Three security researchers in Germany have reportedly broken Microsoft's CardSpace, which was designed to beef up the security of users' personal information while browsing the internet.
The technique essentially co-opts part of the CardSpace technology, which Microsoft believes can reduce problems such as identity theft plaguing internet users. Microsoft has said it plans to integrate CardSpace with OpenID, an open-source standard also designed to toughen up internet security.
CardSpace, which ships with Microsoft's Windows Vista operating system, operates in tandem with a browser when a user visits a website requesting information such as names, addresses or credit card numbers. In the CardSpace scenario, users can store their personal information on their own PC or use a third-party identity provider's service.
CardSpace maintains a list of virtual ID cards, which can be "self-issued" cards stored on the user's PC or "managed" cards stored by the ID provider. When a website asks for personal information, the user selects one of the cards.
When users rely on an ID provider for authenticating with a website, the provider issues a token to the website rather than passing the user's individual information along. This is where the security researchers, from the Horst Gortz Institute for IT Security at Ruhr University in Bochum, Germany, have uncovered a flaw in the process.
The security researchers, students Sebastian Gajek and Xuan Chen and Jorg Schwenk, a professor and chairman of network and data security at the institute, have shown it is possible to intercept the authentication token from CardSpace. The technique requires directing users to a malicious web server.
According to the researchers, an attacker would have to modify the victim's domain name server (DNS) settings -- a hacker technique called pharming -- and direct the visitor to the malicious web server, which then captures the authentication token. A hacker could then use the token to access or send sensitive information to the original website.
This proof-of-concept technique has not been used to attack people. The attack can be easily replicated, according to the Horst Gortz Institute. According to the researchers, it is realistic to expect real-world attacks against CardSpace in the near future.
Kim Cameron, Microsoft's chief identity architect, refuted the students' claim in a blog post. “I think it is amazing that the Ruhr students describe their attack as successful when it does NOT provide a method for compromising EITHER DNS or the certificate store,” he wrote in the blog post.
“They say DNS might be taken over through a drive-by attack on a badly installed wireless home network,” he added. “But they provide no indication of how to simultaneously compromise the Root Certificate Store,” which provides authentication certificates.
“In summary, the students' attack is theoretical. They have not demonstrated the simultaneous compromise of the systems necessary for the attack to succeed.”
The technique essentially co-opts part of the CardSpace technology, which Microsoft believes can reduce problems such as identity theft plaguing internet users. Microsoft has said it plans to integrate CardSpace with OpenID, an open-source standard also designed to toughen up internet security.
CardSpace, which ships with Microsoft's Windows Vista operating system, operates in tandem with a browser when a user visits a website requesting information such as names, addresses or credit card numbers. In the CardSpace scenario, users can store their personal information on their own PC or use a third-party identity provider's service.
CardSpace maintains a list of virtual ID cards, which can be "self-issued" cards stored on the user's PC or "managed" cards stored by the ID provider. When a website asks for personal information, the user selects one of the cards.
When users rely on an ID provider for authenticating with a website, the provider issues a token to the website rather than passing the user's individual information along. This is where the security researchers, from the Horst Gortz Institute for IT Security at Ruhr University in Bochum, Germany, have uncovered a flaw in the process.
The security researchers, students Sebastian Gajek and Xuan Chen and Jorg Schwenk, a professor and chairman of network and data security at the institute, have shown it is possible to intercept the authentication token from CardSpace. The technique requires directing users to a malicious web server.
According to the researchers, an attacker would have to modify the victim's domain name server (DNS) settings -- a hacker technique called pharming -- and direct the visitor to the malicious web server, which then captures the authentication token. A hacker could then use the token to access or send sensitive information to the original website.
This proof-of-concept technique has not been used to attack people. The attack can be easily replicated, according to the Horst Gortz Institute. According to the researchers, it is realistic to expect real-world attacks against CardSpace in the near future.
Kim Cameron, Microsoft's chief identity architect, refuted the students' claim in a blog post. “I think it is amazing that the Ruhr students describe their attack as successful when it does NOT provide a method for compromising EITHER DNS or the certificate store,” he wrote in the blog post.
“They say DNS might be taken over through a drive-by attack on a badly installed wireless home network,” he added. “But they provide no indication of how to simultaneously compromise the Root Certificate Store,” which provides authentication certificates.
“In summary, the students' attack is theoretical. They have not demonstrated the simultaneous compromise of the systems necessary for the attack to succeed.”
