Zotob Proves Patching 'Window' Non-existent

By Gregg Keizer, TechWeb News
“Although the initial attack on Windows 2000 PCs by bot worms exploiting a week-old vulnerability hasn't grabbed much traction, the way hackers jumped on the bug is proof that the patching "window" is virtually non-existent, said security experts Tuesday.

"The last week showed once more that there is no more patch window," wrote Johannes Ullrich, chief research officer at the SANS Internet Storm Center, in the group's daily alert. "Defense in depth is your only chance to survive the early release of malware."

Exploits were circulating within three days of Microsoft disclosing the Plug and Play vulnerability and offering up a patch, and within five days, several bot worms -- notably Zotob.a and Zotob.b -- were attacking systems.

"Microsoft must be fuming that virus writers are exploiting security holes in their software so quickly," said Graham Cluley, senior technology consultant for security vendor Sophos, in a statement. "It's not only embarrassing for the software giant, but a real headache for businesses who need to move quickly to roll out security patches."

The reason for the fast hacker turn-around, said Ullrich, is that attackers are sharing more and more information. "Malware can only develop as fast as it is developing in this case because of extensive code sharing in the underground," Ullrich said. "The only way we can keep up with this development is by sharing information as efficiently.

"We need to outshare the attackers.…" ”

http://www.crn.com/nl/security/showArticle.jhtml?articleId=168602090

Spyware Researchers Discover ID Theft Ring

“Sunbelt Software Inc., makers of the enterprise-grade CounterSpy spyware protection product, made the discovery during an audit of "CoolWebSearch," a program that routinely hijacks Web searchers, browser home pages and other Internet Explorer settings.

During the research, Sunbelt researcher Patrick Jordan deliberately installed the "CoolWebSearch application on a machine and immediately noticed that the infected system became a spam zombie that was placing callbacks to a remote server.

When Jordan visited the remote server, he was shocked to find that it was being used to distribute sensitive personal information from millions of PC users infected by the spyware application.

"We found the keylogger transcript files that are being uploaded to the servers. We're talking real spyware stuff…chat sessions, usernames, passwords, bank account information, full names, addresses," said Sunbelt president Alex Eckelberry.

…Eckelberry said the sophistication of the operation suggests it's the work of a "massive identity theft ring" that used keystroke loggers to grab confidential information that could be used to create fake online identities.

…"This is the most repulsive thing I've ever seen. It's very painful to see what's in these log files that are being uploaded in real time. We're seeing a lot of bank information and usernames and passwords to get in," Eckelberry said.

The log files included logins to one business bank account with more than $350,000 and another small company in California with over $11,000, readily accessible.

"There are lots of eBay account information and names and addresses of the people owning those accounts. Names, passwords, all matched up," Eckelberry added

He said the server, which is hosted out of a data center in Texas, was effectively a "massive repository of stolen data" that was being replenished in real time.

"As the [log] file gets to a certain size, it gets taken down and a new file starts generating. This goes on nonstop. We've been watching it for a few days while trying to get to the FBI, and it just keeps growing and growing."

While the site is being hosted in the United States, Eckelberry said the domain name is registered to an offshore company. The huge size of the log files is a clear indication that thousands of machines are pinging back daily.

Where users appeared to be at immediate risk of losing a considerable amount of money, Sunbelt has contacted the affected individuals.

Eckelberry said the "CoolWebSearch" payload included a typical adware download that immediately scanned the infected machine for e-mails to use for spam runs. It then sets up a "very intelligent keylogger" that looks for very specific information, noting that the keystroke logger was able to pick up identity-related data for delivery to the remote server.

Anti-virus vendor Trend Micro Inc. provides a free online scanning tool that detects and deletes the "CoolWebSearch" application. ”

http://www.eweek.com/article2/0,1895,1845248,00.asp?kc=ewnws080905dtx1k0000599

Effective professional blogging

“TechRepublic VP Bob Artner explains what it takes to be an effective professional blogger. He advises avoiding the mistakesof many personal blogs, which he says Bloviate and are Loud,Obnoxious and Gabby.”



http://ct.zdnet.com.com/clicks?c=354577-56849759&brand=zdnet&ds=5&fs=0

Spyware Costs

“A survey of more than 1,000 IT managers and end users reveals that spyware and other unsanctioned downloads are resulting in average monthly costs of $130,000 to IT enterprises. The survey also found that spyware incursions appear to be growing at a rate twice that of computer virus incidents.

