Re: New whitepaper "The Phishing Guide"

[Aleksandar Milivojevic]

Gunter Ollmann (NGS) wrote:

[snip]

> While the Phishers
> develop evermore sophisticated attack vectors, businesses flounder to
> protect their customers' personal data and look to external experts for
> improving email security. Customers too have become wary of "official"
> email, and organisations struggle to install confidence in their
> communications.

Sometimes it's unbelivable how long it takes organizations to discover
that email can be signed. Especially nowdays when all major mail
readers have support for at least S/MIME (and the really good ones have
support for at least PGP ;-) ).

--
Aleksandar Milivojevic <amilivojevic@pbl.ca> Pollard Banknote Limited
Systems Administrator 1499 Buffalo Place
Tel: (204) 474-2323 ext 276 Winnipeg, MB R3T 1L7

[Seth Arnold]

--00sTfE/IIAT5d2r5
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Thu, Sep 23, 2004 at 09:57:03AM -0500, Aleksandar Milivojevic wrote:
> Sometimes it's unbelivable how long it takes organizations to discover=20
> that email can be signed. Especially nowdays when all major mail=20
> readers have support for at least S/MIME (and the really good ones have=
=20
> support for at least PGP ;-) ).

DE09D78D
888D09A3
18C4ED82
DA081DD1
4CE06F00
CC3D9213
23BDC6F9

Methinks PGP is good for talking within friends, but perhaps trusting
communications from J. Random Corporation with PGP as your best means of
verification is a stretch. The Web Of Trust idea only takes you so far
in combating these problems -- I've heard anecdotal evidence that
someone has replicated the entire "Web Of Trust" graph with identical
uids on keys of EFF members. If one starts the search from the desired
key and searches until finding a plausible name, one is doomed. One must
return to one's own key -- AND have faith that everyone in the middle
played fairly.

http://www.internetnews.com/dev-news/article.php/721571

Even the best-known X.509 Certification Agency has made screwups
regarding one of the best-known publicly traded corporations. How hard
do you think it would be to get certificates for something that sounds
plausibly like a bank? Credit card company?

Cryptography is good at solving many problems. But it is not a magical
problem solver. End users still need to be educated. Your guess is as
good as mine if we'll make progress on the "don't give information to
people who ask for it" front. :)

--00sTfE/IIAT5d2r5
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFBUyJD+9nuM9mwoJkRAnG6AJ4lNcdzi1t9XFtlWyVSC+ O8g/hquwCfZZ9I
J4OxEv36d5FM1d/azS4V6p8=
=AMNL
-----END PGP SIGNATURE-----

--00sTfE/IIAT5d2r5--

[Dehner, Benjamin T.]

I think if major vendors used signed emails, it would be a good step.
However, I'm not sure in the long run it will do much good.

First, the real problem isn't technical, it's educational. Most users
sophisticated enough to download a public key, verify the fingerprint, and
install it on their keyring aren't going to be fooled by phishing attacks
anyway.

Second, as far as I know, there is no standard for encryption software.
Signing something with, say, PGP doesn't do a blind bit of good unless the
recipient has gone to the bother of downloading and installing PGP on their
system. (See above.) And if you haven't installed PGP, seeing the BEGIN
PGP SIGNED MESSAGE verbage on an email may give a false sense of security
when the message may have been signed by an invalid key, or may not have
been signed at all and the enclosed "signature" is random garbage.

Third, I can see a new variant of the phishing attack. "WARNING: OUR
SECURITY HAS BEEN COMPROMISED. PLEASE CLICK ON THE LINK BELOW TO ADD OUR
NEW SECURITY CERTIFICATE TO YOUR KEYRING AND RE-VERIFY YOUR PERSONAL
INFORMATION". (This also touches on the subject of key revokations, but
I'll leave that alone for now.)

Ben



-----Original Message-----
From: Aleksandar Milivojevic [mailto:amilivojevic@pbl.ca]
Sent: Thursday, September 23, 2004 9:57 AM
To: bugtraq@securityfocus.com
Subject: Re: New whitepaper "The Phishing Guide"


Gunter Ollmann (NGS) wrote:

[snip]

> While the Phishers
> develop evermore sophisticated attack vectors, businesses flounder to
> protect their customers' personal data and look to external experts for
> improving email security. Customers too have become wary of "official"
> email, and organisations struggle to install confidence in their
> communications.

Sometimes it's unbelivable how long it takes organizations to discover
that email can be signed. Especially nowdays when all major mail
readers have support for at least S/MIME (and the really good ones have
support for at least PGP ;-) ).

