Date: 29 May 1996
Click here for printable version
Click here for PGP verifiable version
-----BEGIN PGP SIGNED MESSAGE-----
AL-96.01 AUSCERT Alert
Forged Security Information - Verifying AUSCERT Information
29 May 1996
AUSCERT has received reports of forged messages, containing false
computer security information, being distributed on the Internet.
Before applying any patches, fixes, or workarounds obtained from
the Internet, or in fact anywhere else, the contents and origin of
that information should be verified.
All information released from AUSCERT (including this Alert) contains
a Digital Signature. This signature can be used to verify the
origin and contents of the message. This not only applies to
Advisories and Alerts, but also to all official electronic mail
correspondence from AUSCERT.
AUSCERT has received reports of forged messages claiming to
contain security patch information being distributed via
electronic mail, news, and other distribution mechanisms.
AUSCERT takes this opportunity to warn constituents of the
dangers of forged electronic mail, news or messages, and the
measures AUSCERT has in place to verify the authenticity of
any message claiming to come from AUSCERT. These techniques
are also used by many other incident response teams and software
The standard protocol used to distribute electronic mail
throughout the Internet is Simple Mail Transfer Protocol (SMTP).
SMTP was not designed for secure transfer of electronic mail.
It is easy to forge electronic mail header information, including
the "From" address. Users should never trust electronic mail
header information as authentication of the author of the
message. Similar issues regarding authenticity may be applied
to news articles.
Users should always be cautious and verify the authenticity of
a message before applying the instructions given in that message.
This includes patch information, software installation commands,
and vulnerability workarounds.
One method of ensuring the authenticity of messages is to use
a secure cryptographic method. Using these techniques, a sender
can "digitally sign" a message allowing the recipient to verify
its authenticity. Currently there are a number of packages
which have the ability to "digitally sign" messages. These
packages generally also have information encryption capabilities.
AUSCERT has chosen to use Pretty Good Privacy (PGP) as its
standard package for digital signatures and encryption. PGP
has been chosen because it currently uses technology that is
believed to be secure, is widely distributed, and is well supported
by the Internet community.
Many Advisories contain information on available patches. The
contents of these patches should be verified by checking the
supplied MD5 checksums listed in the Advisory against those
created from the retrieved patches. Note that the listed MD5
checksums can only be trusted if they are protected by a
verifiable digital signature.
Administrators should be wary of trusting checksums created by
sum(1) to verify the contents of patches. Software is available
to modify files without altering the checksum created by sum(1).
System administrators or users may be misled into performing
inappropriate actions such as installing programs containing
security vulnerabilities, allowing intruders to gain privileged
All information released by AUSCERT will be Digitally Signed. This
signature should always be checked to validate the authenticity of
AUSCERT currently uses the Pretty Good Privacy (PGP) system. By
installing and configuring PGP, and obtaining the AUSCERT Public Key,
users may verify that the information they receive has been released by
A tutorial on PGP is beyond the scope of this Alert, however, there is a
large selection of PGP resources available on the Internet.
3.1 PGP resources
PGP source code, binaries for major architectures, documentation, and
numerous PGP tools are available from:
In particular, the PGP Frequently Asked Question lists (FAQs)
are available from:
Web users may also find the following page useful:
A version of MD5 may be obtained from:
3.2 Obtaining and Installing AUSCERT's PGP Public Key
The AUSCERT PGP Public Key is available from:
Users which have access to the "finger" utility may also use:
% finger firstname.lastname@example.org
Experienced PGP users may also obtain the AUSCERT Public Key from any
public PGP keyserver.
Fetch AUSCERT's PGP Public Key and save it to a file
% finger email@example.com > auscert.pgp
Read this file for further instructions on verifying the authenticity
of the key.
After verifying the authenticity of the key, install the public
key into your keyring.
% pgp auscert.pgp
3.3 Example of verifying a message using PGP
The following example shows how to use AUSCERT's Public Key to
verify the contents and authenticity of a message. This example
assumes PGP has been correctly installed and configured. It
also assumes that AUSCERT's Public Key has previously been
added to your keyring. It serves only as a guide for PGP
running under the UNIX operating system.
To verify a message (such as this one), save it to a file (such as
alert.txt), and type:
% pgp alert.txt
You should see the following line (Note that the date will change):
Good signature from user "AUSCERT <firstname.lastname@example.org>".
Signature made 1996/05/28 10:41 GMT
If the following text is seen, this may represent a modified message:
WARNING: Bad signature, doesn't match file contents!
Bad signature from user "AUSCERT <email@example.com>".
Signature made 1996/05/28 10:41 GMT
Reasons for a message having a "Bad signature" range from the message
being accidentally changed to it being an intentional forgery. It is
possible for messages to be unintentionally altered (for example, by
some mail forwarders).
All AUSCERT Advisories and Alerts are made available on the AUSCERT
ftp server. If the signature for an Advisory or Alert fails to verify,
you should fetch a new copy of the document from
Users who believe they have received forged mail, apparently sent from
AUSCERT, should immediately contact AUSCERT with the details.
4. Additional Measures and Information
If any user is unsure of the authenticity of information claiming
to be released by AUSCERT, then AUSCERT may be contacted by
sending electronic mail to the address below or by calling the
Hotline. AUSCERT requests that after-hours calls to the Hotline
be reserved for emergency situations only.
If you wish to send sensitive information to AUSCERT, we advise
that e-mail be encrypted. This can be done using PGP and
AUSCERT's PGP Public Key. Please check your PGP documentation
for more details. Users which do not have PGP installed and
wish to send sensitive information should contact AUSCERT to
arrange a secure method of transfer.
Many other individuals and organisations also digitally sign
their documents. This includes other incident response teams
and software developers. Users should get into the habit of
verifying digital signatures on security critical documents or
code, whenever it is an available option.
The CERT Coordination Centre has written a document on Email
Forgery. This document can be retrieved from:
The AUSCERT team have made every effort to ensure that the information
contained in this document is accurate. However, the decision to use the
information described is the responsibility of each user or organization.
The appropriateness of this document for an organization or individual system
should be considered before application in conjunction with local policies
and procedures. AUSCERT takes no responsibility for the consequences of
applying the contents of this document.
If you believe that your system has been compromised, contact AUSCERT or your
representative in FIRST (Forum of Incident Response and Security Teams).
AUSCERT is located at The University of Queensland within the Prentice Centre.
AUSCERT is a full member of the Forum of Incident Response and Security Teams
AUSCERT maintains an anonymous FTP service which is found on:
ftp://ftp.auscert.org.au. This archive contains past SERT and AUSCERT
Advisories, and other computer security information.
AUSCERT also maintains a World Wide Web service which is found on:
Internet Email: firstname.lastname@example.org
Facsimile: (07) 3365 4477
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AUSCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for emergencies.
Australian Computer Emergency Response Team
c/- Prentice Centre
The University of Queensland
-----BEGIN PGP SIGNATURE-----
Comment: Finger email@example.com to retrieve AUSCERT's public key
-----END PGP SIGNATURE-----