…applications that are downloaded and installed on end user PCs without IT sanction, are increasingly represented by instant messaging. "Within the next six months, virtually all end users will have deployed some type of greynet application," the report states. "Based on stated intentions, this number will rise to 93 percent in the next six months."

…Noting that in addition to instant messaging, greynet applications can include P2P file sharing, Web conferencing, Web mail, adware/spyware, and VoIP applications such as Skype, the study found that even among IT managers who have installed perimeter security measures, 77 percent of them had a spyware incident in the past six months. Most of the IT managers said spyware incidents are occurring at the same or greater frequency as six months ago.… ”

http://www.crn.com/nl/security/showArticle.jhtml?articleId=167100251

Not Sure About that Phish? Throw It Back

Recommended Action: If you receive an e-mail from your bank asking you to sign in to verify or update your account then follow these steps:

1. close the email
2. open a new browser window
3. go to the banks web site using your regular bookmark or by typing in the address
4. log in there to see if there are any problems.

http://www.pcmag.com/article2/0,1895,1842338,00.asp

Next Explorer to fail Acid test | Tech News on ZDNet

"'We will not pass this test when IE7 ships,' Chris Wilson, lead program manager for the Web platform in IE, wrote in the IE blog. 'We fully recognize that IE is behind the game today in CSS support. We've dug through the Acid2 test and analyzed IE's problems with the test in some great detail, and we've made sure the bugs and features are on our list--however, there are some fairly large and difficult features to implement, and they will not all sort to the top of the stack in IE7.'

Standards advocates and Web developers have criticized Microsoft for letting Internet Explorer go without a significant upgrade for years. This spring it became clear that Microsoft would finally address long-standing standards-compliance issues in its planned version 7 upgrade.

Microsoft last week came out with a test, or 'beta' version, of its Windows Vista operating system and IE 7.

Wilson said the broad range of Acid2's demands made it more of a 'wish list' than a 'compliance test.'

'As a wish list, it is really important and useful to my team, but it isn't even intended, in my understanding, as our priority list for IE7,' Wilson wrote.

The Web Standards Project responded positively to the announcement, hailing Microsoft's standards to-do list and its openness in acknowledging the test."

http://news.zdnet.com/2100-9588_22-5813897.html?tag=nl.e539

Weekend Project: Get your hard drive back in the fast lane - CNET reviews

If your PC isn't the speedster it used to be, chances are a bloated hard drive is to blame. Steer clear of PC bottlenecks by making the most of Windows' built-in maintenance tools. Just mouse over to your System Tools folder and get ready to fine-tune your PC.

http://reviews.cnet.com/4520-10163_7-5555103-1.html?tag=nl.e501

Is the XP SP2 firewall getting a raw deal?

A current report on a new denial of service vulnerability involving Windows RDP (Remote Desktop Protocol) blaming the Windows XP SP2 (Service Pack 2) firewall has touched off firestorm of inaccurate coverage fthat gets "blindly regurgitated in the forums." George Ou sets us straight.

“A recent report on a new denial of service vulnerability involving Windows RDP (Remote Desktop Protocol) blaming the Windows XP SP2 (Service Pack 2) firewall has touched off a rash of sensationalism from other media outlets that gets blindly regurgitated in the forums. This has caused some unwarranted confusion and fear in the IT industry. The original story incorrectly blamed the XP SP2 firewall for failing to protect against the RDP flaw. This was a false characterization of the XP SP2 firewall which has a history of being mischaracterized as something that breaks a lot of applications or is somehow unreliable. This has resulted in some harm to the general public because too many windows users are refusing to protect themselves with Windows XP SP2. Larry Seltzer did a wonderfully accurate and educational assessment on XP SP2 but is drowned out by all the doom and gloom sensationalism.

