Messagenet FreeNumber
Messagenet mette a disposizione alcuni interessantissimi servizi molti d
ei
quali gratuiti di fax via web e di telefonia Voice Over IP. La funzione
più
interessante è quella di poter ottenere un numero di telefono virtuale
Freenumber con prefisso urbano 06 oppure 02 od anche 011 come se ci
trovassimo a Milano, Roma o Torino oppure qualsiasi altra città italian
a
(quest'ultima opzione non è però del tutto free), potendo così rice
vere
direttamente sul nostro pc telefonate effettuate da interlocutori via
teleofono fisso oppure cellulare a carico naturalmente del chiamante.
Eccezionale la comodità di potere essere rintracciabili su un numero u
rbano
o nazionale magari anche trovandoci all'estero...
http://www.wintricks.it/news1/article.php?ID=3837

Cultura libera.. liberamente scaricabile!
Dove ci sta portando l'enfasi sui diritti di proprietà intellettuale. L
e
nuove tecnologie cambiano completamente le dimensioni del problema, rispe
tto
ai tempi del "diritto d'autore": non solo nel campo dell'informatica o
dell'editoria tradizionale, ma in tutto il mondo dell'entertainment, dell
o
spettacolo e in quelli, per il momento forse meno "visibili",
dell'ingegneria genetica e delle biotecnologie. Fra chi vuole proteggere
tutto (difendendo interessi acquisiti) e chi vorrebbe tutto "libero", Les
sig
ha una posizione articolata e profonda, in equilibrio fra anarchia e
controllo: difende l'idea di un creative commons, uno spazio pubblico di
libertà, ed è a favore di licenze limitate, in cui non "tutti", ma so
lo
"alcuni diritti" sono riservati. Per combattere l'estensione illimitata d
ei
diritti di proprietà, che porterebbe a una "feudalizzazione" della cult
ura.
http://www.liberliber.it/biblioteca/l/lessig/

** PLAYSTATION PORTABLE, GIA' CRACCATO IL SISTEMA ANTICOPIA **
Sony si salva (per ora) soltanto per un'astuta contromisura fisica
>> di Paolo Attivissimo
http://www.zeusnews.it/news.php?cod=4102
Also - http://punto-informatico.it/pi.asp?i=52709

PERCHE' DIRE NO AL DIGITALE TERRESTRE
di Mauro Vergari (Adiconsum) - Decoder e televisori devono garantire la
ricezione di qualsiasi radio e tv digitale. Per tutelare la liberta' di
scelta ci si opponga al DTT e si rinvii la scadenza del 2006
URL: http://punto-informatico.it/pi.asp?i=52698

SCOPERTI DUE BUCHI IN FIREFOX
Ieri sono stati divulgati i dettagli di due vulnerabilita' di Firefox, un
a
gia' parzialmente corretta e relativa al meccanismo di installazione dell
e
estensioni del celebre browser
URL: http://punto-informatico.it/pi.asp?i=52710

SQL SERVER 2000 AL QUARTO PACCO
Per il serverone di database Microsoft e' disponibile il quarto service
pack, che comprende correzioni di bug vecchi e nuovi e migliorie a molti
componenti del software. Rilasciata anche una beta pubblica di R2
URL: http://punto-informatico.it/pi.asp?i=52691

MICROSOFT TE LO DICE CON UN ADVISORY
Il big di Redmond affianca agli attuali bollettini di sicurezza mensili u
n
servizio di advisory che fornira' tempestivamente informazioni su nuove
falle e minacce
URL: http://punto-informatico.it/pi.asp?i=52692

IN PRIGIONE ALTRI MEMBRI DRINKORDIE
Molti mesi di reclusione per tre esponenti della celebre organizzazione
pirata. Tra loro un impiegato della City londinese. Secondo i PM i tre si

sentivano dei Robin Hood. BSA applaude
URL: http://punto-informatico.it/pi.asp?i=52700

Speciale computer forensics
Recovering and Examining Computer Forensic Evidence
http://www.ictlex.net/index.php?p=479

Forensic Computer Analysis: An Introduction
http://www.ictlex.net/index.php?p=478

C++ Coding Standards: Take Parameters Appropriately by Value, (Smart)
Pointer, or Reference
Choosing well among values, references, and pointers for parameters is go
od
habit that maximizes both safety and efficiency. This chapter from Herb
Sutter and Andrei Alexandrescu will help you do just that.
http://www.informit.com/articles/article.asp?p=373338

Hacking iTunes: Programming iTunes on the Windows Platform
Want to make your iTunes rock (and add a little roll, too?) Apple has giv
en
you a code base from which you can build Windows solutions that run in yo
ur
iTunes software. In his continuing series on hacking your iPod, Matthew
David gives you the skinny on developing the plugins and extensities you
need.
http://www.informit.com/articles/article.asp?p=385337

How Effective is Your Test Automation?
Do you know, for sure, absolutely, that your automated test is testing wh
at
you think it's testing? Probably not, now that we've introduced some doub
t.
Mike Kelly explains how to get from "I think it's working" to "Yes, it's
working correctly."
http://www.informit.com/articles/article.asp?p=379757

Outlook Express 6.0 vs Thunderbird 1.0
http://newsvac.newsforge.com/article.pl?sid=05/05/09/0211232&from=rss
Anonymous Reader writes "We've put together a series of side-by-side scre
en
shots of Outlook Express and Thunderbird as a visual comparison of these
basic rival e-mail clients. Excellent open source Outlook Express
alternatives are available which provide similar and additional features.

