"Debian oltre l'uso desktop"
Notizia citata da OSNews.com: esiste un tutorial, illustrato e ben organizzato, sul come utilizzare software completamente Open Source per configurare un firewall personale (servendosi di vecchio computer, wow!) nello stile e nel gusto Debian.
http://www.ziobudda.net/Admin/redir_news.php?id=24319

BREVETTI, L'OMBRA DI EOLAS SULLA RETE
Il brevetto temuto da Microsoft e Tim Berners-Lee torna al centro dopoche' l'Ufficio brevetti statunitense ne ha dichiarato la validita'. Ora si riapre la caccia al browser e ai sesterzi
URL: http://punto-informatico.it/pi.asp?i=55309

XP SERVICE PACK, NON C'E' DUE SENZA TRE
Un dirigente europeo di Microsoft ha confermato che il Service Pack 3 per Windows XP arrivera' dopo il rilascio di Windows Vista. Inoltre Office 12 supportera' il formato PDF
URL: http://punto-informatico.it/pi.asp?i=55284

TROJAN APPROFITTA DI UN BUCO DI OFFICE
Un nuovo cavallo di Troia e' in grado di sfruttare un bug per compromettere un PC e porlo alla merce' di un cracker. Per il momento, tuttavia, il pericolo sembra limitato
URL: http://punto-informatico.it/pi.asp?i=55303

NEGLI USA LA PRIMA LEGGE ANTI-PHISHING
La scorsa settimana il Senato della California ha promulgato una nuova legge che permettera' di perseguire i phisher; le sanzioni possono arrivare fino a 500mila dollari per reato
URL: http://punto-informatico.it/pi.asp?i=55298

Italian Linux Documentation Project: nuovi how-to.
Ecco gli ultimi documenti pubblicati dall'Italian Linux Documentation Project, progetto che si propone di fornire documentazione su GNU/Linux e Software Libero in lingua italiana, in particolare traducendo documenti provenienti da TLDP (http://tldp.org/).
* HOWTO e mini-HOWTO:
Accessibility Dev HOWTO (How to Develop Accessible Linux Applications) http://it.tldp.org/HOWTO/Accessibility-Dev-HOWTO/index.html
ADSL Bandwidth Management HOWTO
http://it.tldp.org/HOWTO/ADSL-Bandwidth-Management-HOWTO/index.html
Apache Overview HOWTO
http://it.tldp.org/HOWTO/Apache-Overview-HOWTO.html
Battery Powered Linux mini-HOWTO
http://it.tldp.org/HOWTO/Battery-Powered/index.html
C++ dlopen mini HOWTO
http://it.tldp.org/HOWTO/C++-dlopen/index.html
CDServer-HOWTO
http://it.tldp.org/HOWTO/CDServer-HOWTO/index.html
Debian Binary Package Building HOWTO
http://it.tldp.org/HOWTO/Debian-Binary-Package-Building-HOWTO/index.html
Installfest HOWTO
http://it.tldp.org/HOWTO/Installfest-HOWTO/index.html
I/O Port Programming mini-HOWTO
http://it.tldp.org/HOWTO/IO-Port-Programming.html
RTLinux HOWTO
http://it.tldp.org/HOWTO/RTLinux-HOWTO.html
Speech Recognition HOWTO
http://it.tldp.org/HOWTO/Speech-Recognition-HOWTO/index.html
TrueType Fonts with XFree86 4.0.x mini-HOWTO http://it.tldp.org/HOWTO/TT-XFree86.html
Wireless Sync HOWTO
http://it.tldp.org/HOWTO/Wireless-Sync-HOWTO/index.html
XFree86 Second Mouse mini-HOWTO
http://it.tldp.org/HOWTO/XFree86-Second-Mouse/index.html
XFree86 Video Timings HOWTO
http://it.tldp.org/HOWTO/XFree86-Video-Timings-HOWTO/index.html

BFi14-dev-02: netsukuku
title: netsukuku
author: AlpT <alpt@freaknet.org>
rel-date: 29/09/2005
url: http://bfi.s0ftpj.org/dev/BFi14-dev-02.tar.gz
lang: it

AbiWord
Vendor: AbiSource
A vulnerability was reported in AbiWord. A remote user may be able to cause arbitrary code to be executed on the target user's system.
Impact: Execution of arbitrary code via network
Alert: http://securitytracker.com/alerts/2005/Sep/1014982.html

RealOne (RealPlayer)
Vendor: RealNetworks
A vulnerability was reported in RealPlayer for Linux/UNIX. A remote user can cause arbitrary code to be executed on the target user's system.
Impact: Execution of arbitrary code via network
Alert: http://securitytracker.com/alerts/2005/Sep/1014974.html

Nokia Phone
Vendor: Nokia
A vulnerability was reported in the Nokia 7610 and 3210 phones. A remote user can cause denial of service conditions.
Impact: Denial of service via network
Alert: http://securitytracker.com/alerts/2005/Sep/1014973.html

