Virus Piggybacks Microsoft Mail Worm

metacell writes "A virus (a version of the Chernobyl virus) infects an email worm executable (the Klez worm), and is spread along with it. " It's a damn good *delete* thing that Microsoft has been *delete* spending the last few weeks doing a *delete* security audit *delete* of all of *delete* ah never mind. My wrist hurts from deleting over a meg of mail worm viruses a day.

Comments

Solution

[Chardish]

Hmm, maybe Microsoft could just disable scripts in their email software? That sounds like a good option.

No one uses Outlook macros anyway, except worm writers. It's common sense that I don't want any software, not just viruses, automatically sending email without my consent or confirmation (or even knowledge!)

Re:Solution

[bsoftware]

But thi is not "for the consumer's best interest"! consumer's best interest

Re:Solution

[Pfhreakaz0id]

There are LOTS of places that use Outlook automation/workflow apps. I've worked at two. Just FYI.

Re:Solution

[Hemi Rodner]

You can do it yourself.
Options > Security > click on "Restricted sites zone". After that, click on "internet options" in the control panel, select "security" > Restricted sites, click on "custom level" and disable everything.

Re:Solution

[swingkid]

Actually, the company i work for has a product that uses Outlook to automatically notify users of events generated outside Outlook, and I'm sure there are any number of other products that do something similar. Just because YOU don't want it doesn't mean it's not useful. Also, by default outlook lets you know if something is trying to automatically send an email on your behalf, and lets you cancel the action.

Re:Solution

[JThaddeus]

Unfortunately, my sources tell me the Outlook and Office team at Microsoft insisted on putting it in--over the objections of the Visual Basic team who knew it was a bad idea from the start. The Office logic was "We make more revenue, we want it, you have to do it." Now if only MS would get stuck with some major suits over it the would clean up their act.

Re:Solution

[killmenow]

Then again, maybe Mail/System Admins could install some AV software with daily updates and the Outlook Security Patch along with a backend server (Exchange or OpenMail [now Samsung Contact]) that can implement server-side policies to prevent users from overriding and running executables anyway.

With this done, viruses and worms have little effect.

And the constant reminders to your user-base of proper e-mailing habits does eventually sink in.

Outlook is insecure...yada yada yada...people should take responsibility for their systems and stop blaming Microsoft for everything...after all, they're only responsible for maybe half of the world's problems.

Re:Solution

[MeNeXT]

I would say there are LOTS more who do not. If we include all the home users then I would say MOST do not. So why is it active be default? Why not activate it when/if you need this feature?

I have not seen one company who uses this feature intetionally but they all have it activated and I have helped hundreds of them clean up after a virus. It does not matter if I turn it off because I do not maintain their networks and they will just reactivate it the next time they reinstall their system. On top of that they are not willing to pay someone to setup their network securely.

If you are talking to managers they see absolutely no need to spend good money on security/AV. They bought norton so all is well. Norton will save them.

It's a bird ...It's a plane .... no it's Norton

Oh! Why do I need to keep it up to date????

Re:Solution

[Pfhreakaz0id]

For the record I would agree more don't use it. I agree the defaults should be more secure in Outlook. What I was responding to was the suggestion that NO ONE used Outlook/VBA scripting. I can assure you, that is not the case.

Re:Solution

[Some Dumbass...]

Then again, maybe Mail/System Admins could install some AV software with daily updates and the Outlook Security Patch [google.com] along with a backend server (Exchange or OpenMail [now Samsung Contact]) that can implement server-side policies to prevent users from overriding and running executables anyway.

With this done, viruses and worms have little effect.

And the constant reminders to your user-base of proper e-mailing habits does eventually sink in.

And if there's a street near your house with lots of potholes and cracks, you can get larger tires, better shocks for your car, and instruct your passengers to hold on tight when you turn onto that street.

Or you can just take another street :)

Getting the city to fix the potholes isn't a bad idea either.

Re:Solution

[Malcontent]

I would so hate to be sysadmin at an MS shop. COnstantly going from desk to desk patching up outlook, IE, and whatever else was hacked that week.

Yes CmdrTaco

[gazbo]

If Microsoft had done their past few weeks of security audits properly then there is no way that this vulnerability would remain unpatched.

It is still unpatched, right? Otherwise your submission just looks like stupid MS bashing.

Re:Yes CmdrTaco

[Pfhreakaz0id]

Yeah. You wouldn't want to go off on a rant without checking the basic facts, right? I mean that would be really stupid. (For the clue-impaired, check the date)

Re:Yes CmdrTaco

[thesolo]

If Microsoft had done their past few weeks of security audits properly then there is no way that this vulnerability would remain unpatched.

More importantly, if Microsoft had done their job properly in the first place, Outlook would have never been released with so many gaping security holes.

Seriously, there is no excuse for releasing a product that auto-executes code/macros in email upon retrieval, EVER.

Re:Yes CmdrTaco

[Pfhreakaz0id]

okay, according to Smyantec, this is the vulnerablity that the worm exploits. It's dated March 2001.M

Furthermore, the other technote/patch you reference is dated may 2001. Either way, the patch has been out for a while. I agree with you, I think they've done about everything they can to get people to patch. Hell, they have enough trouble to get supposed system administrators to patch their damn web servers (code red, Nimida anyone? Both eploited holes that already had patches available).

In XP, they have a setting you can turn on to basically download the patches automatically (I'm speaking second-hand here because I haven't used XP, so I may have this wrong), but my father-in-law said he turned it off because it "screwed up his computer"! Oh well.

Re:Yes CmdrTaco

[Dionysus]

But if these guys had never released their product with gaping security holes, we would never have discovered Outlook's security holes in the first place.

Re:Yes CmdrTaco

[Dionysus]

Well, let me connec the dots.

Thesolo wrote that Microsoft should never have released Outlook with that many security bugs.

All mail on the internet, sooner or later will hit a sendmail server. Sendmail (with BIND) has been shown to be among the ten worse security applications on the 'net. If the Sendmail people had not released their product until it had been properly secure (and considering, they're still finding security bugs), then email as we know it today probably wouldn't exist. So, if the sendmail people had waited until they had a secure server, then that worm would never have been sent and arrived at someone's email box, because the server inbetween wouldn't be up.

Of course, throw in BIND, and you wouldn't have an internet either (do you know Slashdot's IP address without looking it up? Doesn't the root servers run on BIND?)

Antiviral?

[Ioldanach]

Now that someone's thought of infecting a virus with another virus, when will a white hat think of infecting Klez with some sort of antivirus. Let Klez think its doing its work, but don't actually delete the files its trying to delete. Then, a few weeks later, have code that just shuts down the Klez virus altogether.

Re:Antiviral?

[tps12]

This makes no sense for email worms. They do their damage by overloading servers when they replicate. An "antivirus" would do the exact same thing.

Re:Antiviral?

[Salsaman]

Just make a virus that installs Linux and Evolution. Problem solved.

Re:Antiviral?

[GregWebb]

No.

The first worms out there (as I recall) were autonomously helping computers - fixing problems, tuning them and so on. All beautiful, the computers fixed themselves.

Until someone came in one morning and found the machines jammed on 100% CPU and playing up. The worm had a bug in it. At which point, research stopped quickly because it was shown just how destructive this sort of thing could be.

Please, nobody try and piggyback helpful code onto an e-mail virus. How sure are you that there isn't a single bug on any possible client platform?

New Anti-Terrorism Laws put to good use?

[11thangel]

Since Outlook is propogating virii, it is responsible for electronic havoc. According to the new legislation, that classifies Outlook as an electronic terrorism program. Ok, so I'm dreaming, but wouldn't you love to see SWAT teams breaking down doors to sieze copies of Outlook?

Re:New Anti-Terrorism Laws put to good use?

[spongman]

hmm... according to your logic Boeing are liable for their planes crashing into the WTC?

I think not.

Re:New Anti-Terrorism Laws put to good use?

[wiredog]

Well, that hasn't gone to court yet. More probable is that the airlines will be held liable for lax securiy.

Re:New Anti-Terrorism Laws put to good use?

[B1]

...but then, Boeing jets don't have intrinsic flaws that make them likely to fly into tall buildings.

(BTW... Is there a version of Godwin's law for gratuitous references to terrorism or the WTC yet?)

Re: New Anti-Terrorism Laws put to good use?

[Black Parrot]

> but wouldn't you love to see SWAT teams breaking down doors to sieze copies of Outlook?

They already do that, except that it's federal marshals instead of SWAT teams, and it's done for agregated petty theft instead of mass murder.

Oh, well... our society almost has it right.

Re:New Anti-Terrorism Laws put to good use?

[saintlupus]

Is there a version of Godwin's law for gratuitous references to terrorism or the WTC yet?

I hearby institute "Ridge's Law," named for our illustrious Homeland Defense Minister. Any gratuitous reference to terrorism, Bin Laden, or the WTC "incident" will be considered automatic loss of a debate.

After all, any Slashdot thread long enough will eventually end up in a why-the-gov't-is-evil mode and its probability of invoking Ridge's Law will inexorably approach 1.

--saint

Re:New Anti-Terrorism Laws put to good use?

[lkaos]

According to the new legislation, that classifies Outlook as an electronic terrorism program.

Screw terrorism, if it could simply be proven that MS shipped Outlook with the knowledge that it had many security flaws, they could definitely be hit with some criminal charges (although the whole "AS IS" complicates it a bit).

All it would take is one memo from a higher up person saying, "Outlook has a ton of bugs, and worms are likely to wreck havoc on the industry, but we need to release on time."

Re:New Anti-Terrorism Laws put to good use?

[bleckywelcky]

Um, troll, no.

