Information Security News mailing list archives
Security UPDATE, May 22, 2002
From: InfoSec News <isn () c4i org>
Date: Thu, 23 May 2002 04:52:19 -0500 (CDT)
******************** Windows & .NET Magazine Security UPDATE--brought to you by Security Administrator, a print newsletter bringing you practical, how-to articles about securing your Windows .NET Server, Windows 2000, and Windows NT systems. http://www.secadministrator.com ******************** ~~~~ THIS ISSUE SPONSORED BY ~~~~ Plan for Infrastructure Security http://www.ibm.com/e-business/playtowin/n20 VeriSign--The Value of Trust http://list.winnetmag.com/cgi-bin3/flo?y=eL4Z0CJgSH0CBw014e0AI (below IN FOCUS) ~~~~~~~~~~~~~~~~~~~~ ~~~~ SPONSOR: PLAN FOR INFRASTRUCTURE SECURITY ~~~~ A flexible, reliable infrastructure is a fully integrated infrastructure. With your copy of "e-business Infrastructure Integration: Practical Approaches," you'll learn how properly constructed e-business infrastructure solutions can work for you across business units and across operations to make your organization faster, more flexible, immediately responsive, and highly competitive. IBM has the knowledge, experience, and global resources to help you implement a solution tailored to your company's needs. Let us help you get started building a seamlessly integrated infrastructure for your organization by signing up today to receive your complimentary white paper at http://www.ibm.com/e-business/playtowin/n20 ~~~~~~~~~~~~~~~~~~~~ May 22, 2002--In this issue: 1. IN FOCUS - Biometric Security: Fingerprints Don't Always Suffice 2. SECURITY RISKS - Multiple Problems with IE - Authorization Problem in nCipher's MSCAPI CSP Install Wizard 5.50 3. ANNOUNCEMENTS - Meeting IT Security Benchmarks Through Effective IT Audits, August 8-9, 2002, Washington, DC - Attend Black Hat Briefings & Training, July 29 - August 1, 2002, Las Vegas 4. SECURITY ROUNDUP - News: Online Personal Privacy Act Closer to Becoming Law - News: Microsoft Remedy Hearings: Security by Obscurity, Parts I and II - Feature: Secure Messaging and Exchange 5. SECURITY TOOLKIT - Virus Center - FAQ: How Can I Restrict User Access to the Control Panel Internet Options or Internet Tools Applet Without Using Policies? 6. NEW AND IMPROVED - Realtime Protection Against Security Breaches - Updated Security Suite 7. HOT THREADS - Windows & .NET Magazine Online Forums - Featured Thread: The Difference Between Required Encryption and Maximum Strength Encryption - HowTo Mailing List - Featured Thread: IIS 5.0 Banner Query 8. CONTACT US See this section for a list of ways to contact us. ~~~~~~~~~~~~~~~~~~~~ 1. ==== IN FOCUS ==== (contributed by Mark Joseph Edwards, News Editor, mark () ntsecurity net) * BIOMETRIC SECURITY: FINGERPRINTS DON'T ALWAYS SUFFICE Does your company use fingerprint-scanning authentication technology? If so, that technology might not be enough to guard the authentication process for your particular network environment because, as you know, the finger doesn't have to be attached to the body. For that matter, the finger doesn't even need to be a real finger. A recent news story from The Register (see the URL below) is a good case in point. In the story "Gummi bears defeat fingerprint sensors," reporter John Leyden describes how Japanese mathematician Tsutomu Matsumoto used gelatin and a plastic mold to reproduce a portion of a finger, including its fingerprint, and defeated 11 different fingerprint-authentication systems in four of five attempts. Taking the process further, Matsumoto lifted a fingerprint from a glass, transferred the print to a rigid flat surface, and used a mold to create a fake gelatin finger. According to the report, the finger fooled scanners about 80 percent of the time. http://www.theregister.co.uk/content/55/25300.html To receive a copy of a paper Matsumoto wrote detailing the preceding endeavors, send him an email message to tsutomu () mlab jks ynu ac jp and request a copy. Although that paper isn't available on the Web site, you'll find a presentation in which Matsumoto discusses biometrics and shows some photographs of the process of creating a fake finger. You can download a copy of the PDF file (about 1.2MB) at the URL below. http://www.itu.int/itudoc/itu-t/workshop/security/present/s5p4.pdf Bruce Schneier, founder and chief technology officer CTO of Counterpane Internet Security, publishes the newsletter Crypto-Gram. In the May 15 edition (see the URL below), Schneier offers more detail and commentary about Matsumoto's process. According to Schneier, "There's both a specific and a general moral to take away from this result. Matsumoto is not a professional fake-finger scientist; he's a mathematician. He didn't use expensive equipment or a specialized laboratory. He used $10 of ingredients you could buy, and whipped up his gummy fingers in the equivalent of a home kitchen. And he defeated eleven different commercial fingerprint readers, with both optical and capacitive sensors, and some with 'live finger detection' features." Schneier urges us to consider how much more dedicated attackers could do. Schneier