Subject: GA-DIGEST V1 #837
From: [email-masked] (GA-DIGEST)
To: [email-masked]

GA-DIGEST          Thursday, November 8 2001          Volume 01 : Number 837

----------------------------------------------------------------------

Date: Wed, 7 Nov 2001 06:20:20 -0400
From: "Peter de Blanc" <[email-masked]>
Subject: RE: [ga] Reliability of the Internet - the silent battle - part 2

Roeland:

The file you attached, ATT00010.DAT,  262 K bytes, was identified as
"32.Sircam.Worm@mm"  and "quarantined" by my Norton Anti-Virus corporate
edition version 7.51.847.

Peter de Blanc

- -----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Roeland
Meyer
Sent: Tuesday, November 06, 2001 10:27 PM
To: GA DNSO (E-mail)
Subject: RE: [ga] Reliability of the Internet - the silent battle - part
2

Hold on guys! The shell was there but the virus wasn't. It was a message
that showed an attachment, without the attachment.

|> -----Original Message-----
|> From: Roeland Meyer [mailto:[email-masked]]
|> Sent: Tuesday, November 06, 2001 1:32 PM
|> To: GA DNSO (E-mail)
|> Subject: [ga] Reliability of the Internet - the silent
|> battle - part 2
|> 
|> 
|> This is an example of something that didn't survive my
|> filters. I looked at
|> the attachement, it wasn't spam. Rather, it was an attached virus.
|> 
|> I have included the traceroute for validation. It
|> purportedly came from
|> china. The point is that, file attachments are becoming a 
|> less reliable
|> means to distribute documents.
|> 
|> --- techies-only below here ---
|> 
|> pheonix:/root
|> Tue Nov  6 13:07:51 [bash:root:59]#> traceroute 211.101.48.83 
|> traceroute to 211.101.48.83 (211.101.48.83), 30 hops max, 40 byte 
|> packets  1  spkez.gw.mhsc.net (216.27.184.225)  5 ms  3 ms  2 ms
|>  2  gw-081-176.sfo1.dsl.speakeasy.net (216.27.176.1)  27 ms  
|> 21 ms  33 ms
|>  3  border3.fe5-3.speakeasy-9.sff.pnap.net (216.52.86.28)  
|> 19 ms  21 ms  19
|> ms
|>  4  core1.fe0-1-bbnet2.sff.pnap.net (216.52.80.65)  20 ms  
|> 21 ms  20 ms
|>  5  sl-gw12-sj-1-1.sprintlink.net (144.232.217.17)  22 ms  
|> 20 ms  21 ms
|>  6  sl-gw12-sj-9-0.sprintlink.net (144.232.3.145)  25 ms  22 
|> ms  32 ms
|>  7  sl-bb20-tac-11-1.sprintlink.net (144.232.9.214)  56 ms  
|> 39 ms  41 ms
|>  8  sl-gw4-tac-0-0.sprintlink.net (144.232.17.6)  38 ms  41 ms  40 ms
|>  9  * sle-chinatelecom-3-0.sprintlink.net (160.81.25.6)  443 ms *
|> 10  p-13-0-r1-c-bjbj-1.cn.net (202.97.33.9)  502 ms  303 ms  200 ms
|> 11  p-2-0-r1-a-bjbj-2.cn.net (202.97.38.50)  188 ms  201 ms  219 ms
|> 12  202.96.12.50 (202.96.12.50)  287 ms  324 ms  271 ms
|> 13  202.106.193.206 (202.106.193.206)  199 ms  195 ms  196 ms
|> 14  202.108.254.75 (202.108.254.75)  199 ms  197 ms  196 ms
|> 15  211.101.63.2 (211.101.63.2)  500 ms  505 ms  514 ms
|> 16  211.101.63.9 (211.101.63.9)  229 ms  230 ms  231 ms
|> 17  211.101.48.83 (211.101.48.83)  530 ms  553 ms  565 ms
|> 
|> |> -----Original Message-----
|> Received: from junhoo.com (211.101.48.83 [211.101.48.83]) by
|> condor.mhsc.com
|> with SMTP (Microsoft Exchange Internet Mail Service Version 
|> 5.5.2650.21)
|> 	id TTWMVQKL; Tue, 6 Nov 2001 13:04:47 -0800
|> Received: from CR380220-A.etob1.on.wave.home.com [24.101.18.46] by
|> junhoo.com
|>   (SMTPD32-7.04 EVAL) id AF54350042; Wed, 07 Nov 2001 05:00:04 +0800
|> From: "0"<0
|> To: [email-masked]
|> Subject: Flight crews rely on passengers to stop trouble
|> date: Tue, 6 Nov 2001 16:12:47 -0500
|> MIME-Version: 1.0
|> X MIME OLE: Produced By Microsoft MimeOLE V5.50.4133.2400
|> X-Mailer: Microsoft Outlook Express 5.50.4133.2400
|> Co ntent Type: multi part/m ixed; boun
|> dary="----41C1485D_Outlook_Express_message_boundary"
|> Con tent Disposition: Multipart message
|> Message-Id: 
|> <[email-masked]>
|> 
|> ------41C1485D_Outlook_Express_message_boundary
|> Content Type: text/plain; charset=ISO-8859-1
|> Content Transfer-Encoding: quoted-printable
|> Content Disposition: message text
|> 
|> ------41C1485D_Outlook_Express_message_boundary
|> Content Type: application/mixed; na me="Flight crews rely on
|> passengers to
|> stop trouble.doc.com"
|> Content Transfer-Encoding: base64
|> Content Disposition: attachment;  file name="Flight crews 
|> rely on passengers
|> to stop trouble.doc.com"
|> 
|> ------41C1485D_Outlook_Express_message_boundary
|> |> From: 0 [mailto:0]
|> |> Sent: Tuesday, November 06, 2001 1:13 PM
|> |> To: [email-masked]
|> |> Subject: Flight crews rely on passengers to stop trouble
|> |> 
|> |> 
|> |> Hi! How are you?
|> |>  
|> |> This is the file with the information that you ask for
|> |>  
|> |> See you later. Thanks
|> |> 
|> 
|> 
- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Wed, 7 Nov 2001 03:04:31 -0800 
From: Roeland Meyer <[email-masked]>
Subject: RE: [ga] Reliability of the Internet - the silent battle - part 2

I am sorry if it caused you concern. The DAT file, while not normally
executable, shouldn't have been there. I thought my methods had removed it.
My filters had already renamed it to the DAT type, which is a non-executable
type under windows, and I manually deleted the attachment from the message.
Apparently, that was unsuccessful. If Norton detected it then either NAV is
using external message data or I indeed failed to remove the attachment.

In the latter case, I apologize. I went back to my Sent Files folder to
check and it appears to not have the attachment, under binary scan of the
message, even though the message header thinks it still has the file. But,
playing around with virii isn't safe by any stretch and that's the main
reason I don't do it. Because it was a DAT file, it should still be dead.
But, I won't repeat that move anytime soon. Again, I apologize for the
inconvenience.

