Chapter: 2, What, Me Worry?
Section: But I Use a Mac!
Page: 10, 18

In July and August 2001, the "Code Red" worm infected a large number of Windows machines. The same Macintosh used in the previous study, on the @Home network, was attacked repeatedly by this worm. attacks from 1400 unique IP addresses were detected in the 30 day period ending August 21, 2001 (indicating 1400 infected Windows machines). The Macintosh is immune to "Code Red", as it is immune to most other attacks.

There were a couple interesting aspects of the attacks

Almost all the attacks were from machines on the @Home network.
In contrast, a Macintosh on the Ashland Fiber Network (AFN) logged attacks from 500 unique addresses in the same period. The AFN is also a high-speed cable modem system, but is much less well known than @Home, and consists of many fewer machines.

-----------------

Chapter: 3, Physical Security
Section: Things will go wrong anyway (Backup options)
Page: 27

When you sign up for an iTools account so as to be able to use iDisk for backup, you also get a Mac.com e-mail address. However this e-mail address can compromise the security of your iDisk if not used properly. See the note below on this subject.

-----------------

Chapter: 5, Safe Surfing
Section: Safe E-mail (Sending your e-mail password)
Page: 61

Although the Mac.com site does use SSL to encrypt your password when sending it to that site, your password is sent in clear text if you use an e-mail application to read your Mac.com email through the Mac.com server. The Mac.com server does not seem to support APOP, so it is recommended that you use the Mac.com site to have your Mac.com e-mail forwarded to another mail server that does (or, alternately, use one iTools account for your email and a different one, with a different password, for your iDisk).

-----------------

Chapter: 10, Securing Third-Party Internet Services
Section: Your data could be backed up by an intruder
Page: 141

It is possible for an intruder to use Retrospect to attempt to back up your machine over the Internet. Retrospect has a dialog that allows users to specify a machine to be backed up over TCP/IP by simply typing an IP address. This feature makes the use of a firewall even more important. If you wish to allow backup of your machine over TCP/IP, a firewall can deny access to Retrospect except from the IP address of the desired backup machine. If you do not wish to allow backup of your machine over TCP/IP, a firewall can deny access to Retrospect from all IP addresses.

-----------------

Chapter: 13, Analyzing and Responding to Security Threats
Section: Creating the e-mail
Page: 233

An IP address you investigate may or may not be the ultimate origin of a given attack. A common ploy used by hackers is to use others' machines from which to launch their attacks. Hackers who have obtained unauthorized access to a machine can upload a piece of software to that machine (Figure 1), and then communicate with that software over the Internet (Figure 2), telling the software to perform various kinds of mischief to another user's machine (Figure 3).

Figure 1. Hacker uploads software to user A's machine

Figure 2. Hacker tells software to attack user B's machine

Figure 3. Attack is launched on user B's machine from user A's machine

Since this is done without user A's knowledge, user A may rightly claim to have no knowledge of an attack on user B, even though the attack came from user A's machine. If a user you investigate claims no knowledge of an attack you're inquiring about, you may wish to suggest to the user that their machine may be infected with a virus or otherwise have been taken over by a third party.

-----------------

Chapter: 16, Wireless Networking
Section: Too much freedom
Page: 282

Recent analysis has revealed that the algorithm used by WEP (wired-equivalent privacy) to encrypt communication on 802.11b networks is flawed. It is possible for someone to figure out the password used on WEP-based networks simply by listening on those networks for a long enough time. For home networks, which are lightly used compared to business networks, that time may be on the order of days, but the flaw means that use of WEP on Airport networks should be re-examined. If someone does obtain your WEP password, he will be able to act as a full participant on your wired network, and also to listen in on all your network communications unless those communications are specifically encrypted. For these reasons, you should:

Not use your WEP password for any other service, and especially not for your Airport base station.
Implement multiple levels of defense, as mentioned in this chapter and throughout the book.
If you need to communicate with complete security, use an encrypted protocol like SSL (see chapter 5), or use a wired network.
Continue to use WEP, since it does making spying and other hacking on Airport networks harder.

The 802.11b committee is looking at more secure alternatives, so expect more changes in this area in the near future.

-----------------

Section: How AirPort is used
Page: 280

The AirPort Base Station 2.0 has two Ethernet ports. You connect the "WAN" Ethernet port of the Base Station to your cable or DSL modem, and the "LAN" Ethernet port to any wired machine or network you may have.

Figure 16.4c Airport Base Station 2.0 setup

-----------------