- Email: [email protected]
Hand-held Virii On The Way
Security Views/Dr Bill Hancock
Andrew Antipass, a Manhattan-based corporate security consultant, says he thinks the Internet will see some “sensational” DOS attacks in 2001. “Could it happen over the holiday weekend?” Antipass said. “Sure, because when so many business and university machines are left unattended for a few days, you always have to consider that someone will realize it’s an optimum time to muck about in systems.” The NIPC and other security experts also suggest a ‘lights out’ check to ensure that all users have logged out of the system before they leave the office. People tend to want to escape fast over the holidays, and they may leave without closing down their connections. That leaves the network open to anyone who happens to be in the vicinity, either virtually, or — more likely — people who are physically in your office. “That’s not to say office cleaning crews are actually frustrated crackers, but in some circles corporate espionage isn’t unheard of ”, Antipass added. The NIPC also advised running a full data and system backup before stopping work for the holiday weekend. And if systems will be left running unattended, they also suggest applying all current security patches as well. Antipass suggests that security supervisors should plan to start off the new millennium right by reminding users “once again” that they should “never” open any E-mailed attachments, such as documents, screen savers or pictures that have been sent to them. “I’m stressing to people that they shouldn’t open anything from anyone unless they are specifically expecting to get a document via E-mail. It’s important to tell people, and then tell them again, that nasty viruses and worms can be sent from someone you know.”…“It doesn’t mean they are out to get you, (it) just means you have some lame friends or co-workers who clicked on something they shouldn’t have.” MonKeeBiz, a self-described “freelance systems and security investigator”, said that the NIPC warning is “somewhat justified” in its warnings and fears. But he added that the “real story” behind the furor over DoS attacks is that there is a patch readily available for
6
the hole that is being exploited. “If the zombies are gathering on the front lines, then why are so many people aiding and abetting them by not applying security patches?” MonKeeBiz said. “Didn’t you folks see the Night of the Living Dead? When the zombies started lurching around and lunching on people, the first thing those people did was board up the windows and the doors. Same thing here — apply the patches and then go out and party.”
Hand-held Virii On The Way The magazine advertisement for an anti-virus computer software company shows a giant bug ready to pounce on a man using a handheld computer. The message: computer viruses aren’t just for personal computers anymore. Now, mobile devices such as handheld computers and cell phones are at risk. The threat is real, but it won’t be much of a problem for at least a year, experts say.The mobile devices are not yet powerful enough to allow viruses to thrive. “Today’s (virus warnings) are pretty much pure vendor hype”, says John Pescatore, research director for Gartner, an analyst firm. Gartner estimates that viruses will begin to affect handheld users by the end of 2001 and cell phone users by mid-2002. More than 120 million people will own Webenabled cell phones or handheld computers by 2005, according to industry research firm Yankee Group — and anti-virus vendors are preparing for the onslaught. McAfee.com began selling anti-virus programs for hand-helds in August. Symantec created a division in December to create anti-virus programs for service providers.The programs, which may be released in six months, will allow wireless-related companies to prevent viruses from being sent to users. Three viruses were discovered this fall for the popular Palm operating system, which is installed on handhelds sold by Palm, Handspring and Sony. They were largely contained within the research community yet provide a glimpse of the future.‘Phage’ fills the handheld’s screen with a dark gray box.‘Vapor’, which was not technically a virus but a program that appears to
Computers & Security, Vol. 20, No. 1
be something it is not, makes icons disappear LibertyCrack’ attempts to delete applications. McAfee.com considers Phage, Vapor and LibertyCrack to be “low risk” because they are not easily spread. Most viruses are passed through E-mail attachments.Very few of today’s hand-helds can handle attachments, so it is difficult to pass a virus. That makes them unpopular among virus programmers. “If you write viruses, you probably want to infect as many people as possible”, says Graham Cluley, senior technology consultant for anti-virus software firm Sophos. Technological advances will let PDAs perform more functions, including the opening of attachments.That will make them more vulnerable to infection by viruses. Cell phones are currently not powerful enough to harbor a virus, but the next generation of Web-enabled phones — which will let users download applications — will be more vulnerable.
