ENCRYPTION + AUTHENTICATION = TRUST
You may think people will regard your business as trustworthy because you've got a 128-bit encryption certificate, but encryption does not guarantee trust. Thawte believes in rigorous authentication. Download our FREE Authentication Guide

BOOK REVIEW: Honeypots: Tracking Hackers
Tracking Hackers by Lance Spitzner is fantastically written. The detailed definitions and descriptions make it a great book even for the honeypot novice to understand. It grabs your attention right from the very beginning, holds it to the end and leaves you wanting more. http://www.linuxsecurity.com/feature_stories/feature_story-121.html

Linux Advisory Watch: This week, advisories were released for tomcat, tkmail, htmail, fetchmail, buzilla, libkvm, Konqueror, talkd, sendmail, pic, libc, rouge, apache, hylafax, php, tcpdump, gv, and nss_ldap. The vendors include Conectiva, Debian, EnGarde, NetBSD, OpenBSD, Red Hat, and SuSE.

http://www.linuxsecurity.com/articles/forums_article-5891.html

Take advantage of our Linux Security discussion list!  This mailing list is for general security-related questions and comments. To subscribe send an e-mail to security-discuss-request@linuxsecurity.com with "subscribe" as the subject.

Thank you for reading the LinuxSecurity.com weekly security newsletter. The purpose of this document is to provide our readers with a quick summary of each week's most relevant Linux security headlines.

Host Security News:

October 11th, 2002 -- Sendmail Trojan Looks Familiar -- The Trojan horse discovered in a distribution of the Sendmail open-source e-mail server has striking similarities to a backdoor planted in OpenSSH last summer, according to security experts who've analyzed the code. But missteps in the alerting process may have given the culprits a chance to cover their tracks.

http://www.linuxsecurity.com/articles/hackscracks_article-5902.html

October 11th, 2002 -- Design For Security Up Front -- Of the five basic phases--initiation, development, implementation, maintenance, and decommissioning/disposal--often the need for security isn't realized until the implementation phase, and security measures not added until the maintenance phase. Even so, fixing many other system vulnerabilities is simply an afterthought, addressed with patches, service packs, or emergency hot fixes.

http://www.linuxsecurity.com/articles/security_sources_article-5892.html

October 11th, 2002 -- Footprints in the Sand, Part One. Fingerprinting Exploits In System And Application Log Files -- Forensic analysts and incident response engineers are armed with a slew of open source and commercial forensic toolsets to attempt to understand and analyze break-ins they did not witness. The most critical component of forensic analysis is system log files.

http://www.linuxsecurity.com/articles/documentation_article-5894.html

October 11th, 2002 -- Chroot Jails Made Easy with the Jail Chroot ProjectRegister -- There are always difficult jobs to do as a GNU/Linux system administrator. Sometimes the difficulty lies in finding out how to do a particular job, not neccessarily the job itself. This can be particularly true in the open source world where documentation can often take a back seat to implementation.

http://www.linuxsecurity.com/articles/documentation_article-5903.html

October 10th, 2002 -- When Code Goes Wrong - Format String Exploition -- I will try to keep this article as short and as easy to understand as possible so the average people would understand this concept. What is Format String? Formatstring are the %d, %s, %u, %x, %p %n in your C langauge that you use when using printf and something similar. How is it vulernable?

http://www.linuxsecurity.com/articles/documentation_article-5882.html

October 10th, 2002 -- Stenographied File Transfer Using Posix File Locks -- Every computer system is insecure! Why? because by using any system resources that are available to each process information can be leaked. Say for example you can detect CPU usage remotely (possible by measuring the time taken for a ping reply for example).

http://www.linuxsecurity.com/articles/documentation_article-5889.html

October 9th, 2002 -- Assessing Internet Security Risk, Part Five: Custom Web Applications Continued -- This article is the fifth and final in a series that is designed to help readers to assess the risk that their Internet-connected systems are exposed to. In the first installment, we established the reasons for doing a technical risk assessment.

http://www.linuxsecurity.com/articles/documentation_article-5871.html

October 9th, 2002 -- Introduction to Buffer Overflows -- Hello, here I am again, this time I'll let you know what is in fact buffer overflow and how you can detect if some program is vulnerable to buffer overflow exploits. This tutorial has C source code, so if you don't know C you can have some problems in this tutorial, you also need to have some notions on ASM and how to use gdb.

http://www.linuxsecurity.com/articles/documentation_article-5873.html

October 8th, 2002 -- Improve Linux Security -- Although Linux's native support for networking services is part of the OS's appeal, these services can also create a security risk. Stop unnecessary network services. One of the attractions of Linux is its native support for a wide range of TCP/IP services, many of which are configured to run by default.

http://www.linuxsecurity.com/articles/host_security_article-5862.html

October 7th, 2002 -- Security Tools in Linux Distributions, Part I -- With so many security tools available, it can be hard to know what to use. Many users do not want to be bothered with downloading, learning and configuring security software when so many other things need to be done.

http://www.linuxsecurity.com/articles/documentation_article-5848.html

October 7th, 2002 -- Inhospitable Hosts -- Intrusion prevention sounds cool. It's sexy. It's the action hero of the infosecurity universe, smacking down the bad guys before they can get in and hurt the assets your organization holds near and dear. But what is it, really?