Palladium all'assalto dei telefonini
Il consorzio Trusted Computing Group progetta il telefonino della prossima generazione. Ecco come sarà.
http://www.zeusnews.it/index.php3?ar=stampa&cod=4355

"Spamlearn: Addestrare spamassasin con lo spam di spamarchive"
Script automatico che permette di addestrare spamassassin direttamente dall'archivio di spamarchive.org, tutto in puro debian-style.
http://www.ziobudda.net/Admin/redir_news.php?id=24338

"Installando Debian"
Le linee guida definitive per installare Debian senza problemi, tutti i suggerimenti per ottimizare l'ultima versione, la 3.1 Sarge. Debian infatti è considerata la più usabile ma la meno semplice da installare...
http://www.ziobudda.net/Admin/redir_news.php?id=24327

"Trasformare gli URL dinamici in indirizzi statici"
Con Apache è possibile attraverso il mod_rewrite e le Regular Expressions fare in modo di trasformare gli indirizzi URL di pagine dinamiche in indirizzi del tutto statitici (con estensione .html), a tutto beneficio dei motori di ricerca
http://www.ziobudda.net/Admin/redir_news.php?id=24321

"Installare programmi in un Klik"
Un software innovativo permette di eseguire programmi su Gnu/Linux senza installazione. Klik permette l'esecuzione di software anche molto complessi senza avere privilegi di root sul sistema e senza alterare minimamente la propria distribuzione con l'aggiunta di librerie o binari inutili. La filosofia alla base di Klik è: si scarica il software e lo si utilizza... subito.
http://www.ziobudda.net/Admin/redir_news.php?id=24347

"Linux 2.6.13.3"
Nuona mini-release del kernel 2.6. Poche le novità ed i bug-fix
http://www.ziobudda.net/Admin/redir_news.php?id=24344

BREVETTI, AMD CAPITOLA DAVANTI AD ACACIA Il chipmaker sceglie di pagare e chiudere subito la questione con Acacia, che le aveva mosso causa la scorsa primavera. AMD costretta a chiedere (e pagare) le licenze su certe tecnologie-chiave
URL: http://punto-informatico.it/pi.asp?i=55329

IL WORMINO CHE SGOOGLA YAHOO
PremiumSearch cattura l'attenzione: se infettati, la ricerca online viene spostata su siti imitazione di Google, Yahoo! e MSN. Per soldi
URL: http://punto-informatico.it/pi.asp?i=55326

L'ITALIA VERSO UN WI-FI PIU' LIBERO
Pur con enorme ritardo, e' stato presentato il decreto che rendera' possibile coprire il paese in banda larga wireless. Piu' scelte per i consumatori. Per una volta applaudono tutti. L'analisi di Lidis.it
URL: http://punto-informatico.it/pi.asp?i=55349

KASPERSKY, DALLA RUSSIA CON BUG
Il celebre antivirus russo soffre di un grave problema di sicurezza che potrebbe esporre gli utenti ad aggressioni esterne. Problemi, pur meno gravi, anche nell'antivirus BitDefender e nel firewall ZoneAlarm
URL: http://punto-informatico.it/pi.asp?i=55345

WIKIPEDIA SUPERA L'ESAME BOICOTTAGGIO
L'enciclopedia libera e' affidabile? Funziona? Un noto giornalista statunitense mette alla prova le dinamiche della cosiddetta intelligenza collettiva. Risultati eccellenti
URL: http://punto-informatico.it/pi.asp?i=55343

Can writing software be a crime?
A recent case shows the government attempting to prosecute the developer of a key logger software that can be used for both lawful and unlawful purposes.
http://www.securityfocus.com/columnists/360

Using FreeBSD's ACLs
The standard Unix permissions scheme works fine if you have simple needs, but juggling groups and users can grow unwieldy very quickly. FreeBSD's Access Control Lists give you more control over who can access files and directories. Dru Lavigne explains how to enable, understand, and use them appropriately.
http://www.onlamp.com/pub/a/bsd/2005/09/22/FreeBSD_Basics.html

Understanding the HTTP Protocol (Part 2)
Author: Don Parker
Summary: In part one of this article series, we covered the HTTP traffic metrics that come from a web browser client. This second part will cover what the web server itself will send, and expand a little more on HTTP itself.
Link: http://www.WindowsNetworking.com/articles_tutorials/Understanding-HTTP-Protocol-Part2.html

Review of Security Planning Guides from Microsoft
Author: Mitch Tulloch
Summary: This article reviews the recommendations of several recently released security planning guides from Microsoft that deal with securing administrator accounts and implementing smart card authentication in enterprise environments.
Link: http://www.WindowSecurity.com/articles/Review-Security-Planning-Guides-Microsoft.html