China Passes Law to Promote Internet Security — Supposedly China has made it a crime to use the Internet to promote Taiwan’s independence, organize ‘cults’ and spread rumours to manipulate stock prices, state newspapers said recently. A resolution, passed by the Standing Committee of the National People’s Congress, also lists slander of individuals and corporations over the Internet, creating and disseminating computer viruses, breaking into national defense networks or tampering with personal E-mail accounts as criminal activities. Several articles of the resolution mirror existing laws used to imprison dissidents, ethnic separatists and members of the Falun Gong spiritual group, but apply them specifically to the Internet for the first time. Using the Internet to “incite subversion of state power”, to “overthrow the Socialist system”, to “destroy national unification”, or to “maintain contact with cult
members”, are all criminal offences, the resolution said. “Establishing pornographic websites and Web pages, or providing links to pornographic sites” are also illegal, it said. China has regarded Taiwan as a breakaway province since the 1949 civil war and has threatened to attack if the island declares independence.
Smarter Marines Personnel at Marine Corps Base Quantico,Va., will be the first in the Corps to use the Common Access Card as their standard identification. Marine personnel will begin receiving the cards in February. Each card will contain a digital photo of the cardholder on both sides and will have bar codes, a magnetic strip, and a micro-battery and integrated circuit chip encoded with information about the holder. The smart cards, which can hold up to 32K of data, will be issued to active duty personnel, some members of reserve forces, Defense Department civilian employees and eligible contract personnel. Thirteen cards will be set aside as public-key infrastructure tokens for storing information for the Dependents Enrollment Eligibility Reporting System. The cards will not contain all of a Marine’s medical, dental or service history but will serve as a pointer for access to a database containing such information.The cards can store critical data such as medical conditions, allergies or blood types. The smart cards will be issued gradually as part of the replacement procedure for old, lost or damaged ID cards. Throughout 2001, Defense sites will begin installing upgraded software for the Real-Time Automated Personnel Identification System, which runs applications for use with the smart cards. Two applications currently are being considered for the Common Access Cards, officials said. A mess hall program would allow a Marine to swipe his card rather than sign his name to login for a meal.Another application would automatically record training and administrative information, such as rifle range and physical fitness test scores.
7
Andrew Antipass, a Manhattan-based corporate security consultant, says he thinks the Internet will see some “sensational” DOS attacks in 2001. “Could it happen over the holiday weekend?” Antipass said. “Sure, because when so many business and university machines are left unattended for a few days, you always have to consider that someone will realize it’s an optimum time to muck about in systems.” The NIPC and other security experts also suggest a ‘lights out’ check to ensure that all users have logged out of the system before they leave the office. People tend to want to escape fast over the holidays, and they may leave without closing down their connections. That leaves the network open to anyone who happens to be in the vicinity, either virtually, or — more likely — people who are physically in your office. “That’s not to say office cleaning crews are actually frustrated crackers, but in some circles corporate espionage isn’t unheard of ”, Antipass added. The NIPC also advised running a full data and system backup before stopping work for the holiday weekend. And if systems will be left running unattended, they also suggest applying all current security patches as well. Antipass suggests that security supervisors should plan to start off the new millennium right by reminding users “once again” that they should “never” open any E-mailed attachments, such as documents, screen savers or pictures that have been sent to them. “I’m stressing to people that they shouldn’t open anything from anyone unless they are specifically expecting to get a document via E-mail. It’s important to tell people, and then tell them again, that nasty viruses and worms can be sent from someone you know.”…“It doesn’t mean they are out to get you, (it) just means you have some lame friends or co-workers who clicked on something they shouldn’t have.” MonKeeBiz, a self-described “freelance systems and security investigator”, said that the NIPC warning is “somewhat justified” in its warnings and fears. But he added that the “real story” behind the furor over DoS attacks is that there is a patch readily available for
6
the hole that is being exploited. “If the zombies are gathering on the front lines, then why are so many people aiding and abetting them by not applying security patches?” MonKeeBiz said. “Didn’t you folks see the Night of the Living Dead? When the zombies started lurching around and lunching on people, the first thing those people did was board up the windows and the doors. Same thing here — apply the patches and then go out and party.”
