Power Hacker 2003/Power_Hacker_2003.iso/E-zine/Magazines/winsd/winsd.040500.txt

Text File | 2002-05-27 | 24.2 KB | 490 lines

**********************************************************
WINDOWS 2000 MAGAZINE SECURITY UPDATE
**Watching the Watchers**
The weekly Windows 2000 and Windows NT security update newsletter brought
to you by Windows 2000 Magazine and NTSecurity.net
http://www.win2000mag.com/update/
**********************************************************

This week's issue sponsored by
Trend Micro -- Your Internet VirusWall
http://www.antivirus.com/welcome/springfwd04052000.htm

|-+-|-+-|-+-|-+-|-+-|-+-|-+-|-+-|-+-|-+-|-+-|-+-|-+-|-+-|-+-
April 5, 2000 - In this issue:

1. IN FOCUS
     - Application Service Providers: Are They Sitting Ducks?

2. SECURITY RISKS
     - Index Server Exposes Web Code
     - Malformed TCP/IP Print Request
     - UNC Mappings and IIS Virtual Paths Expose Code

3. ANNOUNCEMENTS
     - Register Today for Microsoft Tech-Ed 2000
     - Turn Your Knowledge into Something You Can Drive!

4. SECURITY ROUNDUP
     - News: Office 2000 SR-1 Update Might Contain Numerous Bugs
     - News: IPv6 in Windows 2000 at Least 2 Years Out
     - News: Army to Adopt Biometric Security

5. NEW AND IMPROVED
     - Protection from Hacker Attacks
     - Increased Security for E-Commerce

6. HOT RELEASE (ADVERTISEMENT)
     - WebTrends Security Analyzer 3.5 - 1,000+ Tests

7. SECURITY TOOLKIT
     - Book Highlight: Managing TCP/IP Networks: Techniques, Tools and
Security
     - Tip: Minimize the Risk of Using Windows 2000 Professional
     - Windows 2000 Security: Reducing the Risks of Group Policies
     - Ultimate Security Toolkit: Internet Scanner 6.1
     - Writing Secure Code: Avoiding Buffer Overruns with String Safety

