Nasty New Virus Variants

Simple... by Anonymous Coward · 2004-03-21 15:51 · Score: 4, Insightful

Don't use Microsoft products... or use them and have an up-to-date modern Anti Virus scanner.

Re:Simple... by BigHungryJoe · 2004-03-21 15:59 · Score: 5, Informative

AntiVir might be a good, free choice.

I has served me well. Catches a lot of the spyware that my favorite pr0n sites try to push me, too.
Re:Simple... by LooseChanj · 2004-03-21 18:42 · Score: 4, Funny

There's only one sensible place for pr0n: usenet.

--
Mix the failings of Usenet with the shortcomings of the World Wide Web and the result is slashdot.
Re:Simple... by GMC-jimmy · 2004-03-21 21:20 · Score: 4, Informative

Apparently, the simple act of selecting the message activates the code. Given that you have to select an E-mail to delete it, how are users supposed to protect themselves from this one?

This has ALWAYS been the case when it comes to Outlook and Outlook Express. The Preview will execute the code contained within the mail message in exactly the same way as if you had opened it. It has been this way for a few years. This is what Valve's Half-Life 2 Lead programmer claims happened that lead to the leaked source code for HL2.

--
__________________________________
Free your mind - Flush your toilet
Re:Simple... by Sarin · 2004-03-21 21:53 · Score: 4, Insightful

not a bad idea.

After the latest infection on my parents' computer, though mcaffee was installed and auto-updating and eudora, I decided to choose for the first.
I wiped microsoft from the computer and installed gentoo with kde, firefox and sylpheed-claws and I made it autologin into their kde account.

My parents have never been happier with their computer: 'internet is so much faster now' and 'hey that solitaire game is much more fun' and 'that thing allows you to have multiple virtual screens', it even looks better now and I told them they could click on any email virus they wanted.
Re:Simple... by Perseid · 2004-03-21 22:06 · Score: 5, Insightful

People have a tendency to forget that the evil-nasty viruses come out BEFORE the virus-scan developers have a chance to add it to their software. It is very possible to have the newest AV updates and get hit by a virus.

People who hide behind virus scanners as if they solve all of the world's problems are part of the problem themselves.
Re:Simple... by mosschops · 2004-03-21 23:18 · Score: 5, Informative

Don't use Microsoft products... or use them and have an up-to-date modern Anti Virus scanner.

Don't forget that the Witty is entirely memory resident so most (if not all) virus scanners will miss it...
Re:Simple... by dustmite · 2004-03-22 01:02 · Score: 5, Insightful

Yes, it's actually impossible to be protected against the 'latest virus that just came out', because it's impossible that your AV vendor has protection against a brand new immediately (unless the AV vendor wrote it themselves). There always must be a "window" between time of discovery of a new virus and the time that your AV is updated to protect against it during which you are vulnerable, and this is typically anything from a few hours to a few days.
But just try to explain this logic to the damn "if you run an AV and keep your definitions up to date you'll have no problems" crowd ..
Re:Simple... by Weekly+IT · 2004-03-22 01:14 · Score: 4, Insightful

I told them they could click on any email virus they wanted
Maybe its just me here, but I think that might be a very dangerous way to think about viruses. Sure there aren't that many viruses know to affect Linux boxes, but one nasty one, possibly written by a Windows geek who's fed up with your kind of thinking, could do a lot of damage. Combined with the simplistic idea that "I have linux, no virus can touch me" and the growing popularity of Linux, I see a growing potential for harm.
Re:Simple... by AndroidCat · 2004-03-22 01:23 · Score: 5, Informative

And that's why I've always had the Preview pain switched off. And switched on View as Plain Text as soon as it was available. And use CTRL-F3 to view the "source" of email from people I don't know. If you have to use MS products, you've got to be on your toes because they are out to get you!

