Security Loophole Found in Microsoft Windows University of Haifa (11/12/07)
as it appeared in the November 16, 2007 edition of ACM TechNews.
A group of researchers in Israel notified Microsoft that they have discovered a security loophole in the Windows 2000 operating system. The researchers say they have found a way to decipher how Windows' random number generator works, compute previous and future encryption keys used by a computer, and monitor private communication. The security loophole jeopardizes emails, passwords, and credit card numbers entered into a computer. "This is not a theoretical discovery," says Dr. Benny Pinkas from the Department of Computer Science at the University of Haifa, who headed the research initiative. "Anyone who exploits this security loophole can definitely access this information on other computers." The researchers say the newer versions of Windows may also be vulnerable if Microsoft uses similar random number generator programs. They say Microsoft should improve the way it encodes information and even consider publishing its code for random number generators so outside computer security experts can test them. The researchers' findings were presented at the ACM Conference on Computer and Communications Security in Alexandria, Va., Oct. 29-Nov. 2, 2007, in a paper titled "Cryptanalysis of the Windows Random Number Generator." Click Here to View Full Article
