RE: [Full-Disclosure] MSN Webcam / Chat Spoof

From: Christopher Harrington (charrington_at_syseng.com)
Date: 05/14/03

  • Next message: Kevin Spett: "Re: [Full-Disclosure] FW: BUSINESS PROPOSITION" 
    To: "yossarian" <yossarian@planet.nl>, <full-disclosure@lists.netsys.com>
Date: Wed, 14 May 2003 15:13:44 -0400

    OCSP is not per cert, you can request cert status of multiple certificates
    in one request. You would have more connections with OCSP than with
    checking a CRL, there is no question. With OCSP you get near real time
    validation status. In a CRL model you are only as accurate as your last
    CRL. Some CA's issue delta CRLS, but that gets resource intensive. If
    Verisign publishes a CRL every Monday and I revoked my cert today, you
    would not know about it until the next CRL is published. As far as
    financial transactions go, OCSP is definitely the standard. IDENTRUS,
    Swift, GTA, SET, Certeca, all use OCSP as their method of cert status
    checking..none rely on CRL's for time sensitive financial transactions.

    I use Verisign Class 1 because that's all I need. I don’t care that
    Verisign does not have enough info on me to grant a Class2 or Class3 or
    that the recipients of my email cant verify my cert via OCSP. I only care
    that the emails I send are not tampered with and that I can sign / encrypt
    email in an MS environment (my workplace) with minimal difficulty. Even if
    I did have a Class 2 or Class 3 the percentage of people who could check
    my cert via OCSP is very small ( I know because I was Technology Director
    at a now defunct company that developed and sold OCSP software / plugins )

    --Chris

    -----Original Message-----
    From: yossarian [mailto:yossarian@planet.nl]
    Sent: Tuesday, May 13, 2003 6:47 PM
    To: Christopher Harrington; full-disclosure@lists.netsys.com
    Subject: Re: [Full-Disclosure] MSN Webcam / Chat Spoof

    MessageMaybe for use in e-mail - OCSP is per cert, which means that every
    transaction will lead to a separate connect. Maybe good enough for e-mail,
    certainly not for say money transactions - you rather update once in a
    while, on quiet hours on your internet connection - not as a home user,
    but as a corporate admin. Yes with OCSP you have less data per connection,
    but you would have far more connections - if people were to use whatever
    subtype of PKI in any significant numbers - which fortunately they don't.
    In networking it is not just size that matters, also the number of
    requests.

    If you prefer OCSP - why do you use Verisign Class I - not validated? Then
    I noticed something not working in my Outlook E Sp1 on win2k: I said to
    explicitily NOT trust this certificate and the darn thing refuses to save
    this setting. Am Ioverlooking something or did I stumble into another
    minor MS Cockup Experience and have disclosed something?

    BTW - Thawte is most commonly used to push dialers onto innocent
    p0rnsurfers.... Hey, it trusted and safe software, so you really should
    install it .... Lets' associate this great product with connection
    stealers and p0rnpeddlers of the worst kind. It will really help get it
    accepted by the general public, i guess.

    Yossarian

    ----- Original Message -----
    From: Christopher Harrington
    To: Steve Poirot ; full-disclosure@lists.netsys.com
    Sent: Tuesday, May 13, 2003 10:23 PM
    Subject: RE: [Full-Disclosure] MSN Webcam / Chat Spoof

    If more clients had embraced OCSP, SCVP, CAM or some other form of
    certificate validation, the size of the CRL would be irrelevant. An OCSP
    request is only 2kb for example.

    --Chris
    -----Original Message-----
    From: Steve Poirot [mailto:poirotsj@gci.net]
    Sent: Tuesday, May 13, 2003 1:45 PM
    To: full-disclosure@lists.netsys.com
    Subject: Re: [Full-Disclosure] MSN Webcam / Chat Spoof

    I don't know about IE, but with Netscape you can import the CRLs and
    arrange for automatic updates with the maximum frequency being once per
    day.

    John.Airey@rnib.org.uk wrote:

    Because Thawte don't have the hardware capabilities to do this. I'd asked
    them this before and they told me it would be too difficult to set this
    up. Even if they did, imagine how much network traffic would be required
    for verifying every certificate worldwide?

    PKI as it is set up at the moment is as useful as the British MOT test.
    All it says is that on a given day your identity (or car) was
    satisfactorily inspected. The other 364 (or 365) days anything could
    happen.

    -
    John Airey, BSc (Jt Hons), CNA, RHCE
    Internet systems support officer, ITCSD, Royal National Institute of the
    Blind, Bakewell Road, Peterborough PE2 6XU,
    Tel.: +44 (0) 1733 375299 Fax: +44 (0) 1733 370848 John.Airey@rnib.org.uk

    Appeasement is the policy of being nice to a crocodile in the hope that he
    will eat you last. (Winston Churchill)

    -----Original Message-----
    From: Richard M. Smith [mailto:rms@computerbytesman.com]
    Sent: 12 May 2003 18:09
    To: full-disclosure@lists.netsys.com
    Subject: RE: [Full-Disclosure] MSN Webcam / Chat Spoof

    The other problem with Authenticode is that certifcates aren't revokable.
    Why doesn't IE go back to Thawte to see if the "Browser Plugin"
    certificate is still valid?

