-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ********************************************************************** SANS NEWSBITES The SANS Weekly Security News Overview Volume 4, Number 18 May 1, 2002 Editorial Team: Kathy Bradford, Dorothy Denning, Roland Grefer, Bill Murray, Stephen Northcutt, Alan Paller, Marcus Ranum, Eugene Schultz ********************************************************************** Last chance this spring for security training in Washington DC area: next week. http://www.sans.org/CapitolHill TOP OF THE NEWS 24-29 April 2002 Klez Continues to Spread 26 April 2002 Hotmail Cookie Vulnerability 23 April 2002 Scam Artists Use Brute Force to Find Valid Credit Cards 22 April 2002 IM Users Tricked Into Downloading DDoS Software THE REST OF THE WEEK'S NEWSS 29 April 2002 XP Automatic Updating Feature Generates Complaints 29 April 2002 Vivendi Plans Hacking Suit Over Questionable Online Voting 29 April 2002 GAO Undercover Agents Gain Access to Federal Buildings 26 April 2002 Outlook E-mail Editing Vulnerability 29 April 2002 Outlook E-Mail Editing Patch May Not Fix the Whole Problem 26 April 2002 Belgian ISP Sends Out Infected CD 26 April 2002 Hybrid Attacks Gaining Popularity 26 April 2002 Military Academy Cyber Defense Exercise 26 April 2002 Chilean Computer Thieves Caused Traffic Chaos 26 April 2002 Chernobyl Probably Won't Cut a Wide Swath This Year 26 April 2002 FBI to Establish Three New Regional Cyber Forensic Labs 25, 26 & 29 April 2002 CIA Report Describes China Cyber Attack Threat 25 April 2002 File-Sharing Companies Taste the Bitter Brew of Irony 24 April 2002 PKI Vendors Agree to Interoperability 24 April 2002 Finjan Points Out MBSA Flaw 24 April 2002 Microsoft Pulls Office Tools Because of Security Flaws 23 & 24 April 2002 IE6 Privacy Features Have Security Holes 23 April 2002 Moscow ATM Crackers Sentenced 23 April 2002 Kagra Virus 22 April 2002 IT Security Resource List 22 April 2002 Industry Group Concerned That NIST Could Mandate Product Features 22 April 2002 Windows Update Not Reliable, Say Consumers 22 April 2002 Taiwan to Hold Cyber Security Drill IN-DEPTH TECHNICAL SECURITY TRAINING (AND MANAGEMENT COURSES) IN THE NEXT 120 DAYS Large SANS GIAC Certification and Training programs in Washington, Toronto, Boston, Denver, New York, and Los Angeles Smaller programs in Minneapolis, Portland, Colorado Springs, Chicago, Detroit, Ottawa, and Melbourne Details and registration information: www.sans.org ********************** Sponsored by Cisco Systems ********************* One Flexible, Modular and Cost-Effective Way to Make your Network SAFE Today's sophisticated networks need more than just a "Firewall here, intrusion detection system there" approach. They need an ironclad network security solution that will protect their network against malicious activity. That's why Cisco Systems has created the SAFE Blueprint, which empowers businesses with best practices and robust solutions to effectively secure their networks. For more information, visit http://www.cisco.com/go/safe *********************************************************************** TOP OF THE NEWS --24 - 29 April 2002 Klez Continues to Spread The latest versions of Klez have infected more than 7% of PCs around the world, moving past totals accrued by SirCam and Nimda. Variants of the Klez virus continue to spread with such rapidity that some suspect the virus's spread is hastened with the use of "seeding," though there is no evidence to support this. Klez uses a variety of subject lines and can spoof senders' e-mail addresses, making it harder for people to look out for the usual signs of virus-laden e-mails. Klez uses its own SMTP server to mail itself out to e-mail addresses found on infected computers' hard drives. Corporate users are less likely to become infected because they are more vigilant than home users about updating their anti-virus signatures. Klez severely disrupted Internet service in Zimbabwe, disabling mail servers and forcing some ISPs to go off-line to clean up the virus residue. More than 75% of the country's businesses and private citizens were cut off from Internet access. The Czech Republic is reportedly the hardest hit of all European countries. http://news.com.com/2100-1001-894706.html http://news.com.com/2100-1001-891030.html http://www.computerworld.com/storyba/0,4125,NAV47_STO70574,00.html http://www.ds-osac.org/edb/cyber/news/story.cfm?KEY=7962 http://www.europemedia.net/shownews.asp?ArticleID=10300 [Editor's (Schultz) Note: Klez's success is, lamentably, not only in the number of computers it has infected. The