On Wed, Jun 16, 2004 at 01:26:28PM +0200, R Armiento wrote:For example: attacker 'A' sends 'B' a social engineering request for "the secret plans"
...
spam filter silently drops the email. 'A' forges a reply
Joel Eriksson wrote:
it's not a "real" vulnerability that gives remote root to the attacker, I think it's beautiful though. :)
More likely I will ask your boss to approve payment of an invoice and then send my own forged authorization.
This is a widespread vulnerability in the way that organizations improperly trust computer communications.
The only solution is to implement some type of authentication for important electronic communications, and we all know that new vulnerabilities are exposed once there is an authentication mechanism.
To presume that electronic communications and stored communications are trustworthy, the way that the parties to civil litigation generally do, and the way that criminal courts nearly always do, creates endless potential for very bad things to happen. We must always doubt by default anything that is in electronic form.
With that in mind, remember that the attacker in the scenario presented will only succeed once per target and then the target will adapt and defend. In practice that is an acceptable risk, and the natural condition of our exposure to computer vulnerabilities.
Where we really see harm come from improper computing practices on a large scale is in court. As a society we will never be capable of adapting to threats because there will always be new people who have not previously suffered the consequences of each mode of attack.
Sincerely, Jason Coombs Director of Forensic Services PivX Solutions, Inc. http://www.pivx.com