When Boeing originally sells a plane, it works perfectly. When MS sells Outlook, it should work perfectly, but doesn't. As time goes on, the plane ages and stops working perfectly. As time goes on, Outlook does not age, and should continue to work perfectly (theoretically), but still continues to not work perfectly. As time goes on, if flaws are found in a Boeing plane that result in a plane crash (not due to aging), Boeing is responsible. As time goes on, if flaws are found in Outlook and causes electronic havoc, MS is responsible. If someone chooses to take a Boeing plane and intentionally crash it into a building, Boeing is not at fault. If someone takes Outlook and intentionally uses it to spread a virus, or commit other malicious behavior, MS is not at fault.

Capiche? Or is that too complicated for you?

Now, if Boeing designed the navigation systems of its planes with a bug that caused them to direct towards and crash into any nearby buildings by default, then Boeing is at fault.

Re:New Anti-Terrorism Laws put to good use?

[tshak]

Some call me a MS fanboy based on my love for .NET, Win2K, my XBox, etc. However, I just use the technology that works best for the situation. This being said, I'm not quite sure why Outlook is not classified as a TROJAN. In a corporate environment Exchange can filter viruses and enforce group wide policies like "no executeables". This is actually pretty secure (in my experiences). However, on an unprotected home or small business machine, Outlook is almost as bad as COTDC's backorifice. At least with backorifice you have to somewhat target the attack to the machine in which it is installed. With Outlook, thanks to it's convenient address book feature, your friend and your friend's friend (and so on) is a victim. MS really needs to get their act together on this one. It's embarrassing, especially for those of us who work with MS technology everyday.

Re:New Anti-Terrorism Laws put to good use?

[parliboy]

Well, that hasn't gone to court yet. More probable is that the airlines will be held liable for lax security.

Heh, good thing they can afford it now.

"I hereby find for the plaintiff for $20 billion."

"No problem. Here's the cash you guys gave us last year. Hope you don't mind if we keep the interest."

cant belive ppl still fall for this:

[rehabdoll]

Just deleted this klez mail:

Klez.E is the most common world-wide spreading worm.It's very dangerous by corrupting your files.
Because of its very smart stealth and anti-anti-virus technic,most common AV software can't detect or clean it.
We developed this free immunity tool to defeat the malicious virus.
You only need to run this tool once,and then Klez will never come into your PC.
NOTE: Because this tool acts as a fake Klez to fool the real worm,some AV monitor maybe cry when you run it.
If so,Ignore the warning,and select 'continue'.
If you have any question,please mail to me.


Ofcourse, an infected file was attached with the mail..

Re:cant belive ppl still fall for this:

[dboyles]

"NOTE: Because this tool acts as a fake Klez to fool the real worm,some AV monitor maybe cry when you run it."

We're going to be screwed when a native English speaker decides to propagate a virus.

"I send you this file in order to have your advice."

Re:cant belive ppl still fall for this:

[Technician]

I got this at work. Our on the ball IT staff was already prpared. The tag from the IT staff simply said attachment quarentined and named the virus and the full filename. I love a good IT staff. My text was a little diffrent. It prompted me to save the attachment then exit to the DOS prompt and run it. My guess is that is to kill the anti-virus monitor.

Re:cant belive ppl still fall for this:

[BlueUnderwear]

How long until we get a virus that goes through the user's mail archive, and searches messages that look like "please install this update on your workstation" messages from the local sysadmin. The replace the attachment with itself, and send it out, with From and everything else intact to people in the address book who work in the same company (i.e. same domain)

Such a virus is bound to make a killing: everybody knows the name and writing style of the sysadmin, and both will match. Of course, we still need a more traditional boilerplate in order to jump company boundaries... (or just locate messages saying "in our company, tech support recommends this small utility for such and such purpose, please try it out").

In short: rather than coming with its own boilerplate message, the virus would go through the user's archive to find suitable real messages, and use those as templates for its mischievous purpose... Spotting suitable templates should not be overly hard: look for mails with attached zips, and containing a couple of suitable keywords such as "install", "update", "utility", "fun", "game", "screensaver", ...

Re:cant belive ppl still fall for this:

[BlueUnderwear]

You realize of course you may have just given some jackass an idea.

That was the goal ;-)

Sysadmin's everywhere will curse your name

No, they'll curse Outlook, the program which allowed this to happen in the first place...

and spit upon your grave....

Well, for that, Bill Gates' hitpersons will have to get me first ;-)

Evolution for Windows

[justanyone]

Why isn't there a version of Evolution for windows? It's great software - I'd pay for it if it wasn't free. And, NO VIRUSES!!!

Re:Evolution for Windows

[philhy]

Hey, since when is open source about a single platform?

Re:Evolution for Windows

[nagora]

I've setup customised autoreplies for messages meeting certain criteria, size limits on emails, size limits with a password to bypass them, domain-filters (taiwan, china, etc),

All of which, and more, are available to qmail users via Perl (or any other language) scripting. None of these would take more than two pages; one page if you just hardwire the parameters and don't bother with parsing a config file.

TWW

Re:Evolution for Windows

[Glytch]

This might shock and offend you, so brace yourself: Not everyone runs their own mail servers, and not everyone knows Perl. The Bat is great for your average Windows user. It fills a niche.

Re:Evolution for Windows

[Surak]

You can do things in The Bat that make Linux email clients look crippled. I've setup customised autoreplies for messages meeting certain criteria, size limits on emails, size limits with a password to bypass them, domain-filters (taiwan, china, etc), native support for PGP, or use PGP itself, GPG, or native support for S-MIME encryption.

Um, procmail will do this. I think qmail will do this too. You'd need to write only a very basic Perl or Python script.

Options?

[InnereNacht]

Alright. I've been in the field for some time but have never really pursued this: What other options for email clients do we HAVE besides Outlook/Outlook express in a windows environment?

I'm pretty sure that Eudora is still around, but what is out there for windows-based, user friendly software? It'd almost be worth the switch just to avoid all these damn Outlook-friendly virii.

Re:Options?

[cheebie]

Forte Agent is what I use for email and newsreading. I'm pretty happy
with it so far and have gotten 0 virii/worms. It doesn't render HTML, but I
consider that a feature. I use it on an individual basis, so I can't intelligently talk about its use by a larger group. You can even download it for 30 days free
to check it out.

See Agent Product Page for more information.

(disclaimer: I don't work for Forte, I'm just a satisfied customer.)

Re:Options?

[OblongPlatypus]

I know you by "windows-based, user friendly" probably mean some form of the standard windows GUI, but I personally find Pine easier to use than anything else. Probably because that's what I'm used to, but then again that's why people like the windows GUI too.

Re:Options?

[Izeickl]

The Bat ofcourse, seriously, check this mail client out, it has all the features you could want...Includes PGP encryption as standard too. I use The Bat all the time.

Re:Options?

[Will_TA]

Options away from Outlook? In Windows

• Eudora (www.eudora.com)
• Netscape/Mozilla/Opera E-Mail Clients
• Peagsus Mail (www.pmail.com)
• PM Mail 2000 (www.pmmail2000.com)

My university uses Pegasus, my favorite is Balsa (Linux/X Windows), Pine ('nix/Cmd Line)or Eudora (Winblows)

Re:Options?

[RazzleFrog]

How about you just educate yourself and your coworkers instead? Email viruses are not just about the program used - they are also about ignornace. Here is a hint to get you started:

1) Apply all security patches from Microsoft.

I was just interupted as I was typing this by a coworker asking me about a virus (talk about synchronicity). We don't use Outlook and she wasn't infected but she printed out the email and showed it to me. Sure enough - whatever.scr. I told her to delete it immediately.

Why did she ask me first and not print it? Because we have a policy here - which brings me to point 2:

2) Don't open anything that isn't work related.
3) All computers show all extensions on files.
4) Only open files that you expected with .xls or .doc extensions only (no .doc.js, etc.).
5) If you get anything else - then ask me or somebody else informed about the latest viruses.
6) When in doubt, call the sender and ask if they intended to send the email.

With all of these in place, when a virus is sent to one of our employees it does not propogate.

I leave you with this thought. A few weeks ago somebody in another department received an email warning about a virus go around. The email said to email this warning to EVERYBODY IN YOUR ADDRESS BOOK. One of my coworkers received the email and asked me about it. Of course it was a hoax and I wrote an email back to the original sender telling her that she basically just sent out a manual email. If everybody sent out that email to everybody in their address book it would be a disaster. The moral of the story - ignorance is the worst virus.

Re:Options?

[Andrewkov]

We use Lotus Notes, it's great. It has all the groupware functions your users will demand, such as calendar, appointments, to-do list, disscusion threads, etc. It has pretty good security, and is very reliable. I was mortified when our parent company told us we had to switch to Outlook. Fortunately we were able to convince them to allow us to keep Lotus Notes.

Re:Options?

[zaphod110676]

The thing to be aware of is that the latest versions of Eudora, by default, use IE to read e-mail that contains HTML. It is the same control that outlook uses to view mail. If you don't turn it off Eudora will also automatically execute attachments if they exploit a vulnerability in IE.

On the bright side, you can switch it off and use Eudora's built in viewer.

http://www.iss.net/security_center/static/8609.p hp

Re:Options?

[leuk_he]

check selection from another osdn site:

Counting till 126. And that is free and shareware. I bet this doubles when going for payware. Some packages are even so disfunctional it will even block execution of viruses.

And not forgetting number 127: telnet your pop3. . 8 commands to remember, if that is not user friendly. 8-)

Re:Options?

[CharlieG]

I agree - the Bat is great

Re:Options?

[GMFTatsujin]

GroupWise 6. A nice little package, reasonably similar to Outlook, and it uses the standard MAPI that comes with Windows, as opposed to the bastardized version Microsoft implants with Office installs.

Plus, no macros.

Plus, the GroupWise AntiViral Agent (GWAVA) has served us well by blocking infected email at the gateway.

And if you're running a Novell network, the management tools integrate right in. No more juggling accounts! Yay.
GMFTatsujin

Re:Options?

[saintlupus]

What other options for email clients do we HAVE besides Outlook/Outlook express in a windows environment?