Such is the case with Mozilla's Thunderbird, which is available for Windo
ws,
Mac, and Linux users. Moving away from Outlook Express is a no-brainer, a
s
our screen shots illustrate. This is the first of a two-part e-mail clien
t
comparison. In Part 1 our comparison is based on default installations of

Outlook Express 6.0 and Thunderbird 1.0. In our upcoming Part 2 we will
compare Outlook, Evolution and Kontact."

qmail
Vendor: Bernstein, D. J.
Several vulnerabilities were reported in qmail, affecting 64-bit systems.
A
remote user can cause the SMTP service to crash.
Impact: Denial of service via network
Alert: http://securitytracker.com/alerts/2005/May/1013911.html

Squid
Vendor: Squid-cache.org
In March 2005, a vulnerability was reported in Squid in the enforcement o
f
http_access controls. A remote user may be granted unauthorized access.
Impact: Host/resource access via network
Alert: http://securitytracker.com/alerts/2005/May/1013910.html

Invision Power Board
Vendor: Invision Power Services
Some input validation vulnerabilities were reported in Invision Power Boa
rd
in 'login.php' and 'topics.php'. A remote user can inject SQL commands. A

remote user can also conduct cross-site scripting attacks.
Impact: Disclosure of authentication information
Alert: http://securitytracker.com/alerts/2005/May/1013907.html

FreeBSD Kernel
Vendor: FreeBSD
A vulnerability was reported in the FreeBSD kernel in the processing of
certain object names. A local user may be able to obtain portions of ker
nel
memory.
Impact: Disclosure of authentication information
Alert: http://securitytracker.com/alerts/2005/May/1013906.html

FreeBSD Kernel
Vendor: FreeBSD
A vulnerability was reported in FreeBSD in the i386_get_ldt(2) system cal
l.
A local user may be able to obtain portions of kernel memory.
Impact: Disclosure of authentication information
Alert: http://securitytracker.com/alerts/2005/May/1013905.html

FreeBSD Kernel
Vendor: FreeBSD
A vulnerability was reported in FreeBSD in the iir(4) driver for Intel
Integrated RAID controllers and ICP Vortex RAID controllers. A local use
r
may be able to view or delete certain data.
Impact: Denial of service via local system
Alert: http://securitytracker.com/alerts/2005/May/1013904.html

RealOne (RealPlayer)
Vendor: RealNetworks
A vulnerability was reported in RealPlayer. A remote user can cause
arbitrary code to be executed.
Impact: Execution of arbitrary code via network
Alert: http://securitytracker.com/alerts/2005/May/1013899.html

Ethereal
Vendor: Ethereal.com
A variety of vulnerabilities were reported in Ethereal, affecting more th
an
50 different dissectors. A remote user can cause Ethereal to crash, ente
r
an endless loop, or execute arbitrary code.
Impact: Denial of service via network
Alert: http://securitytracker.com/alerts/2005/May/1013889.html

Mac OS X
Vendor: Apple Computer
A vulnerability was reported in chfn, chpass, and chsh on Apple Mac OS X.
A
local user may be able to gain elevated privileges.
Impact: Execution of arbitrary code via local system
Alert: http://securitytracker.com/alerts/2005/May/1013876.html

Symantec Gateway Security
Vendor: Symantec
Several vulnerabilities were reported Symantec Gateway Security in the
TCP/IP stack. A remote user can cause denial of service conditions.
Impact: Denial of service via network
Alert: http://securitytracker.com/alerts/2005/May/1013871.html

Invision Power Board
Vendor: Invision Power Services
Arron Ward from GovernmentSecurity.org reported an input validation
vulnerability in Invision Power Board. A remote user can conduct cross-s
ite
scripting attacks.
Impact: Disclosure of authentication information
Alert: http://securitytracker.com/alerts/2005/May/1013863.html

Linux Kernel
Vendor: kernel.org
A vulnerability was reported in the Linux kernel in the it87 and via686a
drivers. A local user can cause denial of service conditions.
Impact: Denial of service via local system
Alert: http://securitytracker.com/alerts/2005/May/1013862.html

Open WebMail
Vendor: openwebmail.org
A vulnerability was reported in Open WebMail. A remote authenticated use
r
can execute arbitrary code on the target system.
Impact: Execution of arbitrary code via network
Alert: http://securitytracker.com/alerts/2005/May/1013859.html

"Webalizer, statistiche 'opensource'"
In questo articolo analizziamo webalizer, un software completamente gratu
ito
che genera dei report molto dettagliati prendendo in esame i file di log
di
Apache, Squid e Ftp server (ad esempio Wu-ftpd o Proftpd).
http://www.ziobudda.net/Admin/redir_news.php?id=22149

"PHP: guida alla programmazione (Parte II)"
Sei pagine di articolo che spiegano passo dopo passo e in maniera più c
he
chiara i principali costrutti in PHP, solo accennati nella prima lezione.

Utile per tutti coloro che vogliono avvicinarsi a questo potente linguagg
io
di programmazione.
http://www.ziobudda.net/Admin/redir_news.php?id=22143

"Slackware on Laptop"
Una serie di tutorial, tutti in italiano, che spiegano passo-passo come
installare Slackware GNU/Linux sui portatili in maniera semplice ed
efficace... Davvero molto interessanti!
http://www.ziobudda.net/Admin/redir_news.php?id=22142

"Sarge? Sid? Ramo? Debian X???"
Se volete installare la Debian vi dovrete scontrare contro i vari "rami d
i
sviluppo". Ecco una loro spiegazione.
http://www.ziobudda.net/Admin/redir_news.php?id=22139

MA DOVE SONO OGGI I PHREAKERS?
Breve viaggio di Punto Informatico tra gli alchimisti della telefonia: il

movimento piu' antico dell'underground telematico continua a mutare e ogg
i
smanetta su VoIP, Bluetooth e Wi-Fi
URL: http://punto-informatico.it/pi.asp?i=52730

UN CAMPIONATO ITALIANO DI HACKING?
Cosi' lo definiscono i promotori, descrivendo il Capture the Flag 2005 al

quale ci si potra' iscrivere a partire dal primo giugno. Ecco di cosa si
tratta
URL: http://punto-informatico.it/pi.asp?i=52724

***NomeItalia propone la registrazione anonima dei siti web***
Registrare i domini internet in forma anonima, al momento non è possibi
le: i
dati di registrazione compaiono sempre, per policy, nei database pubblici

consultabili via 'whois' o via web tramite i siti delle organizzazioni ch
e
li gestiscono. Eppure NomeItalia propone di registrare i domini in forma
anonima, a un costo particolarmente contenuto. Per farlo, il provider si
siciliano si appoggia ad Alisat per quanto riguarda le questioni collegat
e
alla privacy, si legge in una nota. Nessuna spiegazione su come questo ti
po
di servizio sia possibile..
http://www.pc-facile.com/nomeitalia_propone_registrazione_anonima_siti_we
b_n31308/

GOOGLE INACCESSIBILE PER QUALCHE MINUTO; PAURA HACKER
Per qualche minuto inaccessibile il sito piu' famoso del mondo
http://www.studiocelentano.it/newsflash_dett.asp?id=14496