8. HOT THREADS
     - Windows 2000 Magazine Online Forums
         Let Non-Administrators Add a Local Printer on NT Workstation
     - Win2KSecAdvice Mailing List
         Aureate/Radiate Update
         BAT.Chode.Worm Appears not to Affect NT/Win2K
     - HowTo Mailing List
         Enterprise Security Manager any Good?

~~~~ SPONSOR: TREND MICRO -- YOUR INTERNET VIRUSWALL ~~~~
Now that spring has turned the clock forward, don't lose any more hours
of sleep worrying about your network servers' virus security. Instead, use
Trend Micro's family of antivirus solutions. Trend Micro is a world leader
in antivirus and content security technologies. They offer protection for
the Internet gateway, Notes and Exchange email servers, desktop machines
and everywhere in between -- forming a protective, content security
VirusWall around your entire network.
http://www.antivirus.com/welcome/springfwd04052000.htm

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Want to sponsor Windows 2000 Magazine Security UPDATE? Contact Jim Langone
(Western Advertising Sales Manager) at 800-593-8268 or [e-mail],
OR Tanya T. TateWik (Eastern and International Advertising Sales Manager)
at 877-217-1823 or [e-mail].
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1. ========== IN FOCUS ==========

Hello everyone,

Two years ago, when someone used the acronym ASP, they were probably
referring to Microsoft's Active Server Pages technology. Today, a new group
of entities that call themselves application service providers (ASPs) has
appropriated the acronym. ASPs offer businesses and other end users
centralized network-based access to a set of everyday applications for a
fee. Using a high-speed network connection, users connect to an ASP to run
the applications they need.
   Microsoft CEO Steve Balmer once said that shrink-wrapped software will
one day become a thing of the past. I think that ASPs are the inevitable
replacement to shrink-wrapped software, so what are the pros and cons of
this form of computing?
   With the use of ASPs, the cost of operation for a network will replace
cost of ownership. In the future, instead of owning your network, you might
lease it. Large ASPs might eventually offer your business a total network
solution, including all software, hardware, cabling, maintenance, support,
Internet connectivity, and upgrades. With that basic network service plan,
ASPs will probably guarantee uptime, network response time, and information
security.
   If anything will stymie ASPs' acceptance in the marketplace, it will be
security. The reasons are manifold but are mainly found in the potential
for Denial of Service (DoS) attacks and data interception. Are today's OSs
and network hardware robust enough to fend off Distributed Denial of
Service (DDoS) attacks? Has VPN technology been tested thoroughly enough
that a business can trust its ability to continually protect data? I think
you'll find that the answer is no to both questions.
   For example, Microsoft's VPN solution is PPTP. Security organizations
Counterpane and L0pht proved that Microsoft's first rendition of PPTP was
seriously flawed. Microsoft corrected those shortcomings with the release
of PPTPv2, but what other problems remain undetected or unreported? An even
bigger concern might be why Microsoft didn't detect these problems before
releasing the technology. Numerous vendors release less-than-secure
products, so Microsoft is not alone in that category.
   Perhaps I'm wrong, but it seems as though vendors prefer to release
software, then wait for independent hackers to find problems with it, which
the vendor then fixes at its leisure. This routine of waiting for third
parties to find bugs in already-released software shifts the cost of
debugging from the vendor to the consumers. Is it fair to put consumers at
risk like that? And more importantly, will that cost-shifting methodology
work with ASP-based solutions? I seriously doubt it.
   The public doesn't accept claims of product security at face value. If a
vendor makes a claim about security, hackers will test that claim and
report their findings. If vendors don't change the way they test code and
do a more thorough job of looking for security risks, hackers will have a
field day on ASPs. Hackers will quickly prove how easily they can disrupt
ASP service or compromise information security. And if hackers do those
things, isn't that beneficial to everyone who relies on the ASP and its
applications? I think so. Perhaps insecure applications are no different
