All Categories : Servers & Networks

Maximum Security:

A Hacker's Guide to Protecting Your Internet Site and Network

---

- A -

How to Get More Information

This appendix is designed to provide you with some of the sources consulted in this book, as well as sites (or documents) that can assist you in better understanding security.

Establishment Resources

Following is a list of resources. This list includes articles, papers, or tools. The majority were authored or created by individuals working in security.

Sites on the WWW

General Accounting Office: Information Security: Computer Attacks at Department of Defense Pose Increasing Risks. A report on failed security at U.S. Defense sites.

• http://www.epic.org/security/GAO_OMB_security.html

The Evaluated Products List (EPL). This is a list of products that have been evaluated for security ratings based on DoD guidelines.

• http://www.radium.ncsc.mil/tpep/epl/index.html

InterNIC (the Network Information Center). InterNIC provides comprehensive databases on networking information. These databases contain the larger portion of collected knowledge on the design and scope of the Internet. Of main importance here is the database of RFC documents.

• http://ds0.internic.net/ds/dspg1intdoc.html

The Rand Corporation. This site contains security resources of various sorts as well as engrossing early documents on the Internet's design.

• http://www.rand.org/publications/electronic/

Connected: An Internet Encyclopedia. This is an incredible online resource for RFC documents and related information, painstakingly translated into HTML.

• http://www.freesoft.org/Connected/RFC/826/

The Computer Emergency Response Team (CERT). CERT is an organization that assists sites in responding to network security violations, break-ins, and so forth. This is a great source of information, particularly for vulnerabilities.

• http://www.cert.org

Dan Farmer: Security Survey of Key Internet Hosts and Various Semi-Relevant Reflections. This is a fascinating independent study conducted by one of the authors of the now famous SATAN program. The survey involved approximately 2,200 sites; the results are disturbing.

• http://www.trouble.org/survey/

U.S. Department of Energy's Computer Incident Advisory Capability (CIAC). CIAC provides computer security services to employees and contractors of the U.S. Department of Energy, but the site is open to the public as well. There are many tools and documents at this location.

• http://ciac.llnl.gov/

The National Computer Security Association. This site contains a great deal of valuable security information, including reports, papers, advisories, and analyses of computer security products and techniques.

• http://www.ncsa.com/

Short Courses in Information Systems Security at George Mason University. This site contains information about security courses. Moreover, you'll find links to a comprehensive bibliography of security-related documents.

• http://www.isse.gmu.edu:80/~gmuisi/

NCSA RECON. This is the site of the National Computer Security Association's special division. It offers a service where one can search through thousands of downloaded messages passed among hackers and crackers on BBS boards and the Internet. This commercial site is an incredible security resource.

• http://www.isrecon.ncsa.com/public/faq/isrfaq.htm

Lucent Technologies. This site contains information about courses on security from the folks who really know security.

• http://www.attsa.com/

Massachusetts Institute of Technology Distribution Site of Pretty Good Privacy (PGP) for U.S. Residents. PGP provides some of the most powerful, military-grade encryption currently available.

• http://web.mit.edu/network/pgp.html

The Anonymous Remailer FAQ. This document covers all aspects of anonymous remailing techniques and tools.

• http://www.well.com/user/abacard/remail.html

The Anonymous Remailer List. This is a comprehensive but often-changing list of anonymous remailers.

• http://www.cs.berkeley.edu/~raph/remailer-list.html

Microsoft ActiveX Security. This page addresses the security features of ActiveX.

• http://www.microsoft.com/security

Purdue University COAST Archive. This is one of the more comprehensive security sites, containing many tools and documents of deep interest to the security community.

• http://www.cs.purdue.edu//coast/archive/

Raptor Systems. The makers of one of the better firewall products on the Net have established a fine security library.

• http://www.raptor.com/lib/index.html

The Risks Forum. This is a moderated digest of security and other risks in computing. This great resource is also searchable. With it, you can tap the better security minds on the Net.

• http://catless.ncl.ac.uk/Risks

Forum of Incident Response and Security Teams (FIRST). FIRST is a conglomeration of many organizations undertaking security measures on the Net. This powerful organization is a good starting place for sources.

• http://www.first.org/

The CIAC Virus Database. This is the ultimate virus database on the Internet. It's an excellent resource for learning about viruses that can affect your platform.

• http://ciac.llnl.gov/ciac/CIACVirusDatabase.html

Information Warfare and Information Security on the Web. This is a comprehensive list of links and other resources concerning information warfare over the Internet.

• http://www.fas.org/irp/wwwinfo.html

Criminal Justice Studies of the Law Faculty of University of Leeds, The United Kingdom. This site boasts interesting information on cryptography and civil liberties.

• http://www.leeds.ac.uk/law/pgs/yaman/cryptog.htm

Federal Information Processing Standards Publication Documents (Government Guidelines). The National Institute of Standards and Technology reports on DES encryption and related technologies.

• http://csrc.nist.gov/fips/fips46-2.txt

Wordlists Available at NCSA and Elsewhere. This site is for use in testing the strength of, or cracking, UNIX passwords.

• http://sdg.ncsa.uiuc.edu/~mag/Misc/Wordlists.html

Department of Defense Password Management Guideline. This is a treatment of password security in classified environments.

• http://www.alw.nih.gov/Security/FIRST/papers/password/dodpwman.txt

Dr. Solomon's. This site is filled with virus information. Anyone concerned with viruses (or anyone who just wants to know more about virus technology) should visit Dr. Solomon's site.

• http://www.drsolomon.com/vircen/allabout.html

The Seven Locks Server. This is an eclectic collection of security resources, including a number of papers that cannot be found elsewhere!

• http://www.sevenlocks.com/

S/Key Informational Page. This site provides information on S/Key and the use of one-time passwords in authentication.

• http://medg.lcs.mit.edu/people/wwinston/skey-overview.html

A Page Devoted to ATP, the "Anti-Tampering Program." In some ways, ATP is similar to Tripwire or Hobgoblin.

• http://www.cryptonet.it/docs/atp.html

Bugtraq Archives. This is an archive of the popular mailing list, Bugtraq, one of the most reliable sources for up-to-date reports on new-found vulnerabilities in UNIX (and at times, other operating systems).

• http://geek-girl.com/bugtraq/

Wang Federal. This company produces high-quality security operating systems and other security solutions. It is the leader in TEMPEST technology.

• http://www.wangfed.com

The Center for Secure Information Systems. This site, affiliated with the Center at George Mason University, has some truly incredible papers. There is much cutting-edge research going on here. The following URL sends you directly to the publications page, but you really should explore the entire site.

• http://www.isse.gmu.edu/~csis/publication.html

SRI International. This site boasts some very highbrow technical information. The technical reports here are of extreme value. However, you must have at least a fleeting background in security to even grasp some of the concepts.

• http://www.sri.com/

The Security Reference Index. This site, maintained by the folks at telstra.com, is a comprehensive pointer page to many security resources.

• http://www.telstra.com.au/info/security.html

Wietse Venema's Tools Page. This page, maintained by Wietse Venema (co-author of SATAN, author of TCP_Wrapper and many other security tools), is filled with papers, tools, and general information. It is a must-visit for any UNIX system administrator.

• ftp://ftp.win.tue.nl/pub/security/index.html

Books, Reports, and Publications

United States. Congress. House. Committee on Science, Space, and Technology. Subcommittee on Science.

Internet security: Hearing Before the Subcommittee on Science of the Committee on Science, Space, and Technology. U.S. House of Representatives, One Hundred Third Congress, second session, March 22, 1994. Washington. U.S. G.P.O. For sale by the U.S. G.P.O., Supt. of Docs., Congressional Sales Office, 1994.

An Interactive Guide to the Internet. Que Education and Training. J. Michael Blocher, Vito Amato, and Jon Storslee. ISBN: 1-5757-6354-0. 1996.

Apache Server Survival Guide. Sams.net. Manuel Alberto Ricart. ISBN: 1-57521-175-0. 1996.

