Security Vendor Issues Dec. Vulnerabilities List:
"Central Command Inc. on Thursday released its so-called Dirty Dozen list of top twelve viruses for December, 2003. The report is based on virus incidents confirmed through the Medina, Ohio-based company's Emergency Virus Response Team."

According to the company, the Gibe.C worm, with its HTML e-mail message that impersonated a Microsoft Web site, retained the top spot for December, a position that Klez.E held five times during the year.…

Gibe.C—21.4 percent
Klez.E—14.7 percent
MiMail.I—12.8 percent
MiMail.J—5.9 percent
BugBear.B—5.2 percent
MiMail.K—5.1 percent
MiMail.A—3.7 percent
Sober.C—1.9 percent
Nachi—1.6 percent
MiMail.C—1.6 percent
Hawawi.G—1.2 percent
Dumaru.A—1.1 percent
Others—23.8 percent

http://www.eweek.com/article2/0,4149,1425300,00.asp?kc=EWNWS010204DTX1K0000599

New Worm Spreads Via MSN Messenger:
"Anti-virus experts are watching a new worm that spreads through Microsoft Corp.'s MSN Messenger client. The worm is not harmful to infected machines and has infected only a few PCs at this point, according to an analysis by Trend Micro Inc.

Known as Jitux, the worm is self-propagating and contains a link to a Web site that automatically downloads an executable file named 'jituxramon.exe' to the PC. Once the file runs, the worm begins sending out copies of itself to all of the names in the user's Messenger contact list. The worm, first discovered Tuesday, is capable of spawning multiple instances of itself on one PC.… "

http://www.eweek.com/article2/0,4149,1424692,00.asp?kc=EWNWS010204DTX1K0000599

Top Technologies of 2003:
"Anti-Spam Software and Services

As junk e-mail reached epidemic proportions this year, spam blockers rushed in to rescue ailing e-mail in-boxes."

Centralized Patch Management
Patches were the bane of IT managers' existence this year, and many have turned or are turning to centralized patch management to ease the burden (if not their ire over having to patch in the first place).…

http://www.eweek.com/article2/0,4149,1420259,00.asp?kc=EWNWS123103DTX1K0000599

An Unrepentant Spammer Considers the Risks:
"Alan Ralsky, according to experts in the field, has long been one of the most prolific senders of junk e-mail messages in the world. But he has not sent a single message over the Internet in the last few weeks.

He stopped sending e-mail offers for everything from debt repayment schemes to time-share vacations even before President Bush, on Dec. 16, signed the new Can Spam Act, a law meant to crack down on marketers like Mr. Ralsky.

He plans to resume in January, he said, after he overcomes some computer problems, and only after he changes his practices to include in his messages a return address and other information required by the law, the title of which stands for Controlling the Assault of Non-Solicited Pornography and Marketing. "

That is quite a switch for Mr. Ralsky, who has earned a reputation as a master of cyberdisguise. By his own admission, he once produced more than 70 million messages a day from domains registered with fake names, largely by way of foreign countries - or sometimes even by way of hijacked computers - so that the recipients could not trace the mail back to him.

Most experts in junk e-mail, known as spam, have dismissed the new federal law as largely ineffectual. And many high-volume e-mailers say the law may even improve the situation for them because it wipes away a handful of tougher state laws.

But Mr. Ralsky, who lives in a Detroit suburb, says the law's potential penalties - fines of up to $6 million and up to five years in jail - are making him rethink his business.

"Of course I'm worried about it," he said after the law was signed. "You would have to be stupid to try to violate this law."

No one is saying that e-mail in-boxes will be clean of spam any time soon. But the world is getting to be a much more hostile place for spammers, particularly those who send some of the most offensive messages. The biggest threat is not so much the new law, though it is expected to play a role in stepped-up enforcement, as the increased willingness of prosecutors to go after spammers.…

http://www.nytimes.com/2003/12/30/technology/30spam.html?pagewanted=all&position=

Download details: Security Update for Windows XP (KB823980):
"This update addresses the vulnerability addressed in Microsoft Security Bulletin 03-026. Find out about more recent critical updates in the Overview section."

http://www.microsoft.com/downloads/details.aspx?FamilyID=2354406c-c5b6-44ac-9532-3de40f69c074&displaylang=en

Revamping the Security Bulletin Release Process:
"Security Bulletins Expanded and Summarized by Product

Tools & Resources

The most significant change that the new security bulletin process will introduce for customers will be in the number and timing of security patches. Consequently, customers may need to revisit some of the processes they use for deploying patches. The following tools and resources will help customers evaluate, plan, manage and deploy security patches:"

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/revsbwp.asp

Security Bulletin Search:
"Microsoft Releases Enhanced Security Bulletin Search Tool"

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/current.asp

The Best Products of 2003
"PC Magazine's Best Products List is out."