than any other defective product, where itÆs the manufacturer's ultimate
responsibility to keep the product safe to use.
   The bottom line is that for ASP technology to become acceptable across
the board, it must first be certified as a secure computing method. But who
will make that certification? You certainly can't accept a vendor's claims
at face value--they've proved time and again that they are fallible when it
comes to the development of risk-free applications.
   And even if the applications are deemed secure, which ASP will boldly
certify that it's DDoS-proof or crack proof? If an ASP becomes the target
of DDoS attacks or a serious breach of security, how will that ASP
compensate its clients for any subsequent loss of business revenue? Will
businesses have to wave the right to revenue recovery when they contract
with an ASP? Will governments have to eventually intervene on behalf of any
businesses affected by ASP security issues? Will ASPs become regulated like
other communication services?
   ASP technology raises many questions, most of which have no clear answer
yet. But one thing seems clear: ASPs are not ready for prime time. The
security risks alone are too great for most businesses to accept.
Nonetheless, Microsoft and other vendors intend to realize their envisioned
future of a society without shrink-wrapped software. Several aspects of
computing will need to change before that happens: Vendors must enhance the
way they test their code for security problems, and networks must become
more resistant to all types of DoS attacks. Until that happens, I think
ASPs will remain sitting ducks.
   On a related note, you can stay current on the latest ASP happenings by
subscribing to our biweekly ASP Review UPDATE electronic newsletter
featuring News Editor Christa Anderson. Stop by our Web site at
http://www.win2000mag.com/ourproducts/email to subscribe.
   Also, I'd like to point out that you can now find my weekly editorial
posted on our NTSecurity.net Web site each Wednesday afternoon, complete
with functionality that let's you post your own comments. Be sure to stop
by and discuss ASPs with me. I'm anxious to learn your ideas, concerns, and
opinions. Until next time, have a great week.

Sincerely,
Mark Joseph Edwards, News Editor
[e-mail]

2. ========== SECURITY RISKS =========
(contributed by Mark Joseph Edwards, [e-mail])

* INDEX SERVER EXPOSES WEB CODE
If a request is made for a particular IIS URL related to Index Server, the
system can be tricked into exposing source code for files on the Web site.
The problem resides in Microsoft's implementation of the webhits.dll, which
has an associated memory-resident file entitled null.htw. The file exists
only in memory, where the webhits.dll code handles all calls to the file.
If you append a space in a particular manner to the end of a URL destined
for null.htw, the system reveals a file's source code instead of processing
the file as usual.
   The problem affects Indexing Service on Windows 2000 (Win2K) and Index
Server 2.0 on Windows NT 4.0. Microsoft has issued patches, an FAQ, and a
Support Online article regarding this matter.
   http://www.ntsecurity.net/go/loader.asp?iD=/security/iis4-7.htm

* MALFORMED TCP/IP PRINT REQUEST
USSRLabs reported that a specially malformed TCP/IP print request can cause
the tcpsvc.exe to crash, which not only prevents the server from providing
printing services, but also stops several other services, including DHCP.
The problem affects users of Windows 2000 (Win2K) and Windows NT 4.0.
   Users should note that the affected TCP/IP print service is not the same
as native print service under Win2K Pro and NT 4.0. Microsoft has issued
patches, an FAQ, and a Support Online article regarding this matter.
   http://www.ntsecurity.net/go/loader.asp?iD=/security/ntprint1.htm

* UNC MAPPINGS AND IIS VIRTUAL PATHS EXPOSE CODE
If a virtual directory on an IIS server is mapped to a Universal Naming
Convention (UNC) share, and a request for a file in the directory contains
one of several specific characters at the end, the expected ISAPI extension
processing might not occur. The result is that the source code of the file
is sent to the browser.
   The problem affects Microsoft IIS 4.0 and 5.0, Proxy Server 2.0, Site
Server, Site Server Commerce Edition 3.0, and Commercial Internet System
2.0 and 2.5. Microsoft has released patches, an FAQ, and a Support Online
article related to this matter.
   http://www.ntsecurity.net/go/loader.asp?iD=/security/iis4-6.htm

3. ========== ANNOUNCEMENTS ==========

* REGISTER TODAY FOR MICROSOFT TECH-ED 2000!
Microsoft Tech-Ed 2000 focuses specifically on products and technologies
that you can use TODAY! Join more than 10,000 of your peers at the premier
technical training event--Microsoft Tech-Ed 2000, June 5 through 8 in
Orlando, Florida.
   This year, Microsoft Tech-Ed 2000 will feature more than 220 sessions
delivered by Microsoft developers and third-party experts. They will cover
topics related to the core products that make up Windows DNA 2000--the
platform that gives you the fastest time-to-market for building Web
applications that can integrate with your existing applications.
   Don't miss out on all this valuable technical training! Get the in-depth
technical education you need about the latest products, technologies, and
services that will change business computing in the coming year, and solve
your real business issues now.
   Register now at
http://msdn.microsoft.com/events/teched/defaultr.asp

* TURN YOUR KNOWLEDGE INTO SOMETHING YOU CAN DRIVE!
Ready to test your knowledge of evaluating, deploying, maintaining, and
troubleshooting Microsoft products? Here's your chance to compete in a
skills-based sweepstakes for a BMW Z3 Roadster from BMW of North America.
Enter the Microsoft TechNet Puzzler contest today!
http://www.microsoft.com/technet/puzzler/default.ASP


4. ========== SECURITY ROUNDUP ==========

* NEWS: OFFICE 2000 SR-1 UPDATE MIGHT CONTAIN NUMEROUS BUGS
Last week we learned that BugNet was investigating claims about no less
than 10 serious problems that reside within Microsoft's Service Release 1
(SR-1) Update for Office 2000. On March 31, Microsoft released an updated
version of SR-1, which corrects numerous problems. If you're an Office 2000
user, be sure to load the latest SR-1 Update.
   http://officeupdate.microsoft.com/2000/downloadDetails/O2kSR1DDL.htm

* NEWS: IPV6 IN WINDOWS 2000 AT LEAST 2 YEARS OUT
In March, Microsoft posted preview code that enables Windows 2000 (Win2K)
to support the newer IPv6 protocol specification. However, according to
Mitch Wagner's report for TechWeb, Microsoft's official support for IPv6
under Win2K is still at least 2 years away.
   As you know, IPv6 provides expanded address space, better routing, and
enhanced support for security features, such as the ability to deny address
spoofing and support for IPSec.
   http://www.techweb.com/se/directlink.cgi?INW20000327S0031

* NEWS: ARMY TO ADOPT BIOMETRIC SECURITY
Dan Verton reports that the US Army is studying the ethical and legal
implications of replacing personal passwords with biometric devices. As you
know, biometric devices enhance security through their ability to read
fingerprints, recognize voices and faces, and capture a host of other
personal biologically related information from a given computer user.
   http://www.fcw.com/fcw/articles/2000/0403/tec-mouse-04-03-00.asp

5. ========== NEW AND IMPROVED ==========
(contributed by Judy Drennen, [e-mail])

* PROTECTION FROM HACKER ATTACKS
Recourse Technologies released ManHunt, a security solution designed to
protect corporations from hacker attacks. ManHunt lets businesses track
hackers across Internet boundaries. ManHunt working with ManTrap enables
companies to track and trap hackers. ManHunt detects attacks against
distributed computer networks and responds by tracking the attacker back
across numerous Internet hops. ManHunt determines the precise network entry
point and forwards the information to upstream ISPs. Contact Recourse
Technologies at 877-786-9633 or visit the Web site.
   http://www.recourse.com

* INCREASED SECURITY FOR E-COMMERCE
RapidStream announced RapidStream Scalable Security Architecture (RSSA)
that takes network security to a new performance level. The RapidStream
architecture addresses the previously missing technical advancement needed
in security systems to meet increased security requirements for e-commerce,
email, voice, and hosts (Web servers, application servers, file servers).
By deploying RapidStream Security Appliances, a company can secure its
internal network by adding access control (firewall and hacker detection)
and data secrecy (encryption). Outsourced Web servers and application
servers can also receive this same level of protection from Internet
attacks without giving up performance, a critical requirement for service
providers who offer Service Level Agreements (SLAs). The RapidStream
architecture was designed to execute multiple services simultaneously at