fact that it spoofs sender identities has created a massive amount of confusion within the user community.] --26 April 2002 Hotmail Cookie Vulnerability Because cookies are used for Hotmail account authentication, if crackers get hold of two specific cookies -- which are stored unencrypted in a fixed location -- they can always access the account, even after a password change. Hotmail users are advised not to use the "keep me signed in" option. http://www.wired.com/news/technology/0,1282,52115,00.html [Editor's (Murray) Note: This is the second time that Hotmail has been shown to store privileged state in the clear. It now appears that instead of fixing it the first time, they simply moved it from the URL to the cookie. I always wondered how they had managed to fix it in only 12 hours; now I know.] --23 April 2002 Scam Artists Use Brute Force to Find Valid Credit Cards Several groups of credit card scam artists are using brute force to run credit card numbers through Authorize.Net, "a payment gateway system" that requires no password, only a login name. Every transaction is charged a fee, regardless of the credit card number's validity. http://www.msnbc.com/news/742677.asp?0dm=C1AMT --22 April 2002 IM Users Tricked Into Downloading DDoS Software Many IRC and IM users have been tricked into downloading malicious software onto their computers which could then be used to launch a distributed denial of service (DDoS) attack. The users are tricked into downloading the malware. Hackers send messages telling victims that their systems are infected (not true), and instructing the victim to go to a certain website and download the software or risk being banned from the IM system. When the user executes the downloaded software, their systems become infected. http://www.ds-osac.org/edb/cyber/news/story.cfm?KEY=7929 ************************* Sponsored Links **************************** (1) Plug that perimeter security gap - FREE full-function PestPatrol evaluation software http://www.sans.org/cgi-bin/sanspromo/NB31 (2) ALERT! Hackers gain access to backend data via web applications. FREE WHITE PAPER: http://www.sans.org/cgi-bin/sanspromo/NB32 ********************************************************************** THE REST OF THE WEEK'S NEWS --29 April 2002 XP Automatic Updating Feature Generates Complaints Windows XP users get pop up screens informing them of new updates available for their systems. Users have complained that some patches are making their systems unstable. http://www.wired.com/news/technology/0,1282,52108,00.html [Editor's (Murray) Note: One fundamental property of "patch and fix" is that the solution becomes the problem. That said, AOL manages to update their very intrusive client without generating complaints.) --29 April 2002 Vivendi Plans Hacking Suit Over Questionable Online Voting Vivendi Chief Executive Jean-Marie Messier says hackers sabotaged on line voting during the media company's recent shareholders' meeting; votes cast by certain shareholders did not correlate with records. Some think the allegations are dubious. The board plans to call a new shareholders' meeting for June. http://story.news.yahoo.com/news?tmpl=story&cid=528&ncid=528&e=1&u=/ap/20020429/ap_on_hi_te/vivendi_voting_2 http://www.wired.com/news/business/0,1367,52162,00.html http://europe.cnn.com/2002/BUSINESS/04/29/vivendi.hacker/index.html --29 April 2002 GAO Undercover Agents Gain Access to Federal Buildings Undercover investigators from the General Accounting Office (GAO) were able to gain access to and move freely about through four federal buildings in Atlanta. They were also able to obtain building passes and after hours access codes, and made copies of the credentials on computers. http://www.msnbc.com/news/745303.asp --26 April 2002 Outlook E-mail Editing Vulnerability When Outlook users view their e-mail, scripts often cannot run because the IE security is set to block them. However, if they use MS Word as their e-mail editor, the documents are called in unprotected mode, allowing HTML e-mail messages to execute scripts. Microsoft has released a patch for the vulnerability. http://www.computerworld.com/storyba/0,4125,NAV47_STO70570,00.html http://www.theregister.co.uk/content/55/25033.html http://www.microsoft.com/technet/security/bulletin/ms02-021.asp --29 April 2002 Outlook E-Mail Editing Patch May Not Fix the Whole Problem Microsoft's recently release patch for the Outlook/Word e-mail flaw is only partially effective, according to Georgi Guninski. The exploit path through Excel remains vulnerable. http://www.theregister.co.uk/content/55/25064.html