Subject: Re: Should IETF do more to fight computer crime?

From: Scott Bradner <[email-masked]>
Date: Mon, 22 May 2000 09:45:24 -0400 (EDT)

> Scott Bradner gave a presentation at the G8 hi-tech crime event in Paris last
> week 

the presentation is at:
http://golem.sobco.com/presentations/2000.05.17-g8/index.htm

since the real work of the confreence was done in private it was hard
to tell what was actually going on.  But the presentations were
mostly content free.  

2 or 3 of the presentations actually had some content and reality
about the Internet - one from an Intel rep and another from someone
from Canada (his card is at home and I do not remember his name)
stood out.

the government/police presentations generally called for consistant
rules between countries, a 24/7 support center or traceability

I had to leave before the final discussion session so do not
know what happened there

Scott

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Mon, 22 May 2000 12:57:21 -0400

In message <[email-masked]>, [email-masked] wri
tes:
>Steve Bellovin <[email-masked]> said:
>> I'm far from convinced, for example, that the LOVEBUG  virus would
>> have been prevented were all mail digitally signed, because  I
>> strongly suspect that the attack would have invoked a digital
>> signature API to generate digitally-signed copies of itself.
>
>I would hope that any software I use, that is able to put my digital signature
>on some data, would ask me for my pass-phrase every time my private key is 
>used. I would even hope that such software wouldn't be able to use my private
>key without the pass-phrase, otherwise anybody with access to my computer coul
>d
>easily forge my signature.
>
>If this requirement is not met, the digital signature has no value.

Yup...

More precisely -- in the Holy Name of Convenience, many (most?) mailers 
permit a passphrase to be cached for some amount of time.  A virus 
could exploit that.  Or it could wait until you tried sending some 
signed mail, and grab the key then.  It could even wait, and then pop 
up its own key window that masquerades as the real one, followed by a 
box saying that you entered your passphrase incorrectly, and that you 
should retry it, in the real prompt.  There are operating system 
techniques that can prevent that latter attack, such as the "trusted 
path".  But trusted path support is rare on UNIX systems, and though 
Windows NT does use it for login passwords, I haven't yet seen a secure 
NT mailer that uses it.  (Btw -- though there are security risks here, 
there are also security risks in using such technologies, since if it's 
too inconvenient to send secure email, there will be more sent in the 
clear.  That's a risk, too; pick your poison.)

It's for reasons like these that it has been said that conventional 
signatures are weakly bound to a document, but strongly bound to the 
individual, while digital signatures are strongly bound to a document 
but weakly bound to an individual.  A digital signature provides proof 
that a particular private key was used to produce it.  Just who 
employed that key is a separate question, and one that must be 
carefully evaluated when deciding how much weight to attach to the 
signature.

		--Steve Bellovin

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Mon, 22 May 2000 15:15:12 -0400

In message <v04210103b54f26125316@[130.237.150.138]>, Jacob Palme writes:
>Does there exist a mailinglist specially oriented towards
>cybercrime and its prevention? If not, should we start such
>a list?

I don't know of any such list.  But -- as we've learned in the IETF 
about working group charters -- unless it's very narrowly focused, it's 
just going to turn into a flamefest, and won't contribute at all to any 
real solutions.  For example, the techniques necessary to deal with 
DDoS flooding attacks are not at all related to the techniques that one 
would use to combat your favorite form of "illegal" content (kiddie 
porn, Nazi propaganda, Metallica MP3s, truthful and accurate 
information about the local dictatorship, etc.).

		--Steve Bellovin

---

From: [email-masked]
Date: Mon, 22 May 2000 22:53:37 +0200

"Steven M. Bellovin" <[email-masked]> said:
> in the Holy Name of Convenience, many (most?) mailers  permit a
> passphrase to be cached for some amount of time.  A virus  could
> exploit that.

Ok. So, you're reasoning on the assumption that the user and her system 
enginer are both incompetent, that the software being used cannot be trusted
and that a virus is potentially already active on the user's system. Under 
such assumptions, what do you foresee as a possible solution?

When I said:
>used.

