Re: NetScape's dependence upon RSA down for the count!

> The point to attacking SSL is to be able to decode a message from any
> browser, without having to do anything extraordinary to the victim's host.
> No cryptosystem is proof against an attacker who can see and
> control everything you do on the client side (i.e. has root in UNIX
> parlance).
> 
> So, while your idea #1 might be interesting or fun to do as far as computer
> security goes, it's not an attack on SSL. 

Agreed, within limits. Security as "Marketed" by NetScape goes far past
just claiming SSL to be secure, including the use of NetScape client
and servers as secure. With this expanded model, attacking NetScapes
claim of security includes attacking the process and enviornment that
they provide to endusers and info mall businesses. In this case
electronicaly distributing clients in a hostile environment is a gross
disregard for endusers security needs, traded off for ease of distribution.

I probably should not have included virus attacks, and just focused
upon the main problem ... unsecured network transmission of clients.

As it stands, a third party with minimal trouble can compromise a very
large number of NetScape clients and capture the dredit card data for
those users who would otherwise expect their transactions to be secure.

To take the ground that their product is secure in a secure environment
is meaningless ... the product value they seem to offer is security in
a non-secure environment - which I don't think is true, and I gather
you might agree?

> That points out the flaw in Netscape's authentication model that
> others have already pointed out on this list.  Admittedly, like Don
> Stephenson just posted, there's not really a good way to distribute
> and authenticate certificates until there's a ubiquitous global
> CA chain.

Again, we agree that this reflect negatively on NetScapes claims of
security in an unsecure environment?
	
As an aside, readers in private have suggested that a signature by
Verilog as the CA my not be required, quoting that until receintly,
NetScape signed their own certificates. This seems that the MITM
can choose his own CA, possibly of his own design to sign false
certificates.
	
> Assume that the attacker Mallet is in the middle and has control of the http
> stream.  Alice clicks on 'open Widget order form' to order a Widget
> and Mallet sends her browser a redirect pointing to his evil web server.
> Alice doesn't notice that the hostname in the url has changed, or
> if she does, she figures that the catalog people have arranged to
> have Mallet's server host their 'secure' transactions (not an unreasonable
> assumption).  Mallet takes the order and pockets the money.
> The hostname in the certificate (Mallet's) matches the hostname
> in the URL (also Mallet's).

Or Mallet places the order in Alice's name defering the chances of detection
until enough cards numbers are aquired to make a run on the bank. There is
tremendous value in forstalling the point of detection and the location of
the MITM becoming known. If Alice get's her goods promptly she is much less
likely to question the transaction.

> Of course this isn't really an attack on SSL per se.  It's an attack on
> the certificate-granting policy- the CA gave a certificate to
> an unscrupulous person (Mallet).

But it is a clear attack on NetScape's advertised "security" for end users.

Almost all sucessfull crooks/thieves have a front business to launder their
money thru. In this case you can steal customers just by redirecting your
competitor's DNS records to your server ... With a similar home page
and ordering/catalog screens they might never notice the switch, certainly
not first time customers. Gee nobody would probably own up to the occasional
named failures that could also cause this.

Somehow I don't think this is what endusers of info mall owners consider
security.

> > > Well of course, if the secret key of the server (or worse yet, certificate 
> > > authority) is compromised, all bets are off.  That's true of just about any 
> > > protocol you can dream up.
> > 
> > I'm not referring to the secret key of _the_ server; I'm referring to the 
> > secret key of _ANY_ server. In the limiting case, such a key can be 
> > obtained by buying one from the CA. 
> 
> Right. That's what I pointed out in an earlier message, although I
> didn't elaborate on it.   The security of Netscape browsers depends
> on Verisign's policy in handing out server certificates.

and on the physical security of the site plus it's network connections,
the trustworthyness of it's internal staff and contractors, and it's ability
to deliver service in the face of failures and disasters, both man made
and natural.

Security includes more than just crypto correctness, in this case it
include denial of service attacks as well has physical site attacks.

In this case I strongly suspect that bombing Verilog would shutdown
net commerce for a while. Certainly it's employees are in a position
to earn high six figures for the key algorithm or a copy of the key
database.

As for the policy, it has to include mom & pops and young business owners
setting out to make their honest fortune on the net ... unfortunately
this profile includes the evil side as well. I don't think restricting
info mall business to the fortune 500 is that we have in mind here.
As such, I don't think screening by the CA takes us very far at all.