When Microsoft first came out with XP SP2 last year, its new firewall feature was incorrectly blamed for breaking hundreds of applications when in fact any personal firewall installed without the proper holes drilled would have caused the exact same issues. This latest story on the RDP vulnerability seems to be yet another slam on the SP2 firewall with the incorrect accusation that it fails to protect against this new RDP denial of service vulnerability. While it's technically true that a SP2 firewall with port TCP 3389 (used by RDP) opened to anyone will result in a successful denial of service attack to an unpatched windows machine, this is the normal behavior of any stateful packet inspection firewall.… ”

You can protect all the PCs in your office or home by simply implementing a router with a basic firewall or just NAT (Network Address Translation) capability. A router for the home with a built-in switch can be purchased for less than $40. Not only does the router protect you from a vast array of attacks, it also acts as an Internet sharing device. Another easy thing to do is to turn on the Windows XP SP2 firewall make sure that the RDP service is either entirely blocked or only permitted to enter from trusted network sources. You can find more in-depth information here to turn off the RDP service entirely or configure the XP SP2 firewall. One of the nicest features of the XP SP2 firewall besides the fact that it's free with Windows is that it can easily be managed from a central location. This can be done from a legacy Windows NT 4.0 domain environment using a script or better yet from a group policy in a Windows 2000/2003 Active Directory. This allows a Microsoft network administrator to quickly configure every single windows XP computer in the company with a single login script or a single group policy.

http://blogs.zdnet.com/Ou/index.php?p=81&tag=nl.e539

Domain Hijacking

“Domain-name hijacking occurs when someone fraudulently takes control of a domain name, often by masquerading as the legitimate administrative contact for a domain name.

The e-mail addresses of administrative contacts, widely available in the WHOIS database of domain registrations, are used to verify domain-name holders.

The domain-name hijacking report, available here as a PDF, came from ICANN's Security and Stability Advisory Committee.

The report, announced Wednesday during an international meeting of the ICANN (Internet Corporation for Assigned Names and Numbers) in Luxembourg, followed at least two high-profile incidents this year of what is known as domain-name hijacking—one hitting New York-based ISP Panix and another affecting e-mail provider Hushmail Communications Corp.

The committee advises the domain-name system overseer's board of directors and constituents such as the registrars that sell domain names to individuals and business and the registries that manage domains such as .com and .net.

While the Panix and Hushmail cases were widely reported, the ICANN committee report also cited a dozen other examples of stolen domain names. The hijacks hit such high-profile names as wifi.com, commericials.com, nike.com and ebay.de.

Committee members expressed optimism that the report will lead to swift action, but it was still unclear as of late Wednesday whether ICANN's board planned to address the report's findings and recommendations at its meeting later this week.”

http://www.eweek.com/article2/0,1895,1836820,00.asp?kc=ewnws071505dtx1k0000599

Hollingsworth Rambles

“Not a Podcast?
Latlely I've been hearing a lot of chatter on the podoshpere ragging on conventional broadcasters who make their shows available as podcasts. The line of reasoning seems to be that when Mr. and Ms. Big Broadcaster post their conventional broadcasts on the Internet as downloadable mp3s, they're just posers jumping on the bandwagon.

Agreed, professional broadcasts lack the home-made charm of many current podcasts. That's probably more of a threat to the podcast producers than the podcast listeners.… ”

http://hollingsworthrambles.blogspot.com/2005/06/not-podcast.html

Does OS matter anymore for security?

by George Ou
“…It's usually taken as gospel in many IT circles to assume that Windows Security is an oxymoron; anyone who dares to suggest using Microsoft IIS 6.0 for a public web server faces serious ridicule. To see if there was any truth to this presumption that Windows Server is fundamentally insecure, I looked up these hacking statistics from www.zone-h.org for 2003 to 2004. Not only did it not show that Windows was hacked more often, but just the opposite. The Linux servers were actually getting hacked and defaced far more often than the Windows server and Apache was also being hacked and defaced more than Microsoft IIS.

While most security research comparing various operating systems and applications focus on statistics for the number of vulnerabilities and their criticality, zone-h takes a completely different approach by looking at actual server compromises. Even more significant is that these are not theoretical hacks in the laboratory but actual website defacements that were confirmed by the public. Zone-h is essentially a centralized "score board" for hackers who want bragging rights for their handy work. While the source of the data is highly despicable, there is no denying the value of such data being collected regardless of the source because of its accuracy. When a website is hacked and defaced, there is little room for interpretation for what has transpired because the proof is in the humiliating public defacement. While these particular defacements are often the work of recreational hackers who hack for sport and not the work of a professional criminal who hacks for financial gain, the techniques uses to compromise the servers are usually identical.…

