🚀 go-pugleaf

Forwarded from comp.internet.net-happenings:

> Date: Wed, 11 Feb 1998 23:21:05
> From: John Walker <jwalker@networx.on.ca>
> Eric Ward, URL Wire
> 
> Special to the CSS Internet News
> 
> http://www.networx.on.ca/~jwalker
> 
> Major Web Sites Vulnerable: Hidden "Hole" Behind
> Far-reaching Internet Security Threat
>            http://www.miora.com/
> 
> Playa Del Ray, CA USA/URLwire/ -February 11, 1998-
> Many of the Internet's most popular web sites are
> currently open to outside penetration, according to a
> white paper released today by information security
> specialists, Miora Systems Consulting, Inc., (MSC). At
> the same time the company has the released results of
> its research on how the problem can be fixed. 
> 
> "We were shocked to find this vulnerability at a large
> number of high profile web sites, including Internet
> shopping malls, on-line banks, and even pharmacy web
> pages," says Stephen Cobb, CISSP, Director of Education
> and Research at MSC. 
> 
> According MSC's General Manager and Chief Consultant,
> Michael Miora, CISSP, the problem, which has been
> dubbed the MSC Hidden Form Field Vulnerability, has the
> potential to undermine security at sites built with
> software from Microsoft (NASDAQ: MSFT), Netscape
> (NASDAQ:NSCP), Lotus, IBM (NYSE:IBM ), Apache, and
> others. Also affected are so-called "middleware"
> products that use HTML forms to access database information. 
> 
> "We estimate that over 90 percent of web sites engaged
> in on-line transactions suffer from the MSC Hidden Form
> Field Vulnerability," says Miora. 
> 
> The problem is described in "The MSC Hidden Form Field
> Vulnerability Report," written by David Brussin,
> Director of MSC Labs and the person responsible for
> both identifying the scope of this security hole and
> designing a fix. 
> 
> Working out of MSC's offices in Los Angeles,
> penetration testing teams from MSC Labs were able to
> exploit hidden form fields to break into client sites
> during authorized tests.
> 
> Brussin's report can be downloaded from the Miora
> Systems Consulting web site at http://www.miora.com.
> The report explains the main areas of concern, which
> include: broken authentication systems; compromise of
> sensitive information; new types of CGI program
> attacks; plus hijacking and replay attacks enabling
> malicious hackers to gain unauthorized access to
> financial and medical systems. 
> 
> 
> Summarizing the MSC Hidden Form Field Vulnerability
> Brussin says: "a web design element, known as a hidden
> form field, is being misused in ways that undermine the
> fundamental security of Internet sites." He adds that,
> because this vulnerability exists in authorized web
> server content, firewalls currently offer no protection. 
> 
> According to Miora, "As soon as we realized the
> seriousness of this vulnerability we surveyed leading
> web sites to find out how many were using hidden form
> fields. The results were alarming." 
> 
> "We faced the classic security experts' dilemma," says
> Miora, "Do we announce the problem to the world or try
> to deal with it one client at a time." MSC decided to
> go public, but only after researching potential fixes
> for the problem and making that research available to
> the Internet community without charge. 
> 
> Details of how to fix the problem can be downloaded,
> along with the white paper, free of charge from
> 
> http://www.miora.com. According to Brussin, "Because
> this problem results from insecure web site content,
> rather than a vendor specific software glitch that can
> be quickly patched, MSC decided to hold off announcing
> the problem until we found a way to fix it." 
> 
> Using encryption technology, Brussin designed a method
> to prevent subversion of hidden form fields. At MSC's
> European office, in Surrey, England, Mike Cobb coded a
> demonstration version of the fix for Microsoft Windows
> NT(TM). MSC is also setting up a moderated discussion
> list at http://www.infosecurity.net to assist web
> developers and software companies working to implement a fix. 
> 
> According to Stephen Cobb, "This whole problem could
> have been avoided if companies had subjected their web
> sites to independent outside testing, either during the
> design phase, or after going live; but now is not the
> time for finger-pointing." 
> 
> To help organizations deal immediately and effectively
> with this vulnerability, and to demonstrate MSC's own
> commitment to improving information system security,
> the company is providing, at no charge: an executive
> summary and white paper, an FAQ and discussion group,
> plus documentation and demonstration of how to fix the problem.
