Larry Seltzer

Cast a slightly more skeptical eye this weekend at the Web, as an underground group has scheduled a volume Web site defacement contestfor Sunday, July 6. You hear about this sort of attack every now and then, when juveniles put obscene phrases on a company site for political purposes or simple chest-beating. The opening page […]

Lets say youre a really small operation. Youve got one server and you want to connect it the Internet. Obviously youre going to need a firewall. Do you need a whole separate system for it? While many people will say that you should pull out an old 486 box and run IPTables for Linux on […]

Many years ago in the course of testing antivirus software for PC Magazine, one of the vendors I spoke to said that their long-term radar indicated that conventional antivirus pattern scanning techniques were headed for a technological wall. The number of viruses that the product searched for was projected to grow by a third in […]

If you ever read security vulnerabilities you eventually run into a notation looking like “CVE-2002-0947.” This is a standard naming convention for vulnerabilities called Common Vulnerabilities and Exposures (CVE). CVE is administered by a company called Mitre, a non-profit company that operates governmental research facilities and other such cool things. In addition to hosting the […]

Microsoft may have a bad reputation in some circles, but theyre George Washington compared with the average mass-spammer. So filing suit in the United States and United Kingdom against 15 major spammers solves two problems. Its hard not to feel good about this action, although Im sure some will find ways to construct criticism of […]

Somethings not quite as it seems with Microsofts acquisition last week of the intellectual property of GeCAD Software, a Romanian antivirus supplier. In one sense, the reasons are obvious: As the press release announcing the purchase makes clear, Microsoft is on a mission, pursuant to the Trusted Computing initiative, to provide a more secure computing […]

It all began in late 2001 with a plan from Microsoft and a few other companies to limit details of vulnerabilities, especially with respect to exploit information. Normal people, as opposed to those in the security business, are usually appalled to hear that many researchers include details of how to exploit new vulnerabilities, including handy […]

Discuss this column in our forum. Bit-heads such as myself tend to get hung up around the cool techie aspects of security, like data encryption and authentication systems. But many of the most important information theft attacks are based, at least in part, on the breakdown of the more human elements of security. Could I […]

Sorry for the broken record treatment to all my regular readers, but I think its perhaps the most important security point in real world IT: Too many vulnerable systems are left in exposed situations, even when patches have been made available. For large networks that require active management, the answer is a patch management system […]

Discuss this column in our forum. It took many years of browser development before we started fearing them. Until about version 4 of Netscape and IE the only talk of security was theoretical and usually unrealistic, such as whether Java or ActiveX were big holes when neither has turned out to be. The real holes […]

I take it as a positive trait in myself that Im constantly appalled at the gall of some people conducting scams on the Internet. It would be sad to take such things in stride. The latest cheap trick comes as an automated e-mail from a site called word-of-mouth.org. Purporting to come from the “Word-of-Mouth.Org Report […]

Thanks to Jonas Eckerman (http://www.truls.org/) for answering my request in a recent column for input rules for the Apache mod_rewrite module to make it work roughly like Microsofts UrlScan. Eckerman isnt familiar with UrlScan, but says these rules “stop a majority of worms and attacks against web servers.” These rules cause Apache to return an […]