Security

The U.S. Government has reported that fewer vulnerabilities were found in Windows than in Linux/Unix operating systems in 2005.

Linux/Unix-based operating systems--a set that includes Mac OS X, as well as the various Linux distributions and flavours of Unix--had more than twice as many vulnerabilities as Windows, according to the United States Computer Emergency Readiness Team (US-CERT).

The report, the Cyber Security Bulletin 2005, was published last week and found that out of 5,198 reported flaws, 812 were Windows operating system vulnerabilities, while 2,328 were Unix/Linux operating bugs. The remaining 2,058 were multiple … Read more

Officials of the National Security Agency this week acknowledged that the agency had been placing persistent cookies on the computers of people who visited its Web site and that it has since ceased the practice.

The NSA said Wednesday that the use of the cookies was accidental, the result of a recent software upgrade, according to the Associated Press. "After being tipped to the issue, we immediately disabled the cookies," an agency spokesman said.

The spy organization also uses other, more short-lived cookies--small files that keep a record of Web sites people visit--that disappear when a person closes … Read more

Richard M. Smith, a computer privacy expert, has suggested a method to find out if the government is monitoring a person's e-mail.

"With all of the controversy about the news that the NSA (National Security Agency) has been monitoring, since 9/11, telephone calls and email messages of Americans, some folks might now be wondering if they are being snooped on," he said in a blog posting last week.

To find out, Smith suggested the following recipe: Set up e-mail accounts with Hotmail and a non-U.S. e-mail provider and send e-mail back and forth whose contents &… Read more

Microsoft has made available a tool to fix a snag that hit some users of its Software Update Services tool. SUS is an older version of Microsoft's current Windows Server Update Services (WSUS) software that lets users manage patches for multiple computers.

The problem occurred if users synchronized their SUS 1.0 server after Dec. 12, the software maker issued critical Windows patches a day later.

"If you synchronize a server that is running Microsoft Software Update Services (SUS) 1.0 with Service Pack 1 (SP1) after December 12, 2005, all the previously approved software updates may be … Read more

The U.S. government's National Information Assurance Partnership has awarded certain versions of Windows XP and Windows Server 2003 its Common Criteria security certification, Microsoft said this week.

The operating system software has received Evaluation Assurance Level (EAL) 4 certification, Microsoft said. Such certification can be important for government and other organizations when making buying decisions.

Windows was certitified in "20 real-world scenarios" that each involved specific configurations, a Microsoft representative said. In other words, the out-of-the-box Windows installation wasn't certified.

EAL 4 is not the highest level of CC certification--the highest level is 7--but it … Read more

Software Update Services (SUS), an older version of Microsoft's software that lets users manage patches for multiple computers, has hit a snag.

"If you synchronize your server after December 12, 2005, all previously approved updates may be unapproved," Microsoft said in an article on the issue published on its support Web site published Wednesday.

Microsoft does not detail the cause of the problem, but the company is working on a fix. "Microsoft is currently working on a standalone scripting solution that will reset your approval settings to their previous state," according to the support article. … Read more

A computer virus got the better of a Japanese Airlines co-pilot when the passcodes in his computer were circulated over the Internet, according to a story in online magazine Computerworld.

The codes, which would enable someone to enter secure areas at 16 Japanese airports and one in Guam, including Tokyo's Narita and Haneda airports, are used to gain access to areas normally off limits to passengers and are known to numerous airport employees, Computerworld reported.

The chipmaker is working on hardware-based security protection that will tell people when a rootkit is being downloaded to their PC, according to a report in ITObserver. The plan is to put a small chip on the motherboard to do this, Intel said at a press and analyst event in Folsom, Calif., on Thursday.

The move comes as Sony works to pull itself out of an embroglio over rootkit-like tool included in the antipiracy software on some of its CDs.

Internet Security Systems is holding back details on serious flaws in Cisco Systems products, according to Michael Lynn, the security researcher at the Black Hat security confab in July hacked into Cisco a Cisco router.

Lynn told Wired News that ISS, his former employer, has known about several more flaws in Cisco's Internetwork Operating System, IOS, but hasn't told the networking giant. These flaws could allow a remote attacker to gain control over or crash Cisco switches and routers, he told Wired.

An ISS representative told Wired that it has no knowledge of additional, undisclosed flaws. Lynn now … Read more