SafeWeb users may be vulnerable

From...

By Dan Verton

(IDG) -- SafeWeb Inc., a developer of online privacy technology used by consumers, political dissidents and government agencies, including the CIA, last week said there are security gaps in its software that could put the identities of users at risk.

The flaws, discovered by David Martin, a computer science professor at Boston University, and Andrew Schulman, a researcher at the Privacy Foundation in Denver, stem from the way the SafeWeb software handles JavaScript and its use of master cookies, which store cookie information from multiple sites. Using a series of attacks, the researchers showed how they were able to trick a Web browser into divulging a user's IP address and cookie information, and they also installed spyware for the duration of the SafeWeb session.

IDG.net INFOCENTER Computerworld main page Computerworld's topic-oriented communities Computerworld's IT career center Free daily newsletters Features PC World.com Product Finder Mastering e-commerce by degrees Fast-track training puts nontechies in IT jobs Visit an IDG site Choose a site: IDG.net CIO Computerworld Darwin Dummies.com GamePro.com The Industry Standard ITWorld.com InfoWorld.com JavaWorld LinuxWorld Macworld Online Network World Fusion PC World Publish.com UnixInsider IDG.net search

"We have found that the SafeWeb service is seriously and fundamentally flawed," said Schulman. "We're not talking about a few implementation errors or imperfections. Our paper documents spectacular failures of the service, based on extremely simple attacks."

Computerworld's investigation into Schulman and Martin's study ignited a series of e-mail exchanges between the researchers and executives at Emeryville, California-based SafeWeb and prompted the company to issue a statement February 13 in which it acknowledged the security flaws.

SafeWeb was aware of the problems as early as last year, said co-founder and CEO Stephen Hsu, but the company decided not to develop patches after abandoning its consumer business and licensing its technology to Los Angeles-based PrivaSec LLC in August.

In a statement, PrivaSec CEO Geoffrey Riggs acknowledged that "there are certain vulnerabilities to SafeWeb and SurfSecure secure surfing technology" and added that the company is working to develop patches. However, PrivaSec claims that the "likelihood of such an attack on a user living in a free, non-politically-repressed society is relatively low."

Martin characterized PrivaSec's explanation as security through obscurity. "Frankly, I can't think of any other security system that is considered secure by nature of it being unlikely to be attacked," he said.

SafeWeb is used by thousands of politically oppressed people around the world to shield their Web activities.