Schneier on Security

Archangel • April 11, 2007 9:09 AM

Trojan made possible by poor inspection of token (button), resulting in theft of massive quantities of data (jackpot). The button approximated the response protocol for access to the machine (small, round object of particular diameter, thickness and mass), and no further check was made (is it metal? &c), nor was a second authentication factor brought into play. This is like hash collision - the attack and the expected token produce like results when the system inspects them, and it accepts the attacker as an authorized user.

Archangel • April 11, 2007 9:14 AM

security software that can be preempted to obtain access without authentication, or reverse-engineered from output to discover the expected protocol and tailor input appropriately (SAMBA 'attack') - the problem isn't even so much that the password manager gave out the password, as that he responded to bad input at all. Failing silently may not be user-friendly, but it is more secure than handing out debugging context to invalid users.

Archangel • April 11, 2007 9:25 AM

Phishing attack - redirect of data (scotch) from sender (barkeep) to 'shot glass' funnel - looks like appropriate recipient, but is really a link to somewhere very different (bottle), not designed to use and discard data, but to retain it for future use at the new recipient's convenience. Pass-thru, maybe, since it can be said that the proper data did reach the proper recipient (one shot, to Harpo), but the same authentication channel did not expire, and was then used to obtain far more data from the sender for the recipient's private use.