high throughputs while adding minimal delay (latency).
   For more information, contact Bruce Byrd at 408-519-4891, Fran Aun at
415-288-0401, or visit the RapidStream Web site.
   http://www.RapidStream.com.

6. ========== HOT RELEASE (ADVERTISEMENT) ==========

* WEBTRENDS SECURITY ANALYZER 3.5 - 1,000+ TESTS
WebTrends Security Analyzer 3.5 provides complete security vulnerability
analysis with over 1,000 tests for Windows 95, 98, NT, 2000, Red Hat and VA
Linux, and Solaris systems. Get the FREE 10 System Edition for immediate
download.
http://www.webtrends.com/redirect/securityupdate1.htm

7. ========== SECURITY TOOLKIT ==========

* BOOK HIGHLIGHT: MANAGING TCP/IP NETWORKS: TECHNIQUES, TOOLS AND SECURITY
By Gilbert Held
Online Price $89.95
Hardcover; 334 Pages
Published by John Wiley & Sons, February 2000
ISBN 0471800031

Numerous management issues are associated with the construction and
operation of a TCP/IP network. This comprehensive text addresses these
issues, ranging from the planning behind the assignment of TCP/IP addresses
to the ability to recognize network problems and the appropriate use of
diagnostic tools to discover their cause. This  book's accessible style
will appeal to a wide-ranging audience. For professionals in the field of
data communications and computer science, LAN administrators, network
managers, network analysts, network designers, and network engineers. It's
also essential reading for students of electrical and electronic
engineering, computer science, and communications.

For Windows 2000 Magazine Security UPDATE readers only--Receive an
additional 10 percent off the online price by typing in WIN2000MAG in the
discount field on the Shopping Basket Checkout page. To order this book, go
to

http://www.fatbrain.com/shop/info/0471800031?from=win2000mag

Or visit the Windows 2000 Magazine Network Bookstore at
http://www1.fatbrain.com/store.cl?p=win2000mag&s=97772

* TIP: MINIMIZE THE RISK OF USING WINDOWS 2000 PROFESSIONAL
(contributed by Mark Joseph Edwards, [e-mail])

Windows 2000 Professional (Win2K Pro) is a brand new OS with lots of bells
and whistles, so its available services deserve careful inspection before
connecting it to the Internet. If you perform your own Win2K Pro
installation, install only the services that you absolutely require. If
someone other than yourself built or maintains your system, you should
review all services for proper configuration. For example, did you know
that Win2K Pro lets a remote user start the Telnet service if your system
is not protected against such action? Therefore, if you don't need a Telnet
service, don't install it. And if the service is already installed, remove
or disable it.
   Minimally, inspect each installed service to ensure no unwanted services
have been enabled for automatic or manual start. If you have services
installed that you'll never use, remove them from your systems. These
actions help prevent intruders from starting services without your
knowledge. If you have a service installed that you'll use only on rare
occasions, disable that service until you need it.
   Be sure to inspect and test all the security aspects of any installed
services for proper configuration. For example, if you have an FTP service
installed, ensure that only authorized accounts can log on to that service
and that those accounts can access only the parts of the file system you
authorize.

* WINDOWS 2000 SECURITY: REDUCING THE RISKS OF GROUP POLICIES
In the second installment of his biweekly column, Randy Franklin Smith
looks at some of the major differences between Group Policy under Windows
2000 (Win2K) and Windows NT 4.0. Randy points out some caveats and offers
advice about how to avoid pitfalls as your network evolves. Be sure to stop
by and read Randy's new article today.
   http://www.ntsecurity.net/go/win2ksec.asp

* ULTIMATE SECURITY TOOLKIT: INTERNET SCANNER 6.1
Steve Manzuik looks at Internet Scanner 6.1 from Internet Security Systems
in Atlanta. According to Steve, the product is stable and scans for more
than 600 vulnerabilities, but it can be expensive compared to some
competing tools on the market today. Stop by and read what Steve has to say
about this leading-edge tool.
   http://www.ntsecurity.net/go/ultimate.asp

* WRITING SECURE CODE: AVOIDING BUFFER OVERRUNS WITH STRING SAFTEY
This week, David LeBlanc offers developers advice that will help avoid some
of the pitfalls with string handling. Denial of Service (DoS) attacks are