Now, if I can get that system in China to quit sending me free copies of
SirCam ....

|> -----Original Message-----
|> From: Peter de Blanc [mailto:[email-masked]]
|> Sent: Wednesday, November 07, 2001 2:20 AM
|> To: 'Roeland Meyer'; 'GA DNSO (E-mail)'
|> Subject: RE: [ga] Reliability of the Internet - the silent 
|> battle - part
|> 2
|> 
|> 
|> Roeland:
|> 
|> The file you attached, ATT00010.DAT,  262 K bytes, was identified as
|> "32.Sircam.Worm@mm"  and "quarantined" by my Norton 
|> Anti-Virus corporate
|> edition version 7.51.847.
|> 
|> Peter de Blanc
|> 
|> -----Original Message-----
|> From: [email-masked] [mailto:[email-masked]] On Behalf 
|> Of Roeland
|> Meyer
|> Sent: Tuesday, November 06, 2001 10:27 PM
|> To: GA DNSO (E-mail)
|> Subject: RE: [ga] Reliability of the Internet - the silent 
|> battle - part
|> 2
|> 
|> 
|> Hold on guys! The shell was there but the virus wasn't. It 
|> was a message
|> that showed an attachment, without the attachment.
|> 
|> |> -----Original Message-----
|> |> From: Roeland Meyer [mailto:[email-masked]]
|> |> Sent: Tuesday, November 06, 2001 1:32 PM
|> |> To: GA DNSO (E-mail)
|> |> Subject: [ga] Reliability of the Internet - the silent
|> |> battle - part 2
|> |> 
|> |> 
|> |> This is an example of something that didn't survive my
|> |> filters. I looked at
|> |> the attachement, it wasn't spam. Rather, it was an attached virus.
|> |> 
|> |> I have included the traceroute for validation. It
|> |> purportedly came from
|> |> china. The point is that, file attachments are becoming a 
|> |> less reliable
|> |> means to distribute documents.
|> |> 
|> |> --- techies-only below here ---
|> |> 
|> |> pheonix:/root
|> |> Tue Nov  6 13:07:51 [bash:root:59]#> traceroute 211.101.48.83 
|> |> traceroute to 211.101.48.83 (211.101.48.83), 30 hops max, 40 byte 
|> |> packets  1  spkez.gw.mhsc.net (216.27.184.225)  5 ms  3 ms  2 ms
|> |>  2  gw-081-176.sfo1.dsl.speakeasy.net (216.27.176.1)  27 ms  
|> |> 21 ms  33 ms
|> |>  3  border3.fe5-3.speakeasy-9.sff.pnap.net (216.52.86.28)  
|> |> 19 ms  21 ms  19
|> |> ms
|> |>  4  core1.fe0-1-bbnet2.sff.pnap.net (216.52.80.65)  20 ms  
|> |> 21 ms  20 ms
|> |>  5  sl-gw12-sj-1-1.sprintlink.net (144.232.217.17)  22 ms  
|> |> 20 ms  21 ms
|> |>  6  sl-gw12-sj-9-0.sprintlink.net (144.232.3.145)  25 ms  22 
|> |> ms  32 ms
|> |>  7  sl-bb20-tac-11-1.sprintlink.net (144.232.9.214)  56 ms  
|> |> 39 ms  41 ms
|> |>  8  sl-gw4-tac-0-0.sprintlink.net (144.232.17.6)  38 ms  
|> 41 ms  40 ms
|> |>  9  * sle-chinatelecom-3-0.sprintlink.net (160.81.25.6)  443 ms *
|> |> 10  p-13-0-r1-c-bjbj-1.cn.net (202.97.33.9)  502 ms  303 
|> ms  200 ms
|> |> 11  p-2-0-r1-a-bjbj-2.cn.net (202.97.38.50)  188 ms  201 
|> ms  219 ms
|> |> 12  202.96.12.50 (202.96.12.50)  287 ms  324 ms  271 ms
|> |> 13  202.106.193.206 (202.106.193.206)  199 ms  195 ms  196 ms
|> |> 14  202.108.254.75 (202.108.254.75)  199 ms  197 ms  196 ms
|> |> 15  211.101.63.2 (211.101.63.2)  500 ms  505 ms  514 ms
|> |> 16  211.101.63.9 (211.101.63.9)  229 ms  230 ms  231 ms
|> |> 17  211.101.48.83 (211.101.48.83)  530 ms  553 ms  565 ms
|> |> 
|> |> |> -----Original Message-----
|> |> Received: from junhoo.com (211.101.48.83 [211.101.48.83]) by
|> |> condor.mhsc.com
|> |> with SMTP (Microsoft Exchange Internet Mail Service Version 
|> |> 5.5.2650.21)
|> |> 	id TTWMVQKL; Tue, 6 Nov 2001 13:04:47 -0800
|> |> Received: from CR380220-A.etob1.on.wave.home.com [24.101.18.46] by
|> |> junhoo.com
|> |>   (SMTPD32-7.04 EVAL) id AF54350042; Wed, 07 Nov 2001 
|> 05:00:04 +0800
|> |> From: "0"<0
|> |> To: [email-masked]
|> |> Subject: Flight crews rely on passengers to stop trouble
|> |> date: Tue, 6 Nov 2001 16:12:47 -0500
|> |> MIME-Version: 1.0
|> |> X MIME OLE: Produced By Microsoft MimeOLE V5.50.4133.2400
|> |> X-Mailer: Microsoft Outlook Express 5.50.4133.2400
|> |> Co ntent Type: multi part/m ixed; boun
|> |> dary="----41C1485D_Outlook_Express_message_boundary"
|> |> Con tent Disposition: Multipart message
|> |> Message-Id: 
|> |> <[email-masked]>
|> |> 
|> |> ------41C1485D_Outlook_Express_message_boundary
|> |> Content Type: text/plain; charset=ISO-8859-1
|> |> Content Transfer-Encoding: quoted-printable
|> |> Content Disposition: message text
|> |> 
|> |> ------41C1485D_Outlook_Express_message_boundary
|> |> Content Type: application/mixed; na me="Flight crews rely on
|> |> passengers to
|> |> stop trouble.doc.com"
|> |> Content Transfer-Encoding: base64
|> |> Content Disposition: attachment;  file name="Flight crews 
|> |> rely on passengers
|> |> to stop trouble.doc.com"
|> |> 
|> |> ------41C1485D_Outlook_Express_message_boundary
|> |> |> From: 0 [mailto:0]
|> |> |> Sent: Tuesday, November 06, 2001 1:13 PM
|> |> |> To: [email-masked]
|> |> |> Subject: Flight crews rely on passengers to stop trouble
|> |> |> 
|> |> |> 
|> |> |> Hi! How are you?
|> |> |>  
|> |> |> This is the file with the information that you ask for
|> |> |>  
|> |> |> See you later. Thanks
|> |> |> 
|> |> 
|> |> 
|> --
|> This message was passed to you via the [email-masked] list.
|> Send mail to [email-masked] to unsubscribe
|> ("unsubscribe ga" in the body of the message).
|> Archives at http://www.dnso.org/archives.html
|> 
|> --
|> This message was passed to you via the [email-masked] list.
|> Send mail to [email-masked] to unsubscribe
|> ("unsubscribe ga" in the body of the message).
|> Archives at http://www.dnso.org/archives.html
|> 
- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Wed, 7 Nov 2001 07:07:42 -0400
From: "Peter de Blanc" <[email-masked]>
Subject: RE: [ga] Reliability of the Internet - the silent battle - part 2

Ok, Roeland-

Perhaps I over-reacted...  But I just spent several days (and nights)
"cleaning" my windows NT based servers. No problems with my unix
servers, of course ;-)

Regards

Peter de Blanc

- -----Original Message-----
From: Roeland Meyer [mailto:[email-masked]] 
Sent: Wednesday, November 07, 2001 7:05 AM
To: 'Peter de Blanc'; Roeland Meyer; 'GA DNSO (E-mail)'
Subject: RE: [ga] Reliability of the Internet - the silent battle - part
2

I am sorry if it caused you concern. The DAT file, while not normally
executable, shouldn't have been there. I thought my methods had removed
it. My filters had already renamed it to the DAT type, which is a
non-executable type under windows, and I manually deleted the attachment
from the message. Apparently, that was unsuccessful. If Norton detected
it then either NAV is using external message data or I indeed failed to
remove the attachment.

In the latter case, I apologize. I went back to my Sent Files folder to
check and it appears to not have the attachment, under binary scan of
the message, even though the message header thinks it still has the
file. But, playing around with virii isn't safe by any stretch and
that's the main reason I don't do it. Because it was a DAT file, it
should still be dead. But, I won't repeat that move anytime soon. Again,
I apologize for the inconvenience.