Bots and Other Internet Beasties. Sams.net. Joseph Williams. ISBN: 1-57521-016-9. 1996.

Designing and Implementing Microsoft Internet Information Server. Sams.net. Weiying Chen, Sanjaya Hettihewa, Arthur Knowles, and Paolo Pappalardo. ISBN: 1-57521-168-8. 1996.

E-Mail Security: How To Keep Your Electronic Messages Private. John Wiley & Sons. Bruce Schneier. ISBN: 0-471-05318-X. 1995.

Firewalls and Internet Security: Repelling the Wily Hacker. Addison-Wesley Publishing Company. William R. Cheswick and Steven M. Bellovin. ISBN: 0-201-63357-4. 1994.

Halting the Hacker: A Practical Guide to Computer Security. Prentice Hall. Donald L. Pipkin. ISBN: 0-13-243718. 1997.

Internet 1997 Unleashed, Second Edition. Sams.net. Jill Ellsworth, Billy Barron, et al. ISBN: 1-57521-185-8. 1996.

Internet Commerce. New Riders. Andrew Dahl and Leslie Lesnick. ISBN: 1-56205-496-1. 1995.

Internet Firewalls and Network Security, Second Edition. New Riders. Chris Hare and Karanjit S. Siyan, Ph.D. ISBN: 1-56205-632-8. 1996.

Internet QuickKIT. Hayden. Brad Miser. ISBN: 1-56830-240-1.

Internet Research Companion. Que Education and Training. Geoffrey McKim. ISBN: 1-5757-6050-9. 1996.

Internet Security for Business. John Wiley & Sons. Terry Bernstein, Anish B. Bhimani, Eugene Schultz, and Carol A. Siegel. ISBN 0-471-13752-9. 1996.

Internet Security Professional Reference. New Riders. Chris Hare, et al. ISBN: 1-56205-557-7. 1996.

Internet Security Resource Library (Box Set). New Riders. ISBN: 1-56205-506-2. 1996.

Linux System Administrator's Survival Guide. Sams Publishing. Timothy Parker, Ph.D. ISBN: 0-672-30850-9. 1996.

Managing Windows NT Server 4. New Riders. Howard F. Hilliker. ISBN: 1-56205-576-3. 1996.

Microsoft Internet Information Server 2 Unleashed. Sams.net. Arthur Knowles. ISBN: 1-57521-109-2. 1996.

NetWare Security. New Riders. William Steen. ISBN: 1-56205-545-3. 1996.

PC Week Intranet and Internet Firewalls Strategies. Ziff-Davis Press. Ed Amoroso and Ronald Sharp. ISBN: 1-56276-422-5. 1996.

Practical UNIX & Internet Security, Second Edition. O'Reilly & Associates. Simson Garfinkel and Gene Spafford. ISBN: 1-56592-148-8. 1996.

Protection and Security on the Information Superhighway. John Wiley & Sons. Frederick B. Cohen. ISBN: 0-471-11389-1. 1995.

The Internet Unleashed 1996. Sams.net. Sams Development Group. ISBN: 1-57521-041-X. 1995.

The Underground Guide to UNIX: Slightly Askew Advice from a UNIX Guru. Addison-Wesley Publishing Company. John Montgomery. ISBN: 0-201-40653-5. 1995.

UNIX Installation Security and Integrity. Prentice Hall. David Ferbrache and Gavin Shearer. ISBN: 0-13-015389-3. 1993.

UNIX Security: A Practical Tutorial (UNIX/C). McGraw-Hill. N. Derek Arnold. ISBN: 0-07-002560-6. 1993. Contains source code for a possible UNIX virus!

UNIX Security for the Organization. Sams Publishing. R. Bringle Bryant. ISBN: 0-672-30571-2. 1994.

UNIX System Security. Addison-Wesley Publishing Company. David A. Curry. ISBN: 0-201-56327-4. 1992.

UNIX System Security Essentials. Addison-Wesley Publishing Company. Christoph Braun and Siemens Nixdorf. ISBN: 0-201-42775-3. 1995.

UNIX System Security: How to Protect Your Data and Prevent Intruders. Addison-Wesley Publishing Company. Rick Farrow. ISBN: 0-201-57030-0. 1991.

UNIX Unleashed. Sams Publishing. Sams Development Team (Susan Peppard, Pete Holsberg, James Armstrong Jr., Salim Douba, S. Lee Henry, Ron Rose, Richard Rummel, Scott Parker, Ann Marshall, Ron Dippold, Chris Negus, John Valley, Jeff Smith, Dave Taylor, Sydney Weinstein, and David Till). ISBN: 0-672-30402-3. 1994.

Windows NT Server 4 Security, Troubleshooting, and Optimization. New Riders. ISBN: 1-56205-601-8. 1996.

Novell

A Guide to NetWare for UNIX. Prentice Hall. Cathy Gunn. ISBN: 0-13-300716-2. 1995.

NetWare to Internet Gateways. Prentice Hall. James E. Gaskin. ISBN: 0-13-521774-1. 1996.

NetWare Unleashed, Second Edition. Sams Publishing. Rick Sant'Angelo. 1995.

NetWare Web Development. Sams Publishing. Peter Kuo. ISBN: 1-57521-188-6. 1996.

Novell's Guide to Integrating NetWare and TCP/IP. Novell Press/IDG Books. Drew Heywood. ISBN: 1-56884-818-8. 1996.

Novell's Guide to NetWare LAN Analysis. Sybex. Dan E. Hakes and Laura Chappell. ISBN: 0-7821-1143-2. 1994.

The Complete Guide to NetWare 4.1. Sybex. James E. Gaskin. ISBN: 0-7821-1500A. 1995.

The NetWare to Internet Connection. Sybex. Morgan Stern. ISBN: 0-7821-1706-6. 1996.

Windows NT

Inside The Windows NT File System. Microsoft Press. Helen Custer. ISBN: 1-55615-660-X. 1994.

Inside Windows NT Server 4. New Riders. Drew Heywood. ISBN: 1-56205-649-2. 1996.

Managing Windows NT Server 4. New Riders. Howard Hilliker. ISBN: 1-56205-576-3. 1996.

Microsoft Windows NT Workstation 4.0 Resource Kit. Microsoft Press. ISBN: 1-57231-343-9. 1996.

NT Server: Management and Control. Prentice Hall. Kenneth L. Spencer. ISBN: 0-13-107046-0. 1995.

Windows NT 4 Electronic Resource Kit. Sams.net. ISBN: 0-67231-032-5.

Windows NT Administration: Single Systems to Heterogeneous Networks. Prentice Hall. Marshall Brain and Shay Woodard. ISBN: 0-13-176694-5. 1994.

Peter Norton's Complete Guide to Windows NT 4.0 Workstation. Sams Publishing. Peter Norton and John Paul Mueller. ISBN: 0-672-30-901-7. 1996.

General

A Guide to Understanding Discretionary Access Control in Trusted Systems. Technical Report NCSC-TG-003, National Computer Security Center, 1987.

A Model of Atomicity for Multilevel Transactions. 1993 IEEE Computer Society Symposium on Research in Security and Privacy; Oakland, California. Barbara T. Blaustein, Sushil Jajodia, Catherine D. McCollum, and LouAnna Notargiacomo (MITRE). USA: IEEE Computer Society Press. ISBN: 0-8186-3370-0. 1993.

Authentication and Discretionary Access Control. Karger, Paul A. Computers & Security, Number 5, pp. 314-324, 1986.

Beyond the Pale of MAC and DAC--Defining New Forms of Access Control. Catherine J. McCollum, Judith R. Messing, and LouAnna Notargiacomo. SympSecPr, pp. 190-200, IEEECSP, May 1990.

Computer Crime: A Crimefighter's Handbook. O'Reilly & Associates. David Icove, Karl Seger, and William VonStorch. ISBN: 1-56592-086-4. 1995.

Computer Security Basics. O'Reilly & Associates. Deborah Russell and G.T. Gangemi Sr. ISBN: 0-937175-71-4. 1991.