The Web Security Mailing List
The Web Application Security Consortium (WASC) is proud to present 'The W
eb
Security Mailing List'. An open information forum for discussing topics
relevant to web security. Topics include, but are not limited to, industr
y
news and technical discussions surrounding web applications, proxies,
honeypots, new attack types, methodologies, application firewalls,
discoveries, experiences, web servers, application servers, database
security, tools, solutions, and others. Subscribe by sending email to:
websecurity-subscribe@webappsec.org

SECURING YOUR ENVIRONMENT: PART 2
"This month, let's will take a look at intrusion detection using SNORT,
along with its LAMP-based analysis add-on, ACID, short for 'Analysis Cons
ole
for Intrusion Databases...'"
http://nl.internet.com/ct.html?rtr=on&s=1,1lhx,1,48o0,6tpj,85jl,7pty

THINK BEFORE DEPLOYING SECURITY-ENHANCED LINUX IN RHEL 4
"One of the most exciting new features in RHEL v.4 is the implementation
of
Security-Enhanced Linux (SELinux). In this tip, we'll look at how you can

use it to beef up system security..."
http://nl.internet.com/ct.html?rtr=on&s=1,1lhx,1,f682,avf2,85jl,7pty

APACHE'S LENYA AS EASY AS 1.2.3
"The Apache Software Foundation (ASF) released version 1.2.3 of its Lenya

project after only two months of development, group leaders said today...
"
http://nl.internet.com/ct.html?rtr=on&s=1,1lht,1,l2bn,7tni,85jl,7pty

Y2038 BUG MAY HIT UNIX, LINUX MACHINES
"...[T]here is yet another bug on the horizon. It is the Year 2038 bug th
at
is slated to hit computer users in that year..."
http://nl.internet.com/ct.html?rtr=on&s=1,1lht,1,a4nm,hity,85jl,7pty

THE ADVANTAGES OF ADOPTING OPEN SOURCE SOFTWARE
"This chapter focuses on the advantages of going with an open source
solution..."
http://nl.internet.com/ct.html?rtr=on&s=1,1lht,1,bbs0,gtdx,85jl,7pty

PREVENT PRICEY WI-FI SECURITY ERRORS
An innocent-looking cafe may harbor a nest of fraudsters, identity thieve
s
and other miscreants, security experts warn.
http://www.net-security.org/news.php?id=7701

EIGHT TOP TIPS FOR NETWORK SECURITY
Protecting your network isn't about installing the right hardware and
software. It's knowing how to use it, and how to set up the right securit
y
policies and procedures. We show you how.
http://www.net-security.org/news.php?id=7709

THE SECOND COMMANDMENT OF SYSTEM ADMINISTRATION
Trust is a hard thing to come by in any workplace. Luckily for you, trust
in
your servers isn't.
http://www.net-security.org/news.php?id=7714

ENABLING INTERNET ACCESS FOR VPN CLIENTS CONNECTED TO AN ISA FIREWALL
A problematic situation with the ISA Server 2000 firewall was that once a

VPN client connected to the ISA Server 2000 firewall, they could not conn
ect
to the Internet using their default SecureNAT client configuration.
http://www.net-security.org/news.php?id=7717

HACKING A SQL SERVER
We'll outline how attackers footprint, attack, and compromise SQL Server,

followed by solutions for mitigating these threats.
http://www.net-security.org/news.php?id=7722

SECURE PROGRAMMING WITH THE OPENSSL API, PART 2
Avoid the dreaded man in the middle (MITM) attack by securing the handsha
ke
during a Secure Sockets Layer (SSL) session.
http://www.net-security.org/news.php?id=7727

The Third Commandment of system administration
http://software.newsforge.com/article.pl?sid=05/05/02/1426209&from=rs
s
Nothing will make your team look worse than getting a call from an angry
boss wondering why he couldn't get into the company email server all
weekend. Server and service monitoring provides a way to know at all time
s
which items on your network are up, which are down, what servers are
experiencing issues handling load and just about any other type of
availability information you could want. By configuring alerts and
notifications, you can be the first to know when a problem on your networ
k
arises.

PGP announces complete hard drive encryption
http://newsvac.newsforge.com/article.pl?sid=05/05/09/1835200&from=rss
PGP Corporation on Monday announced a new way for Windows users to encryp
t
their entire hard drives.

"Secure Data Manager (SDM) 2.1 Released"
Rilasciata la versione 2.1 di SDM. E' scaricabile dal sito. Nuove
funzionalità aggiunte:
- Miglirata la UI
- Gestione dei Tipi
- Migliorato il codice
- L'attributo "Other" è ora multi-colonna
- Le colonne della tabella memorizzano dimensione e posizione
http://www.ziobudda.net/Admin/redir_news.php?id=22167

"Maggiori dettagli sui bug di FireFox"
Su MozillaZine è possibile leggere un articolo che fornisce maggiori
dettagli sui due bug che affliggono FireFox.
http://www.ziobudda.net/Admin/redir_news.php?id=22158

"Avvocati: meglio un software libero che pirata"
A Foggia un seminario di studio e dimostrazione di OpenOffice.org
http://www.ziobudda.net/Admin/redir_news.php?id=22183

"Allarme per un worm che diffonde codice spyware"
E' la prima volta che viene identificato un worm contenente un programma
spyware. Il worm è anche in grado di registrare i tasti digitati
dall'utente.
http://www.ziobudda.net/Admin/redir_news.php?id=22181

RETI SOTTO ATTACCO, A COLPI DI TROJAN
Si indaga in piu' paesi attorno ad una serie di aggressioni telematiche c
he
ignoti avrebbero condotto contro numerosi network scientifici, accademici
e
governativi. Sospettato un 16enne. I dettagli
URL: http://punto-informatico.it/pi.asp?i=52745

ITUNES SPOSA IL VIDEO, TAPPA UN BUCO
Apple ha rilasciato una nuova versione di iTunes in grado di gestire i fi
le
video MPEG-4, funzionalita' gia' sfruttata dalla casa della Mela per
distribuire sul proprio negozio di musica i video di alcune canzoni
URL: http://punto-informatico.it/pi.asp?i=52735
Also - http://www.eweek.com/article2/0,1759,1814470,00.asp?kc=EWRSS0311
9TX1K0000594

APACHE: JAVA OPEN VE LO DIAMO NOI
Apache Software Foundation lancera' un progetto open source per implement
are
la piattaforma J2EE di Sun in chiave aperta. All'iniziativa potrebbe
collaborare la stessa Sun
URL: http://punto-informatico.it/pi.asp?i=52738