ADVISORIES: OCTOBER 3, 2005
Today's security advisories: mysql-dfsg-4.1, prozilla, cfengine, cfengine2, and mozilla-firefox (Debian GNU/Linux); and kernel (Mandriva Linux).
http://nl.internet.com/ct.html?rtr=on&s=1,1xop,1,5zit,et0p,85jl,7pty

CRACKERS DEFACE COMMUNITY SITES
Three Novell community Web sites and the community advocacy site SpreadFirefox.com were all defaced recently. Articles within.
http://nl.internet.com/ct.html?rtr=on&s=1,1xop,1,b5kt,l51d,85jl,7pty

NTT RELEASES 'NILFS' LINUX FILE SYSTEM FOR PREVENTION OF DATA LOSS "NTT has released NILFS (New Implementation of a Log-structured File System), a new file system for the Linux operating system..."
http://nl.internet.com/ct.html?rtr=on&s=1,1xk6,1,mgji,1yuw,85jl,7pty

CLI MAGIC: LOGROTATE
"This week's CLI Magic comes from Mayank Sharma. While some might think that Logrotate is strictly a tool for system administrators, Mayank disagrees..."
http://nl.internet.com/ct.html?rtr=on&s=1,1xor,1,e5g9,8kfn,85jl,7pty

MINI-HOWTO: DISK BLASTING 101 WITH LINUX "There are times when you really, really want to make sure that there's not one shred of readable data left on your drives. For those times, you need a blast furnace..."
http://nl.internet.com/ct.html?rtr=on&s=1,1xor,1,7pxb,b6s0,85jl,7pty

SEARCHING FOR ONLINE SECURITY
GeoTrust launches a search engine to help consumer identify credit card scams on the web.
http://www.net-security.org/news.php?id=8926

WINDOWS SECURITY UPDATE FOR DIRECTX 8
Microsoft has reported two buffer overflow problems in DirectX and announced that the update that resolves them is available.
http://www.net-security.org/news.php?id=8936

RULE SET BASED ACCESS CONTROL 1.2.5 AVAILABLE RSBAC is a flexible, powerful and fast open source access control framework for current Linux kernels.
http://www.net-security.org/news.php?id=8956

PHISHING FILTER TO BE AVAILABLE IN INTERNET EXPLORER 7 One of the program managers in the Microsoft Internet Explorer Security Team posted some news on a feature called Phishing Filter that will be available in Internet Explorer 7.
http://www.net-security.org/article.php?id=833

SPAM PROOF YOUR OUTLOOK E-MAIL APPLICATION WITH SPAMBULLY SpamBully 3 for Outlook and Outlook Express is an easy to use spam filter that uses artificial intelligence to quickly learn what is and isn't spam based on each user's unique personal email habits.
http://www.net-security.org/article.php?id=832

Which Routing Protocol Should My Network Use?
One of the toughest questions facing network engineers is which routing protocol to use. Each has its strengths, and each works better with some network designs than with others. This chapter will help you decide which routing protocol is best for your particular network.
http://www.informit.com/articles/article.asp?p=417092

Universal Group Membership Caching: Lessons Learned the Hard Way Kurt Hudson did a bit of experimenting with the Universal Group Membership Caching feature of Windows Server 2003 Active Directory. He found some surprises (including results that seem to contradict statements he found in Microsoft TechNet documentation), and shares them in this article.
http://www.informit.com/articles/article.asp?p=415792

MALWARE
Title: Backdoor Trojan targets Microsoft Access
Source: The Register
Date Written: 2005-10-03
Date Collected: 2005-10-03
An unpatched buffer overflow flaw in Microsoft Office allows the Hesive Trojan, potentially disguised as a Microsoft Access file, to take over Windows PCs. Although rare, this example demonstrates how hackers are employing methods more commonly used in targeted hacking attacks for malware creation.
http://www.theregister.co.uk/2005/10/03/access_trojan/

TECHNOLOGY
Title: Explorer 7.0 to get new identity security
Source: Techworld
Date Written: 2005-09-30
Date Collected: 2005-10-03
Microsoft may include Infocard, a browser-based user authentication technology, in version 7.0 of its Internet Explorer browser, set to be released in 2006. The Infocard server is being designed to track a user name and password as the user moves between websites, avoiding the need to log in repeatedly. Microsoft’s Passport currently functions in a similar way, but Infocard will be compatible with other software and browsers. Some speculate that Microsoft is focusing attention on internet security as an attempt to regain browser market share.
http://www.techworld.com/security/news/index.cfm?RSS&NewsID=4495

BEST PRACTICES & RISK MANAGEMENT
Title: 10 ways to wireless security
Source: ZDNet UK
Date Written: 2005-09-30
Date Collected: 2005-10-03
Advice to keep your wireless network safe from attack and interception include: using strong encryption, Changing the default administrative password, turning off Service Set Identifier (SSID) broadcasting as well as changing the default SSID, using media access control (MAC) address filtering, isolating the wireless network from the rest of the LAN, and transmitting on frequency 802.11a rather than the more commonly used 802.11b/g.
http://insight.zdnet.co.uk/communications/wireless/0,39020430,39223889,00.htm

Open source software -- Managing the legal risks http://newsvac.newsforge.com/article.pl?sid=05/10/03/1631228&from=rss
It's a common practice for programmers to find readily available source code on the Internet that can be downloaded and incorporated into the software they are developing. Using open source software (OSS) in this manner can be very efficient. Unfortunately, there are many misconceptions about OSS, and the legal ramifications that can arise are not so simple.

