The Search Engine Report - Number 90 - May 6, 2004:
"Search Engine Watch News

Search Engine Strategies Toronto & London!

Search Engine Articles By Danny Sullivan

SearchDay Articles

Search Engine Articles

Search Engine Resources"

http://searchenginewatch.com/sereport/article.php/3350871

Why your personal firewall could be obsolete - TechUpdate - ZDNet:
"If your business has turned the use of personal firewalls into a required countermeasure, now's a good time to start thinking more strategically before buying any more personal firewall technology from a third party.

Although it still has a serious flaw that Microsoft will have no choice but to fix, the morphing of Windows XP's built-in personal firewall from a toy into a more serious security technology means that now's also a good time for the remaining independent personal firewall vendors like Zone Labs to be thinking about long term survival strategies. For the cottage industry of personal firewalls that includes giants like Symantec and McAfee (a division of Network Associates) and smaller players like Zone Labs, Sygate, Internet Security Systems (makers of BlackICE), and Panda Software, this was an inevitable turn of events.… "

http://64.95.71.98/techupdate/stories/main/Preview4987.html

Patches Could Have Lessened Sasser Worm Spread:
"Sasser's spread began to stabilize Tuesday, but not after infecting hundreds of thousands of computers since Friday by exploiting a known Windows flaw for which Microsoft Corp. issued a software patch three weeks ago. "

Twenty British Airways flights were each delayed about 10 minutes Tuesday due to Sasser troubles at check-in desks, while British coastguard stations used pen and paper for charts normally generated by computer.

On Monday, the worm hit public hospitals in Hong Kong and one-third of Taiwan's post office branches. Major corporations around the world also were infected.

Home users were particularly hit hard, computer security experts say, because they generally lack the know-how to install patches and tend not to have the firewalls needed to keep Sasser from spreading to other computers via the Internet.

Late this summer, Microsoft plans to introduce a Windows XP update that would turn on a built-in firewall and automatically obtain and install security patches regularly. Microsoft is currently testing the update.

For now, computer users must manually turn such settings on—through "System" or "Automatic Updates" in Windows' Control Panel—or they must periodically check the company's Web site for new patches.…

http://www.eweek.com/article2/0,1759,1585008,00.asp?kc=ewnws050504dtx1k0000599

Sasser.D Worm Arrives, Ready to Do Damage:
"A fourth version of Sasser has the potential to cause serious slowdowns and outages; a hoax e-mail claiming to contain a fix for the worm in fact contains a version of the NetSky worm.…"

Sasser.D appeared Monday afternoon and is similar to the previous three versions in most respects. The main difference in the new variant is that it uses ICMP echo requests, also known as pings, to look for other machines to infect. The Nachi worm of last summer had the same capability and, on networks with a number of vulnerable machines, the worm caused severe congestion.

The new Sasser variant could cause the same problems, experts warn. And, Sasser.D can scan multicast addresses, which has led to it causing some destabilization of routers that handle multicast traffic, analysts at The SANS Institute in Bethseda, Md., said.

Sasser.D also uses a different name for the file it leaves on infected PCs: Skynetave.exe. And it creates a remote shell on TCP port 9995, instead of 9996, which is used by the other three variants.

In addition to the new variant, there also is a hoax e-mail circulating that claims to contain a fix for Sasser. The message actually contains a new version of the NetSky worm.…

http://www.eweek.com/article2/0,1759,1584121,00.asp?kc=ewnws050404dtx1k0000599

Symantec Security Response - W32.Sasser.B.Worm:
"W32.Sasser.B.Worm is a variant of W32.Sasser.Worm. It attempts to exploit the LSASS vulnerability described in Microsoft Security Bulletin MS04-011. This worm spreads by scanning randomly selected IP addresses of vulnerable systems.… "

Notes:
The MD5 hash value of this worm is 0x1A2C0E6130850F8FD9B9B5309413CD00.

Symantec Security Response has developed a removal tool to clean the infections of W32.Sasser.B.Worm.

Block TCP ports 5554, 9996, and 445 at the perimeter firewall and install the appropriate Microsoft patch (MS04-011) to prevent the remote exploitation of the vulnerability.