I meant that these were my requirements for a reliable system. But, unless I
were to be provided with all the sources and took the time to carefully analyze
them, I would, in the end, still be relying on somebody else's "promise" that
the software doesn't do anything stupid with my private key. The least I could
do, though, is to check that the system I use at least pretends to be doing 
what I consider safe to do. Still, when I disable scripting in my mail user 
agent and my browser, can I be 100% sure that no script will ever be executed?

"Steven M. Bellovin" <[email-masked]> also said:
> A virus [snip] could wait until you tried sending
> some  signed mail, and grab the key then.  It could even wait, and
> then pop  up its own key window that masquerades as the real one,
> followed by a  box saying that you entered your passphrase
> incorrectly, and that you  should retry it, in the real prompt.  There
> are operating system  techniques that can prevent that latter attack,
> such as the "trusted  path".

Interesting. Do you have a reference (preferably a URL) that describes the
"trusted path" technique?

Peace,

Bertrand Ibrahim.
--------------------------------------------
[email-masked]
http://cui.unige.ch/eao/www/Bertrand.html

---

From: Vernon Schryver <[email-masked]>
Date: Mon, 22 May 2000 17:21:41 -0600 (MDT)

> From: [email-masked]

> and that a virus is potentially already active on the user's system.

Without belaboring whether the word "incompetent" is appropriate (I
think it is), what is the difference between that hypothetical and
the current real world?  Almost all of the bazillions of flavors of
Microsoft virus are based on that same Holy Name of User Friendliness.
No competently designed or implemented system since at least a decade
before those three guys hacked that BASIC interpretor in about 1973
has had the design holes that infest--uh--enhance the user's experience
of all flavors of Windows as installed by default through at least
Windows 98 SE and Window NT 4.0+service pack 6.

> the software doesn't do anything stupid with my private key.....

Do you momentarily cringe when you give your car keys to a mechanic or
parking attendant?  Do you give your house keys to every stranger who
expresses an interest in cleaning your drapes or checking your closets
for snipes?  How can one not expect to need to perform similar due
diligence with the keys to your data?

Vernon Schryver    [email-masked]

---

From: Greg Skinner <[email-masked]>
Date: Tue, 23 May 2000 10:41:18 -0700 (PDT)

Jacob Palme <[email-masked]> wrote:

> But would not better logg production in routers be an aid
> in finding the villain behind computer crimes?

What type of logging do you propose?  It seems that the types of logging
that are already done enable people to trace the origins of suspicious
traffic.

--gregbo

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 23 May 2000 14:13:34 -0600 (MDT)

> From: "Dawson, Peter D" <[email-masked]>

> True, but only the origin of packets are determined. What is needed is
> a code of ethics between ISPs , to share information.
> i.e once a packet leaves isp1 cloud and travels across isp2 cloud,
> very rarely would isp1 be willing to disclose to isp2,...
> which (user) is leased that specific dynamic ip address.
>
> btw, this info would be required on the fly... so that net admin/sec
> would be in a better position to pinpoint the perpetrator's habits/ 
> physiological profile etc..

Let's actually think for a moment about serious logging or sharing
information about Internet traffic.  State of the art large routers
move Tbits/sec.  If the average packet size is 500 bytes, you're
talking about logging or sharing information about 100 Mpackets/second.
If you only log or share the source and destination IPv4 addresses,
TCP or UDP port numbers, in incoming interface, a timestamp, and 1 or
2 bits saying the packet was not unusual (e.g. no TCP options other
than window scaling or SAK and no IP options), you're talking about
logging or sharing more than 20 bytes/packet or a few GBytes/second/big
router.  There are 86,400 seconds/day, so you're talking about logging
or sharing about 100 TBytes/day per large router.

Typical IP paths seem to be at least 10 hops long these days, and
often 20 or 30.  Most of those routers are not going to be Tbit/sec
backbone routers, but more than one will be, and the rest can be
counted or aggregated as if they were.  Thus, you're talking about
logging or sharing several 1000 TBytes/day.

Perhaps it would not be a problem to burn 1,000,000 GByte CDROM, tapes,
or other media per day, but what would you be able to do with those logs?
Searching a 1000 TByte database on the fly, especially if it is merely
a primitive sequential log, would be a serious challenge.