"Imparare l'hacking con l'e-learning"
Learn Security Online organizza corsi a distanza per imparare a sferrare attacchi a server insicuri.
http://www.ziobudda.net/Admin/redir_news.php?id=24358

LA PIU' IMPONENTE LOBBY CONTRO LA PIRATERIA I CEO di molte delle piu' grandi imprese del mondo hi-tech, e non solo, confluiscono in un nuovo organismo proposto dalla Camera di Commercio Internazionale per dar vita ad un'alleanza globale che difenda la proprieta' intellettuale
URL: http://punto-informatico.it/pi.asp?i=55373

IL DVD DI MICROSOFT? MONOUSO
Il gigante del software tenta di penetrare nel ricco mercato dell'home video con un DVD che puo' essere riprodotto una sola volta. Microsoft spera di rivoluzionare il settore del videonoleggio, ma prima dovra' convincere l'industria
URL: http://punto-informatico.it/pi.asp?i=55378

BUCO NEL MOTORE ANTIVIRUS DI SYMANTEC
Com'e' capitato di recente a diversi suoi illustri colleghi anche Symantec e' inciampata su una vulnerabilita' di sicurezza che affligge il motore antivirus integrato in molto suoi prodotti. Disponibile la patch
URL: http://punto-informatico.it/pi.asp?i=55389

Nasce LinuxInItalia
LinuxInItalia è un progetto che si occupa di pubblicare news, interviste, annunci, sondaggi e commenti riguardo il panorama GNU/Linux, specialmente quello italiano. A nostro avviso, in Italia, vi sono una grande quantità di progetti attivi ed interessanti che però per svariati motivi non riescono ad essere conosciuti e supportati appieno dalla comunità. A questo proposito, il nostro progetto sta riscuotendo un buon successo coronando 30000 letture e l'adesione al progetto unitario Spaghettilinux.org ( www.spaghettilinux.org ) che ci riconosce la giusta serietà.
http://linuxinitalia.spaghettilinux.org

Reducing browser privileges
This article shows the simple approach of reducing privileges for Internet-facing applications on such as IE, Firefox, IM and email clients when the user must operate as a Windows administrator.
http://www.securityfocus.com/infocus/1848

Standardization and the security appliance
Author: Don Parker
Summary: There is a dizzying array of appliances out there today, which will address almost every security concern. Problem is that the vendors are all touting that they can accomplish this performance benchmark or task for you. There would be little point in a vendor making outright falsifications about their wares, but it would surely be nice to have them ascertained to a certain degree by an independent source.
Link: http://www.WindowSecurity.com/articles/Standardization-security-appliance.html

Working With Application Pools in Internet Information Server
Author: Brien M. Posey
Summary: If your IIS Server hosts multiple Web sites, then buggy code within any one of those sites can bring down the other sites. I should know; it happened to me. Fortunately, there is something that you can do to prevent this from happening. In this article, I will show you how you can use application pools to prevent problems with a Web site from causing stability problems across your IIS server.
Link: http://www.WindowsNetworking.com/articles_tutorials/Working-Application-Pools-Internet-Information-Server.html

Buffer Underruns, DEP, ASLR and Improving the Exploitation Prevention Mechanisms (XPMs) on the Windows Platform This paper deals with buffer _underruns_ , DEP and Address Space Layout Randomization on Windows. During the paper's review process I was pointed to http://www.phrack.org/show.php?p=58 which deals with the same conceptual issues to defeat PaX on Linux but, as my paper was completed, I thought I may as well still go ahead and release it. Besides mine discusses buffer underruns, too http://www.ngssoftware.com/papers/xpms.pdf

Data-Mining With SQL Injection and Inference This paper talks about using inference as a means of drilling for data with SQL injection and it is based upon a talk I presented at Blackhat Europe earlier on in the year. I divide SQL injection data theft attacks into three classes - inband, out-of-band and inference. The first, in-band, uses the existing connection to get data out; the second, out-of-band, uses another channel, e.g. smtp by using builtin database mail functions; and lastly inference. With inference there is no actual transfer of data - rather it can be inferred what the data is by making observations about differences in the way an application behaves.
http://www.ngssoftware.com/papers/sqlinference.pdf

