my personal security links

15 January 2003

Please direct any comments, suggestions, etc. about this URL list to Webmaster.

Overview

Security Organizations

SANS Institute, with compilations of recent security threats, Global Incident Analysis Center (GIAC), GIAC training, and Reading Room
Federal Bureau of Investigation (FBI) National Infrastructure Protection Center (NIPC) (CyberNotes archive | InfraGard)
CERT Security Improvement Modules, including general information on firewalls and intrusion detectors.
International Computer Security Association (ICSA); excellent set of papers on firewalls, viruses, e-commerce, etc.
Center for Education and Research in Information Assurance and Security (CERIAS) (Purdue U.) [Replaces COAST (Computer Operations, Audit, and Security Technology)]
Computer Security Institute (Source of the annual "CSI/FBI Computer Crime and Security Survey")
The Center for Internet Security
ISC² (Certified Information Systems Security Professional (CISSP) information)
High Tech Crime Network/"The Journal of Computer Crime Investigation and Forensics"
The ANSER Institute For Homeland Security

Security Information Sites
Box Network's New Order computer & network security portal
The NAVY INFOSEC WebSite: "Dedicated to the Defense and Protection of all United States Navy Information Systems, Afloat and Ashore."
securitywatch.com
AntiOnline (Good starting point)
NSI Security Resource Net
DigiCrime
SecureZone, the "ultimate" computer security resource
AntiSearch's Information Security Related Sites
Security & encryption links from Yahoo!
Information Security Education Resources for Professional Development (M.E. Kabay)

General Information/Overviews
NIST Computer Security Resource Center (CSRC) publications page
Abstract: Shall We Dust Moscow?, Dan Farmer's "Security Survey of Key Internet Hosts & Various Semi-Relevant Reflections"
"Considerations for LAN and Internet Security" (GCK & C.A. Monaghan)
Marcus Ranum's security papers including Taxonomy of Internet Attacks, firewalls FAQ, presentations...
RFC 2828/FYI 36: Internet Security Glossary
Fred Cohen & Associates security-related games/simulations
Slashdot: News for nerds, stuff that matters
http://www.computerbytesman.com/
MPRM Group Ltd. — Information Technology Security Agency
Security glossary online: Victoria TelecommunityNet | Northern Illinois University
Course material: 14-part introductory security course (M. Burgess; English & Norwegian) | Course material from Mich Kabay
Sun Tzu's "The Art of War": The Oldest Military Treatise in the World" (Everyone in infosec and infoware quotes Sun Tzu; here's the text)

General Information Databases
NIST iCat project, provides an index to vulnerabilities by vendor and software product
Mitre's Common Vulnerabilities and Exposures dictionary
NIST Threats-and-Countermeasures Database
NIST Toolbox for constructing security specifications
CERIAS Workshop on Security Vulnerability Databases
NIST Workshop on Databases of Threats and Countermeasures

Security Incident Response Teams
Internet Storm Center at www.incidents.org
Distributed Intrusion Detection System, DShield.org
Australian Computer Emergency Response Team (AUSCERT)
CERT Coordination Center
Defense Information Systems Agency (DISA) Center for Automated System Security Incident Support Team (ASSIST)
Dept. of Energy Computer Incident Advisory Capability (CIAC)
European CERTs list
Federal Computer Incident Response Capability (FedCIRC)
Forum of Incident Response and Security Teams (FIRST)
German Research Network Computer Emergency Response Team (DFN-CERT)
NASA Incident Response Center (NASIRC)
National Institute for Standards and Technology (NIST) Computer Security Resource & Response Center (CSRC), security, virus info, VIRUS-L archive

Computer Crime and Legal Issues
U.S. Dept. of Justice Computer Crime and Intellectual Property Section (CCIPS)
LabMice.net's Legal and CyberCrime Resources
Council of Europe (international computer crime treaty)
Cryptome.org
FBI's Internet Fraud Complaint Center
U.S. Department of Justice "Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations"

