Liudvikas Bukys

vnunet:
Microsoft software expelled by top college

Newnham women’s college, Cambridge, has banned Microsoft Outlook and Outlook Express because it is tired of cleaning up after virus attacks.
The college, which has around 700 users, took the decision after the latest Klez virus outbreak.

Atlanta Journal-Constitution: The rise of hackers vs. colleges:
Security being bolstered for university computer systems

Marc Barrot’s outline weblog keeps getting cooler.

Six arrested over ‘Nigerian email’ frauds:
Six people were arrested in South Africa last weekend on suspicion of being involved in the infamous Nigerian email and letter fraud.

Network World, Daniel Blum:
Is Your Forest Burning?

Over time, Microsoft has backed away from the single-forest concept, finally publishing this past winter a white paper disclosing that service administrators in one domain can’t be isolated from other domains in the forest. Since then, Microsoft has done a security-threat analysis. It determined that a serious hacker’s goal is to gain physical access to a domain controller, or network access to a service administrator account.

Microsoft also has been doing disaster planning. Recently, it wiped out the domain controllers on its entire development group forest, which serves thousands of users, and tested the procedures necessary to bring it back online. And at Microsoft’s recent TechEd conference, a speaker went so far as to advise large companies that “if you don’t have a single CIO, you shouldn’t have a single forest.”

Bakos & Jiang:
SQLSnake code analysis

DMCA Attacks: NAI Tells Sites To Remove PGP (Updated) [Slashdot: News for nerds, stuff that matters]

While looking for examples of SQL Code Injection attacks, I found

a nice concise summary of many typical web application vulnerabilities, including specific product-specific things to look for, e.g.:

MySQL

– Supports ‘INTO OUTFILE’
– Runs often as “root”
– Most modules and libs do not support multiple-statements.

Oracle

– Subselects possible
– UNION possible
– Comes with many stored procedures (utf_file!)
– No multiple-statements

DB2

– Subselects possible
– UNION possible
– Stored procedures
– No multiple-statements

Postgres

– Supports COPY (if superusermode)
– Subselects possible
– UNION possible
– Stored procedures
– Multiple statements are possible!

MS SQL

– Subselects possible
– UNION possible
– Stored procedures
– Multiple statements are possible!
– Many dangerous default stored procedures (xp_cmdshell, sp_adduser)

John Robb:
The New Economy
: “Did the Internet enable a new economy? I think the latest evidence says that it has. But it isn’t the new economy corporate America expected.”

Wireless Networking at 72Mbps Dual-channel 802.11a [Slashdot: News for nerds, stuff that matters]