Comments on: Researcher: Digital Signatures Can Lie To Linux, OSX and Windows Users http://www.emailbattles.com/2006/05/01/security_aadfeaecja_ig/ Spam, Security, Privacy, Spyware, Phishing & Viruses from the Front Lines. Thu, 21 Aug 2008 22:42:29 +0000 http://wordpress.org/?v=2.0.4 by: WebUrs http://www.emailbattles.com/2006/05/01/security_aadfeaecja_ig/#comment-777 Fri, 05 May 2006 04:39:22 +0000 http://www.emailbattles.com/2006/05/01/security_aadfeaecja_ig/#comment-777 "For years, Prof. Ferenc Leitold of the University of Veszprem has been explaining the dangers of digital signatures to the world at large."<br> <br> This statment is not terribly accurate. Surely Dr. Leitold would prefer to be seen as malware expert and not a cryptographer as his personal Webpage would suggest<br> <br> http://www.fleitold.com/index.php?CN=20&CIE=0<br> <br> It appears that the author of this posting was not in attendance at the EICAR 2006 nor did he have access to the paper Leitold presented. Two of the questions raised in the audience clearly indicated that there are some conditions required to make Leitolds attack work. Again this is outlined here in more detail (technical and regulatory issues as well as social engineering).<br> <br> http://blog.casescontact.org/?p=53 “For years, Prof. Ferenc Leitold of the University of Veszprem has been explaining the dangers of digital signatures to the world at large.”

This statment is not terribly accurate. Surely Dr. Leitold would prefer to be seen as malware expert and not a cryptographer as his personal Webpage would suggest

http://www.fleitold.com/index.php?CN=20&CIE=0

It appears that the author of this posting was not in attendance at the EICAR 2006 nor did he have access to the paper Leitold presented. Two of the questions raised in the audience clearly indicated that there are some conditions required to make Leitolds attack work. Again this is outlined here in more detail (technical and regulatory issues as well as social engineering).

http://blog.casescontact.org/?p=53

]]> by: BJ Gillette http://www.emailbattles.com/2006/05/01/security_aadfeaecja_ig/#comment-776 Wed, 03 May 2006 15:45:08 +0000 http://www.emailbattles.com/2006/05/01/security_aadfeaecja_ig/#comment-776 Hi Sean.<br> Unfortunately, most of the security gurus I track have given up on any single factor authentication, and moved on to two factor authentication, which typically requires a smartcard reader, fingerprint / eyeball scanner, USB flash drive, dongle, etc.<br> <br> Problem is, anything you do is going to a) cost money, b) complicate management, and c) require sentient users.<br> <br> I'm not sure sentient users are a possibility. Hi Sean.
Unfortunately, most of the security gurus I track have given up on any single factor authentication, and moved on to two factor authentication, which typically requires a smartcard reader, fingerprint / eyeball scanner, USB flash drive, dongle, etc.

Problem is, anything you do is going to a) cost money, b) complicate management, and c) require sentient users.

I’m not sure sentient users are a possibility.

]]> by: Tracy R Reed http://www.emailbattles.com/2006/05/01/security_aadfeaecja_ig/#comment-775 Wed, 03 May 2006 11:36:53 +0000 http://www.emailbattles.com/2006/05/01/security_aadfeaecja_ig/#comment-775 I believe that proper use of digital signatures are the way to stop spam and fishing. But I am loathe to let any big company put a stranglehold on my email by being a Trusted Authority to issue signatures. I am much more in favor of the "web of trust" model. It is more secure, more scalable, and less subject to political maneuverings of the few Authorities that exist in the other model. Just look at the completely artificial mess and expense caued by the secure web site Certificate Authorities. I believe that proper use of digital signatures are the way to stop spam and fishing. But I am loathe to let any big company put a stranglehold on my email by being a Trusted Authority to issue signatures. I am much more in favor of the “web of trust” model. It is more secure, more scalable, and less subject to political maneuverings of the few Authorities that exist in the other model. Just look at the completely artificial mess and expense caued by the secure web site Certificate Authorities.

]]> by: BJ Gillette http://www.emailbattles.com/2006/05/01/security_aadfeaecja_ig/#comment-774 Tue, 02 May 2006 15:08:10 +0000 http://www.emailbattles.com/2006/05/01/security_aadfeaecja_ig/#comment-774 Hi Sean. <br> RE: "Having signed documents change in usefully malicious ways is not a new topic."<br> <br> Leitold presented a similar paper in 2003. <br> <br> Methinks the current timing is related to all the authenticators who are heralding digital signatures as the final solution for phishing. <br> <br> Lots of financial-types are desperate to convince web users that email from them is perfectly safe.<br> <br> Some folks apparently needed an unambiguous reminder that "perfectly safe" isn't quite accurate. Hi Sean.
RE: “Having signed documents change in usefully malicious ways is not a new topic.”

Leitold presented a similar paper in 2003.

Methinks the current timing is related to all the authenticators who are heralding digital signatures as the final solution for phishing.

Lots of financial-types are desperate to convince web users that email from them is perfectly safe.

Some folks apparently needed an unambiguous reminder that “perfectly safe” isn’t quite accurate.

]]> by: Sean Smith http://www.emailbattles.com/2006/05/01/security_aadfeaecja_ig/#comment-773 Tue, 02 May 2006 05:59:21 +0000 http://www.emailbattles.com/2006/05/01/security_aadfeaecja_ig/#comment-773 Having signed documents change in usefully malicious ways is not a new topic. See:<br> <br> K. Kain, S.W. Smith, R. Asokan.<br> "Digital Signatures and Electronic Documents: A Cautionary Tale."<br> Advanced Communications and Multimedia Security.<br> Kluwer Academic Publishers. Pp. 293--307. September 2002. <br> http://www.cs.dartmouth.edu/~sws/pubs/ksa02.pdf<br> <br> Auden Josang had a paper on this, with a different set of attacks, back in 2001-2002 as well. "What You See is Not always What You Sign." Having signed documents change in usefully malicious ways is not a new topic. See:

K. Kain, S.W. Smith, R. Asokan.
“Digital Signatures and Electronic Documents: A Cautionary Tale.”
Advanced Communications and Multimedia Security.
Kluwer Academic Publishers. Pp. 293–307. September 2002.
http://www.cs.dartmouth.edu/~sws/pubs/ksa02.pdf

Auden Josang had a paper on this, with a different set of attacks, back in 2001-2002 as well. “What You See is Not always What You Sign.”

]]>