Slashdot Mirror
A Central Repository for Virus Information?
four12 asks: "I've been doing more work lately with network security and tightening things up. My new employer has been pretty lax over the years with such things and has come to the realization that their luck has to be wearing thin. I have noticed an dissonance of information between the various virus information sites. McAfee will have a 'prolific' worm listed, but Symantec and Trend say nothing about it and vice versa. It makes me wonder first of all, is my anti-virus system catching things as fast as the other systems? Is there a place that I can go that digests the latest threats and information down in to a nice, clean webpage? I already have too many listserv subscriptions and don't want to wade through a dozen webpages trying to correlate what is out there."
They seem to have a lot of the current advisories and stuff here.
C:\>
I hope you don't work for a petroleum company - I hear that DaVinci virus is pretty nasty!
I thought slashdot didnt allow posts authored by people who cannot use english correctly.
It seems to me that we are getting close to the inflection point for Outlook, where it's benefits are too adversely affected by it's security record. Following bugtraq, we are now at the point where even plaintext messages can trigger javascript. Absurd.
EFF, EPIC, CDT, ACLU and Free Congress have drafted a bill that's been introduced by Senator Wyden today, for a new law called "The Citizens' Protection in Federal Databases Act." This is a hell of a law. It finds that various species of spooks are making avid use of commercial and governmental databases, merging them and aggregating them, without transparency, accountability, or any real understanding of the danger to civil liberties involved in this practice. Accordingly, it requires any Fed agency using non-Fed databases to cut it out and make a full report to Congress on who they're buying database and database-services from, what they're doing to preserve privacy, why they're doing what they're doing, and whether they actually have a realistic chance of catching any bad guys. And it calls into account Feds who abuse their authority and limits the kind of doomsday hypotheticals that can be used to justify such abuse.
We've spent the two years since September 11th writing blank checks to anyone who's got a good story about preventing terrorism through the wholesale abridgement of civil liberties, trading off freedom for the perception of safety. It's time that we called our civil servants to account on these scores -- they've spent our money and our freedom, what did we get in return?
Each report shall include -
(A) a list of all contracts, memoranda of understanding, or other agreements entered into by the department or agency, or any other national security, intelligence, or law enforcement element under the jurisdiction of the department or agency for the use of, access to, or analysis of databases that were obtained from or remain under the control of a non-Federal entity, or that contain information that was acquired initially by another department or agency of the Federal Government for purposes other than national security, intelligence, or law enforcement;
(B) the duration and dollar amount of such contracts;
(C) the types of data contained in the databases referred to in subparagraph (A);
(D) the purposes for which such databases are used, analyzed, or accessed;
(E) the extent to which such databases are used, analyzed, or accessed;
(F) the extent to which information from such databases is retained by the department or agency, or any national security, intelligence, or law enforcement element under the jurisdiction of the department or agency, including how long the information is retained and for what purpose;
(G) a thorough description, in unclassified form, of any methodologies being used or developed by the department or agency, or any intelligence or law enforcement element under the jurisdiction of the department or agency, to search, access, or analyze such databases;
(H) an assessment of the likely efficacy of such methodologies in identifying or locating criminals, terrorists, or terrorist groups, and in providing practically valuable predictive assessments of the plans, intentions, or capabilities of criminals, terrorists, or terrorist groups;
The antivirus vendors can only release their updated file - AFTER the virus has started to spread, the receive a copy and patch and test. This could take *DAYS*.
Some people think that a properly created worm/virus could spread over the entire available host populations in under 15 min from release.
More Info Worhal Virus
Add atachement mangeling, removal, and remove vunerable email client for example; Outlook with with it's own exploits and it's embeded HTML (Explorer) with it's own list of exploits are unacceptable for a networked computing environment.
Moneyed corporations, non-working 'poor' and criminal prisoners are turning productive citizens into tax-slaves.
Almost all the virus problems are Windows-based, and a large majority of the problems occur after Microsoft has released patches. Hence, any comprehensive security plan should include some method of insuring that all critical security updates are applied throughout the company.
Beyond that, it's a race between Microsoft patching bugs and the anti-virus companies detecting the exploits.
If you're getting into the security ballgame you may wind up looking at various sources as a matter of fact. Going with the multi-layered defense, I routinely go to two anti virus sites, one RAT/Trojan site, and a hoax site [www.vmyths.com]. We also block any executable at the gateway, that cuts the majority of your problem there [none of our users need those kinds of files].
-- Some days you're the dog; some days you're the hydrant.
I mean, thats where i get all my viri from.
All Troll + "offtopic" mods are meta moderated as "Unfair", because you abused the system.
http://www.ciac.org/ciac/
Pretty comprehensive across platforms, OSs, viruses, hoaxes, buffer overflows...
Best of all, they're not trying to sell you something.
I am not your blowing wind, I am the lightning.
It makes me wonder first of all, is my anti-virus system catching things as fast as the other systems? Is there a place that I can go that digests the latest threats and information down in to a nice, clean webpage?
Nope and Nope
Humor, moderators, Humor.. okay some truth too.
TruSecure IntelliShield is one such service, but it is not free. It pulls together information about a vulnerability from various vendors, mailing lists, and such, and puts it all under one issue. It also has alerts and a shared task list for managing your organization's response to a vulnerability. The alerts can be useful given the fast-spreading nature of recent worms. The task list is less useful since organizations large enough to benefit from it probably have something similar internally.
I have no affiliation with TruSecure, yadda yadda yadda, I just previewed their service for a former employer.
Although M$ Outlook is commonly mistaken for a mail client, it is acually a distributed P2P virus database which is brilliantly designed to uniformly distribute samples of each possible new virus as rapidly and uniformly as possible. Another fine example of M$ Innovation!
Ethically ironic isn't it:
/. are banner ads for MS product!
./ forgot too, eh?
- MS's poorly designed and implemented product is the primary cause we have a virus problem (80,000 + viruses at last count);
- first thing I see when I log onto
Doh, I forgot: Raking in cash is better than taking the high ground and considering one'
s actions and behavior in the context of ethical social behavior.
Guess
Everything in the Universe sucks: It's the law!
They recommend using a conventional anti-virus solution to catch the 2% of viruses coming into your establishment on portable media, but they'll keep your mail pretty damn clean.
I don't work for them (my partner used to work for part of the same outfit), but I have been an end user of their solution. Good stuff, and they do anti-spam as well...
Matt...
Save the Bottom Line
When I went to speak to Sophos at a show, they actually took me to Sybari's stand :)
I'm sure that there's at least one in Iraq. Just we couldn't find it yet.