[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Netscape rewards are an insult
- To: [email protected]
- Subject: Re: Netscape rewards are an insult
- From: [email protected]
- Date: Thu, 19 Oct 1995 10:22:40 -0700
- Comments: This message is NOT from the person listed in the Fromline. It is from an automated software remailing service operating atthat address.THE PORTAL SYSTEM DOES NOT CONDONE OR APPROVE OF THE CONTENTS OF THISPOSTING. Please report problem mail to <[email protected]>.
- Sender: [email protected]
> :I've deleted the rest of your content-free rant. Instead of alluding to
> :some "flawed algorithm", why not tell us about the hole you say you've
> :found in netscape?
OK, Netscape functions by DESIGN as an enhanced delivery vehicle.
Is that a sufficient explanation of the hole?? or is more detail necessary
Netscape blindly trusts any and all ports on all servers. On the
basis of this trust, it begins a negotiation with a server that
might well have a dynamic deliverability capability. The client then
examines a Content-type header, trusts the content-type to decide
what application it should launch, and then launches and processes
the data block it is fed, all on good faith.
It even trusts the server to redirect it to any arbitrary destination
which it automatically loads and then executes.
Is this enough of an explanation?? Or should I paraphrase:
Netscape is a gateway that permits an untrustworthy server to take
complete control of a client's machine. The server can tell the
client where it should go, what it should load and how often, and
what applications to execute on the client machine, as though this
arbitrary server were its master.
Does this help to underscore the problem??
The Netscape Navigator client was DESIGNED to be controlled remotely from
any machine on the Internet. This is the "flawed algorithm". W3 was
meant to be hypertext ... not a gateway that permits a server to deliver
customized byte bombs down a clearcut path by remote-control.
If people don't know that you don't let another person (or machine) take
control of your machine and run programs on it ... well, like I said in
> "Let me make this absolutely clear.
> It should not be up to non-US citizens like myself to safe-guard US
> economic security, and protect vital national interests. It is not
> my job and certainly not my responsibility to protect the international
> public and Fortune 500 companies from poor security."
So without giving out another "exploitation algorithm" to the Internet,
without extending a helping hand to Japan to retaliate against the US for
the American Japanese auto surveillance, I will simply quote from two
sources which are "public record" and mentioned in the FAQ.
From the "Orange Book", one of the volumes of the Department of Defence's
"Rainbow Series" more commonly known as TCSEC (Trusted Computer System
Evaluation Criteria) and available from:
U.S. Government Printing Office INFOSEC Awareness Office
Superintendent of Documents - or - National Computer Security Centre
Washington, DC 20402 9800 Savage Road
Fort George G. Meade, MD 20755-6000
which stipulates that:
"... it is required that ADP (Automated Data Processing) systems
that "process, store, or use classified data and produce
classified information will, with reasonable dependability, prevent:
a. Deliberate or inadvertent access to classified material by
unauthorized persons, and
b. Unauthorized manipulation of the computer and its associated
The above quoted reference is public information. And, since Netscape is
making "no-comment" I will quote Netscape's public information.
> NETSCAPE CLIENT APIS (NCAPIS) 2.0
> The NCAPIs are designed to allow third-party applications to
> remotely control the Netscape Navigator client. They are
> platform specific, utilizing the platform's native method of
> interprocess communication (IPC). These APIs are not final
> and may change with the release of version 1.1 of Netscape
> Navigator (they do not work with Netscape Navigator 1.0).
Herein is the "flawed algorithm" which is just a fancy way of saying that
it's a flawed idea. And this isn't new ... it's been there for a long
Generally, we don't routinely trust every other computer, foreign or
domestic on the Internet to manipulate us by remote control. This is
as basic as the idea that we don't give out our PIN numbers with our
banking cards to anyone who asks us.
If someone tries to suggest differently, then they are a fool.
Let's recall that Version 1.1 of Navigator was released long ago, and
trusts every machine on the Internet to do just that. It trusts every
other machine on the Internet to be "trustworthy". Whether that machine
is foreign or domestic. We are not speaking about the new and improved --
feature added -- "beta" 2.0 software, we are speaking of the software that
AT&T is using internally and is selling to its customers as we speak as a
Software which AT&T security "approved" of in direct contravention of the
most basic of basic security principles.
Let me reiterate this.
Netscape's current existing software was designed in direct contravention
of the US Department of Defence's evaluation criteria for Trusted Computer
Systems, the TCSEC. It also contravenes the ITSEC (Information Technology
Security Evaluation Criteria) which is a document developed by the
British, German, French, and Netherlands governments.
(Anyone can get a free copy of ITSEC by writing to the Commission of the
European Communities in Brussels.)
Netscape forgot one thing about trust. If you "trust everyone" ... even if
you always trust everyone, you always cut the cards.
And when you're playing poker at these stakes ... well ... 'nuff said.
Alice de 'nonymous ...
...just another one of those...
P.S. This post is in the public domain. Please don't shoot the messenger.
C. S. U. M. O. C. L. U. N. E.
P.P.S If this is confusing to anyone, please direct your comments to
one or all of the following newsgroups: