Security UPDATE, August 15, 2001

[InfoSec News <isn () c4i org>]

********************
Windows 2000 Magazine Security UPDATE--brought to you by Security
Administrator, a print newsletter bringing you practical, how-to
articles about securing your Windows 2000 and NT systems.
   http://www.secadministrator.com
********************

~~~~ THIS ISSUE SPONSORED BY ~~~~

BindView Corporation
   http://go.win2000mag.net/UM/T.asp?A2153.23115.1316.1.532985

Ultimate Hacking: Hands On - NT/2000 Security
   http://go.win2000mag.net/UM/T.asp?A2153.23115.1316.3.532985
   (below SECURITY RISKS)

~~~~~~~~~~~~~~~~~~~~

~~~~ BINDVIEW CORPORATION ~~~~
   Security is the key issue in today's interconnected world and
BindView is right on top of it with a new, highly informative eBook, The
Definitive Guide to Windows 2000 Security. This eBook covers all the
bases of a comprehensive security methodology for your Microsoft Windows
2000 environment. It's heavy into the detail of what goes into a great
IT security system, and is specifically geared for Windows 2000
platforms. Written by Paul Cooke, an Information Security professional
with more than 10 years' experience developing and deploying security
solutions, the tips, tricks, and info packed into this volume are
priceless! Get it FREE at
   http://go.win2000mag.net/UM/T.asp?A2153.23115.1316.1.532985

********************

August 15, 2001--In this issue:

1. COMMENTARY
     - 802.11 Wireless Networks: Is Yours Really Safe?

2. SECURITY RISKS
     - Internal IP Address Disclosure in IIS SSL

3. ANNOUNCEMENTS
     - What Key Weapon Is Missing from Your Security Arsenal?
     - Visit the New Connected Home Web Site!

4. SECURITY ROUNDUP
     - News: Code Red Reveals New Security Hole in IIS
     - News: Microsoft Releases Post-SP6a Security Rollup Package
     - News: Vigilinx Joins RSA Secured Partner Program
     - News: Riptech Expands Operations
     - Feature: Exchange 2000 SP1 Adds New Functionality to the
Migration Wizard

5. HOT RELEASES (ADVERTISEMENTS)
     - CyberwallPLUS Server Resident Security
     - Sponsored by Thawte

6. SECURITY TOOLKIT
     - Book Highlight: Surviving Security: How to Integrate People,
Process and Technology
     - Virus Center 
         - Virus Alert: Win2K/Stream
     - FAQ: How Do I Enable and Disable Windows XP's System Restore
Feature? 

7. NEW AND IMPROVED
     - Security System
     - Close Security Holes

8. HOT THREADS
     - Windows 2000 Magazine Online Forums
         - Featured Thread: Installing IIS for a Standalone Certificate
Server
     - HowTo Mailing List 
         - Featured Thread: Trouble with Network Authentication on
Laptops

9. CONTACT US
   See this section for a list of ways to contact us.

1. ==== COMMENTARY ====

Hello everyone,

Do you use an 802.11-based wireless LAN? If so, are you aware of several
security problems in the Wired Equivalent Privacy (WEP) protocol (used
in 802.11-based wireless LANs) that can compromise your network? WEP is
part of the IEEE 802.11 standard and uses the RC4 encryption algorithm
with a 40-bit key to encrypt network traffic. During the past several
months, we've published two stories about vendor support for WEP and two
stories about several WEP protocol security risks--see the URL below to
locate the stories. Recently, researchers have discovered two more
security problems that let attackers easily crack WEP's RC4 encryption
keys.
   http://63.88.172.128/security/query.html?col=security&qt=wep

Three researchers (Scott Fluhrer, Istak Mantin, and Adi Shamir)
published "Weakness in the Key Scheduling Algorithm of RC4" (linked
below), a paper which the three men say proves that "RC4 is completely
insecure in a common mode of operation which is used in the widely
deployed [WEP] protocol." The document outlines two vulnerabilities. The
first vulnerability stems from the fact that a small number of secret
encryption key bits determine a large number of subsequent key
permutation bits. An intruder can use the second weakness to determine
the secret part of a key by analyzing particular aspects of encryption
key streams. 
   http://www.eyetap.org/~rguerra/toronto2001/rc4_ksaproc.pdf

Although the paper is very technical--people without a significant
understanding of cryptography and mathematics might find the paper
difficult to comprehend--it reminds us not to depend on only one
security method. If you rely on WEP to protect sensitive
wireless-network traffic, you're a sitting duck. Until the IEEE adopts
revamped encryption specifications for the 802.11 standard (which it's
in the process of doing), we can't depend on the standard to offer any
significant information security.

Exploits exist already for some of the WEP vulnerabilities--don't think
that cracking your wireless LAN takes a rocket scientist. For example,
over the weekend, Anton Rager posted Perl scripts (available at the URL
below) to the BugTraq mailing list that help demonstrate and validate
the claims the three researchers make in the paper. The code base
functionality is limited but clearly proves that penetrating WEP-based
network security doesn't take much effort.
   http://sourceforge.net/projects/wepcrack

Although protecting your WEP-enabled network against intrusion isn't
difficult, it does take some effort. One of the most effective security
measures you can take is to implement a VPN between all systems that
communicate over the wireless network. This setup means that if you have
WEP enabled on your wireless LAN and an intruder subsequently cracks WEP
on your LAN, then any underlying VPN protocols will still probably
protect your network. It's also a good idea use a media access control
(MAC) address to restrict access to your wireless network hubs. This
configuration ensures that only authorized network cards can communicate
on your wireless network. 

If you need another reason to better protect your wireless LANs,
remember that wireless LANs operate based on radio technology, and radio
signals often stray well beyond their intended boundaries. For example,
take a laptop computer with an 802.11-based wireless network card,
configure the machine to run a DHCP client, and take the laptop with you
as you drive around heavily populated business districts or walk around
inside large office buildings. You might be surprised to find a few
wireless LANs are wide open to the public. If you don't guard against
unknown wireless connections, someone will use your wireless network
without your knowledge--and who knows what kind of trouble that can lead
to? 

Before I sign off this week, I want to remind you to patch all your
systems--especially laptops--to protect them from the Code Red worms. Be
sure to review our article related to Microsoft security bulletin
MS01-033 (see the URL below for details). I mention this warning again
because many companies have overlooked patching their laptops. Some
laptops have Microsoft Internet Information Services (IIS) 5.0 running
on top of Windows 2000 Professional, and as you know, IIS 5.0 is
vulnerable to Code Red. When these unpatched laptops connect to the
Internet using a connection outside the company's protected internal
LAN, they become vulnerable to Code Red infection. A Code Red-infected
system can spread the worm back into a company's internal LAN when a
user reconnects the system to the LAN. So be sure to patch your
Win2K-based laptop systems.
   http://www.WindowsITsecurity.com/articles/index.cfm?articleid=21503

Until next time, have a great week.

Sincerely,

Mark Joseph Edwards, News Editor, mark () ntsecurity net

2. ==== SECURITY RISKS ====
   (contributed by Ken Pfeil, ken () win2000mag com)

* INTERNAL IP ADDRESS DISCLOSURE IN IIS SSL
   By connecting manually to Secure Sockets Layer (SSL) TCP port 443
using OpenSSL or a similar tool, an attacker can obtain the internal IP
address or NetBIOS name of the Web server. The attacker can exploit the
vulnerability by using an HTTP/1.1 GET request instead of an HTTP/1.0
GET request. Microsoft has not released a fix or workaround for this
problem.
   http://www.WindowsITsecurity.com/articles/index.cfm?articleid=22095