OPEN SOURCE GOES ON RAID
"With the release of three new RAID storage subsystems built entirely on an open source platform, Open Source Storage continues its march to offer a full line of open source storage products..."
http://nl.internet.com/ct.html?rtr=on&s=1,1xsh,1,13yo,rkq,85jl,7pty

WHY OPENDOCUMENT WON (AND MICROSOFT OFFICE OPEN XML DIDN’T) "Most people, a few years ago, expected that whatever XML format Microsoft created would win. Yet Microsoft appears to have lost the war, due to its own poor decisions..."
http://nl.internet.com/ct.html?rtr=on&s=1,1xsh,1,bpu,3bo5,85jl,7pty

FLOCK: A NEW SORT OF BROWSER
"This piece of software is based on Mozilla's Gecko rendering engine, which is also the foundation for Firefox, but it takes browsing deep into the realm of social networking. The target user: bloggers..."
http://nl.internet.com/ct.html?rtr=on&s=1,1xsh,1,cr4w,dq5z,85jl,7pty

IRC on a Higher Level
This article, the first of three parts about the Python-IRCLib, takes a look at this library and what you can do with it.
http://www.devshed.com/c/a/Python/IRC-on-a-Higher-Level/

Open Source and Proprientary Approaches To Bugs and Quality Take a look into the differences between open source and commercial troubleshooting.
http://www.devshed.com/c/a/BrainDump/Open-Source-and-Proprientary-Approaches-To-Bugs-and-Quality/

Installing and Configuring Apache 2 on a Windows XP Machine Set up and configure Apache 2 on a Windows XP PC to give you a development environment that will allow you to test your PHP.
http://www.devshed.com/c/a/Apache/Installing-and-Configuring-Apache-2-on-a-Windows-XP-Machine/

Temporary Variables: Temporaries Are Not Necessarily Evil Returning objects by value is not necessarily evil, as Jun Nakamura explains.
http://www.devarticles.com/c/a/Cplusplus/Temporary-Variables-Temporaries-Are-Not-Necessarily-Evil/

Hiding Your Sensitive Data From Google and the World You used to need to be a hacker in order to get private information, while now Google serves it right on your desktop.
http://www.seochat.com/c/a/Google-Optimization-Help/Hiding-Your-Sensitive-Data-From-Google-and-the-World/

Microsoft FAT Patents Get Thumbs Down
http://newsvac.newsforge.com/article.pl?sid=05/10/05/1848203&from=rss
The USPTO has rejected two key patent applications around FAT, but Microsoft still believes it has a good chance of triumphing. Open-source vendors are holding their breath.

A totally mobile and secure email client http://newsvac.newsforge.com/article.pl?sid=05/10/05/1833234&from=rss
Shane Coughlan writes "You have 8,000 emails, 400 contacts, and your laptop battery is dead. Wouldn't it be great if everything could just work off your iPod Shuffle? Imagine an email client that goes everywhere that you do.

Microsoft: No Office on Linux 'at this time'
http://newsvac.newsforge.com/article.pl?sid=05/10/05/1830235&from=rss
Microsoft may have opted to port Office to the Mac but it has no plans to do the same for Linux even if the open source OS overtakes the Apple platform.

"Mandriva 2006 is out"
Pare che siano disponibili le ISO, solo per i membri del club Mandriva
http://www.ziobudda.net/Admin/redir_news.php?id=24395
Also - http://nl.internet.com/ct.html?rtr=on&s=1,1xyr,1,cj01,fzdn,85jl,7pty
Also - http://newsvac.newsforge.com/article.pl?sid=05/10/07/1719235&from=rss

"Nessus chiude il sorgente"
Nessus, forse il più famoso tool di sicurezza open sorce, dalla prossima release, la 3.0, abbandonerè la licenza GPL.
http://www.ziobudda.net/Admin/redir_news.php?id=24386
Also - http://nl.internet.com/ct.html?rtr=on&s=1,1xvx,1,9j88,i0wa,85jl,7pty
Also - http://software.newsforge.com/article.pl?sid=05/10/06/1716257&from=rss

"Mozilla Firefox e Thunderbird 1.5 beta 2 RC2"
Nuove release candidates per Mozilla Thunderbird e Firefox 1.5 beta2. Bug fixes, più che altro. Niente di epocale.
http://www.ziobudda.net/Admin/redir_news.php?id=24382

"Rilasciato Gnome 2.12"
GNOME 2.12 è l'ultima versione del popolare ambiente desktop libero multi-piattaforma GNOME, che fornisce tutti gli strumenti di cui ha bisogno un utente di computer e una piattaforma per gli sviluppatori software.
http://www.ziobudda.net/Admin/redir_news.php?id=24381