warns, "All the fingerprint companies have claimed for years that this kind of thing is impossible. When they read Matsumoto's results, they're going to claim that [Matsumoto's methods] don't really work, or that they don't apply to them, or that they've fixed the problem. Think twice before believing them." http://www.counterpane.com/crypto-gram-0205.html#5 Following the fake finger story, Crypto-Gram offered a link to a news report about paying for merchandise with nothing more than a fingerprint. According to an April 27 article in the Seattle Post- Intelligencer (see the URL below), the West Seattle Thriftway store offers customers a fingerprint-only payment system. The system ties customers' fingerprints directly to their credit cards, checking accounts, and benefit cards and lets them pay for merchandise by simply placing their index finger on a scanner during checkout. http://seattlepi.nwsource.com/local/68217_thumb27.shtml Someone could theoretically use Matsumoto's technique to create a thin "skin" with someone else's fingerprint, lay it over his or her index finger, and go on a shopping spree at someone else's expense. The article about the fingerprint checkout system could mislead uneducated consumers. According to the store owner, the new payment system is foolproof: "People no longer have to worry that their cards will be lost or stolen and then used to run up hefty charges. Stores and credit card issuers will likewise avoid the losses associated with identity theft." Yeah, right. If nothing else, the Matsumoto experiments should keep us all from being lulled into a false sense of security. The West Seattle Thriftway might have used something a bit more secure for its biometric payment system. Several other options (e.g., facial- recognition units) offer more security. Visionics (see the URL below) makes a facial-recognition unit that you can use for network authentication. The company's FaceIt product works as a single sign-on (SSO) tool and as a continuous authentication system. Users are authenticated initially, then reauthenticated as they continue to use the system. This approach helps prevent anyone but the authenticated user from using the authenticated resources. FaceIt uses any video camera that supports Microsoft Video for Windows. The product runs on Windows platforms, Linux, Sun OS, and SGI Irix systems, and the company offers software development kits (SDKs) for custom application development. http://www.visionics.com/faceit BioID makes a facial-recognition product also called BioID. The product uses a combination of facial features, voice patterns, and lip movement to identify a person. BioID uses a standard USB-based video camera and microphone to perform its authentication process. You can learn more about the product at the company's Web site (see the URL below). http://www.bioid.com If you're interested in other types of biometric security, such as hand-geometry, iris, retina, voice, and signature scanners, a great place to start is the International Biometric Group Web site (see the first URL below). The site offers information about most types of biometric security available today and links to many vendor sites. The following quick reference by security type (see the second through eighth URLs below) will get you started. http://www.biometricgroup.com http://www.finger-scan.com/finger-scan_vendors.htm http://www.facial-scan.com/facial-scan_vendors_and_links.htm http://www.iris-scan.com/iris_recognition_vendors.htm http://www.retina-scan.com/retina_scan_vendors_and_products.htm http://www.hand-scan.com/hand_scan_vendors.htm http://www.voice-scan.com/vendors.htm http://www.signature-scan.com/signature_scan_vendors.htm In last week's Security UPDATE commentary, I discussed Instant Messaging (IM) software. A different article in The Register, "EDS bans IM" (see the URL below), discusses how the computer arm of the British government has banned IM because of its inherent security risks, particularly the way IM products let network traffic bypass certain security systems designed to protect networks. For example, IM software can deliver email and transfer files that bypass virus-scanning software and infect your network. The article offers further evidence that you should weigh the risks of IM before you allow its use in your environment. http://www.theregister.co.uk/content/55/25185.html ~~~~~~~~~~~~~~~~~~~~ ~~~~ SPONSOR: VERISIGN--THE VALUE OF TRUST ~~~~ Get the strongest server security--128-bit SSL encryption! Download VeriSign's FREE guide, "Securing Your Web Site for Business" and learn everything you need to know about using SSL to encrypt your e-commerce transactions for serious online security. Click here! http://list.winnetmag.com/cgi-bin3/flo?y=eL4Z0CJgSH0CBw014e0AI ~~~~~~~~~~~~~~~~~~~~ 2. ==== SECURITY RISKS ==== (contributed by Ken Pfeil, ken () winnetmag com) * MULTIPLE PROBLEMS WITH IE Microsoft reported six vulnerabilities in Microsoft Internet Explorer (IE). The first is a cross-site scripting problem, the second and third relate to information disclosure, the fourth is a zone- spoofing