Information Warfare

InfoWar.Com, with tons of info plus archives of Happy Hacker, Phrack, and more...
IWS - The Information Warfare Site
PAPERS: "Cyber Attacks During the War on Terrorism: A Predictive Analysis" (ISTS, Dartmouth, 2001) | In Athena's Camp: Preparing for Conflict in the Information Age (Arquilla & Ronfeldt, ed., 1997; PDF files) | "Cyber-terrorism: The Shape of Future Conflict?" (Rathmell, 1997) | "Cyberwar and Netwar: New Modes, Old Concepts, of Conflict" (Arquilla & Ronfeldt, 1993) | "Information Age Warfare Must Enlist Civilian Partnerships" (Campen, SIGNAL, 1999) | "Information Warfare: A Two-Edged Sword" (RAND Corp., 1995)

Some Vendors' Security Bulletins
Berkeley Software Design, Inc. (BSDI)
Cable & Wireless Security Engineering
Caldera Systems Linux
Compaq
Cisco Systems Security Technical Tips and Internet Security Advisories
Debian Linux
The FreeBSD Project
ISS X-Force
Microsoft security bulletins
Novell
The Open BSD Project
Red Hat Linux
Santa Cruz Operation (SCO)
Silicon Graphics (SGI)
Sun Microsystems

Security News and Journals
Access Controls and Security Systems
ACM RISKS DIGEST
ACM Transactions on Information and Systems Security (TISSEC)
American Society for Industrial Security (ASIS)
Hacker's Digest
Information Security Magazine
Internet Security Review
Journal of Computer Security
Journal of Homeland Security
Security Magazine
SecurityFocus.com

Security newslists/e-periodicals
CyberCrime-Alerts newsletter (Joe Mezzanini)
Security Wire Digest
SANS Security Digests
secedu (Security Education)
CERT/CC Advisories
InfoSec News
Network World Fusion Security e-zine (Mich Kabay)
Net-Sec newsletter
NewsScan Daily: text version | HTML version
POLITECH — Declan McCullagh's politics and technology mailing list
RISKS newsletter
SearchSecurity Daily News
SecurityPortal's Weekly Newsletter
Dartmouth's Institute for Security Technology Studies (ISTS) "Security in the News"
Crypto-Gram (Counterpane Internet Security)

Security Criteria
Rainbow Book Series [ Navy | NIST | National Computer Security Center (NCSC)]
DoD Orange Book
NIST's "Common Criteria for IT Security Evaluation (CC)" page

Cryptography

General Crypto Information

RSA's Cryptography FAQ
Cypherpunks WWW page
The Cryptography, PGP, and Your Privacy Web page
Security and Cryptography (from ARPA.MIL)
Encryption standards around the world
Common Data Security Architecture (CDSA)
COAST Hotlist of Security Sites
Crytography Research Inc.'s cryptography.com Site
The National Security Agency: Providing and Protecting Vital Information Through Cryptology
American Cryptogram Association (ACA)
Cryptologia
Yahoo! crypto pages
U.S. Department of Commerce Export Administration Regulations (EAR) | U.S. Electronic Signature (e-sign) legislation
International: Summary of International Crypto Controls | Crypto policies and laws around the world | Neville, Peterson & Williams: Customs and International Trade Law
Organizations: Business Software Alliance (BSA) | Center for Democracy and Technology (CDT) | Electronic Frontier Foundation (EFF) | Electronic Privacy Information Center (EPIC)

About Cryptography
The Prime Pages, all about prime numbers
"Overview of Cryptographic Methods" (GCK)
Excellent crypto site from Bruce Schneier, including "Why Cryptography is Harder Than it Looks" and key length information
Ron Rivest's "Cryptography and Security" Page (including "Chaffing and Winnowing" paper)
"Cryptography and Number Theory for Digital Cash" (J.O. Grabbe)
"Algebra & Complexity Theory in Cryptography" (J.S. Leaning)
CryptoLog: The Internet Guide to Cryptography
"List of Cryptographers" from U.C. Berkeley
distributed.net, a project to break cryto algorithms using the distrubuted computing power of the Internet

Cryptography History
Cryptography Timeline
Enigma Java applet: AT&T (U.K.) | Enigma page, with several Java, PalmOS, and BASIC simulators...
Alan Turing Home Page
The Enigma Machine (Univ. of Arizona)
Vignere Cipher
NSA's National Cryptologic Museum
Codes and Ciphers in the Second World War
Java emulators of WWII crypto devices: Purple, Sigaba, Enigma, Russian Espionage Cipher, and a public domain Bombe.