At the end of the zone-h report for 2003-2004, the author concludes (accurately, in my experience) that the argument about which OS is more secure is totally irrelevant since most modern exploits are against applications and not the operating system hosting them. This is true because servers are rarely deployed wide open on the Internet without a firewall. A properly configured firewall minimizes the vulnerability footprint to only permit the ports necessary for a specific application to work, which means the application is the only thing exposed to the hacker. The zone-h report doesn't actually prove which OS is more secure, only that the OS is mostly irrelevant and the Windows server security jokes are more myth than fact.”

http://blogs.zdnet.com/Ou/?p=77&part=rss&tag=feed&subj=zdblog

PCs Have 50-50 Shot At Infection In Just 12 Minutes

By Gregg Keizer, TechWeb News
6:04 PM EDT Wed. Jul. 06, 2005

Sophos estimated that a new PC stands a 50-50 chance of being infected by a worm within 12 minutes of being connected to the Internet. (Other analysts, such as the Internet Storm Center, put the current average survival time at around 34 minutes.)

“The number of new viruses, worms, and Trojans are up nearly 60 percent in the first half of 2005, a U.K.-based security company said Wednesday, while the length of time an unprotected PC survives on the Internet has shrunk to a measly dozen minutes.

Sophos reported that it had pinpointed 7,944 new pieces of malicious software in the first six months of the year, an increase of 59 percent compared to the first half of 2004.

The firm's researchers tracked an even larger spike in the number of keylogging Trojan horses. According to Sophos, that category has tripled in number.

"We are seeing a large amount of new Trojan horses on a daily basis, representing what may be the most significant development in malware writing," said Gregg Mastoras, a Sophos senior security analyst, in a statement.”

http://www.crn.com/nl/security/showArticle.jhtml?articleId=165700440

Sell It on eBay: the Web Site Why not add a Buy It Now?

"Want to use a Reserve Price...why not add a Buy It Now?

eBay Live is off and running and I just picked up a terrific tip in a session taught by Janelle Elms, eBay University instructor and author of eBay Your Business.

It is common knowledge the buyers are very put off by Reserve Price auctions. Buyers understand that sellers need to protect their bottom line, but the hide-and-seek of figuring out what someone's reserve price is can be awfully frustrating."

why not simply add the Buy It Now feature to any reserve price auction as well. If you set the Buy It Now amount to be the same as your reserve, potential buyers examining your auction can snap up your item immediately, at the price you want.

http://sellitonebay.blogspot.com/

VARBusiness | It's a Microsoft World...Where Do You Fit In?

“Taken as a whole, the sheer size of the Microsoft platform broadens the opportunity for consulting services and custom-development engagements for partners, many of whom are increasingly buying into the all-Microsoft mantra. In fact, studies reveal that devoted loyalists are growing by a staggering number, even by Microsoft's standards. That's despite the company's late attempt to catch Google in search, its ongoing struggles to meet its own product deadlines involving Longhorn and other wares, its never-ending battle with hackers--anyone not know someone impacted by spyware?--and its ever-growing complexity when it comes to licensing, its product portfolio or even its basic value proposition. Despite these challenges, the number of people, companies and initiatives that depend on Microsoft technology are simply jaw-dropping… ”

http://www.varbusiness.com/nl/insider/showArticle.jhtml?articleId=164303410

Down to the Wire

Thomas Bleha
From Foreign Affairs, May/June 2005

“In the first three years of the Bush administration, the United States dropped from 4th to 13th place in global rankings of broadband Internet usage. Today, most U.S. homes can access only "basic" broadband, among the slowest, most expensive, and least reliable in the developed world, and the United States has fallen even further behind in mobile-phone-based Internet access. The lag is arguably the result of the Bush administration's failure to make a priority of developing these networks. In fact, the United States is the only industrialized state without an explicit national policy for promoting broadband.

It did not have to be this way. Until recently, the United States led the world in Internet development. In the late 1960s and 1970s, the Department of Defense's Advanced Research Projects Agency conceived of and then funded the Internet. In the 1980s, the National Science Foundation partially underwrote the university and college networks -- and the high-speed lines supporting them -- that extended the Internet across the nation. After the World Wide Web and mouse-driven browsers were developed in the early 1990s, the Internet was ready to take off. President Bill Clinton and Vice President Al Gore showed the way by promoting the Internet's commercialization, the National Infrastructure Initiative, the Telecommunications Act of 1996, and remarkable e-commerce, e-government, and e-education programs. The private sector did the work, but the government offered a clear vision and strong leadership that created a competitive playing field for early broadband providers. Even though these policies had their share of detractors -- who claimed that excessive hype was used to sell wasteful projects and even blamed the Clinton administration for the dot-com bust -- they kept the United States in the forefront of Internet innovation and deployment through the 1990s.

