The Internet is a global collection of networks all using the TCP/IP network protocol suite to communicate. The TCP/IP protocols allow data packets to be transmitted, and routed from a source computer to a destination computer.

Above this set of protocols reside the applications that allow users to generate data packets. The following describe some of the more common applications as well as some security vulnerabilities and concerns.

Archie

Archie is a system for locating public files available via anonymous ftp (see ftp for vulnerability information). A program is run by an Archie site to contact servers with public files and the program builds a directory of all the files on the servers.

Archie can then be used to search the merged directories for a filename and will provide a list of all the files that match and the servers on which the files reside. Public Archie servers are available and can be accessed using telnet, e-mail or an Archie client.

Once the filename/server pair has been found using Archie, ftp can be used to get the file from the server. Archie can be used to find security related information(e.g. if one looks up firewall, Archie will give all the matches and locations for information on firewalls).

Archie is limited in that it can only match on filenames exactly (e.g. if the file contains information on firewalls but the author named it burnbarrier, Archie will not find it if the search was for firewalls).

Archie can be exploited to locate anonymous ftp sites that provide world writable areas that can then be used to store and disseminate illegal versions of software. In this case, a hacker uses the Internet tool to gain legitimate access to the database and then misuse the information.

DNS — Domain Name System

DNS is a hierarchical, distributed method or organizing the name space of the Internet. It is used to map human readable host names into IP addresses and viceversa. A host sends a User Datagram Protocol (UDP) query to a DNS server which either provides the IP address or information about a smarter server than itself.

Different groups are given the responsibility for a subset or subsets of names. The number of names in each group gets larger from left to right. For example: cse.dnd.ca, each level of the system is called a domain, cse represents the domain of the Communications Security Establishment which is smaller and within the dnd - Department of National Defense domain.

The dnd domain is within the ca - Canada domain. The elements of the domain are separated by periods. Queries can also be made using TCP (port 53) and are called zone transfers. Zone transfers are used by backup servers to obtain a copy of their portion of the name space.

Zone transfers can also be used by hackers to obtain lists of targets. The Computer Emergency Response Team (CERT) advises that access to this port be only permitted from known secondary domain servers. This prevents intruders from gaining additional information about the system connected to the local network.

E-Mail—Electronic Mail

Electronic mail is probably the most widely used application on the Internet. Messages are transported using a specific message format and the simple mail transport protocol (SMTP). This protocol offers no security features at all. E-mail messages can be read by a hacker residing on the network between the source and destination of the message.

As well, SMTP e-mail messages can be forged or modified very easily. The SMTP protocol offers no message integrity or sender authentication mechanisms. Some security and a higher level of trust can be provided to SMTP by applying some cryptographic measures to the message.

If message integrity or sender authentication are required then the application of a digital signature is called for. A digital signature allows a user to authenticate the e-mail message just as a written signature authenticates a document in today's paper world. Message confidentiality can be obtained by applying an encryption algorithm to the message prior to sending it.

SMTP — Simple Mail Transport Protocol

SMTP is an application level protocol used to distribute e-mail messages between computers. This protocol is very simple and understands only simple text based messages and commands. All messages transferred between computers are in ASCII form and are unencrypted.

The message is available to everyone in the path that the message takes. There is no method of verifying the message source or ensuring the message integrity, this must be done at a higher level using another protocol such as PEM. A common implementation of the SMTP protocol is found in the UNIX sendmail facility.

This program has a very colourful security history. Sendmail is an extensive program which allows remote computers more access than required to drop off email. SMTP is also commonly implemented in Post Office Protocol version 3 servers (also known as POP3) and the new IMAP4 protocol used on newer e-mail servers on Internet.

PEM — Privacy Enhanced Mail

PEM is a set of standards for adding a security overlay to Internet e-mail providing message confidentiality and integrity. This set of standards describes a security protocol that can be used above the common Simple Mail Transport Protocol (SMTP) or the UNIX-to-UNIX Copy Protocol (UUCP).

The PEM security enhancements provide three security services: message integrity, message origin authentication, and message confidentiality. The PEM enhancements can be used as a foundation to provide non-repudiation for electronic commerce applications.

Currently the PEM standard defines the use of the RSA public key algorithm to be used for key management and digital signature operations, and the DES algorithm is included for message confidentiality encryption. The PEM protocols rely on the trusted distribution of the public keys.

PEM public keys are distributed within an X.509 certificate. These certificates are digitally signed by a certification authority. The PEM user trusts a certification authority to provide public key certificates. The certification authorities can also cross certify public key certificates from another certification authority.

The certification authorities are distributed in a hierarchical structure with the Internet Policy Registration Authority (IPRA) at the top. The IPRA will certify the certification authorities. The IPRA is a non-government, private agency and may or may not be trusted by an organization.

Entrust and Entrust-Lite

Entrust is an cryptographic module that is being developed by Bell Northern Research (BNR). This module will be available for multiple computer platforms and operating systems. The module provides an Application Interface for user applications to utilize the cryptographic functions.

This module will provide the cryptographic functionality required for both message and document integrity (Digital Signatures) as well as message/document confidentiality. This cryptographic module is being validated by the Communications Security Establishment against the FIPS 140-1 standards.

PGP — Pretty Good Privacy

PGP is a public key encryption package to protect e-mail and data files. It lets you communicate securely with people you've never met, with no secure channels needed for prior exchange of keys. It's well featured and fast, with sophisticated key management, digital signatures, data compression, and good ergonomic design.

This program provides the RSA algorithm for key management and digital signatures, and uses the IDEA algorithm to provide confidentiality. The program is available for non-commercial use to Canadian citizens from the site ftp.wimsey.bc.ca.

There is commercial version of this program for sale from ViaCrypt, and an international version available as well. The international version has the message encryption (IDEA algorithm) functionality removed.

RIPEM — Riordan's Internet Privacy-Enhanced Mail

RIPEM (pronounced RYE-pehm) is a public key encryption program oriented toward use with electronic mail. It allows you to generate your own public keypairs, and to encrypt and decrypt messages based on your key and the keys of your correspondents.

RIPEM is free, but each user is required to agree to a license agreement which places some limitations on its use. RIPEM is available on Internet at ftp.rsa.com. This program is a public domain implementation of the PEM standard. The RIPEM application is available for a variety of computer platforms and operating systems.

MIME — Multipurpose Internet Mail Extensions

MIME is an Internet Engineering Task Force (IETF) solution that allows users to attach non-text objects to Internet messages. A MIME-capable e-mail client can be configured to automatically retrieve and execute data files that are attached to an email message.

The MIME standard provides a standard method of providing attachments to e-mail messages. Some of the MIME e-mail programs allow the user to configure what type of attachments are accepted and how they are interpreted, other programs are not configurable.

Users are cautioned to disable the automatic execution and interpretation of mail attachments. The attachments can be examined and processed after the user responds to prompt. In this configuration the user is warned that an attachment is going to be processed and the user has the option of cancelling that processing if they are unsure of the consequences.

There is a system in development called atomicmail. Atomicmail is described as a language for interactive and computational e-mail. This language is being developed to provide portability between computer systems for the advanced e-mail attachments as well as to address security concerns.

The atomicmail language is being designed with the constraints that processing does no harm and that access to the operating system, CPU, files and other resources is tightly controlled.