Now, if I can get that system in China to quit sending me free copies of
SirCam ....

|> -----Original Message-----
|> From: Peter de Blanc [mailto:[email-masked]]
|> Sent: Wednesday, November 07, 2001 2:20 AM
|> To: 'Roeland Meyer'; 'GA DNSO (E-mail)'
|> Subject: RE: [ga] Reliability of the Internet - the silent
|> battle - part
|> 2
|> 
|> 
|> Roeland:
|> 
|> The file you attached, ATT00010.DAT,  262 K bytes, was identified as 
|> "32.Sircam.Worm@mm"  and "quarantined" by my Norton Anti-Virus 
|> corporate edition version 7.51.847.
|> 
|> Peter de Blanc
|> 
|> -----Original Message-----
|> From: [email-masked] [mailto:[email-masked]] On Behalf
|> Of Roeland
|> Meyer
|> Sent: Tuesday, November 06, 2001 10:27 PM
|> To: GA DNSO (E-mail)
|> Subject: RE: [ga] Reliability of the Internet - the silent 
|> battle - part
|> 2
|> 
|> 
|> Hold on guys! The shell was there but the virus wasn't. It
|> was a message
|> that showed an attachment, without the attachment.
|> 
|> |> -----Original Message-----
|> |> From: Roeland Meyer [mailto:[email-masked]]
|> |> Sent: Tuesday, November 06, 2001 1:32 PM
|> |> To: GA DNSO (E-mail)
|> |> Subject: [ga] Reliability of the Internet - the silent battle - 
|> |> part 2
|> |> 
|> |> 
|> |> This is an example of something that didn't survive my filters. I 
|> |> looked at the attachement, it wasn't spam. Rather, it was an 
|> |> attached virus.
|> |> 
|> |> I have included the traceroute for validation. It purportedly came

|> |> from china. The point is that, file attachments are becoming a
|> |> less reliable
|> |> means to distribute documents.
|> |> 
|> |> --- techies-only below here ---
|> |> 
|> |> pheonix:/root
|> |> Tue Nov  6 13:07:51 [bash:root:59]#> traceroute 211.101.48.83
|> |> traceroute to 211.101.48.83 (211.101.48.83), 30 hops max, 40 byte 
|> |> packets  1  spkez.gw.mhsc.net (216.27.184.225)  5 ms  3 ms  2 ms
|> |>  2  gw-081-176.sfo1.dsl.speakeasy.net (216.27.176.1)  27 ms  
|> |> 21 ms  33 ms
|> |>  3  border3.fe5-3.speakeasy-9.sff.pnap.net (216.52.86.28)  
|> |> 19 ms  21 ms  19
|> |> ms
|> |>  4  core1.fe0-1-bbnet2.sff.pnap.net (216.52.80.65)  20 ms  
|> |> 21 ms  20 ms
|> |>  5  sl-gw12-sj-1-1.sprintlink.net (144.232.217.17)  22 ms  
|> |> 20 ms  21 ms
|> |>  6  sl-gw12-sj-9-0.sprintlink.net (144.232.3.145)  25 ms  22 
|> |> ms  32 ms
|> |>  7  sl-bb20-tac-11-1.sprintlink.net (144.232.9.214)  56 ms  
|> |> 39 ms  41 ms
|> |>  8  sl-gw4-tac-0-0.sprintlink.net (144.232.17.6)  38 ms  
|> 41 ms  40 ms
|> |>  9  * sle-chinatelecom-3-0.sprintlink.net (160.81.25.6)  443 ms * 
|> |> 10  p-13-0-r1-c-bjbj-1.cn.net (202.97.33.9)  502 ms  303
|> ms  200 ms
|> |> 11  p-2-0-r1-a-bjbj-2.cn.net (202.97.38.50)  188 ms  201
|> ms  219 ms
|> |> 12  202.96.12.50 (202.96.12.50)  287 ms  324 ms  271 ms 13  
|> |> 202.106.193.206 (202.106.193.206)  199 ms  195 ms  196 ms 14  
|> |> 202.108.254.75 (202.108.254.75)  199 ms  197 ms  196 ms 15  
|> |> 211.101.63.2 (211.101.63.2)  500 ms  505 ms  514 ms 16  
|> |> 211.101.63.9 (211.101.63.9)  229 ms  230 ms  231 ms 17  
|> |> 211.101.48.83 (211.101.48.83)  530 ms  553 ms  565 ms
|> |> 
|> |> |> -----Original Message-----
|> |> Received: from junhoo.com (211.101.48.83 [211.101.48.83]) by 
|> |> condor.mhsc.com with SMTP (Microsoft Exchange Internet Mail 
|> |> Service Version
|> |> 5.5.2650.21)
|> |> 	id TTWMVQKL; Tue, 6 Nov 2001 13:04:47 -0800
|> |> Received: from CR380220-A.etob1.on.wave.home.com [24.101.18.46] by

|> |> junhoo.com
|> |>   (SMTPD32-7.04 EVAL) id AF54350042; Wed, 07 Nov 2001
|> 05:00:04 +0800
|> |> From: "0"<0
|> |> To: [email-masked]
|> |> Subject: Flight crews rely on passengers to stop trouble
|> |> date: Tue, 6 Nov 2001 16:12:47 -0500
|> |> MIME-Version: 1.0
|> |> X MIME OLE: Produced By Microsoft MimeOLE V5.50.4133.2400
|> |> X-Mailer: Microsoft Outlook Express 5.50.4133.2400
|> |> Co ntent Type: multi part/m ixed; boun 
|> |> dary="----41C1485D_Outlook_Express_message_boundary"
|> |> Con tent Disposition: Multipart message
|> |> Message-Id:
|> |> <[email-masked]>
|> |> 
|> |> ------41C1485D_Outlook_Express_message_boundary
|> |> Content Type: text/plain; charset=ISO-8859-1
|> |> Content Transfer-Encoding: quoted-printable
|> |> Content Disposition: message text
|> |> 
|> |> ------41C1485D_Outlook_Express_message_boundary
|> |> Content Type: application/mixed; na me="Flight crews rely on 
|> |> passengers to stop trouble.doc.com"
|> |> Content Transfer-Encoding: base64
|> |> Content Disposition: attachment;  file name="Flight crews 
|> |> rely on passengers
|> |> to stop trouble.doc.com"
|> |> 
|> |> ------41C1485D_Outlook_Express_message_boundary
|> |> |> From: 0 [mailto:0]
|> |> |> Sent: Tuesday, November 06, 2001 1:13 PM
|> |> |> To: [email-masked]
|> |> |> Subject: Flight crews rely on passengers to stop trouble
|> |> |> 
|> |> |> 
|> |> |> Hi! How are you?
|> |> |>  
|> |> |> This is the file with the information that you ask for
|> |> |>  
|> |> |> See you later. Thanks
|> |> |> 
|> |> 
|> |> 
|> --
|> This message was passed to you via the [email-masked] list. Send mail to

|> [email-masked] to unsubscribe ("unsubscribe ga" in the body of 
|> the message). Archives at http://www.dnso.org/archives.html
|> 
|> --
|> This message was passed to you via the [email-masked] list. Send mail to

|> [email-masked] to unsubscribe ("unsubscribe ga" in the body of 
|> the message). Archives at http://www.dnso.org/archives.html
|> 

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Wed, 7 Nov 2001 03:02:26 -0800
From: William X Walsh <[email-masked]>
Subject: Re[2]: [ga] Reliability of the Internet - the silent battle - part 2

Wednesday, Wednesday, November 07, 2001, 3:04:31 AM, Roeland Meyer wrote:

> I am sorry if it caused you concern. The DAT file, while not normally
> executable, shouldn't have been there. I thought my methods had removed it.
> My filters had already renamed it to the DAT type, which is a non-executable
> type under windows, and I manually deleted the attachment from the message.
> Apparently, that was unsuccessful. If Norton detected it then either NAV is
> using external message data or I indeed failed to remove the attachment.