Quantum Cryptography
University of Oxford Centre for Quantum Computation
IBM Almaden Research Lab

Advanced Encryption Standard (AES) et al.

NIST's AES Home Page
The Rijndael Page
"Improved Cryptanalysis of Rijndael" (Ferguson et al.)
The Rijndael Fan Page
Twofish
Links to many crypto protocols

PGP
MIT's PGP distribution
- MIT's PGP keyserver
Network Associates' Pretty Good Privacy Web site
The International PGP Home Page
The OpenPGP Alliance
Phil Zimmerman's Home Page
Yahoo! links

Product Vendors
National Security Institute's List of Security Products & Services
RSA (RSA attack info)
Hewlett-Packard's International Cryptography Framework
IBM position papers on key recovery and technical guide to encryption
Digital Watermarks: New Tools for Copyright Owners and Webmasters
CrypTec Systems

Public Key Infrastructure (PKI)
The PKI Forum
PKI and the Law Web site
ETSI Security Technical Committee
IETF Public Key Infrastructure (X.509) (pkix) Working Group
NIST's Public Key Infrastructure (PKI) page...
"Weaving a Web of Trust" (R. Khare & A. Rifkin)
CommerceNet's "Security and Internet Payments" page
"PKI: How It Works" (Lucent)
"Security Management Infrastructure: Session Key Management Protocols (and some other stuff)" includes info on ISAKMP/Oakley
SKIP - Simple Key management for Internet Protocols IP-Level Cryptography
CA info/vendors: OpenCA, information on open source CA | VeriSign | Thawte | Baltimore Technologies | EnTrust Technologies | Chrysalis-ITS | Cylink Corp. | nCipher, Inc. | Norman Data Defense Systems | OpenNetwork Technologies | Syntegra, Inc. | Valicert, Inc.

Steganography
MIT's Data Hiding Home Page
Cambridge University's Information Hiding Home Page
JJTC's Steganalysis and Steganography & Digital Watermarking pages
StegoArchive.com
Steganography software
Steganos
"Coded Communications" (McGrath, Newsweek/MSNBC, 9/21/2001)

Poor Cryptography Examples
DVD CSS: CSS DVD Encryption/Decryption, including "Cryptanalysis of Contents Scrambling System" (F.A. Stevenson) | Gallery of CSS Descramblers | OpenDVD.org

Operating System Security

General Information

Cerberus Information Security Advisories
BUGTRAQ Vulnerability Database Statistics
SecurityFocus.com: Microsoft | Sun | Linux
The Ideahamster Organization and the Open Source Security Testing Methodology Manual (OSSTMM)

NetWare (Novell)
Northwestern Univ.
Nomad Mobile Research Centre (includes NetWare Hack FAQ)
Socrates (NetWare and more!)
"Security Procedures and Checklists for LAN Administrators of Netware 3.1x"

Unix (including Linux)
CERT Security Improvement Modules, with Unix-specific practices
CyberSoft (excellent set of papers and downloadable tools...)
UNIX Exploits
Stack Smashing Security Vulnerabilities
Matt's UNIX Security Page
BUGTRAQ archive
"An Architectural Overview of UNIX Network Security" (Reinhardt)
Linux Shadow Password HOWTO
Genocide2600.com
ROOTKIT.COM
Apostols, queso and other tools
Fyodor's Playhouse, nmap and other tools (nLog is a Perl script to convert nmap log file output to a flat file database)
hping, command-line oriented TCP/IP packet assembler/analyzer.
NetSaint Network Monitor (Linux)
Security Portal's Linux Security page
Linux SECURITY.COM
"Armoring Linux" and "Armoring Solaris"
NSA's Security-Enhanced Linux Project