--
Aleksandar Milivojevic <amilivojevic@pbl.ca> Pollard Banknote Limited
Systems Administrator 1499 Buffalo Place
Tel: (204) 474-2323 ext 276 Winnipeg, MB R3T 1L7




The information contained in this E-mail message and the documents accompanying this message are
privileged and confidential, and may be protected from disclosure. Please be aware that any use,
printing, copying, disclosure or dissemination of this communication may be subject to legal
restriction or sanction. If you think that you have received this E-mail message in error, please
reply to the sender.

For more information about Valmont Industries, Inc., please visit our web site at www.valmont.com

[Greg A. Woods]

[ On Thursday, September 23, 2004 at 12:21:40 (-0700), Seth Arnold wrote: ]
> Subject: Re: New whitepaper "The Phishing Guide"
>
> Methinks PGP is good for talking within friends, but perhaps trusting
> communications from J. Random Corporation with PGP as your best means of
> verification is a stretch. The Web Of Trust idea only takes you so far
> in combating these problems -- I've heard anecdotal evidence that
> someone has replicated the entire "Web Of Trust" graph with identical
> uids on keys of EFF members. If one starts the search from the desired
> key and searches until finding a plausible name, one is doomed. One must
> return to one's own key

You seem to be blaming the existing state of the PGP web of trust on
some fundamental failing in its design and yet you then go on to admit
that people use the wrong kinds of things in real life to authenticate
and identify others with, and you further admit that the public in
general still has a lot to learn about using computing and networking
infrastructures safely in their daily lives.

PGP's web of trust can be almost infinitely more reliable, trustworthy,
and controllable, than any one, or many, for-profit certification
agencies.

Just because one takes a set of dedicated PGP users and tries but fails
to establish trust relationships with non-PGP users doesn't mean PGP's
web of trust is broken -- one of the parties is "broken", not the web of
trust itself or the concept of a web of trust. Obviously in order to
establish trusted end-to-end communciations both parties must be
dedicated to using the technology that achieves their goal and both
parties must have some basis for relating to each other. The web of
trust simply allows that relationship to have a somewhat less direct
nature and to be many-to-many instead of one-to-one.

The idea that a web of trust can work very well once it reaches critical
mass can be trivially demonstrated through simple analysis of the web of
"friends" formed in any of these large online networking systems such as
Orkut.


> -- AND have faith that everyone in the middle
> played fairly.

No, that's not true -- faith doesn't enter into it. In a sufficiently
connected and properly maintained web of trust it should be relatively
easy for conspirators to be weeded out and eliminated.

Not that such a thing is easy to achieve of course.

Obviously a sufficient level of interconnection in a web of trust
requires a critical mass of users; and proper maintenance of the web of
trust requires a sufficient level of proficiency and dedication on the
part of those users. It would certainly help a lot of those users where
encouraged to learn what they need to know and encouraged to pay
attention to maintaining their status and involvement through the
initiative of whatever large institutions many people are already
involved with. Unfortunately it seems such institutions (e.g. banks,
etc.) have so far gone in the direction of using for-profit (and usually
for-profit public corporate) entities to manage x.509 style certificate
authorities.

Technically there is not a lot of difference between PGP's web of trust
and a group of certificate authorities. PGP is not just for mail and
SSL/TLS is not just for HTTP. There are indeed deficiencies in PGP's
implementation choices. A public web of trust can be built using any
public-key crypto system. I think the important thing is that we need
to work on building a democratic web of trust -- and learn to rely less
on certificate authorities operated by for-profit, and particularly
public, corporations. The public corporation is anything but
democratic, especially when it gets involved in the affairs of private
individuals and government bodies.

--
Greg A. Woods

+1 416 218-0098 VE3TCP RoboHack <woods@robohack.ca>
Planix, Inc. <woods@planix.com> Secrets of the Weird <woods@weird.com>

[Crispin Cowan]

Greg A. Woods wrote:

>[ On Thursday, September 23, 2004 at 12:21:40 (-0700), Seth Arnold wrote: ]
>>Methinks PGP is good for talking within friends, but perhaps trusting
>>communications from J. Random Corporation with PGP as your best means of
>>verification is a stretch. The Web Of Trust idea only takes you so far
>>...
>>
>You seem to be blaming the existing state of the PGP web of trust on
>some fundamental failing in its design and yet you then go on to admit
>that people use the wrong kinds of things in real life to authenticate
>and identify others with, and you further admit that the public in
>general still has a lot to learn about using computing and networking
>infrastructures safely in their daily lives.
>

No, I think it is more general than that. Seth's criticism of PGP
actually generalizes to any authentication-based "solution": it requires
the users to be trained to reject all non-authenticated communications,
and for the users to have a sophisticated notion of what constitutes
"properly authenticated."

