[ISN] Linux Security Week - May 9th 2005

InfoSec News isn at c4i.org
Tue May 10 03:16:13 EDT 2005

|  LinuxSecurity.com                         Weekly Newsletter        |
|  May 9th, 2005                              Volume 6, Number 20n    |
|                                                                     |
|  Editorial Team:  Dave Wreski             dave at linuxsecurity.com    |
|                   Benjamin D. Thomas      ben at linuxsecurity.com     |

Thank you for reading the LinuxSecurity.com weekly security newsletter.
The purpose of this document is to provide our readers with a quick
summary of each week's most relevant Linux security headlines.

This week, perhaps the most interesting articles include "Why Snort
makes IDS worth the time and effort," "Five Linux Security Myths You
Can Live Without," and "Backups tapes a backdoor for identity


## Internet Productivity Suite: Open Source Security ##
Trust Internet Productivity Suite's open source architecture to
give you the best security and productivity applications available.
Collaborating with thousands of developers, Guardian Digital
security engineers implement the most technologically advanced
ideas and methods into their design.

Click to find out more!



This week, perhaps the most interesting articles include ethereal,
prozilla, smartlist, kdewebdev, wireless-tools, gimp, bootparamd,
tcpdump, kdelibs, vte, php, words, util-linux, lapack, gnuutils,
and glibc.  The distributors include Conectiva, Debian, Fedora,
Gentoo, and Red Hat.



Review: The Book of Postfix: State-of-the-Art Message Transport

I was very impressed with "The Book of Postfix" by authors Ralf Hildebrandt
and Pattrick Koetter and feel that it is an incredible Postfix reference.
It gives a great overall view of the operation and management of Postfix
in an extremely systematic and practical format. It flows in a logical
manner, is easy to follow and the authors did a great job of explaining
topics with attention paid to real world applications and how to avoid
many of the associated pitfalls. I am happy to have this reference in
my collection.



Introduction: Buffer Overflow Vulnerabilities

Buffer overflows are a leading type of security vulnerability. This
paper explains what a buffer overflow is, how it can be exploited,
and what countermeasures can be taken to prevent the use of buffer
overflow vulnerabilities.



Getting to Know Linux Security: File Permissions

Welcome to the first tutorial in the 'Getting to Know Linux Security'
series.  The topic explored is Linux file permissions.  It offers an
easy to follow explanation of how to read permissions, and how to set
them using chmod.  This guide is intended for users new to Linux
security, therefore very simple.



>> The Perfect Productivity Tools <<

WebMail, Groupware and LDAP Integration provide organizations with
the ability to securely access corporate email from any computer,
collaborate with co-workers and set-up comprehensive addressbooks to
consistently keep employees organized and connected.


-->  Take advantage of the LinuxSecurity.com Quick Reference Card!
-->  http://www.linuxsecurity.com/docs/QuickRefCard.pdf

| Security News:      | <<-----[ Articles This Week ]----------

* Review: Deep Inspection Firewalls
  6th, May, 2005

If it were on public display, this portion of our Firewall Blowout
would be the geek equivalent of the Chicago Auto Show. Our Chicago
Neohapsis partner labs focused on the muscle cars: enterprise-class,
gigabit-capable network firewall appliances and turnkey systems that
support high-availability stateful failover, VPNs and centralized
management as well as DI (deep inspection), which we define as having
the ability not only to perform stateful packet filtering, but also
to inspect packet payloads higher up the OSI model using specific
attack signatures and Layer 7 protocol engines.


* In praise of Gentoo
  2nd, May, 2005

On the server end, you get the best release schedule in the business
for security updates and bug fixes. On the desktop, you get the
latest and greatest packages (if you enable 'beta' packages to be
used) like KDE 3.4 (which I'm running), X.org with awesome openGL
support, and a nicely compiled nvidia driver. Wonderful. Absolutely


* From Operating System to Application: Web Survey Looks at Malware
  5th, May, 2005

"Two years ago, this list was dominated completely by weaknesses in
operating systems," said SANS Institute Director of Research Alan
Paller. "Now we're seeing more and more vulnerabilities in
applications being exploited." The data also reveal that, for the
first time, some security Latest News about Security and anti-virus
software is vulnerable to hackers, creating a dangerous high-level
backdoor into users' systems.


* Report: IT shops lax about logging
  3rd, May, 2005

If a new report from the SANS Institute is any indication,
enterprises are jeopardizing security by taking a sloppy approach to
log keeping. As a result, the report recommends some companies
abandon home-grown logging systems in favor of commercial tools or
simply outsource the task.


* Why Snort makes IDS worth the time and effort
  5th, May, 2005

The decision of whether to implement an intrusion-detection system
(IDS) is a complicated one. Unfortunately, IDS has a well-deserved
reputation for requiring a lot of "care and feeding" and commercial
systems can be very expensive. However, there is an enterprise-grade
open source IDS called Snort that may tip the scales over to a "can't
lose" position.


