Sunday, January 6, 2002

Re: "Buffer Overflow" security problems (PGN, RISKS-21.84) > Perhaps in defense of Ken Thompson and Dennis Ritchie, C (and Unix, for > that matter) was created not for masses of incompetent programmers, but > for Ken and Dennis and a few immediate colleagues. Which only serves to emphasize Henry's point. The code that those "few immediate colleagues" wrote also suffered from buffer overflow problems. Not only did many ordinary commands written at Bell Labs fail given long enough lines, but in one early version of UNIX, the (written in C) login command had a buffer overflow problem that permitted anyone to login by providing sufficiently long input. In other words, C buffer overflows have caused security problems ever since the language was created; and even the earliest users of C have been caught by it. If software were really an engineering field, we would learn as engineers do to avoid tools and methods that persistently lead to serious problems. Note that gcc, the very popular GNU C Compiler, has experimental extensions to support bounds checking; see http://gcc.gnu.org/extensions.html. Let us hope that one of these extensions makes its way out of the laboratory soon. If it became a standard gcc option, the current sorry situation might begin to improve. [Dan Franklin via risks-digest Volume 21, Issue 85] 0:00 # G!

Kaiser Permanente exposes medical record numbers Here's yet another example of how an organization fails to abide by it's own security policies: Kaiser Permanente has a Web site for members at http://www.kponline.org/ . The first page here is the signon page, where one enters a medical record number and their region to enter the site. A statement concerning online security can be seen at: "http://www.kponline.org/ns/signon/signonmember?view=Security" . This statement indicates in the first paragraph that the medical record number will be sent via SSL: Signing On You need to sign on using your Kaiser Medical Number. This number will be transmitted using secure technology (SSL). We need your Kaiser Medical Number before you get into the site for two main reasons: (Note that this is the statement still in effect as of 1 Jan 2002.) However no SSL connection is possible. Every attempt to obtain a secure connection gets redirected to the non-secure page. The people in Kaiser's kponline service center seem to have no clue and no concern about this lapse. They say to disregard the security statement because it applies only to those already signed up for access which is not indicated in the security statement and cannot understand what the problem is. Pointing out that that is not what is stated just annoys them. The service reps say that no one can use the medical record number to access personal information online. Seems like that's all they are concerned with. They also claim that there is no way a medical record number can be associated with a patient. I am fairly certain that these claims are easily proven false. The RISKS are quite obvious but Kaiser seems oblivious to the obvious even when pointed out in detail. [j debert via risks-digest Volume 21, Issue 86] 0:00 # G!