Things changed when the Bush administration took over in 2001 and set new priorities for the country: tax cuts, missile defense, and, months later, the war on terrorism. In the administration's first three years, President George W. Bush mentioned broadband just twice and only in passing. The Federal Communications Commission (FCC) showed little interest in opening home telephone lines to outside competitors to drive down broadband prices and increase demand.

When the United States dropped the Internet leadership baton, Japan picked it up. In 2001, Japan was well behind the United States in the broadband race. But thanks to top-level political leadership and ambitious goals, it soon began to move ahead. By May 2003, a higher percentage of homes in Japan than in the United States had broadband, and Japan had moved well beyond the basic connections still in use in the United States. Today, nearly all Japanese have access to "high-speed" broadband, with an average connection speed 16 times faster than in the United States -- for only about $22 a month. Even faster "ultra-high-speed" broadband, which runs through fiber-optic cable, is scheduled to be available throughout the country for $30 to $40 a month by the end of 2005. And that is to say nothing of Internet access through mobile phones, an area in which Japan is even further ahead of the United States.

It is now clear that Japan and its neighbors will lead the charge in high-speed broadband over the next several years. South Korea already has the world's greatest percentage of broadband users, and last year the absolute number of broadband users in urban China surpassed that in the United States. These countries' progress will have serious economic implications. By dislodging the United States from the lead it commanded not so long ago, Japan and its neighbors have positioned themselves to be the first states to reap the benefits of the broadband era: economic growth, increased productivity, technological innovation, and an improved quality of life.…”

http://www.foreignaffairs.org/20050501faessay84311/thomas-bleha/down-to-the-wire.html

The red herring of data protection | Between the Lines | ZDNet.com

by Eric Norlin
"Set aside for a moment the debate about why, all of a sudden, we're hearing about all of this. Instead, focus on the reasons behind the data loss: physical tapes lost in transit, hackers, malicious insiders, bad network security practices. Notice that the reasons behind the loss are all over the map. We're told the solution is better network security, better encryption, better corporate safeguards, and better 'data protection.' Of course, all of these 'solutions' are a bit specious, as they're always accompanied by the corporate lawyer caveat, 'we cannot guarantee that this won't happen again.'

All of this will ultimately result in some bloated piece of federal legislation around 'data privacy and protection' that will impose new restrictions on corporate security practices and result in a wave of new spending on IT solutions to help solve that problem. But will we have solved it, really? "

I don't think so.

In the end, this "data loss" problem isn't really about data loss, data protection or data safeguarding at all. That, my friends, is a red herring. The real question to be asked is: Why do all of these corporations need to store all of this personal data in the first place? Why does my credit card company need to store my social security number? Why does Amazon need to store my credit card number? Why shouldn't every company store only what I tell them they can store? And why shouldn't the data that they store be as little as they possibly need to conduct business?

Assuming that there's even a smidgen of validity in my line of questioning, the next question becomes how — how do we go about making the possibility behind these questions a reality?

http://blogs.zdnet.com/BTL/index.php?p=1529&tag=nl.e540

New Crypto-Gram Newsletter

“In this issue:

• 2005 Internet Attack Trends
• Stupid People Buy Fake Concert Tickets

  Only an idiot would buy a printout from a scalper, because there's no way to verify that he will only sell it once. This is probably obvious to anyone reading this, but it turns out that it's not obvious to everyone.

• Backscatter X-Ray Technology

  Backscatter X-ray technology is a method of using X rays to see inside objects. The science is complicated, but the upshot is that you can see people naked.

• Crypto-Gram Reprints
• Insider Attacks
• Accuracy of Commercial Data Brokers

  From the press release: "100% of the eleven participants in the study discovered errors in background check reports provided by ChoicePoint. The majority of participants found errors in even the most basic biographical information: name, social security number, address and phone number (in 67% of Acxiom reports, 73% of ChoicePoint reports). Moreover, over 40% of participants did not receive their reports from Acxiom -- and the ones who did had to wait an average of three months from the time they requested their information until they received it."