Computer Security: Hackers Penetrate DoD Computer Systems. Testimony before the Subcommittee on Government Information and Regulation, Committee on Government Affairs. United States Senate, Washington DC, November 1991.

Cyberpunk: Outlaws and Hackers on the Computer Frontier. Simon and Schuster. Katie Hafner and John Markoff. ISBN: 0-671-68322-5. 1991.

DCE Security Programming. Wei Hu. O'Reilly & Associates. ISBN: 1-56592-134-8. 1995.

Extended Discretionary Access Controls. S. T. Vinter. SympSecPr, pp. 39-49, IEEECSP, April 1988.

How to Set Up and Maintain a World Wide Web Site: The Guide for Information Providers. Addison-Wesley Publishing Company. Lincoln D. Stein. ISBN: 0-201-63389-2. 1995.

Internet Security Secrets. IDG Books. John R. Vacca. ISBN: 1-56884-457-3. 1996.

Managing Internet Information Systems. O'Reilly & Associates. Cricket Liu, Jerry Peek, Russ Jones, Bryan Buus, and Adrian Nye. ISBN: 1-56592-051-1. 1994.

Microsoft's PFX: Personal Information Exchange APIs. Microsoft Corporation (http://www.microsoft.com/workshop/prog/security/misf11-f.htm).

Network and Internetwork Security: Principles and Practice. IEEE Computer Society Press/Prentice Hall. William Stallings. ISBN: 0-02-415483-0. 1995.

Network Security: How to Plan for It and Achieve It. McGraw-Hill. Richard H. Baker. ISBN: 0-07-005141-0. 1994.

Network Security: Protocol Reference Model and The Trusted Computer System Evaluation Criteria. M. D. Abrams and A. B. Jeng. IEEE Network, 1(2), pp. 24-33, April 1987.

Protect Your Privacy: The PGP User's Guide. Prentice Hall. William Stallings. ISBN: 0-13-185596-4. 1994.

Secure Databases. 1993 IEEE Computer Society Symposium on Research in Security and Privacy; Oakland, California. USA: IEEE Computer Society Press. ISBN: 0-8186-3370-0. 1993.

Secure Networking at Sun Microsystems Inc. Katherine P. Addison and John J. Sancho. 11th NCSC; 1988. Baltimore. USA: NBS/NCSC: pp.212-218.

STRAWMAN Trusted Network Interpretation Environments Guideline. Marshall Abrams, Martin W. Schwartz, and Samuel I. Schaen (MITRE). 11th NCSC; 1988 Oct 17; Baltimore. USA: NBS/NCSC: pp.194-200.

Java

Briki: A Flexible Java Compiler. Michael Cierniak and Wei Li. TR 621, URCSD, May 1996.

• ftp://ftp.cs.rochester.edu/pub/papers/systems/96.tr621.Briki_a_flexible_java_compiler.ps.gz

Developing Intranet Applications with Java. Sams.net. Jerry Ablan, William Robert Stanek, Rogers Cadenhead, and Tim Evans. ISBN: 1-57521-166-1. 1996.

Gamelan. The ultimate Java archive.

• http://www-a.gamelan.com/index.shtml

H-38: Internet Explorer 3.x Vulnerability. CIAC Advisory, March 4, 1997.

• http://ciac.llnl.gov/ciac/bulletins/h-38.shtml

Internet Java & ActiveX Advisor. Journal.

• http://www.advisor.com/ia.ht

Javaworld. Journal.

• http://www.javaworld.com/

Java & HotJava: Waking Up the Web. Sean González. PC Magazine, October 1995.

• http://www.zdnet.com/~pcmag/issues/1418/pcm00085.htm

Java as an Intermediate Language. Technical Report, School of Computer Science, Carnegie Mellon University, Number CMU-CS-96-161, August 1996.

• http://www.cs.cmu.edu/afs/cs.cmu.edu/project/scandal/public/papers/CMU-CS-96-161.ps.Z

Java Developer's Guide. Sams.net. Jamie Jaworski and Cary Jardin. ISBN: 1-57521-069-X. 1996.

Java Developer's Journal.

• http://www.javadevelopersjournal.com/java/

Java Developer's Reference. Sams.net. Mike Cohn, Michael Morrison, Bryan Morgan, Michael T. Nygard, Dan Joshi, and Tom Trinko. ISBN: 1-57521-129-7. 1996.

Java in a Nutshell: A Desktop Quick Reference for Java Programmers. O'Reilly & Associates. David Flanagan. ISBN: 1-56592-183-6. 1996.

Java Report. Journal.

• http://www.sigs.com/jro/

Java Security. SIGS. Gary McGraw and Edward Felten. ISBN: 1-884842-72-0. 1996.

Java Security: From HotJava to Netscape and Beyond. Drew Dean, Edward W. Felten, and Dan S. Wallach. 1996 IEEE Symposium on Security and Privacy, Oakland, CA, May 1996.

Java Security: Hostile Applets, Holes, & Antidotes. John Wiley & Sons. Gary McGraw and Ed Felten. ISBN: 0-471-17842-X. 1996.

Java: The Inside Story. Michael O'Connell. Sunworld Online, Volume 07, July 1995.

• http://www.sun.com/sunworldonline/swol-07-1995/swol-07-java.html

Just Java, Second Edition. Sunsoft Press/Prentice Hall. Peter van der Linden. ISBN: 0-13-272303-4. 1996.

MIME Encapsulation of Aggregate Applet Objects (Mapplet). A. Bahreman, J. Galvin, R. Narayanaswamy.

• http://src.doc.ic.ac.uk/computing/internet/internet-drafts/draft-bahreman-mapplet-spec-00.txt.Z

NetProf: Network-Based High-Level Profiling of Java Bytecode. Srinivasan Parthasarathy, Michael Cierniak, and Wei Li. TR 622, URCSD, May 1996.

• ftp://ftp.cs.rochester.edu/pub/papers/systems/96.tr622.NetProf_network-based_high-level_profiling_of_java_bytecode.ps.g z

The Java Handbook. Osborne/McGraw-Hill. Patrick Naughton. ISBN: 0-07-882199-1. 1996.

The Java Language Specification. Addison-Wesley Publishing Company. James Gosling, Bill Joy, and Guy Steele. ISBN: 0-201-63451-1. 1996.

Databases and Security

A Personal View of DBMS Security in Database Security: Status and Prospects. F. Manola. C.E. Landwehr (ed.), Elsevier Science Publishers B.V., North Holland, 1988. GTE Labs. December 1987.

A Policy Framework for Multilevel Relational Databases. Xiaolei Qian and Teresa F. Lunt. SRI-CSL-94-12, August 1994.

A Secure Concurrency Control Protocol for Real-Time Databases. R. Mukkamala, Old Dominion University, and S. H. Son, University of Virginia. IFIP WG 11.3 Working Conference on Database Security, Rensselaerville, New York, August 13-16, 1995.

A Security Model for Military Message System. C. E. Landwehr, C. L Heitmeyer, and J. McLean. ACM Transactions on Computer Systems, 2(3), August 1984.

Access Control: Principles and Practice. R.S. Sandhu and P. Saramati. IEEE Communications, pp. 2-10. 1994.

An Extended Authorization Model for Relational Databases. E. Bertino, P. Samarati, and S. Jajodia. IEEE Transactions on Knowledge and Data Engineering, Volume 9, Number 1, 1997, pp. 85-101.

• http://www.isse.gmu.edu/~csis/publications/ieee-97.ps

Authorizations in Relational Database Management Systems. E. Bertino, S. Jajodia, and P. Saramati. ACM Conference on Computer and Communications Security, Fairfax, VA, 1993. pp. 130-139.

Decentralized Management of Security in Distributed Systems. R.S. Sandhu, DSOM. 1991.

• http://www.list.gmu.edu/~sandhu/papers/confrnc/misconf/ps_ver/dsom91.ps

Ensuring Atomicity of Multilevel Transactions. P. Ammann, S. Jajodia, and I. Ray. IEEE Symposium on Research in Security and Privacy. Oakland, CA, May 1996. pp. 74-84.