General Tools
SecurityFocus.com (Unix and Windows) Hacker (Samarai[sic]) Tools from MPRM Group
Vulnerability scanners: Nessus Security Scanner | World Wide Digital Security, Inc. SAINT: Security Administrator's Integrated Network Tool (Unix) (or here) | UltraScan & EPDump (NT) | Kane Security Analyst | WebTrends | NGSSoftware Typhon Security Scanner (NT/2000)
Packet sniffers: LBL's tcpdump (Unix) | WinDump (tcpdump port for Windows) | Analyzer: a public domain protocol analyzer (from the folks who brought you WinDump!) | Ethereal | sniffit | Natas, opensource version of freeware Windows 2000 network sniffer
System auditing: COPS | SWATCH | Tripwire | Foundstone (formerly NT OBJECTives) auditing tools for NT | Inzider and Fport (Foundstone), shows which Windows NT processes are listening to open ports | Startup Cop for all Windows versions; tells what programs run at startup
Trinux — A Linux Security Toolkit
Unix tools: A wealth of Unix tools, always changing... | Psionic PortSentry: Port Scan Detection and Active Defense System | Whitehats security tools
File wipers/shredders: CleanDrive (WhiteCanyon) | Window Washer (Webroot) | BCWipe (Jetico) | Eraser (Sami Tolvanen) | SecureClean (AccessData) | East-Tec Eraser 2000 (East Technologies) | PGP

Windows NT/2000/XP

NSA guidelines
CERT Security Improvement Modules, with NT-specific practices
NTBugTraq Home Page including the International Windows NT Fixes Up-to-date Query Engine
Bill Wall's Windows NT links (includes security)
NTsecurity.com
The NT Shop (NTSecurity.Net)
L0pht Advisories Page
Microsoft-related security papers -- NT, Internet Explorer, Internet Information Server, MS Proxy Server
"Microsoft Passport to Trouble"
- MS Security Tools
- Microsoft Personal Security Advisor (MPSA), web-based application to test Windows NT 4.0 Workstation or Windows 2000 Professional systems
- HFNetChk: command-line tool to check the patch status of all the machines in a network
USSR Labs
Computer & Network Security Site
Known NT Exploits
Nomad Mobile Research Centre (includes NT Hack FAQ)
System Internals (formerly NTInternals)
NT Security - Frequently Asked Questions
Win NT Security
Windows NT Security FAQ
WinNuke Testing Ground
Security White Papers and Web Links for Windows NT
Winternals Software
NT and Related Security Holes and Bugs (Rhino9)
Mnemonix's home page, particularly heavy on Windows NT...
JSI, Inc. NT resources information... (registry hacks)
Windows NT (perhaps something for '95) Systems Bug List Page
"Security Tools for Windows NT" (GCK)
Stefan Norberg's "Building a Windows NT Host in Practice"
Trusted Systems' Windows NT Security Guidelines
"Armoring NT"
"Hardening Windows 2000" (Cox)
"NetBIOS Insecurities"
"Understanding NetBIOS" (NeonSurge)
"Non-Stack Overflows on Windows" (D. Litchfield)
"System Security Administration for NT" (H. Carvey)
Geo's Windows NT tips

PalmOS
L0pht PalmOS Development

Firewalls/IDS/Honeypots

NIST "Guide to Firewall Selection and Policy Recommendations"
ICSA's list of certified firewalls and Firewall Buyer's Guide
InfoSec News firewall survey
The Rotherwick Firewall Resource, an excellent starting point for firewall info
Ultimate Firewalls Page: Excellent info on types of attacks, product info
Greatcircle firewall routers, FAQ, file archive, ...
IANA assigned port numbers
"Firewall Routers and Packet Filtering" (GCK)
Mason: automatic firewall builder for Linux (by Bill Stearns)
Product summaries: Firewall Product Overview | Firewall Fiesta!, comprehensive list of products and vendors | Data Communications Magazine's Firewall Security Table and Firewall Review - Lab Test
Products: Axent | Check Point ( and problems with CheckPoint's Firewall-1) | GTA GnatBox | Network-1 | Raptor Systems | Tripwire Security Systems | Trusted Information Systems