This problem exists because the common mail clients accept
non-authenticated e-mail, and the users have been trained to just accept
that. No matter what you do, the users will continue habitually
accepting non-authenticated traffic, with all the expected consequences.

To actually fix this problem, you would have to supply your users with a
mail client that will *not* do anything "interesting" unless the mail
has been authenticated. Go ahead and try that on your users; I'll wait :)

This has nothing to do with whether you use a hierarchical PKI (VeriSign
et al) or a non-hierarchical PKI (PGP). It is all about the ease-of-use
and default policies of the mail client.

Disclaimers galore: I am on PGP's Technical Advisory Board, but do not
speak for PGP. Seth works for me at Immunix, but gets to have his own
opinions.

Crispin

>PGP's web of trust can be almost infinitely more reliable, trustworthy,
>and controllable, than any one, or many, for-profit certification
>agencies.
>
>Just because one takes a set of dedicated PGP users and tries but fails
>to establish trust relationships with non-PGP users doesn't mean PGP's
>web of trust is broken -- one of the parties is "broken", not the web of
>trust itself or the concept of a web of trust. Obviously in order to
>establish trusted end-to-end communciations both parties must be
>dedicated to using the technology that achieves their goal and both
>parties must have some basis for relating to each other. The web of
>trust simply allows that relationship to have a somewhat less direct
>nature and to be many-to-many instead of one-to-one.
>
>The idea that a web of trust can work very well once it reaches critical
>mass can be trivially demonstrated through simple analysis of the web of
>"friends" formed in any of these large online networking systems such as
>Orkut.
>
>
>
>
>>-- AND have faith that everyone in the middle
>>played fairly.
>>
>>
>
>No, that's not true -- faith doesn't enter into it. In a sufficiently
>connected and properly maintained web of trust it should be relatively
>easy for conspirators to be weeded out and eliminated.
>
>Not that such a thing is easy to achieve of course.
>
>Obviously a sufficient level of interconnection in a web of trust
>requires a critical mass of users; and proper maintenance of the web of
>trust requires a sufficient level of proficiency and dedication on the
>part of those users. It would certainly help a lot of those users where
>encouraged to learn what they need to know and encouraged to pay
>attention to maintaining their status and involvement through the
>initiative of whatever large institutions many people are already
>involved with. Unfortunately it seems such institutions (e.g. banks,
>etc.) have so far gone in the direction of using for-profit (and usually
>for-profit public corporate) entities to manage x.509 style certificate
>authorities.
>
>Technically there is not a lot of difference between PGP's web of trust
>and a group of certificate authorities. PGP is not just for mail and
>SSL/TLS is not just for HTTP. There are indeed deficiencies in PGP's
>implementation choices. A public web of trust can be built using any
>public-key crypto system. I think the important thing is that we need
>to work on building a democratic web of trust -- and learn to rely less
>on certificate authorities operated by for-profit, and particularly
>public, corporations. The public corporation is anything but
>democratic, especially when it gets involved in the affairs of private
>individuals and government bodies.
>
>
>

--
Crispin Cowan, Ph.D. http://immunix.com/~crispin/
CTO, Immunix http://immunix.com

[Chip Andrews]

Agreed but forcing phishers to generate key pairs, purchase
certificates, and/or buy-off CA vendor personnel creates additional
audit trails that could help in the tracking and prosecution of those
individuals. Combine this with certificate revocation and you have at
least a model that gives more verification, auditing, and remediation
than currently exists in the pursuit of these criminals. It's at least a
step in the right direction and shouldn't be avoided simply because it
won't immediately stop all phishing attacks or protect all users.

Watermarks do not stop all counterfeiting. Holograms do not stop all
credit card fraud. It doesn't mean we shouldn't do what we can to help -
even if its only a partial solution.

Chip Andrews
http://www.sqlsecurity.com

>How does that help in practice? A user fooled by a link to ebay-support.com
>is just as likely to accept signed mail from foo@ebay-support.com. Not to
>mention that the potential profits from phishing could easily finance the
>purchase of a forged cert if someone at one of the built-in CA's was
>corruptible. Given the several that are based in 3rd world companies (not to
>mention recent US corporate scandals) I have no confidence that won't
>eventually happen.
>
>-Dan Veditz
>
>
>
>

[Brian Dessent]

Daniel Veditz wrote:

> How does that help in practice? A user fooled by a link to ebay-support.com
> is just as likely to accept signed mail from foo@ebay-support.com.

You can never help the users who can't help themselves. What you can do
is help the users who know a little bit about phishing but do not care
to learn the methods de jour of URL forgery and other arcane knowledge.
In other words you can simply tell them, "if it says it's from @ebay.com
and has a valid signature, it's probably legit. Otherwise delete and
ignore." Whereas today you have to tell them to hover over links,
explain all the ways URLs can be obfuscated, check email headers, and so
on. Sure, the phishers will just start signing their messages as well,
but at least you have more options at hand to check the authenticity.