--
One line blog. I hear that they're called Twitters now.
Re:Simple... by LurkerXXX · 2004-03-22 02:05 · Score: 4, Insightful

And if you don't run your Windows machine as Admin, and you do backups of it, your in the same shape.
The problem is most windows users do run as admin (That's the way it came from the store. They'd run it as 'root' as installed if they had a Linux box. They just don't know better). Most also don't do backups, which is the critical part. Most machines bought these days come with a 'restore' CD that can have the system back to original shape in a hour or two, but the critical thing, the users data is still gone. It doesn't matter if you are on *nix or windows, their is usually a lot more time/value lost in losing the user space files than in simply reinstalling the OS/apps. *nix viruses will do just about as much damage if the user runs something they shouldn't.
It's not an OS thing, it's a user education thing.
Re:Simple... by SillyNickName4me · 2004-03-22 02:37 · Score: 3, Insightful

And the problem is that those products are really aimed at non technical people. How are they supposed to know or understand?
Re:Simple... by doublem · 2004-03-22 03:01 · Score: 4, Insightful

The problem is, running as anything other than admin isn't always an option because of poorly written applications.

Case in point: Omnipage.

We have an older version of Omnipage. I forget the logic behind not upgrading, but we'll leave that as an aside.

If you run as anything other than an Administrator, the application appears to freeze at startup. What's really happening is that the splash image is concealing an error message. You have to know the windows shortcut keys necessary to either move the error message until it's visible or just hit the "YES." Once loaded it's still a mess, and can't open any files.

Long story short, in order to be able to use a software package that has become critical to our business process, we have to have a bunch of users running as the administrators on their local machines. W2K "Run As" doesn't cut it, as the problems still occur.

--
"Live Free or Die." Don't like it? Then keep out of the USA
Re:Simple... by doublem · 2004-03-22 03:58 · Score: 3, Funny

AMEN!!

Having users run as root / administrator all the time is a major issue for any OS, and our admin spends a good portion of his time fixing issues that ultimately stem from a dumb user doing something stupid.

My favorite:

We had a user, we'll call her T.

T called out admin three or four times a day. Every time a dialog box came up she would call for help. This included calls every time IE couldn't find a web site. Finally he told her to stop calling for minor problems, and not to call for trivial issues anymore.

The first dialog she ignores is the Norton Antivirus error message telling her that she's opening an infected attachment.

And thus a new virus hits our network.

--
"Live Free or Die." Don't like it? Then keep out of the USA
Re:Simple... by subtropolis · 2004-03-22 04:09 · Score: 5, Funny

And that's why I've always had the Preview pain switched off.

That's such an apt mis-spelling.

--
"Our interests are to see if we can't scale it up to something more exciting," he said.
Re:Simple... by cloudmaster · 2004-03-22 04:27 · Score: 3, Insightful

If you're gonna put that much effort into it, wouldn't it make more sense to put some effort into installing a different email client? :)

protecting from viruses by bendsley · 2004-03-21 15:51 · Score: 4, Interesting

the ISPs need to have some server-side virus scan running. we do through our company's email server, and so far, it seems to work like a champ

--
Alcohol & calculus don't mix. Never drink & derive.

Re:protecting from viruses by prat393 · 2004-03-21 16:01 · Score: 3, Insightful

Many of them DO... but these variants have been coming out so often lately that they're hard to catch up with.
Re:protecting from viruses by Dominic_Mazzoni · 2004-03-21 16:15 · Score: 5, Informative

the ISPs need to have some server-side virus scan running. we do through our company's email server, and so far, it seems to work like a champ

This is so true...unlike spam, it's quite possible to detect 100% of known viruses with no false positives. That's because every virus must contain essentially the same payload. Viruses simply can't vary their content as much as spam can, because it has to result in executable code, plus some MIME trick or IE/Outlook exploit, either of which have no legitimate use and could be detected easily.

I started running ClamAV on my mail server a couple of weeks ago (after seeing a recommendation for it on Slashdot) and since then I have seen my viruses go down from 500 a day to 1 a week. I manually looked through thousands of the held messages and found no false positives, so now anything that ClamAV scans goes directly to /dev/null.

