Not sure about a threat or a the validity of a certain piece of information? We'll be glad to check it out for you. give us a complete description of the source (date, subject, URL).

E-mails forwarded without explanation will be treated as a virus and deleted. Send your questions to security_sb@sdsltd.com

SECURITY BULLETINS

 

Updated on 22 November 2002 

---

"Terrorist attacks mainly work on the mind, not the body. An attack that kills few can horrify many. That's the low-budget war plan that works so efficiently for terrorists. So, when you accept and pass along false rumors, not only are you scaring yourself and your friends, but you may also be helping the terrorists with their work. Kinda makes you hesitate before you hit that Send button, huh?" - Joyce Slayton, SF Gate, 1 Nov 01

• AOL Instant Messenger Hole
• Attack on America
  • Urban Legends Reference Page
  • Warning of bio attack via coded painting
• Friendgreeting Electronic card
• Online Banking
• Outlook Express Patch
• Windows, Critical Patch (22 Nov 02)

---

Other Links of Interest

w00w00! - Check out their security advisories and file archive

• SECURITY BULLETIN #1 - Attack on America

Fact? Fiction? - (05 Nov 01)

 

The September 11, 2001 terrorist attack on the United States of America has spawned many reports of solid, dubious and unknown origins. It is important for us to sort out the validity of these reports. Needless panic and lack of attention to a threat are dangerous to our survival.

Under the first bullet, you will find reports posted on Urban Legends Reference Page which have surfaced in the past two months; the reports are color-coded for ease of identification of their validity.

 

The second bullet concerns an interview by a Dr. Robert Koontz concerning a warning of a major biological attach hidden in allegedly coded paintings. Please read this item (not just its headline), so you can make up your own mind as to its validity.

•  Urban Legends Reference Page (Main page for Rumors of War) To find out which of the following items are true and which are false or of unknown validity, click on the link to the item and scroll down to the item (by date)
  • Perfume sniffing deaths - (go to 3 Nov item)
  • California Governor Gray Davis re threats on bridges (go to 1 Nov item)
  • FBI investigation of large amounts of candy purchase (go to 23 Oct item)
  • E-mail warning about attack at malls on Halloween (go to 21 Oct item)

 

Before you believe dire warnings from little publicly known sources on face value, it is useful to research the source of the information and thus be able to evaluate the information with more facts in hand. The following case is one such warning that deserves further study:

• Expert warns of major biological attack - warning given via coded painting) and Interview with Dr. Robert Koontz - (Defense Watch, 17 Oct 01) - Although Defense Watch usually provides reliable information, this particular report and the interview are truly bizarre. Things to take into consideration when evaluating the source for the article:
  • The "coded paintings" and "other evidence" are not on the site listed in the article as the place where you can view them. As a matter of fact,, when you click on that URL (http://www.bringmenews.com/Messages/National_Security/Alerts/Alert_003.htm), the message "Error 404 Not Found" pops up. This does not mean that they do not exist, merely that they are not at the site given by Dr. Koontz in the article.
  • Dr. Koontz invites people to visit his site at http://www.BringMeNews.com/ . Strangely, this is not an active site (at least not on 5 Nov 01). When you click on the link, you get "Welcome to the future home of bringmenews.com."
  • October 20, 2001 column in Detroit Free Press by Mike Wendland on this particular story: "The Internet and those who see conspiracies afoot everywhere have been in hyperdrive during the angst-filled days since Sept. 11. This dark side of the Internet can do real harm."
  • Visit Dr. Robert Koontz's site
  • Urban Legends Reference Page analysis and further sources.
• Caution: we are not saying that the threat of biological terrorsm isn't present, we are asking ourselves questions about a specific report based on a study of the above sites.
  

"Trust, but verify." President Ronald Reagan

• SECURITY BULLETIN #2 - AOL Instant Messenger

(02 Jan 02)

 

If you use AOL Instant Messenger, you will be interested in an Associated Press article which warns: "A security hole in AOL Time Warner's Instant Messenger program used by millions of people worldwide can let a hacker take full control of a victim's computer, according to security researchers and the company." For more details, please read the article.

 

If you visit the site of the non-profit security group w00w00! mentioned in the above article, you will be able to find out considerably more details about the problem and how you can fix it or avoid it.

 

• SECURITY BULLETIN #3 - Online Banking

(30 Apr 02)

 

Online banking has become for some people one of the favorite ways of handling their finances. If you are interested in finding out the pitfalls of this growing practice, you might find this ZDNet article informative.

• Late one recent Sunday night, an executive at a midsized financial services firm received the kind of call everyone in the industry dreads: a demand for $1 million, or else the brokerage's network would crash the next day with a surreptitiously installed program . . ." Continue reading here. 

"Outlook Express Flaw Speeds Hacking - Microsoft warned Outlook Express users late Thursday that a software flaw could allow an online vandal to control their computers. A critical vulnerability in the e-mail reader could allow an attacker to send a specially formatted message that would crash the software and potentially take control of the recipient's computer." (ZDNet) Full ZDNet article here.

Get the Microsoft Service Pack for Outlook Express 5.5 and 6.0. Microsoft says that Microsoft Outlook is not affected by this problem.
Note Microsoft's explanation in the Tested Versions paragraph: "Tested Versions: Microsoft tested Outlook Express 5.5 and 6.0 to assess whether they are affected by these vulnerabilities. Previous versions are no longer supported, and may or may not be affected by these vulnerabilities."

• SECURITY BULLETIN #5 - Critical Windows Patch
(22 Nov 02)

Read Microsoft Service Pack. Find the link to the patch at the bottom of the page, under Patch Availability.

Read the CBSNews.com article: "Microsoft Issues Windows Warning," 22 Nov 02.