BREVETTI SOFTWARE, MEZZOGIORNO DI FUOCO
di A. Glorioso - Sono i giorni piu' critici per la proposta di direttiva
che
punta ad introdurre anche nella UE la brevettazione sul software. Dal
software libero una condanna unanime. La palla passa agli europarlamentar
i
URL: http://punto-informatico.it/pi.asp?i=52763

MICROSOFT FRA BOLLETTINI E ADVISORY
Corretta una falla di Windows e pubblicati i primi advisory, documenti
complementari ai bollettini che forniscono informazioni su diversi proble
mi
o tematiche di sicurezza
URL: http://punto-informatico.it/pi.asp?i=52755

IL WORM INFETTA L'AUTO? UNA BUFALA
F-Secure ha effettuato un test che dimostra come il famoso worm Cabir sia

del tutto incapace di infettare il computer di bordo di un'auto dotata di

Bluetooth. Almeno per ora
URL: http://punto-informatico.it/pi.asp?i=52758
Also - http://www.theregister.co.uk/2005/05/10/car_virus_myth_debunked/

** MENO SCHERMATE BLU NEL PROSSIMO WINDOWS. SARANNO ROSSE **
Umorismo involontario in casa Microsoft per la prossima versione di Windo
ws.
>> di Paolo Attivissimo
http://www.zeusnews.it/news.php?cod=4109

** ANTIVIRUS FALLATI, STAVOLTA INCIAMPA SYMANTEC **
Utenti Mac inferociti da un aggiornamento sbagliato dell'antivirus: la cu
ra
è peggiore della malattia. Primi sintomi virali per Mac?
>> di Paolo Attivissimo
http://www.zeusnews.it/news.php?cod=4113
Also - http://www.theregister.co.uk/2005/05/10/symantec_mac_false_alarm/

Accoona (matata) e l'innovazione nella ricerca
Ancora un nuovo motore di ricerca si presenta nell'arena - se la racconta

giusta ne vedremo delle belle e con gli occhi a mandorla.
http://www.apogeonline.com/webzine/2005/05/11/18/200505111801

Built-in Groups vs. Delegation
Summary: The administration of users, groups, computer accounts, resettin
g
passwords, and group policy objects are some of the most important tasks
that need to be done on a typical Active Directory network. When these ta
sks
are assigned, there are two options within Active Directory to provide th
is
access: Built-in groups and Delegation of Administration.
http://www.WindowSecurity.com/articles/Built-in-Groups-Delegation.html

Key Performance Monitor Counters
Summary: This article looks at key Performance Monitor counters you may w
ant
to watch to ensure your Windows Server 2003 machines are running smoothly.
http://www.WindowsNetworking.com/articles_tutorials/Key-Performance-Monit
or-Counters.html

Bruce Schneier on Cryptography
An interview with Bruce Schneier on some current trends in cryptography.
http://www.securityfocus.com/columnists/324

Web Browser Forensics, Part 2
Part 2 of this web browser forensics series looks at reconstructing Mozil
la
Firefox' cache in order to catch an internal hacker using an administrato
r's
account.
http://www.securityfocus.com/infocus/1832

Metasploit Framework 2.4 released
The Metasploit Framework is an advanced open-source exploit development
platform. The 2.4 release includes three user interfaces, 72 exploits and
75
payloads. The Framework will run on any modern operating system that has
a
working Perl interpreter. The Windows installer includes a slimmed-down
version of the Cygwin environment. This release is available from the
Metasploit.com web site:
- Unix: http://metasploit.com/tools/framework-2.4.tar.gz
- Win32: http://metasploit.com/tools/framework-2.4.exe

ADVISORIES, MAY 9, 2005
Today's security advisories: smail and xfree86 (Debian GNU/Linux); and
GnuTLS (Gentoo Linux).
http://nl.internet.com/ct.html?rtr=on&s=1,1lls,1,jnoj,aihw,85jl,7pty

ADVISORIES: MAY 10, 2005
Today's security advisories: gzip, TCPDump, libTIFF, and HT Editor (Gento
o
Linux); and squid (Trustix Secure Linux).
http://nl.internet.com/ct.html?rtr=on&s=1,1lqx,1,jl94,grb8,85jl,7pty

SECURE PROGRAMMING WITH THE OPENSSL API, PART 2: SECURE HANDSHAKE
"Securing the handshake during a Secure Sockets Layer session (SSL) is
vital, since almost all of the security involving the connection is set u
p
inside the handshake..."
http://nl.internet.com/ct.html?rtr=on&s=1,1lqx,1,3kt8,fu4t,85jl,7pty

OUTLOOK EXPRESS VS THUNDERBIRD: AN E-MAIL CLIENT COMPARISON--PART 1
"We've put together a series of side-by-side screen shots of Outlook Expr
ess
and Thunderbird as a visual comparison of these basic rival e-mail
clients..."
http://nl.internet.com/ct.html?rtr=on&s=1,1llq,1,64ou,6klr,85jl,7pty

KERNELTRAP: GIT STATUS
"In parting, [Torvalds] noted that git is feature complete for his needs,

'especially with the new diff-tree, it all pretty much does what I want,
and
I don't have any huge wish-list entries left...'"
http://nl.internet.com/ct.html?rtr=on&s=1,1llq,1,kxjf,ippt,85jl,7pty

THE RISK OF MIXING FREE AND NON-FREE
"In a world where anything (even SCO...) is possible, we have to remember

that risks are taken when free and non-free software are mixedl..."
http://nl.internet.com/ct.html?rtr=on&s=1,1llq,1,cpe9,mdd8,85jl,7pty

CLI MAGIC: SHUTDOWN
"Using shutdown is easy. You only have to learn two important things befo
re
you get your blackbelt in shutdown..."
http://nl.internet.com/ct.html?rtr=on&s=1,1llq,1,cro1,7cif,85jl,7pty

FREE AS IN "FREE SPEECH" OR FREE AS IN "FREE LABOUR"?
"Free software sustains and enables the internet. Across the world, peopl
e
continue to freely contribute ideas and expertise to an important and
growing movement..."
http://nl.internet.com/ct.html?rtr=on&s=1,1lqu,1,8xku,bvcs,85jl,7pty