the leading form of attack on most networks today. Proper string handling
in an application can prevent many common DoS attacks by not providing an
attacker the means to overrun a buffer. As you know, buffer overruns can
corrupt system memory, crash system services, and in some cases let an
attacker run arbitrary code on your system. If you're a Win32 application
developer, be sure to read David's latest column.
   http://www.ntsecurity.net/go/seccode.asp

8. ========== HOT THREADS ==========

* WINDOWS 2000 MAGAZINE ONLINE FORUMS

The following text is from a recent threaded discussion on the Windows
2000 Magazine online forums (http://www.win2000mag.com/support).

March 23, 2000, 03:58 A.M.
Let Non-administrators Add a Local Printer on NT Workstation
The users on our NT 4.0 Workstation (SP6a) laptops do not have local
administrator privileges. This gives a certain level of security, but
unfortunately, they are not able to add a local printer either. Is there a
way to work around this?

Thread continues at
http://www.win2000mag.com/support/Forums/Application/Index.cfm?CFApp=69&Message_ID=96337.

* WIN2KSECADVICE MAILING LIST
Each week we offer a quick recap of some of the highlights from the
Win2KSecAdvice mailing list. The following threads are in the spotlight
this week:

1. Aureate/Radiate Update
I believe that people are getting MUCH TOO UPSET by OptOut's reports of the
presence of Aureate/Radiate's advertising software in their computers. So I
need to clearly state a few things right now for the record.
http://www.ntsecurity.net/go/w.asp?A2=IND0004A&L=WIN2KSECADVICE&P=322

2. BAT.Chode.Worm Appears not to Affect NT/Win2K
It appears that the worm will only work on Win9x, DOS, Win 3.x boxes and
not NT or Win2K. From reading the technical details the worm relies on
autoexec.bat, win.com, and winsock.vbs in order to run. Again, it is
probably possible to modify this worm to affect NT/Win2K.
http://www.ntsecurity.net/go/w.asp?A2=IND0004A&L=WIN2KSECADVICE&P=204

Follow this link to read all threads for April, Week 1:
   http://www.ntsecurity.net/go/win2ks-l.asp?s=win2ksec

* HOWTO MAILING LIST
Each week we offer a quick recap of some of the highlights from the
HowTo for Security mailing list. The following thread is in the
spotlight this week:

Enterprise Security Manager Any Good?
Does anybody know if Axents Security product Enterprise Security Manager
(ESM) is any good? We are going to evaluate a few security products and I
want to know if it is worth evaluating ESM.
   http://www.ntsecurity.net/go/L.asp?A2=IND0004A&L=HOWTO&P=81

Follow this link to read all threads for April, Week 1:
   http://www.ntsecurity.net/go/l.asp?s=howto

|-+-|-+-|-+-|-+-|-+-|-+-|-+-|-+-|-+-|-+-|-+-|-+-|-+-|-+-|-+-

WINDOWS 2000 MAGAZINE SECURITY UPDATE STAFF
News Editor - Mark Joseph Edwards ([e-mail])
Ad Sales Manager (Western) - Jim Langone ([e-mail])
Ad Sales Manager (Eastern) - Tanya T. TateWik ([e-mail])
Associate Publisher/Network - Martha Schwartz ([e-mail])
Editor - Gayle Rodcay ([e-mail])
New and Improved û Judy Drennen ([e-mail])
Copy Editor û Judy Drennen ([e-mail])

|-+-|-+-|-+-|-+-|-+-|-+-|-+-|-+-|-+-|-+-|-+-|-+-|-+-|-+-|-+-

========== GET UPDATED! ==========
Receive the latest information about the Windows 2000 and Windows NT topics
of your choice. Subscribe to these other FREE email newsletters at
http://www.win2000mag.com/sub.cfm?code=up99inxsup.

Windows 2000 Magazine UPDATE
Windows 2000 Magazine Thin-Client UPDATE
Windows 2000 Magazine Exchange Server UPDATE
Windows 2000 Magazine Storage UPDATE
Windows 2000 Pro UPDATE
ASP Review UPDATE
SQL Server Magazine UPDATE
SQL Server Magazine XML UPDATE
IIS Administrator UPDATE
WinInfo UPDATE




SUBSCRIBE/UNSUBSCRIBE/CHANGE ADDRESS

Thank you for reading Windows 2000 Magazine Security UPDATE.


To subscribe, go to the UPDATE home page at
http://www.win2000mag.com/update
or send a blank email to [e-mail].

To remove yourself from the list, send a blank email to
[e-mail].

To change your email address, send a message with the sentence

set securityupdate email="new email address"

as the message text to [e-mail]. Replace the words "new email address" with your new email address (include the quotes).

If you have questions or problems with your UPDATE subscription, please contact [e-mail]. We will address your questions or problems as quickly as we can, but please allow 2 issues for resolution.

|-+-|-+-|-+-|-+-|-+-|-+-|-+-|-+-|-+-|-+-|-+-|-+-|-+-|-+-|-+-|

Copyright 2000, Windows 2000 Magazine