~~~~~~~~~~~~~~~~~~~~

~~~~ ULTIMATE HACKING: HANDS ON ? NT/2000 SECURITY ~~~~
   If you're running a Windows network, then this is the intensive 3-day
course with everything a hacker knows...that you'll need to know! Our
hands-on class, based on real world consultant experience and
Foundstone's best-seller "Hacking Exposed," provides a dynamic
environment to learn this security knowledge. As a Specialist in
Microsoft's Security Services Partner Program, Foundstone knows hacking,
security and Microsoft. Register now for the class in New York City,
September 25-27, and Irvine, California, December 11-13. 
   http://go.win2000mag.net/UM/T.asp?A2153.23115.1316.3.532985

~~~~~~~~~~~~~~~~~~~~

3. ==== ANNOUNCEMENTS ====

* WHAT KEY WEAPON IS MISSING FROM YOUR SECURITY ARSENAL?
   The best IT security defense starts with a subscription to Security
Administrator. Each month, this print newsletter delivers detailed
instructions to help make your Windows 2000/NT environment more tamper
resistant. Get in-depth information on configuring a secure firewall,
setting up group policies, and much more. Subscribe today--before it's
too late! 
   http://www.secadministrator.com/sub.cfm?code=saei251gsa

* VISIT THE NEW CONNECTED HOME WEB SITE!
   The people who bring you Connected Home EXPRESS have launched a new
Web site! Get how-to tips and tricks to help you with home networking,
home theater, audio, and much more. While you're there, sign up (for
free!) for the first issue of Connected Home Magazine, coming in late
October. Check it out! 
   http://www.connectedhomemag.com