http://www.linuxsecurity.com/articles/intrusion_detection_article-5856.html

October 7th, 2002 -- Writing anti-IDS Shellcode -- In the last few weeks i had made an intensive study of Intrusion - Detection Systems like snort. I found that several ways of escaping from being detected while checking for vulnerable CGI's were already made by RFP (rfp@wiretrip.net).

http://www.linuxsecurity.com/articles/documentation_article-5847.html

Network Security News:

October 13th, 2002 -- A Security Nightmare: Wireless Security -- And after suffering through the Love Bugs and Code Reds of e-mail, the growth of mobile wireless raises the question of whether businesses have learned their lessons for this second round. So far, experts say, not really. But the final test may still be a few years away.

http://www.linuxsecurity.com/articles/network_security_article-5904.html

October 10th, 2002 -- FreeS/WAN Weekly Summary: IPsec on the Zaurus and more -- Hackers start using 'side-channel' attacks Side-channel attacks are the next big threat from hackers, according to the head of RSA Labs. Normal attacks on code are conducted by looking at the unencrypted message and the encrypted message and attempt to recover the encryption key

http://www.linuxsecurity.com/articles/cryptography_article-5890.html

October 9th, 2002 -- Firewalls - back to basics -- A firewall is software or hardware that sits between two networks -- typically, between your LAN and the Internet -- and allows some sorts of network traffic through while preventing others. It works by rules that you set, which define the sort of security you want.

http://www.linuxsecurity.com/articles/firewalls_article-5869.html

October 9th, 2002 -- Guide to Intrusion Prevention -- In addition to the host application tools discussed in this article, the broad term "intrusion prevention" encompasses several other classes of tools that protect hosts, Web applications and networks by actively blocking malicious actions.

http://www.linuxsecurity.com/articles/intrusion_detection_article-5879.html

October 8th, 2002 -- Ten Minute Firewall -- Each major version of Linux has had a different firewalling software suite. 2.0 kernels had ipfwadm, 2.2 had ipchains, and 2.4 has iptables. (2.4 can support ipchains-style rules if you load the ipchains module.) Each offers great improvements from its predecessors.

http://www.linuxsecurity.com/articles/documentation_article-5866.html

Vendors/Products:

October 11th, 2002 -- Snort 2.0 - Detection Revisited -- Sourcefire's commitment to delivering the most innovative and effective intrusion management solutions continues with the latest contribution to Snort 2.0 development. As part of Sourcefire's dedication to the Open Source community, the company continually upgrades Snort with technologies and enhancements developed for its commercial products.

http://www.linuxsecurity.com/articles/intrusion_detection_article-5899.html

October 10th, 2002 -- New threat forces cryptography rethink -- Hackers start using 'side-channel' attacks Side-channel attacks are the next big threat from hackers, according to the head of RSA Labs. Normal attacks on code are conducted by looking at the unencrypted message and the encrypted message and attempt to recover the encryption key. But side-channel attacks look at other information in an attempt to crack the code, such as the time taken to perform an operation and how power consumption changes.

Bert Kaliski, head of RSA Labs, told vnunet.com that these methods are forcing the industry to think again. "Side-channel attacks are causing a fundamental rethink in the way we write encryption software," he said. "As the methods used become automated, our job is getting tougher."

http://www.linuxsecurity.com/articles/cryptography_article-5880.html

General News:

October 11th, 2002 -- Sun Exec Defends Open-Source Security -- Whitfield Diffie, the inventor of public key cryptography and now chief security officer at Sun Microsystems, spoke out Tuesday in defense of the security of open-source software. In a keynote address at the RSA Conference here, Diffie defended open-source software against an attack made earlier at the same conference by Microsoft's chief security officer, Craig Mundie.

http://www.linuxsecurity.com/articles/security_sources_article-5895.html

October 11th, 2002 -- Security Tops List of Reasons Not to Deploy Web Services -- End-to-end security of web services forms the most significant barrier to implementation by organizations, but this is not expected to hinder future development.

http://www.linuxsecurity.com/articles/general_article-5898.html

October 11th, 2002 -- Is Linux Really More Secure Than Windows? -- Microsoft has organized a huge security program as a result of vocal complaints from users, while the Linux effort is, in Eric Hemmendinger's words, "less disciplined but more timely." Ramen, Slapper, Scalper and Mighty may sound like Santa's new team of reindeer, but they are creatures far lower down the evolutionary ladder -- and much less welcome.

http://www.linuxsecurity.com/articles/forums_article-5897.html

October 8th, 2002 -- The Great Security Self-Assessment Test -- As the laws governing the use of employee and customer data become ever more complex, IT directors are having to spend more time creating legally watertight privacy policies.

http://www.linuxsecurity.com/articles/privacy_article-5864.html

October 8th, 2002 -- NIST-NSA Team Readies Systems Security Guidance -- The National Information Assurance Partnership in the next month will release two draft guides to create standards for systems security certification and accreditation and for minimum security controls for IT>.

http://www.linuxsecurity.com/articles/government_article-5861.html