Previous or Next? Paginating Records with PHP, part 3
Learn how to make the application created in previous parts work with a
relational database.
http://www.devshed.com/c/a/PHP/Previous-or-Next-Paginating-Records-with-P
HP-Part-3/

PHP and JavaScript Interaction: Storing Data in the Client, part 1
Learn how to make PHP and JavaScript interact, to meet the server-side an
d
client-side needs of modern websites.
http://www.devshed.com/c/a/PHP/PHP-and-JavaScript-Interaction-Storing-Dat
a-in-the-Client-part-1/

PHP and JavaScript Interaction: Storing Data in the Client, part 2
Learn how to develop a PHP/JavaScript news ticker.
http://www.devshed.com/c/a/PHP/PHP-and-JavaScript-Interaction-Storing-Dat
a-in-the-Client-Part-2/

Working with Text and HTML in Flash
Learn a variety of ways to manipulate text and HTML that allow you to exp
and
the capabilties of your website.
http://www.devarticles.com/c/a/Flash/Working-with-Text-and-HTML-in-Flash/

How to Steal to the Top of Google, Part 3
Learn how to build an authority website, and why you should.
http://www.seochat.com/c/a/Google-Optimization-Help/How-To-Steal-To-The-T
op-Of-Google-Part-3/

Learning a New Programming Language Part 2: Language Types
Learn about the three main types of programming languages.
http://webhosting.devshed.com/c/a/Web-Hosting-HowTos/Learning-a-New-Progr
amming-Language-Part-2-Language-Types/

MALWARE
Title: Sober worm hits new heights
Source: C-Net News
Date Written: 2005-05-09
Date Collected: 2005-05-09
Anti-virus firm Sophos says the Sober.P worm continues to spread in great
er
quantities. The worm accounted for 5.4% of all the e- mail monitored by t
he
company over the weekend of May 7, 2005, and 84% of all virus activity,
increases over May 6 when the levels were 4.65% and 77% respectively. In
comparison, the second most prevalent virus, Netsky.P, accounted for only

0.3 percent of all virus activity. Sophos said Sober.P turns off Symantec
's
antivirus protection and Microsoft's Windows XP firewall on infected
machines, allowing the virus to propogate.
http://news.com.com/Sober+worm+hits+new+heights/2100-7349_3-5700311.html

MALWARE
Title: Users untouched by mobile viruses despite hype
Source: The Register
Date Written: 2005-05-05
Date Collected: 2005-05-05
According to WDSGlobal, the threat of mobile phone viruses has been
exaggerated. WDSGlobal, which handles 100,000 specialist data support cal
ls
every month, found that less than 10 of the 275,000 calls received in the

first quarter of 2005 related to mobile phone viruses. The company handle
s
second-line support for data problems and would be the first contacted wi
th
mobile data virus issues. Spokesman Doug Overton said anti-virus vendors
are
exaggerating the threat in order to sell anti-virus software.
http://www.theregister.co.uk/2005/05/05/mobile_virus_hype_debunked/

MALWARE
Title: MyDoom variant opens backdoor IRC channel
Source: vnunet.com
Date Written: 2005-05-10
Date Collected: 2005-05-10
Security firm TrendMicro warns that a new worm, MyDoom.BQ, is spreading
throughout Europe. MyDoom.BQ, also known as Mytob.ED, is mass-mailed as a
n
attachment in an e-mail claiming the user's e-mail has been locked for
security reasons. The worm propogates once the attachment is opened, and
opens a backdoor channel to Internet Relay Chat (IRC) that allows it to t
ake
control of the PC. TrendMicro rates the malware as a medium threat.
http://www.vnunet.com/news/1162938

MALWARE
Title: Panda Software Claims Zero-Day Virus Defense
Source: NewsFactor Network
Date Written: 2005-05-04
Date Collected: 2005-05-05
Security company Panda Software announced May 4, 2005 that its new
TruPrevent 2.0 software can stop zero-day viruses. Panda is the first
anti-virus company to claim its software stops unknown attacks, and
independent testing lab ICSA says TruPrevent is over 98% effective at
eliminating malicious software and has no false positives. While other
anti-virus firms use heuristics approaches to detection, none have claime
d
that their software can catch virtually any unknown threat.
http://www.newsfactor.com/story.xhtml?story_id=34216

VULNERABILITIES & EXPLOITS
Title: Symantec Patches ICMP Denial-of-Service Flaw
Source: EWeek.com
Date Written: 2005-05-03
Date Collected: 2005-05-05
Symantec announced May 2, 2005 that users of Symantec Gateway Security
Series, the Symantec Enterprise Firewall, the Symantec Firewall/VPN
Appliance, the Nexland Firewall Appliance, and the Symantec VelociRaptor
may
be at risk of denial-of-service attacks. In an advisory, the company urge
d
users to install updates fixing an Internet Control Message Protocol (ICM
P)
flaw that has affected products from multiple vendors. The severity of th
e
vulnerability varies from medium to high, depending on the vendor and
product.
http://www.eweek.com/article2/0,1759,1811790,00.asp?kc=EWRSS03129TX1K00
00614

VULNERABILITIES & EXPLOITS
Title: High-Risk Flaw Found in VPN Security Protocol
Source: EWeek.com
Date Written: 2005-05-09
Date Collected: 2005-05-10
The UK National Infrastructure Security Co-ordination Center (NISCC) has
announced a flaw in a widely-used VPN protocol suite that could allow
attackers to intercept secure network communications. The high-risk flaw
in
Internet Protocol (IP) security affects certain configurations of IPSec t
hat
use Encapsulating Security Payload (ESP) in tunnel mode with
confidentiality, configurations with integrity protection being provided
by
a higher layer protocol, and some IPSec configurations using the key
Authentication Header (AH) protocol. NISCC said the flaw is fairly easy t
o
exploit, but noted that it does not affect the default configuration.
http://www.eweek.com/article2/0,1759,1814368,00.asp?kc=EWRSS03129TX1K00
00614

VULNERABILITIES & EXPLOITS
Title: Microsoft revamps security hole approach
Source: Techworld
Date Written: 2005-05-06
Date Collected: 2005-05-06
Microsoft has launched a new Microsoft Security Advisories service to
immediately respond to researchers who publicize unpatched vulnerabilitie
s.
The advisories will be released as soon as a flaw is made public to provi
de
customers "more prescriptive and timely guidance on security issues."
Formerly, Microsoft has only released details in its monthly patches,
responding with only short comments in the interim. The move comes as
software companies and security researchers continue to debate the proper

time to inform the public of vulnerabilities. Microsoft has criticized
researchers for making sensitive information public, while researchers cl
aim
they only go public after Microsoft fails to take action on a vulnerabili
ty.
http://www.techworld.com/security/news/index.cfm?NewsID=3612

