@RISK: The Consensus Security Vulnerability Alert

Part I -- Critical Vulnerabilities from TippingPoint (www.tippingpoint.com)

Widely Deployed Software

• (1) UPDATE: Microsoft Windows HTML Help ActiveX Control Vulnerability

Other Software

• (2) HIGH: Nullsoft SHOUTcast Server Format String Vulnerability
• (3) HIGH: Multiple Vendor PHP Remote File Include Vulnerabilities

Exploits and Worms

• (4) PhpInclude Worm

PART I Critical Vulnerabilities

Part I is compiled by the security team at TippingPoint (http://www.tippingpoint.com) as a by-product of that company's continuous effort to ensure that its intrusion prevention products effectively block exploits using known vulnerabilities. TippingPoint's analysis is complemented by input from a council of security managers from twelve large organizations who confidentially share with SANS the specific actions they have taken to protect their systems. A detailed description of the process may be found at http://www.sans.org/newsletters/cva/#process

Part II: Weekly Comprehensive List of Newly Discovered Vulnerabilities
Week 52, 2004

==end==

Subscriptions: @RISK is distributed free of charge to people responsible for managing and securing information systems and networks. You may forward this newsletter to others with such responsibility inside or outside your organization.

To subscribe, at no cost, go to https://portal.sans.org where you may also request subscriptions to any of SANS other free newsletters.

To change your subscription, address, or other information, visit http://portal.sans.org

Copyright 2004. All rights reserved. No posting or reuse allowed, other that listed above, without prior written permission.

============================================

Bonus or the holidays: The Tool of the Month is distributed to organizations using SANS Security Awareness training program. For more information on our awareness training program, see http://www.sans.org/awareness/

Security Awareness Tool of the Month: December 2004 By Kristy Westphal

Email: Is it safe?

Just when you thought it was safe to open your email again....ZAP! Yet another strange request from your Credit Card Company or bank, looking for your PIN, perhaps a credit card number, or some other personal information. It's even gone so far as to touch other companies like telecommunication provider Verizon. The facts are in: phishing scams are continually on the rise and they are getting harder to detect as they take advantage of vulnerabilities in the software that we use every day, such as our mail clients and our browsers.

As a security professional, you realize that you need to get the information out to your company's employees about what they should do when they get a phishing email. The problem is, how do you explain to your average, non-computer savvy user what to look for? Sure, you can describe it in words, but it really helps to see examples. Here is the tool for you!

http://survey.mailfrontier.com/survey/quiztest.html

It's the MailFrontier Phishing Quiz, currently up to version 2. (Version 1 is available here: http://survey.mailfrontier.com/survey/quiztest.cgi?/themailfrontierphishingiqtes
t )

It has ten samples of real phishing emails, and authentic emails. For example, message 9 is from 'Capitol One' and there are three possible selections. They are:

• - Legitimate
• - Phishing Fraud
• - No Answer

You can click on the link to see what the email looks like ( http://www.mailfrontier.com/quiztest2/S2html/Q9.html ) and then select your answer. When you are done, you can see how well you did by clicking on the "Get your score" button.

While there aren't a lot of details as to what to look for in a phishing email, it is a simple way to show your users that it isn't easy to identify phishing ploys. If they ever have any doubt about an email, they should call the provider in question to verify authenticity. Many of the most heavily hit companies actually have fraud phone lines or email addresses where you can report suspicious emails.

Still not convinced this is a good tool? Well, I have used this tool to help educate the security analysts where I work. We took part of the quiz altogether aloud, and not even they could tell by just looking at the email. They actually missed quite a few ones that were real, calling them fakes, and vice versa. It did show that even security analysts can find it difficult to determine the real versus fake.

In another case, a network manager put some samples from the quiz in a user broadcast message. A user notified him that when they had received a suspicious email, they called the company to confirm it rather than click on the link, all because of the examples that had been sent out.

Furthermore, a consultant has commented that he was able to use the examples in his awareness classes. Feedback on the examples reflected very positive responses, including one that too little time was spent on the examples in the first class where the consultant used them. The consultant commented: "it helped me create a break from 'talking at' the group and get a little audience participation going."

While not a definitive tool, it can be very effective. Combined with tips like the following, from the Anti-Phishing Working Group, the MailFrontier quiz can be another effective tool in your awareness arsenal:

1) Be suspicious of any email with urgent requests for personal information.

2) Don't be fooled by emails with upsetting or exciting (but false) statements that try to get you to react immediately.

3) If you suspect the message might not be authentic, don't use the links within the email to get to a webpage.

4) Don't fill out forms in email messages that ask for personal financial information

5) Communicate information such as credit card numbers only via a secure website or the telephone.

6) To make sure you're on a secure Web server, check the beginning of the URL in your browser address bar. It should be "https" rather than "http". The "s" stands for secure.

7) Consider installing a Web browser toolbar such as EarthLink's Scamblocker to alert you before you visit known phishing fraud websites (eBay also has a similar tool).

8) If an email message is not personalized, assume it's not a valid message.

9) Log in to your online accounts regularly, and check bank, credit and debit card statements to ensure that all transactions are legitimate.

10) Ensure that your operating system and browser is up-to-date and security patches have been applied.

More information on phishing:

http://antiphishing.org http://www.bbbonline.org/idtheft/phishing.asp

Copyright 2004, The SANS Institute. Redistribution is allowed only to individuals within your own employer's organization.