From: anonymous-remailer@shell.portal.com
Date: Wed, 8 Nov 1995 17:36:21 +0800
To: cypherpunks@toad.com
Subject: Re: Java insecurity - long - argumentative - you are warned.
Message-ID: <199511070722.XAA05420@jobe.shell.portal.com>
MIME-Version: 1.0
Content-Type: text/plain


On Mon, 6 Nov 1995, Dr. Frederick B. Cohen wrote:

> WARNING - THIS MESSAGE CONTAINS INFORMATION THAT MIGHT BE CONSIDERED AS
> A FLAME BY SOME READERS - IT IS LONG AND TEDIOUS - YOU ARE WARNED!

> > 4.2 Security in the Java Environment
> > 
> > Security commands a high premium in the growing use of the Internet
> > for products and services ranging from electronic distribution of
> > software and multimedia content, to "digital cash". The area of
> > security with which we're concerned here is how the Java compiler and
> > run-time system restrict application programmers from creating
> > subversive code.

[long list of important questions deleted ...]

Essentially, I think that all of this will distill to a single issue,
vis-a-vis Java or any other paradigm which wishes to represent itself as
*secure*.

Where is the security review role placed within the project development
life cycle?? 

Is it at Design Concept?  Or during Application Development?  Or is it
done last, after design completion, after all of the programming is
complete and the production people are involved in operational turnover. 

Or is it done at all?

This concept is not new, and should not present any problems to anyone in
the industry.  Even John Q. Public will understand it, if we use a simple
construction analogy. 

If you want to build a secure house, your security doesn't start AFTER the
house is built.  It has to start at a very early stage.  It starts before
the blueprints are made, when you specify that you want a concrete
windowless box located on a quiet street at the end of a cul-de-sac.  

That is simple and obvious. 

You certainly don't have *security* if after building a glass house on
Main Street, if after the design is finished, the footings have been
poured, and the key is about to be turned over to the occupant; if then,
as an afterthought you put a single strong deadbolt on the front door to
"secure" it. 

Anyone who can't or won't quite grasp this idea is either willfully
attempting to steer gullible individuals astray, or is congenitally
stupid. 

It's time to call a spade a spade. 

> What exactly does this mean?
> 
> > While all this checking appears excruciatingly detailed, by the time
> > the byte code verifier has done its work, the Java interpreter can
> > proceed knowing that the code will run securely. Knowing these
> > properties makes the Java interpreter much faster, because it doesn't
> > have to check anything. 

Yikes!!  I'll leave this for someone else to address.  This sounds to me
like a variation on virus scanning.  I think that there are far more
reputable virus experts than I who can comment and expand on *flaws* with 
that approach. 

> No runtime checking whatsoever.  Get past the supposed verifier, and you
> have free run of the machine.  A single verifier bug or inadequacy, and
> the world is unsafe for electronic commerce. 

As someone who *vividly* remembers October, 1987 and the near economic
meltdown which was BARELY averted by the Fed, a near meltdown which
occurred because of the interactions of systems far less intelligent or
complex than those we routinely utilize today, systems which directly
interface not only to each other, but have undocumented, non-predictable
interactions with "soft and wet" systems, I might have some serious
concerns. 

Then again, it is _only_ the economy, isn't it? 

> ASBESTOS SUITS MAY NOW BE REMOVED - FLAME OFF.
> 
> P.S.
> 
> When: Tuesday, November 7, 8AM
> Where: The Hilton, Washington D.C. (the CSI conference)
> The talk: 50 Ways to Attack Your World Wide Web Systems
> 
> If you want a chance to heckle - be there.

Drat ... I don't think that I'll be able to attend.  I've already got
a local presentation that I've pencilled in for tomorrow morning at
some god awfully early hour.  Then again, D.C. isn't quite my circuit.

I was hoping though for some clarification.  Are you THE Dr. Frederick
B. Cohen??  The one who originally coined the phrase "computer virus"
and who maintains the computer virus FAQ?

Are you THAT Dr. Frederick B. Cohen, and are you speaking publically
in Washington, tommorow as one of the keynote speakers?

If you are, I'd be interested as to whether you'll talk about the
recent gaping security hole in the existing installed Navigator code
base which I detailed to this list's subscribers. 

The one posted this last Friday the Thirteenth, that questioned
Netscape's wisdom in creating an experimental MIME object which does
not follow the usual HTTP request/response paradigm, but instead
allows a server to open and maintain a bi-directional communications
channel from server to client.

Effectively a non-password protected telnet into the heart of any
system, a open exploitable connection which penetrates proxy servers
and firewalls, and acts as an enhanced bi-directional
delivery/recovery mechanism?

I'd be very interested in the comments around that, especially since both
Netscape and AT&T (who distributes the softwre under its own brand name) 
have made an explicit "no comment".

I'd especially be interested in any post-session transcript. 

I also think that Elaine Garzarelli might be interested.  Especially since
she'll be addressing the nation and the public via the public television
airwaves this Friday evening. 

Or at least ... uhmmm ... I _think_ that's when her electronic daytimer
has her pencilled in ...




Alice de 'nonymous ...

                                  ...just another one of those...


P.S.  This post is in the public domain.
                  C.  S.  U.  M.  O.  C.  L.  U.  N.  E.