4. ==== SECURITY ROUNDUP ====

* NEWS: CODE RED REVEALS NEW SECURITY HOLE IN IIS
   As the Code Red II worm spread across the Internet last week, users
reported that their Web systems were suffering Denial of Service (DoS)
attacks--even after they had installed the Microsoft IIS patch
recommended in bulletin MS01-033. Users notified Microsoft about the
problem, and the company is now working on a patch.
   http://www.WindowsITsecurity.com/articles/index.cfm?articleid=22120

* NEWS: MICROSOFT RELEASES POST-SP6A SECURITY ROLLUP PACKAGE
   Although Microsoft decided to cancel the development and release of
Windows NT 4.0 Service Pack 7 (SP7), the company is releasing
security-related hotfixes for that OS. To make applying those security
hotfixes easier, Microsoft recently released the Post-SP6a Security
Rollup Package.
   http://www.WindowsITsecurity.com/articles/index.cfm?articleid=22121

* NEWS: VIGILINX JOINS RSA SECURED PARTNER PROGRAM
   Vigilinx today announced a strategic partnership with RSA Security.
Under the partnership agreement, Vigilinx joins the RSA Secure Partner
Program as a consultant and system integrator. RSA awarded Vigilinx its
"RSA Secured Keon Ready" certificate, which signifies that Vigilinx
products are compatible with RSA Security's products. RSA Security will
help train Vigilinx consultants to integrate RSA Keon software into
customer solutions. 
   http://www.windowsitsecurity.com/Articles/Index.cfm?ArticleID=22133

* NEWS: RIPTECH EXPANDS OPERATIONS
   Riptech, a managed security-services provider, has opened a new
office in New York and expanded its facilities in San Jose, California.
Riptech also named Ken Legge as vice president of business development
for the company's eastern region.
   http://www.windowsitsecurity.com/Articles/Index.cfm?ArticleID=22134

* FEATURE: EXCHANGE 2000 SP1 ADDS NEW FUNCTIONALITY TO THE MIGRATION
WIZARD
   Exchange 2000 Server Service Pack 1 (SP1) included many bug fixes and
patches that Exchange administrators have been waiting for. Exchange
2000 SP1 also added a great new feature to the Exchange Migration
Wizard--something that many of you might not be aware of.
   http://www.exchangeadmin.com/articles/index.cfm?articleid=22100

5. ==== HOT RELEASES (ADVERTISEMENTS) ====

* CYBERWALLPLUS SERVER RESIDENT SECURITY
   Were your Windows NT/2000 web servers hit by the Code Red Worm? Are
there other important servers still at risk? Use CyberwallPLUS
server-class firewall and intrusion prevention software as your last
line of defense when perimeter security is no longer enough.
   Free 30-day evaluation -
http://go.win2000mag.net/UM/T.asp?A2153.23115.1316.5.532985

* SPONSORED BY THAWTE 
   FREE Apache SSL Guide from Thawte Certification. Do your online
customers demand the best available protection of their personal
information? Click here for your FREE certification guide:
   http://go.win2000mag.net/UM/T.asp?A2153.23115.1316.6.532985

6. ==== SECURITY TOOLKIT ====

* BOOK HIGHLIGHT: SURVIVING SECURITY: HOW TO INTEGRATE PEOPLE, PROCESS
AND TECHNOLOGY
   By Mandy Andress
   List Price: $39.99
   Fatbrain Online Price: $31.99
   Softcover; 525 pages
   Published by Sams, July 2001
   ISBN 0672321297

For more information or to purchase this book, go to
http://www1.fatbrain.com/asp/bookinfo/bookinfo.asp?theisbn=0672321297
and enter WIN2000MAG as the discount code when you order the book.

* VIRUS CENTER
   Panda Software and the Windows 2000 Magazine Network have teamed to
bring you the Center for Virus Control. Visit the site often to remain
informed about the latest threats to your system security.
   http://www.WindowsITsecurity.com/panda

Virus Alert: Win2K/Stream
   Win2K/Stream is the first virus to exploit Windows 2000's ability to
divide a file into streams, where there can be various streams in one
single file, where each stream is identified as a "file." Once the virus
is active, it infects all .exe files in the current directory, and the
infected files lose their respective icons. For complete details on this
virus be sure to visit our Web site.
   http://63.88.172.96/panda/index.cfm?fuseaction=virus&virusid=559

* FAQ: HOW DO I ENABLE AND DISABLE WINDOWS XP'S SYSTEM RESTORE
FEATURE?
   ( contributed by John Savill, http://www.windows2000faq.com )