"Sicurezza e anonimato in rete"
"Profili giuridici e tecnologici della navigazione anonima.". Un libro di nuova pubblicazione aggiornato alla recente normativa recante misure urgenti per il contrasto del terrorismo internazionale (d.l. 144/2005, convertito con Legge 31 luglio 2005 n. 155). Non l'ho letto, ma dal titolo sembra qualche cosa di interessante.
http://www.ziobudda.net/Admin/redir_news.php?id=24380

"Intervista a Riccardo Tortorici, webmaster di no1984.org"
Sensibilizzare, sensibilizzare, sensibilizzare: questo è il messaggio che emerge da questa intervista realizzata con Riccardo Tortorici, webmaster di no1984, il gruppo che si occupa di contrastare l'avvento del TCPA, cercando di coinvolgere il più posibile le utenze.
http://www.ziobudda.net/Admin/redir_news.php?id=24405

NETSUKUKU, RETE LIBERA OLTRE LA RETE
La sviluppano quelli del Freaknet di Catania, crew di hacker che punta ad una rete mondiale distribuita, anonima e anarchica capace di svincolarsi dalle infrastrutture internet tradizionali e di girare al di fuori di ogni controllo
URL: http://punto-informatico.it/pi.asp?i=55421
Also - http://newsvac.newsforge.com/article.pl?sid=05/10/06/1421213&from=rss

LA SCUOLA DEGLI SMANETTONI
Gli insegnanti non hanno piu' di 25 anni, qualcuno 15, smanettano da sempre e vogliono insegnarlo agli altri via chat. Parlano di Linux, Python e PHP e sognano una nuova classe di informatici. PI intervista OilProject
URL: http://punto-informatico.it/pi.asp?i=55404

WIND RIVER FORGIA UN LINUX PER CELLULARI L'azienda, leader nel settore delle piattaforme embedded, ha partorito un cucciolo di Pinguino dedicato ai dispositivi mobili e alle appliance domestiche. Lo si vedra' sui primi device gia' entro la fine dell'anno
URL: http://punto-informatico.it/pi.asp?i=55407

ECLIPSE INCONTRA FLASH
Macromedia sta per dare in pasto alla comunita' di sviluppatori open source un plug-in per Eclipse che permettera' di dar vita ad applicazioni interattive in linguaggio Flash
URL: http://punto-informatico.it/pi.asp?i=55422

NASCE L'ANAGRAFE GLOBALE DEI VIRUS
Ci lavorano sopra il CERT e alcuni dei maggiori player del settore Sicurezza: worm, virus e affini saranno classificati a livello internazionale e avranno una denominazione univoca
URL: http://punto-informatico.it/pi.asp?i=55417

LA UE BLINDA LE PROPRIETA' INTELLETTUALI Scoppia la polemica intorno alla direttiva europea che colpisce la violazione della proprieta' intellettuale. Gli esperti: soffoca la competizione ed e' dannosa per i consumatori. Pene dure, come quelle per i terroristi
URL: http://punto-informatico.it/pi.asp?i=55409

History of Microsoft Exploits and Security Bulletins: 1998-2005 Goal : Exploit for every Microsoft Security Bulletin, 115 Exploits / 449 Bulletins.
http://elsenot.com/

Keen Veracity 14
Articles include :The Art of: Social Engineering, Wireless Technology Exposed, Harriet the Spy, Review of ToorCon.
http://www.legions.org/kv/kv14.txt

Analysis of the Texas Instruments DST RFID The Texas Instruments DST tag is a cryptographically enabled RFID transponder used in several wide-scale systems including vehicle immobilizers and the ExxonMobil SpeedPass system. This page serves as an overview of our successful attacks on DST enabled systems. A preliminary version of the full academic paper describing our attacks in detail is also available below.
http://rfidanalysis.org/

Cellular/Mobile Phone Forensics
Lots of resources on the topic, articles, tools, concepts.
http://www.e-evidence.info/cellular.html

x86-64 buffer overflow exploits and the borrowed code chunks exploitation technique http://www.suse.de/~krahmer/no-nx.pdf

NetBios Inspector
NBI (NetBios Inspector) inspects your Microsoft Network.
http://www.securityfriday.com/tools/NBI.htm

Reverse Engineering Case Study #1: Windows System Hotkeys There is probably no person in the world that knows every aspect of Microsoft Windows in specific detail, and even Google's tremendous body of knowledge is often ignorant of Windows minutiae. Fortunately, this type of information is available on-demand to anyone with a debugger, a disassembler, an Internet connection, and enough patience to sleuth it out. Recently I was trying to figure out how the "special" hotke ys get processed in Windows, when somewhere along the way I thought it might be interesting to write the experience down as a sort of reverse engineering "case study", and at the same time document a tiny bit more of the undocumented.
http://www.eeye.com/html/resources/newsletters/vice/VI20051005.asp?sb=kwkckpakpbnmwapcbprc&rd=vexposed