VULNERABILITIES & EXPLOITS
Title: Firefox suffers first 'extremely critical' security hole
Source: Techworld
Date Written: 2005-05-08
Date Collected: 2005-05-09
Researchers have discovered 'extremely critical' flaws in Mozilla's Firef
ox
browser that could allow a remote attacker to take over a computer. No pa
tch
is available yet, but exploit code is already circulating in the wild. An

attacker would need to create a malicious website to exploit a Javascript

history flaw to make malicious content appear to come from a trusted site
. A
input verification flaw in the IconURL parameter would execute the malici
ous
content with the Firefox user's privileges. Users can keep there own
whitelist of trusted sites. Mozilla has modified its update sites --
whitelisted by default -- to prevent use of the IconURL flaw, but users
would still be vulnerable when communicating with other whitelisted sites
.
Users can protect themselves by disabling Javascript.
http://www.techworld.com/news/index.cfm?RSS&NewsID=3619

VULNERABILITIES & EXPLOITS
Title: Microsoft to miss 'Patch Tuesday' again
Source: ZDNet Australia
Date Written: 2005-05-06
Date Collected: 2005-05-06
Microsoft has announced that it has no patches to issue May 2005 of its
monthly patch cycle. Microsoft began issuing patches monthly in October 2
003
to make it easier for systems administrators to apply and test patches, o
nly
breaking the cycle for highly critical vulnerabilities. Microsoft also
skipped March 2005. Microsoft plans to move from a monthly patch cycle to
a
patch release every six months once it can be sure customers will be safe

between patches.
http://www.zdnet.com.au/news/security/0,2000061744,39190847,00.htm

VULNERABILITIES & EXPLOITS
Title: Dashboard Leaves Macs Vulnerable
Source: Wired News
Date Written: 2005-05-11
Date Collected: 2005-05-11
Dashboard, a new feature in Apple's latest operating system, OS X Tiger,
could expose users to attack and theft of personal information. Dashboard

allows users to keep "widgets", small programs that access the Internet f
or
information, on their desktops. Anyone can make a widget using Javascript

and HTML. Most widgets install themselves automatically, and cannot be
deleted by the user once installed. Stephen Meyers, one of the first to
publicize the danger of Dashboard, has developed Zaptastic, a widget that

opens the Safari browser and directs users to a webpage promoting an onli
ne
payment system. A more malicious version opens the webpage every time
Dashboard is booted up. Users can manually delete widgets through the
/Library/Widgets folder.
http://www.wired.com/news/mac/0,2125,67484,00.html

VULNERABILITIES & EXPLOITS
Title: eEye finds holes in RealPlayer, Windows
Source: Sydney Morning Herald
Date Written: 2005-05-11
Date Collected: 2005-05-11
eEye Digital Security has found a 'highly critical' vulnerability in
RealPlayer and several flaws in various versions of Windows. The RealPlay
er
flaw could allow a remote attacker to execute arbitrary code by tricking
a
user into opening a malicious file. The Windows flaws, found in certain
default configurations, could also allow remote code execution after mini
mal
user interaction. The flaws can be found in such softwares as Internet
Explorer and Outlook as well as the NT 4.0, Windows 2000, and Windows XP
operating systems. eEye notified Microsoft of the flaws on May 5, 2005. e
Eye
has a policy of releasing limited details of a flaw after giving software

vendors full details, and does not release full details to the public unt
il
a patch is available.
http://www.smh.com.au/news/Breaking/eEye-finds-holes-in-RealPlayer-Window
s/2005/05/11/1115585017607.html

VULNERABILITIES & EXPLOITS
Title: Security fix for Windows 2000 issued
Source: Sydney Morning Herald
Date Written: 2005-05-11
Date Collected: 2005-05-11
Microsoft has released an overnight patch for a flaw discovered by Israel
i
security firm GreyMagic in Windows 2000. The input validation flaw in the

webvw.dll Web View library could allow an attacker to execute malicious c
ode
locally with escalated privileges. Microsoft rates the flaw as 'important
'
and has released a patch for Windows 2000 Service Pack 3 and Service Pack
4.
Microsoft has not released a patch for Windows 98, Windows 98SE, and Wind
ows
ME, saying it does not offer patches for non-critical vulnerabilities on
those systems.
http://www.smh.com.au/news/Breaking/Security-fix-for-Windows-2000-issued/
2005/05/11/1115585016382.html

FreeBSD 5.4-RELEASE Announcement
http://newsvac.newsforge.com/article.pl?sid=05/05/10/2136229&from=rss
The Release Engineering Team is happy to announce the availability of
FreeBSD 5.4-RELEASE, the latest release of the FreeBSD Stable development

branch. Since FreeBSD 5.3-RELEASE in November 2004 we have made many
improvements in functionality, stability, performance, and device driver
support for some hardware, as well as dealt with known security issues an
d
made many bugfixes.

"Ulog e Iptables"
Il seguente howto spiega come utilizzare ulogd al posto del classico sysl
ogd
nella gestione dei log di iptables. Ulogd lavora in user space e può es
sere
affiancato anche a DBMS come MySQL, in modo tale da gestire i dati nella
maniera più disparata.
http://www.ziobudda.net/Admin/redir_news.php?id=22192

"Disponibile KNOPPIX 3.8.2"
Aggiornamenti: "kernel 2.6.11 update; the madwifi drivers are back;
kwifimanager in KNOPPIX/network menu; OpenOffice 1.1.4 security update;
swapping on knoppix.swp on a NTFS partition should now work; replaced Fab
ian
Franz' original knoppix-installer with the version from Jörg
Schirottke/Kanotix; fixed SCSI drivers in bootimage."
http://www.ziobudda.net/Admin/redir_news.php?id=22189

"Disponibile Firefox 1.0.4"
Fix di sicurezza e fix ad "errori" DHTML incontrati su alcuni siti web.
http://www.ziobudda.net/Admin/redir_news.php?id=22188