   System Restore (i.e., restorept.api) is a new Windows XP feature
that's similar to Last Known Good Configuration. However, System Restore
maintains multiple restore points instead of one last-restore point. The
user can manually create restore points, or System Restore can keep
restore points during the following operations:
   - Installing new software, if the application uses a current
installer that is System-Restore compliant 
   - Using AutoUpdate 
   - During a restore operation 
   - During a Microsoft backup or recovery operation 
   - Installing an unsigned driver 
   - Automatically following 24 hours of inactivity 
   By default, System Restore monitors all partitions. So, for example,
if you delete an executable file, you can have the system state revert
to a specific restore point to recreate or repair the executable file.
When you revert to a restore point, however, you lose all changes since
that point, except for changes to files in the My Documents folder and
documents you've created with applications such as Microsoft Word and
Microsoft Excel.
   If you use System Restore and don't like the new system state, you
can undo the process and restore the machine to the system state it had
before you ran System Restore. Alternatively, you can run System Restore
to change the system state to a different restore point. To enable or
disable System Restore, follow the steps in our FAQ.
   http://www.windows2000faq.com/articles/index.cfm?articleid=22059

6. ========== NEW AND IMPROVED ==========
   (contributed by Scott Firestone, IV, products () win2000mag com)

* SECURITY SYSTEM
   NFR Security released NFR Network Intrusion Detection-200 (NID-200),
a system that monitors networks and responds to suspicious activity
(e.g., too many attempts to match a password, port scans, debilitating
ping floods, and back-entry device planting). The system provides a set
of customizable default alerts, including an annotation describing the
alert, common industry responses, and a field for your company's policy
explaining what action you should take. For pricing, contact NFR
Security at 240-632-9000.
   http://www.nfr.com

* CLOSE SECURITY HOLES
   ElcomSoft released Advanced NT Security Explorer (ANTExp), security
software that lets you use passwords to identify and close security
holes in your networks. The software executes a comprehensive audit of
account passwords and exposes insecure account passwords. You can also
use ANTExp to recover lost passwords and access a user's Windows
account. The software runs on Windows 2000, Windows NT, Windows Me, and
Windows 9x systems. ANTExp costs $49 for a personal license, $149 for a
business license, and $399 for a universal license. Contact ElcomSoft at
support () elcomsoft com.
   http://www.elcomsoft.com/antexp.html

7. ==== HOT THREADS ====

* WINDOWS 2000 MAGAZINE ONLINE FORUMS
   http://www.win2000mag.net/forums 

Featured Thread: Installing IIS for a Standalone Certificate Server
   (Four messages in this thread)

A user wants to set up a standalone root Certificate Authority (CA)
server. However, he doesn't want to install IIS because of all the
security issues and wonders whether this CA setup is available without
IIS installed. Read more about the problem and the responses, or lend a
hand at the following URL:
   http://www.win2000mag.net/forums/rd.cfm?app=64&id=73867

* HOWTO MAILING LIST
   http://www.WindowsITsecurity.com/go/page_listserv.asp?s=howto

Featured Thread: Trouble with Network Authentication on Laptops
   (Two messages in this thread)

   An administrator has configured his network so that a user must
authenticate to a domain controller (DC) to log on to a machine.
However, this presents a problem for mobile users (e.g., those with
laptops) who can't log on to their systems when they aren't connected to
the local LAN. Do you know to remedy this type of problem? Read the
responses or lend a hand at the following URL:
   http://63.88.172.96/go/page_listserv.asp?a2=ind0108b&l=howto&p=777

8. ==== CONTACT US ====
   Here's how to reach us with your comments and questions:

* ABOUT THE COMMENTARY -- mark () ntsecurity net

* ABOUT THE NEWSLETTER IN GENERAL -- mlibbey () win2000mag com; please
mention the newsletter name in the subject line.

* TECHNICAL QUESTIONS -- http://www.win2000mag.net/forums

* PRODUCT NEWS -- products () win2000mag com

* QUESTIONS ABOUT YOUR SECURITY UPDATE SUBSCRIPTION? -- Email Customer
Support at securityupdate () win2000mag com.

* WANT TO SPONSOR SECURITY UPDATE? emedia_opps () win2000mag com

********************

   Receive the latest information about the Windows 2000 and Windows NT
topics of your choice. Subscribe to our other FREE email newsletters.
   http://www.win2000mag.net/email

|-+-+-+-+-+-+-+-+-+-|

Thank you for reading Security UPDATE.

SUBSCRIBE
To subscribe send a blank email to
subscribe-Security_UPDATE () list win2000mag net.

___________________________________________________________
Copyright 2001, Penton Media, Inc.



-
ISN is currently hosted by Attrition.org

To unsubscribe email majordomo () attrition org with 'unsubscribe isn' in the BODY
of the mail.