> mention that the potential profits from phishing could easily finance the
> purchase of a forged cert if someone at one of the built-in CA's was
> corruptible. Given the several that are based in 3rd world companies (not to
> mention recent US corporate scandals) I have no confidence that won't
> eventually happen.

This is why all software should be shipped with the option to check
certificate revocation lists enabled by default.

Brian

[Philip Stoev]

> Agreed but forcing phishers to generate key pairs, purchase
> certificates, and/or buy-off CA vendor personnel creates additional
> audit trails that could help in the tracking and prosecution of those
> individuals. Combine this with certificate revocation and you have at
> least a model that gives more verification, auditing, and remediation
> than currently exists in the pursuit of these criminals. It's at least a
> step in the right direction and shouldn't be avoided simply because it
> won't immediately stop all phishing attacks or protect all users.
>
> Watermarks do not stop all counterfeiting. Holograms do not stop all
> credit card fraud. It doesn't mean we shouldn't do what we can to help -
> even if its only a partial solution.

Phishing relies on the victim lacking the information or the intellectual
capability to distinguish genuine email or web page from a fake one. That is
why phishers attempt to use nearly-real URLs and shiny padlock icons so that
the user feels a false sense of security and correctness when he sends in
his social security number. If a phishing email is signed correctly, the
email client will display a padlock icon on its own plus assurances that the
email has been signed and valid and authenticated, etc. All this will
further the false sense of security that phishing relies on, unless the
email client is configured to explicitly display enough information on the
signature and enough warnings for the average user to be able to make an
informed decision.

Philip

[Juraj Bednar]

Hello,

> How does that help in practice? A user fooled by a link to ebay-support.com
> is just as likely to accept signed mail from foo@ebay-support.com. Not to
> mention that the potential profits from phishing could easily finance the
> purchase of a forged cert if someone at one of the built-in CA's was
> corruptible. Given the several that are based in 3rd world companies (not to
> mention recent US corporate scandals) I have no confidence that won't
> eventually happen.

it is quite possible, I had success of convincing U.S. CAs of issuing me
a certificate, while they shouldn't. I once wrote an article about it to
2600.

Seems like most CAs are more capable of selling certificates than
providing real security checks, which are usually done by using that
same insecure channels, that they are trying to protect.

For example:
- a fax of business license (which for example in our country can be
get by anyone)
- e-mail to one of the administrative contacts from whois database
(which can be -- if not protected -- changed by sending simple
e-mail, if your registrar uses RIPE).
- creating a file on the target webserver (which in turn is capable of
all those attacks, that SSL is trying to protect).

So basically, "hacking" CA is just paperwork, e-mail and browserwork.

You can read the article here:
http://files.juraj.bednar.sk/CA

(I'm not sure, if it's the latest version, that got published, so please
forbid any small mistakes, but you will get the point, hopefully).

I believe there are CAs, that are more secure even for e-mail. Here in
Slovakia, we have even law about electronic signatures, and you have to
go physically to CA, show your ID, passport and after you convince them,
you are the right person, they issue you a certificate (which is equal
to signature on paper). One particular issue is, that they guarantee
also your identity (not only the ability to read particular e-mail,
which often is checked by so-called CAs by sending e-mail to the target
address and user has to check the link, which does not guarantee
anything, but the ability to read the particular e-mail -- which we want
to protect from unauthorized users, right?).



Juraj.

[Aleksandar Milivojevic]

Seth Arnold wrote:
> http://www.internetnews.com/dev-news/article.php/721571
>
> Even the best-known X.509 Certification Agency has made screwups
> regarding one of the best-known publicly traded corporations. How hard
> do you think it would be to get certificates for something that sounds
> plausibly like a bank? Credit card company?

I totally agree with what you (and others) wrote. Most of the current
registrars fall from the sky some time ago, telling us that they are
"trusted" entities (yeah right). Even without that incident you
mentioned, would you trust company whose bussiness practices include
hijacking of DNS name space (scandal with wildcard .com and .net
entries) or sending deceptive domain renewals via mail? Probably not.

My point was that currently corporations are not even attempting to use
the tools they have available. It is more important to them that
message is nicely HTML formated, than putting even basic security
precausins (such as signing with x509 certificate).

--
Aleksandar Milivojevic <amilivojevic@pbl.ca> Pollard Banknote Limited
Systems Administrator 1499 Buffalo Place
Tel: (204) 474-2323 ext 276 Winnipeg, MB R3T 1L7