> Backing up for a minute, the same problem holds for those neeto
> credit-card readers that Visa and MasterCharge give out to merchants.
> The merchant can be a crook setting up a 'store-front' operation to charge
> to bogus/stolen card numbers, or the employees can steal using the numbers
> they get in the corse of doing business, etc.  There are already
> procedures in place for dealing with this sort of crime.  I'm not
> sure that tricking Verisign into giving out a certificate to a group
> of crackers is really any different than tricking Visa into giving
> a card reader to a group of theives.

Volume greatly affect the risk factor. Giving a merchant number to a
business means that only the number of people that can walk-in or
phone in to that merchants store are at risk. Stolen cards are handled
differently than stolen numbers. Stolen numbers are cross correlated
by past purchase locations by store, and if possible by register location
and employee. There is a strong pointer to the person(s) involved.

Skimming card numbers off the net has the potential to cross vendors,
geographic areas, and other determinates that would aid in locating the
source of the tap. The number of card numbers exposed has the potential
to be several orders of magnitude higher, and remain undetected for quite
some time. The net offers the ability to place a large number of orders
in a short period of time for very high valued merchandice for delivery
to what would appear proper customers ... and using the UPS/FedX example
picking off the proceeds in a centralized low security location. With
another computer store front on the net, you turn the same hijacked goods
into full value shipments in a few days ... and maybe coordinate the
bogus orders and hijackings to meet your customers demands.

Or for an economic terrorist create $100 million in bogus orders and
deliveries to drive the system into failure.

Gone are the days when sheer man-power limited your exposure.  Gone
are the days when a sturdy building, good doors and locks, and a
security system backed by Well Fargo staff would protect your business.

Security in our network context includes not only the protection of
the individual consumer, but the info mall vendors and the future of
the medium as a viable way to do business. NetScape I believe is working
toward all three of these goals, I strongly disagree with the short
cuts and risks they are taking to get there.

John Bass

On the topic of risks for a "major browser" to be tempered/targetted
as a virus :

I asked monthes ago netscape folks to make md5sum and/or PGP digital
signatures (preferably md5sum of each files, this in a file, itself
pgp signed) of the binaries available on their page and on relevant 
newsgroup to reduce possibility of tempering.

[ok it won't help mythical joe six pack's but...]

Maybe I'll got more luck calling from here :-)


dl
--
Laurent Demailly * http://hplyot.obspm.fr/~dl/ * Linux|PGP|Gnu|Tcl|...  Freedom
Prime#1: cent cinq mille cent cinq milliards cent cinq mille cent soixante sept

SEAL Team 6 SDI NORAD Nazi mururoa cryptographic Panama

In article <9510030248.AA08909@hplyot.obspm.fr>, dl@hplyot.obspm.fr (Laurent Demailly) writes:
> 
> On the topic of risks for a "major browser" to be tempered/targetted
> as a virus :
>
> I asked monthes ago netscape folks to make md5sum and/or PGP digital
> signatures (preferably md5sum of each files, this in a file, itself
> pgp signed) of the binaries available on their page and on relevant 
> newsgroup to reduce possibility of tempering.
> 
> [ok it won't help mythical joe six pack's but...]
> 
> Maybe I'll got more luck calling from here :-)

  I've been thinking about this recently for obvious reasons.  My concern
is that if someone can attack your download of netscape, they could also
attack your download of the program that validates netscape.  Is there
really any way out of this one?

	--Jeff

-- 
Jeff Weinstein - Electronic Munitions Specialist
Netscape Communication Corporation
jsw@netscape.com - http://home.netscape.com/people/jsw
Any opinions expressed above are mine.