Guninski's description: http://www.guninski.com/m$oxp-2.html --26 April 2002 Belgian ISP Sends Out Infected CD Belgian ISP Skynet sent some of its customers a CD infected with W95.Hybris.gen. http://www.europemedia.net/shownews.asp?ArticleID=10308 --26 April 2002 --26 April 2002 Hybrid Attacks Gaining Popularity Hybrid attacks, like Code Red and Nimda, have overtaken denial of service (DoS) attacks as the most prevalent security threat, according to Internet Security Systems' X-Force unit's Internet Risk Impact Summary. The group also expressed concern about the PHP and SNMP vulnerabilities. http://www.vnunet.com/News/1131294 --26 April 2002 Military Academy Cyber Defense Exercise Military academy students participated in a cyber defense exercise. Six groups of students were pitted against professional military teams comprised of National Security Agency (NSA) employees and soldiers from the U.S. Air Force's 92nd Information Warfare Aggressor Squadron and the Army's Land Information Warfare Activity. For some students, this competition inspired a passion for hands on cyber security. http://zdnet.com.com/2100-1105-893418.html --26 April 2002 Chilean Computer Thieves Caused Traffic Chaos Thieves stole 15 PCs and 2 servers from a roadway traffic control center in Santiago de Chile, throwing traffic signals out of synchronization and causing traffic turmoil. http://www.wired.com/news/business/0,1367,52114,00.html --26 April 2002 Chernobyl Probably Won't Cut a Wide Swath This Year The Chernobyl virus, set to launch its payload on April 26, is viewed as a minor threat because anti-virus signatures would have to be significantly outdated not to detect it. If launched, the virus can cause a great deal of damage, overwriting hard drives. Chernobyl affects only Windows 95, 98 and ME. http://www.newsbytes.com/news/02/176177.html --26 April 2002 FBI to Establish Three New Regional Cyber Forensic Labs The FBI plans to set up three new cyber forensics laboratories in Kansas City, Chicago and San Francisco; the FBI has already established labs in Dallas and San Diego. Half of all cases the FBI opens now involve computers. http://www.siliconvalley.com/mld/siliconvalley/news/editorial/3145543.htm --25, 26 & 29 April 2002 CIA Report Describes China Cyber Attack Threat According to a CIA report, the Chinese military wants to sabotage US computer systems. Though it is believed they do not presently have that capability, independent hackers, possibly students, may increase cyber harassment through viruses, defacements and DoS attacks on the anniversary of the collision between a U.S. spy plane and a Chinese plane. http://www.msnbc.com/news/743518.asp?0dm=T22AT http://www.latimes.com/news/nationworld/world/la-042502china.story http://www.washingtonpost.com/wp-dyn/articles/A50900-2002Apr25.html http://www.fcw.com/fcw/articles/2002/0429/news-hack-04-29-02.asp [Editor's Murray] Note: Most nation states develop both offensive and defensive capabilities that they hope never to use. They do not require "sophistication." In any case, whatever US intelligence or reporters may think, while China may be poor, relative to the West and per capita, they are not primitives. The Chinese are sophisticated; we disparage or under-estimate them at our peril.] --25 April 2002 File-Sharing Companies Taste the Bitter Brew of Irony A programmer going by the name of Dr. Damn has been releasing file-sharing software stripped of bundled adware and spyware. The companies that developed this software have been the target of complaints from the film and recording industries for contributing to the theft of intellectual property. Now they are crying foul. http://news.com.com/2100-1023-891724.html --24 April 2002 PKI Vendors Agree to Interoperability The British government has convinced public key infrastructure (PKI) vendors to make their products interoperable, which will increase the likelihood that more businesses will adopt the technology. http://www.silicon.com/public/door?6004REQEVENT=&REQINT1=52901&REQSTR1 [Editor's (Schultz) Note: This development is a huge step forward; lack of PKI product interoperability is one of the major reasons that PKIs have not been more widely deployed. But it may be too little, too late for PKI.] --24 April 2002 Finjan Points Out MBSA Flaw Finjan has issued an alert describing a security vulnerability in Microsoft Baseline Security Analyzer. While the tool offers a good service, it generates a report in plaintext that can be misused by crackers to exploit the vulnerabilities listed. http://www.finjan.com/mcrc/alert_show.cfm?attack_release_id=71 --24 April 2002 Microsoft Pulls Office Tools Because of Security Flaws Microsoft has removed the latest version of Office Web Components (OWC) from its site because a security consultancy has reported that the tools could allow malicious e-mails or website to read local files and run scripts even when scripting has been disabled. Until a patch is available, users can disable ActiveX or uninstall OWC. http://www.newsbytes.com/news/02/176138.html --23 & 24 April 2002 IE6 Privacy Features Have Security Holes Thor Larholm has enumerated security flaws in IE6 privacy features. Crackers could exploit the vulnerabilities to launch programs already on a computer's hard drive, send messages to people on MSN Messenger contact lists and steal cookies. http://www.newsbytes.com/news/02/176077.html http://www.theregister.co.uk/content/55/24997.html --23 April 2002 Moscow ATM Crackers Sentenced Two ringleaders of a Moscow hacking group that used ATMs to steal nearly $1 million from bank accounts have been sentenced to five years in prison. A third man, who cooperated with the authorities during the investigation, received a 3-year sentence and was then freed under an amnesty law; three others received three-year suspended sentences. http://story.news.yahoo.com/news?tmpl=story&cid=562&562&e=14&u=/ap/20020423/ap_on_hi_te/russia_atm_fraud_3 [Editor's (Murray) Note: This demonstrates the risk of dealing with unknown and unauthenticated clients. It also demonstrates the necessity of slowing responses to repeated failed queries. At some level the credit card companies understand these attacks; the SET protocols respond to them. Like most such exposures, they seem to accept the risk until someone starts to exploit them. Shame.] --23 April 2002 Kagra Virus Kagra, a malicious VBS virus, preys on people's prurient interests, delivering a nasty payload instead of the promised pictures. The mass-mailer worm displays a message on May 12 noting that the machine has been hacked and deletes the Windows or WinNT folder on May 13. http://www.vnunet.com/News/1131174 --22 April 2002 IT Security Resource List The Washington Post has compiled a list of IT security resources for those who want to know more about cyber security. http://www.washingtonpost.com/wp-dyn/articles/A29557-2002Apr22.html --22 April 2002 Industry Group Concerned That NIST Could Mandate Product Features Pending legislation would significantly increase funding for the National Institute of Standards and Technology's (NIST) Computer Security Division. Industry trade groups and network security vendors are concerned that NIST could mandate product standards that would slow production and increase expense. http://www.nwfusion.com/news/2002/0422nist.html [Editor's (Paller) Note: When you see a reference to an "industry trade group" saying an agency should not mandate standards, you might find it useful to remember that the auto manufacturers' industry trade group spoke out against seat belts for decades using many of the same arguments. A better translation of their comments in this article would have been "our marketing people think this may cost us money so we'll claim it will hurt consumers to try to persuade Congress to kill it." --22 April 2002 Windows Update Not Reliable, Say Consumers Consumers are complaining that Windows Update is unreliable: it sometimes says systems are adequately patched when they are not, it doesn't report failed patch installations, and it doesn't always display the most current patches. http://www.computerworld.com/cwi/community/story/0,3201,NAV65-663_STO70382,00.html --22 April 2002 Taiwan to Hold Cyber Security Drill Taiwan will hold a drill in June along with its annual air-raid defense review. The government hopes to better understand the ways hackers could break into and disrupt computer networks. There is concern that China may launch a cyber attack against Taiwan as a prelude to an invasion. http://www.ds-osac.org/edb/cyber/news/story.cfm?KEY=7925 ==end== Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) e-mail sans@sans.org with the subject: Subscribe NewsBites To change your subscription, address, or other information, visit http://www.sans.org/sansurl and enter your SD number (from the headers.) You will receive your personal URL via email. You may also email with complete instructions and your SD number for subscribe, unsubscribe, change address, add other digests, or any other comments. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE80AFR+LUG5KFpTkYRAhEIAJ9N1+rDTcL4PFgjKSSs/J9ZavuTxwCgje5J p+6B+YEafvGhRs8ilYDuyqE= =pGSc -----END PGP SIGNATURE-----