Personal Firewalls
Test Windows systems remotely for exposures: Gibson Research Center (GBC) ShieldsUP! | Symantec Security Check | farm9
"FireHole — How to bypass your personal firewall outbound detection or Game Over: An exercise in utility" (R. Kier)
Cable modem/ADSL security: ADSL Reports | Speed Guide.net | "Cable Modems and the Internet: Securing the SOHO" (GCK)
Cable modem/DSL hardware: Linksys EtherFast Cable/DSL Router | D-Link DI-701 | Macsense XRouter | SonicWALL SOHO2
Windows software: BlackICE Defender (Network ICE/ISS) | ZoneAlarm | WinRoute and Tiny Personal Firewall (TINY Software) | Norton Personal Firewall & Norton Internet Security | CyberArmor Personal Firewall (InfoExpress) | ConSeal PC Firewall (Conseal Software) | Internet Firewall 2000 (IFW2000) for Personal Computers (Digital Robotics) | Home PC Firewall Guide
UNIX: Netfilter (iptables), for Linux | Mason, plug-in for Netfilter or IPChains | IPFilter, for BSD | Snort (Marton Roesch); also here) | Shadow (Navy Surface Warfare Center)

Proxy Servers
Standard-type proxies: Apache proxy server | Microsoft Proxy Server | Netscape Proxy Server | SOCKS ( SOCKS5 white paper (Aventail)) | Squid
Transparent proxies: Cisco WCCP | Inktomi | NetApp Web Cache | PacketStorm WebSpeed

Intrusion Detection

Lance Spitzner's Technical Whitepapers and Publications, good set of papers about IDS, forensics, honeypots...
SANS Intrusion Detection FAQ
ICSA's Intrusion Detection System Consortium (IDSC) and IDS Buyer's Guide and "An Introduction to Intrusion Detection And Assessment" (Bace)
RobertGraham.com's IDS FAQ
arachNIDS (Advanced Reference Archive of Current Heuristics for Network Intrusion Detection Systems)
State of the Practice of Intrusion Detection Technologies (CERT Tech. Report)
"Intrusion Prevention: The Next Step in IT Security (Hollander)
Michael Sobirey's IDS Page
Paul Proctor's IDS Page"
NIST's special publication on IDS
SecurityFocus.com

Honeypots
"To Build A Honeypot"
The Honeypot Project
Fred Cohen's Deception Toolkit (DTK)

Forensics
netForensics
"Know Your Enemy: A Forensic Analysis" and other papers
Computer Forensics Online
High Tech Crime Network/"The Journal of Computer Crime Investigation and Forensics"
Computer Forensics Software: The Coroner's Toolkit (TCT), from Dan Farmer and Wietse Venema, a toolkit for incident response/forensic analysis of Unix systems | EnCase (Guidance Software) | DriveSpy (Digital Intelligence) | Maresware Suite (Mares & Co.) | ProDiscover (Technology Pathways)
Incident Handling: CERT/CC Steps for Recovering From a Unix or NT System Compromise and "How the FBI investigates computer crimes" | SecurityFocus.com | "How to Develop and Implement a CIRT"
Legal Issues: Title 18A-Appendix, Federal Rules of Evidence | Department of Justice, Computer Crime and Intellectual Property Section (CCIPS), Computer Crime Policy and Programs | "Collecting Computer-Based Evidence," New York Law Journal (J.E. Feldman, R.I. Kohn) | Department of Justice, Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigation 71 (2001) | Computer Records and the Federal Rules of Evidence (O.S. Kerr) | "What is electronic evidence?" (Center for Computer Forensics) | "Tracking a Computer Hacker" (D.A. Morris)

Virtual Private Networks (VPN)/Tunneling

General Information

"What is a VPN?" (Ferguson)
Tina Bird's VPN Page
Thomas Porter's VPN web page
The VPN Resource - VPDN.Com (TeleChoice)
Alliance Datacom VPN papers/tutorials
Communications Industry Researchers (CIR)
Internetweek's VPN Source Page
Virtual Private Network Consortium (VPNC)
VPNlabs
Vendors: Altiga | Aventail Extranet Strategist | Axent | Conclave | Data Fellows | Effnet | Indus River | Intel (nee Shiva) | IRE | Lucent (nee Livingston) | RedCreek | 3Com | TimeStep | VPNet

Secure Shell (SSH)
SSH Communications Security
SSH/SSHD for Win32
IETF Secure Shell (secsh) Working Group
TTSSH: An SSH Extension to Teraterm