The official Windows mailer here is Mulberry, which is pretty nice once you get past the horrible interface. We recommend a webmail package to most users, but if its not flexible enough, Mulberry is what they get.

--saint

Re:Options?

[kevin lyda]

for gods sake, just install some linux distro plus evolution and star office. even if your a bill gates groupie you've got to admit that ms needs something to get it's attention and cop the fuck on. if a decent percentage of desktops migrate to linux, and say they're doing it for security, then maybe ms will wake up and pay attention.

Re:Options?

[gosand]

Pardon my frankness, but what are you smoking? Which do you think is easier for a company to do - mandate that everyone use a specific email program, or educate them about not being stupid and opening attachments?

The general public not only doesn't understand why they shouldn't open attachments (obviously), they don't understand why anyone would write a virus. When I once told someone to not open attachments that might contain a virus, their reply was "why would they want to infect MY computer". The whooshing sound going over their head was so loud it almost broke the sound barrier.

Honestly, people are stupid and gullible. If you don't believe me, look up gullible on dictionary.com. They updated the definition recently, and it actually says "A very large percentage, nearly 80%, of the human population is extremely gullible." It also cites some documented studies, and indicates that they are actually considering removing gullible from the English dictionary. I would have included a link to the actual page, but my internet access is down at the moment.

Companies cannot afford to give their employees the benefit of the doubt. They have to force things on them. Instead of changing email clients, they should just be outlawing executable attachments. The ones who need educating are the admins, because they see over all the users. You can't believe that it is feasable to educate all the users. Maybe in small companies, but not in large ones.

Re:Options?

[Da Schmiz]

Honestly, people are stupid and gullible. If you don't believe me, look up gullible on dictionary.com. They updated the definition recently, and it actually says "A very large percentage, nearly 80%, of the human population is extremely gullible." It also cites some documented studies, and indicates that they are actually considering removing gullible from the English dictionary. I would have included a link to the actual page, but my internet access is down at the moment.

Best. Troll. Ever!

Re:Options?

[Random Walk]

Don't know PM Mail 2000, but I have tried the other three and found them rather poor (Eudora lite: nasty ads, could not find out whether/how to configure for multiple accounts, Netscape et al: bloated, slow, limited functionality, Pegasus: horrible user interface).

By far the best one I have found so far is Sylpheed (yes, it is based on GTK+, but there is a Windows binary available, and it even supports GnuPG, as well as SSL connections for POP3/IMAP).

Re:Options?

[SCHecklerX]

PMMail

Based on the original OS/2 version.

Re:Options?

[epukinsk]

The whooshing sound going over their head was so loud it almost broke the sound barrier.

You mean the sound almost reached the speed of sound? Wow, he/she really was stupid.

-Erik

Re:Options?

[Kiaser Zohsay]

Mozilla Mail/News has been my primary email client on Win32 since May of 2000 (that M18 for those of you keeping track) and is still going strong. I stuck to the milestones for day-to-day stuff, and test drove nightlies now and then to check specific bugs. RC1 looked real good all over, and RC2 should be out Real Soon Now.

Re:Options?

[Master Bait]

It doesn't render HTML

This is a GOOD thing. I'm not using Mozilla on Linux because I can't figure out how to turn off html email rendering. Have you ever seen something in your email like this?:
http://www.spammer.com/1pixel.gif?yourname@yourdom ain.com

That's a very common way to harvest email addresses.

Re:Options?

[petis]

> I would have included a link to the actual page,
> but my internet access is down at the moment.

Oh, first ever snail-mail post on slashdot. Congrats! ;)

Re:Options?

[MadFarmAnimalz]

I'll bite.

What you are saying makes sense in this limited, above-intelligence community of ours. But you are making an assumption of shared values between these coworkers/employees and more clued-in people such as you and I.

IMO ,one of the reasons people pay Microsoft money for their software is to remit payment for shielding them from the gory details of all things wired.

Let me filter out the jargon: people buy MS because it's supposed to be equally functional, but a hell of a lot easier to use.

The keyword here is 'equally functional'. By being this susceptible to moronic attempts at worm writing, MS fails to deliver in the 'equally functional' stakes.

Dumbing down an operating system does not have to be synonymous with hampering functionality. And virus susceptibility is definitely 'hampered functionality'.

No, it's not the user's fault. The client should be secure. Some things you can't blame on users.

Re:Options?

[Tony-A]

Good advice, but I'm real lazy.
1) Apply all security patches from Microsoft.
Or none. Kill all the *script.exe *script.dll thingees.
Run AV software or not. But it's the ones WITH the AV software that get the viruses. The ones without tend to be more careful.
2) Don't open anything that's strange or unexpected, work related or not.
3) All computers show all extensions on files. Insane (Microsoft default) not to.
4) Only open files that you expected with .xls or .doc extensions only. I'd be inclined to accept only zips. The body or the subject should be informative and timely enough that the message is not easily forged.
5) Otherwise terminate with extreme prejudice. The're common enough now so don't even bother asking.

With all of these in place, when a virus is sent to one of our employees it does not propogate.
That's the point! It's just a pyramid/chain-letter scheme. No reason to play the game. If people know what's going on, it works just as well as the Unix Honor Virus.

Re:Options?

[Malcontent]

"Eudora lite: nasty ads, could not find out whether/how to configure for multiple accounts,"

Well if you pay for eudora you won't get the ads, if you can't figure out how to configure eudora for multiple accounts you are just plain stupid. I'l give you a hint. Tools->personalitites (ooh wow that was really well hidden wasn't it). Or you could have clicked on the human being icon (get it a person) and then a right click->new.

You can figure out how to use GnuPG but can't figure that out? WTF?

Re:Options?

[Malcontent]

Groupwise.

CmdrTaco is RIGHT!

[sheriff_p]

Because, there hasn't been an Outlook patch kicking around for some time now. And because no open-source software has bugs. Ever.

So, in short, there's two lines of Microsoft bashing there, accompanying a really dull story about a virus that no AV software has any trouble detecting?

Must be the slow season I guess.

patches won't do it

[sheean.nl]

no mather how good a patch is, some people will always remain unpatched/unupgraded. And some of those people also gets viruses and everybody gets irritated by that, I mean, everytime I check at someone's else's PC it ain't patched.

Re:patches won't do it

[wik]

Recently I tried going to the windows update website to patch my Win2K laptop. When I selected the huge security rollup package -- or as I later found out -- any package from that site, I'd get an error message after downloading that said it could not install the patch, error code -2Billion and change. How useful.

So, even if I wanted to install the patches (which I did), I couldn't. The solution (as seems to be the solution for most things dealing with Microsoft problems now) was to download and install IE 6 over my current installation. Apparently that fixed it. I was peeved that the installation added Outlook Express and a new version of Media Player without (as far as I could tell) giving me the choice to leave the current versions.

I use outlook... but not for much longer

[GnomeKing]

I use outlook
I have done for many years
I like the interface, its easy to use, and I'm used to it

However, in the past few months I have been recieving more and more viruses and it has seriously made me reconsider my position... Last week alone my virus scanner blocked atleast 50 virus infected emails

I never open attachments, I have the preview pane turned off, I have outlook set to use the restricted zone for emails, I have norton scanning every email I get - but just yesturday I got an email informing me that I'd sent an infected mail out...

I will almost certainly be moving away from outlook within the next week just to get away from it all

Re:I use outlook... but not for much longer

[tps12]

Anyone else wonder why GnomeKing is using Outlook?

Re:I use outlook... but not for much longer

[Reckless Visionary]

The most likely reason you were informed that you sent out an infected e-mail is that Klez spoofs the From field. So if anyone who has you in their address book that was not responsible enough to take the precautions you did received and contracted the virus, there is a chance that it will be sent to other computers from your email address. See McAfee's description, most notably:

the worm has the ability to spoof the From: field (often set to an address found on the victim machine).

My wrist hurts, blah, blah, blah...

[hansendc]

My wrist hurts from deleting over a meg of mail worm viruses a day.

How many times do we have to hear Taco complain about deleting email worms? You can script up a huge database-backed website, but you can't write a freakin' procmail script?

Re:My wrist hurts, blah, blah, blah...

[sandidge]

I think "deleting over a meg of mail worm viruses" might actually be /. slang for "polishing the pleasure pole".

Re:My wrist hurts, blah, blah, blah...

[bigberk]

For anyone interested, this is all you need by way of procmail filter in order to never see any of this crap (kills executable attachments).

:0 B
*^Content-Type: (application|audio)
*^.*name=.*\.(vb[esx]|jse?|ws [hf]|c[ho]m|bat|cmd|s hb|hta|exe|lnk|pif|scr|shs)
/dev/null

Re:My wrist hurts, blah, blah, blah...

[digitalsushi]

its too bad procmail cant delve into the mime attachments, eh. then we could pattern match on the.. help me out here, uuencoded virus? i'm stabbing in the dark, though. that could be very incorrect.. and i'd love it if it was.

Re:My wrist hurts, blah, blah, blah...

[Spunk]

Yeah, and I'm really sure that's the reason his wrist hurts.

Re:My wrist hurts, blah, blah, blah...

[morris57]

How about a filter for evolution? Even if I can convince mom to use linux, there is no way I can talk her through procmail.

Re:My wrist hurts, blah, blah, blah...

[cjpez]

Can't procmail redirect a message to a program? Using a pipe? Should be easy to write your own . . .

Re:My wrist hurts, blah, blah, blah...

[digitalsushi]

yeah.. it's pretty easy. thing is, i cant figure out a way to test how it will affect the load on the machine without actually testing it on the machine. i think piping it through a program as such might knock the stuffing out of it, which is why it would be nice of procmail could do it "while its there".

I suppose that's a developer trick. (setting up a test environment that can emulate 8 incoming emails a second/10k users popping). Actually, I would give serious kudos for a link to something like that. I tried to research the setting up of a test bed like this but didnt even know what to call it! :-P

Re:My wrist hurts, blah, blah, blah...