It must have used the external data, my copy that come from the list
did not have the attachment.

- -- 
Best regards,
William X Walsh <[email-masked]>
- --
Webcertificates.info
SSL Certificates for resellers from $49ea

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Wed, 7 Nov 2001 03:27:02 -0800 
From: Roeland Meyer <[email-masked]>
Subject: RE: Re[2]: [ga] Reliability of the Internet - the silent battle - part 2

|> From: William X Walsh [mailto:[email-masked]]
|> Sent: Wednesday, November 07, 2001 3:02 AM
|> 
|> Wednesday, Wednesday, November 07, 2001, 3:04:31 AM, Roeland 
|> Meyer wrote:

|> > My filters had already renamed it to the DAT type, which 
|> is a non-executable
|> > type under windows, and I manually deleted the attachment 
|> from the message.
|> > Apparently, that was unsuccessful. If Norton detected it 
|> then either NAV is
|> > using external message data or I indeed failed to remove 
|> the attachment.
|> 
|> It must have used the external data, my copy that come from the list
|> did not have the attachment.

Thanks William. This indicates a problem with NAV. It's not the first time
that NAV has shown false-positives. Only binary scans of the actual
attachment is valid. Basing detection on external data isn't. I'm glad to
hear that my kill methods worked though, as I said, I wont be doing that
again soon. I am saddened to hear that Norton Anti-Virus, any edition, may
not be adequate.

It does prove another point, however, that there is no magic bullet for
these things. MHSC servers withstood Code Red and Nimda attacks, for two
solid weeks, that were sufficiently severe to use 80% of our WAN bandwidth,
24x7x2. It was a PITA, but I let it run because the servers seemed to be
holding up well. Good architecture and systems policies are the only real
answer and that takes a knowlegable hand at the tiller. A "magic" program,
by itself, isn't going to save your servers. They have flaws too.

Now that I've left everyone with that comforting thought, g'night all.
- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 8 Nov 2001 01:52:51 +1100
From: "Patrick Corliss" <[email-masked]>
Subject: [ga] UNESCO Observatory on the Information Society

I wonder whether others in the GA subscribe to the above newsletter at:
http://www.unesco.org/webworld/observatory

One interesting recent article was:

[ACC, INF - 26.10.2001] Has HTML had its day?  (The Guardian)
If you fancy a challenge, think about making the web redundant. Think about
getting all the programmers and designers who create web pages in HTML
(Hypertext Mark-up Language) to use something different. Think about
converting them to Curl. It sounds like a long shot, but it is by no means
impossible. The information technology industry is used to sweeping changes,
such as the move from Microsoft's MS-DOS to Windows, or from proprietary
networking systems to the internet's IP (Internet Protocol).
http://www.guardian.co.uk/internetnews/story/0,7369,580311,00.html

Regards
Patrick Corliss

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Wed, 7 Nov 2001 16:01:37 +0100
From: Thomas Roessler <[email-masked]>
Subject: Re: [ga] Reliability of the Internet - the silent battle - part 2

On 2001-11-07 03:04:31 -0800, Roeland Meyer wrote:

>I am sorry if it caused you concern. The DAT file, while not
>normally executable, shouldn't have been there. I thought my
>methods had removed it. My filters had already renamed it to the 
>DAT type, which is a non-executable type under windows, and I 
>manually deleted the attachment from the message. 

Whatever your filter did, it was only visible on your system.  Your 
message had an application/mixed attachment with a file name ending 
in .doc.com, which contained a 16-page word document at offset 
137216.

Of course, the problem you are trying to describe has nothing at all 
to do with attachments "as such": It's more about inappropriate 
interpretation of attachments in implementations, and about users 
who carelessly execute every program sent to them.  This leads, in 
turn, to software trying to second-guess malware, with all evil side 
effects this may have.

The problem is also (and, one may say, even more so) about using and 
being used to inappropriate data formats when transferring data. 
Word documents can contain macros, which can basically control a 
windows PC. That's a problem in any circumstance where such 
documents cross trust boundaries - be it, possibly, on local 
networks, be it on the web, or be it via e-mail. That is, making 
word documents available for download is in no way better than 
attaching them to e-mail messages.

The same argument does, of course, apply to any "active" content 
being spread on the net, including even HTML when clients on the 
receiving end are configured without paying attention to trust 
boundaries.  (With windows, you should possibly have another look at 
your Security Zones settings, and make sure that e-mail content is 
considered to come from some zone which has sufficiently paranoid 
security settings.)

This means that any data formats having "active" components are 
totally inappropriate when publishing information which is supposed 
to cross trust boundaries.  If you want to publish or spread large 
documents, use plain text (which is sufficient for most things), or 
use HTML or PDF (and hope that your correspondents either don't know 
about the possible dangers, or are using sufficiently safe viewers).

Concerning Peter de Blanc's "complaint" about Roeland's message, and 
the news item about f-prot being integrated with listserv which was 
forwarded by Danny: Filtering viruses and worms at mailing list 
distribution points is pointless, and a cosmetic "solution" _at_ 
_best_.  Because, either users rely on software which isn't 
susceptible to the worms and viruses generally distributed - in this 
case, filtering is unnecessary.  Or they are using software which is 
susceptible.  In this case, they are acting irresponsibly when not 
using local filtering solutions anyways.  In this case, central 
scanning will possibly delay infection (and learning of an important 
lesson) a bit - but such users will eventually be hit directly. That 
effect is nothing worth spending any money or effort for.

Thus, scanning for malware at list servers only helps to reduce 
bandwidth consumption (a bit), and it does of course help to cover 
up the fact that quite a few virus-scanning gateways are of so poor 
quality that they aren't even able to properly determine where to 
send an error message.

- -- 
Thomas Roessler                        http://log.does-not-exist.org/
- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 8 Nov 2001 02:32:19 +1100
From: "Patrick Corliss" <[email-masked]>
Subject: [ga] Mani Pulite O Mani Sporche ?

Hi Roeland

> I've been looking for "manu pulite". Could you explain?

Try "mani pulite"
http://cidc.library.cornell.edu/DOF/italy/captioned/mani.htm

Regards
Patrick

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Wed, 07 Nov 2001 07:47:51 -0800
From: Eric Dierker <[email-masked]>
Subject: [ga] Secular?

How come I cannot find a single place for/or member representing a
religious order any where in ICANN.
Are they unwelcome?  Do they not care?  Perhaps instead of a domain name
ownership required to vote in the AL we should require faith membership?
Generally you pay some for both and you have to be real.

Well the possibilities are very interesting, we all know that while
reverse hijacking is bad, how the porn sites grab expiring faith based
domain names is far worse.  Perhaps we should be more concerned with the
human type viruses then the e types.

As too the etype viruses; my personal thanks to Mr. Roesslers' recent
post. 
Now that is the way someone who wants to be understood should write on
the GA.  Hard technical talk on the GA is simply braggadocios (yes I
used this long arcane english word to help make my point = bragging, in
marketing we say flag waving)

Sincerely,
Eric

http://www.msnbc.com/news/653706.asp
- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Wed, 07 Nov 2001 10:54:17 -0600
From: [email-masked] (Kristy McKee)
Subject: Re: [ga] The "Official" ALSC Report is Posted

Cute.

~k

At 11:54 PM 11/5/2001 -0500, you wrote:
>http://www.atlargestudy.org/final_report.shtml
>
>
>
>
>
>
>
>
>--
>This message was passed to you via the [email-masked] list.
>Send mail to [email-masked] to unsubscribe
>("unsubscribe ga" in the body of the message).
>Archives at http://www.dnso.org/archives.html

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Wed, 07 Nov 2001 14:52:27 -0400
From: Joanna Lane <[email-masked]>
Subject: Re: [ga] Report on the NC Transfers Task Force activities

on 11/6/01 12:43 PM, [email-masked] at [email-masked] wrote:

> 
> Whereas Verisign appears concerned that domain name holders may not be
> adequately represented in these discussions, if there is an organization that
> represents such interests that would like to forward a representative to this
> task force, please let me know and I will bring such interest to the
> attention of the Interim Chair.
> --

Danny,

As all in community knows, the organization that represents the interests of
Individual Domain Name Holders at this time is the IDNO,
http://www.idno.org, it's purpose and mission being ratified in it's Charter
in September 2000 as:-

1.1 Purpose: to provide representation in the Domain name Supporting
Organization (DNSO) for all individual Domain Name Owners. We represent the
concerns of individuals who own domain names, rather than organizations.
These concerns include the wish to remain free from being classified as
commercial or non-commercial.