* BlueCat Networks Previews its Proteus Enterprise IP Address
  3rd, May, 2005

Networks, Inc., a leading provider of simple, secure and affordable
network security appliances, today announced that it is previewing
Proteus, its new enterprise class Internet protocol (IP) Address
Management (IPAM) system at Networld+Interop in booth # 1124.


* Linux Labs International consolidates SELinux with Bproc
  6th, May, 2005

Linux Labs International, Inc. ( LLII ), the world leader in
Linux-based clustered supercomputer engineering, announced today a
key milestone for security in supercomputing technology. With today's
release of Nimbus 4.0, its out-of-the-box Linux cluster distribution,
the leading Single System Image cluster architecture ( bproc ) is now
seamlessly integrated with SELinux, the Security Enhanced Linux
platform ( SELinux ).


* Backups tapes a backdoor for identity thieves
  2nd, May, 2005

Large companies are reconsidering their security and backup policies
after a handful of financial and information-technology companies
have admitted that tapes holding unencrypted customer data have gone


* Netcraft Phishing Site Feed Available
  2nd, May, 2005

Netcraft launched an anti-phishing system at the start of 2005:
people install a toolbar and effectively become part of a giant
neighbourhood watch system whereby the most experienced members of
the community can report phishing sites and effectively block them
for the rest of the community.


* Infosecurity Europe 2005 Interviews
  3rd, May, 2005

Rootsecure.net recently recorded a series of interviews with
attendees at .Infosecurity Europe 2005., .Europe's number one,
dedicated Information Security event..	Those interviewed include
representatives from eEye Digital Security, Zone-H, Forensic
Computing Ltd, British Computing Society, and a reformed serial
website defacer. They are downloadable in MP3 or OGG Vorbis format


* China's largest bank switches to Linux
  3rd, May, 2005

The Industrial Commercial Bank of China (ICBC) has decided to switch
its servers to the Linux operating system after signing an agreement
with Turbolinux.


* Moving IT management to a new paradigm
  4th, May, 2005

IT management software ranges from hundreds of point solutions to
huge integrated bundles for high-end enterprises. Aiming for a target
in between is Robert Fanini, co-founder and CEO of GroundWork Open
Source Solutions Inc., a startup in Emeryville, Calif., that has
built its simple, low-priced IT management package on open source
code. In this interview, Fanini explains how open source will open
the eyes of now-doubting chief information officers


* Is VoIP Service the Next Big Target for Hackers?
  5th, May, 2005

Internet telephone service's appeal as a cutting-edge technology for
cutting phone costs is convincing more and more people to ditch their
landlines and go hi-tech with Voice over Internet Protocol.


* Five Linux Security Myths You Can Live Without
  6th, May, 2005

Before I wrote this article, I went to some Linux newsgroups to find
out what typical concerns among security-conscious Linux users might
be. I asked, simply, what they felt were the biggest myths
surrounding Linux security.


* Sober Hasn't Slowed, Still Accounts For Four Of Five Worms And
  6th, May, 2005

Sober.p, the worm that stormed the Internet Monday, showed no signs
of fading away as of Thursday morning, an anti-virus vendor said.


* Business inaction could lead to data privacy laws
  2nd, May, 2005

U.S. businesses for years have urged the government to let them set
computer-security standards of their own, but their inability to do
so could now prompt Congress to step in, experts say.


* House subcommittee elevates cybersecurity position
  6th, May, 2005

A bill that would create a high-level cybersecurity official in the
U.S. Department of Homeland Security (DHS) was approved Wednesday by
a House of Representatives subcommittee.


* How a Bookmaker and a Whiz Kid
 Took On an Extortionist . and Won
  3rd, May, 2005

The e-mail began, "Your site is under attack," and it gave Mickey
Richardson two choices: "You can send us $40K by Western Union [and]
your site will be protected not just this weekend but for the next 12
months," or, "If you choose not to pay...you will be under attack
each weekend for the next 20 weeks, or until you close your doors."


* Hackers Widen Their Attacks
  4th, May, 2005

Hackers continue to develop new ways to infiltrate computer systems,
staying one step ahead of software providers by targeting an array of
applications, according to a recent report from the SANS Institute
Latest News about SANS Institute.


* Spying on the spyware makers
  5th, May, 2005

The 25-year-old researcher has spent years analyzing how spyware and
adware programs work and publicizing his findings. That often results
in red faces and, occasionally, lawsuit threats from companies like
WhenU and Claria, formerly known as Gator.


Distributed by: Guardian Digital, Inc.                LinuxSecurity.com

     To unsubscribe email newsletter-request at linuxsecurity.com
         with "unsubscribe" in the subject of the message.

More information about the ISN mailing list