Main Menu
Home
News
Blog
Contact Us
Search
News Feeds
FAQs
Sitemap
Related Content
Administrator
Login Form





Lost Password?
No account yet? Register
Syndicate

Polls
Are you ready for x'mas?
 
Who's Online





'Friendly rootkits' PDF Print E-mail
'Friendly rootkits' a must for secure Web shopping?

Secure Socket Layer (SSL) certificates have made e-commerce more secure, according to VeriSign, but a US security researcher reckons benevolent rootkits served by the retailer might do a better job.

SSL certificates are issued to merchants by Certificate Authorities to indicate to the consumer it is a legitimate business. The rootkit which Dan Geer, VP and chief scientist at security company Verdasys, has proposed would take over the security function of a customer during a transaction by placing it within the merchant's trusted environment.

Geer proposes that merchants ask their customers whether they would like an "extra special secure connection" prior to making a transaction. If a user says "Yes", the merchant could install the rootkit on a customer's PC to make the transaction safe.

"In other words, you should immediately 0wn their machine for the duration of the transaction -- by, say, stealing their keyboard away from their OS and attaching it to a special encrypting network stack all of which you make possible by sending a small, use-once rootkit down the wire at login time, just after they say 'Yes'," explained Geer in a special guest blog for ZDNet Australia sister site ZDNet.com.

The problem with SSL certificates, according to Geer, is that there is an assumption the consumer's PC is trustworthy, which today is untrue -- a quarter to two-thirds of the world's PCs are infected by some form of malware, he said, which is the result of human behaviour and means merchant e-commerce systems are "regularly kissing some infected machine on the lips".

Geer said PC infections -- like venereal diseases -- are a function of people's behaviour, so if a user says "yes", they are likely infected and would therefore benefit from the rootkit. Those that say "no" on the other hand are likely to be unencumbered by viruses and could therefore rely on standard encryption measures.

But the world is not black and white
Although Geer reckons his proposed method will have a positive impact on e-commerce safety, VeriSign's regional executive, Ed Elliff, said it would easily be undermined by other rootkit software possibly already installed on the user's PC.

"If you're talking about taking over a PC and installing a rootkit you should remember that you've got cybercriminals creating rootkits that intercept other rootkits," he said. "Also, you can't really divide the world into two camps like that. Just thinking about my own use, I would be on the "no" side, but my kids would say "yes" and I can't control that. Even if we did have a situation where merchants were always trusted, it's not viable for merchants to interject themselves like that. Seeing things like Apple with iTunes and somehow taking control of a computer and controlling what sites they go to -- no-one likes that."

The real problem comes back to poorly governed issuance of SSL certificates by low-cost Certificate Authorities, said Elliff.

"SSL has done a pretty good job for last 15 years. The technology hasn't been broken but like any technology there are processes which are reflected in pricing ... there are some low cost options where the issuance and validation process is weaker. So it's not safe just to know that a Web site has a digital certificate," he said.

"Some organisations can generate their own so you really have to look behind the fact there is an SSL and who the Certificate Authority is and the process it was issued under."
Is Extended Validation SSL a panacea?

Despite the apparent success of SSL certificates, a new standard was ratified in June this year, called Extended Validation (EV) SSL. EV SSL is more costly for a merchant to acquire because Certificate Agents must follow more rigorous procedures to certify the merchant.

However whether EV SSL is a real solution to the problem of shoddily-issued SSL certificates is another matter -- the extra cost involved in gaining EV SSL certification has prohibited many smaller organisations from adopting the standard.

So far only banks and government agencies have applied for EV SSL certificates, leaving consumers at the mercy of the remaining merchants that have acquired certificates by substandard Certificate Authorities.

Elliff warns to not hold out for a "panacea" for e-commerce security, since the real goal should be to "manage", not "eliminate" risk -- an issue which adds further complexity to the job faced by Certificate Authorities.

"The difference between the public sector and commercial enterprise such as banks is that [the latter] are working on risk management. Banks are losing lots of money each month but it's still manageable whereas a lot of government initiatives get caught up trying to eliminate risk rather than have it managed."
 
[ Back ]

Recommended Sites


Related Content

Arts
Business
Computers
Games
Health
Home
Kids and Teens
News
Other
 outdoors
Recreation
Reference
Regional
Science
Shopping
Society
Sports
World



New York Travel Services World travel info, including the New York area activities, accommodations, and travel arrangements

Reciprocal link exchange Link Exchange, Link Swap, and Link Trade Directory - Free link exchange service

Love's Briar Patch Antique Mall for Tahlequah, Muskogee & Northeastern Oklahoma

Cheap Tents cheap tents at Well Rated UK shops

SportEAR- Hearing Protection / Hearing Enhancement Hear the Outdoors come Alive with SportEARs Revolutionary All New Sound Quality. Hearing Enhancement/Hearing Protection Products, Hearing Aids, Digital Hearing Aids, Shooting Protection, Ear Plugs, Cu

Cheap Phone Calls Get Cheap and Budget calls. Take advantage of great discount call rates. Call Worldwide from Your Mobile or Landline. Enjoy Cheap International Telephone calls.