1.2. Mission: to ensure that Individual Domain Name Owners , as stakeholders
in the Domain Name System (DNS), will have a say in all new ICANN rulemaking
that will affect their financial interest, on-line freedom or security of
existence. 

1.3. Our mission to represent Individual Domain Name Owners will extend to
all global decisionmaking bodies and is not limited to representation in
ICANN or the DNSO. 

It is therefore entirely appropriate for the IDNO to participate in the
ICANN process through a representative joining the NC Transfer Task Force.

Speaking personally as both a long time advocate of the rights of Individual
Domain Holders in the General Assembly and other fora, who has participated
in general discussions about the proposed Transfer policy changes, and as a
member of the IDNO, I am keen to expedite this matter in whatever way
possible. However, the IDNO has recently commenced an election process that
I understand temporarily limits what it can do with respect to selecting a
representative to join the NC Transfer Task Force at this time, and
unfortunately, it will December before those procedures can be completed.

In order not to cause delays unecessarily, I am therefore requesting that
you put my name forward to the Interim Chair of the Task Force, in my
capacity of an Individual Domain Name Holder who will take responsibility
for gathering input on Transfer policy issues on a day to day basis from the
collective IDNO membership and other interested individual domain name
holders, until such time as the IDNO can confirm a representative
appointment.

Regards,
Joanna 

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Wed, 7 Nov 2001 20:36:47 +0100 (CET)
From: Marc Schneiders <[email-masked]>
Subject: [ga] Registrar selling expired domains... (2 URLS for available names for Sale)

A registrar offering expired domains for sale. Interesting.

- ---------- Forwarded message ----------
Date: Wed, 07 Nov 2001 12:59:56 -0500
From: [email-masked]
To: [email-masked]
Subject: 2 URLS for available names for Sale

URLs for domains to purchase. If you are interested in any of these please
email [email-masked].

Impound domains
http://iar2.iaregistry.com/cgi-bin/dispimp.cgi

Expired Domains
http://iar2.iaregistry.com/cgi-bin/iarexpimp.cgi

David W
Manager IARegistry.com

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 08 Nov 2001 10:55:49 +1300
From: Joop Teernstra <[email-masked]>
Subject: Re: [ga] The "Official" ALSC Report is Posted

On 10:54 7/11/01 -0600, Kristy McKee said:
>Cute.
>
>~k
>
>At 11:54 PM 11/5/2001 -0500, you wrote:
>>http://www.atlargestudy.org/final_report.shtml

The recommendations in this report should not be adopted by the Board 
without serious improvement.

The proposals on how to cast the future distribution of Board seats in 
stone are beyond the scope of the Committee's study mandate and a permanent 
minority position on the Board as envisaged for ICANN's members is not 
exactly the place to be when you want to have input in DNS policy.

My conclusion, now more than ever, is that the Individual Domain Name 
Holders must get their representation in the DNSO, in balance with the 
registration provider industry.

- --Joop

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Wed, 07 Nov 2001 18:18:47 -0800
From: Jeff Williams <[email-masked]>
Subject: [ga] FYI Sans security info and report - SANS NewsBites Vol. 3 Num. 45

- --------------041B2143F14B5E9BD3A7E8F1
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

All assembly members,

  As I had posted twice before and followed up on by Roeland I am
forwarding the following regarding the Sans classes and news for
your review.