• http://www.isse.gmu.edu/~csis/publications/oklnd96-indrksi.ps

Formal Query Languages for Secure Relational Databases. M. Winslett, K. Smith and X. Qian. ACM TODS, 19(4):626-662. 1994.

Honest Databases That Can Keep Secrets. R. S. Sandhu and S. Jajjodia, NCSC.

• http://www.list.gmu.edu/~sandhu/papers/confrnc/ncsc/ps_ver/b91poly.ps

Locking Protocol for Multilevel Secure Databases Providing Support for Long Transactions. S. Pal, Pennsylvania State University. IFIP WG 11.3 Working Conference on Database Security, Rensselaerville, New York, August 13-16, 1995.

Messages, Communications, Information Security: Protecting the User from the Data. J. E. Dobson and M. J. Martin, University of Newcastle. IFIP WG 11.3 Working Conference on Database Security, Rensselaerville, New York, August 13-16, 1995.

Microsoft Access 2.0 Security. Tom Lucas. PC Solutions.

• http://www.pc-solutionsinc.com/lucasec.html

Multilevel Security for Knowledge Based Systems. Thomas D. Garvey and Teresa F. Lunt. SRI-CSL-91-01, February 1991. Stanford Research Institute.

On Distributed Communications: IX. Security, Secrecy and Tamper-Free Considerations. P. Baran. Technical Report, The Rand Corporation. Number RM-376, August 1964.

Role-Based Access Controls. D.F. Ferraiolo and R. Kuhn. NIST-NCSC National Computer Security Conference, Baltimore, MD, 1993. pp. 554-563.

Symposium on the Global Information Infrastructure: Information, Policy & International Infrastructure. Paul A. Strassmann, U.S. Military Academy West Point and Senior Advisor, SAIC; William Marlow, Senior Vice President, SAIC. January 28-30, 1996.

The Microsoft Internet Security Framework (MISF) Technology for Secure Communication, Access Control, and Commerce. " 1997 Microsoft Corporation. (All rights reserved.)

• http://www.microsoft.com/intdev/security/

Trusted Database Management System. NCSC-TG-021. Trusted Database Management System Interpretation. April 1991. Chief, Technical Guidelines Division. ATTN: C11 National Computer Security Center Ft. George G. Meade, MD 20755-6000.

Why Safeguard Information? Computer Audit Update, Elsevier Advanced Technology, 1996. Abo Akademi University, Institute for Advanced Management Systems Research, Turku Centre for Computer Science. Thomas Finne.

• http://www.tucs.abo.fi/publications/techreports/TR38.html

Articles

"Accountability Is Key to Democracy in the Online World." Walter S. Mossberg. The Wall Street Journal. Thursday January 26, 1995.

"ActiveX Used as Hacking Tool." Wingfield, N. CNET News, February 7, 1997.

• http://www.news.com/News/Item/0,4,7761,4000.html?latest

"Alleged Computer Stalker Ordered Off Internet." Stevan Rosenlind. McClatchy News Service. July 26, 1995.

"A Tiger Team Can Save You Time and Money and Improve Your Ability to Respond to Security Incidents." Peter Galvin. SunWorld Online. February 1996.

• http://www.sandcastle-ltd.com/articles.html

"Billions and Billions of Bugs." Peter Galvin. SunWorld Online.

• http://www.sun.com/sunworldonline/swol-03-1996/swol-03-security.html

"Breaches From Inside Are Common." Infosecurity News. January/February 1997.

"CYBERWAR IS COMING!" John Arquilla and David Ronfeldt. International Policy Department, Rand Corporation. 1993. Taylor & Francis. ISSN: 0149-5933-93.

"Digital IDs Combat Trojan Horses on the Web." Bray, H. Computer News Daily. February 1997.

• http://computernewsdaily.com/live/Latest_columns/052_022197_124200_25016.html

"FBI Investigates Hacker Attack at World Lynx." B. Violino. InformationWeek Online. November 12, 1996.

• http://techweb.cmp.com/iw/newsflash/nf605/1112_st2.htm

"Gang War in Cyberspace." Slatalla, M. and Quitner, J. Wired, Volume 2, Number 12. December, 1994.

• http://www.hotwired.com/wired/2.12/features/hacker.html

"KC Wrestles With Equipment Theft Problem." Timothy Heider. Kansas City Star. February 17, 1997.

• http://www.isecure.com/newslet.htm

"Macros Under the Microscope: To Stop the Spread of Macro Viruses, First Understand How They Work." Kenneth R. van Wyk. Infosecnews.

• http://www.infosecnews.com/article5.htm

"Network Security Throughout the Ages." Jeff Breidenbach. 1994. Switzerland (Project MAC) Association. MIT Project on Mathematics and Computation.

"New York's Panix Service Is Crippled by Hacker Attack." Robert E. Calem. The New York Times. September 14, 1996.

"Pentagon Web Sites Closed After Visit from Hacker." Nando.net News Service. December 30, 1996.

• http://www.nando.net/newsroom/ntn/info/123096/info1_29951.html

"Post Office Announces Secure E-Mail." Boot. March 1997.

"SATAN Uncovers High Risk of Web Attack." S. L. Garfinkel. San Jose Mercury News. December 19, 1996.

• http://www1.sjmercury.com/business/compute/satan1218.htm

"Secure Your Data: Web Site Attacks On The Rise!" Stewart S. Miller. Information Week. January 29, 1996.

"Security and the World Wide Web." D. I. Dalva. Data Security Letter. June, 1994.

• http://www.ja.net/newsfiles/janinfo/cert/Dalva/WWW_security.html

"Security Is Lost in Cyberspace." News & Observer. February 21, 1995.

• http://www.nando.net/newsroom/ntn/info/other/02219540865.html

"Statement Before Senate Subcommittee on Governmental Operations." June 25, 1996. John Deutch, Director, CIA.

"Student's Expulsion Over E-Mail Use Raises Concern." Amy Harmon. Los Angeles Times. November 15, 1995.

• http://www.caltech.edu/~media/times.html

"The First Internet War; The State of Nature and the First Internet War: Scientology, its Critics, Anarchy, and Law in Cyberspace." David G. Post. Reason Magazine. April, 1996.

• http://www.cli.org/DPost/X0003_ARTICLE4.html

"The Paradox of the Secrecy About Secrecy: The Assumption of A Clear Dichotomy Between Classified and Unclassified Subject Matter." Paul Baran. MEMORANDUM RM-3765-PR; August 1964, On Distributed Communications: IX Security, Secrecy, and Tamper-Free Considerations. The Rand Corporation.

"U.S. Files Appeal in Dismissed Baker Case." Zachary M. Raimi. The Michigan Daily. November 22, 1995.

"What's the Plan? Get a Grip on Improving Security Through a Security Plan." Peter Galvin. SunWorld Online. September 1995.

• http://www.sun.com/sunworldonline/swol-09-1995/swol-09-security.html

"Windows NT Security Questioned: Experts Say Hackers Could Gain Entry to System." Stuart J. Johnston (http://www.informationweek.com). CMP Media, Techweb.

• http://techweb.cmp.com/iw/610/10iunt.htm

Tools

Following is a list of tools. Some of these tools were coded by the establishment (the legitimate security community). Others were authored by amateur hackers and crackers.

Password Crackers

Crack: Cracks UNIX passwords on UNIX platforms.

• http://ciac.llnl.gov/ciac/ToolsUNIXNetSec.html

MacKrack v2.01b1: Cracks UNIX passwords on the MacOS platform.

• http://www.borg.com/~docrain/mac-hack.html

CrackerJack: Cracks UNIX passwords on the Microsoft platform.

• http://www.fc.net/phrack/under/misc.html

PaceCrack95: Cracks UNIX passwords on the Windows 95 platform.

• http://tms.netrom.com/~cassidy/crack.htm

Qcrack: Cracks UNIX passwords on DOS, Linux, and Windows platforms.