Jeff Weinstein writes:
 > In article <9510030248.AA08909@hplyot.obspm.fr>, dl@hplyot.obspm.fr (Laurent Demailly) writes:
 > > I asked monthes ago netscape folks to make md5sum and/or PGP digital
 > > signatures (preferably md5sum of each files, this in a file, itself
 > > pgp signed) of the binaries available on their page and on relevant
 > > newsgroup to reduce possibility of tempering.
[...]
 >   I've been thinking about this recently for obvious reasons.  My concern
 > is that if someone can attack your download of netscape, they could also
 > attack your download of the program that validates netscape.  Is there
 > really any way out of this one?
I have *already* downloaded, checked,... pgp years ago, and I did
multiplatforms cross tests,... so all I need is a pgp signed stuff
(obviously i need your (netscape's) pgp public key too, but I think
that a "massive" distribution, that is : mail on a couple of mailing
lists, your site, newsgroup, eventually adding fingerprint by phone
for the paranoid, would ensure that your key is indeed your key (it
can probably take few weeks before it's "sure" (you'll get feedback if
key have been tempered somehow)
Or easiest even manage that your key is signed by some well known folk
(PhilZ,...))

See my point ?

ps :imo the later your start, the harder it'll be to be "sure" of
something. (reputation of a key takes some weeks/monthes,...)

dl
--
Laurent Demailly * http://hplyot.obspm.fr/~dl/ * Linux|PGP|Gnu|Tcl|...  Freedom
Prime#1: cent cinq mille cent cinq milliards cent cinq mille cent soixante sept

$400 million in gold Legion of Doom mururoa assassination break Peking
Delta Force

On Oct 3,  6:19pm, Laurent Demailly wrote:
> Subject: Re: Netscape finally issuing md5sums/pgp signed binaries ? (was R
> 
> [ text/plain
>   Encoded with "quoted-printable" ] :
Jeff Weinstein writes:
>  > In article <9510030248.AA08909@hplyot.obspm.fr>, dl@hplyot.obspm.fr 
(Laurent Demailly) writes:
>  > > I asked monthes ago netscape folks to make md5sum and/or PGP digital
>  > > signatures (preferably md5sum of each files, this in a file, itself
>  > > pgp signed) of the binaries available on their page and on relevant 
>  > > newsgroup to reduce possibility of tempering.
> [...]
>  >   I've been thinking about this recently for obvious reasons.  My concern
>  > is that if someone can attack your download of netscape, they could also
>  > attack your download of the program that validates netscape.  Is there
>  > really any way out of this one?
> I have *already* downloaded, checked,... pgp years ago, and I did
> multiplatforms cross tests,... so all I need is a pgp signed stuff
> (obviously i need your (netscape's) pgp public key too, but I think
> that a "massive" distribution, that is : mail on a couple of mailing
> lists, your site, newsgroup, eventually adding fingerprint by phone
> for the paranoid, would ensure that your key is indeed your key (it
> can probably take few weeks before it's "sure" (you'll get feedback if
> key have been tempered somehow) 
> Or easiest even manage that your key is signed by some well known folk
> (PhilZ,...))
> 
> See my point ?

  Yes, I get the idea about spewing the signed hashes everywhere.  The
problem I have is with the user of PGP.  That will help cypherpunks,
but does absolutely nothing for most of our millions of users, who
have no idea what PGP is.  Perhaps its enough to assume that if anyone
is tampering with the distribution, some cypherpunk will stumble across
it...

	--Jeff


-- 
Jeff Weinstein - Electronic Munitions Specialist
Netscape Communication Corporation
jsw@netscape.com - http://home.netscape.com/people/jsw
Any opinions expressed above are mine.

-----BEGIN PGP SIGNED MESSAGE-----

    From: Jeff Weinstein <jsw@netscape.com>
    Date: Tue, 3 Oct 1995 14:03:28 -0700
    Subject: Re: Netscape finally issuing md5sums/pgp signed binaries ? (was Re: NetScape's dependence upon RSA down for the count!) 

    . . .

      Yes, I get the idea about spewing the signed hashes everywhere.  The
    problem I have is with the user of PGP.  That will help cypherpunks,
    but does absolutely nothing for most of our millions of users, who
    have no idea what PGP is.  Perhaps its enough to assume that if anyone
    is tampering with the distribution, some cypherpunk will stumble across
    it...

I suspect that most of these millions don't know about md5 or much of
anything in the way of strong authentication.  However, if you provide
any sure-fire mechanism by which someone could detect that the
distribution has been tampered with, it would be an improvement over
not having any.  If someone does happen to notice tampering and send
mail to cypherpunks about it, I'd guess that there's a good chance it
would be reported in major publications shortly thereafter.

You might want to indirect through BETSI . . . .

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMHHUeZNR+/jb2ZlNAQHVCQP8CBb5c/0nX41awTf/kt+gGODu4qLcJVI8
rc604+rdr0YUFPVTStwXdUCg7gKgUTOC8werBPK5Dgyse/8u1jczU4Czub9Cd693
EfUW7o2oHN5/3x9E0Yn1rJD+ffwuGC+lf1EMBJMHsTwJzbPmy0FJPfyfyDlvWrDD
OQDsJ5DbOHU=
=s/t0
-----END PGP SIGNATURE-----
--
Rick Busdiecker                        Please do not send electronic junk mail!
 net: rfb@lehman.com or rfb@cmu.edu    PGP Public Key: 0xDBD9994D
 www: http://www.cs.cmu.edu/afs/cs.cmu.edu/user/rfb/http/home.html
 send mail, subject "send index" for mailbot info, "send pgp key" gets my key
A `hacker' is one who writes code.  Breaking into systems is `cracking'.

>   Yes, I get the idea about spewing the signed hashes everywhere.  The
> problem I have is with the user of PGP.  That will help cypherpunks,
> but does absolutely nothing for most of our millions of users, who
> have no idea what PGP is.  Perhaps its enough to assume that if anyone
> is tampering with the distribution, some cypherpunk will stumble across
> it...

If nothing else, Jeff, it will expose those "millions of users, who
have no idea what PGP is" to PGP.  And, hopefully, some of those
"millions of users" might even take the time to grab PGP and take a
look at that, too.

In other words, there is nothing to lose (except a little bit of time
and effort, and a small amount of storage space) and there is a heck
of a lot to gain by including PGP signatures.

-derek

-----BEGIN PGP SIGNED MESSAGE-----

Hello "Jeff Weinstein" <jsw@netscape.com>
  and Laurent Demailly <dl@hplyot.obspm.fr>,
  and jsw@neon.netscape.com (Jeff Weinstein)
  and cypherpunks@toad.com

"Jeff Weinstein" <jsw@netscape.com> writes:

> On Oct 3,  6:19pm, Laurent Demailly wrote:
> > Subject: Re: Netscape finally issuing md5sums/pgp signed binaries ? (was R
...
> 
>   Yes, I get the idea about spewing the signed hashes everywhere.  The
> problem I have is with the user of PGP.  That will help cypherpunks,
> but does absolutely nothing for most of our millions of users, who
> have no idea what PGP is.

Provided they know at least one person who does, they might well ask
that person to come and verify it for them.

Then again the tampered-with version might not mention PGP-signatures
at all (unless you use it widely in your publicity).

> Perhaps its enough to assume that if anyone
> is tampering with the distribution, some cypherpunk will stumble across
> it...

You wouldn't want that to be your only argument, but it helps...

If you mention all over the place that the program is PGP-signed
to foil {cr,h}ackers and viruses (*), chances are a lot of people will
ask their one colleague or friend that does know PGP to verify it for them.

Footnotes:
  (*) well, gotta use the four horse{wo,}men, no?

Jiri
- --
If you want an answer, please mail to <jirib@cs.monash.edu.au>.
On sweeney, I may delete without reading!
PGP 463A14D5 (but it's at home so it'll take a day or two)
PGP EF0607F9 (but it's at uni so don't rely on it too much)

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2i

iQCVAwUBMHHu7CxV6mvvBgf5AQHTaAP/W2RKNFiGFc4WjE4saoAls8/Q3N+zlkqm
sDOCga9t9ElSY+jf0XQR/MLxMnuJ4n2H1gbzxnK+ELAbubzRBjNfK+I66IsN89nd
FYEwtnGMSgmmPtO2Y8X0KaFwkdRS8XUVgvnyYVrrhz/6dh3VvcLy5imLBK0fbIrA
r2+u9FL6fuQ=
=2WVg
-----END PGP SIGNATURE-----

> 
> If you mention all over the place that the program is PGP-signed
> to foil {cr,h}ackers and viruses (*), chances are a lot of people will
> ask their one colleague or friend that does know PGP to verify it for them.

	Yeah, just imagine the PR possibilities!

-- 
sameer						Voice:   510-601-9777
Community ConneXion				FAX:	 510-601-9734
An Internet Privacy Provider			Dialin:  510-658-6376
http://www.c2.org (or login as "guest")			sameer@c2.org