Tunneling Protocols (Layer 2)

PPTP: Point-to-Point Tunneling Protocol (PPTP) | PPTP technical site (MS) | PPTP FAQ (MS) | "Understanding Point-to-Point Tunneling Protocol (PPTP)" (MS) | Counterpane's Analysis of MS-PPTP | Ascend PPTP FAQs | RFC 2637 (PPTP)
L2TP: Cisco L2TP FAQs | L2TP (draft 16) (IETF pppext WG)

IP Security Protocol (IPsec)
S/WAN, Linux-based IPsec
IPsec interoperability tests
IPsec Developers Forum
IETF ipsec WG (Contains a complete list of IPsec drafts and RFCs)
"IPSec: What Makes It Work" (Lucent)

Web-related Security

Web Browsers/Protocols

Netcraft Web Site Finder
WWW Security FAQ (includes HTML, Java, ActiveX, browsers, etc.)
SSL specification (ftp)
Security info (Netscape)
SAIC (wealth of documents, including SHTTP *plus* pointers to other sites)
EIT's S-HTTP Page
IETF's Transport Layer Security (TLS)
"How to Obscure Any URL"
Bugnosis, Web bug detector

Some Secure Web Server Products
Axent's WebDefender
Blockade Systems' Extended Access Control (EAC)
Gradient Technology's NetCrusader/Web
Hewlett-Packard's DomainGuard
Network Associates' (NAI) WebShield E-ppliance
Securant Technologies' ClearTrust SecureControl
Systems Advisory Group Enterprises, Inc. (SAGE) BRICKHouse Web Appliance
Perfecto Technologies' AppShield

Content Control
Platform for Internet Content Selection (PICS) specification
RSACi
Content Screening Software: CyberPatrol (Win3.11/9x/NT, Mac) | CyberSitter (Win9x/NT) | The Internet Filter | NetNanny (Win3.11/9x) | SurfWatch (Win3.11/9x, Mac) (SurfWatch Internet safety presentation)

IIS
Microsoft's IIS 4.0 Security Checklist
NTBugTraq's security fixes for IIS 4.0 running on NT 4.0 with SP6a and IIS 5.0 running on Windows 2000 with SP1
"Assessing IIS Configuration Remotely" (D. Litchfield)

Web Privacy

Platform for Privacy Preferences (P3P Project)
TRUSTe Privacy Generator
Network Advertising Initiative (NAI)
U.S. Dept. of Commerce "Safe Harbor" Web site, to help U.S. companies complu with E.U. privacy policies

Java/JavaScript/ActiveX
Java security (Finjan)
Hostile Applets: Using Java to break security (GA Tech.)
Java security info from Sun
A set of hostile Java applets
JavaScript Security FAQ
ActiveX FAQ

Other Web Programming
CGI: WWW Security FAQ | "Writing Secure Scripts" | NCSA Tips for Secure CGI Programming | Lincoln Stein's excellent resource list
Exploit checkers: PHF Prober | test-cgi checker | php_exploit, wwwcount exploit, and brute_web.c | CGICHK
Latro Perl checker
Socrates server load simulator
Segue Performer SSL load performance tool

Hacked Web Site Mirrors
alldas.org defacement archive
Attrition.org's extensive — and timely! — set of hacked sites
Some examples: CIA | U.S. Dept. of Justice | Kriegsman Furs | U.S. Air Force; also see 2600 Magazine
Hacker News Network archive

Hacker/Cracker Sites & Tools

Hacker/Cracker General Sites...

Genocide2600.com
Packetstorm.org
packet storm security
Netscape's hacker page
HNN - Hacker News Network
The Happy Hacker
Rhino9, includes "The Modern Hackers Desk Reference" and "NT Vulnerability Theory" (Also alternate URL)
Networking Bloopers
PC Demos Explained (new-age hackers...)
The Black Hat Briefings/ DefCon show
2600 Magazine
PHRACK Magazine
Hacks and Cracks
The Internet Underground
Hackers Catalog
rootshell.com
Aneurysm...
L0pht's Hacking Files Index (some NetWare, war dialers, phreaking, and more)
Cracking Unix and BIOS passwords, and more...
HackPalace.com
EFF's "hacker" archive
RainForestPuppy
Tools discussed in Hacking Exposed
astalavista.box.sk, the search engine for security related websites

SATAN
Info from NIST
Dan Farmer's SATAN Website

Password recovery/cracking tools...