• http://tms.netrom.com/~cassidy/crack.htm

John the Ripper: Cracks UNIX passwords on the DOS and Linux platforms.

• http://tms.netrom.com/~cassidy/crack.htm

Pcrack (PerlCrack): Cracks UNIX passwords on the UNIX platform.

• http://tms.netrom.com/~cassidy/crack.htm

Hades: This UNIX password cracker is available everywhere. Try the search string hades.zip.

Star Cracker: This utility is for the DOS4GW environment. It cracks UNIX passwords.

• http://citus.speednet.com.au/~ramms/

Killer Cracker: Cracks UNIX passwords under UNIX.

• http://www.ilf.net/~toast/files/

Hellfire Cracker: Cracks UNIX passwords on the DOS platform.

• http://www.ilf.net/~toast/files/

XIT: Cracks UNIX passwords on the DOS platform.

• http://www.ilf.net/~toast/files/xit20.zip

Claymore: A generalized password cracker for Windows.

• http://www.ilf.net/~toast/files/claym10.zip

Guess: Cracks UNIX passwords on the DOS platform. This utility is available everywhere. Try the search string guess.zip.

PC UNIX Password Cracker: The name of this utility says it all. This tool is hard to find; I know of no reliable locations, but you might try the name as a search string.

ZipCrack: Cracks the passwords on Zip archives. Try the search string zipcrk10.zip.

Password NT: Cracks NT passwords.

• http://www.omna.com/yes/AndyBaron/recovery.htm

Sniffers

Gobbler: Sniffs in the DOS environment. This tool is good for sniffing Novell NetWare networks.

• http://www.macatawa.org/~agent43/gobbler.zip

ETHLOAD: Sniffs Ethernet and token ring networks.

• ftp://oak.oakland.edu/SimTel/msdos/lan/ethld104.zip

Netman: Awesome sniffer suite for use on UNIX platforms.

• http://www.cs.curtin.edu.au/~netman/

Esniff.c: Sniffer for use on UNIX machines (specifically SunOS and Solaris).

• http://pokey.nswc.navy.mil/Docs/Progs/ensnif.txt

Sunsniff: The title says it all. This utility is a good sniffer for SunOS.

• http://mygale.mygale.org/08/datskewl/elite/

linux_sniffer.c: Runs on the Linux platform.

• http://www.hacked-inhabitants.com/warez/

Nitwit.c: For use on the Sun platform.

• www.catch22.com/Twilight.NET/phuncnet/hacking/proggies/sniffers/nitwit.c

Scanners and Related Utilities

NSS: Network Security Scanner. Written in Perl, runs on UNIX.

• http://www.giga.or.at/pub/hacker/unix

Strobe: Runs on UNIX.

• http://sunsite.kth.se/Linux/system/Network/admin/

SATAN: Runs on UNIX; you must have Perl.

• http://www.fish.com

Jakal: Runs on UNIX. Scans behind firewalls.

• http://www.giga.or.at/pub/hacker/unix

IdentTCPscan: Runs on UNIX; identifies the UID of all running processes.

• http://www.giga.or.at/pub/hacker/unix

CONNECT: Are you looking for a vulnerable TFTP server? Try this utility. It runs on UNIX.

• http://www.giga.or.at/pub/hacker/unix/

FSPScan: This UNIX utility identifies vulnerable FSP servers.

• http://www.giga.or.at/pub/hacker/unix

XSCAN: Locates vulnerable X servers.

• http://www.giga.or.at/pub/hacker/unix

NetScan Tools: Win95 port of many UNIX snooping utilities.

• http://www.eskimo.com/~nwps/index.html

Network Toolbox: Runs on Windows 95. Has many common UNIX snooping utilities and a port scanner.

• http://www.jriver.com/netbox.html

IS User Information for Windows 95: A very good generalized network analysis tool.

• http://www.csn.net/~franklin/user_info.html

TCP/IP Surveyor: Microsoft platform.

• ftp://wuarchive.wustl.edu/systems/ibmpc/win95/netutil/wssrv32n.zip

MacTCP Watcher: TCP/IP analysis tool for the Macintosh platform.

• http://www.share.com/share/peterlewis/mtcpw/

Query It!: Nslookup utility for Mac.

• http://www.cyberatl.net/~mphillip/index.html#Query It!

WhatRoute: Port of the popular UNIX utility Traceroute to Mac.

• http://homepages.ihug.co.nz/~bryanc/

Destructive Devices

The UpYours Mail Bombing Program: To obtain UpYours, try the string upyours3.zip.

Kaboom: This device is an e-mail bomber. To obtain it, try the string kaboom3.exe.

Avalanche: This device is yet another mail-bombing utility. Avalanche is for Windows. Try the search string avalanche20.zip.

The UnaBomber: This utility is a mail bomber for the Windows platform. To obtain it, try the search string unabomb.exe.

eXtreme Mail: This utility is a mail bomber for the Windows platform. To obtain it, try the search string xmailb1.exe.

Homicide: This utility is a mail bomber for the Windows. platform. To obtain it, try the search string homicide.exe.

The UNIX MailBomb: This mail-bomb utility by CyBerGoAT works on all UNIX platforms. To obtain it, try the search string MailBomb by CyBerGoAT.

Bombtrack: This is a mail bombing utility for Macintosh.

FlameThrower: This is a Macintosh mail-bombing utility.

Finger Clients

WSFinger (Windows)

• ftp://papa.indstate.edu/winsock-l/finger/wsfngr14.zip

Macfinger (Macintosh)

• ftp://ftp.global.net.id/pub/mac/

FFEU (OS/2)

• http://www.musthave.com/OS2/

Technical Reports and Publications

"A Basis for Secure Communication in Large Distributed Systems." David P. Anderson and P. Venkat Rangan. UCB//CSD-87-328. January 1987.

• ftp://tr-ftp.cs.berkeley.edu/pub/tech-reports/csd/csd-87-328/

"A Cryptographic File System for UNIX." Matt Blaze. 1st ACM Conference on Computer and Communications Security. pp. 9-16. ACM Press. November, 1993.

Actually Useful Internet Security Techniques. New Riders. Larry J. Hughes, Jr. ISBN: 1-56205-508-9. 1995.

"A Network Perimeter With Secure External Access." Frederick M. Avolio and Marcus J. Ranum. An extraordinary paper that details the implementation of a firewall purportedly at the White House. Trusted Information Systems, Incorporated. Glenwood, MD. January 25, 1994.

• http://www.alw.nih.gov/Security/FIRST/papers/firewall/isoc94.ps

"A Prototype B3 Trusted X Window System." J. Epstein, J. Mc Hugh, R. Pascale, H. Orman, G. Benson, C. Martin, A. Marmor-Squires, B. Danner, and M. Branstad, The proceedings of the 7th Computer Security Applications Conference, December, 1991.

"A Security Architecture for Fault-Tolerant Systems." Michael K. Reiter, Kenneth P. Birman, and Robbert Van Renesse. TR93-1354. June 1993.

• http://cs-tr.cs.cornell.edu:80/Dienst/Repository/2.0/Body/ncstrl.cornell%2fTR93-1354/ocr

"Augmented Encrypted Key Exchange: a Password-Based Protocol Secure Against Dictionary Attacks and Password File Compromise." 1st ACM Conference on Computer and Communications Security, pp. 244-250. ACM Press. November 1993.

"Benchmarking Methodology for Network Interconnect Devices." RFC 1944. S. Bradner and J. McQuaid.

• ftp://ds.internic.net/rfc/rfc1944.txt

Building Internet Firewalls. D. Brent Chapman and Elizabeth D. Zwicky. O'Reilly & Associates. ISBN: 1-56592-124-0. 1995.

"Charon: Kerberos Extensions for Authentication over Secondary Networks." Derek A. Atkins. 1993.

"Check Point FireWall-1 Introduction." Checkpoint Technologies firewall Information.

• http://www.checkpoint.com/products/firewall/intro.html

"Cisco PIX Firewall." Cisco Systems firewall information.

