Computers & Security, 17 (1998) 715-720

Abstracts of Recent Articles and Literature John Meyer

Netscape offers new security tool, Carol Sliwu. Netscape Communications Corp. has announced its Netscape Security Services product, which enables developers to build security services into their appli- cations. Versions of the product range in price from $70 000 - $150 000, with the high-end version being certified to FIPS 140-I. Although the product is ini- tially targeted at independent software vendors, it can also prove beneficial to corporate developers who wish to add SSL encryption, authentication or other PKI security to their applications. Phil Schacter of the Midvale, Utah-based Burton Group commented that, “Big IT groups have been given the mandate to cre- ate custom application code to support new extranet applications.“. . . . “They don’t have to work at the pro- tocol level.” Comnputenvorld, October 19, 1998, p. 54.

ISS finds security ANSA, Job Leyden. The indus- try has recently announced the formation of the Adaptive Network Security Alliance (ANSA), a grouping of security vendors which are seeking to integrate their products to enable them to respond more rapidly to hacker attacks.The group, formed by Internet Security Systems (ISS), and including such vendors as 3Com, Check Point and HP, has made available four modules for network systems develop- ers, which enable vendors to ensure that their products will work with those of third parties when detecting

security threats. The modules include: a decision sup- port module that helps users integrate all security log data; a ‘lock down kit’ which enables tests against the security of a company’s infrastructure; an active response module which enables firewalls to become more robust if a security threat is raised; and an adap- tive network security management tool which allows the integration of all these components into existing network management systems. Network New, 28

Octobev, 1998. p. 2.

Spate of hacking lets the cat out of the bag,Joohn Leynen. Three US teenagers have hacked into the databank of Dalco Electronics, an Ohio-based elec- tronic accessories retailer, and stolen 8000 electronic invoices for credit card orders placed over the Internet. One of the hackers in an IRC interview said that the group had installed software allowing the cap- ture of 4.3Mb of archived credit-card orders and a 15Mb Microsoft Of&e inventory database.The attack was accomplished by uploading an FTP server pro- gram, Serv-U, to the Web retailer’s server. With the programs default directory set to the target machine’s hard drive, and the program running, the hackers were able to browse directories and steal data. In a separate attack, hackers reportedly broke into the network of the heavy equipment manufacturer Caterpillar, and obtained root privileges on several Unix servers. The

0167-4048/98$19.00 0 1998 Elsevier Science Ltd. All rights reserved 715