Promotional Gifts Promotional gifts and promotional Items UK supplier: see the latest promotional products, corporate gifts and giveaways at fantastic prices – pens, mugs, mouse, mats, gadgets, keyrings, umbrellas, ec

Christmas Gifts for Her Look our extensive range of beautiful Christmas gift ideas, anniversary gifts, birthday gifts to suit every important woman in your life.

Ladies Rolex Watch Melrose Jewelers is the largest global importer and distributor of preowned Rolex Watches for ladies.

Online Dating

Discontinued perfume Perfumes, Discount perfume, Designer women perfume, Mens cologne, French perfume, Fragrances, Designer fragrance, discount cologne, skin care products, perfumes New York, Chanel perfume, Perfume onlin

Japanese Fashion Japanese Store offers Japanese Shopping Service, Japanese Street Fashion, Japanese Car Parts, and Japanese Clothing for you to Buy Direct from Japan

Anuschka Handbags Planet shoes offer different variety of bags like Baggallini Handbags, Anuschka Handbags in stylish looks.

Promotional Business Gifts Choose from a wide variety of promotional business gifts with best value. Save on 5000 promotional products with our guaranteed low prices!

Promotional Umbrellas Choose a wide variety of advertising gifts and promotional giveaways like promotional pens, mugs, mouse mats, umbrellas, keyrings and many others- perfect for any exhibition, conference or event.

Promotional Mugs Save on 5000 promotional products, gifts and printed corporate merchandise items including promotional pens, mugs, mouse mats, umbrellas, keyrings - perfect for any exhibition, conference or event.

Safes Buy safes from the safe shop online

flower delivery UK flower delivery uk for flowers and champagne and chocolates gifts delivered individually or combined together - UK gifts delivery service.

Online Book Shop Gauchotexts.com: Get your books faster & easily with lowest price online book store with coupons!

Subway Sandwich Coupons

Wholesale Products from China and around the world Buy Wholesale Direct from factories around the Globe; including China, Taiwan, Hong Kong, Vietnam, Korea, Sinagapore, Italy, France, Peru, Chile, Brazil, Mexico, etc

Enhancing Athletic Performance

Argentina Dove Hunting Book direct with Adventurix and save 20% on your next dove hunting trip to Argentina.

titanium rings Brand name items for your loved one including titanium and tungsten rings, money clips and bracelets.

Werbeartikel Werbeartikel-Produkte: Für günstige Werbeartikel, Premium Werbeartikel, Ideen zu Werbeartikeln, Slogans für Werbeartikel, Werbeartikel-Lieferanten, Händler, Werbeartikel-Produkte BesuchE-Merch.com

Plasma LCD TV Wall Brackets For plasma tv brackets, plasma, plasma tv wall brackets, plasma wall mounting brackets, 42 tilt plasma wall mount brackets Visit Techfocus

uniforms & staff wear uniforms corporate & staff wear

sporting goods Tootoo.com has the most comprehensive Chinese building sporting products, sporting suppliers, manufacturers, exporters, companies and factories, etc.

Loose Leaf Tea Order tea online and savor organic and fair trade white, green, oolong, black, puerh, herbal teas and hand made teaware. Order online, or visit us...

Fundraising Ideas Yellow Moon has great value products including educational toys, crafts and novelties, that can help raise funds for schools and groups.

Children's Crafts Baker Ross stock 1000's of superb craft ideas for children, plus numerous toys, games and party products.

house designs house designs and house extensions - Architectyourhome.co.uk

Personal Injury Lawyer California Personal Injury Lawyer California specialize in representing all types of injury.

Personal Injury Case Compclaims Panel of Solicitors have successfully represented many accident victims and helped them recover compensation.

freshwater pearls Wholesale cultured freshwater pearls. Offer high quality pearl necklaces, earrings and other pearl jewelry directly from pearl farms at the discounted prices.

