Virus attacks on PGP

PGP can be vulnerable to virus attacks.  (Similar attacks can be made on
other cipher systems.) These virus attacks can either be "Get the Key", or
"Subvert the System" attacks.  Schneier's "Rubber Hose" attack and a class
of attack which I will call "Black Bag" attacks are get the key attacks. 
With a black bag attack, victims do not know their keys have been stolen,
and so continue to use them.  (According to "The Puzzle Palace", NSA got
the FBI to perform black bag attacks on embassies in Washington DC.)  I
don't think subvert the system attacks have any parallel in classical
cryptography.


Get the Key Attacks

PGP has three keys: the secret key ring pass phrase, the secret RSA key,
and the IDEA key.  Getting any of them would constitute a successful
attack.

A virus that collects secret key rings and sends their contents somewhere,
either via UDP like messages or by dialing the modem late at night doesn't
seem to much harder to build than one that erases your hard disk.  If it
runs only once per machine, its chances of getting caught are fairly low. 
The standard IP error handling of "throw away the packet" means that it
probably won't be caught by firewalls.  It seems more likely that someone
will catch their computer making an unauthorized 800 number call.  This
attack would allow an opponent to use a brute force attack on the pass
phrase.

Getting the pass phrase or the IDEA key requires that the virus infect
something in the PGP environment.  The infection could be to PGP itself, or
to the operating system in which it runs.  (N.B. Since Mac and PC systems
have only one protection domain, all programs running in them are part of
the operating system for the sake of this analysis.)

Assuming PGP is infected, although similar arguments apply to the operating
system, the possible mechanisms of infection are many:

  A infected PGP binary is installed
  A virus modifies disk copies of PGP
  The OS's loader is infected to modify PGP as it is loaded
  The compiler or linker is infected to modify PGP.

Any of these forms of infection could send pass phrases, secret keys, or
IDEA keys out via IP or modem.


Subvert the System Attacks

The mechanisms of infection are similar to those of the get the key
attacks, but these attacks do not require that the virus send data outside
the machine.  Instead, these attacks act by reducing the size of one of the
three key spaces, making it vulnerable to brute force attacks.  For
example, if the OS provides a "random number" service, then limiting the
randomness of the numbers constitutes an attack.  Making RSA key generation
loosely connected to the date and time constitutes an attack.


Defenses

One standard defense in classical cryptography is to frequently change the
cipher keys.  The PGP web-of-trust makes changing keys difficult, and is
perhaps the weakest part of the overall protocol.

Standard defenses against viruses can help, but if the attacker is
determined and competent, then the virus will not be detected by virus
detection programs, and will not have bugs which cause noticeable ill
effects on infected machines.

Custom changes to things like random number utilities and the PGP code
itself may increase resistance by preventing some of these attacks from
identifying the modified code as its intended target.

Auditing code, preferably object code, can detect infection.  Having ALL
the source code available is almost a requirement here.

Maintaining a file of cryptographic hashs of the IDEA keys used and
checking for duplicates can detect subvert the system attacks on IDEA key
generation at the risk that the cryptographic hash is in fact invertible
and can be used to reveal the IDEA key.

Using operating systems which run in many small protection domains can
limit the opportunity for infection.  One such system I have been involved
with for over 20 years is described at the following WEB sites:
  http://www.cis.upenn.edu/~KeyKOS/
  http://www.webcom.com/agorics/allkey.html

Bill


-----------------------------------------------------------------
Bill Frantz                   Periwinkle  --  Computer Consulting
(408)356-8506                 16345 Englewood Ave.
frantz@netcom.com             Los Gatos, CA 95032, USA

Thanks for the post.  I think there are a few interesting points, and 
some of the things I do to try to make things more difficult for a 
potential virus.

First, my secring is on a PCMCIA memory card, as is the versions of PGP, 
in this case DOS and Linux.  A virus is unlikely to attack both, and when 
the memory card is in, the network and modem cards are out.

Second, I think PGP is statically linked by default.  If it isn't this 
shoudl be changed - there was recently a CERT alert about telnet services 
being compromised by switching DLLs.  The code can also be cross compiled 
and burned onto a CDROM which would make it difficult to infect.

zerucha@shell.portal.com -or- 2015509 on MCI Mail
  finger zerucha@jobe.portal.com for PGP key

Where can one get PGP burnt into cdrom? Or the equiptment to do it
             Thanks in advance
                 moroni

> Where can one get PGP burnt into cdrom? Or the equiptment to do it

If you can wait a while, TERENA (UKERNA, SURFnet, etc) are producing a PGP CD
at the start of next year ...

> > Where can one get PGP burnt into cdrom? Or the equiptment to do it
> 
> If you can wait a while, TERENA (UKERNA, SURFnet, etc) are producing a PGP CD
> at the start of next year ...

Would PGP on CD-ROM truely gaurantee a corrupt/virus free executable? A 
virus already running in memory could tamper with what it's doing, 
perhaps extracting the necessary keys and dumping them to a log file.
This would be especially dangerous on a UNIX system where many people 
might be using PGP, thinking it is secure.