I have no idea why all ISPs don't use ClamAV! Obviously they don't need to throw messages away, just in case - advanced users might prefer that messages probably containing viruses just be quarantined instead - but that would eliminate the problem for most people.
Re:protecting from viruses by FalconZero · 2004-03-21 16:22 · Score: 5, Informative

My company outsources email virus protection to a dedicated service (Star Internet) which checks and forwards.
Its pretty cheap, and I've not had to worry about any email virii for years.
I'd (personally) like to see more companies (or even ISPs) going this sort of route as not only does it take the hassle away from sysadmins
(so you don't have to drive in at X in the morning to apply a patch), but it consequently helps reduce the rate of spread.

--
Windows in 6 Bytes (IA-32) : 90 90 90 90 CD 19
Re:protecting from viruses by BigHungryJoe · 2004-03-21 16:24 · Score: 3, Informative

The first time my ISP has a false positive and blocks a legitimate email, I'm going to be pissed.

This is probably why they don't do it - they can't risk false positives.

-BHJ
Re:protecting from viruses by cs · 2004-03-21 16:24 · Score: 4, Insightful

And ISP filtering can readily be a PITA depending on the lists you read. Example: I'm on several Yahoo lists. Naturally the odd virus (or virus-looking) email gets onto one of the lists and (apparently) my ISP bounces it (even though I've got "no filtering please" chosen with them). Anyway, the bounce is an SMTP 553 bounce. Yahoo considers this a "hard" bounce (which it is) and TURNS OFF ALL MY YAHOO DELIVERY. Very very very annoying.
Now, one side of this is that SMTP needs (and lacks) a "this particular message will always be refused" error code. That would work well for virus filters, since the delivering system (eg Yahoo) could them just discard that message and continue with everything else.
The real fix is not to use these buggy mail clients. Like M$ LookOut!
And, though it's not applicable to the outright-buffer-overflow viruses like this one, not to use systems with the vile design flaw of letting users click on attachments and execute stuff. For example, my mutt mail reader has a mailcap that drives its attachment handling. Every clause runs a viewer. If I get a .exe I get told its size or offered an opportunity to save it to disc. It does not offer or try to run it. This core distinction is the weakness in the windows mail world: no attachment should have executable power. An explicit user driven install ritual should be needed to get such a thing into a context where it can be run. i.e. it should be a safe action for a user to double click any attachment - that act should always invoke a viewer of some kind.

--
Cameron Simpson, DoD#743 cs@cskk.id.au http://www.cskk.ezoshosting.com/cs/
Re:protecting from viruses by afidel · 2004-03-21 16:27 · Score: 4, Insightful

Just strip all executable attachments. We do this and haven't had a single virus hit our network since implementing this simple step. Of course some worms have been distributing themselves inside of zips but that still takes more steps and hence more chances for the user to think about what they are doing, plus MS email clients can't auto-execute them (most people run Groupwise client on the Citrix farm but some do run Outlook via POP).

--
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
Re:protecting from viruses by badriram · 2004-03-21 16:43 · Score: 5, Informative

Except these worms now are not in attachments, they are part of the email message itself. It uses an activex vulnerability amoung others to attack the computer.

If people patched their computers, the virus would not have an effect on the computer. Atleast not this one.
Re:protecting from viruses by LostCluster · 2004-03-21 16:48 · Score: 5, Informative

Just what is an executable attachment these days? It used to be possible to say that Word files could never carry a virus, but ever since the Word Macro engine grew up into a full power Visual Basic for Applications that's not so true anymore.

It used to be possible to say an e-mail with no attachments was safe, but today's virus of the day is proving that wrong... just using an IE bug in an HTML e-mail is enough to cause trouble.