[cjpez]

Oh, so you're worried about sissy things like performance and will my box still be able to function? Wimp. :P

Seriously, though, if you're applying these rules for everyone on the system, doing it via a procmail pipe probably wouldn't be the best way to do it. (Although I suppose you could always flip the sticky bit on the executable to help things a little.) Might as well just have sendmail take care of it for you. If you do a search on Freshmeat, there seems to be a number of things out there . . .

Re:My wrist hurts, blah, blah, blah...

[realdpk]

Sure it can. Please see man procmailrc or procmailex. Check out the 'B' flag.

Re:there should come a law for it...

[tps12]

Legislation containing the language "BWUHAHAHAHA", while not specifically prohibited by the Constitution, has historically been held in disdain by the Supreme Court.

put everyone who sends you worms in a filter

[johnjones]

its not that hard

allspam folder grows and the sensible people who dont send you worms + virus because they use a decent mailer dont get abused

simple why are you haveing such a hard time ?

ah you must run outlook or be unable of adding filter rules OR even asking you local sysadmin to do it for you all of which mean your a moron

regards

john jones

Suggestion

[szcx]

My wrist hurts from deleting over a meg of mail worm viruses a day.

Fire your administrator. What kind of idiot runs mailservers without AV software installed?

Re:Suggestion

[Peyna]

Hmm, yeah, I have yet to get any virus e-mails actually in a long time. Last ones I got were about 2 years ago. I also deal with a large number of people, so my address isn't exactly private.

Re:Suggestion

[ryanvm]

Fire your administrator. What kind of idiot runs mailservers without AV software installed?

Bzzzt - wrong. Any administrator that depends on AV software is an idiot.

Using anti-virus software to keep your computer clean of viruses is akin to taking monthly vaccines to avoid salmonella. Here's a tip: QUIT EATING RAW CHICKEN.

Similarly, you can avoid the whole virus issue if you simply avoid the risks. Don't open executable email attachments and if you're using script-capable programs stay up to date on the patches.

Of course, if you're an admin you can't depend on your users to be that smart. But again, there are much better solutions than AV software. The most effective is to simply configure your mail server to remove executable attachments.

Relying on AV software to protect you is a reactive solution. It fosters stupidity and it puts you at the mercy of your AV vendor's reflexes and creativity, and I can't accept that.

Re:Suggestion

[szcx]

Bzzzt - wrong. Any administrator that depends on AV software is an idiot

Did I say anything about depending on AV software? It's a single part of your security policy. It's no more or less important than keeping an eye on the server for unusual activity or educating your users. It's common sense.

Relying on AV software to protect you is a reactive solution. It fosters stupidity and it puts you at the mercy of your AV vendor's reflexes and creativity, and I can't accept that.

Can you accept an admin that allows his users to recieve "over a meg" of tainted messages every single day, even though tools exist that would prevent those messages from clogging the system or exposing said user to risk?

Re:Suggestion

[greenfly]

Exactly. The setup I have here uses procmail and spamassassin and defangs any inappropriate html or word macros. On top of that, executables it knows are bad it quarrantines and notifies both the sender and receiver (in the off chance the attachment was legit, both parties would know it didn't go through and why). Otherwise it simply renames the attachment randomly and "defangs" the extension so one has to manually rename it to get it to even run.

We've had no problems since that is set up. Most places don't even need .exe, .pif, etc attachments in email. And even if you do, it's a simple matter to just zip it up.

Re:Suggestion

[sheldon]

Running anti-virus software on your computers is like cooking the chicken before serving it.

There are other best practices as well, such as denying certain types of attachments to come in and out of your mail server, and other such rules.

Outlook

[mikethegeek]

The BEST virus spreader evern invented... The sad thing is, it doesn't MATTER IF MS fixes it, there are so many millions of the "take me in the ass, script kiddie" versions of Outlook and/or IIS running on 2000/NT and 9x workstations owned by users with no clue as to how to patch their systems that this will be a problem for YEARS...

I'm telling you, software makers NEED liability. It's the only way we will ever have responsible programs released. Right now, software makers can get away with selling products that have defects in them on the order of ones that if they were in cars, would send Ford or GM into receivership.

These e-mail worms would never be able to spread in this way if it were not for defects in Microsoft products.

Until software houses are FORCED by liability that can't be EULA'ed away, there will never be wuality control.

Re:Outlook

[mikethegeek]

" Careful what you wish for. There are people out here in real world who cannot afford to get sued."

You know what? If this happens, the software industry has no one but themselves to blame. They've had plenty of time and then some to self-police, and have failed to take bugs and security seriously.

True, not ALL software companies are MS, but it is MS that has the flaws, and is on most of the machines. Sadly.

Re:Outlook

[mikethegeek]

"That's because in the case of Ford or GM, defects like that would cost people their health or their lives. I very much doubt that anyone has ever been killed by an email virus or worm."

When it comes down to the courts, even health and life is expressed in dollar damage awards.

Software security holes and bugs lead to what is probably many milliions to maybe BILLIONS of dollars in damage and loss each year.

If the software industry took QUALITY as seriously as they do feeding their BSA stormtroopers, I might be more sympathetic to their piracy cries.

Re:Outlook

[mikethegeek]

"software makers NEED liability

The problem is, they would just argue "hey, the patch is available, why didn't you apply it?"

To which I reply, "Why did you release it (and take my money) before you patched that?"

Re:Outlook

[Error27]

>>True, not ALL software companies are MS, but it is MS that has the flaws, and is on most of the machines. Sadly.

All software has flaws.

Probably you could find at least 10 Linux kernel sleep_on race bugs by looking at the links on this page. These aren't serious bugs for most people but they potentially could be crashing (DoS) bugs for some people.

A study by Stanford showed that OpenBSD was twice as buggy as Linux per ksloc.

People claim that mainframes are less buggy, but that is mostly because no one opens those computers to the internet.

Open VMS is supposedly secure, but last week one of my friends found a security bug in it.

Think about it... The Linux kernel is 3 million lines of code, hundreds of drivers, developed over by hundreds of developers over a period of 10 years. You seriously think it is possible to develop something like that without making a single mistake?

Re:Outlook

[Fizzlewhiff]

I'm telling you, software makers NEED liability. It's the only way we will ever have responsible programs released. Right now, software makers can get away with selling products that have defects in them on the order of ones that if they were in cars, would send Ford or GM into receivership.

Before you go asking for something like this think about how it will impact the open source and free software community. All software has bugs. Bugs for the most part are not intentional. Would a free software project have the resources to fight off litigation caused by exploit? Punish the script kiddies if you want to punish someone but don't go after the industry because of a few bad apples. This is very similar to copy protecting CD's because a few people might pirate the contents.

Re:Outlook

[brer_rabbit]

Finally, if commercial software houses (which include things like single-person shareware companies) are required to cover damages and are not allowed to set the terms of liability, then I feel that the GPL-using community should be required to do the same. Fair is fair.

Very much true. Even though the GPL states: "IN NO EVENT ... WILL ANY COPYRIGHT HOLDER ... BE LIABLE TO YOU FOR DAMAGES" (capitolization from GPL). That said, that won't stop anybody from trying to sue you. And what's to stop existing or future EULAs from MS or otherwise to include similar provisions?

Liability for virus transfer

[Anonymous Coward]

While it seems a little draconian, holding individual users liable for viruses that spread via their machines makes sense to me. I'd liken it to automobile collisions--if your failure to properly control your car on the road leads to someone else's property being damaged, you get sued. After all, the owner/operator of a computer, even a home PC, does have the ability to prevent their machine from becoming a vector--if not by picking secure software, then simply by disconnecting the machine from the Internet.

If the incentive existed, individual users would tend to take more responsibility for what moves through their computers.

And sure, most people with PCs and email today don't have a clue about virus transmission, but why should that be an excuse to let their irresponsible behavior cause damage to everyone else? Either get a clue, or leave the net to people who have one.

Re:Liability for virus transfer

[ShavenYak]

holding individual users liable for viruses that spread via their machines makes sense to me. I'd liken it to automobile collisions--if your failure to properly control your car on the road leads to someone else's property being damaged, you get sued.

Great, now I'll have to get liability insurance on my computers too.

Wrist ache

[Tet]

My wrist hurts from deleting over a meg of mail worm viruses a day.

Procmail is your friend. As soon as I get more than 4 or 5 copies of a spam / worm / virus, it gets a procmail rule to autodelete it. Simple, really...

a bug with a bug

[connorbd]

So let's see. We have a worm. It's infected with a virus. Double your damage, double your fun... reminds me a little of flesh-eating streptococcus. Regular strep, you get a sore throat and a week or so of penicillin. Give that strep a virus, suddenly your arm starts melting.

Now what I want to know: is this train wreck a coincidence or has someone been cross-breeding?

/Brian

Re:a bug with a bug

[Dr_Cheeks]

....has someone been cross-breeding?

From the article:

"As far as (Chernobyl) is concerned, the Klez worm is just another file to infect," Weafer said. "It's quite common to see piggybacking effects when you have worms that have been propagating for a long time in the world."

Pure fluke by the looks of things - Chernobyl has been around for ages (4 years) and happened to infect Klez as it would any other file. When you think about it, people who're still catching 4 year old virii are more likely to be propagating the newer stuff too.

Re:Secure computing

[iCharles]

Perhaps we really need to place the blame on teh people who are truely at fault: the people who write the worms and viruses in the first place.

Blaming Microsoft is fashionable here, and, IMHO, encourages people who write viruses that attack MS products (one of many factors, but I suspect it is a major one). However, just because someone leaves there car unlocked does not mean they are at fault should they get robbed.

I'm not saying that better security should not be implemented. However, by simply saying it's MS's fault is simply condoning the virus-writers. Let's make them the pariahs.