• News
• Eric Schmidt on Secrecy and Security

  "Schmidt: Transparency is not necessarily the only way you achieve security. For example, part of the encryption algorithms are not typically made available to the open source community, because you don't want people discovering flaws in the encryption."

  Actually, he's wrong. Everything about an encryption algorithm should always be made available to everyone

• U.S. Medical Privacy Law Gutted

  The civil penalties have long been viewed as irrelevant by the healthcare industry. Now the criminal penalties have been gutted. The Justice Department has ruled that the criminal penalties apply to insurers, doctors, hospitals, and other providers -- but not necessarily their employees or outsiders who steal personal health data. This means that if an employee mishandles personal data, he cannot be prosecuted under HIPAA unless his boss told him to do it. And the provider cannot be prosecuted unless it is official organization policy.

• Risks of Cell Phones on Airplanes
• Billions Wasted on Anti-Terrorism Security

  "Among the problems:

  "Radiation monitors at ports and borders that cannot differentiate between radiation emitted by a nuclear bomb and naturally occurring radiation from everyday material like cat litter or ceramic tile.

  "Air-monitoring equipment in major cities that is only marginally effective because not enough detectors were deployed and were sometimes not properly calibrated or installed. They also do not produce results for up to 36 hours -- long after a biological attack would potentially infect thousands of people.

  "Passenger-screening equipment at airports that auditors have found is no more likely than before federal screeners took over to detect whether someone is trying to carry a weapon or a bomb aboard a plane.

  "Postal Service machines that test only a small percentage of mail and look for anthrax but no other biological agents."

  The Washington Post had a series of articles. The first lists some more problems:

  "The contract to hire airport passenger screeners grew to $741 million from $104 million in less than a year. The screeners are failing to detect weapons at roughly the same rate as shortly after the attacks.

  "The contract for airport bomb-detection machines ballooned to at least $1.2 billion from $508 million over 18 months. The machines have been hampered by high false-alarm rates.

  "A contract for a computer network called US-VISIT to screen foreign visitors could cost taxpayers $10 billion. It relies on outdated technology that puts the project at risk.

  "Radiation-detection machines worth a total of a half-billion dollars deployed to screen trucks and cargo containers at ports and borders have trouble distinguishing between highly enriched uranium and common household products. The problem has prompted costly plans to replace the machines.

• Counterpane News
• Attack on the Bluetooth Pairing Process

  According to the Bluetooth specification, PINs can be up to 128 bits long. Unfortunately, most manufacturers have standardized on a four decimal-digit PIN. This attack can crack that 4-digit PIN in less than 0.3 sec on an old Pentium III 450MHz computer, and in 0.06 sec on a Pentium IV 3Ghz HT computer.

  And it's not just the PIN; the entire protocol was badly designed.

  At first glance, this attack isn't a big deal. It only works if you can eavesdrop on the pairing process. Pairing is something that occurs rarely, and generally in the safety of your home or office. But the authors have figured out how to force a pair of Bluetooth devices to repeat the pairing process, allowing them to eavesdrop on it. They pretend to be one of the two devices, and send a message to the other claiming to have forgotten the link key. This prompts the other device to discard the key, and the two then begin a new pairing session.

  Taken together, this is an impressive result. I can't be sure, but I believe it would allow an attacker to take control of someone's Bluetooth devices. Certainly it allows an attacker to eavesdrop on someone's Bluetooth network.

  Combined with the long-range Bluetooth "sniper rifle," Bluetooth has a serious security problem.

• Password Safe 2.11
• Public Disclosure of Personal Data Loss
• Holding Computer Files Hostage
• White Powder Anthrax Hoaxes
• Comments from Readers”

http://www.schneier.com/crypto-gram-0506.html

Encrypted Lockbox Aims to Clean Up Password Clutter

According to Schneier's PasswordSafe documentation, users normally write their passwords on pieces of paper, leaving accounts vulnerable to thieves or internal snoops.

In some cases, users work around the confusion by choosing the same password for different applications, which presents a bigger risk if that password gets hijacked.

PasswordSafe uses the popular Blowfish encryption algorithm and appeals to users with a simple, user-friendly interface.

“Bruce Schneier's PasswordSafe lockbox, which provides a free utility for users to encrypt and manage multiple passwords on a computer, is ready for a new phase of open-source development.