> 
> "By providing this information for free, and by
> bringing this matter to the attention of the Internet
> community," Miora says, "We hope to give the web a
> gentle shove in the direction of improved security,
> reliability, and confidentiality." 
> 
> About Miora Systems Consulting, Inc. (MSC) 
> 
> MSC provides information security services to
> corporations and government agencies around the world
> and is dedicated to maximizing the benefits of
> information technology by identifying and minimizing
> associated security risks. 
> 
> Using the innovative IOTA(TM) approach, MSC acts as an
> independent, trusted, outside authority in the areas of
> Information System Security, Network and Internet
> Security, Disaster Recovery Planning and related
> fields. MSC's pioneering vulnerability analysis finds
> the holes in system security. MSC's world-class experts
> develop technical solutions using MSC Labs. Innovative
> training programs such as WISE(SM), the Web-based
> Information Security Education service, heighten
> 
> employee security awareness.
> 
> Since 1988, MSC has provided information security
> services to a broad range of industries, from banking
> and finance to manufacturing, distribution, retail, and
> service companies, as well as government agencies. The
> company has U.S. offices in California, Florida,
> Arkansas, and Pennsylvania. MSC's European office is in
> Surrey, U.K. 
> 
> The company's Web site is located at http://www.miora.com
> 
> ###/URLwire/
> ---------------------
> Also in this issue:
> 
> - Major Web Sites Vulnerable: Hidden "Hole" Behind
>   Far-reaching Internet Security Threat
>     Playa Del Ray, CA USA/URLwire/ -February 11, 1998-
>     Many of the Internet's most popular web sites are
>     currently open to outside penetration, according to a
>     white paper released today by information security
>     specialists, Miora Systems Consulting, Inc., (MSC). At
>     the same time the company has the released results of
>     its research on how the problem can be fixed. 
> - Malaysian Cybercity Taking Shape, Despite Crisis
>    KUALA LUMPUR - Malaysia's plans for a US$10 billion futuristic
>    multimedia "smart city" remain on track despite regional economic
>    troubles. That is the message government officials are expected to
>    tell investors later this week during a series of meetings on its
>    Multimedia Super Corridor. 
> - Free e-mail: the next Catch-22?
>     AltaVista became the latest big Web site to offer free e-mail,
>     announcing on Tuesday an agreement to license the e-mail service from
>     iName, a division of privately-held GlobeComm Inc. 
> - Detective Describes Children As Online Victims
>     An undercover cop told the Senate Commerce Committee Tuesday that
>     sexual predators stalking children on the Internet is a huge problem.
> - The State of the Net: Crowded, Fragile
>     Regional Internet Service Providers (ISPs) are juggling scarce
>     remaining IP address blocks, and national network interchanges are
>     looking for bigger and bigger pipes to handle their ever- increasing
>     loads.
> - AOL to launch in Hong Kong 
>     America Online (AOL) said today it forged an alliance with Hong
>     Kong-based China Internet Corporation (CIC) to offer its online
>     service to Hong Kong consumers within the next year, extending its
>     global reach.
> - E-commerce's road to success
>     The proper use of Internet commerce will be a huge boon to companies
>     and customers, if they can avoid the pitfalls and the overhyped
>     technology -- such as cyber money. 
> - New Lists and Journals
>     * assistant - Personal Research Assistant newsletter
>     * SECONDS - STAMPS with FAULTS - Discussions/Buying/Selling of
>       Stamp Collecting Material 
>     * PURPLE - discussing the colour purple
> -------------------------------
> Excerpt from CSS Internet News (tm)  ,-~~-.____
> For subscription details email      / |  '     \
> jwalker@networx.on.ca with         (   )        0
> SUBINFO CSSINEWS in the             \_/-, ,----'
> subject line.                          ====           //
>                                        /  \-'~;    /~~~(O)
> "On the Internet no one               /  __/~|   /       |
> knows you're a dog"                 =(  _____| (_________|
> 
> 
> 
> http://www.networx.on.ca/~jwalker
> 


--
####    |\^/|     Colin R. Leech     ag414 or crleech@freenet.carleton.ca
#### _|\|   |/|_  Civil engineer by training, transport planner by choice.
#### >         <  Opinions are my own. You may consider them shareware.
####  >_./|\._<   "If you can't return a favour, pass it on." - A.L. Brown