Braaaa-ziiiilllllll

[lildogie]

The notes about releasing a benivolent virus that locks down Outlook features reminds me of the movie "Brazil," where there was a character that clandestinely made repairs to the failing infrastructure. The "legitimate" repair people never fixed anything; they stalled with paperwork and broke more things than they fixed. On top of that, numerous products were advertised and sold that just put pretty paint over the top of the flawed plumbing, instead of actually improving anything. To top it all off, nearly everybody thought that the "official" technology worked fine, because they'd never experienced anything that actually worked _well_.

Life imitates art.

Re:Braaaa-ziiiilllllll

[pohl]

It was also illegal for you to conduct your own repairs, even if the works were right behind a panel in the wall of your own apartment. There was a scene where the official repairmen finally arrived (a short-fat/tall-skinny pair like Laurel & Hardy) almost catching the rogue repairman in the act, and they were very dubious about the plumbing just "fixing itself". (The source is closed; though shalt not touch...) Add to that the constant restaurant bombs and the botulism toxins that people are injecting to look younger, and you have a movie that was frighteningly accurate prediction of the future.

Re:Seriously...

[Dr_Cheeks]

"I get like 4 virus e-mails a day, sometimes more. It's starting to become slightly ANNOYING!
snip!it's a major pain in the arse."

STATING="obvious"Um, if it's such a major problem then either: a)switch on your antivirus s/w or b)set up some filters for your email/STATING

C'mon; you come to /. - surely you're savvy enough to manage that. And surely you didn't expect sympathy from the crowd here :P

Not Always MS's fault

[kpetruse]

Now I dislike MS as much as the next man, but let's not blame them for all virus emails.

Most (but not all) email virus/worms are Javascript, Visual Basic or .EXE files that are sent by email. Clueless users double click on these because they are...well...clueless, and think that they are games/pictures/nudey photos of Kournikova, whatever. This activates them, and allows the worm to read the address book and either use Outlook or its own SMTP routine to send itself to all the people in the address book.

MS put the "double click" functionality in to make people's lives easier, and on the whole, they have. Outlook is very easy to use and this is one of the reasons it's so widespread (another being that it's very powerful, but that's going off topic). Combine this ease of use with how common MS Outlook is, and you'll see why virus writers write viruses for it. If some new Mail client became as popular, don't think for a minute that it wouldn't have similar viruses.

All that it takes to stop viruses like Klez is for the mail administrator to block attachments with .exe, .js and .vbs extensions (plus some other little tricks) and this kills 99.9% of viruses stone dead. Either that, or get your user base educated enough to not blithely double click on everything they see.

I'm not talking here about some of the rather more ominous security holes in Outlook - those that allow code to run by previewing the message - because anyone who hasn't patched that yet is a moron. And there are a couple of holes which MS should be hauled over hot coals for, but they aren't exactly the only software firm to produce insecure software.

Never mind Klez, hoaxes are the annoying viruses

[galaga79]

Never mind the the Klez virus, those elaborate virus hoaxes are far more annoying because you need to educate the person that emailed you about it that it is in fact a hoax. One only has to look at the latest hoax that tricks user into thinking jdbgmgr.exe, the Microsoft Debugger Registrar for Java is a virus.

Our duty to our users.

[AmiNTT]

I'm a half-owner of a small web development company in Ottawa, Ontario (Canada). When we discuss email with our clients (new and old) we *strongly* warn them about the dangers of using MS Outlook (well, MS anything, really). Many are dumbfounded to find out that all the viruses, worms and macros are targeted at MS software. We urge them to change to something else. We should all be doing this. The more users we can get away from MS Outlook, will directly translate into less trouble for ourselves because who do they call? Certainly not Ghostbusters. ;-) Even if it means setting up just a few systems that don't use outlook, the next time around something clever and nasty is released, those systems won't get infected. Then we bring that to the attention of the PHB's (Pointy Headed Boss, for you non-Dilbert readers). Explain that because those systems weren't infected, it saved x hours. Just about everyone that we have infuence with has stopped using outlook (with the exception of uncle Bob, but hey, thats his problem). Its saved us time and energy. In a way, its our duty, as people in the know, to move them away from MS software. Why use software that is going to cause problems? Is Outlook so amazing that it is worth the hours of problems caused by virus outbreaks? I would say no. I like the kind of software that you install, it works and doesn't cause any troubles. Besides, migrating users to something else (Opera, Mozilla.. anything!) takes licencing bucks away from MS. ;-) And thats always a good thing.

Re:Our duty to our users.

[error0x100]

Some people here are defending MS by saying that people should just "install all Microsoft security patches". Well, sure, in an ideal world, we would all be able to keep up-to-the-minute up to date with MS patches and anti-virus updates, and we would all have 15 minutes to 1 hour a day available to personally dedicate to updating our MS and AV software.

In the real world though it doesn't work that way. We often go through very busy patches at work, and getting the latest AV update or d/ling the latest MS patches fall a few notches on the priority list. Its very easy to go one or two weeks without updating. It is a *practical* impossibility for real people to always keep their stuff up to date; most of us actually have work to get done and don't have the luxury of sitting down every day to do it.

Furthermore, even if everyone did somehow manage to keep their software up to date, miraculous as that would be, it still wouldn't be enough, and it CAN NEVER BE enough, for the simple reason that anyone who discovers yet another exploit in Outlook will always be ahead of the patch writers and anti-virus authors. And downloading the latest updates doesn't always help either: I got hit with an Outlook virus at work in spite of having the AV software 100% up to date with "live update" - the AV auto-updates were at least a few days behind, and sure I was stupid for opening a strange attachment, but I honestly thought that I was safe because my software was up-to-the-minute patched (I did an update right before opening the file, just to be on the safe side, so much for that) (I opened the email because it resembled the sort of email I do sometimes get from foreigners asking me for help ..)

Anyway, even if you manage to educate users to never open strange attachments (which is an annoying enough notion in itself, simply because there is a legimate reason for the existence of email attachments, now some servers/companies dont even allow them at all), it still wouldn't be enough, as history has already shown us that some Outlook exploits don't even require user intervention at all, the email simply needs to drop into the inbox and it will execute. Sure, these are rare, but they exist, and the possibility for more of them is fair to good.

The point is, no matter WHAT you do, as long as you use Outlook, you are NOT safe. And I remember when I used to use Outlook, there was always this constant, nagging 'fear' in the back of my mind whenever I checked my mail, knowing that I might be about to become yet another victim of the next Outlook-flavour-of-the-week virus. Probably what I like most about having switched to Pegasus is the peace of mind that is now possible when checking mail. Somewhat comparable to having protected vs unprotected sex, in the latter case the risk is in the back of your mind the whole time.

You know what I find hilarious?

[Qwerpafw]

It's ridiculously funny how email apps (outlook in particular) spread virii.

Think back on a bunch of the copyright issues. Basically, one of the problems is that you are in trouble if your work can be used in illegal ways with great ease. Thats why napster got busted--the courts found that their system was often used for illegaly violating copyright laws, and that they didn't do enough about it (saying "Don't steal music != enough).

well, I am seeing potential lawsuits against microsoft here. Clearly their software is commonly used for spreading virii, and clearly they, too, aren't doing enough about it.

Suuuuuure. They say that security is a "focus," but nothing has really changed. So they obviously are condoning, even promoting, virus writing! Microsoft must be sued to stop them from spreading email virii. It's for the good of the country that this evil corporation must be kept from promoting the internet terrorism which costs taxpayers millions every year.

Just a thought to keep you smiling. :)

Why I find Klez so interesting...

[bmooney28]

Frankly i've been facinated with the Klez virus for two reasons...

First of all, I did some calculations, and found that there are over 1600 different subject line possibilities alone with this virus! This takes into consideration the number of variable words within the subject lines, and doesn't even account for the number of different message bodies. All things considered, there are probably over 10,000 possibilities!

The second thing about Klez that I find interesting is the payload... You often get totally random files from people's computers (if they survive virus removal)... For example, one of my coworkers got the 2001 operating budget of her church, and was able to see how much everyone was paid, how much they blew on projects, etc... Opening your inbox is like opening presents on christmas morning... most of the stuff is pretty boring, but every once in awhile you open something interesting!

Re:Why I find Klez so interesting...

[Kallahar]

And it's safer than Sircam because those attachments aren't infected, it's just the one executable file that is infected.

I've gotten some web pages, and a list of cargo trucks leaving raleigh, SC on April 18th! :)

Travis

What can Microsoft do?

[Nomad7674]

Okay, as a long-time Mac user and a reader of Linux sites like this, I know that Windows carries a massively larger burden of virii than other Operating Systems out there. Time and time again, I have heard it said that this is due to their market share - hackers want to be seen and thus make their virii attackers of the software that most people have. But this really rings hollow for me - the MacOS has always been relatively free of virii, as has Linux, as has BSD, as has AmigaOS, as has BeOS etc. This seems to imply that maybe aside from marketshare, Microsoft engineers (or marketting staff) are doing something wrong.

Let's take a constructive approach to this topic. With so many SysAdmins out there, what are the TOP TEN things that Microsoft (or any OS maker) can do to prevent virii? I am just a humble Business Analyst, but here are a few ideas that come to mind for me (I hope the coders will forgive my ignorance on some of the finer points):

10. Disable scripting in certain programs (e-mail) by default.
9. Automatically download security pactches to PCs if they are of a sufficient severity level (but put measures in place to make sure the same mechanism is not used to transmit virii/worms)
8. Auto-detect large numbers of e-mails being sent at once and alert users before sending
7. Make the default install for all systems the most secure install
6. Create a system to auto-report virus/worm infections to a central (independent) agency for monitoring (user-selectable kill switch for this functionality should be available tho)
5. Allow purchase of "health insurance" for PCs by Microsoft to reimburse for lost productivity/hardware due to infection - monetary incentive for MS to push quality and security
4. Create a module of the OS to track virus reports/alerts and display them in the taskbar - produces one trusted source for alerts and to decrease the effectiveness of e-mail hoaxes
3. Integrate virus alert into mail program for incoming e-mails - advise users when a known large-scale e-mail virus/worm is out there to decrease openning of infected mail.
2. Give sysadmins the ability to change e-mail setting for all users when a large-scale outbreak is going, to specifically turn off scripting, html reading, java, etc.
1. Provide a method for a daily audit of all processes running on a machine to identify all those not initiated by the user, and flag those taking part in suspicious activity.