"Overview of Password Crackers"
Windows passwords crackers: Cain v1.51 & Abel v1.1
Password cracking tools from Hackers Club
Vitas Ramanchauskas' password recovery software
ELCOM Ltd. ZIP and Office password recovery software
Password Crackers, Inc.
Bokler's Cracker Software Page
HackPalace.com's /cracking/misc-passwords
John the Ripper (Unix, DOS, Win32)
Hacking Angels: Cmos/Bios Password Crackers
"Windows NT Password Hacking"
"Feasibility of attacking Windows 2000 Kerberos Passwords" (F. O'Dwyer)
Another set of password crackers...

Commentary on Back Orifice/BO2k and other tools...
TL Security | ISS X-Force | Diamond Computer Systems' BO2K scanner freeware

About Hackers...
"Know Your Enemy" series (Lance Spitzner)

Windows-based tools
WildPackets (formerly AGNetTools) EtherPeek plus iNetTools (DNS Lookup, Finger, Name Lookup, Name Scan, Ping, Ping Scan, Port Scan, Service Scan, Throughput, Trace Route and Whois)
J. River Network Toolbox (ping, traceroute, IP address and port scanner, finger, whois, and more)
eEye Digital Security's nmapNT
cotse.com's winetd, an NT port of inetd, including tcpwrappers, honeypot modules, and more
Foundstone's tools, including SuperScan port scanner, DDoS ping, and UDP flood
NetBIOS tools

Other Security Topics

Viruses/Worms

Virus Bulletin
SecurityFocus.com
Virus Databases/Product Vendors: AVP Virus Encyclopedia | CIAC's Virus Database Page | F-Secure Computer Virus Info Center | McAfee Anti-Virus Center | Network Associates Virus Library | Sophos | Symantec's AntiVirus Research Center | Trend Virus Information Center
Virus Hoax Information: CIAC's Internet Hoaxes Page | F-Secure Hoax warnings | Symantec Virus Hoaxes | Vmyths.com (formerly Computer Virus Myths Page)
Chain Letters & Urban Legends (Why here? Well, it is sort of related to virus hoaxes....): The AFU (alt.folklore.urban) and Urban Legends Archive | CIAC Internet Chain Letters Page | The San Fernando Valley Folklore Society's Urban Legends Reference Pages

E-mail/Spamming
Fight Spam on the Internet! site
Spam laws in the U.S. and around the world
John Marshall Law School cyberlaw site
Internet Mail Consortium (IMC)
Integralis' MIMESweeper

Passwords
"Passwords — Strengths and Weaknesses" (GCK)
One-Time Password (OTP) systems: Security Dynamics Technologies (SDTI) | Secure Computing Corp. | Activcard | Axent Technologies | CRYPTOCard Corporation | LeeMah DataCom | Vasco Data Security, Inc. | IETF's One-Time-Password SASL Mechanism
BioPassword keystroke dynamics

Denial-of-service
ICSA DDoS Attacks Page
Denial of Service (DoS) Attack Resources Page
PacketStorm's Distributed Attack Tools list
David Dittrich's security papers (The best analyses of Trin00, TFN, and Stacheldraht)
DoS Database
Webtorials DDoS briefing
Buffer overflow: Cerberus papers (David Litchfield) | NT Security's papers (Dave LeBlanc) | USSR Back | Foundstone Tools (formerly NT Objectives)

Code Red Worm....
DShield
www.incidents.org (SANS Institute)
CAIDA's analysis and "The Spread of the Code-Red Worm (CRv2): The Movie"
Digital Island's Code Red page
Microsoft URL for Code Red Advisory and Microsoft Patch Installation Instructions
eEye Digital Security

Personalities in Security
"Kevin Mitnick" info
"Cliff Stoll" info
"Takedown" (Tsutomu Shimomura on Kevin Mitnick)
Phil Zimmermann (inventor of PGP)
Discovery Channel's "Hackers' Hall of Fame"