• http://www.cisco.com/univercd/data/doc/cintrnet/prod_cat/pcpix.htm

"Comparison: Firewalls." LANTimes. June 17, 1996. Comprehensive comparison of a wide variety of firewall products.

• http://www.lantimes.com/lantimes/usetech/compare/pcfirewl.html

"Computer User's Guide to the Protection of Information Resources." NIST Special Publication.

• ftp.ffeu101.zipinternet/finger-15.hqx

"Covert Channels in the TCP/IP Protocol Suite." Craig Rowland. Rotherwick & Psionics Software Systems Inc.

• http://www.zeuros.co.uk/firewall/papers.htm

"Crack Version 4.1: A Sensible Password Checker for UNIX." A. Muffett. Technical Report, March 1992.

"Daemons And Dragons UNIX Accounting." Dinah McNutt. UNIX Review. 12(8). August 1994.

"Designing Plan 9." Rob Pike, Dave Presotto, and Ken Thompson. Dr. Dobb's Journal. Volume 16, p. 49. January 1, 1991.

"Dyad: A System for Using Physically Secure Coprocessors." Dr. (Professor) J. Douglas Tygar and Bennet Yee, School of Computer Science at Carnegie Mellon University.

• http://www.cni.org/docs/ima.ip-workshop/www/Tygar.Yee.html

"Evolution of a Trusted B3 Window System Prototype." J. Epstein, J. McHugh, R. Psacle, C. Martin, D. Rothnie, H. Orman, A. Marmor-Squires, M. Branstad, and B. Danner. In proceedings of the 1992 IEEE Symposium on Security and Privacy, 1992.

"Features of the Centri Firewall." Centri firewall information.

• http://www.gi.net/security/centrifirewall/features.html

"Firewall Application Notes." Good document that starts by describing how to build a firewall. Also addresses application proxies, sendmail in relation to firewalls, and the characteristics of a bastion host. Livingston Enterprises, Inc.

• http://www.telstra.com.au/pub/docs/security/firewall-1.1.ps.Z

"Firewall Performance Measurement Techniques: A Scientific Approach." Marcus Ranum. February 4, 1996 (last known date of modification).

• http://www.v-one.com/pubs/perf/approaches.htm

Firewalls and Internet Security : Repelling the Wily Hacker. William R. Cheswick and Steven M. Bellovin. Addison-Wesley Professional Computing. ISBN: 0-201-63357-4. 1994.

Firewalls FAQ. Marcus J. Ranum.

• http://www.cis.ohio-state.edu/hypertext/faq/usenet/firewalls-faq/faq.html

"Five Reasons Why an Application Gateway is the Most Secure Firewall." Global Internet.

• http://www.gi.net/security/centrifirewall/fivereasons.html

"Group of 15 Firewalls Hold Up Under Security Scrutiny." Stephen Lawson. InfoWorld. June 1996.

• http://www.infoworld.com/cgi-bin/displayStory.pl?96067.firewall.htm

"If You Can Reach Them, They Can Reach You." William Dutcher. A PC Week Online Special Report. June 19, 1995.

• http://www.pcweek.com/sr/0619/tfire.html

"Improving the Security of Your Site by Breaking Into It." Dan Farmer and Wietse Venema. 1995.

• http://www.craftwork.com/papers/security.html

"Improving X Windows Security." Linda Mui. UNIX World. Volume IX, Number 12. December 1992.

"Integrating Security in a Group Oriented Distributed System." Michael K. Reiter, Kenneth P. Birman, and Li Gong. TR92-1269. February 1992.

• http://cs-tr.cs.cornell.edu:80/Dienst/Repository/2.0/Body/ncstrl.cornell%2fTR92-1269/postscript

"Internet Firewalls: An Introduction." Firewall white paper. NMI Internet Expert Services.

• http://www.netmaine.com/netmaine/whitepaper.html

Internet Firewalls and Network Security (Second Edition). New Riders. Chris Hare and Karanjit Siyan. ISBN: 1-56205-632-8. 1996.

Internet Security Resource Library: Internet Firewalls and Network Security, Internet Security Techniques, Implementing Internet Security. New Riders. ISBN: 1-56205-506-2. 1995.

"Intrusion Protection for Networks 171." Byte Magazine. April, 1995.

"IP v6 Release and Firewalls." Uwe Ellermann. 14th Worldwide Congress on Computer and Communications Security Protection. pp. 341-354. June 1996.

"Is Plan 9 Sci-Fi or UNIX for the Future?" Anke Goos. UNIX World. Volume 7, p. 61. October 1, 1990.

"Keeping Your Site Comfortably Secure: An Introduction to Internet Firewalls." John P. Wack and Lisa J. Carnahan. National Institute of Standards and Technology. February 9, 1995.

• http://csrc.ncsl.nist.gov/nistpubs/800-10/

"Making Your Setup More Secure." NCSA tutorial pages.

• http://hoohoo.ncsa.uiuc.edu/docs/tutorials/security.html

"Multilevel Security in the UNIX Tradition." M. D. McIlroy and J. A. Reeds. SWPE. 22(8), pp. 673-694. 1992.

"NCSA Firewall Policy Guide." Compiled by Stephen Cobb, Director of Special Projects. National Computer Security Association.

• http://www.ncsa.com/fwpg_p1.html

"Network Firewalls." Steven M. Bellovin and William R. Cheswick. IEEECM, 32(9), pp. 50-57. September 1994.

"Networks Without User Observability: Design Options." Andreas Pfitzmann and Michael Waidner. Eurocrypt '85, LNCS 219, Springer-Verlag, Berlin 1986, 245-253.

• http://www.informatik.uni-hildesheim.de/FB4/Projekte/sirene/publ/PfWa_86anonyNetze.html

"On Access Checking in Capability-Based Systems." Richard Y. Kain and C. E. Landwehr. IEEE Trans. on Software Engineering Volume SE-13, Number 2 (Feb. 1987) pp. 202-207; reprinted from Proc. 1986 IEEE Symposium on Security and Privacy, April, 1986, Oakland, CA.

• http://www.itd.nrl.navy.mil/ITD/5540/publications/CHACS/Before1990/1987landwehr-tse.ps

"On the (In)Security of the Windowing System X." Marc VanHeyningen. Indiana University. September 14, 1994.

• http://www.cs.indiana.edu/X/security/intro.html

"Packet Filtering for Firewall Systems." February 1995. CERT (and Carnegie Mellon University).

• ftp://info.cert.org/pub/tech_tips/packet_filtering

"Packets Found on an Internet." Steven M. Bellovin. Interesting analysis of packets appearing at the application gateway of AT&T. Lambda. August 23, 1993.

• ftp://ftp.research.att.com/dist/smb/packets.ps

"Password Security: A Case History." Robert Morris and Ken Thompson.

• http://www.sevenlocks.com/papers/password/pwstudy.ps

PCWEEK Intranet and Internet Firewall Strategies. Ed Amoroso and Ron Sharp. Ziff-Davis Press. ISBN: 1562764225. 1996.

"Plan 9." Sean Dorward, Rob Pike, and Dave Presotto. UNIX Review. Volume 10, p. 28. April 1, 1992.

"Plan 9: Feature Film to Feature-Rich OS." Paul Fillinich. Byte Magazine. Volume 21, p. 143. March 1, 1996.

"Plan 9 from AT&T." David Bailey. UNIX Review. Volume 1, p. 27. January 1, 1996.

"Plan 9 from Bell Labs." Rob Pike, Dave Presotto, and Phil Winterbottom. Computing Systems Journal. Volume 8, p. 221. Summer, 1995.

"Plan 9: Son of UNIX." Robert Richardson. LAN Magazine. Volume 11, p. 41. August 1, 1996.

"Private Communication Technology Protocol." Daniel Simon. April 1996.

"Product Overview for IBM Internet Connection Secured Network Gateway for AIX, Version 2.2." IBM firewall information.

• http://www.ics.raleigh.ibm.com/firewall/overview.htm

"Program Predictability and Data Security." Charles G. Moore III and Richard W. Conway. TR74-212.