"Convegno E-PRIVACY 2005"
E-Privacy 2005 si terra' il 27 ed il 28 maggio a Firenze, in Palazzo
Vecchio, nella Sala Incontri. Il tema centrale di questa edizione e'
nuovamente la data retention, ma sono previsti numerosi interventi su alt
ri
aspetti attuali dell privacy. L'ospite principale di quest'edizione sara'

Nick Mathewson, il padre di due dei piu' promettenti sistemi per la priva
cy
in rete, Tor e Mixminion. Durante il convegno avverra' la consegna dei Bi
g
Brother Award Italia 2005 con la partecipazione di Privacy International.
http://www.ziobudda.net/Admin/redir_news.php?id=22216

"Commwarrior, il virus furbo!"
Commwarrior, il virus furbo, che di giorno colpisce i cellulari via
Bluetooth e di notte si propaga inviando MMS a tutta la rubrica degli ute
nti
colpiti, con addebiti stellari in bolletta!
http://www.ziobudda.net/Admin/redir_news.php?id=22207

BREVETTI, IL 17 MOBILITAZIONE NAZIONALE
Si avvicina il momento della verita': i Verdi di Cortiana organizzano una

manifestazione a sostegno della mozione del Senato contro i brevetti sul
software. La lettera di Stallman ai parlamentari italiani
URL: http://punto-informatico.it/pi.asp?i=52786

QUANDO NEL WORM CRESCE UNO SPYWARE
L'ultima variante del worm Wurmark porta in grembo un programma capace di

attaccarsi a Internet Explorer e spiare le abitudini dell'utente per fini

commerciali. Sui cellulari Symbian OS continua invece a diffondersi
Commwarrior
URL: http://punto-informatico.it/pi.asp?i=52778

SPOPOLA LA RE'CLAME DI FIREFOX
Negli scorsi giorni, un po' in sordina, la filiale europea di Mozilla
Foundation ha lanciato una campagna pubblicitaria on-line per promuovere
l'uso di Firefox. In pochi giorni ha gia' totalizzato decine di migliaia
di
visite
URL: http://punto-informatico.it/pi.asp?i=52779

** RICHARD STALLMAN SCRIVE AL PARLAMENTO ITALIANO **
Chiede di schierarsi contro i brevetti del software.
http://www.zeusnews.it/news.php?cod=4120

Diffusione dell'informativa ai sensi del nuovo codice privacy
Uno dei capisaldi del Codice in materia di protezione dei dati personali
(legge sulla privacy) e` l' Informativa che, regolamentata dall'articolo
13
del Codice, obbliga chiunque tratti dati personali a informare in modo
chiaro ed esaustivo gli interessati in merito ai motivi del trattamento
(finalita` e scopi), ai criteri di elaborazione dei dati (sia manuali ch
e
informatizzati) all'obbligo o meno a fornire le informazioni, alla durata

dei trattamenti e a dove rivolgersi per esercitare i diritti di controllo

sanciti dall'art.7 del Codice stesso.
http://www.siforge.org/articles/2005/05/13-diffusione_informativa.html

Introduction to Wireless Networking Part 3 - Security, General Tips and T
ricks
Author: Andrew Z. Tabona
Summary: Welcome to part three of what was originally meant to be a two p
art
series on 'An Introduction to Wireless Networking'. We'll take a closer l
ook
at the types of security that wireless networking offers, I'll give you s
ome
general tips and tricks and update you on some of the latest news and
statistics.
http://www.WindowsNetworking.com/articles_tutorials/Introduction-Wireless
-Networking-Part3.html

Security Series: Final countdown tips for Disaster Recovery and Business
Continuity (Part 6 of 6)
Author: Ricky M. Magalhaes
Summary: This article completes the DR BC series and we have covered many

aspects that need to be taken into consideration when designing both a
Disaster recovery and business continuity plan. WE covered documentation
and
the need for change control and skilled people for managing the process.
We
also cover some steps that can be taken now by the organization to mitiga
te
the risk and reduce the loss of valuable data.
Link:
http://www.WindowSecurity.com/articles/Disaster-Recovery-Tactics-Part6.ht
ml

Astalavista Security Newsletter
Issue 16 of Astalavista Security Newsletter can be found at the following

URLs :
http://www.astalavista.com/media/newsletter/issue_16_2005.pdf
http://www.astalavista.com/media/newsletter/issue_16_2005.txt

Microsoft Anti-Virus?
Microsoft's announcement that it will enter the AV market next year, with

initial trials starting next week, could be a sign of many things to come.
http://www.securityfocus.com/columnists/325

Foundstone CookieDigger
CookieDigger, designed by Foundstone, is a free tool to help identify wea
k
cookie generation and usage by web applications. The tool works by
collecting and analyzing cookies issued by a web application for multiple

users.
The tools functionality can be divided into 3 broad categories.
1. Cookie Collection
2. Cookie Analyses
3. Results
Download Binaries -
http://www.foundstone.com/resources/termsofuse.htm?file=cookiedigger.zi
p
Download User Guide -
http://www.foundstone.com/resources/downloads/Foundstone_CookieDigger_Whi
tepaper.pdf

ADVISORIES: MAY 11, 2005
Today's security advisories: gaim (Fedora Core); openmotif, tcpdump (2),
and
gaim (2) (Red Hat Linux); and ethereal (Mandriva Linux).
http://nl.internet.com/ct.html?rtr=on&s=1,1luz,1,m7ik,34k6,85jl,7pty

ADVISORIES: MAY 12, 2005
Today's security advisories: Gaim (Gentoo Linux); gnutls, kdelibs, gaim,
and
tcpdump (Mandriva Linux); and mozilla-firefox, mozilla, and gaim (Ubuntu
Linux).
http://nl.internet.com/ct.html?rtr=on&s=1,1lyx,1,171z,2ajn,85jl,7pty

FREEDOM IS NOT FREE
"Professor Lessig's general premise was that whether you share the
perception (sound familiar?), we are currently in a war..."
http://nl.internet.com/ct.html?rtr=on&s=1,1lv1,1,7vpq,cdkn,85jl,7pty

THE DAEMON, THE GNU AND THE PENGUIN, CH. 8
"Richard M. Stallman, though a freshman at Harvard, began working for Rus
s
Noftsker at the MIT Artificial Intelligence Lab in 1971..."
http://nl.internet.com/ct.html?rtr=on&s=1,1lyv,1,db4p,gzve,85jl,7pty