Hand-held Virii On The Way The magazine advertisement for an anti-virus computer software company shows a giant bug ready to pounce on a man using a handheld computer. The message: computer viruses aren’t just for personal computers anymore. Now, mobile devices such as handheld computers and cell phones are at risk. The threat is real, but it won’t be much of a problem for at least a year, experts say.The mobile devices are not yet powerful enough to allow viruses to thrive. “Today’s (virus warnings) are pretty much pure vendor hype”, says John Pescatore, research director for Gartner, an analyst firm. Gartner estimates that viruses will begin to affect handheld users by the end of 2001 and cell phone users by mid-2002. More than 120 million people will own Webenabled cell phones or handheld computers by 2005, according to industry research firm Yankee Group — and anti-virus vendors are preparing for the onslaught. McAfee.com began selling anti-virus programs for hand-helds in August. Symantec created a division in December to create anti-virus programs for service providers.The programs, which may be released in six months, will allow wireless-related companies to prevent viruses from being sent to users. Three viruses were discovered this fall for the popular Palm operating system, which is installed on handhelds sold by Palm, Handspring and Sony. They were largely contained within the research community yet provide a glimpse of the future.‘Phage’ fills the handheld’s screen with a dark gray box.‘Vapor’, which was not technically a virus but a program that appears to
Computers & Security, Vol. 20, No. 1
be something it is not, makes icons disappear LibertyCrack’ attempts to delete applications. McAfee.com considers Phage, Vapor and LibertyCrack to be “low risk” because they are not easily spread. Most viruses are passed through E-mail attachments.Very few of today’s hand-helds can handle attachments, so it is difficult to pass a virus. That makes them unpopular among virus programmers. “If you write viruses, you probably want to infect as many people as possible”, says Graham Cluley, senior technology consultant for anti-virus software firm Sophos. Technological advances will let PDAs perform more functions, including the opening of attachments.That will make them more vulnerable to infection by viruses. Cell phones are currently not powerful enough to harbor a virus, but the next generation of Web-enabled phones — which will let users download applications — will be more vulnerable.
China Passes Law to Promote Internet Security — Supposedly China has made it a crime to use the Internet to promote Taiwan’s independence, organize ‘cults’ and spread rumours to manipulate stock prices, state newspapers said recently. A resolution, passed by the Standing Committee of the National People’s Congress, also lists slander of individuals and corporations over the Internet, creating and disseminating computer viruses, breaking into national defense networks or tampering with personal E-mail accounts as criminal activities. Several articles of the resolution mirror existing laws used to imprison dissidents, ethnic separatists and members of the Falun Gong spiritual group, but apply them specifically to the Internet for the first time. Using the Internet to “incite subversion of state power”, to “overthrow the Socialist system”, to “destroy national unification”, or to “maintain contact with cult
members”, are all criminal offences, the resolution said. “Establishing pornographic websites and Web pages, or providing links to pornographic sites” are also illegal, it said. China has regarded Taiwan as a breakaway province since the 1949 civil war and has threatened to attack if the island declares independence.
Smarter Marines Personnel at Marine Corps Base Quantico,Va., will be the first in the Corps to use the Common Access Card as their standard identification. Marine personnel will begin receiving the cards in February. Each card will contain a digital photo of the cardholder on both sides and will have bar codes, a magnetic strip, and a micro-battery and integrated circuit chip encoded with information about the holder. The smart cards, which can hold up to 32K of data, will be issued to active duty personnel, some members of reserve forces, Defense Department civilian employees and eligible contract personnel. Thirteen cards will be set aside as public-key infrastructure tokens for storing information for the Dependents Enrollment Eligibility Reporting System. The cards will not contain all of a Marine’s medical, dental or service history but will serve as a pointer for access to a database containing such information.The cards can store critical data such as medical conditions, allergies or blood types. The smart cards will be issued gradually as part of the replacement procedure for old, lost or damaged ID cards. Throughout 2001, Defense sites will begin installing upgraded software for the Real-Time Automated Personnel Identification System, which runs applications for use with the smart cards. Two applications currently are being considered for the Common Access Cards, officials said. A mess hall program would allow a Marine to swipe his card rather than sign his name to login for a meal.Another application would automatically record training and administrative information, such as rifle range and physical fitness test scores.
7