|
Re: MS on the CCC ActiveX virusDate: Fri, 21 Feb 1997 11:46:11 -0800 (PST) From: fc@ca.sandia.gov (Fred Cohen) Subject: Re: MS on the CCC ActiveX virus (RISKS-18.83) Re: SBN Wire: News Flash, Brad Silverberg > You may have heard reports about a malicious software program created and > demonstrated recently by the Chaos Computer Club (CCC) in Hamburg, Germany. > I want to personally assure you that Microsoft(R) Internet Explorer 3.0 has > the appropriate safeguards to protect against this type of threat. By using > its default security level (High) that comes pre-set, Internet Explorer 3.0 > will not download and run any "unsigned" control such as the one from the > CCC. I appreciate your insightful opinion on this matter, however... Anyone can get a signature key without authenticating their legitimacy. It's relatively easy to break into a system and take a legitimate key. The default may be changed by the user for one use and remain changed. Other flaws in Explorer may be used to turn that feature on - then look out. > The CCC demonstrated its malicious executable code running on Microsoft > Internet Explorer 3.0, though they could just as easily have demonstrated a > similar attack on any other browser. While it is unfortunate that hackers > have created this harmful program, it does point out the need for users to > act cautiously and responsibly on the Internet, just as they do in the > physical world. I appreciate your insightful opinion on this matter, however... This is not accurate. The very nature of ActiveX makes it impossible to operate it securely. Unlike other vendors who make attempts at providing improved protection, ActiveX is a hole waiting to be exploited. > Malicious code can be written and disguised in many ways - within > application macros, Java(tm) applets, ActiveX(tm) controls, Navigator > plug-ins, Macintosh(R) applications and more. For that reason, with > Internet Explorer 3.0, Microsoft has initiated efforts to protect users > against these threats. Microsoft Authenticode(tm) in Internet Explorer 3.0 > is the only commercial technology in use today that identifies who published > executable code you might download from the Internet, and verifies that it > hasn't been altered since publication. I appreciate your insightful opinion on this matter, however... No disguise is needed for malicious ActiveX programs. Any ActiveX program can potentially - either maliciously or by accident or even as a result of configuration differences, cause a system crash, the corruption or destruction of information and/or unlimited leakage and it doesn't depend on some hard-to-find hole in an otherwise secure application. It is a direct result of the methods used by Microsoft, cannot be easily cured with any bug-fix. > If users choose to change the default security level from High to Medium, > they still have the opportunity to protect themselves from unsigned code. > At a Medium setting, prior to downloading and running executable software on > your computer, Microsoft Internet Explorer presents you with a dialog either > displaying the publisher's certificate, or informing you that an "unsigned > control" can be run on your machine. At that point, in either case, you are > in control and can decide how to proceed. I appreciate your insightful opinion on this matter, however... Even if you choose wisely, ActiveX is a hole waiting to be exploited and provides essentially no protection. As the folks at Microsoft know well, impediments are easily and commonly removed - and the use of the display box for popular applications is likely to result in the question being turned off in favor of easy access. > As you know, Microsoft is committed to giving users a rich computing > experience while providing appropriate safeguards. Most useful and > productive applications need a wide range of system services, and would be > seriously limited in functionality without access to these services. This > means that many Java applications will have to go "outside the sandbox" to > provide users with rich functionality. By signing code, a developer can > take advantage of these rich services while giving users the authentication > and integrity safeguards they need. Other firms such as Sun and Netscape > are following our lead, and have announced that they will also provide code > signing for Java applets. Microsoft will also be providing an enhanced Java > security model in the future, giving users and developers flexible levels of > functionality and security. I appreciate your insightful opinion on this matter, however... "...while providing appropriate safeguards" is just not true. Microsoft has a long history of providing systems with no protection, and only recently introduced the first system with even mild protection in it's NT product. Java provides a lot of functionality within the "sandbox", but I am not an advocate of Java either. The syle of computing being pushed out to consumers is inherently risky and must be implemented with substantial controls if it is to be used safely. But this is not Microsoft's goal. There is nothing wrong with having signatures, but it is no guarantee either. > Microsoft takes the threat of malicious code very seriously. It is a > problem that affects everyone in our industry. This issue is not tied to > any specific vendor or group of people. All of us that use computers for > work, education, or just plain fun need to be aware of potential risks and > use the precautions that can insure we all get the most out of our > computers. For this reason, we are committed to providing great safeguards > against these types of threats in Internet Explorer. We expect hackers and > virus writers to get increasingly sophisticated but we pledge we'll continue > to keep you and us one step ahead of them. I appreciate your insightful opinion on this matter, however... Microsoft still has not addressed Work Macro viruses, PC viruses, Windows viruses, etc. The claim that "Microsoft takes the threat of malicious code very seriously" is ludicrous on its face. This is the same company that has distributed viruses to its customers because it didn't do adequate checking of its distributions for known viruses. This is the company whose Windows installation deleted all of the README files on a system when the user upgraded. This is the same company that continues to ship software with inadequate protection. All of this "perception management" doesn't change the fact, and it shouldn't sway the readers of this letter either. FC [Fred Cohen can be reached at tel:510-294-2087 fax:510-294-1225] [NOTE: I usually truncate all but a salient excerpt from included message text on which a responder is commenting. In this case, it would have required too much editing effort to delete the interstitiated originals and still convey the sense of the relevant references. Your cross-reading effort would also have been much greater. PGN] |
[Datenschleuder]
[58]
Re: MS on the CCC ActiveX virus