Aladdin Security Alert -- eSafe Protects Surfers Against New Cross-Site Scripting Vandals Threat.

Business Editors/High Tech Writers

SEATTLE--(BUSINESS WIRE)--Feb. 8, 2000

Embedded Code on Web Pages and Web Servers Enables Hackers to

Poach Information and Access to Corporate Networks

THE SECURITY RISK

Five federal computer security agencies have issued a joint bulletin alerting the Internet community to dangers posed by malicious mobile code embedded in dynamically generated web pages. Using a method called cross-site scripting, hackers embed hyperlinks on dynamically generated Internet documents -- web pages generated by search engines or forms, for example -- with malicious scripts in HTML tags which many web servers do not recognize as hostile.

In this scenario, the unsuspecting user will click on hyperlink containing malicious code, and the URL sent to the web server in question will contain the user's request for information, as well as the malicious script code. When the web server returns the HTML web page, it may also contain the embedded malicious code, which will automatically execute upon arrival and expose the user to a security breach.

Because one source is injecting executable code into web pages sent by another source, this method of attack is called cross-site scripting. Malicious hyperlinks could potentially be found in newsgroups, message boards, email messages, web pages, web forms, or other mediums using dynamically generated Internet content.

THE IMPACT

Users may unintentionally execute malicious scripts when they follow untrusted links in web pages, email messages and newsgroup postings. These scripts pose any number of potential security threats to organizations, including:

--   Full access to any information provided to a web server,
     including confidential personal information often provided to
     companies in web forms
--   Transmitting a user's confidential information to another web
     page or web site
--   Alteration of the appearance or behavior of legitimate web pages
--   Exposure of encrypted data. Because malicious script tags are
     introduced before the Secure Socket Layer (SSL) encrypted
     connection is established between the user and the server, SSL
     encrypts the data with the malicious code attached.
--   Modification of a web site's cookies which create a persistent
     security breach

THE SOLUTION

eSafe Enterprise and eSafe Desktop automatically protect users against this form of Internet vandal through eSafe' s exclusive Sandbox technology. eSafe's Sandbox monitors the network or PC for malicious or inappropriate activity. When abnormal activity is detected, eSafe's Sandbox technology automatically quarantines the vandal and blocks the action, preventing access to vital information and damage to network resources. Because eSafe proactively monitors all system activity, rather than scanning for pre-defined or recognized malicious code, it is able to stop vandals without the need for security patches or program updates.

eSafe Gateway users can also shield their networks by turning on Smart Script protection that blocks malicious script at the Internet Gateway level. Directions to enable Smart Script can be found in eSafe Gateway's release notes or users may visit Aladdin's eSafe technical support Web site at http://esafe.com/support.html, or by calling 1-888-7SAFEPC.

ABOUT ESAFE

Aladdin's eSafe product suite, which includes eSafe Desktop, eSafe Enterprise and eSafe Gateway, provides the most comprehensive protection available against hostile elements on the Internet and gives users confidence in their ability to navigate the Internet safely. eSafe is the only comprehensive suite of content security solutions on the market to provide proactive protection from the gateway to the desktop. It also is the only one to provide Total Sandbox Quarantine(TM) protection against all forms of malicious content including viruses, vandals and worms. A unique feature found only in Aladdin's eSafe solutions, the sandbox erects a protective wall around vital system files and isolates all potentially dangerous viruses, vandals and worms in a sterile environment, preventing them from damaging, infecting or stealing from system resources.

Much more than anti-virus protection, the eSafe suite of products enables businesses to:

--   block users ability to alter vital system files, thereby reducing
     IT maintenance and repair costs.
--   stop access to web sites with inappropriate or malicious content,
     such as hate literature or pornography, or those sites known to
     propagate viruses.
--   restrict outgoing emails from sending classified or prohibited
     content.

ABOUT ALADDIN

Aladdin (NASDAQ:ALDN) is a global leader in securing digital content, from applications software to Internet use and access. Aladdin's products include HASP and Hardlock, software security systems that protect the revenues of developers and publishers; Privilege, a software licensing platform for the Internet; the eSafe line of anti-vandal, anti-virus and content filtering software for PCs and networks connected to the Internet; and eToken for Internet security and authentication. Aladdin serves its customers through eight offices located in the world's major software markets as well as a network of 50 distributors serving more than 100 countries. For more information, visit the Aladdin web site at www.aks.com.

Note to Editors: All trademarks and registered trademarks are the property of their respective holders.