Not sure if those are insightful or lame. But feel free to improve upon this list, ad infinitum.

Re:What can Microsoft do?

[sheldon]

First of all... AmigaOS free of virii? Huh? I encountered a lot of boot sector viruses back in those days. Oh, and my favorite was the arguments about the virus that supposedly embedded itself in A500 memory expansion clock.

Now as far as what Microsoft can do, let's look at your list and what they have done.

10. Done. New versions of Outlook by default disable scripting.
9. Windows XP automatically downloads security patches. This functionality should be extended to universally cover Office and other products as well.
8. Done. New versions of Outlook by default will warn a user if an external app is trying to use it to send email, and further warn if it's being used rapidly.
7. Pretty much done with WinXP. There are a few settings relating to domain authentication that can be strengthened by default. I think they are not because it would cause connectivity issues with older NT domains.
6. That would be virus protection and step on third parties like Norton and McAfee.
5. That's not Microsoft's responsibility.
4. Again virus protection.
3. Again virus protection.
2. Done. This is part of the Active Directory integration.
1. Process auditing has been part of NT since the very beginning. What you want is reporting on that, and I don't think you fully appreciate just how big of a task this would be. This functionality is really only useful in more secure DoD installations because of the scope.

Re:What can Microsoft do?

[cjpez]

To be fair, most other operating systems just don't generate the sheer amonut of hate that people throw at Windows. The same can be said of companies and Microsoft. Windows users may dislike Macs, or be wary of Linux, but disgruntled ex-MS-product people tend to be exceptionally bitter towards MS. So what do you suppose the virii are going to be written to attack?

Just a theory, of course, with no evidence, but that's how it seems to me.

Re:What can Microsoft do?

[Reziac]

Do XP's autoupdates still require ActiveX and WSH be active? Cuz if so, ISTM that kinda defeats the purpose -- ie. being required to turn on a broad-spectrum vulnerability in order to fix another vulnerability doesn't make good sense to me.

Re:What can Microsoft do?

[Rogerborg]

• 8. Auto-detect large numbers of e-mails being sent at once and alert users before sending

Unfortunately, many virii include their own mini smtp server, so they don't actually send via Outlook. Incidentally, if you run a LAN, it's a good idea to have your firewall be paranoid about outgoing traffic as well as incoming. Instead of using SMTP servers on each desktop, or using your ISP's SMTP server, run a single SMTP server on the firewall (only visible from the LAN) using a non-standard port, set up all your desktops to use that server to send mail, and block (and log!) any LAN-WAN outgoing port 25 traffic.

• 2. Give sysadmins the ability to change e-mail setting for all users when a large-scale outbreak is going, to specifically turn off scripting, html reading, java, etc

But there's always a large scale outbreak going on! Or rather, there's a large scale outbreak going on over there, but that's OK, because your systems are perfectly clean... right up to the point where they're not.

I do take your point though. Last time we got a dose of Code Red and Nimda, the office sysadmins pulled the network cables and isolated every office from each other and from the 'net, and kept us down for two days, while they cleaned and labelled every machine by hand. It would be nice if they had somewhere to go before reaching that stage. ;-)

Re:What can Microsoft do?

[thrig]

10. Done. New versions of Outlook by default disable scripting.

And this new version is a free upgrade to all users running previous versions? Is Microsoft going to get on TV and beg users to upgrade for the sake of the Internet?

9. Windows XP automatically downloads security patches. This functionality should be extended to universally cover Office and other products as well.

XP sounds like something users have to pay for. What would happen to someone in the middle ages who built a castle with three walls, then came back for more money for a castle with four walls?

8. Done. New versions of Outlook by default will warn a user if an external app is trying to use it to send email, and further warn if it's being used rapidly.

See #10, above.

7. Pretty much done with WinXP. There are a few settings relating to domain authentication that can be strengthened by default. I think they are not because it would cause connectivity issues with older NT domains.

See #9, above.

6. That would be virus protection and step on third parties like Norton and McAfee.

My unix machines only need anti-virus software to protect the odd Windows client, or to reduce DoS attacks by Windows clients. Why does the existence of Windows outside my organization mandate the additional cost of anti-virus software?

5. That's not Microsoft's responsibility.

Sure, but I would love to see higher insurance rate for people running Microsoft software, until it can be proven otherwise that Microsoft has fixed the historic flaws in their products.

4, 3

See #6, above.

2. Done. This is part of the Active Directory integration.

That sounds like something you have to pay for. What about older systems, or independent systems run at an ISP or educational institute that do not have the money or resources to setup such an administrative layer?

1. Process auditing has been part of NT since the very beginning. What you want is reporting on that, and I don't think you fully appreciate just how big of a task this would be. This functionality is really only useful in more secure DoD installations because of the scope.

This is true. Far better to spend time fixing the historic flaws of Microsoft products in the first place.

Re:What can Microsoft do?

[iabervon]

Back in the old days, the reason that the Good Times virus was obviously a hoax was that email was data, and was never treated like code (unless the user went to the trouble of extracting something from the message and then running it, at which point it was an issue of downloading programs from the net, not a virus).

The same used to be true of spreadsheets and word processor documents: you couldn't get a virus in them because they didn't include code. If there were macros, they lived on your computer, separate from your document, and you used them to generate an inert document, which you could then distribute.

I think MicroSoft should go back to passive documents in general, with active documents (and programs) available only when you explicitly extract them from the passive document, and then run them outside of your viewer.

Re:What can Microsoft do?

[sheldon]

Interesting. I'm curious why you think everything should be free.

BTW the unix/windows thing is an apples to oranges comparison. The issues here have nothing to do with the OS but rather the usage patterns.

Re:What can Microsoft do?

[sheldon]

"And what happens when someone figures out how to hack Windows Update, sending out a virus to thousands upon thousands of machines?"

If the updates are digitally signed, wouldn't the hacker need the RSA private key? How would they go about obtaining that?

If they had access to that, as well as easy access to the site, then you have an internal leak within the company. At this point it's not a technical security problem, but one of physical and administrative access.

"Oh yes it is. There is so much wasted time and resources out there because of Microsoft. They must be held responsible for it. Pleading ignorance is not a defense."

It's always easy to sit and take pot shots when you are ignorant of the circumstances.

Re:What can Microsoft do?

[pmz]

10. Done. (I use Emacs)
9. Not on my watch. (I'm the only thing installing software on my workstation)
8. Not needed. (I use Emacs)
7. Done. (well-configured Solaris and/or OpenBSD)
6. Not on my watch. (Nothing leaves my site.)
5. Not needed. (No M$ software, here)
4. Not needed. (see #5)
3. Not needed. (see #8)
2. Not needed. (see #8)
1. Can do. (see #7)

Re:What can Microsoft do?

[sheldon]

The product we are talking about isn't really defective. It works exactly as designed and advertised, but now you want additional new functionality like auto-downloading of patches and so forth.

The alternative I suppose is to pay much more for software up front so you get free upgrades for life. The point is you need to get beyond the "everything should be free to me" mentality.

Re:What can Microsoft do?

[Tony-A]

doesn't make good sense to me
Hehe. (It's not for the benefit of the victims)
Being required to turn on a broad-spectrum vulnerability (to everything unknown, one of which will eventually be pretty bad)
in order to fix another vulnerability (to something relatively harmless)

It's INNOVATION. Making the Internet Explorer gizmos (ie virus/worm writers paradise) an integral part of the Operating System.
Backup early. Backup often. Get your important stuff out of reach of whatever WILL be run without your knowledge or consent.

Re:What can Microsoft do?

[Tony-A]

One exploit, one place wouldn't do it.
If the updates are digitally signed, the hacker needs an RSA private key that the software thinks it should trust. Doesn't have to be Microsoft's. If you have a worm that propagates and manages to stay under the radar screens, ...
It's easy to take pot shots, agreed. What "circumstances" am I ignorant of?

Re:What can Microsoft do?

[Reziac]

Omighod, you're right! IE is a virus! :)

Funny how timely this is.. look up some of my other posts where I rant about a forcible infection with IE5.5, which I finally got completely cured yesterday. As my punishment for this heresy, today my WinXP system (another box entirely) won't boot, the HD apparently having taken a crap.

Good gods, it's contagious even across an air gap! :)

Re:What can Microsoft do?

[Tony-A]

Dunno if it would still work on XP, but you can boot NT from floppy.
Needs to be formatted under NT.
Needs BOOT.INI NTDETECT.COM and NTLDR.
Seems like it was SOP on early NT systems when NTFS would clobber the above files.
Probably more like a cancer than a virus. Viruses are small, tight,and well organized.

Re:What can Microsoft do?

[Reziac]

System (all FAT32) boots fine from a floppy. On a HD boot, if I harangue F8 enough times, I eventually get XP's boot menu, and it will start in DOS (the WinME boot has been forced to start in pure DOS). I can get the recovery console to run if I boot from the XP CD. But neither XP nor ME will run from the HD. Seems the HD is having random read errors even in DOS, and that just happens to hit several critical boot files. (I hooked up a different HD that has XP installed for this machine, and it ran fine, so it's not some other hardware problem.) Oh well, the HD is under warranty. But what a nuisance.

BTW where the heck DID they hide "make recovery boot floppy" in XP?

The Klez Worm's Little Friend

[muerte24]

I have psuedo-responsibility for our tiny network of about 15 computers. So some jackass has to use Outlook to sync his email with his expensive handheld, and he gets nailed by Klez.