==============  Copy follows ==============

Today is the deadline for the early registration discount for Cyber
Defense West in San Francisco next month (www.sans.org) and both Cyber
Defense East (Washington DC) and West programs will have the full
five-day hands-on hacker exploits course, the nation's highest rated
security training program) as well as other great immersion training
tracks. AP
**********************************************************************
SANS NEWSBITES The SANS Weekly Security News Overview Volume 3, Number
45 November 7, 2001 Editorial Team: Kathy Bradford, Dorothy Denning,
Roland Grefer, Vicki Irwin, Bill Murray, Stephen Northcutt, Alan Paller,
Marcus Ranum, Howard Schmidt, Eugene Schultz
**********************************************************************
TOP OF THE NEWS 5 November 2001 Netcraft Survey Says 130,000 IIS Users
Switched to Apache 2 November 2001 Passport e-Wallet Vulnerability 1
November 2001 California Court Says DeCSS is "Pure Speech" 31 October &
1 November 2001 NY Times Attack Was Nimda, Not DoS 30 October 2001
Nimda-E Still A Major Problem THE REST OF THE WEEK'S NEWS 1 & 2 November
2001 Aibo Hacker Threatened With DMCA 1 November 2001 Florida IS
Director Wants Critical Infrastructure Protection Center 1 November 2001
A Place for Hackers to Work 31 October & 1 November 2001 Virus-Tainted
DVD Recalled 31 October 2001 Proposed European Legislation Takes Aim at
Cookies 31 October 2001 Sewage spills; Hacker jailed 31 October 2001
Phony WTO Site 31 October 2001 The Human Element of Security 30 October
2001 Plans for a Virtual Pentagon 30 October 2001 Microsoft Warns
Against Installing Pirated Versions of Windows XP 1 November 2001
Microsoft Admits XP Has Been Cracked UPCOMING TRAINING OPPORTUNITIES
**Microsoft IIS Security in multiple cities **Hackers Beware: Live! in
multiple cities **Three Rivers SANS (1 track), Pittsburgh, PA, Nov.
15-20 **North Pacific SANS (1 track), Vancouver, BC, Nov. 15-20 **SANS
Cyber Defense Initiative (6 tracks), Wash. DC, Nov. 27 - Dec. 3 **SANS
Cyber Defense Initiative (3 tracks), San Fran. CA, Dec. 16-22 **SANS
Gateway Asia (2 tracks), Singapore, Jan 10-15 **SANS Down Under (1
tracks), Melbourne, Jan 10-15 **SANS Darling Harbour (4 tracks), Sydney,
Jan 19-24 **Plus new, on-line, security training programs. See
www.sans.org for details. ************************ Sponsored by NetIQ
************************** FREE SECURITY GUIDE: Get the in-depth
knowledge you need to secure your enterprise with NetIQ's FREE
step-by-step security guide - "Selecting The Right Security Solution" -
at http://www.netiq.com/f/form/form.asp?id=109 NetIQ's security
solutions not only identify intruders, but ensure that threats don't
ever become incidents.
***********************************************************************
TOP OF THE NEWS --5 November 2001 Netcraft Survey Says 130,000 IIS Users
Switched to Apache Netcraft's September survey of 33 million web servers
showed 300,000 fewer IIS servers than in August, with 130,000 of those
sites moving to Apache. The survey also reported that 11 percent of all
IIS servers were infected and completely unprotected from exploitation
and use by malicious persons.
http://www.cw360.com/bin/bladerunner?REQSESS=Z097P4P&690REQEVENT=&CARTI=107480&CARTT=14&CCAT=2&CCHAN=20&CFLAV=1&CPAGEN=ArticlePage&CPAGET=-99999&CSEARCH=&CSESS=-99999&CTOPIC=
- --2 November 2001 Passport e-Wallet Vulnerability A researcher
discovered that by sending specially constructed e-mails to Hotmail
accounts, he could view the contents of that user's Passport e-wallet.
Marc Slemko alerted Microsoft to the vulnerability, and the company
temporarily shut users out of their e-wallets while they fixed the
network. http://www.msnbc.com/news/652089.asp?0dm=C219T [Editor's
(Schultz) Note: At least two years ago a number of malicious Java
applets (e.g., "BookMarker," "DemonDialer," and "Pickpocket") that raid
electronic wallets surfaced. These applets are still widely available at
certain web sites. (Irwin) The summary paragraph makes it sound like
Microsoft fixed the problem after being alerted. And, in the most
literal sense, they did. But if you read Mark Slemko's paper, you'll see
that there is a fundamental design flaw in the Passport "single sign-on"
implementation ... specifically (quoting the paper) "The Hotmail HTML
filtering hole and this particular cross-site scripting issue on
passport.com will quickly be fixed, making this particular exploit stop
working. But unless the deeper issues are addressed, it is still fairly
trivial to come up with a new exploit using slightly different
techniques. The key problems here are that the cookies go to all
passport.com servers, broadening the attack space, and that when the
user uses a password to authenticate for one purpose, the resulting
token can be used for other purposes." Incidents.Org Handler's Diary
article for a technical overview
http://www.incidents.org/diary/november01/110501.php#2 Mark Slemko's
paper http://alive.znep.com/~marcs/passport/] --1 November 2001
California Court Says DeCSS is "Pure Speech" A three judge panel of the
California Court of Appeal has ruled that DeCSS, the program written to
descramble DVDs, is "pure speech" and web sites posting the program are
protected by the First Amendment.
http://www.msnbc.com/news/651673.asp?0dm=C16PT
http://www.wired.com/news/print/0,1294,48075,00.html
http://news.cnet.com/news/0-1005-200-7751876.html?tag=prntfr --31
October & 1 November 2001 NY Times Attack Was Nimda, Not DoS What at
first appeared to be a denial-of-service attack on the New York Times
computers instead turned out to be the work of a variant of the Nimda
worm. http://news.cnet.com/news/0-1003-200-7739301.html?tag=prntfr
http://www.computerworld.com/storyba/0,4125,NAV47_STO65249,00.html --30
October 2001 Nimda-E Still A Major Problem Complete analysis at.
http://www.incidents.org/diary/october01/103001.php#1 ******************
Also Sponsored by VIGILANTe *********************** A new generation of
distributed vulnerability assessment solutions now available! Bring your
company's level of internal and external network security into the 21st
century of protection. You can achieve unparalleled efficiency and
flexibility through a unique third generation distributed vulnerability
scanning technology, providing single console real-time testing of
multiple remote systems. To find out more, please go to
http://www.vigilante.com/info/SANS/
**********************************************************************
THE REST OF THE WEEK'S NEWS --1 & 2 November 2001 Aibo Hacker Threatened
With DMCA Sony is threatening to invoke the Digital Millennium Copyright
Act (DMCA) against a hacker who has tinkered with the electronics
company's Aibo robotic dog and placed software enhancements on his web
site. The augmented programs still require that users purchase Sony
Memory Sticks.
http://news.cnet.com/news/0-1006-200-7746625.html?tag=prntfr
http://www.wired.com/news/business/0,1367,48088,00.html --1 November
2001 Florida IS Director Wants Critical Infrastructure Protection Center
Florida's Information Security Office Director is asking the State
legislature to establish and fund a critical infrastructure protection
center to alert law enforcement, infrastructure managers, some private
companies and emergency workers in the event of an attack. The center
would have four levels of redundancy, including a secure Internet
connection, to ensure communications.
http://www.gcn.com/vol1_no1/daily-updates/17400-1.html --1 November 2001
A Place for Hackers to Work Thubten Comerford, a former Buddhist monk
and now the CEO of White Hat Technologies, takes issue with using the
word "hackers" to refer to bad guys. Comerford created his company to
guide young hackers toward helping people.
http://www.theregister.co.uk/content/55/22599.html [Editor's (Murray)
Note: "By their fruits you shall know them." Like it or not, the word
carries a lot of baggage. It seems to mean those who reject
professionalism, formal and supervised learning, order, identification
with the community of users, identification with the common good,
submission to authority, discipline, private property, etc. It seems to
mean those that reserve the right to interfere with, not to say
contaminate, the systems of others. That is the fault of those who so
identify and how they behave, not of the rest of us. Anyone who does not
like the baggage that comes with the word can simply reject the
identification. "A rose is a rose is rose" and garlic by any name still
smells like garlic. (Paller) Bill may be right and the task may be
harder than Mr. Comerford thinks, but I for one, wish him great
success.] --31 October & 1 November 2001 Virus-Tainted DVD Recalled In
the first reported instance of a DVD acting as the vector of infection,
a Powerpuff Girls cartoon DVD has been recalled because it contains the
Funlove virus. The virus infects PCs when the disk's supplemental
software is installed; DVD players are unaffected.
http://news.cnet.com/news/0-1003-200-7735109.html?tag=prntfr
http://news.bbc.co.uk/hi/english/sci/tech/newsid_1632000/1632896.stm
- --31 October 2001 Proposed European Legislation Takes Aim at Cookies The
European Commission has introduced legislation that would prohibit the
use of cookies, or personal identification tags. Proponents of the
proposed directive maintain cookies violate citizens' privacy; people in
the advertising business say the move, if approved, could seriously
damage e-commerce and Internet advertising sales.
http://www.wired.com/news/politics/0,1283,48025,00.html [Editor's
(Schultz) Note: This news item once again shows the clash of two
cultures, the one in the US (in which insufficient attention to privacy
is paid), and the one in much of Europe, where privacy is a major
concern. What we are seeing here is a proverbial time bomb waiting to go
off.] --31 October 2001 Sewage spills; Hacker jailed An Australian man
was sent to prison for two years after he was found guilty of hacking
into a Queensland computer-controlled waste management system and
causing millions of gallons of raw sewage to spill out into local parks,
rivers and even the grounds of a Hyatt Regency hotel.
http://www.theregister.co.uk/content/4/22579.html --31 October 2001
Phony WTO Site A phony WTO site that has been around for two years
recently changed its appearance to closely resemble that of the official
site; the phony site also began collecting e-mail addresses of visitors
without permission. Some search engines are sending surfers to the fake
site instead of the real one.
http://www.computerworld.com/storyba/0,4125,NAV47_STO65229,00.html --31
October 2001 The Human Element of Security John Dickinson reminds
readers that people are an important line of defense in computer
security: don't open attachments if you don't know what they are, who
they're from or weren't expecting them, be wary of attachments with
certain extensions, including .exe, .vbs, and .dll, and adjust program
security settings.
http://www.zdnet.com/zdnn/stories/comment/0,5859,2821467,00.html --30
October 2001 Plans for a Virtual Pentagon The Defense Department (DoD)
is working on plans for a "virtual Pentagon" or "distributed Pentagon"
that would allow DoD employees to keep working after a disaster. The
September 11 attack underscored the need for distributed remote storage
sites and redundant measures to avoid single points of failure.
http://www.fcw.com/fcw/articles/2001/1029/web-pent-10-30-01.asp --30
October 2001 Microsoft Warns Against Installing Pirated Versions of
Windows XP Microsoft warns users not to install pirated versions of the
recently released software because it could leave them vulnerable to
malicious code. An IT security firm says the software's copy protection
has been broken. http://www.newsbytes.com/news/01/171651.html --1
November 2001 Microsoft Admits XP Has Been Cracked Crackers have been
distributing code that removes the product activation technology from
Windows XP, allowing users to install the software on multiple machines.
Microsoft is aware of the situation.
http://www.computerworld.com/storyba/0,4125,NAV47_STO65240,00.html
==end== Please feel free to share this with interested parties via email
(not on bulletin boards). For a free subscription, (and for free
posters) e-mail [email-masked] with the subject: Subscribe NewsBites To
change your subscription, address, or other information, visit
http://www.sans.org/sansurl and enter your SD number (from the headers.)
You will receive your personal URL via email. You may also email with
complete instructions and your SD number for subscribe, unsubscribe,
change address, add other digests, or any other comments. -----BEGIN PGP
SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see
http://www.gnupg.org
iD8DBQE76ZTs+LUG5KFpTkYRAuI6AKCjdRRXGQ7CJ8TZtm0FxEoE7MZW4wCghTtW
IM5BausET/t7xG8l1M4Ri/U= =brT3 -----END PGP SIGNATURE-----

