| Saturday,
August 10, 2002 Thanks to Ed Hume for
this one:
From < http://www.strategypage.com/fyeo/
howtomakewar/default.asp?target=HTINF.HTM >
August 7, 2002; A Canadian sniper in Afghanistan has
been confirmed as hitting an enemy soldier at a range of 2,310 meters, the
longest recorded and confirmed sniper shot in history. The previous record
of 2,250 meters was set by US Marine sniper Carlos Hathcock in Vietnam in
1967. The Canadian sniper was at an altitude of 8,500 feet and the target,
across a valley, was at 9,000 feet. Canadian sniper units often operated
in support of US infantry units, which were grateful for their help. The
record lasted only one day, until a second Canadian sniper hit an enemy
soldier at 2,400 meters. The Canadian snipers were firing special
..50-caliber McMillan tactical rifles, which are bolt-action weapons with
five-round magazines. The Canadian snipers were the only Canadian troops
operating without helmets or flak jackets as they had too much other
equipment to carry. Each three-man team had one sniper rifle, three
standard rifles (Canadian C7s), one of them with a 203mm grenade
launcher.--Stephen V Cole
Astonishing.
And from Sue Ferarra
Subject: Headline - Not so fast Einstein, light's
got the brakes on
Greetings,
Sue Ferrara wants you to know about a story on www.smh.com.au
Personal Message:
Not so fast Einstein, light's got the brakes on
August 8 2002
URL: http://www.smh.com.au/articles/2002/08/08/1028157977713.html
The notion that the speed of light is a slowly
changing "constant" has been with us a long time. I am not
really competent to evaluate the evidence. Another reader put it:
What if the speed of light isn't a constant?
http://www.msnbc.com/news/791205.asp?cp1=1
and wonders if that has consequences for
interstellar travel. Probably not in our lifetimes.
On another subject,
Since the events of 9/11 I've been trying to
understand the motivation or purpose of people who would condemn
themselves and others to death. Lee Harris has written http://www.policyreview.org/AUG02/harris.html
for Policy Review that seems to shed a different understanding on what's
happening in the Islamic world and how our response has missed the
mark. It also has broader implications in our understanding of
how Hitler, Mussolini, Lenin or Stalin managed to build and maintain the
regimes they did.
Hope you enjoy your birthday.
Sincerely, Dennis C. O'Neil doneil@brainerd.net
Thank you. It is a bit long before he gets to his
point, and the way he leads into the subject makes you think he will reach
a different conclusion (although Policy Review publication makes that
unlikely); but it's worth the time to read it, and of course he's correct.
Those with religious visions even if they have shed most of the religious
aspects, are not usually deterred by rational argument. The Crusaders
weren't and neither were those who set forth to complete the Crescent
under Suleiman the Magnificent. And see
commentary.
And Eric sends this:
http://www.theregus.com/content/6/25929.html
A hilarious attempt to protest American Imperialism
online.
from a self proclaimed Cambridge philosopher manqué,
an interesting concept all by itself. I note that he has no problem
believing in a persona called "The United States" however much
quarrel he has with cyberspace as a place.
And thanks to Roland for
another Internet Explorer vulnerability, this one quite serious:
Internet Explorer SSL Vulnerability 08/05/02 Mike
Benham <moxie@thoughtcrime.org> http://www.thoughtcrime.org
<http://www.thoughtcrime.org/> < http://www.thoughtcrime.org
<http://www.thoughtcrime.org/> >
===============================
Abstract
Internet Explorer's implementation of SSL contains a
vulnerability that allows for an active, undetected, man in the middle
attack. No dialogs are shown, no warnings are given.
=======================================
Description
In the normal case, the administrator of a web site
might wish to provide secure communication via SSL. To do so, the
administrator generates a certificate and has it signed by a Certificate
Authority. The generated
certificate should list the URL of the secure web
site in the Common Name field of the Distinguished Name section.
The CA verifies that the administrator legitimately
owns the URL in the CN field, signs the certificate, and gives it back.