Yes, not many Tbit routers have been deployed, but they will be, and I
think the average packet size is less than 500, which increases the amount
of logging.  Yes, you might not need to keep those 1000's of TBytes for
more than a few days, but you still need a way to do something with them.

To put it another way, the complaints from the large ISP's that they cannot
police Internet traffic to shield their customers from pornography, talk
about World War II political parties, and the other things that various
pressure groups and governments dislike have some technical reality.

Technical reality always trumps political blather everywhere that matters.

---

From: "Dawson, Peter D" <[email-masked]>
Date: Tue, 23 May 2000 20:45:09 -0000

>-----Original Message-----
>From: Vernon Schryver [mailto:[email-masked]]
>Sent: Tuesday, May 23, 2000 4:14 PM
>To: [email-masked]
>Subject: RE: Should IETF do more to fight computer crime?
>
>

I agree on the technical reality of tbyte storage/tcpdump etc...

>Technical reality always trumps political blather everywhere 

Yes, but if I were  behind a DMZ and my IDS triggers... and if I got a
source address .. my question is...
 would 'THe ISP' provide any type of information to  negate the threat ? is
this a political problem?? , beyond technical reality or just plain
non-compliance to 'Collabration' ???

/pd

---

From: "Maddux, Michel" <[email-masked]>
Date: Tue, 23 May 2000 17:00:39 -0500

When the procedures dictate that government agencies get involved at certain
points
and you notify them of the outage or problem, what other steps do you
recommend?  
Operational entities are not, in most cases,  law enforcement agencies.
There is a limit to 
how much notification one should undertake in these situations.
thanks. /m.

> From:	Dawson, Peter D [SMTP:[email-masked]]
> Sent:	Tuesday, May 23, 2000 3:22 PM
> To:	IETF general mailing list
> >On Tue, 23 May 2000 18:27:41 -0000, "Dawson, Peter D" 
> ><[email-masked]>  said:
> >Note that many providers may be legally bound to not give any more
> >information than "Yeah, that's one of our IP addresses".  I know we
> >have a lot of issues regarding privacy laws due to the fact that we're
> >an agency of the Commonwealth of Virginia.  If we find that one of our
> >students has been naughty, about all we can say to people outside is
> >that we're aware of it and that action is being taken as per 
> >our procedures.
> >-- 
> 
> lets say a non-student was naughty and was attacking the vt.edu network...
> would you feel satisfied with the answer.. "we're aware of it and that 
> action is being taken as per our procedures".... knowing fully well that
> the outage costs is running into a couple of millions on a single site ??
> /pd

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Tue, 23 May 2000 19:24:26 -0400

In message <[email-masked]>, Danny Iacovou writes:
>Steven M. Bellovin writes:
>> 
>> Right.  On the other hand, the AP reports that a French-government 
>> sponsored bill would bar anonymous posting to the net.  For details, 
>> see http://www.techserver.com/noframes/story/0,2294,500207446-500289602-5015
>71097-0,00.html
>
>  But should the IETF be fighting this fight? Does the IETF send someone
>  to France in hopes of convincing politicians not to do this? Do we have
>  the most convincing tongues? The strength of the IETF is in technology. 
>  
>  Right now we don't even have enough resources to go back and update 
>  RFCs with augmented notes stating how popular implementations differ 
>  from spec. 
>

I wasn't suggesting that we should fight it; I was merely citing it as 
an example of governments following their own agendas, regardless of 
the underlying technologies.

		--Steve Bellovin

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 23 May 2000 19:06:02 -0600 (MDT)

> ...

(really technical unreality)

> non-compliance to 'Collabration' ???

How do you identify "The ISP"?  RFC 2267 is about ingress filtering,
but not egress filtering, logging, flagging, or informing.

If you do trust that the IP source address is valid, then what do you need
with anything more than we've had for decades?  Why can't you telephone
a domain contact, and get whatever information or promises of action that
the other guy is willing and able to give?

As for negating threats, regardless of what the apparent source says,
don't you think that the wise course for you is to ensure that your own
defenses render the attack harmless?