--------------------------------------------------------------------------------

W32.Sasser.B.Worm can run on, but not infect, Windows 95/98/Me computers. Although these operating systems cannot be infected, they can still be used to infect the vulnerable systems to which they are able to connect. In this case, the worm will waste a lot of resources so that programs cannot properly run, including our removal tool. (On Windows 95/98/Me computers, the tool should be run in Safe mode.)

http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.removal.tool.html

http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.b.worm.html

Keyboard Shortcuts with Windows XP Home Edition:
"When speed counts, the keyboard is still king. Almost all the actions and commands you can perform with a mouse you can perform faster using combinations of keys on your keyboard. These simple keyboard shortcuts can get you where you want to go faster than several clicks of a mouse. You'll work faster on spreadsheets and similar documents, too, because you won't lose your place switching back and forth between mouse and keys.

Here are some of the most useful keyboard shortcuts:"

http://www.microsoft.com/windowsxp/home/using/tips/personalize/keyboardsc.asp

ZDNet: Printer Friendly - Alarm growing over bot software:
"Known as bot software, the remote attack tools can seek out and place themselves on vulnerable computers, then run silently in the background, letting an attacker send commands to the system while its owner works away, oblivious. The latest versions of the software created by the security underground let attackers control compromised computers through chat servers and peer-to-peer networks, command the software to attack other computers and steal information from infected systems.

News.context

What's new:
Internet security watchers warn that the most common kind of bot software has been upgraded. A new variant incorporates publicly available code for breaching security through a vulnerability on almost every Windows system sold in the past five years.

Bottom line:
Bot software has spread widely--just how quickly is difficult even for security experts to evaluate. Symantec puts the number of computers compromised in the hundreds of thousands. Other security experts have put the number in the millions. Moreover, with source code commonly available, bot software gets quickly updated to take advantage of the latest flaws.…"

http://zdnet.com.com/2100-1105_2-5202236.html?tag=adnews

URLScan Security Tool:
"UrlScan version 2.5 is a security tool that restricts the types of HTTP requests that Internet Information Services (IIS) will process. By blocking specific HTTP requests, the UrlScan security tool helps prevent potentially harmful requests from reaching the server. UrlScan 2.5 will now install as a clean installation on servers running IIS 4.0 and later.…"

http://www.microsoft.com/technet/security/tools/urlscan.mspx

Spam Report Card 2004 - TechUpdate - ZDNet:
"More than 50 percent of e-mail is spam. Billions of spam attacks are launched each month. Spam costs U.S. companies at least $1 billion per year in security and human resources expenditures, as well as lost productivity. Increasingly, virus-infected machines are used to distribute spam and perpetuate additional fraud, such as phishing. Is combating spam a losing battle?"

http://techupdate.zdnet.com/special_report/Spam_Report_Card_2004.html

Crypto-Gram: April 15, 2004:
"In this issue:

National ID Cards
TSA-Approved Locks
Crypto-Gram Reprints
Stealing an Election
Counterpane News
Security Notes from All Over: Man-in-the-Middle Attack

Bluetooth BeepCard
Privacy Hack
News
Virus Wars "

http://www.schneier.com/crypto-gram-0404.html

Signs Point to Worm Attack on SSL Vulnerability:
"Security experts on Tuesday said they are seeing evidence of what appears to be a worm exploiting the recently announced vulnerability in the Windows implementation of the Secure Sockets Layer (SSL) protocol.

During the morning and early afternoon Tuesday, specialists at VeriSign Inc.'s security operations center observed a large-scale exploitation of the vulnerability. While there are a number of software tools available on the Internet to attack the vulnerability, experts said the volume of activity is too great for the attacks to be manual.…"

http://www.eweek.com/article2/0,1759,1573827,00.asp

Microsoft Confirms Bug In SSL Patch:
"The knowledge base article goes by the unusually long name: 'Your computer stops responding, you cannot log on to Windows, or your CPU usage for the System process approaches 100 percent after you install the security update that is described in Microsoft Security Bulletin MS04-011.'

The problem occurs, according to the article, because Windows tries repeatedly to load drivers that fail to load. Microsoft acknowledges that the problem is a bug in the patch and that the company is investigating solutions.…"

http://www.eweek.com/article2/0,1759,1578752,00.asp

Scams, Lies, Deceit, and Offshoring:
"Someone has to take the jobs that, as President Bush and others say, 'Americans don't want.' There appear to be a large number of these jobs. In fact, it seems that our fastest-growing business segment is the creation of more and more jobs that Americans don't want. Often, American companies will lay people off, only to train newcomers to replace them."

Here is how the real scam works. You are a programmer at one of the big IT or computer companies. You're 55 and nearing a retirement plateau; in fact, you're a liability. You're making, say, $80,000 as a program designer. You have various responsibilities. The company eliminates your position in the process of downsizing.