So, really... nothing's safe. I'm sure somebody will find a buffer exploit for plaintext mail in Outlook someday...
Re:protecting from viruses by Ironica · 2004-03-21 16:50 · Score: 5, Informative

I have no idea why all ISPs don't use ClamAV! Obviously they don't need to throw messages away, just in case - advanced users might prefer that messages probably containing viruses just be quarantined instead - but that would eliminate the problem for most people.

My school's mail server, after getting slammed very hard by er... one of them a couple months ago (I can no longer keep up with which virus is which), installed something that I think is called Vscan. What it does is sends you an email which informs you that you were sent a message with a virus attached, and gives you a link with a generated username (usually the "from" email address) and password to view the message... if you really want to.

I like this system, because it's soooo much easier to filter those messages as Junk than all the random stuff that might be thrown together by a virus ;-) and, if for some reason you get a *real* email that happens to have a virus attached, you can still read it just fine. Remember, back in the old days, when viruses were first learning to use email, and they'd just attach themselves to whatever outgoing messages you'd send? I'll bet there's one or two of those still floating around...

--
Don't you wish your girlfriend was a geek like me?
Re:protecting from viruses by jrockway · 2004-03-21 17:08 · Score: 4, Informative

The newer viruses send an encrypted zip file and a password. The user has to save the zip file, unzip the file, type in the password (!!!), and then execute the extracted executable. And there are STILL millions of infected boxen!!!

Obviously the mail client is not the problem. The user is :(

(And if you're wondering why the virus is encrypted, it's so it passes through filters. Encrypting with a random password has the nice side effect of randomizing the data. So there are no known strings to filter on. Pretty clever.)

--
My other car is first.
Re:protecting from viruses by CyberKnet · 2004-03-21 17:28 · Score: 3, Funny

There's something just a little ironic about calling "Visual Basic for Applications" full power =)

It's astonishing that you can do anything useful in it, let alone write a virus in it.

--
Video meliora proboque deteriora sequor - Ovidius
Re:protecting from viruses by Dun+Malg · 2004-03-21 17:46 · Score: 4, Funny

There's something just a little ironic about calling "Visual Basic for Applications" full power =) It's astonishing that you can do anything useful in it, let alone write a virus in it.
Perhaps it's really only "full power" in the sense that it's given the power to clobber your stuff. To me it brings to mind a visual of a child being handed a flamethrower. Sure, he can use it, but shouldn't such things be restricted to adults?

--
If a job's not worth doing, it's not worth doing right.
Re:protecting from viruses by LostCluster · 2004-03-21 18:00 · Score: 5, Informative

The strength of VB is really in the fact that it really makes using ActiveX to boss around other programs very easy, and also the ability to make system-level DLL calls. VBA adds the extra damage of being able to hide code in a file format that some people might not expect to be executable.

VBA doesn't actually have anything much missing from the VB6 command set. The only thing it's really missing is the ability to make compiled executables, that VBA programs can only be embeded in certain MS filetypes. It's a much bigger power tool than most people expect...
Re:protecting from viruses by repetty · 2004-03-21 18:37 · Score: 4, Funny

"Remember, back in the old days, when viruses were first learning to use email, and they'd just attach themselves to whatever outgoing messages you'd send?"

No, I don't really remember those days. I used a Mac.

--Richard
Re:protecting from viruses by Afrosheen · 2004-03-21 18:37 · Score: 4, Funny

That's great there. You endorse a product which is broken on your box.

I got some nice swamp land in Florida for you if you're interested.
Re:protecting from viruses by runderwo · 2004-03-21 18:37 · Score: 5, Informative