Stadium and Theater seating, Staging and rotating stages. Theater and stadium seating, staging equipment, stadium seating and installation services provided to the theater and performing arts, cinema and educational institutions.

buy travel insurance Up to 20% off when you buy online Instant travel insurance

Dating Sites Directoryofdating is a dating site that provides information and ratings of online dating services. Directory of dating ranks each dating service by providing individual reviews and listening to feedb

Belgian Tapestries Visit our on line catalog to view all types and styles of tapestry wall hangings available with us

Authentic Gucci Handbags Purchase range of designer handbags from Designer handbags store available brands like Gucci, Prada, Guess and more

bingo on the net

free online casino craps

online craps games

Mom Blogs | Stay at home Mom Blogs Cool Web Moms is a place where stay at home moms read and write blogs

Beds & Mattresses

Luxury Beds

shopping links Professional Link Building Company : online shopping directory, online shopping link exchange, link exchange shopping, shopping links, free shopping links.

Bad Credit Loans Bad Credit Loans

Payday Loans Payday Loans

Energy Savers Select from a wide range of energy savers and green products at TerraPass green store. Take a positive step to fight global warming with energy savers today!

Price Comparison Price comparison shopping portal offer comparison shopping for everything – mobile phones, electronics, games, books, movies, music and much more.

Online Shopping India Online shopping store for mobile phones, laptops, iPods, cameras, Games in India... Buy online at Retails Direct India- Your Lower Price Store.

Rahul Manchanda

flowers Send fresh flowers to someone special today. No matter what the occasion, Flowersdirect can delivery flowers for you when you want.

Association of Party Professionals Association of party pros (APP), with Molson Dry as the official sponsor, It celebrates partying as a professional sport.

Carpool RideSearch.com enables workers, employees, and apartment dwellers to carpool to work with someone else by doing a search for matches which helps people rideshare, save on gas, save the environment and

Johnathan Ahlf Johnathan Ahlf is currently Vice President of Marketing at NFG Broker in Davenport, Iowa

ThreadsDress.com - Latest Designer Fashion - Designer Handbags - Designer Shoes Designer fashion clothing at Threads Dress. Buy the latest fashion trends kids wear, men wear, women wear including designer t-shirts, handbags, fashion dresses, skirts, jackets, pants and sweaters.

Super Gift Shop Online - Gifts for men, women, children Hampers and gift baskets for all occasions throughout the year, traditional, bespoke and luxury, fine imaginative gifts - beautifully wrapped gift - fast online delivery service.

online shopping For shopping purpose online shopping is discounted and reasonable priced for home shopping.

prom dresses 2009 The 2009 prom fashion forecast says that while floor-length, short-hemmed, and full-skirted dresses still take the center stage, spring colors are hot this year.

Baby Quilt Patterns These baby quilt patterns are ideal for craft enthusiasts. Take a look at the different quilting supplies and fabrics offered.

Emblems WorldEmblem.com is your online supplier for emblems, badges and patches. Call 800-766-0448.

Wholesale Clothing WholesaleClothingMarket.com is the best online wholesale clothing store offering the latest styles in urban clothing, fashion, and name brand clothing. Call 1(866) 248-8959 to find out more.

Graduation Pearl Jewelry GalleryofPearls.com is an international company offering high quality pearl jewelry at exceptional value direct to the consumer. Call 770-428-7186.

Wholesale Akademiks Bargin Wholesaler is the biggest wholesale source to shop for latest styles in urban wear clothing for men, women & boys from brands like Akademiks, Sean John, Ecko, Dickies, Roca, Phat Farm, Enyce

Hostels Budapest - Hostel Budapest: Universum Youth Hostels Budapest Hungary Universum Youth Hostels - has been operating hostels & hotels in the center of Budapest since 1989. Hotel & Hostel Rila**, Hostel Vásárhelyi, Hostel Apáczai, Hostel Landler and Hostel Rózsa.

murad

Dior Sunglasses Top designers sunglasses and eyeglasses. All our products are new and 100% authentic and come directly from manufactures or official distributors.

vending machines VendingOnDemand.com is your source for vending machines and more.

Payday Loan

Faxless Payday Loans

Celebrity free bingo This online bingo site is certainly celebrity endorsed

Affordable Home Games Bargains & Sports Bjs Bargains provides affordable home gaming bargains, sports equipment, basketball, baseball products, archery, gaming products, party games and more! Buy your affordable home games now!

Pet Gifts Compare and save on over 50,000 pet supplies and accessories including hundreds of pet gifts, personalized dog and cat items at Cheappetstore.com.

free wordpress templates

free poker sites

free texas holdem poker games

free poker playing

Pegboard Shelving & retail display equipment specialists All shop fittings, garment rack rails, metal displays shelves, glass cabinets direct from the importer in Sydney

Pakistan Gifts We have express services for sending gifts to Pakistan.whether you wish to send cakes to Pakistan or you wish to send flowers to Pakistan,we have expert services for you.

Learn about credit cards Credit Card advice site. 100% Free credit card advice and help

Counters online bargain of your life at John Ellis Display exhibition & Equipment Shop for buying counters in various measurements built with high quality materials for display and decorative requirements