Page Two

By Larry Seltzer  |  Posted 2004-12-06 Print this article Print

Phishing takes off Attacking perfect strangers for the sake of attacking them must have become blasé in 2004, because the hackers all seem to have gone phishing. My first column of the year was about phishing attacks, but I am surprised at how common it is now to receive messages from

The efforts to create an e-mail authentication system are not just motivated by stopping spam. The same efforts would make it difficult to send phishing attacks—or at least most of them would. The real motivation behind adding the Microsoft Caller ID parts to the Sender ID specification was to fight phishing, because SPF, the other part of Sender ID, did nothing to stop spoofing of the From: address, the one the user sees (potentially as

Just when you think phishers cant get any more immoral, they set the bar even lower. This year we saw a fake attempt to solicit contributions for the Kerry campaign. The campaigns Internet people seem to have been pretty savvy about it and were able to sabotage the effort.

Phishing attacks were increasingly used exploit vulnerabilities and install Trojan horses, but social engineering is still the bread-and-butter technique. Specifically, a link to one Web page disguised to look like a link to another Web page; the true target of the link is a fake page. But weve also begun to see anti-phishing systems that specifically look for this.

A vulnerable year There were a number of significant security vulnerabilities in a variety of products in 2004, but as usual the ones with the biggest impact were in Windows and Internet Explorer.

Well consider three of this years major problems. Perhaps the most widely-exploited vulnerability of the year, used by several prominent worms, was a bug in the Windows LSASS (Local Security Authority Subsystem Service). The bug was remotely exploitable without any user intervention on the computer—a true nightmare of an exploit. To make matters worse, Microsofts first attempt to patch this problem was itself buggy.

The most prominent worm exploiting this bug, Sasser, is still endemic, even though its author, also the principal author of the Netsky worms, was arrested in May.

The ASN.1 bug was scary not just because it allowed for potential complete compromise of the system, but because the vulnerable component is so pervasive throughout Windows. The ASN.1 system, which describes the encoding of data used by the system, was also the source of vulnerabilities in other systems, including Kerberos and a VPN. But this bug, despite potential for widespread damage, was not the source of any serious wave of attacks.

Later in the year, Microsoft revealed that the code in Internet Explorer and other programs that parsed JPEG graphics files had a bug that could allow an attacker to take over a system simply by getting a user to view the graphic. The potential for malicious JPEG files is particularly concerning since most anti-virus scanners dont scan graphics. The fallout from this was also not as bad as it might have been.

SP2 to the rescue A new, stealth version of Windows was released in 2004, but Microsoft called it a service pack. Service Pack 2 for Windows XP made profound changes in the inner workings of the operating system, intentionally breaking existing third-party products in the name of improving the security of the system. It has been successful in both regards.

Since SP2 was released in August, researchers have discovered only a few security problems in spite of unprecedented scrutiny. Its record compared with earlier versions of Windows is stellar, but it does have its drawbacks. Users have reported a large number of applications that dont work on it, and some have complained that their systems wouldnt come back up after they upgraded to SP2.

Still, SP2 users are more resistant to attack than their counterparts. As they grow through new system shipments, especially in the consumer space, the opportunities for attack will decline.

Next page: The appliance-ization of security.

Larry Seltzer has been writing software for and English about computers ever since—,much to his own amazement—,he graduated from the University of Pennsylvania in 1983.

He was one of the authors of NPL and NPL-R, fourth-generation languages for microcomputers by the now-defunct DeskTop Software Corporation. (Larry is sad to find absolutely no hits on any of these +products on Google.) His work at Desktop Software included programming the UCSD p-System, a virtual machine-based operating system with portable binaries that pre-dated Java by more than 10 years.

For several years, he wrote corporate software for Mathematica Policy Research (they're still in business!) and Chase Econometrics (not so lucky) before being forcibly thrown into the consulting market. He bummed around the Philadelphia consulting and contract-programming scenes for a year or two before taking a job at NSTL (National Software Testing Labs) developing product tests and managing contract testing for the computer industry, governments and publication.

In 1991 Larry moved to Massachusetts to become Technical Director of PC Week Labs (now eWeek Labs). He moved within Ziff Davis to New York in 1994 to run testing at Windows Sources. In 1995, he became Technical Director for Internet product testing at PC Magazine and stayed there till 1998.

Since then, he has been writing for numerous other publications, including Fortune Small Business, Windows 2000 Magazine (now Windows and .NET Magazine), ZDNet and Sam Whitmore's Media Survey.

Submit a Comment

Loading Comments...
Manage your Newsletters: Login   Register My Newsletters

Rocket Fuel