: http://net-security.org/various/software ---------------------------------------------------------------------------- SMARTBLOCK 1.50 SmartBlock offers the ability to filter indecent Web sites in real time, thus protecting your children from objectionable Internet material. SmartBlock intercepts all words in real time, restricts your children's access to games, and protects files and folders from being deleted or renamed. It can also capture screenshots and save them to the hard disk to help you monitor computer usage. Info/Download: < http://www.net-security.org/various/software/987348093,23594,windows.shtml > ---------------------------------------------------------------------------- IPNETSENTRY IPNetSentry is a simple and intelligent security application which protects your Macintosh from outside Internet intruders. This is particularly important for Macintosh users who have cable modem, DSL, or another high-speed Internet service where connections can be maintained and left unattended for hours (or days) at a time. Unlike most other Internet security products, IPNetSentry does not erect barriers for the safe use of your Internet connection. There is no need to "punch holes" in a firewall for specific applications you may wish to run. Instead, IPNetSentry silently and intelligently watches for suspicious behavior, and when triggered, invokes a solid filter which completely bans the potential intruder from your Macintosh. Info/Download: < http://www.net-security.org/various/software/987349021,10394,mac.shtml > ---------------------------------------------------------------------------- WEBROOT WINGUARDIAN 2.6 Parents, schools, libraries, churches, and anyone else wishing to control access to the Internet can use WinGuardian to monitor which Web sites users visit, what they type (via keystroke logging), which programs they access, and the time they spend using the programs. WinGuardian can also secure Windows so that users cannot run unauthorized programs or modify Windows configurations such as wallpaper and network settings. It also features network support and the ability to display an acceptable-use policy. Features include screen-shot capturing, enhanced keystroke capturing (captures lowercase and special characters), America Online support, Opera support, and the ability to email log files to a specific email address. Info/Download: < http://www.net-security.org/various/software/987348286,54994,windows.shtml > ---------------------------------------------------------------------------- BRICKHOUSE BrickHouse was developed by Brian Hill to ease the process of configuring MacOS X's built-in Firewall. His hard work has paid off; hundreds of OS X owners use his program. Changing Firewall settings manually without a GUI can be tedious and confusing for unexperianced users; this program removes those barriers. By using BrickHouse to configure your computer's firewall, you can more effectively keep unauthorized users from gaining access to your computer via your internet connection. BrickHouse makes it easy to use your firewall to guard against denial of service or resource-based internet attacks. Network attacks will bounce off the firewall, preventing your computer from slowing down or crashing. BrickHouse provides a simple and easy interface to activate and configure your firewall's filters. It also includes a firewall monitor window that allows you to see how frequently each filter is used. Filter settings can be saved and toggled quickly, and can be imported and exported to and from disk. Settings can be created by knowledgeable users and admins, who can distribute them to others, quickly disabling specific or recently discovered attack techniques. Info/Download: < http://www.net-security.org/various/software/987349194,20968,mac.shtml > ---------------------------------------------------------------------------- ETHEREAL-0.8.17-A Ethereal is a GTK+-based network protocol analyzer, or sniffer, that lets you capture and interactively browse the contents of network frames. The goal of the project is to create a commercial-quality analyzer for Unix and to give Ethereal features that are missing from closed-source sniffer. Changes: New dissectors include CUPS browsing protocol, Cisco HDLC, DCE RPC support, LMI for frame relay, Wellfleet compression, BACNET, and RWALL. Many other dissectors were updated and bug-fixed. New 3D logo. The Windows version can now dynamically load the wpcap.dll at run-time. And a Windows installer has been added. Add -D flag to tethereal to show list of all network. Added support for packet data decompression and decoding. Info/Download: < http://www.net-security.org/various/software/987348497,42703,linux.shtml > ---------------------------------------------------------------------------- Defaced archives ------------------------ [09.04.2001] Original: http://www.sony-center.ch/ Defaced: http://defaced.alldas.de/mirror/2001/04/09/www.sony-center.ch/ OS: Windows Original: http://pbrown.ios.doi.gov/ Defaced: http://defaced.alldas.de/mirror/2001/04/09/pbrown.ios.doi.gov/ OS: Windows Original: http://www.aiwa.com.pa/ Defaced: http://defaced.alldas.de/mirror/2001/04/09/www.aiwa.com.pa/ OS: Windows Original: http://www.crackattack.com/ Defaced: http://defaced.alldas.de/mirror/2001/04/09/www.crackattack.com/ OS: Windows Original: http://dataframe.net/ Defaced: http://defaced.alldas.de/mirror/2001/04/09/dataframe.net/ OS: Windows [10.04.2001] Original: http://www.ericsson.ly/ Defaced: http://defaced.alldas.de/mirror/2001/04/10/www.ericsson.ly/ OS: Windows Original: http://www.ericsson.cbc.dk/ Defaced: http://defaced.alldas.de/mirror/2001/04/10/www.ericsson.cbc.dk/ OS: Windows Original: http://www.apache.or.kr/ Defaced: http://defaced.alldas.de/mirror/2001/04/10/www.apache.or.kr/ OS: Linux Original: http://www.pepsi-music.co.uk/ Defaced: http://defaced.alldas.de/mirror/2001/04/10/www.pepsi-music.co.uk/ OS: Windows Original: http://www.netnanny.com/ Defaced: http://defaced.alldas.de/mirror/2001/04/10/www.netnanny.com/ OS: Windows Original: http://www.honda.ca/ Defaced: http://defaced.alldas.de/mirror/2001/04/10/www.honda.ca/ OS: Windows [11.04.2001] Original: http://www.sony-training.com/ Defaced: http://defaced.alldas.de/mirror/2001/04/11/www.sony-training.com/ OS: Windows Original: http://www.yourcriminalattorney.com/ Defaced: http://defaced.alldas.de/mirror/2001/04/11/www.yourcriminalattorney.com/ OS: Windows Original: http://www.golfhackers.com/ Defaced: http://defaced.alldas.de/mirror/2001/04/11/www.golfhackers.com/ OS: Windows Original: http://www.nortel.it/ Defaced: http://defaced.alldas.de/mirror/2001/04/11/www.nortel.it/ OS: Windows Original: http://www.gatorade.com.ar/ Defaced: http://defaced.alldas.de/mirror/2001/04/11/www.gatorade.com.ar/ OS: Windows [12.04.2001] Original: http://www.dortp.gov.tw/ Defaced: http://defaced.alldas.de/mirror/2001/04/12/www.dortp.gov.tw/ OS: Windows Original: http://www.vipfe.gov.bo/ Defaced: http://defaced.alldas.de/mirror/2001/04/12/www.vipfe.gov.bo/ OS: Windows Original: http://www.sony-training.de/ Defaced: http://defaced.alldas.de/mirror/2001/04/12/www.sony-training.de/ OS: Windows Original: http://www.crack3r.com/ Defaced: http://defaced.alldas.de/mirror/2001/04/12/www.crack3r.com/ OS: Windows [13.04.2001] Original: http://www.sonymonitor.com/ Defaced: http://defaced.alldas.de/mirror/2001/04/13/www.sonymonitor.com/ OS: Windows Original: http://www.tech-help.com/ Defaced: http://defaced.alldas.de/mirror/2001/04/13/www.tech-help.com/ OS: Unknown Original: http://www.drinkpepsi.com/ Defaced: http://defaced.alldas.de/mirror/2001/04/13/www.drinkpepsi.com/ OS: Windows Original: http://www.fazenda.pbh.gov.br/ Defaced: http://defaced.alldas.de/mirror/2001/04/13/www.fazenda.pbh.gov.br/ OS: Windows [14.04.2001] Original: http://www.coca-colaecuador.org/ Defaced: http://defaced.alldas.de/mirror/2001/04/14/www.coca-colaecuador.org/ OS: Windows Original: http://www.profuturo.com.pe/ Defaced: http://defaced.alldas.de/mirror/2001/04/14/www.profuturo.com.pe/ OS: Windows Original: http://www.britishembassy.ee/ Defaced: http://defaced.alldas.de/mirror/2001/04/14/www.BritishEmbassy.ee/ OS: Windows Original: http://www.pepsi-music.co.uk/ Defaced: http://defaced.alldas.de/mirror/2001/04/14/www.pepsi-music.co.uk/ OS: Windows Original: http://www.linuxtampico.org.mx/ Defaced: http://defaced.alldas.de/mirror/2001/04/14/www.linuxtampico.org.mx/ OS: Linux [15.04.2001] Original: http://www.musicworld4u.com/ Defaced: http://defaced.alldas.de/mirror/2001/04/15/www.musicworld4u.com/ OS: Windows Original: http://www.spytoy.com/ Defaced: http://defaced.alldas.de/mirror/2001/04/15/www.spytoy.com/ OS: Linux Original: http://www.creative-computer.com/ Defaced: http://defaced.alldas.de/mirror/2001/04/15/www.creative-computer.com/ OS: Windows Original: http://www.networksensors.com/ Defaced: http://defaced.alldas.de/mirror/2001/04/15/www.networksensors.com/ OS: BSDI Original: http://www.antiviral.uab.edu/ Defaced: http://defaced.alldas.de/mirror/2001/04/15/www.antiviral.uab.edu/ OS: Windows ---------------------------------------------------------------------------- ======================================================== Advertisement - HNS Security Database ======================================================== HNS Security Database consists of a large database of security related companies, their products, professional services and solutions. HNS Security Database will provide a valuable asset to anyone interested in implementing security measures and systems to their companies' networks. Visit us at http://www.security-db.com ======================================================== Questions, contributions, comments or ideas go to: Help Net Security staff staff@net-security.org http://net-security.org http://security-db.com