Linux vs. Microsoft: Who solves security problems faster?

Rudimentary treatise on the construction of locks

The difference between a hacker and script kiddie

misc

• A nice overview page with links to more pages for more info (securitybaron.com).
• Encryption
• Internal vs External breakins
• Redhat Linux security problems
• Bastille Linux
• Stackguard, part of immunix
• chkexploit - check for vulnerabilities on linux
• Vulnerability database
• NIST's vulnerability database: ICAT
• Joe's Generic SUID/SGID Wrapper
• Paper summarizing CERT reported incidents
• Infinity Void (exploits)
• "Reptile" on linux security
• Security and hackerscene"
• Intro to denial-of-service attacks
• The ping attack
• Taxonomy of attacks
• There be dragons...
• Ned's
• Securing NIS
• Coast
• Spaf's hotlist
• Comprehensive list of security sites (Spaf's list)
• Eight little green men
• flying.fish (Dan Farmer)
• unimi archive
• Telstra
• Fixing security in SunOS 4.1.3 and 4.1.3_U1 boxes
• another page describing many things that need to be done to make SunOS 4.1.x secure - this one is a unixworld article
• unix security (comparitech)
• network security scanners
• Where's Robert Morris?
• security FAQ's provided by ISS
• First team contacts
• Arny's (ypghost, more)
• Misc, including a good SYN sniffer
• MCN's intrusion info
• All.Net
• Setting up anon ftp securely
• "Giga" hacker ftp
• GWU's Staying Safe Online with Cybersecurity Information

Self-spreading, attacking programs (viruses, worms)

• Nice description of 'the worm', from Carleton
• Plausibility of unix viruses

non-atomic IP (mostly TCP)

• IP spoofing (emv's)
• IP spoofing again ("spoofit")
• RED - good for guarding against listen-queue overlow SYN-based attacks
• Phrack on IP spoofing and SYN floods
• ...and how some slimeball smashed up panix with a syn flood
• TCP/IP intro
• Firewall design that handles SYN attacks (Firewall-1)

sendmail

• smstart
• List of sendmail security problems

Formal bodies/companies

• CERT
• CIAC
• SGI security

alternative security models

• POSIX 1e (linux privs)
• CAT

"fascist" password checkers and password crackers

• Netpassword
• UCI's yppasswd
• npasswd
• passwd+
• List of password cracking programs

secure telnet

• SRP (entire auth system, plus telnet, ftp...)
• SNP
• ensta's - derived from SRA
• slush - intended to become an ssh replacement, based on open protocols. Uses ssl/tls.
• ssh
• the package
• Understanding RSA and DSA authentication with ssh v1 and v2
• performance
• Free SSH implementations
• the new lsh web page
• F-Secure ssh
• SSL telnet
• Another SSL telnet
• Stel
• stelnet
• SSLified r* commands

secure TCP/IP

• sun collection: IPng and IPv6
• swipe
• cryptographic protocols and standards
• Probable Plaintext attacks
• NIST's IPv6 project
• Mentat's overview
• FreeS/WAN (ipsec + ike) for linux
• Key management with IPv6
  • skip
    • enSKIP
    • SKIP in Russia
    • Sun internet commerce group
  • ISAKMP/Oakley
    • ISAKMP/Oakley from Cisco
    • Freely redistributable version, MIT server
  • Photuris was also a contender for IPv6 key management

export law

• Survey: What crypto is in use where?
• RSA FAQ
• Crypto policy resource page
• Crypto law survey

cryptography

Patent issues

• The RSA algorithm and the RSA patent

Kerberos

• coast's collection of papers
• UC, interrealm auth

Web stuff

• The WWW security FAQ

Hacking tools

• infonexus
• cyberpk1.html
• cyberpk2.html
• 2600
• rootshell

Hoaxes

• CIAC
• Symantec
• urbanlegends.com

Checking the security of your SSL browser connection

Writing secure programs

• Study in Scarlet - about the difficulties of writing secure php programs
• shmoo.com: how to write secure code
• SWOL: unix security
• SWOL: security
• Adam's review
• Bishop's secure programming
• SMB's
• Kragen's
• Aleph1's summary on learning security
• faqs.org: The Secure Programming (SUP) FAQ

Internet

• Meta Weather
• Lots of crypto