Ethics
"Why Kids Shouldn't Be Criminal Hackers: An Explanation for High School Students, Teachers & Parents" (Mich Kabay) | M. Kabay's ethics articles and links
Responsible Netizen Page
The CyberPilot's License
University of British Columbia's Center for Applied Ethics Computer & Information Ethics Resources on the WWW
DePaul University's Ethics Resources for Teachers and Trainers
Internet & Computer Ethics for Kids (and Parents & Teachers Who Haven't Got a Clue) (Winn Schwartau)
"Composing Ourselves Online: Broadening the Definition of Computer Literacy" (R.W. Burniske)

E-government/E-voting
Rebecca Mercuri's pages on Electronic Voting (and why she's ag'in it!)
The Digital Government Research Center (DGRC)

Some Security Product Vendors

AT&T: Internet security ftp server | Cheswick/Bellovin ftp server
CrypTEC Systems
CyberSafe (née Centrax)
EnGarde IP-Watcher
Internet Security Systems (ISS)
Network Associates
Network Flight Recorder (Marcus Ranum)
Platinum Technology (née AbirNet)
Secure Computing Corporation
SecurityDynamics (SecurID Vulnerabilities White-Paper (ftp))

Health Insurance Portability and Accountability Act (HIPAA)
Dept. of Health and Human Services Page... (includes library of proposed rules and mailing list information and "Standards for Privacy of Individually Identifiable Health Information")
Univ. of Michigan Health System HIPAA Page
Health Privacy Project (Georgetown University)
ICSA'a HIPAA Pages
Communications Technology Consultancy
3Com's HIPAA News and HIPAA FAQ
HIPAAcomply
VT/NH HIPAA consortium

Security Policies
Commonly Accepted Security Practices and Recommendations
U.S. Federal Best Security Practices (BSPs) (CIO Council)
Computer Security Administration guidelines
RFC 2196 (Site Security Handbook) and RFC 2504 (User Security Handbook)
Australia Defence Signals Directorate
British Standards Institute (BS7799)
CERT/CC: Security Improvement Modules | OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation)
Software Engineering Institute, Carnegie-Mellon Univ.
Murdoch Univ.
NIST's Special Publication: Internet Security Policy: A Technical Guide
Common Criteria Project: International Common Criteria Page | NIST's Common Criteria for IT Security Evaluation (CC) Page | National Computer Security Center (NCSC) page
SANS: Draft policies | S.C.O.R.E. (Security Consensus Operational Readiness Evaluation)
U.S. Dept. of Energy
"How to Develop a Network Security Policy" (Sun Microsystems)
Columbia University Information Security Policy Statement
WEDI — Workshop for Electronic Data Interchange
Information Security Policies Made Easy: A Comprehensive Set of Information Security Policies, V7, C.C. Wood
PentaSafe's VigilEnt Security Manager
IT Baseline Protection Manual, Federal Republic of Germany's Bundesamt für Sicherheit in der Informationstechnik (English)
IT Security Cookbook, S. Boran

Wireless Security
General Sites: Wireless Research (U. of Maryland) | The Unofficial 802.11 Security Web Page
Cigital Labs: ARP Poison paper | Wireless security | Wireless FAQ
IEEE 802.11 WIRED EQUIVALENT PRIVACY (WEP): UC Berkeley WEP flaws | IEEE 802.11 response | "Using the Fluhrer, Mantin, and Shamir Attack to Break WEP" | "Unsafe at any Key Size: An Analysis of the WEP Encapsulation" (J.Walker) | Configuring Wired Equivalent Privacy (Cisco) | "Penetration Testing on 802.11b Networks" (B. Huey) | AirSnort | WEPCrack
WAR DRIVING: High gain "Pringles" antenna (Arwain.net) | "Antenna on the Cheap (er, Chip)" [R. Flickenger] | NetStumbler | Perl script by P. Shipley | Scripts by F.L. Roque | Airopeek
WAP WTLS security problems
BLUETOOTH: Bluetooth specification | Bluetooth primer | Bluetooth security issues | More Bluetooth security

greetz fly out to yahya sibien, boy mikerosoft, nday, irwanto intellisys

and to YOU.

Hosted by www.Geocities.ws