From: mccoy@communities.com (Jim McCoy)
Date: Fri, 21 Jun 1996 11:36:34 +0800
To: cypherpunks@toad.com
Subject: Re:Oil Change software snoops through hard drive
Message-ID: <v02140b00adef81075f5b@[205.162.51.35]>
MIME-Version: 1.0
Content-Type: text/plain


Declan writes:
> Alan forwarded this to me. Thought it might be interesting. -Declan
[...auto updating software...]
> Unanswered Qs:
[...intersting questions which are raised by such a service...]

I saw no mention of authentication between the Oil Change client and server,
so the first question that I had was "how do you know if you are actually
connecting to the legitimate Oil Change server?"

Since the updates are via dialup a few bridge clips in the right location
would be all it takes to have the call re-routed to someone else's server
(and if the update is done over the net hijacking the system is not much
harder...) Once you have people getting your server instead of the Oil
Change server you _own_ their machine.  You can install whatever trojan
horses or backdoors you want under the guise of an update or direct the
user to pull a hacked update from a server you designate (and it wouldly
not be hard to set up a dummy software package so that even if you later
lose your override of the system or remove it to cover your tracks the
system continues to keep your backdoors installed.)  This is some very bad
mojo.

A little social engineering or midnight wiring and there will be a lot of
people in a world of pain. Nothing like designing a system which takes your
weak spot and makes it a security problem for every one of your customers...

jim