[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Impact of Netscape kernel hole
Huge Cajones Remailer writes:
>
> It'd be nice to have more specifics about the whole situation, but
> regardless - any preliminary threat assessments? Exactly how widely
> exploited do you think this has been?
>
> Tim's post (although refuted by Marc) raises some serious issues since I
> suspect that Joe Public has his secret key sitting in c:\pgp\secring.pgp
Of course that's IDEA-encrypted (or maybe something better in PGP 5) so
the attacker would need a lot of compute power to brute-force the key.
I wouldn't worry too much about someone getting my secring.pgp. However
I would worry about them getting my mail folder, my .rhosts, my
/etc/password, etc.
> Some coherent input on the possible impact of this would be appreciated.
Yes, a description of the exploit would be very helpful. It should
be fairly easy to hack a proxy to search and destroy the Java/Javascript
CaptiveX attacklet as it's being received.
--
Eric Murray [email protected]
Network security and encryption consulting. PGP keyid:E03F65E5