problem, and the last two relate to malformed headers in downloadable files. Microsoft has released a cumulative patch to correct the problems. For complete details about these problems and a link to the patch, please visit the URL below. http://www.secadministrator.com/articles/index.cfm?articleid=25246 * AUTHORIZATION VULNERABILITY IN NCIPHER'S MSCAPI CSP INSTALL WIZARD 5.50 When a user creates an Operator Card Set with nCipher's MSCAPI CSP Install Wizard 5.50, the nCipher CSP key generation behaves as the user requests. When the user selects Cardset Protect from the Install Wizard but doesn't create a new Operator Card Set, the wizard incorrectly sets up the nCipher CSPs to use module protection for all keys that the user subsequently creates. Then, rather than a combination of the Operator Card Set and module, the module alone protects application keys that the nCipher CSP generates. An attacker who gains control of any nCipher module that the user has programmed into the key's security world can gain unauthorized access to this key because the nCipher module doesn't require any further smart card authorization. nCipher has released an advisory that recommends the corrective action a user should take. http://www.secadministrator.com/articles/index.cfm?articleid=25245 3. ==== ANNOUNCEMENTS ==== (brought to you by Windows & .NET Magazine and its partners) * MEETING IT SECURITY BENCHMARKS THROUGH EFFECTIVE IT AUDITS, AUGUST 8- 9, 2002, WASHINGTON, DC Have your IT security solutions kept pace with evolving threats? Until you conduct a thorough IT security audit, you won't know until after a breach has occurred. To help you achieve the most Return on Investment (ROI) on your security investment, ITRA is proud to present a step-by-step practical guide to auditing your enterprise's IT security. For more information, call 800-280-8440 or visit: http://list.winnetmag.com/cgi-bin3/flo?y=eL4Z0CJgSH0CBw014f0AJ * ATTEND BLACK HAT BRIEFINGS & TRAINING, JULY 29-AUGUST 1, 2002, LAS VEGAS Black Hat Briefings is the world's premier technical security event, featuring 8 tracks and 12 training sessions, with lots of Windows topics coverage, full support by Microsoft, and a keynote by Richard Clarke. See for yourself what the buzz is all about. Register today! http://list.winnetmag.com/cgi-bin3/flo?y=eL4Z0CJgSH0CBw0pHV0AQ 4. ==== SECURITY ROUNDUP ==== * NEWS: ONLINE PERSONAL PRIVACY ACT CLOSER TO BECOMING LAW The Senate Commerce Committee approved bill (S.2201), "Online Personal Privacy Act," which would require online entities to stop collecting personal information from users unless the users specifically agree to such information collection either before or during the collection process. After users agree to the information collection, the agreement would remain in effect until the users change their consent. http://www.secadministrator.com/articles/index.cfm?articleid=25247 * NEWS: MICROSOFT REMEDY HEARINGS: SECURITY BY OBSCURITY, PARTS I AND II If you didn't read Paul Thurrott's WinInfo Daily UPDATE Short Takes on May 10, you missed some interesting information. As Microsoft Group Vice President Jim Allchin responded to a question about the security exception in the proposed settlement with the US Department of Justice (DOJ), he essentially said that the company must be permitted to withhold information that would compromise Windows security (you know, like interoperability information). "The more creators of viruses know about how antivirus mechanisms in Windows operating systems work, the easier it will be to create viruses to disable or destroy those mechanisms," Allchin said. Samba developers had been looking forward to a mid-2002 Microsoft code release that would give them the information they need to work with the company's latest networking protocol, the Common Internet File System (CIFS). However, Microsoft forbids using the code in any projects covered by the GNU General Public License (GPL), which is exactly what Samba uses. http://www.secadministrator.com/articles/index.cfm?articleid=25172 * FEATURE: SECURE MESSAGING AND EXCHANGE Microsoft Exchange Server implements secure messaging through the Advanced Security subsystem. This subsystem supports two key functions: signing (i.e., digital signatures for message nonrepudiation) and encryption/decryption. In fact, Exchange's infrastructure and services play a supporting role in secure messaging; the Exchange client (e.g., Microsoft Outlook, Outlook Express) plays the main role. For secure messaging to work, you need a supporting infrastructure, Exchange services, and client extensions that implement support for digital signing and encryption. http://www.secadministrator.com/articles/index.cfm?articleid=25165 5. ==== SECURITY TOOLKIT ==== * VIRUS CENTER Panda Software and the Windows & .NET Magazine Network have teamed to bring you the Center for Virus Control. Visit the site often to remain informed about the latest threats to your system security. http://www.secadministrator.com/panda * FAQ: HOW CAN I RESTRICT USER ACCESS TO THE CONTROL PANEL INTERNET OPTIONS OR INTERNET TOOLS APPLET WITHOUT USING POLICIES? ( contributed by John Savill, http://www.windows2000faq.com ) A. If you use NTFS, you can use the file system's built-in permissions to restrict access to the Control Panel Internet Options or Internet Tools applet by performing the following steps: 1. Open Windows Explorer. 