- --------------041B2143F14B5E9BD3A7E8F1
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML>
All assembly members,
<P>&nbsp; As I had posted twice before and followed up on by Roeland I
am
<BR>forwarding the following regarding the Sans classes and news for
<BR>your review.
<P>==============&nbsp; Copy follows ==============
<P>Today is the deadline for the early registration discount for Cyber
Defense West in San Francisco next month (www.sans.org) and both Cyber
Defense East (Washington DC) and West programs will have the full five-day
hands-on hacker exploits course, the nation's highest rated security training
program) as well as other great immersion training tracks. AP **********************************************************************
SANS NEWSBITES The SANS Weekly Security News Overview Volume 3, Number
45 November 7, 2001 Editorial Team: Kathy Bradford, Dorothy Denning, Roland
Grefer, Vicki Irwin, Bill Murray, Stephen Northcutt, Alan Paller, Marcus
Ranum, Howard Schmidt, Eugene Schultz **********************************************************************
TOP OF THE NEWS 5 November 2001 Netcraft Survey Says 130,000 IIS Users
Switched to Apache 2 November 2001 Passport e-Wallet Vulnerability 1 November
2001 California Court Says DeCSS is "Pure Speech" 31 October &amp; 1 November
2001 NY Times Attack Was Nimda, Not DoS 30 October 2001 Nimda-E Still A
Major Problem THE REST OF THE WEEK'S NEWS 1 &amp; 2 November 2001 Aibo
Hacker Threatened With DMCA 1 November 2001 Florida IS Director Wants Critical
Infrastructure Protection Center 1 November 2001 A Place for Hackers to
Work 31 October &amp; 1 November 2001 Virus-Tainted DVD Recalled 31 October
2001 Proposed European Legislation Takes Aim at Cookies 31 October 2001
Sewage spills; Hacker jailed 31 October 2001 Phony WTO Site 31 October
2001 The Human Element of Security 30 October 2001 Plans for a Virtual
Pentagon 30 October 2001 Microsoft Warns Against Installing Pirated Versions
of Windows XP 1 November 2001 Microsoft Admits XP Has Been Cracked UPCOMING
TRAINING OPPORTUNITIES **Microsoft IIS Security in multiple cities **Hackers
Beware: Live! in multiple cities **Three Rivers SANS (1 track), Pittsburgh,
PA, Nov. 15-20 **North Pacific SANS (1 track), Vancouver, BC, Nov. 15-20
**SANS Cyber Defense Initiative (6 tracks), Wash. DC, Nov. 27 - Dec. 3
**SANS Cyber Defense Initiative (3 tracks), San Fran. CA, Dec. 16-22 **SANS
Gateway Asia (2 tracks), Singapore, Jan 10-15 **SANS Down Under (1 tracks),
Melbourne, Jan 10-15 **SANS Darling Harbour (4 tracks), Sydney, Jan 19-24
**Plus new, on-line, security training programs. See www.sans.org for details.
************************ Sponsored by NetIQ **************************
FREE SECURITY GUIDE: Get the in-depth knowledge you need to secure your
enterprise with NetIQ's FREE step-by-step security guide - "Selecting The
Right Security Solution" - at <A HREF="http://www.netiq.com/f/form/form.asp?id=109">http://www.netiq.com/f/form/form.asp?id=109</A>
NetIQ's security solutions not only identify intruders, but ensure that
threats don't ever become incidents. ***********************************************************************
TOP OF THE NEWS --5 November 2001 Netcraft Survey Says 130,000 IIS Users
Switched to Apache Netcraft's September survey of 33 million web servers
showed 300,000 fewer IIS servers than in August, with 130,000 of those
sites moving to Apache. The survey also reported that 11 percent of all
IIS servers were infected and completely unprotected from exploitation
and use by malicious persons. <A HREF="http://www.cw360.com/bin/bladerunner?REQSESS=Z097P4P">http://www.cw360.com/bin/bladerunner?REQSESS=Z097P4P</A>&amp;690REQEVENT=&amp;CARTI=107480&amp;CARTT=14&amp;CCAT=2&amp;CCHAN=20&amp;CFLAV=1&amp;CPAGEN=ArticlePage&amp;CPAGET=-99999&amp;CSEARCH=&amp;CSESS=-99999&amp;CTOPIC=
- --2 November 2001 Passport e-Wallet Vulnerability A researcher discovered
that by sending specially constructed e-mails to Hotmail accounts, he could
view the contents of that user's Passport e-wallet. Marc Slemko alerted
Microsoft to the vulnerability, and the company temporarily shut users
out of their e-wallets while they fixed the network. <A HREF="http://www.msnbc.com/news/652089.asp?0dm=C219T">http://www.msnbc.com/news/652089.asp?0dm=C219T</A>
[Editor's (Schultz) Note: At least two years ago a number of malicious
Java applets (e.g., "BookMarker," "DemonDialer," and "Pickpocket") that
raid electronic wallets surfaced. These applets are still widely available
at certain web sites. (Irwin) The summary paragraph makes it sound like
Microsoft fixed the problem after being alerted. And, in the most literal
sense, they did. But if you read Mark Slemko's paper, you'll see that there
is a fundamental design flaw in the Passport "single sign-on" implementation
... specifically (quoting the paper) "The Hotmail HTML filtering hole and
this particular cross-site scripting issue on passport.com will quickly
be fixed, making this particular exploit stop working. But unless the deeper
issues are addressed, it is still fairly trivial to come up with a new
exploit using slightly different techniques. The key problems here are
that the cookies go to all passport.com servers, broadening the attack
space, and that when the user uses a password to authenticate for one purpose,
the resulting token can be used for other purposes." Incidents.Org Handler's
Diary article for a technical overview <A HREF="http://www.incidents.org/diary/november01/110501.php#2">http://www.incidents.org/diary/november01/110501.php#2</A>
Mark Slemko's paper <A HREF="http://alive.znep.com/~marcs/passport/">http://alive.znep.com/~marcs/passport/</A>] --1 November
2001 California Court Says DeCSS is "Pure Speech" A three judge panel of
the California Court of Appeal has ruled that DeCSS, the program written
to descramble DVDs, is "pure speech" and web sites posting the program
are protected by the First Amendment. <A HREF="http://www.msnbc.com/news/651673.asp?0dm=C16PT">http://www.msnbc.com/news/651673.asp?0dm=C16PT</A>
<A HREF="http://www.wired.com/news/print/0,1294,48075,00.html">http://www.wired.com/news/print/0,1294,48075,00.html</A> <A HREF="http://news.cnet.com/news/0-1005-200-7751876.html?tag=prntfr">http://news.cnet.com/news/0-1005-200-7751876.html?tag=prntfr</A>
- --31 October &amp; 1 November 2001 NY Times Attack Was Nimda, Not DoS What
at first appeared to be a denial-of-service attack on the New York Times
computers instead turned out to be the work of a variant of the Nimda worm.
<A HREF="http://news.cnet.com/news/0-1003-200-7739301.html?tag=prntfr">http://news.cnet.com/news/0-1003-200-7739301.html?tag=prntfr</A> <A HREF="http://www.computerworld.com/storyba/0,4125,NAV47_STO65249,00.html">http://www.computerworld.com/storyba/0,4125,NAV47_STO65249,00.html</A>
- --30 October 2001 Nimda-E Still A Major Problem Complete analysis at. <A HREF="http://www.incidents.org/diary/october01/103001.php#1">http://www.incidents.org/diary/october01/103001.php#1</A>
****************** Also Sponsored by VIGILANTe ***********************
A new generation of distributed vulnerability assessment solutions now
available! Bring your company's level of internal and external network
security into the 21st century of protection. You can achieve unparalleled
efficiency and flexibility through a unique third generation distributed
vulnerability scanning technology, providing single console real-time testing
of multiple remote systems. To find out more, please go to <A HREF="http://www.vigilante.com/info/SANS/">http://www.vigilante.com/info/SANS/</A>