• Desktops & Notebooks
• Processors
• Digital Imaging
• Printers
• Productivity Software
• Utilities
• Audio
• Video
• Peripherals
• Home Entertainment
• Mobile Devices & Services
• Open-Source Tools
• Networking
• Development Tools
• Games
• Education & Reference

http://www.pcmag.com/article2/0,4149,1421871,00.asp

InformIT.com : Design & Creative Media > Web Design:
"Web Design Reference Guide"

The Guide is broken into several sections, as follows:

• Web Design Reference Guide


• Articles and sample chapters


• Books and e-books


• Online resources

The Web Design Reference Guide is continuously updated. Each
week, you can expect new content with the latest news and information from the
world of Web design.

Table of Contents
http://www.informit.com/isapi/guide~webdesign/seq_id~3/guide/content.asp

http://www.informit.com/topics/index.asp?guide=webdesign

The Law of War in the War on Terror:
"What are the boundaries of the Bush administration's 'war on terrorism?' The recent battles fought against the Afghan and Iraqi governments were classic wars between organized military forces. But President George W. Bush has suggested that his campaign against terrorism goes beyond such conflicts; he said on September 29, 2001, 'Our war on terror will be much broader than the battlefields and beachheads of the past. The war will be fought wherever terrorists hide, or run, or plan.'

This language stretches the meaning of the word 'war.' If Washington means 'war' metaphorically, as when it speaks about a 'war' on drugs, the rhetoric would be uncontroversial, a mere hortatory device intended to rally support for an important cause. Bush, however, seems to think of the war on terrorism quite literally -- as a real war -- and this concept has worrisome implications. The rules that bind governments are much looser during wartime than in times of peace. The Bush administration has used war rhetoric precisely to give itself the extraordinary powers enjoyed by a wartime government to detain or even kill suspects without trial. In the process, the administration may have made it easier for itself to detain or eliminate suspects. But it has also threatened the most basic due process rights."

http://www.nytimes.com/cfr/international/20040101faessay_v83n1_roth.html?pagewanted=all&position=

ZDNet AnchorDesk: Greatest hits: The top columns of 2003

http://reviews-zdnet.com.com/4520-7298-5114689.html

Of Dying Viruses and Dangerous Xmas Cards:
"While antivirus vendors have reported several new viruses and malicious attackers in the past week, we have not seen any new large scale outbreaks. However, the ghosts of virus past are still with us -- Klez, Blaster, Swen, Bugbear, Dumaru, Mimail, and Welchia\Nachi all haunt the top ten. According to virus analysts, the Welchia\Nachi worm has only another week or so to live, as it is supposed to remove itself in 2004. Despite this fact, it is still infecting at a good rate…"

2003 may go down in history as the year of the spammer, as there has been more spam sent and received than in any other year. eWeek reported Monday Dec 15th that a judge in California ruled to allow pop up spammers to continue to operate for the time being. One spammer, in particular, was sending Windows Messenger Service popups to PCs that were not running a firewall or had the service turned on (it's on by default in Windows XP/2000). The ruling may trigger more spammers to try their hand at that kind of advertising.…

http://www.pcmag.com/print_article/0,3048,a=115069,00.asp

Microsoft Security FAQ :
"TOP Frequently Asked Questions

Note that this is NOT a complete list of all the questions answered in the FAQ.
Chances are, your question has probably already been answered. If your question is not listed below, you may want to see the complete table of contents at: http://securityadmin.info/faq.htm#contents "

http://securityadmin.info/faq.asp

Top Ten Web Design Mistakes of 2003 (Jakob Nielsen's Alertbox):
"Sites are getting better at using minimalist design, maintaining archives, and offering comprehensive services. However, these advances entail their own usability problems, as several prominent mistakes from 2003 show. "

http://www.useit.com/alertbox/20031222.html

Rapid Application Development with Mozilla: Navigation. Pt. 1 - WebReference.com -:
"This chapter is from the book 'Rapid Application Development with Mozilla' Nigel McFarlane. (ISBN 0131423436). "

http://www.webreference.com/programming/mozilla/

Threat From Sober Variant Grows:
"A variant of the Sober mass-mailing worm appears to be gaining more traction as leading security vendors increase their threat levels.

Increasing prevalence of the W32/Sober.C worm prompted Network Associates Inc. on Sunday to raise its risk assessment to medium from low. Sober.C is most active in Germany, where e-mail security vendor MessageLabs Inc. said 83 percent of samples had originated."

Other security vendors all have rated Sober.C's threat as low or medium. F-Secure Corp. tagged it a medium threat, ranking it a level 2 threat out of three. Symantec Corp. rated it as a level 2 threat out of five, or a low threat. MessageLabs also consider the risk "low," while saying that it has intercepted a "significant number of copies" of the worm.

Sober.C first appeared on Saturday, and New York-based MessageLabs reported its highest number of interceptions of the worm on Sunday.

Sober.C, once activated, e-mails itself to a user's Microsoft Outlook address book and sends outgoing messages through its own SMTP engine, said Network Associates, of Santa Clara, Calif. Along with e-mail, Sober.C can spread through peer-to-peer filing sharing networks.…

Sober.C, written in Visual Basic, can infect systems running Windows 2000, Windows 95, Windows 98, Windows NT and Windows Server 2003.

http://www.eweek.com/article2/0,4149,1420314,00.asp

In 1998, President Clinton noted that "information technology now accounts for more than a third of our economic growth, and government should follow one guiding principle: First, do no harm."