I think the only way to be safe is to actually boot up off of the CD-ROM, 
and hope that the hardware in your computer physically hasn't been 
tampered with :)

On Fri, 24 Nov 1995, Laszlo Vecsey wrote:

> > > Where can one get PGP burnt into cdrom? Or the equiptment to do it
> > 
> > If you can wait a while, TERENA (UKERNA, SURFnet, etc) are producing a PGP CD
> > at the start of next year ...
> 
> Would PGP on CD-ROM truely gaurantee a corrupt/virus free executable? A 
> virus already running in memory could tamper with what it's doing, 
> perhaps extracting the necessary keys and dumping them to a log file.
> This would be especially dangerous on a UNIX system where many people 
> might be using PGP, thinking it is secure.
> 
> I think the only way to be safe is to actually boot up off of the CD-ROM, 
> and hope that the hardware in your computer physically hasn't been 
> tampered with :)
> 

My original post mentioned two things, the other was to cross-compile the 
sources.  Maybe do it on 3 different systems (e.g. Sun, HP and DEC), and 
compare the binaries, then burn a CD.  A virus would have to be very 
versatile to infect multiple platforms and insert code for another.

It would also be silly for a virus to just dump keys when PGP runs, it 
would be far easier to look for any occurance of secring.pgp, and mail 
it, and/or monitor when it was opened and record keystrokes.  And log files
must go somewhere.

I don't know if I mentioned, but I keep PGP and my keys on pcmcia memory 
cards that aren't in the system at the same time as a network or modem 
card.  Moreover I can also simply use the DOS version (I use linux to 
communicate) - It would require quite an effort to create a virus that 
would work and pass data across the required OS problems and not break 
with the twice a week kernel-level changes :).

ViaCrypt also has a PCMCIA implementation of pgp, and it should be fairly 
easy to implement in an ASIC, or small embedded micro.  That would be 
much harder to compromise.  Of course anything so useful commercially 
woudl be the subject of our legal system.

It takes quite an effort to create a complex virus to do this.  It 
reminds me of the Glomar Challenger that was used to recover the remains 
of a russian sub (my memory is somewhat faulty).  Such a virus would 
require a great investment in time and money.  What target would be worth it?
Many otherwise feasible things aren't economically pracitcal.

zerucha@shell.portal.com -or- 2015509 on MCI Mail
  finger zerucha@jobe.portal.com for PGP key

-----BEGIN PGP SIGNED MESSAGE-----

On Fri, 24 Nov 1995, Moroni wrote:

> 
>     Where can one get PGP burnt into cdrom? Or the equiptment to do it
>              Thanks in advance
>                  moroni
> 
> 
> 

I remember seeing in computer catalog a device that can burn data into a
cdrom and it even supplies blank cd's.  Unfortunately, I cannot remember
the name of the catalog.  It might have been _Tiger Software_ or some
similar catalog.  I do know that the technology is available.


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: Processed by mkpgp, a Pine/PGP interface.

iQCVAwUBMLaOlrZc+sv5siulAQGpUgQAnj4I6lhgOX6Q6U9PctJn4pFcW7ncRguT
Npv8w7GR5TzBY7fejmiwVGqjSkw86trCvJwwR42azd2XAYU9t8zlSNO/r+dbqGQY
1mmA5RGUAuP5FVvVKoJqq0eYBhixe0E+G9/hBftqNlNAsIEuQ+sRd1MkoR1zu4R+
27+lBhQ72as=
=j0/5
-----END PGP SIGNATURE-----


`finger -l markm@omni.voicenet.com` for public key and Geek Code
Public Key/1024: 0xF9B22BA5 BD 24 D0 8E 3C BB 53 47  20 54 FA 56 00 22 58 D5
Homepage URL:http://www.voicenet.com/~markm/

On Fri, 24 Nov 1995, Mark M. wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> 
> On Fri, 24 Nov 1995, Moroni wrote:
> 
> > 
> >     Where can one get PGP burnt into cdrom? Or the equiptment to do it
> >              Thanks in advance
> >                  moroni
> > 
> > 
> > 
> 
> I remember seeing in computer catalog a device that can burn data into a
> cdrom and it even supplies blank cd's.  Unfortunately, I cannot remember
> the name of the catalog.  It might have been _Tiger Software_ or some
> similar catalog.  I do know that the technology is available.
> 
> 
There was a recent review in network computing of about 60 or so
different CDROM recording devices. The cheapest one was about $500 from
Liberty. The most expensive was I think the one from Kodak, for about $20k.
The capabilities of each are different. Some include buffering, some don't.
However, the pre-mastering software used to make file systems on a CDROM
(HSFS, UFS, DOS, ISO-???? (forget that four digit number) is sold separately,
but generally not too expensive. There are also single and multi-session
CD 'burners'. The single session mean you have to do the entire disk in
one session, and generally if you mess up, you need a new disk. The multi-
session devices let you start a session, and pick it up with more information
at a later time.

Most of them are designed for multi-media or audio recording, but you can
generally get pre-mastering software that will work with something like
CD-XA.. etc..
 Check your software for compatibility before purchasing the hardware.

____________________________________________________________________________
Doug Hughes					Engineering Network Services
System/Net Admin  				Auburn University
			doug@eng.auburn.edu
		Pro is to Con as progress is to congress