Category: News

Opposition justice spokesman Joe Ludwig had said Labor would support the Bill now that the government had undertaken to conduct a full review of the Telecommunications Interception Act.

But both the Australian Democrats and Greens continued to oppose the bill – the Telecommunications (Interception) Amendment (Stored Communications) Bill 2004 – on the grounds that it intruded excessively on privacy.

Senator Ludwig said the opposition would not oppose the bill on the basis that the government had accepted a bipartisan recommendation of a Senate committee which called for a comprehensive review of the Telecommunications Interception Act over the next 12 months.

Democrats Senator Brian Greig said accessing private communications without a warrant and without the knowledge of the individual involved was a very intrusive practice. “I don’t have confidence that that review is going to come from the point of view of the suggestions and enhancement of the rights of citizens from a government which has serially been involved in putting legislation to this place which cuts across the rights of citizens,” Senator Brown said.

http://www.zdnet.com.au/news/security/0,2000061744,39168307,00.htm

If an online intruder has infiltrated your Windows PC, you may notice recurring slowdowns of e-mail and Web browsing, or you may notice nothing at all. Always use a personal firewall and keep security patches up to date. As of early November, all new Windows XP PCs come with Service Pack 2, which includes a firewall and automatic patching. Owners of Windows XP PCs purchased earlier than that should download Service Pack 2 from www.microsoft.com/athome/ security/protect/default.aspx. Users of older versions of Windows can get security tips at that same Web site. Once hijacked, it is likely to get grouped with other compromised PCs to dispense spam, conduct denial-of-service attacks or carry out identity-theft scams.

Those are key findings of a test conducted by USA TODAY and Avantgarde, a San Francisco tech marketing and design firm.

The experiment involved monitoring six “honeypot” computers for two weeks — set up to see what kind of malicious traffic they would attract.

The test did not measure Web attacks that require user participation, namely spyware, which gets spread by visiting contagious Web sites, or e-mail viruses, which proliferate via e-mail attachments.

However, the results vividly illustrate how automated cyberattacks have come to saturate the Internet with malicious programs designed to take the quickest route to break into your PC: through security weaknesses in the PC operating system.

“It’s a hostile environment out there,” says tech security consultant Kevin Mitnick, who served five years in prison for breaking into corporate computer systems in the mid-1990s.

Test results underscored the value of keeping up to date with security patches and using a firewall.

Attackers successfully compromised the Dell Windows XP computer using Service Pack 1 nine times, and the Dell Windows 2003 Small Business server once.

They included: four Dell desktop PCs running different configurations of the Window XP operating system, an Apple Macintosh and a Microtel Linspire, which uses the Linux operating system.

10:52:08 Less than four minutes from start of the test, an intruder breaks into Windows XP SP1 through the vulnerability most famously exploited by last May’s Sasser worm.

11:03:30 Eleven minutes later another intruder breaks into XP SP1 through the security hole exploited by the July 2003 MS Blaster worm.

He confirms XP SP1 is connected to the Internet, then begins making repeated attempts to connect XP SP1 to a server running an Internet Relay Chat channel, the equivalent of a private Instant Messaging line.

While attempted break-ins never ceased, successful compromises were limited to nine instances on the minimally protected Windows XP computer and a single break-in of the Windows Small Business Server.

To hijack the Windows Small Business Server, the attacker finagled his way into a function of the Windows operating system that allows file sharing between computers.

“Downloading and using other exploits, performing denial-of-service attacks, running spam-relay tools, running identity-theft tools are all very common activities of compromised machines,” says Martin Roesch, chief technology officer at tech security firm Sourcefire.

http://www.usatoday.com/money/industries/technology/2004-11-29-honeypot_x.htm

TippingPoint Technologies launched spyware protection for its UnityOne intrusion- prevention systems. Earlier in the month, Check Point Software Technologies unveiled similar antispyware capabilities for its VPN-1 device.

And solution providers say they’re seeing the need for perimeter security devices that protect against spyware as well as other threats go through the roof.

Today, vendors such as Secure Computing and Internet Security Systems, which have incorporated firewall, VPN and antivirus capability into one box for years, are now adding new capabilities to fight adware, keystroke loggers and other forms of malware.