ADVISORIES: OCTOBER 5, 2005
Today's security advisories: mysql-dfsg-4.1, apachetop, drupal, mailutils, egroupware, arc, and mod-auth-shadow (Debian GNU/Linux); gtkdiskfree, Berkeley MPEG Tools, Uim, and Texinfo (Gentoo Linux); slocate, vixie-cron, net-snmp, kernel, openssh, binutils, perl, mysql, and gdb (Red Hat Linux); Thunderbird (Slackware); and mozilla-locale-... and dia (Ubuntu Linux).
http://nl.internet.com/ct.html?rtr=on&s=1,1xvz,1,duxc,clwm,85jl,7pty

ADVISORIES: OCTOBER 6, 2005
Today's security advisories: mason (Debian GNU/Linux); Ruby and Dia (Gentoo Linux); and texinfo (Ubuntu Linux).
http://nl.internet.com/ct.html?rtr=on&s=1,1xyt,1,9i7j,8m6k,85jl,7pty

HOW TO BREAK INTO A COMPUTER THAT IS RIGHT AT YOUR FINGERTIPS "In this excerpt from Chapter 5 of , author Joel Dubin illustrates the ease with which a hacker can bypass a BIOS password and break into a computer..."
http://nl.internet.com/ct.html?rtr=on&s=1,1xvz,1,7jwh,31in,85jl,7pty

HOW TO STOP PHISHING IN ONE EASY STEP
"Here's a security concept for everyone: 'if you can't do it securely, then don't do it at all...'"
http://nl.internet.com/ct.html?rtr=on&s=1,1xyt,1,f0q2,1zg1,85jl,7pty

DEBIAN, GET YOUR @%#* TOGETHER!
"If there’s any hope of a free version of Linux usurping users from Microsoft Windows, the obvious path leads to Ubuntu..."
http://nl.internet.com/ct.html?rtr=on&s=1,1xvx,1,35wd,ii8e,85jl,7pty

NEW SHELLS, PART ONE: ZOIDBERG
"This month, let's look at the first of several nontraditional shells: Zoidberg, or zoid, a shell written in Perl..."
http://nl.internet.com/ct.html?rtr=on&s=1,1xvx,1,bgod,h5fp,85jl,7pty

PROTECTING FILES AT HOME USING ENCRYPTED CONTAINERS "Many people encrypt partitions or drives to keep data safe, but if you're looking for something a little simpler but still safe, try using containers..."
http://nl.internet.com/ct.html?rtr=on&s=1,1xvx,1,6v0e,drxt,85jl,7pty

MICROSOFT'S LINUX-RELATED PATENTS REJECTED "The U.S. Patent Office has rejected two Microsoft patents over the FAT file format, but the software maker said Wednesday that it's not ready to give up its battle to protect its widely used method for storing data..."
http://nl.internet.com/ct.html?rtr=on&s=1,1xvx,1,bvnl,k386,85jl,7pty

PASS ON PASSWORDS WITH SCP
"Learn how to propagate files quickly and do backups easily when you set up scp to work without needing passwords..."
http://nl.internet.com/ct.html?rtr=on&s=1,1xyr,1,9akg,gb6c,85jl,7pty

SUSE 10 ARRIVES
"Without any fanfare, Novell Inc. has released the latest version of its flagship Linux distribution: SuSE Linux 10..."
http://nl.internet.com/ct.html?rtr=on&s=1,1xyr,1,2iaj,cpg5,85jl,7pty

Astalavista Security Newsletter 21
Issue 21 of the Astalavista Security Newsletter can be found at the following URL:
http://www.astalavista.com/media/archive1/newsletter/issue_21_2005.pdf

Eight Tips for Migrating to Enterprise VoIP Ted Wallingford answers the eight most common questions asked by prospective VoIP adopters, and offers advice to get you started on the path to enterprise VoIP.
http://www.oreillynet.com/pub/a/network/2005/09/23/voice-over-ip-faqs.html

MALWARE
Title: Bilingual worm poised to penetrate networks
Source: Search Security
Date Written: 2005-10-06
Date Collected: 2005-10-06
McAfee Inc. has raised its threat level to "medium" due to a new strain of the Sober worm. A zip file attached to an email, called "PW_Klauss.Pic.packed-bitmap.exe.", contains malicious code with its own SMTP engine that then creates outgoing "your password has successfully been changed" messages in German and English depending on the language of the Windows version it finds. The worm then attaches itself to the PC and displays an error message, although it does not appear to capture keystrokes or anything else. McAfee recommends users update their antivirus software to remain protected.
http://searchsecurity.techtarget.com/originalContent/
0,289142,sid14_gci1131957,00.html