I manually looked through thousands of the held messages and found no false positives, so now anything that ClamAV scans goes directly to /dev/null.
Be careful. You might lose some messages you actually want, if anything ClamAV scans goes directly to /dev/null.
Joking aside, be careful that you check the exact exit code that you need to determine whether ClamAV found a virus or not. I was using a script called clamfilter.pl that someone else wrote. Since I was in a hurry, I went ahead and stuck it in my procmailrc without checking into it much. It seemed to work for quite a while. When one of the MS virus storms hit, I started sending all the viruses to /dev/null like you are. This turned out to be a mistake.
At some later point, we had a hard drive disaster that left most of /usr unreadable. However, the mail server was still running, and still using clamav to filter mail. Due to one of clamav's files becoming unreadable, clamav started exiting with a nonzero exit code, but not because it was finding a virus in the mail. Hence ALL mail went to /dev/null for a few days while the system was being rebuilt, and we didn't discover it until afterwards. I filed a bug with the clamfilter forum, but up till now the author hasn't fixed his (IMO dangerous) code that he is offering for general use.
The moral of the story is, if you are sending mail to /dev/null in ANY case, be damn sure that you are properly checking clamscan's exit code.

--
LRC, the best-read libertarian site on the web
Re:protecting from viruses by slamb · 2004-03-21 18:42 · Score: 5, Interesting
The first time my ISP has a false positive and blocks a legitimate email, I'm going to be pissed. This is probably why they don't do it - they can't risk false positives.
False positives aren't that bad if you handle them well. The trick is to never silently discard an email. It's much better to send a friendly error message like:
- "Appears to be W32/Sobig virus. If this is a legitimate message, please change the subject line and resend." (They can easily do so.)
- "Attachment name "$1" ends with ".$2", which I've disallowed because of worms filling the mail queues. Please arrange an alternate way to send this file." (If nothing else, they can send an email saying 'tried to send you a ZIP file; it didn't work' and I can temporarily relax the rule.)
I do this with a 5xx rejection during the SMTP session. So what happens is:
- if their client connects directly to my mailserver, they get an error message before the compose window has even gone away. They can make the necessary changes and resend easily.
- if their client connects indirectly, the other mailserver will generate a bounce from this message. The sender will get their original as an attachment, so they can modify it even if they don't keep sent messages.
- if a virus or worm connects directly (the most common case), it receives an error message and gives up. No bounce is sent to the owner of the "From" address. That's good because the address is forged; said owner has nothing to do with the infected machine. No point in filling their mailbox with bounces.
- if the virus connects indirectly, the owner of the "From" address does get a bounce. Undesirable but not devastating. This seems to happen rarely. Maybe only when there's a transparent SMTP proxy along the way or something.
Re:protecting from viruses by Afrosheen · 2004-03-21 18:58 · Score: 4, Funny

It'll become a word if people keep using it enough.

Virii virii virii!
Re:protecting from viruses by Isomer · 2004-03-21 18:58 · Score: 3, Interesting

One idea I've had is to hold anything that has an attachment that starts with the letters "MZ" (which are the "magic" for .EXE files) for 24 hours, then rerun the virus scanner over them. 24 hours is more than enough time for virus checkers to be updated and the virus hopefully will be dropped then. People who are legitimately (?!) sending executables around in email, just get a 24h delay.
Re:protecting from viruses by boaworm · 2004-03-21 19:11 · Score: 3, Interesting

.zip is vicious too. I've seen several copies of a virus that tries to look like its being sent from the staff of your domain, and says that you have to unlock your email account because of abuse. The instructions are in a .zip archive and the mail provides you with a password to "unlock" the archive.

Dont have any spare copies of the virus to cut'n'paste for you, but, beware of .zip to.

--
Probable impossibilities are to be preferred to improbable possibilities.
Aristotele
Re:protecting from viruses by tverbeek · 2004-03-22 01:22 · Score: 3, Interesting

Eliminating all ".zip" attachments, and also ".dll", ".exe", ".scr", ".pif", ".com", and ".bat" seems to do the trick.
If your local Powers That Be won't allow you to take this (IMHO sensible) precaution, you can still provide a measure of id10t-proofing by mangling the extensions of these attachments. For example, this procmail script will rename an attachment from PATCH.EXE to PATCH.DEFANGED-EXE, requiring the recipient to save the file (giving the anti-virus software a chance to check it) and rename it before executing it.
My policy (before I got laid off and ended up in a non-policy-setting job elsewhere) was to simply not deliver messages containing SCR/PIF/COM/BAT/DLL, on the grounds that these are never legitimate attachments. (For a while I delivered the message but stripped the file; after several months with no false positives, I just stopped delivering them altogether.) For EXE/DOC/ZIP attachments (which were occasionally legit) I'd mangle the filename.