News: New threat to Net's future?:
"In complex political systems, the objective of an action can be honorable, but the impact of an action can be completely at odds with the objective. This is largely because the tools we use to encourage behavior in such systems are often crude and imprecise.

On Oct. 6, the 9th U.S. Circuit Court of Appeals issued an opinion in the case of Brand X Internet v. the Federal Communications Commission that has the potential to delay the progress of the Internet in the United States by certainly years and potentially decades. Through its actions, the 9th Circuit has 'invited' the 50 independent and natural bureaucratic state-based public utility commissions directly into the fold of the Internet. "

How the 9th Circuit accomplished this feat is both curious and confusing. The case in question deals with whether cable lines that deliver Internet service can be considered a "telecommunications service." This wording is critical, because Congress and the FCC have made it clear that states can regulate "telecommunications services," but must keep their hands off "information services."

In 1998, the same year Clinton made his declaration, the city of Portland mandated that AT&T, as a requirement for approval of its acquisition of TCI, open up its broadband lines to competitive carriers. Ruling on this in 2000, the 9th Circuit stated that the city of Portland could not mandate this behavior, as its jurisdiction was over cable franchises, and these broadband connections did not technically represent a cable franchise.

But the 9th Circuit did not stop there. It made one more historical but seemingly unnecessary step. It declared cable modem service a "telecommunications service."

The FCC was compelled to react to the 9th Circuit Court's assertion, as it flew in the face of the FCC position on this matter, as well as the clear intent of Congress and the Executive Branch. (Both had echoed a desire to keep the Internet unregulated.) In 2002, in an effort to clarify and correct the decision in Portland, the FCC ruled that cable modem services are "interstate information services" and not "telecommunication services." Seven different petitions for review of the FCC's "information services" ruling were filed in the 3rd, 9th and D.C. Circuits. Under the multicircuit rules, a judicial lottery was held, and the 9th Circuit was ironically elected to rule on the FCC's ruling.


http://zdnet.com.com/2100-1107_2-5130490.html

SecurityFocus HOME Infocus: Firewall Evolution - Deep Packet Inspection:
"Deep Packet Inspection is a term used to describe the capabilities of a firewall or an Intrusion Detection System (IDS) to look within the application payload of a packet or traffic stream and make decisions on the significance of that data based on the content of that data. The engine that drives deep packet inspection typically includes a combination of signature-matching technology along with heuristic analysis of the data in order to determine the impact of that communication stream. While the concept of deep packet inspection sounds very nice it is not so simple to achieve in practice. The inspection engine must use a combination of signature-based analysis techniques as well as statistical, or anomaly analysis, techniques. Both of these are borrowed directly from intrusion detection technologies. In order to identify traffic at the speeds necessary to provide sufficient performance newer ASICs will have to be incorporated into existing firewall designs. These ASICs, or Network Processors Units (NPUs), provide for fast discrimination of content within packets while also allowing for data classification. Deep Packet Inspection capable firewalls must not only maintain the state of the underlying network connection but also the state of the application utilizing that communication channel."

http://www.securityfocus.com/infocus/1716

FAQ: Firewall Forensics (What am I seeing?):
"This document explains what you see in firewall logs, especially what port numbers means. You can use this information to help figure out what hackers are up to.

This document is intended for both security-experts maintaining corporate firewalls as well as home users of personal firewalls. "

http://www.secinf.net/firewalls_and_VPN/FAQ_Firewall_Forensics_What_am_I_seeing_.html

News: IE fix mends flawed open-source patch:
"A Web site that published a third-party patch to fix a security hole in Microsoft's Internet Explorer has had to reissue the patch, after the original was found to be flawed.

Openwares.org published the second patch Saturday, after the first was found to contain a buffer overflow exploit. This exploit, which allowed an attacker to take control of the patched PC, might have been far more damaging than the flaw the patch aimed to fix."

The IE vulnerability, which was first reported in late November, allows a browser to display one URL in the address bar while the page that's being viewed is actually hosted elsewhere, making the user more susceptible to ruses like "phishing," in which spoof e-mails direct people to fake Web sites that seem to belong to legitimate companies. However, Openwares' first fix, which worked by filtering out any URLs containing suspicious characters, would work only with addresses that had less than 256 bytes. Larger addresses produced a buffer overflow.

Openwares' administrator said: "The new version has been rewritten and tested by dozens of users who helped out. If you're unsure, look at the new source code for yourself."

By early morning Monday, there had been 2,500 downloads of the new patch. However, this is a minute fraction of IE users, who make up more than 90 percent of the Internet population.

Microsoft has still not released a fix for the IE problem or given any indication as to when one might be available. In October, the Redmond, Wash., software maker adopted a policy of releasing only one patch each month, but it has already announced that it will be skipping its December release; IE is expected to remain vulnerable until at least mid-January.

Earlier in December, weeks after the IE flaw was discovered, Iain Mulholland, a security program manager at Microsoft, said the company was putting heavy emphasis on increasing the quality of its patches and that the approach has had an effect on the timing of releases.…

http://zdnet.com.com/2100-1105_2-5130708.html