Experts in excommunication from Explore
The discussion has been opened by Godfather Gutmann, a specialist in encryptie (the versleutelen of truces) from New-zealand. In an article under the head Where Thu your encryption keys for to go today does Gutmann from the shut down which weak spots he in MSIE have found.
It goes around near it especially the manner on which the browser the digital `sleutels keeps' on the hard disk. Such keys or certificaten become sold through businesses as VeriSign and be meant round the identity of the user fast to put as that on the World Wide Web money transfers or want to look at confidential information.
Gutmann says that hackers simple a PC, that on the Internet has been connected can penetrate into, and there after that off can go with the digital certificaten. That are according to him easily to crack.
Russ Cooper, editor of the news letter NT Bugtraq, speaks that against. He want to pull to want the Nieuwzeelandse encryptiespecialist of it the attention of the media to exaggerate through the risks on theft of the certificaten.
Cooper recognizes that if the certificaten stolen can become the identity of the user is robbed. But according to him do not makes only a very small part of the surfers use of the certificaten and then also yet once for important affairs.
The Bugtraq-editor says further that the alarming article of Gutman scores of technical wrong contain. Gutmann goes there from out that surfers Internet Explore 3.0 have installed, that the relative weak encryptiemethode RC2 uses the certificaten to versleutelen. But the method that Gutmann handles that certificaten to steal asks round effort of the Internet Explore 4.0. That takes advantage of the much stronger OF THE-versleuteling. The certificaten to peck turns Gutmann the RES-bug at (see microweb of 11 November), by which a hacker IE 4.0 the buffer memory of the browser let `overlopen' then commandos directly at the computer to give.
“As you IE 3.0 uses can your no programs via the Internet on other men PC turn”, says Cooper, “You can then only the commandos export to let through the user a not-approved ActiveX-control download. Then in principle, everything is possible.”
Version 3.0 and 4.0 of want to have protection against malicious ActiveX-objects built in.
[Onno Hektor, Marketing Manager Internet Customer Unit of Microsoft in head town, means that only nuance in the above message on its place is: he wisest it on that the mistakes that in the both versions of Explore (3.0 and 4.0) are named already long remedied are in releases 3.02 and 4.01. of. Gutmann and Cooper get thus old koeien from the ditch, according to Hektor.]