    Richard
    -----Original Message-----
    From: full-disclosure-admin@lists.netsys.com
    [mailto:full-disclosure-admin@lists.netsys.com] On Behalf Of Daniel
    Docekal
    Sent: Monday, May 12, 2003 11:38 AM
    To: 'Richard M. Smith'; full-disclosure@lists.netsys.com
    Subject: RE: [Full-Disclosure] MSN Webcam / Chat Spoof

    Sure Richard it is actually loader of dialer program itself - it even
    updates itself any time it wants and it does anything it wants. And there
    thousands of people who had this bad luck to "use" that kind of software
    without properly realising what they are doing.

    Concerning that certifitace - stop trusting things which cannot be
    trusted. Would be any COmpany/Street text something you can trust? Would
    it change any time that company relocates?

    It's problem of Microsoft who made this "authenticode" verification so
    misguided and people that they even trust to that. Actually one should not
    trust to anything that is not personally known to him... -----Original
    Message-----
    From: full-disclosure-admin@lists.netsys.com
    [mailto:full-disclosure-admin@lists.netsys.com] On Behalf Of Richard M.
    Smith
    Sent: Monday, May 12, 2003 4:10 PM
    To: full-disclosure@lists.netsys.com
    Subject: RE: [Full-Disclosure] MSN Webcam / Chat Spoof

    The downloaded ActiveX file can be found at this URL:
    http://80.96.118.2/ac/mw/MSN_QTPieJess1.exe

    I ran a strings on the file and the control is called: TIBS Loader module
    and the ProgID is LoaderCon.LoaderCon. I can't find anything on the Web
    about this particular ActiveX control, but it wouldn't surprise me that it
    is part of some sort adult dialer scheme. The control appears to be more
    of a downloader program and not the adult dialer itself.

    My question: Why can't an Authenticode certificate present the following
    information to a user:

       - Company name
       - Street address
       - Phone number
       - Web site URL
       - Contact Email address
       - Company logo
       - Link to a product description page

    All this information can be verified when a company applies for a
    Authenticode signing tool. The current scheme is just plain silly as this
    MSN scam illustrates. There is simply no way to verify where a piece of
    software is really coming from.

    Richard

    -----Original Message-----
    From: full-disclosure-admin@lists.netsys.com
    [mailto:full-disclosure-admin@lists.netsys.com] On Behalf Of Daniel
    Dočekal
    Sent: Monday, May 12, 2003 2:08 AM
    To: full-disclosure@lists.netsys.com
    Subject: RE: [Full-Disclosure] MSN Webcam / Chat Spoof

    Browser Plugin is ADULT DIALER - it connects via modem to telephone
    service and you pay your sexy adventure through your telephone bill. In
    many cases, there are adult dialers committing fraud - they redirect your
    dial-up internet connection to very expensive number without your
    knowledge. -----Original Message-----
    From: full-disclosure-admin@lists.netsys.com
    [mailto:full-disclosure-admin@lists.netsys.com] On Behalf Of Richard M.
    Smith
    Sent: Monday, May 12, 2003 3:40 AM
    To: full-disclosure@lists.netsys.com; secure@microsoft.com
    Subject: RE: [Full-Disclosure] MSN Webcam / Chat Spoof

    You missed the good part. If you actually go to the "MSN" Web site and
    press the "Connect Now" button, the site tries to download some
    questionable ActiveX control. Not to worry however:

       Just press YES in the dialog box when it appears. This operation is
    totally safe and certified by Microsoft Authenticode(tm)

    The control is signed by "Browser Plugin". I guess Thawte will give
    anyone an Authenticode certificate nowadays. I wonder who "Browser
    Plugin" really is?

    -

    NOTICE: The information contained in this email and any attachments is
    confidential and may be legally privileged. If you are not the intended
    recipient you are hereby notified that you must not use, disclose,
    distribute, copy, print or rely on this email's content. If you are not
    the intended recipient, please notify the sender immediately and then
    delete the email and any attachments from your system.

    RNIB has made strenuous efforts to ensure that emails and any attachments
    generated by its staff are free from viruses. However, it cannot accept
    any responsibility for any viruses which are transmitted. We therefore
    recommend you scan all attachments.

    Please note that the statements and views expressed in this email and any
    attachments are those of the author and do not necessarily represent those
    of RNIB.

    RNIB Registered Charity Number: 226227

    Website: http://www.rnib.org.uk

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

    • application/x-pkcs7-signature attachment: smime.p7s
  • Next message: Kevin Spett: "Re: [Full-Disclosure] FW: BUSINESS PROPOSITION"