The celebrated cryptographer, who is credited with designing or co-designing several widely used encryption algorithms, announced the release of Version 2.1 of the database utility as a full-fledged open-source project at SourceForge.

In a blog entry, Schneier said the project is now being managed by Rony Shapiro, a British programmer specializing in network security.

Schneier, who is founder and chief technology officer of Counterpane Internet Security Inc., said the tool is perfect for Web users who struggle to remember all their usernames and passwords.

"I have long advocated writing them all down on a piece of paper and putting it in your wallet, [but] I designed PasswordSafe as another solution," he explained.

He said the tool offers "security through simplicity" by encrypting all of a user's passwords using a single passphrase.…”

Schneier on Security

Currently, Password Safe is an open source project at SourceForge, and is run by Rony Shapiro. Thank you to him and to all the other programmers who worked on the project.

Note that my Password Safe is not the same as this, this, this, or this PasswordSafe. (I should have picked a more obscure name for the program.)

It is the same as this, for the PocketPC.

http://www.schneier.com/blog/archives/2005/06/password_safe.html

http://www.eweek.com/article2/0,1759,1828954,00.asp?kc=ewnws061705dtx1k0000599

Contrary Brin: Networks and Netwar

“This week I'd like to point attention to an interesting article by one of the smartest guys in Santa Monica, California. David Ronfeldt works for the Rand Corporation, the original 'think tank' which ponders many imponderables for the more far seeing (and currently beleaguered) parts of the federal government. It has been posted on rand's website at
http://www.rand.org/publications/RP/RP1169/.

This paper--written in 2002 and now a chapter in a new book (Environmentalism and the Technologies of Tomorrow, Island Press, 2005) -- speculates about the future of the environmental movement as a function of its increasing use of network forms of organization and related strategies and technologies attuned to the information age. The paper does so by nesting the movement's potential in a theoretical framework about social evolution.

This framework holds that people have developed four major forms for organizing their societies: first tribes, then hierarchical institutions, then markets, and now networks. The emergence of a new, network-based realm augurs a major rebalancing in relations among government, market, and civil-society actors. In the near term (years), there will be continuing episodes of social conflict as some environmental groups press their case, often by using netwar and swarming strategies.… ”

Spoofing flaw resurfaces in Mozilla browsers

By Joris Evers, CNET News.com

“A 7-year-old flaw that could let an attacker place malicious content on trusted Web sites has resurfaced in the most recent Firefox browser, Secunia has warned.

The flaw, which also affects some other Mozilla Foundation programs, lies in the way the software handles frames, which are a way of showing Web content in separate parts of the browser window. The applications don't check whether the frames displayed in a single window all originate from the same Web site, Secunia said in an advisory on Monday. Firefox 1.x, Mozilla 1.7.x and Camino 0.x versions are vulnerable to the flaw, the security monitoring company said.

As a result, an attacker could insert content into a frame on a trusted Web site, Secunia said. Account holders who believe they are interacting with a frame belonging to an online bank could be tricked into giving up personal information or downloading malicious code, for example. Secunia rated the issue "moderately critical."

The same "frame injection" vulnerability in Mozilla's browsers was detailed by Secunia in July of last year. At the time, it did not affect the most recent versions of the applications.

For a spoofing attempt to work, a surfer would need to have both the attacker's Web site and a trusted Web site open in different windows. A click on a link on the malicious site would then display the attacker's content in a frame on the trusted Web site, Secunia said. The company advised people not to visit trusted and untrusted Web sites at the same time.…”

The more things change… The more they brag about how secure they are.

CRN Breaking News Firefox Vulnerable To 7-Year-Old Bug

According to Danish security firm Secunia, Mozilla 1.7.x and Firefox 1.x are vulnerable to a frame injection flaw that first surfaced in 1998. Hackers could exploit the bug to insert their own content into the view of a legitimate site, to, for instance, pose as the log-in frame, then collect usernames and passwords to online bank accounts.

"The flaw means that if you are viewing a trusted site in one window (PayPal or your bank) and open a site belonging to a spoofer in another window, the spoofer can insert code in the window showing the trusted site," wrote a moderator on Mozilla's online forum Monday.

http://www.crn.com/nl/crnupdate/showArticle.jhtml?articleId=164300698

http://news.zdnet.com/2100-1009_22-5734121.html?tag=nl.e589