So Klez works even by simply previewing the message and launches itself. It has its own mail sending engine, and forges the From: field to look like it's real. It also copies past Subject: fields to fool the recipient.

But this time, our little friend Klez has brought his little friend Elkern32. This nasty little guy infects executables on the infected computer, and is also network aware and infects files across the network. So even people who didn't use Outlook were infected. Some people had hundreds of infected programs on their computer.

And a cool thing about Elkern is that it can randomly overwrite a files bytes with all zeroes, while maintaining the file length. It can be nasty.

All this because no one updates their virus definitions.

Muerte

ugh

[AnimeFreak]

Why doesn't Microsoft, by default, disable scripting and in Outlook? This is where Outlook is weak at and where the root of all it's problems come from.

Otherwise, more viruses will just keep coming and coming.

Require PKC!

[eddy]

Just because YOU don't want it doesn't mean it's not useful.

You don't have to remove the functionality; just make it REQUIRE the script to be CRYPTOGRAPHICALLY SIGNED by a known entity, like the sysadmin.

Fucking simple solution, unless you wanna argue that clients should execute code from UNKNOWN and UNTRUSTED sources for some reason?

Re:Require PKC!

[4of12]

just make it REQUIRE the script to be CRYPTOGRAPHICALLY SIGNED by a known entity

Not enough, methinks.

Imagine Grandma getting an automatic pop-up warning from an email she got from spamzrus.org:

"Warning!

"You have received a digitally signed script from someone who is not a registered and authorized MS Passport Service Provider.

"Do you wish to authorize "Microsoftt [sic] Universal Products, Incorporated" as a Bronze Grade local script provider for you?"

(to the sounds of Dixie...) Click away, click away, click away.

Strong Bad Sucks!

[toupsie]

Come on! Only a lame farker would think Strong Bad was funny.

Wrist hurts?

[Gannoc]

My wrist hurts from deleting over a meg of mail worm viruses a day.

Your wrist hurts? As in... you're using a mouse to delete mail? You use a GRAPHICAL email program???!!!

Oh. Oh Commander Taco. We thought you were so elite... (weep)

In a related note, a _meg_ a day? Who are all these losers that have CmdrTaco's email address stored in their outlook address book? When I sent email to slashdot, I telnet to the SMTP server directly and type it out, just so I can mock all the lusers who have to use pine.

MC Gates?

[Glytch]

Can't patch this! (stupid repetitive music) Can't patch this!

Likely Excuse

[SubtleNuance]

My wrist hurts from deleting over a meg of mail worm viruses a day

Yes, Taco, it is from handling your mouse that has caused your wrist trouble..

Yeah, sure.

Suggestions?

[Kozz]

I'm not a server admin by trade, so I don't get involved with mail server administration duties all too often. Can someone suggest some links to mail-server based AV software for Sendmail, Qmail, others?

I often end up providing "tech support" to those who know I'm a "computer guy". None of their hosts use server-based AV software, but I'd like to send them some links.

For as long as

[jhines]

For as long as people keep insisting that sending spam doesn't hurt anyone cause they can just hit the delete key.

Patch for Outlook

[mgblst]

A patch to fix all of Outlook Security problems can be downloaded here

Sircam / Klez == Security wakeup call for idiots

[SomethingOrOther]

No I'm not trolling, but sometimes I wonder if the writers of Klez / Sircam et.al, were infact white-hats trying to show the average MS user to take security seriously and patch there machine!
Yeah, every office worker knows something about this "security thing" and how the boss said they shouldn't write there passwords down. But only when they start getting mailed other peoples confidential info will they sit up, take notice and patch, or so you would think! Maybe it backfired a bit.

Incidently, try setting your gnutella client to look for .doc .xls and other MS extentions. The number of idiots who have misconfigured there clients (installed on work machines) to share there entire hard drive is worrying. Wake Up!

Did someone think of it, or did it just happen.

[mindstrm]

I say this because it isn't the first time 2 viruses have bonded together. I recall many moons ago when a couple other viruses got together.
Viruses usually employ a mechanism to detect if a file is already infected, so they don't keep adding to the size of the file. One used a marker at the beginning of the file to decide if it was infected, one at the end. So the first virus infected the file, the second came along (modifying the beginning as per normal virus behavior, and adding it's marker to the end), then the first came along again and saw the file was not infected so infected it again. THen things stayed the same.

So it would show up as containing virus A, but you could not disinfect it properly, because it would just re-infect as soon as it was run. B wouldn't show up because B was actually a layer down.

On a side note.. the #1 thing that has reduced the number of viruses coming out of my office has been to ban the use of outlook/outlook express.

Are you implying..

[mindstrm]

that Eudora is not user friendly or windows based?

We switched the whole company to Eudora for this very reason. It's good, yet somewhat obscure now and virus writers don't target it.

It's also much better at dealing with attachments, and doesn't corrupt mailboxes as often. It's easy to store years worth of mail in eudora.

Eudora.

Netscape communicator's mail client seems popular as well.

Re:And M$ wants to "help" homeland SECURiTY?

[radish]

Weird thing is, I've been using Windows for years, and yet I never got a Windows virus. Maybe the problem is with the users, not just the software? The very few times a virus has even made it as far as my box (my ISP filters my mail) it gets clobbered by my AV.

Generally...

[interiot]

Generally, Outlook is targetted because it's so widely used. So if you use an email client other than Outlook, and which doesn't use some of the same libraries (and thus the same bugs) that Outlook does (eg. using MSIE to display html email), then you'll be safer.

If some other email client becomes popular, then this same argument would apply to that. Although, often a program is popular for a reason, so personal preferences may make this argument moot.

Msft Security Audit

[ch-chuck]

That likely only applies to NEW shipping software - all that old vulnerable stuff out there will need to be 'updated' at something like $85 a pop or more - can you say "80 Billion in the bank" ?

It's always worked before....

Klez got infected by accident?

[oldmacdonald]

This is really cool. From the article:

"As far as (Chernobyl) is concerned, the Klez worm is just another file to infect," Weafer said. "It's quite common to see piggybacking effects when you have worms that have been propagating for a long time in the world."

So it is likely not that someone was trying to make Klez worse, it just happened on its own.

I don't think so...

[stubear]

My wrist hurts from deleting over a meg of mail worm viruses a day.

That wasn't from deleting e-mails, it was from your viewing too much pr0n.

Not too nasty if you have backups

[Colin Smith]

What's more nasty would be viruses which simply modify words and numbers here and there in documents.

Re:Not too nasty if you have backups

[SuiteSisterMary]

Actually, what you'd program it to do is look in your inbox, find something with an attachment, infect said attachment, and send it back. Or look for something with 'fwd:' in the subject, and forward an infected version to everybody. Or go through your 'already sent' list, and resend each one, after infecting it and putting a line like "My mail server seems to be having trouble, so I'm not sure if you got this, so here it is again." at the beginning.

Time to use Intellisync

[GMFTatsujin]

Okay, I may be playing the shill, but I'm not getting paid for it. I don't know if that makes me bad, or worse.

Anyway.

Check out Intellisync by Pumatech. It's a third-party conduit manager for PalmOS and PocketPC platforms, and it can connect just about everything to everything else. The list of Groupware and Email apps it can sync your handheld to is just staggering.

And although it does have to authenticate to the mail server to retrieve email and calendar items and such, the actual email application does not have to be loaded. Nothing gets previewed. It just goes from the server to your handheld. Nice.

Of course, this does mean that if anybody comes up with a PalmOS virus that can run through an email, you're fscked. And syncing to another machine may help spread the virus. However, and least your sync station will be that much more secure. :)

GMFTatsujin

Use this for something good

[pommaq]

Hey, why not put an update for Outlook as payload and spread it around?

Re:Now NOw

[Glytch]

http://freshmeat.net/projects/quarantineattachment /

Enjoy.

traffic

[mach-5]

I wonder if anyone has ever done a study on the amount of net traffic caused by a virus propagating itself. I would think that viruses that can replicate in exponential fashion will end up generating huge amounts of traffic, even if it is only a small text message and executable. To think of all that wasted bandwidth that could be used for important things like pr0n ;-)

viruses

[kz45]

metacell writes "A virus (a version of the Chernobyl virus) infects an email worm executable (the Klez worm), and is spread along with it. " It's a damn good *delete* thing that Microsoft has been *delete* spending the last few weeks doing a *delete* security audit *delete* of all of *delete* ah never mind. My wrist hurts from deleting over a meg of mail worm viruses a day.

Maybe you should tell the people on your contact list to stop opening attachments (or at least get the latest patches). Microsoft is all but Moron proof.

linux machines get hacked into every day. Is it a linux flaw? no...it's a user flaw. So why should Microsoft be nay different? Maybe because they're against open source?

Re:Good alternatives to Outlook

[slamb]

Don't forget: it gets email from a hotmail account. I think there's a script for linux called gotmail that is (well, was a year ago) a kludgy work around to get hotmail into your local mail folders. I know that's the only reason I use OE, and I know a lot of people who like that feature.

There's a JavaMail provider that does the same thing. So any Java mail client will be able to do that as well. Mulberry would, though I don't like Mulberry's user interface.

Incidentally, if you do find a good Java mail client, I'd love to know. I don't use HotMail, but would like a mail client that's cross-platform, developed with a UI I could realistically modify (Swing is easy!), and fundamentally immune to buffer overflows.

Suggestion

[iceT]

Since MS created the breeding ground for these viruses.. maybe we should forward all of our virus-alert messages to microsoft... like billg@microsoft.com, or abuse@microsoft.com

Liability

[pbryan]

I'm telling you, software makers NEED liability. It's the only way we will ever have responsible programs released. Right now, software makers can get away with selling products that have defects in them on the order of ones that if they were in cars, would send Ford or GM into receivership.

