cryptoanarchy.wiki

Arise, you have nothing to lose but your barbed wire fences!

1995-09-20 - Re: NYT on Netscape Crack

Header Data

From: “Perry E. Metzger” <perry@piermont.com>
To: jsw@neon.netscape.com (Jeff Weinstein)
Message Hash: ecf2d8c37ff8f01f3926247109266b23d683a641bc7167af77937dbe6841529c
Message ID: <199509200324.XAA03268@frankenstein.piermont.com>
Reply To: <43lu3k$7q6@tera.mcom.com>
UTC Datetime: 1995-09-20 03:26:45 UTC
Raw Date: Tue, 19 Sep 95 20:26:45 PDT

Raw message

From: "Perry E. Metzger" <perry@piermont.com>
Date: Tue, 19 Sep 95 20:26:45 PDT
To: jsw@neon.netscape.com (Jeff Weinstein)
Subject: Re: NYT on Netscape Crack
In-Reply-To: <43lu3k$7q6@tera.mcom.com>
Message-ID: <199509200324.XAA03268@frankenstein.piermont.com>
MIME-Version: 1.0
Content-Type: text/plain



Jeff Weinstein writes:
> > I suspect that there are far more flaws in Netscape. String buffer
> > overflows are another good guess here -- they are probably rampant
> > through the code both for the browser and the commerce server they
> > sell. I can't prove it myself, of course, given that I don't have the
> > time to rip the thing apart, but the same folks never seemed to learn
> > their lesson in release after release when they worked at NCSA, and
> > the only thing thats probably keeping their dignity here is the lack
> > of distributed source code.
> 
>   Sigh.  For your information the security code for 1.x versions of
> netscape was not even written by someone from NCSA.

If there is ANY place in the code that I can do a data driven buffer
overflow, I can force you to execute code that I supply. I don't give
a damn if it's in the "security" code. It makes no difference where it
is. If there is a chink, thats it -- you're meat.

Besides, the "security code" obviously was written by someone who
doesn't understand anything about cryptography and yet presumed to
play cryptographer. A person who thinks seeding things off the time
makes for a good PRNG is capable of almost anything.

> In the places in the code that I have seen where it looked like such
> errors could have crept in, I have found that the correct checks
> for buffer overflow have been in place.

I have very serious doubts in this regard -- VERY serious doubts,
especially given what I've been told by several former Netscape
employees.

Perry

Thread