A LAPTOP, A COFFEE, AND DISASTER RECOVERY
"Last week, my laptop died a sudden spectacular death-by-drowning, as a f
ull
cup of coffee poured into its keyboard. It emitted a pop sound, and the
screen and the power shut off..."
http://nl.internet.com/ct.html?rtr=on&s=1,1lyv,1,be4z,cl6o,85jl,7pty

KERNELTRAP: CLEANING UP PER THE KERNEL CODING STYLE
"Jesper Juhl submitted a small patch to bring the kernel/module.c source
file closer in line with the kernel's CodingStyle document..."
http://nl.internet.com/ct.html?rtr=on&s=1,1lyv,1,5b5d,1msp,85jl,7pty

MALWARE
Title: VXers make a monkey out of gullible surfers
Source: The Register
Date Written: 2005-05-11
Date Collected: 2005-05-12
Virus writers are using pictures of a famous albino gorilla, Snowflake, t
o
lure victims into downloading malware. The mass-mailed Wurmark-K worm
spreads through an attachment which displays a picture of Snowflake while

infecting computers with the Rbot-ABK network worm and a backdoor Trojan
program. Sophos senior technology consultant Graham Cluley says the pictu
re
is used to make people believe the e-mail was a harmless joke.
http://www.theregister.co.uk/2005/05/11/albino_gorilla_worm/

MALWARE
Title: Symbian success feeds mobile malware explosion
Source: ZDNet Australia
Date Written: 2005-05-12
Date Collected: 2005-05-13
A number of security experts forecast that an increase in the use of the
Symbian operating system for mobile phones will lead to a sudden jump in
the
number of mobile viruses. Symbian reports that its operating system
shipments have grown by 200% over the past year. Many researchers believe

that virus writers have been avoiding mobile phones since a wide variety
of
operating systems prevents viruses from spreading far. However, viruses m
ay
have less difficulty spreading as the market settles on one operating
system. Sophos' Dr. Jan Hruska says his company is developing antivirus
software for mobile phones in anticipation of such threats. F-Secure's Mi
kko
Hyppönen expresses surprise that Symbian become the standard target for

authors of mobile viruses since he expected virus writers to transfer the
ir
Windows code to Pocket PC. However, source code for the Cabir worm, which

targets Symbian, gave virus writers a launch pad for mobile viruses. Symb
ian
has announced growth of nearly 180% over the last year and license
agreements with Microsoft to improve interoperability with Exchange and
Outlook.
http://www.zdnet.com.au/news/security/0,2000061744,39191477,00.htm

VULNERABILITIES & EXPLOITS
Title: New Firefox, Mozilla Versions Fix Open Browser Holes
Source: EWeek.com
Date Written: 2005-05-12
Date Collected: 2005-05-12
Mozilla has released new versions of its Firefox and Mozilla browsers,
addressing serious security vulnerabilities. The first bug allowed an
attacker to execute arbitrary code using a javascript URL as the IconURL
property. The other vulnerabilities allowed an attacker to bypass securit
y
checks related to javascript URLs. The updates are complete new versions,

rather than security fixes, and users are advised to upgrade immediately.
http://www.eweek.com/article2/0,1759,1815205,00.asp?kc=EWRSS03129TX1K00
00614

VULNERABILITIES & EXPLOITS
Title: RSA patches Web authentication tool
Source: CNet
Date Written: 2005-05-12
Date Collected: 2005-05-12
Security company RSA has released a patch for a security flaw in its Web
authentication software. Customers are advised to update the software for

its Authentication Agent for Web for Internet Information Service, to
protect against a vulnerability that could allow arbitrary code execution
.
Security firm Secunia says the flaw involves a boundary error that can be

exploited to cause a buffer overflow.
http://news.com.com/RSA+patches+Web+authentication+tool/2110-7355_3-57050
43.html?part=rss&tag=5705043&subj=news

VULNERABILITIES & EXPLOITS
Title: I know what you downloaded from Freenet
Source: The Register
Date Written: 2005-05-13
Date Collected: 2005-05-13
The Freenet Project has worked since 2000 to develop a peer-to-peer (P2P)

file sharing software that would make it impossible to censor material,
using encryption to prevent outsiders from tracking who sends what data t
o
whom or from identifying the author of any content. Every Freenet
participant hosts encrypted data for both themselves and other participan
ts.
This allows a host to repudiate possession of illegal materials, since th
e
data is encrypted and requested data cannot be distinguished from data ot
her
participants cached on a host. However, this system can fail for larger
files. A host who takes hours to download a large file can delete that fi
le
and download it again almost instantly, since Freenet remembers that
encrypted chunks of the file are locally cached. The short download time
would allow an investigator to determine whether a host requested certain

files or is merely holding them for others. The Freenet Project plans to
fix
this behavior in its next release.
http://www.theregister.co.uk/2005/05/13/freener_not_so_anonymous/

TECHNOLOGY
Title: Google puts the brake on Web Accelerator
Source: The Register
Date Written: 2005-05-13
Date Collected: 2005-05-13
Google has disabled downloads of its Web Accelerator software following
reports that it cached people's personal data, such as website logins, an
d
made them available to other people. Google took the download site down
after six days, saying it had reached it maximum user capacity and that t
he
site would return once Google had increased the number of users it could
support. Google Web Accelerator speeds up web browsing by caching content

frequently accessed by its users. However, some users report being logged
in
to websites as other users after downloading the software.
http://www.theregister.co.uk/2005/05/13/google_accelerator_suspended/

Turn the LAMP on to Linux-Apache-MySQL-PHP technology
http://newsvac.newsforge.com/article.pl?sid=05/05/13/1819210&from=rss
Anonymous Reader writes "This tutorial explores the Linux-Apache-MySQL-PH
P,
or LAMP, Web development framework and shows how that framework can help
you
build applications to solve common business problems. The tutorial begins

with an exploration of the LAMP architecture, then introduces fundamental

PHP concepts. After a solid grounding of PHP, the tutorial explains MySQL

support, with coverage focusing on database concepts and how to access My
SQL
from PHP."

g00d reading! 'n' bye
Security News MainTainer:

The Jackal a.k.a. jAcKallO < jackal [at] capitanlug.it >

(AreaSessantuno Inside) / (SpiPPolatori Collaborator)
(HackerAlliance Member) / (Socio fondatore del CapitanLUG.iT)
(Daily DisInfo CreaTor & MainTainer) / (Security News MainTainer)