“As a network administrator, you don’t want this conga line of boxes that you have to manage,” said Richard Hanke, vice president of product management at Fortinet, the Sunnyvale, Calif., company credited with inventing the integrated security appliance.

Across the industry, spyware has risen steadily since January—a recent study co-sponsored by America Online and the National Cyber Security Alliance indicated that eight out of 10 computers are infected by some form of spyware. Then came innovation in the form of point solutions. Earlier this month, Computer Associates International and McAfee each released spyware-specific solutions for enterprises and consumers.

While Fortinet is relatively new to the antispyware movement, fellow Silicon Valley vendor BlueCoat has been incorporating spyware protection in its ProxyAV device for years.

http://www.crn.com/showArticle.jhtml;jsessionid=DWELBERQ4QWKYQSNDBCSKHSCJUMEKJVN?articleID=54200212

The letter, signed by representatives of the DHS, Symantec, Microsoft, McAfee, and Trend Micro, said the industry hopes to address “the challenges surrounding the ‘Virus Name Game’,” with a pilot program coming as early as January.

At first, Common Malware Enumeration (CME) will be confined to “major” threats. Names are often derived from the filenames, the content of the email the worm attaches itself to, or plaintext found inside the code.

http://www.cbronline.com/article_news.asp?guid=11D11704-DE5B-45BD-AF4B-45D8F44E055C

Sarbanes-Oxley may strike dread in the hearts of some IT executives, but not Tracy Austin. Austin, the chief information officer with casino operator Mandalay Resort Group, said the financial reporting regulations act resulted in a 30 percent increase in her information technology budget this year and battle-tested her fairly young IT staff. “I was able to beef up our test and development system budget, as well as our firewall and intrusion detection system budget,” Austin said. “Sarbanes-Oxley opened up the awareness of our (chief) executives and prompted questions about…our business risks. So instead of talking about technology, we were talking about what are our business risks and the technology to address them.”

That’s because the regulations laid down in the Sarbanes-Oxley Act and other laws hold executives’ feet to the fire, making them responsible for signing off on the accuracy of their financial statements. Last week, a key section of Sarbanes-Oxley kicked in, turning up the heat. That push to overhaul systems looks likely to be a boon for security technology providers.

Overall spending on complying with the Sarbanes-Oxley Act is expected to reach $5.5 billion this year, according to a recent survey by AMR Research. That’s more than double the $2.5 billion that was spent last year.

And technology companies are expected to grab nearly a third of the multibillion-dollar spending pie in 2005. Companies are spending more on compliance in general, according to a PricewaterhouseCoopers survey released on Tuesday, which found that about half of U.S. and European businesses expect to increase those budgets by an average of 23 percent during the next year to two.

http://news.zdnet.com/Hidden+gold+in+corporate+cleanup/2100-1009_22-5465305.html?part=rss&tag=feed&subj=zdnn

Steve Vamos told attendees at an Australian Information Industry Association event in Adelaide yesterday the security issue was “essentially …

Vamos’ blunt comments come as Microsoft struggles to deal with a raft of flaws uncovered in its flagship Web browser, Internet Explorer (IE), attempts by malicious code writers to disrupt its monthly patching cycle and security researchers’ preparedness to disclose vulnerabilities to all community members at the same time rather than give the vendor some lead time to devise a fix before going public. The Microsoft Australia boss also launched an assault on the software heavyweight’s other bugbear of the moment, competition from Linux and open source solutions.

The use of open source software by government agencies was very much at the forefront of the recent federal election campaign, with all major political parties detailing publicly their policy stance on the issue. The federal government in late August released a guide saying it was preparing a range of tools to help agencies evaluate emerging open source solutions against more familiar proprietary software “on an informed basis”.

“…my view is very straightforward…that whatever alternatives our customers have, be they open source or not, if they are better value for money and better fit for purpose than what Microsoft have, then we’ve got a problem.” Vamos said he viewed the shift to the use of software as a service as “a much bigger movement” than the open source community. The Microsoft boss also said in the corporate arena, rather than just having the chief information officer pushing the IT agenda in the top team, every member of that team had to sign up to it.

http://www.zdnet.com.au/news/security/0,2000061744,39167795,00.htm