ITsafe safeword concerns

Categories: spam, virus, malware, UK, government.

Yesterday, I talked about the UK Government's ITsafe security alerts system, and how it uses a "safeword" in an attempt to reduce spoofing attacks. I have some concerns:

1. This doesn't reduce the perceived authority of spoofed messages; it only increases the authority of legitimate messages.
2. The safeword may be stolen by hackers, either by spyware, packet sniffing, or via an "inside job."
3. There seems to be no way to periodically change the safeword, as one should with a password.

The reality is that these sort of weak measures can lead to a false sense of security. Arguably, that's worse than no measures at all.

Imagine the situation if virus writers managed to steal the ITsafe signup database. They could spam consumers, pretending to be the UK Government. Their messages could contain a dire warning that they should install a patch.

• Naturally, the patch would contain a virus.
• Naturally, the text of the message would employ the usual, proven social engineering tricks of such virus vectors.
• Naturally, a significant percentage of consumers would be fooled into installing the virus.

Would the presence of the "safeword" make the consumer more likely to take the bait? I think so.

UK.Gov has idea, shocker

Categories: spam, virus, malware, UK, government.

As reported elsewhere, The UK government now has a service, ITsafe, for advising citizens about viruses and other threats. It comes from the NISCC (National Infrastructure Security Coordination Centre).

To quote the website:

ITsafe is designed to provide both home users and small businesses with proven, plain English advice to help protect computers, mobile phones and other devices from malicious attack. It consists of both the Advice on this website, and a low-volume Alerting Service.

While this is potentially good news, that's not directly the point of this post. However, one tiny aspect of the alerting service shows an interesting idea.

When a consumer signs up to receive alerts, they're asked to provide a "safeword": this is to reduce the risk of spoofing. All messages the service sends will use this word in the subject line. A consumer can then quickly check that the message has really come from ITsafe, as someone else would not know the safeword.

This is an interesting idea, and one that banks and credit card companies could learn from. It appears to be a lightweight, yet powerful way to foil phishing attacks. However, there's the potential for this to cause a false sense of security. We'll cover this tomorrow.

[Edited Feb 25 2005 7.30pm UTC: adds concerns about false sense of security, a subject for a future blog entry.]

Now writing for CircleID

First post is here.

At LinuxWorld, Novell's NIMS lives again as "Hula"

Categories: Hula, GroupWise, email.

Remember NIMS, Novell Internet Mail System, later reborn as NetMail? The technology is about to get it's third outing, as the core of Hula, "a new community project to create an open source collaboration server." This illustrates several interesting trends...

A highly scalable mail server, with a reputation for robustness, NIMS quietly withered on the Novell marketing vine. It managed to pick up a claimed 4 million seats, despite very little effort from Novell, including an ill-concieved attempt to create a Hotmail competitor.

Initial goals for Hula are explicitely modest: to provide email, calendaring, and a rich "Gmail-style" web access. It's interesting to see the email market subdivide itself into full-featured messaging/collaboration platforms like Notes/Domino or Novell Groupwise, and the newer, "streamlined" technologies like IBM's Workplace Service Express or Hula.

It's also interesting to see Novell grasp the "open source community" nettle. In many ways, it's got nothing to lose, as the NIMS codebase isn't worth much to Novell as a piece of IP.

Richer web access is also a significant trend: existing mail clients such as the Scalix web client and Google's Gmail give a hint of what's possible with modern browsers. Google has also given Hula inspiration with their new Google Maps beta. Clearly, we should no longer be satisfied with slow web interfaces and heavy reliance on server round-trips. What users are coming to expect is a level of interactivity from web applications approaching that of regular desktop clients such as Outlook.

Stupid public WiFi tricks

Categories: email, WiFi.

This year's East coast LinuxWorld conference is in Boston, at the Hynes Convention Center. As is becoming common, there's a public WiFi network here. In this case, it's provisioned using SolutionInc's platform.

It seems to work quite well, even at a geek-central show such as this. However, there's one dumb thing it does, which I need to get off my chest.

When a PC connects for the first time that day, the platform goes through a registration process. The first web page you see will be the convention center's. After that, users are free to go about their business.

It does this by spoofing the first connection to its web proxy, and serve up its own welcome page instead of whatever home page you normally see.

However, it also tries to proxy spoof your first POP3 connection, so it can send you a welcoming email. This is the dumb part.

POP3 email clients need to keep track of which messages they have already downloaded, so it doesn't try to download them again. This is known as keeping the "POPstate". However, because the proxy has spoofed the POP3 connection, it will confuse the client—the spoofed message doesn't match up with the POPstate.

This confusion is likely to cause one of two problems. Either the client will re-download every message from the server, causing many duplicates to appear in the client inbox; or worse, the client will skip some new messages, meaning that they'll never be downloaded.

A plea to SolutionInc, their customers, and anyone else who does this stuff: stop it, please!