**********************************************************************
THE REST OF THE WEEK'S NEWS --1 &amp; 2 November 2001 Aibo Hacker Threatened
With DMCA Sony is threatening to invoke the Digital Millennium Copyright
Act (DMCA) against a hacker who has tinkered with the electronics company's
Aibo robotic dog and placed software enhancements on his web site. The
augmented programs still require that users purchase Sony Memory Sticks.
<A HREF="http://news.cnet.com/news/0-1006-200-7746625.html?tag=prntfr">http://news.cnet.com/news/0-1006-200-7746625.html?tag=prntfr</A> <A HREF="http://www.wired.com/news/business/0,1367,48088,00.html">http://www.wired.com/news/business/0,1367,48088,00.html</A>
- --1 November 2001 Florida IS Director Wants Critical Infrastructure Protection
Center Florida's Information Security Office Director is asking the State
legislature to establish and fund a critical infrastructure protection
center to alert law enforcement, infrastructure managers, some private
companies and emergency workers in the event of an attack. The center would
have four levels of redundancy, including a secure Internet connection,
to ensure communications. <A HREF="http://www.gcn.com/vol1_no1/daily-updates/17400-1.html">http://www.gcn.com/vol1_no1/daily-updates/17400-1.html</A>
- --1 November 2001 A Place for Hackers to Work Thubten Comerford, a former
Buddhist monk and now the CEO of White Hat Technologies, takes issue with
using the word "hackers" to refer to bad guys. Comerford created his company
to guide young hackers toward helping people. <A HREF="http://www.theregister.co.uk/content/55/22599.html">http://www.theregister.co.uk/content/55/22599.html</A>
[Editor's (Murray) Note: "By their fruits you shall know them." Like it
or not, the word carries a lot of baggage. It seems to mean those who reject
professionalism, formal and supervised learning, order, identification
with the community of users, identification with the common good, submission
to authority, discipline, private property, etc. It seems to mean those
that reserve the right to interfere with, not to say contaminate, the systems
of others. That is the fault of those who so identify and how they behave,
not of the rest of us. Anyone who does not like the baggage that comes
with the word can simply reject the identification. "A rose is a rose is
rose" and garlic by any name still smells like garlic. (Paller) Bill may
be right and the task may be harder than Mr. Comerford thinks, but I for
one, wish him great success.] --31 October &amp; 1 November 2001 Virus-Tainted
DVD Recalled In the first reported instance of a DVD acting as the vector
of infection, a Powerpuff Girls cartoon DVD has been recalled because it
contains the Funlove virus. The virus infects PCs when the disk's supplemental
software is installed; DVD players are unaffected. <A HREF="http://news.cnet.com/news/0-1003-200-7735109.html?tag=prntfr">http://news.cnet.com/news/0-1003-200-7735109.html?tag=prntfr</A>
<A HREF="http://news.bbc.co.uk/hi/english/sci/tech/newsid_1632000/1632896.stm">http://news.bbc.co.uk/hi/english/sci/tech/newsid_1632000/1632896.stm</A> --31
October 2001 Proposed European Legislation Takes Aim at Cookies The European
Commission has introduced legislation that would prohibit the use of cookies,
or personal identification tags. Proponents of the proposed directive maintain
cookies violate citizens' privacy; people in the advertising business say
the move, if approved, could seriously damage e-commerce and Internet advertising
sales. <A HREF="http://www.wired.com/news/politics/0,1283,48025,00.html">http://www.wired.com/news/politics/0,1283,48025,00.html</A> [Editor's
(Schultz) Note: This news item once again shows the clash of two cultures,
the one in the US (in which insufficient attention to privacy is paid),
and the one in much of Europe, where privacy is a major concern. What we
are seeing here is a proverbial time bomb waiting to go off.] --31 October
2001 Sewage spills; Hacker jailed An Australian man was sent to prison
for two years after he was found guilty of hacking into a Queensland computer-controlled
waste management system and causing millions of gallons of raw sewage to
spill out into local parks, rivers and even the grounds of a Hyatt Regency
hotel. <A HREF="http://www.theregister.co.uk/content/4/22579.html">http://www.theregister.co.uk/content/4/22579.html</A> --31 October 2001
Phony WTO Site A phony WTO site that has been around for two years recently
changed its appearance to closely resemble that of the official site; the
phony site also began collecting e-mail addresses of visitors without permission.
Some search engines are sending surfers to the fake site instead of the
real one. <A HREF="http://www.computerworld.com/storyba/0,4125,NAV47_STO65229,00.html">http://www.computerworld.com/storyba/0,4125,NAV47_STO65229,00.html</A>
- --31 October 2001 The Human Element of Security John Dickinson reminds
readers that people are an important line of defense in computer security:
don't open attachments if you don't know what they are, who they're from
or weren't expecting them, be wary of attachments with certain extensions,
including .exe, .vbs, and .dll, and adjust program security settings. <A HREF="http://www.zdnet.com/zdnn/stories/comment/0,5859,2821467,00.html">http://www.zdnet.com/zdnn/stories/comment/0,5859,2821467,00.html</A>
- --30 October 2001 Plans for a Virtual Pentagon The Defense Department (DoD)
is working on plans for a "virtual Pentagon" or "distributed Pentagon"
that would allow DoD employees to keep working after a disaster. The September
11 attack underscored the need for distributed remote storage sites and
redundant measures to avoid single points of failure. <A HREF="http://www.fcw.com/fcw/articles/2001/1029/web-pent-10-30-01.asp">http://www.fcw.com/fcw/articles/2001/1029/web-pent-10-30-01.asp</A>
- --30 October 2001 Microsoft Warns Against Installing Pirated Versions of
Windows XP Microsoft warns users not to install pirated versions of the
recently released software because it could leave them vulnerable to malicious
code. An IT security firm says the software's copy protection has been
broken. <A HREF="http://www.newsbytes.com/news/01/171651.html">http://www.newsbytes.com/news/01/171651.html</A> --1 November 2001
Microsoft Admits XP Has Been Cracked Crackers have been distributing code
that removes the product activation technology from Windows XP, allowing
users to install the software on multiple machines. Microsoft is aware
of the situation. <A HREF="http://www.computerworld.com/storyba/0,4125,NAV47_STO65240,00.html">http://www.computerworld.com/storyba/0,4125,NAV47_STO65240,00.html</A>
==end== Please feel free to share this with interested parties via email
(not on bulletin boards). For a free subscription, (and for free posters)
e-mail [email-masked] with the subject: Subscribe NewsBites To change your
subscription, address, or other information, visit <A HREF="http://www.sans.org/sansurl">http://www.sans.org/sansurl</A>
and enter your SD number (from the headers.) You will receive your personal
URL via email. You may also email&nbsp;<[email-masked]>with complete instructions
and your SD number for subscribe, unsubscribe, change address, add other
digests, or any other comments. -----BEGIN PGP SIGNATURE----- Version:
GnuPG v1.0.6 (GNU/Linux) Comment: For info see <A HREF="http://www.gnupg.org">http://www.gnupg.org</A> iD8DBQE76ZTs+LUG5KFpTkYRAuI6AKCjdRRXGQ7CJ8TZtm0FxEoE7MZW4wCghTtW
IM5BausET/t7xG8l1M4Ri/U= =brT3 -----END PGP SIGNATURE-----</HTML>

- --------------041B2143F14B5E9BD3A7E8F1--

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

End of GA-DIGEST V1 #837
************************