MALWARE
Title: Nokia to inoculate phones with antivirus
Source: CNet
Date Written: 2005-10-05
Date Collected: 2005-10-07
Symantec has agreed to equip Nokia's Series 60 smart phones with its Mobile Security antivirus program to guard against attacks that could effect data stored on the phones, like contact lists. Although mobile phone attacks are not common, CommWarrior Trojan horse, which targets Nokia series 60 handsets running the Symbian operating system, is currently spreading.
http://news.com.com/Nokia+to+inoculate+phones+with+antivirus/2100-7355_3-5889450.html?tag=cd.top

MALWARE
Title: First trojan for PSP found
Source: Sydney Morning Herald
Date Written: 2005-10-07
Date Collected: 2005-10-07
Symantec has identified a trojan, Trojan.PSPBrick, the first malware known to target Sony's PSP (PlayStation Portable) handheld device. PSP can only run Sony-approved programs, but the trojan poses as one of the many hacks developed to circumvent this feature. Once installed, the trojan disables the PSP by deleting all system files. F-Secure notes that version 2.0 of the Sony firmware is meant to close the PSP against these hacks, but hackers have found ways to reinstall version 1.50, possibly making even updated PSPs vulnerable to future variants of the trojan.
http://www.smh.com.au/news/breaking/first-trojan-for-psp-found/2005/10/07/1128562976633.html

VULNERABILITIES & EXPLOITS
Title: Symantec Plugs 'High Risk' AV Engine Flaw
Source: EWeek.com
Date Written: 2005-10-05
Date Collected: 2005-10-06
Symantec announced its AntiVirus Scan Engine has a buffer overflow flaw in the web-based Administrative Interface in versions 4.0 and 4.3. Insufficient validation of user input in HTTP requests passed to the Scan Engine Web Service could allow a hacker to supply a maliciously crafted HTTP request to launch harmful code. Rated "high" on Symantec's risk impact scale, the problem can be corrected with security patches posted on the company's website.
http://www.eweek.com/article2/0,1895,1867475,00.asp

VULNERABILITIES & EXPLOITS
Title: Kaspersky Issues Fix for Security-Software Flaw
Source: NewsFactor
Date Written: 2005-10-05
Date Collected: 2005-10-06
Kaspersky Labs issued a product update designed to fix a serious flaw in its antivirus software, which was first reported by researcher Alex Wheeler and is related to processing files of the CAB format in machines running Windows (other operating systems are not affected). The affected products include Anti-Virus Personal 5.0, Anti-Virus Personal Pro 5.0, Anti-Virus 5.0 for Windows Workstations, Anti-Virus 5.0 for Windows File Servers and Personal Security Suite 1.1. Researchers are paying more attention to flaws in security software, but it is unusual that Wheeler announced the flaw himself, rather than telling Kaspersky and letting the company fix it first.
http://www.newsfactor.com/story.xhtml?story_id=38496

HOMELAND SECURITY & INFRASTRUCTURE PROTECTION
Title: SMS attacks could cripple mobile phone network
Source: Techworld
Date Written: 2005-10-06
Date Collected: 2005-10-07
Researchers at Penn State University say hackers could disable the entire U.S. mobile phone network by sending malicious Short Message Service (SMS) messages. The control channel, a small portion of the radio frequency spectrum used to send both SMS messages and calls, is easy to overwhelm. In fact, Europe has seen actual overloads of SMS messages. The researchers hope that mobile service providers will change their practices to decrease the risk of such attacks, but some think the threat is not large and even a successful attack would only knock out service for a short time.
http://www.techworld.com/security/news/index.cfm?NewsID=4525

Using open source software on Mac OS X
http://software.newsforge.com/article.pl?sid=05/09/20/166254&from=rss
If you want to make use of open source software on a Macintosh running OS X, you have plenty of options. The Fink project modifies Unix/Linux open source packages to run on Mac OS X, and gives users the ability to build from source or download precompiled binaries. Many open source packages have native OS X versions -- Firefox, Thunderbird, Abiword, Nvu, and the GIMP among them. But if you dig deeper, you will find quite a few Mac-only open source software gems. Here are a few of the best open source programs written specifically for Mac OS X.

Microsoft: Nothing to gain from Firefox flaws http://newsvac.newsforge.com/article.pl?sid=05/10/07/1940243&from=rss
Microsoft claims it has not gained anything from the recent spate of security flaws that have been discovered in Firefox, even though the open-source browser is a rising rival to the software giant's Internet Explorer.

Sober returns using social engineering techniques http://newsvac.newsforge.com/article.pl?sid=05/10/07/1731223&from=rss
LogError writes "A new variant of the Sober worm, Sober.Y, spreads using social engineering techniques in emails sent in English or German."

g00d reading! 'n' bye
Security News MainTainer:

The Jackal a.k.a. jAcKallO < jackal [at] capitanlug.it >

(AreaSessantuno Inside) / (SpiPPolatori Collaborator) (HackerAlliance Member) / (Socio fondatore del CapitanLUG.iT) (Daily DisInfo CreaTor & MainTainer) / (Security News MainTainer)