Re: Netscape rewards are an insult

> :I've deleted the rest of your content-free rant.  Instead of alluding to
> :some "flawed algorithm", why not tell us about the hole you say you've
> :found in netscape?

OK, Netscape functions by DESIGN as an enhanced delivery vehicle.

Is that a sufficient explanation of the hole?? or is more detail necessary
(which follows): 

     Netscape blindly trusts any and all ports on all servers.  On the 
     basis of this trust, it begins a negotiation with a server that 
     might well have a dynamic deliverability capability.  The client then 
     examines a Content-type header, trusts the content-type to decide 
     what application it should launch, and then launches and processes 
     the data block it is fed, all on good faith.

     It even trusts the server to redirect it to any arbitrary destination
     which it automatically loads and then executes.

Is this enough of an explanation??  Or should I paraphrase:

      Netscape is a gateway that permits an untrustworthy server to take 
      complete control of a client's machine.  The server can tell the 
      client where it should go, what it should load and how often, and
      what applications to execute on the client machine, as though this 
      arbitrary server were its master.

Does this help to underscore the problem??  

The Netscape Navigator client was DESIGNED to be controlled remotely from
any machine on the Internet.  This is the "flawed algorithm".  W3 was
meant to be hypertext ... not a gateway that permits a server to deliver
customized byte bombs down a clearcut path by remote-control. 

If people don't know that you don't let another person (or machine) take
control of your machine and run programs on it ... well, like I said in
the past. 

>   "Let me make this absolutely clear.
>
>   It should not be up to non-US citizens like myself to safe-guard US
>   economic security, and protect vital national interests.  It is not 
>   my job and certainly not my responsibility to protect the international
>   public and Fortune 500 companies from poor security."

So without giving out another "exploitation algorithm" to the Internet,
without extending a helping hand to Japan to retaliate against the US for
the American Japanese auto surveillance, I will simply quote from two
sources which are "public record" and mentioned in the FAQ. 

From the "Orange Book", one of the volumes of the Department of Defence's
"Rainbow Series" more commonly known as TCSEC (Trusted Computer System
Evaluation Criteria) and available from: 

 U.S. Government Printing Office         INFOSEC Awareness Office
 Superintendent of Documents     - or -  National Computer Security Centre
 Washington, DC 20402	                 9800 Savage Road	
                                         Fort George G. Meade, MD  20755-6000

which stipulates that:

      "... it is required that ADP (Automated Data Processing) systems
       that "process, store, or use classified data and produce 
       classified information will, with reasonable dependability, prevent:

        a. Deliberate or inadvertent access to classified material by
           unauthorized persons, and

        b. Unauthorized manipulation of the computer and its associated 
           peripheral devices."

The above quoted reference is public information.  And, since Netscape is
making "no-comment" I will quote Netscape's public information. 

>   NETSCAPE CLIENT APIS (NCAPIS) 2.0
>          The NCAPIs are designed to allow third-party applications to
>          remotely control the Netscape Navigator client. They are
>          platform specific, utilizing the platform's native method of
>          interprocess communication (IPC). These APIs are not final
>          and may change with the release of version 1.1 of Netscape
>          Navigator (they do not work with Netscape Navigator 1.0).

Herein is the "flawed algorithm" which is just a fancy way of saying that
it's a flawed idea.  And this isn't new ... it's been there for a long
time. 

Generally, we don't routinely trust every other computer, foreign or 
domestic on the Internet to manipulate us by remote control.  This is
as basic as the idea that we don't give out our PIN numbers with our 
banking cards to anyone who asks us.  

If someone tries to suggest differently, then they are a fool.

Let's recall that Version 1.1 of Navigator was released long ago, and
trusts every machine on the Internet to do just that.  It trusts every
other machine on the Internet to be "trustworthy".  Whether that machine
is foreign or domestic.  We are not speaking about the new and improved --
feature added -- "beta" 2.0 software, we are speaking of the software that
AT&T is using internally and is selling to its customers as we speak as a 
"co-branded" product.

Software which AT&T security "approved" of in direct contravention of the
most basic of basic security principles.

Let me reiterate this.

Netscape's current existing software was designed in direct contravention
of the US Department of Defence's evaluation criteria for Trusted Computer
Systems, the TCSEC.  It also contravenes the ITSEC (Information Technology
Security Evaluation Criteria) which is a document developed by the
British, German, French, and Netherlands governments.

(Anyone can get a free copy of ITSEC by writing to the Commission of the
European Communities in Brussels.)

Netscape forgot one thing about trust.  If you "trust everyone" ... even if
you always trust everyone, you always cut the cards.

And when you're playing poker at these stakes ... well ... 'nuff said.



Alice de 'nonymous ...

                                  ...just another one of those...


P.S.  This post is in the public domain.  Please don't shoot the messenger.
                  C.  S.  U.  M.  O.  C.  L.  U.  N.  E.