To be fair to you, it creates a new position, Associate Program Designer, that pays $35,000 a year. Its responsibilities coincidentally match those of your old job. You can take this job, doing what you did before but at a huge cut in pay, or look elsewhere. If the latter, it's apparent that this new job is one that "Americans don't want." The company can then hire a "body shop" to drop in a foreign H-1B or L1 visa holder, who will not be quite as good but will work for a lot less.


This is a bait-and-switch scheme that is designed to screw older and more experienced workers out of their retirement benefits, plain and simple. This sort of thing, unfortunately, is nothing new to corporate America:…

http://www.pcmag.com/article2/0,1759,1573102,00.asp

Phishing Scams Increase 1,200% in 6 Months:
"Beware your email.

In the last six months, the number of phishing email scams has increased 1,200 percent, putting end users and major companies at an even greater risk, according to a report from MessageLabs Inc., a managed email security firm based in New York.

MessageLabs reports that last September its analysts had only seen 279 phishing emails. But that number had risen nearly 800-fold to 215,643. Phishing emails peaked in January with 337,050.… "

Phishing is the latest online scam financial scam. It's a con game based on posing.

Spammers send out millions of emails claiming to be from legitimate organizations, such as major U.S. banks or credit card companies. The spammers even fake the senders address so it appears to be from the company they're posing to be. The message in the email often says there is a problem with the recipient's account and it has been shut down. To reinstate the account, or deal with whatever fictional problem the email refers to, the user is instructed to click on a link that then takes them to a phony Web site.

The users are then led to what is often a perfect replica of the Web site that the spammer is pretending to be. At this point, the victim is asked to 'update' his personal security information, passwords, Social Security numbers, addresses and bank account information. The information is then used to siphon money out of the victim's bank account or to make financial transactions with their money.…

http://www.esecurityplanet.com/trends/article.php/3344141

AntiOnline - Windows XP Security Guide (phase one):
"This guide will take you from a FRESH install of XP, to the high level of security … Note that this is more intended for singular computer use (and possibly work office) and not for mission critical server usage. While yes, … use XP for server usages, because it can handle it with the proper settings, a mission critical server requires a primary focus on the 'Server' portion, rather than being evently distrubuted between server, desktop, and game machine. … when it comes down to mission critical servers, it isn't about bending tools to work, it's about how well they work. Windows XP as a *mission* critical server is not recommended because of latency issues, forced RAM on the GUI, and process handling meant for low latency on the GUI responcivness, instead of packet and server process stability handling."

http://www.antionline.com/showthread.php?s=&threadid=255353

Fonts in Cyberspace:
"A guide to finding language fonts on the Internet. Containing more than 400 sources for 123 languages"

http://www.sil.org/computing/fonts/

Getting a Job in CG: Real Advice from Reel People, Chapter 3: What to Learn. By Sybex - WebReference.com-:
"This book excerpt is from 'Getting a Job in CG: Real Advice from Reel People' ISBN 0-7821-4257-5. All rights reserved. Chapter 3: What to Learn., is posted with permission from Sybex.

Knowing the job descriptions in 3D and effects described in the first two chapters can help you find the kind of job that fits your skills and interests. Perusing the descriptions and sample listings, you might have realized that there are skills you lack.

This chapter explains the skills involved in 3D and effects and gives you direction on how to acquire them.…"

http://www.webreference.com/3d/cg/

Security issues move Linksys routers off the short list:
"As more companies adopt a telecommuting-friendly culture, more employees are taking the plunge for cable or DSL-based Internet access. In many cases, their households have more than one Internet user and are installing turnkey connection-sharing appliances. The two companies that most often come to mind for me as providers of these appliances are the recently Cisco-acquired Linksys and the as-of-yet-to-be acquired NetGear. Linksys is apparently having some engineering difficulties that are leaving its customers exposed to potential security problems.… "

http://techupdate.zdnet.com/techupdate/stories/main/Linksys_routers_and_DDoS.html

ZDNet AnchorDesk: What's wrong with Internet phones:
"The best thing about the traditional phone system is what people take for granted: Any phone on the planet can connect to any other. Some Internet telephone systems, such as Vonage, can also connect to any other phone. But except in extremely rare cases, two people on different VoIP systems can't connect to each other directly over the Internet--they have to use the public phone system as a go-between.… "

http://reviews-zdnet.com.com/AnchorDesk/4520-7297_16-5130570.html?tag=adss

Training:
"This set of labs will help you learn how to design and deploy Extensible Markup Language (XML)-based forms in Microsoft® Office InfoPath® 2003 SP-1."

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/odc_2003_ta/html/odc_landinfo03_tr.asp