Subject: Re: Request change in son-of-rfc2633

From: Dale Gustafson <[email-masked]>
Date: Sun, 02 Nov 2003 20:01:25 -0600

Paul Hoffman / IMC wrote

< ... >

> PCs are vulnerable. This doesn't mean we stop all development of
> things that run on PCs.
>
> (FWIW, the paper can be found at
> <http://www.cs.dartmouth.edu/~sws/papers/keyjack.pdf>.)

Interesting paper, although most secure application designers probably realize
that browser keystores are most often protected only by a user-chosen password
which may be weak or even NULL.

The issues raised re: creative ways to insert a "shim DLL" between a secure
application and CryptoAPI (or any other security library using the common DLL
form-factor) are most interesting and apply irrespective of use/non-use of SSL
client authentication.  Anyone know of other recent work in this same area?

> --Paul Hoffman, Director
> --Internet Mail Consortium

Regards,

Dale Gustafson

---

From: [email-masked] (Peter Gutmann)
Date: Mon, 3 Nov 2003 16:18:12 +1300

Dale Gustafson <[email-masked]> writes:

>form-factor) are most interesting and apply irrespective of use/non-use of
>SSL client authentication.  Anyone know of other recent work in this same
>area?

I look at it in chapter 6 of my book, "Cryptographic security architecture
design and verification".  There are a million ways to do this under Windows,
you can hijack and subvert pretty much anything you want, from kernel calls
(the kernel entry jump tables are modifiable from user-space) through to
subverting apps in various ways (the coolest one being thread injection, I'm
surprised virii don't use that one more often because you become totally
undetectable with that).  Chapter 6 covers the various implications of this in
more detail (I'm being lazy and just citing the chapter to avoid having to
paraphrase the whole thing here :-).

Peter.

---

From: [email-masked] (Peter Gutmann)
Date: Tue, 4 Nov 2003 23:11:41 +1300

I wrote:

>Mozilla (and no doubt some others that didn't get any publicity) did the same
>thing, and I'm sure they didn't get asked to do that by customers.

Actually that's not right, I thought Mozilla (or at least some apps that used
the Mozilla/Gecko/NSS/whatever code base) were vulnerable because Konqueror
was vulnerable, but it turns out that this was Konqueror with khtml rather
than with kmozilla, with OpenSSL supplying the crypto.  Apologies for the
mixup.

Before this gets read as "OpenSSL is vulnerable", that isn't the case either.
OpenSSL provides application-defined callbacks that can be used to override
some checks (used to handle, as one source aptly described it, "the mass of
broken certs out there").  Some apps provide callbacks that ignore all errors,
which apparently is what happened here.  Standard OpenSSL doesn't have this
problem.

Peter.