P.P.S If this is confusing to anyone, please direct your comments to
      one or all of the following newsgroups:

                   alt.2600
                   alt.security
                   comp.security.announce
                   comp.security.misc
                   comp.virus

Futplex <futplex@pseudonym.com> write:
> Meta-noise, but I don't plan to lose any sleep over this....
> Maybe I'm just too sheltered. But in a couple of years on the Net, I've only
> ever seen _one person_ write "W3" as an abbreviation for World Wide Web
> before now.

I do use W3 too, though I'm not Alice I swear ;) !
(and I doubt i'm alone)

dl
--
Laurent Demailly * http://hplyot.obspm.fr/~dl/ * Linux|PGP|Gnu|Tcl|...  Freedom
Prime#1: cent cinq mille cent cinq milliards cent cinq mille cent soixante sept

AK-47 $400 million in gold SEAL Team 6 nuclear Clinton Pasqua
 plutonium

Dearest Alice:

A) Please get an alpha account so that I can killfile you.

B) Barring (A), please post an -EXPLOIT-. Back up your words with
working code. Show me how Netscape, properly configured, does what you
describe. Hell, I'll give you a t-shirt for it.

-- 
sameer						Voice:   510-601-9777
Community ConneXion				FAX:	 510-601-9734
The Internet Privacy Provider			Dialin:  510-658-6376
http://www.c2.org (or login as "guest")			sameer@c2.org

Meta-noise, but I don't plan to lose any sleep over this....

Someone writing as Alice de 'nonymous writes:
> The Netscape Navigator client was DESIGNED to be controlled remotely from
> any machine on the Internet.  This is the "flawed algorithm".  W3 was
> meant to be hypertext ... not a gateway that permits a server to deliver
> customized byte bombs down a clearcut path by remote-control. 

Maybe I'm just too sheltered. But in a couple of years on the Net, I've only
ever seen _one person_ write "W3" as an abbreviation for World Wide Web
before now.

Alice, meet Fred. Fred, meet Alice.

-Futplex <futplex@pseudonym.com>

Aleph One / aleph1@dfw.net
http://underground.org/
KeyID 1024/948FD6B5 
Fingerprint EE C9 E8 AA CB AF 09 61  8C 39 EA 47 A8 6A B8 01 

On Thu, 19 Oct 1995 anonymous-remailer@shell.portal.com wrote:

> >   NETSCAPE CLIENT APIS (NCAPIS) 2.0

> Generally, we don't routinely trust every other computer, foreign or 
> domestic on the Internet to manipulate us by remote control.  This is
> as basic as the idea that we don't give out our PIN numbers with our 
> banking cards to anyone who asks us.  

Have you actually read the stuff? The NCAPIS is not on by default.
You *must* enable it by tellling it to which port to listen on.
Further more Mosaic had a remote control API before Netscape did.

On Thu, 19 Oct 1995 10:22:40 -0700, Alice de 'nonymous wrote:


>>From the "Orange Book", one of the volumes of the Department of Defence's
>"Rainbow Series" more commonly known as TCSEC (Trusted Computer System
>Evaluation Criteria) and available from: 
>
> U.S. Government Printing Office         INFOSEC Awareness Office
> Superintendent of Documents     - or -  National Computer Security Centre
> Washington, DC 20402	                 9800 Savage Road	
>                                         Fort George G. Meade, MD  20755-6000
>
>which stipulates that:
>
>      "... it is required that ADP (Automated Data Processing) systems
>       that "process, store, or use classified data and produce 
>       classified information will, with reasonable dependability, prevent:
>
>        a. Deliberate or inadvertent access to classified material by
>           unauthorized persons, and
>
>        b. Unauthorized manipulation of the computer and its associated 
>           peripheral devices."
>

I used to work in ADP security for the U.S. navy and can tell you that
at least the Navy's requirements also include the machine's physical
security and the networks that these machines may be connected to.  In
fact I believe that Secret information can only be stored on a machine
in vault or on removable media.  These are not things that the average
individual is going to do with there computer.  Netscape only attempts
to secure the information being transferred from a trusted client and
a trusted server.  I have yet to see Netscape claiming that if you
install their software on your machine that you will never again
suffer from data loss.  Your expectations are ridicules, Netscape
cannot be held responsible for the end user not properly configuring
their machine.  Please stop wasting everyone's time with your
ridicules rants.  If you must continue to post your idiocy stop using
an anonymous remailer so that the rest of us who want to use this
mailing list for intelligent discussion can kill file you.



Dan Weinstein
djw@pdcorp.com
http://www.earthlink.net/~danjw
PGP public key is available from my Home Page.
All opinions expressed above are mine.

"I understand by 'freedom of Spirit' something quite definite -
the unconditional will to say No, where it is dangerous to say
No.        
           Friedrich Nietzsche