Re: [TLS] TLS, PKI,

[Marsh Ray <[e-mail]>]

Personally, I am not a believer in using either source or dest IP 
address as a basis for authentication. DHCP, ARP, DNS, and IP routing 
can be owned all the time. For mobile WiFi devices the default 
assumption has to be that they are always operating on untrusted networks.

DNS rebinding, connection string, and other attacks let bad guys make 
connections out from your 'internal' systems. Not to mention the 
possibility that there is at least one owned PC behind your firewall.

On 07/14/2010 07:55 AM, Peter Gutmann wrote (or maybe was quoting):
>
> Another way of looking at this
> concession in the direction of practical usability is that if there.s
> an active attacker sitting inside your firewalled private subnet
> performing MITM attacks on you then you have far bigger things to
> worry about then a case of potential certificate spoofing.

Really? Most of these attackers and botnets seem to be after your online 
banking credentials (which could easily be obtained by cert spoofing 
after compromising your home router). Which is not to say you're not 
totally owned of course, but there's no reason to that cert attacks are 
inherently less important.

This common reasoning is also a bit fallacious: SSL/TLS+PKI is supposed 
to be the thing that protects you from compromises in routing and DNS so 
it's not a straightforward comparison of the severities of the two types 
of compromise. The DNS and IP guys used to think "well they have SSL, 
SSH, and IPSEC to protect against that" so no part of the design of 
those protocols can count on anything about the lower layers.

http://www.networkworld.com/news/2010/022010-chuck-norris-botnet-karate-chops-routers.html 
:
vvvvvvvvvvv
> A D-Link spokesman said he was not aware of the botnet, and the
> company did not immediately have any comment on the issue.
>
> Like an earlier router-infecting botnet called Psyb0t, Chuck Norris
> can infect an MIPS-based device running the Linux operating system if
> its administration interface has a weak username and password, he
> said. This MIPS/Linux combination is widely used in routers and DSL
> modems, but the botnet also attacks satellite TV receivers.
^^^^^^^^^^^^^^^

- Marsh