Linux Security Week: May 16th 2005

Let us take the example of scrambling an egg. First, crack the shell, pour the contents into a bowl and beat the contents vigorously until you achieved the needed result - well, a scrambled egg. This action of mixing the molecules of the egg is encryption. Since the molecules are mixed-up, we say the egg has achieved a higher state of entropy (state of randomness). To return the scrambled egg to its original form (including uncracking the shell) is decryption. Impossible?

news/cryptography/a-gentle-introduction-to-cryptography

The Web Application Security Consortium (WASC) is proud to present 'The Web Security Mailing List'. What is The Web Security Mailing List? The Web Security Mailing List is an open information forum for discussing topics relevant to web security. Topics include, but are not limited to, industry news and technical discussions surrounding web applications, proxies, honeypots, new attack types, methodologies, application firewalls, discoveries, experiences, web servers, application servers, database security, tools, solutions, and others.

Demand for security appliances is going through the roof, with western European sales of the devices predicted to reach over $1.4bn in 2009, up from around $625m in 2004.

According to a newly released IDC study, the sector is growing at a compound annual growth rate of 18 per cent.

news/firewall/european-security-appliance-sales-soar

One of the most exciting new features in RHEL v.4 is the implementation of Security-Enhanced Linux (SELinux). In this tip, we'll look at how you can use it to beef up system security.

SELinux is an open source project sponsored by the National Security Agency, to help implement mandatory access control. It is a subsystem which provides a much more secure framework to Linux, then can be achieved from the operating systems level. It implements mandatory access controls that give you finer granularity in terms of security measures and is made up of both kernel and user-space components.

That's the attitude of operating system makers, who aren't just focusing on features such as snazzy graphics and better networking tools when revamping products. Now they're also providing sturdier defenses.

SSH, or secure shell, is the standard protocol for remotely accessing UNIX systems. It's used everywhere: universities, laboratories, and corporations (particularly in data-intensive back office services). Thanks to SSH, administrators can stack hundreds of computers close together into air-conditioned rooms and administer them from the comfort of their desks.

Hyper-Threading, as currently implemented on Intel Pentium Extreme Edition, Pentium 4, Mobile Pentium 4, and Xeon processors, suffers from a serious security flaw. This flaw permits local information disclosure, including allowing an unprivileged user to steal an RSA private key being used on the same machine. Administrators of multi-user systems are strongly advised to take action to disable Hyper-Threading immediately; single-user systems (i.e., desktop computers) are not affected.

A new test laboratory at Iowa State University will allow researchers to study how computer networks respond to massive Internet attacks and could lead to breakthroughs in computer defenses and forensics, said a researcher behind the project.

news/network-security/school-studies-effects-of-internet-attacks

Attackers could exploit a major flaw in the Internet Protocol Security [IPsec] framework to obtain the plaintext version of IPsec-protected communications "using only moderate effort," the British-based National Infrastructure Security Co-Ordination Centre [NISCC] warned in an advisory.

news/network-security/high-severity-vulnerability-in-ipsec

Companies have long realised the great business opportunities that the Internet offers and it’s no secret that organisations are shifting more and more of their business processes online. While this move brings many advantages with it, such as widening customer reach and reducing overheads, the emergence of organised crime in the online world means that business needs to be sharper than ever when it comes to security.

Juniper Networks, Cisco Systems and 3Com's TippingPoint division are integrating a trifecta of security features into all-in-one appliances that give partners new ways to help cut the cost and complexity of security solutions.

The new wares combine firewall, VPN and intrusion-prevention capabilities in a format that promises proactive, easy-to-manage network protection, the vendors and solution providers said.

Linux vendor Novell Inc. has acquired Immunix Inc., a security software vendor in Portland, Ore. The 15-person company was bought last week, but terms of the deal aren't being released, according to Novell.

Immunix was founded in 1998, in part with money from the Defense Advanced Research Projects Agency, to develop security software for Linux. It's best known for developing much of the Linux Security Modules software that's used in the Linux 2.6 kernel, a key component of the Linux operating system.

news/vendors-products/novell-snaps-up-linux-security-company

While networking giant Cisco has advantages most competitors don't - dominant market share, a multi-billion-dollar R&D budget, thousands of engineers - the vendor is also taking advantage and making the most of resources that are open to everyone: Linux and open source software.

news/vendors-products/what-is-cisco-doing-with-linux

Recently discovered "zero-day" exploit code that takes advantage of two vulnerabilities could mean serious trouble for Mozilla Firefox 1.0.3 users, and, to a lesser extent, Mozilla Suite users. Yesterday, Mozilla.org issued an advisory explaining the vulnerabilities and what measures to take to work around them.

Gone are the days when viruses were the number one concern of messaging administrators. Administrators and vendors say the the new focus in the messaging security game deals with patching holes in the infrastructure, identity management, and good old fashioned password maintenance.

Network security practitioners need to base their technology and policy decisions less on what attacks are possible and more on which are probable, according to the chief scientist for Resonance Networks.

"Most decisions are based on folklore, anecdotes and inappropriate theoretical models," said Eric Rescoria during the keynote address Wednesday at the Information Security Decisions conference in Chicago. How we size up threats and defenses needs to change, he argues, to what he calls "evidence-based network security."

The Cyber Security Industry Alliance (CSIA) has called on Congress to include security recommendations related to securing voice over IP (VoIP) technologies as it reviews the 1996 Telecommunications Act.

news/government/alliance-asks-congress-to-consider-voip-vulnerabilities-in-updated-telecom-act

Two vulnerabilities in the popular Firefox browser have been rated "extremely critical" because exploit code is now available to take advantage of them.

The cross-site scripting and remote system access flaws were discovered in Firefox version 1.0.3, but other versions may also be affected, said security company Secunia, which issued the ratings Sunday.

news/hackscracks/exploit-code-chases-two-firefox-flaws

The incident seemed alarming enough: a breach of a Cisco Systems network in which an intruder seized programming instructions for many of the computers that control the flow of the Internet.

Now federal officials and computer security investigators have acknowledged that the Cisco break-in last year was only part of a more extensive operation - involving a single intruder or a small band, apparently based in Europe - in which thousands of computer systems were similarly penetrated.

news/hackscracks/internet-attack-called-broad-and-long-lasting-by-investigators

Cisco Systems issued a statement Monday confirming that police in Sweden have arrested a suspect in connection with the theft of its networking equipment source code last year.

A spokesman for the FBI, which began working on the theft last May, said the case is ongoing and declined to offer details.

news/hackscracks/cisco-confirms-arrest-in-theft-of-its-code