• http://cs-tr.cs.cornell.edu:80/Dienst/UI/2.0/Describe/ncstrl.cornell%2fTR74-212?abstract=Security

"Protecting the Fortress From Within and Without." R. Scott Raynovich. LAN Times. April 1996.

• http://www.wcmh.com/lantimes/96apr/604c051a.html

"Rating of Application Layer Proxies." Michael Richardson. November 13, 1996.

• http://www.sandelman.ottawa.on.ca/SSW/proxyrating/proxyrating.html

"Reducing the Proliferation of Passwords in Distributed Systems Information Processing." Education and Society. Volume II, pp. 525-531. Elsevier Science Publishers B.V. (North Holland). 1992.

"Robust and Secure Password/Key Change Method Proceedings of the Third European Symposium on Research in Computer Security (ESORICS)." Ralf Hauser, Phil Janson, Refik Molva, Gene Tsudik, and Els Van Herreweghen. LNCS, pp. 107-122, SV, November 1994.

"Secure Computing Firewall for NT." Overview. Secure Computing.

• http://www.sctc.com/NT/HTML/overview.html

"Security and the X Window System." Dennis Sheldrick. UNIX World. 9(1), p. 103. January 1992.

• http://ftp.digital.com/pub/Digital/info/SPD/46-21-XX.txt

"Security in Public Mobile Communication Networks." Hannes Federrath, Anja Jerichow, Dogan Kesdogan, and Andreas Pfitzmann. Proceedings of the IFIP TC 6 International Workshop on Personal Wireless Communications, Prague 1995, pp. 105-116.

• http://www.informatik.uni-hildesheim.de/FB4/Projekte/sirene/publ/FJKP_95FunkEngl.ps.gz

"Security in Open Systems." (NIST) John Barkley, editor (with Lisa Carnahan, Richard Kuhn, Robert Bagwill, Anastase Nakassis, Michael Ransom, John Wack, Karen Olsen, Paul Markovitz, and Shu-Jen Chang). U.S. Department of Commerce. Section: The X Window System: Bagwill, Robert.

• http://csrc.ncsl.nist.gov/nistpubs/800-7/node62.html#SECTION06200000000000000000

"Security in the X11 Environment." Pangolin. University of Bristol, UK. January, 1995.

• http://sw.cse.bris.ac.uk/public/Xsecurity.html

"Selective Security Capabilities in ASAP--A File Management System." Richard W. Conway, W. L. Maxwell, and Howard L. Morgan. TR70-62. June 1970.

• http://cs-tr.cs.cornell.edu:80/Dienst/UI/2.0/Print/ncstrl.cornell%2fTR70-62

"Session-Layer Encryption." Matt Blaze and Steve Bellovin. Proceedings of the Usenix Security Workshop, June 1995.

"Site Security Handbook." Update and Idraft version; June 1996, CMU. Draft-ietf-ssh-handbook-03.txt. Barbara Fraser.

• http://www.internic.net/internet-drafts/draft-ietf-ssh-handbook-03.txt

"SQL*Net and Firewalls." David Sidwell and Oracle Corporation.

• http://www.zeuros.co.uk/firewall/library/oracle-and-fw.pdf

"Talking Securely." Mark Arnold, Anthony Boyd, Susan Dalton, Flora Lo, Adam Millard, and Shalini Shah.1994.

• http://julmara.ce.chalmers.se/Security/sectalk.ps.Z

"TCP WRAPPER: Network Monitoring, Access Control, and Booby Traps." Wietse Venema. Proceedings of the Third Usenix UNIX Security Symposium, p. 85-92, Baltimore, MD. September 1992.

• ftp://ftp.win.tue.nl/pub/security/tcp_wrapper.ps.Z

The Cuckoo's Egg. Pocket Books. Cliff Stoll. ISBN: 0-671-72688-9. 1989.

• http://www.raptor.com/lib/9371.ps

"The Eagle Firewall Family." Raptor firewall information.

• http://www.raptor.com/products/brochure/40broch.html

"The Empirical Evaluation of a Security-Oriented Datagram Protocol." David P. Anderson, Domenico Ferrari, P. Venkat Rangan, B. Sartirana. U of California Berkeley, CS csd-87-350. UCB//CSD-87-350, April 1987.

• ftp://tr-ftp.cs.berkeley.edu/pub/tech-reports/csd/csd-87-350/

"There Be Dragons." Steven M. Bellovin. To appear in proceedings of the Third Usenix UNIX Security Symposium, Baltimore, September 1992. AT&T Bell Laboratories, Murray Hill, NJ. August 15, 1992.

"The Secure HyperText Transfer Protocol." E. Rescorla and A. Schiffman. EIT. July 1995.

• http://www.eit.com/creations/s-http/draft-ietf-wts-shttp-00.txt

"The SSL Protocol." (IDraft) Alan O. Freier and Philip Karlton (Netscape Communications) with Paul C. Kocher.

• http://home.netscape.com/eng/ssl3/ssl-toc.html

"The SunScreen Product Line Overview." Sun Microsystems.

• http://www.sun.com/security/overview.html

"The TAMU Security Package. An Ongoing Response to Internet Intruders in an Academic Environment." David R. Safford, Douglas Lee Schales, and David K. Hess. Proceedings of the Fourth Usenix UNIX Security Symposium, pp. 91-118, Santa Clara, CA. October 1993.

• http://www.telstra.com.au/pub/docs/security/tamu-security-overview.ps.Z

"The X Window System." Robert W. Scheifler and Jim Gettys. ACM Transactions on Graphics. Volume5, Number 2, pp. 79-109. April 1986.

• http://www.acm.org/pubs/toc/Abstracts/0730-0301/24053.html

"Undetectable Online Password Guessing Attacks." Yun Ding and Patrick Horster. OSR. 29(4), pp. 77-86. October 1995.

"Using Screend to Implement TCP/IP Security Policies." Jeff Mogul. Rotherwick and Digital.

• http://www.zeuros.co.uk/firewall/library/screend.ps

"Vulnerability in Cisco Routers Used as Firewalls." Computer Incident Advisory Capability Advisory: Number D-15. May 12, 1993.

• http://ciac.llnl.gov/ciac/bulletins/d-15.shtml

"WAN-Hacking with AutoHack--Auditing Security behind the Firewall." Alec D.E. Muffett. (Network Security Group, Sun Microsystems, United Kingdom.) Written by the author of Crack, the famous password-cracking program. Extraordinary document that deals with methods of auditing security from behind a firewall (and auditing of a network so large that it contained tens of thousands of hosts). June 6, 1995.

• http://www.telstra.com.au/pub/docs/security/muffett-autohack.ps

"Warding Off the Cyberspace Invaders." Amy Cortese. Business Week. March 13, 1995.

"Windows NT Firewalls Are Born." PC Magazine. February 4, 1997. Jeffrey G. Witt.

• http://www.pcmagazine.com/features/firewall/_open.htm
  
  
• http://www.raptor.com/lib/9419.ps

"X Through the Firewall, and Other Application Relays." Treese/Wolman. Digital Equipment Corp. Cambridge Research Lab. October, 1993(?).

• ftp://crl.dec.com/pub/DEC/CRL/tech-reports/93.10.ps.Z

"X Window System Security." Ben Gross and Baba Buehler. Beckman Institute System Services. Last Apparent Date of Modification: January 11, 1996.

• http://www.beckman.uiuc.edu/groups/biss/VirtualLibrary/xsecurity.html

"X Window Terminals." Björn Engberg and Thomas Porcher. Digital Technical Journal of Digital Equipment Corporation. 3(4), pp. 26-36. Fall 1991.

• ftp://ftp.digital.com/pub/Digital/info/DTJ/v3n4/X_Window_Terminals_01jul1992DTJ402P8.ps

Intrusion Detection

"A Methodology for Testing Intrusion Detection Systems." N. F. Puketza, K. Zhang, M. Chung, B. Mukherjee, R. A. Olsson. IEEE Transactions on Software Engineering, Volume 22, Number 10. October 1996.