Assuming the administrator is trying to secure www.thoughtcrime.org, we
now have the following certificate structure:
[CERT - Issuer: VeriSign / Subject: VeriSign] ->
[CERT - Issuer: VeriSign / Subject: www.thoughtcrime.org]
When a web browser receives this, it should verify
that the CN field matches the domain it just connected to, and that it's
signed using a known CA certificate. No man in the middle attack is
possible because it should not be possible to substitute a certificate
with a valid CN and a
valid signature.
However, there is a slightly more complicated
scenario. Sometimes it is
convenient to delegate signing authority to more
localized authorities. In this case, the administrator of
www.thoughtcrime.org would get a chain of certificates from the localized
authority:
[Issuer: VeriSign / Subject: VeriSign] ->
[Issuer: VeriSign / Subject: Intermediate CA] -> [Issuer: Intermediate
CA / Subject: www.thoughtcrime.org]
When a web browser receives this, it should verify
that the CN field of the leaf certificate matches the domain it just
connected to, that it's signed by the intermediate CA, and that the
intermediate CA is signed by a known CA certificate. Finally, the web
browser should also check that all intermediate certificates have valid CA
Basic Constraints.
You guessed it, Internet Explorer does not check the
Basic Constraints.
=========================== == Exploit
So what does this mean? This means that as far as IE
is concerned, anyone with a valid CA-signed certificate for ANY domain can
generate a valid CA-signed certificate for ANY OTHER domain.
As the unscrupulous administrator of
www.thoughtcrime.org, I can generate a valid certificate and request a
signature from VeriSign:
[CERT - Issuer: VeriSign / Subject: VeriSign] ->
[CERT - Issuer: VeriSign / Subject: www.thoughtcrime.org]
Then I generate a certificate for any domain I want,
and sign it using my run-of-the-mill joe-blow CA-signed certificate:
[CERT - Issuer: VeriSign / Subject: VeriSign] ->
[CERT - Issuer: VeriSign / Subject: www.thoughtcrime.org] -> [CERT -
Issuer: www.thoughtcrime.org / Subject: www.amazon.com]
Since IE doesn't check the Basic Constraints on the
www.thoughtcrime.org
certificate, it accepts this certificate chain as
valid for www.amazon.com.
Anyone with any CA-signed certificate (and the
corresponding private key) can spoof anyone else.
============================
Severity
I would consider this to be incredibly severe. Any
of the standard connection hijacking techniques can be combined with this
vulnerability to produce a successful man in the middle attack. Since all
you need is
one constant CA-signed certificate (and the
corresponding private key), an attacker can use that to generate spoofed
certificates for other domains
as connections are intercepted (on the fly). Since
no warnings are given and no dialogs are shown, the attacker has
effectively circumvented all security that an SSL certificate provides.
There is some level of accountability, though, since
a user who randomly chooses to view the
certificate of the web site she's visiting will see the attacker's
certificate in the chain. However, by that point the damage has already
been done. All "secure" data has already been transmitted.
====================== = Affected Browsers
Netscape 4.x and Mozilla are NOT vulnerable.
IE 5 and 5.5 are vulnerable straight-up, and IE 6 is
mostly vulnerable.
When VeriSign issues certificates, usually they
leave out the CA Basic Constraint information all together. Thawte tends
to explicitly put in a Basic Constraint CA = FALSE with the critical bit
set to TRUE.
When the CA Basic Constraint on the middle
certificate is explicitly set
to false and marked as critical, IE 6 does not
follow the chain. When it's not mentioned at all, IE 6 follows the chain
and is vulnerable.
This just means that an attacker needs to use a
VeriSign-issued certificate to exploit IE 6.
========================= = Working Exploit
I've set up a URL to demonstrate this problem. If
you want to test browsers not listed above or need proof of this
vulnerability, contact me and I'll give you the information.
=========================== = Vendor Notification
Status
Last week I saw Microsoft downplay and obfuscate the
severity of the IE vulnerability that Adam Megacz reported. After seeing
that, I don't feel like wasting time with the Microsoft PR department.
- Mike
-- http://www.thoughtcrime.org <http://www.thoughtcrime.org/>
< http://www.thoughtcrime.org <http://www.thoughtcrime.org/> >
TOP
CURRENT
VIEW |
CLICK HERE for
a Special Request. 