2. Navigate to \%systemroot%\system32 (e.g., c:\windows\system32). 3. Right-click inetcpl.cpl and select Properties from the context menu. 4. Select the Security tab. 5. Adjust the user and group permissions as appropriate, and ensure that the SYSTEM group has Full Control. You can also use the standard command-line permission utility cacls.exe to set these permissions. However, be aware that when you use either method to restrict access, another administrator will have a difficult time determining the permissions you've set. Therefore, using policies is the preferred method for restricting access. 6. ==== NEW AND IMPROVED ==== (contributed by Judy Drennen, products () winnetmag com) * REALTIME PROTECTION AGAINST SECURITY BREACHES GFI's LANguard Security Event Log Monitor (S.E.L.M.) is a realtime product that protects against internal and external security breaches. The product monitors Security logs for Windows 2000 and Windows NT servers and workstations, then consolidates them into a central log for analysis. LANguard S.E.L.M. costs $495. Contact GFI at 888-243-4329 or sales () gfiusa com. http://www.gfi.com * UPDATED SECURITY SUITE Greatis Software released RegRun Security Suite 3.1, an updated utility that maintains and controls PC stability while protecting against dangerous viruses and Trojan horses. RegRun Security Suite 3.1 runs on Windows XP, Windows 2000, Windows NT, Windows NT, and Windows 9x, and costs from $19.95 to $49.95 for a single-user license. Contact Greatis at 206-202-4216 or support () greatis com. http://www.greatis.com 7. ==== HOT THREADS ==== * WINDOWS & .NET MAGAZINE ONLINE FORUMS http://www.winnetmag.com/forums Featured Thread: The Difference Between Required Encryption and Maximum Strength Encryption (Twenty-one messages in this thread) Robert writes that when you set up a VPN client in Windows XP, in the Properties section you see a tab labeled Security. If you select Advanced (Custom Setting) on this tab, you enable the Setting button. If you click Setting, the process displays another window. At the top of this window, you see a section labeled Data Encryption, with a drop- down menu, in which you find four settings--including Required Encryption and Maximum Strength Encryption. Robert wants to know the difference between Required Encryption and Maximum Strength Encryption. Read the responses or lend a hand at the following URL. http://www.secadministrator.com/forums/thread.cfm?thread_id=104764 * HOWTO MAILING LIST http://www.secadministrator.com/listserv/page_listserv.asp?s=howto Featured Thread: IIS 5.0 Banner Query (Five messages in this thread) A reader wants to know how to change the banner in Microsoft Internet Information Services (IIS) 5.0 so that the server no longer reports itself to users as an IIS 5.0 server. Is there an easy way to make such a change without using hexadecimal editors to edit associated .dll files? Read the responses or lend a hand at the following URL. http://63.88.172.96/listserv/page_listserv.asp?a2=ind0205c&l=howto&p=971 8. ==== CONTACT US ==== Here's how to reach us with your comments and questions: * ABOUT IN FOCUS -- mark () ntsecurity net * ABOUT THE NEWSLETTER IN GENERAL -- vpatterson () winnetmag com (please mention the newsletter name in the subject line) * TECHNICAL QUESTIONS -- http://www.winnetmag.com/forums * PRODUCT NEWS -- products () winnetmag com * QUESTIONS ABOUT YOUR SECURITY UPDATE SUBSCRIPTION? Customer Support -- securityupdate () winnetmag com * WANT TO SPONSOR SECURITY UPDATE? emedia_opps () winnetmag com ******************** This email newsletter is brought to you by Security Administrator, the print newsletter with independent, impartial advice for IT administrators securing a Windows 2000/Windows NT enterprise. Subscribe today! http://www.secadministrator.com/sub.cfm?code=saei25xxup Receive the latest information about the Windows and .NET topics of your choice. Subscribe to our other FREE email newsletters. http://www.winnetmag.com/email |-+-|-+-|-+-|-+-|-+-| Thank you for reading Security UPDATE. MANAGE YOUR ACCOUNT You can manage your entire Windows & .NET Magazine Network email newsletter account on our Web site. Simply log on and you can change your email address, update your profile information, and subscribe or unsubscribe to any of our email newsletters all in one place. http://www.winnetmag.com/email SUBSCRIBE To quickly subscribe, send a blank email to mailto:Security-UPDATE_Sub () list winnetmag com. UNSUBSCRIBE To quickly unsubscribe, send a blank email to mailto:Security-UPDATE_Unsub () list winnetmag com. Thank you! - ISN is currently hosted by Attrition.org To unsubscribe email majordomo () attrition org with 'unsubscribe isn' in the BODY of the mail.
Current thread:
- Security UPDATE, May 22, 2002 InfoSec News (May 23)