• http://seclab.cs.ucdavis.edu/papers/tse96.ps

"An Introduction to Intrusion Detection." Aurobindo Sundaram. Last apparent date of modification: October 26, 1996.

• http://www.techmanager.com/nov96/intrus.html

"A Pattern-Oriented Intrusion-Detection Model and Its Applications." Shiuhpyng W. Shieh and Virgil D. Gligor. Research in Security and Privacy, IEEECSP. May 1991.

Bibliography on Intrusion Detection. The Collection of Computer Science Bibliographies.

• http://src.doc.ic.ac.uk/computing/bibliographies/Karlsruhe/Misc/intrusion.detection.html

"Detecting Unusual Program Behavior Using the Statistical Component of the Next-generation Intrusion Detection Expert System (NIDES)." Debra Anderson, Teresa F. Lunt, Harold Javitz, Ann Tamaru, and Alfonso Valdes. SRI-CSL-95-06, May 1995. Available in hard copy only. The abstract is at

• http://www.csl.sri.com/tr-abstracts.html#csl9506

"Fraud and Intrusion Detection in Financial Information Systems." S. Stolfo, P. Chan, D. Wei, W. Lee, and A. Prodromidis. 4th ACM Computer and Communications Security Conference, 1997.

• http://www.cs.columbia.edu/~sal/hpapers/acmpaper.ps.gz

"GrIDS--A Graph-Based Intrusion Detection System for Large Networks." S. Staniford-Chen, S. Cheung, R. Crawford, M. Dilger, J. Frank, J. Hoagland, K. Levitt, C. Wee, R. Yip, and D. Zerkle. The 19th National Information Systems Security Conference.

• http://seclab.cs.ucdavis.edu/papers/nissc96.ps

"Holding Intruders Accountable on the Internet." S. Staniford-Chen and L.T. Heberlein. Proceedings of the 1995 IEEE Symposium on Security and Privacy, Oakland, CA, May 8-10, 1995.

• http://seclab.cs.ucdavis.edu/~stanifor/seclab_only/notes/ieee_conf_94/revision/submitted.ps

Intrusion Detection Bibliography.

• http://www.cs.purdue.edu/coast/intrusion-detection/ids_bib.html

Intrusion Detection Bibliography (Another)

• http://doe-is.llnl.gov/nitb/refs/bibs/bib1.html

"Intrusion Detection for Network Infrastructures." S. Cheung, K.N. Levitt, C. Ko. 1995 IEEE Symposium on Security and Privacy, Oakland, CA, May 1995.

• http://seclab.cs.ucdavis.edu/papers/clk95.ps

"Intrusion Detection Systems (IDS): A Survey of Existing Systems and A Proposed Distributed IDS Architecture." S.R. Snapp, J. Brentano, G.V. Dias, T.L. Goan, T. Grance, L.T. Heberlein, C. Ho, K.N. Levitt, B. Mukherjee, D.L. Mansur, K.L. Pon, and S.E. Smaha. Technical Report CSE-91-7, Division of Computer Science, University of California, Davis, February 1991.

"Machine Learning and Intrusion Detection: Current and Future Directions." J. Frank. Proceedings of the 17th National Computer Security Conference, October 1994.

"NetKuang--A Multi-Host Configuration Vulnerability Checker." D. Zerkle and K. Levitt. Proceedings of the 6th Usenix Security Symposium. San Jose, California. 1996.

• http://seclab.cs.ucdavis.edu/papers/zl96.ps

"Network Intrusion Detection." Biswanath Mukherjee, L. Todd Heberlein, and Karl N. Levitt. IEEE Network, May 1994.

• http://seclab.cs.ucdavis.edu/papers/bd96.ps

"Simulating Concurrent Intrusions for Testing Intrusion Detection Systems: Parallelizing Intrusions." M. Chung, N. Puketza, R.A. Olsson, B. Mukherjee. Proceedings of the 1995 National Information Systems Security Conference. Baltimore, Maryland. 1995.

• http://seclab.cs.ucdavis.edu/papers/cpo95.ps

Mailing Lists

Intrusion Detection Systems. This list concentrates primarily on discussions about methods of intrusion or intrusion detection.

Target: majordomo@uow.edu.au

Command: subscribe ids (in body of message)

The WWW Security List. Members of this list discuss all techniques to maintain (or subvert) WWW security (things involving secure methods of HTML, HTTP, and CGI).

Target: www-security-request@nsmx.rutgers.edu

Command: SUBSCRIBE www-security your_email_address (in body of message)

The Sneakers List. This list discusses methods of circumventing firewall and general security. This list is reserved for lawful tests and techniques.

Target: majordomo@CS.YALE.EDU

Command: SUBSCRIBE Sneakers (in body of message)

The Secure HTTP List. This list is devoted to the discussion of S-HTTP and techniques to facilitate this new form of security for WWW transactions.

Target: shttp-talk-request@OpenMarket.com

Command: SUBSCRIBE (in body of message)

The NT Security List. This list is devoted to discussing all techniques of security related to the Microsoft Windows NT operating system. Individuals also discuss security aspects of other Microsoft operating systems.

Target: request-ntsecurity@iss.net

Command: subscribe ntsecurity (in body of message)

The Bugtraq List. This list is for posting or discussing bugs in various operating systems, though UNIX is the most often discussed. The information here can be quite explicit. If you are looking to learn the fine aspects (and cutting-edge news) of UNIX security, this list is for you.

Target: LISTSERV@NETSPACE.ORG

Command: SUBSCRIBE BUGTRAQ (in body of message)

Underground Resources

Phrack Magazine: A hacker e-zine that has been in existence for many years. There is a great deal of hard-core technical information in it, as well as a fascinating section called "Phrack World News," which recounts cracker and hacker activities in recent months.

• http://www.fc.net/phrack.html

Underground: The home page of Aleph 1 (and the computer underground society). This page has practical information and tools. Aleph 1 is an authority of UNIX security, and Underground is probably one of the best underground pages ever posted.

• http://underground.org/

LHI Technologies (L0pht Heavy Industries): This group is composed of some of most talented underground hackers. The archives at this site contain rare papers and reports, some written by the site's proprietors.

• http://l0pht.com/

The Infonexus: This site houses most of the tools that have ever been made for UNIX, NT, Novell, and DOS. It also houses some very interesting files that you cannot find elsewhere. The proprietor is Route, an individual who authored one of the most recent denial-of-service tools, the syn_flooder. This site is smokin'.

• http://www.infonexus.com/~daemon9/

Eight Little Green Men [8LGM]: A group of individuals who work independently to discover holes in various platforms. Famous for posting exploit scripts.

• http://www.8lgm.org/home.html

The alt.2600/#hack FAQ: The FAQ for the popular Usenet newsgroup, alt.2600. Some interesting information can be found here, ranging from info about war dialers to tips for covering your tracks after a break-in.

• http://www-personal.engin.umich.edu/~jgotts/hack-faq/hack-faq-cp.html

The Hacks and Cracks Page: Files, files, and more files. Many files for different platforms, including but not limited to DOS, Windows, and Mac.

• http://home.earthlink.net/~mumbv/index.html

The Mac Hack Page: Mac hacking and cracking. Many files and links to other sites. A good starting place for the Mac hacker or cracker.

• http://members.tripod.com/~Buzzguy/The_Mac_Hack_Page

H/P/A Links and Bullshit: A rather anarchistic but somewhat informational page with many, many links.

• http://www.paranoia.com/hpa/

EFF "Hacking, Cracking, Phreaking" Archive: This is the archive of the Electronic Frontier Foundation, a non-profit organization that advocates civil liberties in cyberspace.

• http://www.eff.org/pub/Privacy/Security/Hacking_cracking_phreaking/

---

© Copyright, Macmillan Computer Publishing. All rights reserved.

Contact reference@developer.com with questions or comments.
Copyright 1998 EarthWeb Inc., All rights reserved.
PLEASE READ THE ACCEPTABLE USAGE STATEMENT.
Copyright 1998 Macmillan Computer Publishing. All rights reserved.