I'm concerned that attaching liability to software will send a chill through the software development community, especially the free/open source software projects. Large corporations might have the resources to insure against and pay liability claims. Individuals developing software in their free time certainly do not.

In my opinion, writing software is an exercise in freedom of speech, and deserves the same protections afforded to other forms of speech. If I make my speech available to others, under the condition that they accept responsibility for all damage that may occur as a result of its use, I believe that is reasonable.

A few thoughts...

1. Perhaps the burden of non-EULA-immune liability should only be attached when a piece of software is designed to transport, support or safeguard human life, and has failed to meet specific safety standards. Otherwise, I believe you're opening up a huge can of worms, in the already litigious American culture.

2. Software developers and vendors should have the right to dictate any other terms for licensing their software, including limitation of liability, waiver of warrantee, and "as is" delivery. Users and consumers are free to decline to use any software whose licenses are not acceptable to them.

3. Some free software developers have already stopped releasing their software, citing concerns over liability. Broadcast 2000 is one example I am aware of. This is a concrete example of the chilling effects liability can have on software development.

4. People are free to choose software platforms that are more stable, reliable and less prone to being exploited by viruses and worms. If they persist in using unsecure platforms, and take no steps to protect themselves (e.g. antivirus software), they shouldn't be particularly surprised by the outcome.

5. Those who purposely unleash viruses and worms on the Internet with the intent to do damage should be answering for their actions.

</rant>

Unless it's a Slashdot poster.

[Artifice_Eternity]

Then again, with the grammar and spelling skills on display around here, maybe most /.ers don't count as "native English speakers".

;)

Re:You're missing the BIG ONE

[sheldon]

So basically you are suggesting that Microsoft rewrite Windows such that it only runs software written in .NET.

This would cause 80,000+ applications to cease functioning, the net effect being not a single user would buy this new OS and use it because none of there existing software works.

Microsoft, even with their monopoly, could not force this down users throats.

Your solution is completely unworkable and shows a strong disconnect with reality.

Klez does NOT infect recent versions of IE/Outlook

[Jayde Stargunner]

The auto-preview/run exploit is a PRE IE 5.5 SP2 issue.

That's right. The auto-launching EXE exploit only affects people:
a) Running Outlook Express
b) Running a version of IE before 5.5 SP2.

Considering that IE 5.5 SP2 is VERY old as it is, people who are still using 5.1 or 5.5 initial release haven't bothered updating their software in years--let alone worrying about security patches.

Microsoft can make as many patches as they want, but if people don't install them even given the opportunity of two years, what can you do?

(BTW, I'm not saying that later versions are immune. Just that they won't be auto-infected. All it will do it pop up an Open/Save dialog box at worst...of course, someoen can still run the EXE if they're stupid and get infected.)

-Jayde

Re:You're missing the BIG ONE

[melquiades]

I think that's a pretty strong reading of what I'm suggesting. Quit yer trolling.

I'm not advocating .NET, or any other particular framework. I'm just saying that auto-executed programs should be sandboxed. Let MS figure out the best way to make that happen.

Now it's true that, since Microsoft didn't architect for this from the start, it's going to be pretty hard for them to make the switch now. And it going to be very hard for them to figure out a migration path that doesn't make like difficult for those 80,000 apps. That's why their new commitment to security isn't going to change things overnight.

But these changes do happen. Though it was bumpy and painful road, they managed to get apps to switch from a DOS-based to a Win-based system, and then to the NT architecture. In another five or ten years, they may have actually managed a switch to a secure platform!

Klez not so bad

[commodoresloat]

Sure, deleting these emails is a pain, but it's a lot less time-consuming than giving everyone your advice!

Re:get a mac

[Spencerian]

That means that hackers would have as much success in hacking FreeBSD or other BSDs, or even Linux.

Don't really how often that happens, but it doesn't sound like idiots can hack *nixes very often.

You seem suprised by the stupidity of OL users...

[hndrcks]

When those same people regularly bring things that are proven to be dangerous into their homes and they are often ambivalent or even supportive, to say the least, about products which have been statistically shown to lower life expectancy. They will rise up against the laws requiring safe operation of a product and cry "They are taking my liberties away!" Why should (l)users behave any differently when it comes to software? (And for that matter, is it fair to hold software companies to some higher standard of conduct, when other clearly defective products get special legal protection?)

I agree, the script kiddies and software authors are both culpable - but the idiot users aren't exactly innocent. People use Outlook for the same reason virus writers do - because it's easy, and to hell with the consequences.

Fool me once...

[SomeOtherGuy]

I don't use outlook but my wife does. What I find so amazing is that Microsoft can still let this happen after it has happened so many times before. I know it is easy to procure a patch that will fix this problem....But what about the last patch that I applied the last time an "outlook" scripting bug decided to reak havoc on the rest of her system? Why did not that patch disallow any arbitary executing of scripts or programs just by viewing an email in the preview pane? Did they only patch it good enough so that that the current virus of the day would be stopped --- but leave it open for future virii to get in through the same door....different angle. Why were they not smart enough to notice the symptoms the first 50 or so times and somewhere cure the disease along the way? And yet many (not mine) fortune 500 companies still use this software? What a joke -- these are the same companies that screan applicants backgrounds, and have 50000 processes in place to protect other business interests -- yet continue to use software that is like a ticking timebomb that is going off on a weekly basis.

Re:joke?

[dimator]

I thought those were deleted explitives, that I was mentally putting back in. Makes it pretty funny...

Re:Warning: Ford Explorer Analogy Ahead....

[Pfhreakaz0id]

First, Outlook != Outlook Express. Once again, I will say, I agree, it's a joke that scripting is on by default in Outlook. It doesn't take a brain surgeon to figure that one out. Furthermore, I will say that I don't see ANY reason to have Outlook Express (the POP3 client) to have scripting AT ALL (or at the very least requiring a separate download to install)

Also, I don't write Outlook scripts for a living (although I do have several I've writen myself to clean up my mailbox, etc). But, to say it is a feature no one uses (or should use) is wrong. There are businesses that do large portions of there business on Outlook Forms, just as there are lots of folks who have done custom Notes development, and just as there are firms that have done customized oracle forms/applications/workflow development.

Re:You're missing the BIG ONE

[melquiades]

Clarification:

Simple to identify, but difficult to execute.

I've *NEVER* received an e-mail virus/worm

[Kymermosst]

That's the wonderful thing about having a good ISP, and friends and family who don't use Outlook. (Friends mostly use Linux, family mostly uses Netscape or Hotmail... I'm trying to convert the Hotmail people to something else.)

To date, I have never received an e-mail virus or worm.

Now, back in the day when I did a lot of floppy exchange... well, I saw several virii "in the wild."

This just in...

[gusnz]

...latest research indicate that "Foot and Mouth" disease is the first virus unable to spread via Outlook.

Experts and laymen alike were shocked :).

Now I get it...

[MavEtJu]

Now I get it what microsoft means with "We have created an ecosystem with Windows".

This is pretty cool. Maybe one day the payload of the virus will be the installer of phat-linux :-)

Edwin, not a Linux-fan but thought mentioning the possibility was funny.

Re:You're missing the BIG ONE

[Tony-A]

So basically you are saying that any secure solution to Microsoft software "is completely unworkable and shows a strong disconnect with reality."
You're probably right.

Re:You're missing the BIG ONE

[Tony-A]

You're right about the sandbox, and it's not easy.
Basically, I should be able to run unpatched, buggy, exploitable code with impunity. It doesn't make everything work properly, but it severly curtails the damage possible. I should be able to run the latest Microsft wormage on an unpatched and misconfigured Outlook. It might kill itself, but it should be impossible for it to do anything more than annoy anything else.

Outlook Good? Take out the trash.

[Erris]

h, and Taco, Outlook has filtering built in. It's very easy to use and since I've gotten my rules in place I very rarely get spam or any virii showing up in my inbox, maybe you should look into it ;)

Are you THE famous admin who filtered out all messages with "hi" in the subject line just a while back? So funny how many HIgh fligHIng cHIcagoians HIt tHIs sHIpment HIatus. Oh yeah, my companie's clueless exchange group did this to and deleted all sorts of legitmate email.

Quick, tell me something about IIE that's easier to set up than a debian box or two running exim! Give up? So do I. Point whatever client you want at it! Add a corporate calender and sheduler as a seperate application, ZOIKS, they can work togeter! Amazing but true, nothing but M$ shit works with M$ shit, and it hardly does that while dishing out viruses and worms for the world.

My favorite part of this new plauge is that it is an unintentional combination of ancient virus with slightly modified and fast worm. All those, "brainwash" (M$ spokesman's own word) sessions to waste? So sad, too bad, nothing new, get back to work and get rid of that garbage please.

sounds fucked, all right

[Erris]

Fucking simple solution, unless you wanna argue that clients should execute code from UNKNOWN and UNTRUSTED sources for some reason?

What a total ludite solution. God forbid someone make a reasonable system with permisions and sandbox clients. Well, M$ did not make a reasonable system, better make sure no one runs anything, let alone write a script or compile a program that makes the computer do something you want it to. Outlook runs as what, "sytem" one click less that "Admin"? There is the problem, not the rest of the world. A good analogy is a house with a roof over half the rooms, Don't let anyone go in there without a rubber! Srcreen saver, music player, greetings card web site, what are you smoking man!? Don't share your work, only M$ can program you know. Don't enjoy your computer, it's like stealing from the company.

The simple and obvious solution is to NOT BUY M$ junk. With free software the company is root and really owns the machines. The users are free to do what pleases them, as they and their clients can not trump the company. Those that use M$, smart updater and what not are NOT root. M$ and other third parties own their machines and everything on them. Duh.

Very good free solution

[robinjo]

I've been running E-mail Sanitizer for a few months. It has worked very well. It only tracks the attachments types instead of actually trying to identify viruses. Therefor it even finds most future Outlook-viruses.