Date: Fri, 17 Dec 1999 17:04:32 -0500 (EST)
From: CERT Advisory <[email protected]>
To: [email protected]Subject: CERT Summary CS-99-05
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
CERT Summary CS-99-05
December 17, 1999
Each quarter, the CERT Coordination Center (CERT/CC) issues the CERT
summary to draw attention to the types of attacks reported to our
incident response team, as well as other noteworthy incident and
vulnerability information. The summary includes pointers to sources of
information for dealing with the problems. Occasionally, "special
editions" such as this one are published.
Past CERT summaries are available from
http://www.cert.org/summaries/
______________________________________________________________________
"CERT/CC Current Activity" Web Page
The CERT/CC Current Activity web page is a regularly updated summary
of the most frequent, high-impact types of security incidents and
vulnerabilities currently being reported to the CERT/CC. It is
available from
http://www.cert.org/current/current_activity.html
The information on the Current Activity page will be reviewed and
updated as reporting trends change.
______________________________________________________________________
Year 2000 (Y2K) Information
The CERT/CC has recently published web pages to assist sites in
dealing with Y2K-related security issues.
Y2K FAQ - Our Y2K FAQ has been extensively revised in collaboration
with participants in the International Y2K workshop held in
October 1999. The FAQ includes information to help sites
determine whether a failure is Y2K related or an attack. The
FAQ is available at
http://www.cert.org/y2k-info/Y2K_FAQ.html
Expectations During Y2K - "Cyber Infrastructure and Malicious
Expectations during the Y2K Transition Period," also a
collaborative effort by members of the Threat Analysis Working
Group at the International Y2K Workshop, discusses potential
activities associated with Y2K and offers recommendations. This
paper is available at
http://www.cert.org/y2k-info/y2k-cyberthreats
Year 2000 Computer Viruses and Hoaxes - This web page lists the
approximate number of reports the CERT/CC has received on
viruses and hoaxes that reference Y2K. There are also links to
anti-virus vendors having Y2K virus and hoax web pages. Our
list is available at
http://www.cert.org/y2k-info/y2k-virus.html
Y2K status reports - During the Y2K event, the CERT/CC will publish
regular reports on our web site to inform the community of
activity being reported to us by other response teams and
sites. Those reports will be available at
http://www.cert.org/y2k-info/y2k-status.html
Reporting new security information
We encourage sites that discover new vulnerabilities or witness new
types of attacks to report those to us by sending electronic mail to
[email protected]
Backup CERT hotline
During the Y2K event, we will have backup hotline in case of a
telecommunications failure with our primary hotline. The backup
hotline phone number is
+1 412 818-3442
This backup hotline will be staffed only if the primary hotline fails.
______________________________________________________________________
Results of the Distributed-Systems Intruder Tools (DSIT) Workshop
In November 1999, experts addressed issues surrounding
distributed-systems intruder tools. A paper now available at the
CERT/CC web site is one outcome of the DSIT Workshop. In it, workshop
participants examine the use of distributed-system intruder tools and
provide information about protecting systems from attack by the tools,
detecting the use of the tools, and responding to attacks. The paper
is available at
http://www.cert.org/reports/dsit_workshop.pdf
______________________________________________________________________
Ongoing Intruder Activity
Distributed denial-of-service tools are continuing to be found on
compromised hosts. In addition to the information provided by the
Distributed-Systems Intruder Tools Workshop mentioned above, please
see
http://www.cert.org/incident_notes/IN-99-07.html
Intruders continue to exploit a vulnerability in the am-utils package
to gain root access to victim machines. For details, see
http://www.cert.org/incident_notes/IN-99-05.html
Finally, RPC service vulnerabilities are still being regularly
exploited: rpc.ttdbserverd, rpc.cmsd, statd-automound. Details and
pointers to additional information can be found in
http://www.cert.org/incident_notes/IN-99-04.html
______________________________________________________________________
This document is available from:
http://www.cert.org/summaries/CS-99-05.html
______________________________________________________________________
CERT/CC Contact Information
Email: [email protected]
Phone: +1 412-268-7090 (24-hour hotline)
Fax: +1 412-268-6989
Postal address:
CERT Coordination Center
Software Engineering Institute
Carnegie Mellon University
Pittsburgh PA 15213-3890
U.S.A.
CERT personnel answer the hotline 08:00-20:00 EST(GMT-5) / EDT(GMT-4)
Monday through Friday; they are on call for emergencies during other
hours, on U.S. holidays, and on weekends.
Using encryption
We strongly urge you to encrypt sensitive information sent by email.
Our public PGP key is available from
http://www.cert.org/CERT_PGP.key
If you prefer to use DES, please call the CERT hotline for more
information.
Getting security information
CERT publications and other security information are available from
our web site
http://www.cert.org/
To be added to our mailing list for advisories and bulletins, send
email to [email protected] and include SUBSCRIBE
your-email-address in the subject of your message.
Copyright 1999 Carnegie Mellon University.
Conditions for use, disclaimers, and sponsorship information can be
found in
http://www.cert.org/legal_stuff.html
* "CERT" and "CERT Coordination Center" are registered in the U.S.
Patent and Trademark Office.
______________________________________________________________________
NO WARRANTY
Any material furnished by Carnegie Mellon University and the Software
Engineering Institute is furnished on an "as is" basis. Carnegie
Mellon University makes no warranties of any kind, either expressed or
implied as to any matter including, but not limited to, warranty of
fitness for a particular purpose or merchantability, exclusivity or
results obtained from use of the material. Carnegie Mellon University
does not make any warranty of any kind with respect to freedom from
patent, trademark, or copyright infringement.
-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv
iQA/AwUBOFqGOlr9kb5qlZHQEQLWNACfWkhN6a0Q8L6RdG7G07RJlMFdWOQAoNlO
bPEffGaq1aa9quVfN2ys4N2a
=iGzX
-----END PGP SIGNATURE-----