--
http://alternatives.rzero.com/

Switch!!! by Anonymous Coward · 2004-03-21 15:51 · Score: 4, Insightful

Given that you have to select an E-mail to delete it, how are users supposed to protect themselves from this one?

Well, this one is gonna start a whole slew of flaming and trolling over the virtues of one platform over another as it is kinda a loaded question with a simple answer:

Switch

So let's start right off with a big razz towards Windows users from both the Linux and Macintosh communities.........

Thhhbibibibibbbpt!!!

Seriously though, when are you guys gonna get the picture? Microsoft if chasing a moving target here and they will always be behind the curve, reacting to the latest virus outbreak until they fix what is fundamentally wrong with the Windows architecture. Hopefully this will happen with Longhorn in 2006......or 2007.........or whenever.

Re:Switch!!! by NemesisEnforcer · 2004-03-21 16:14 · Score: 4, Insightful

Your solution is to switch to an entirely new OS because their "default" email program is poop?

How about all the windows users check out Mozilla Thunderbird. You can keep your nice, friendly OS, and still not have to worry about insanely sad security. http://www.mozilla.org

However, if you're feeling a tad adventurous, then by all means check out the alternative OS choices. Need some names? Check out FreeBSD, Red Hat (Fedora Project), Mandrake, and there are plenty more on distrowatch.
Re:Switch!!! by golgotha007 · 2004-03-21 16:22 · Score: 5, Insightful

you don't really need to go so far as to switch operating systems. perhaps this is a wake up call for those to switch to different applications that have the same or similar functionality.

i use both windows and linux machines day to day.
on my windows machines, i've activated the built-in firewall and use Mozilla Thunderbird for mail and Mozilla Firefox for web browsing.

i have zero problems with viruses or worms.

The real culprits here are IE, MS Outlook (& Express).
Re:Switch!!! by Coryoth · 2004-03-21 16:23 · Score: 4, Insightful

Switching won't really help.

The reason most (or all) viruses are written for Windows is because that's where they'll do the most damage, since most people use Windows.

All fine and well, but it will help you if you switch, because then you'll be joining the happy minority that don't worry about such things.

Of course if everyone switches it will be a problem, but really, what are the odds of that actually happening?

It;s all fine and well to say "If everyone switched we'd still have the same problems with viruses", but realistically, everyone isn't going to switch. A lot of people are heavily locked into their current platform - so, if you can, switch...

Jedidiah.

--
Craft Beer Programming T-shirts
Re:Switch!!! by dougmc · 2004-03-21 16:28 · Score: 5, Insightful

The reason most (or all) viruses are written for Windows is because that's where they'll do the most damage, since most people use Windows.
There is some truth to this.
If everyone switches to Linux or Mac OS then you'll start to see viruses for those operating systems.
Some more truth ...
You should be glad you're in the OS minority. That's what's keeping virus writers away from your system.
That's one small thing that's keeping virii out of my system. But it's only a small thing. Other things?

My mail client (mutt) does not run under an account that has full access to the entire system. Instead, it runs as me, and cannot replace parts of the OS even if it wants to. So it can't do things like replace part of the TCP/IP stack -- a popular Windows worm/virus trick.
My mail client does not automatically execute things sent to it. Instead, it shows me the text included in a file, and if I want to, I can open an external program to view it (like a movie player.) But under no conditions does it execute the email as a program, unless I save it to a file myself and execute that.
... And I know better than to do that unless I trust the source of the file, or can read through it and tell what it does.
Re:Switch!!! by Anonymous Coward · 2004-03-21 16:31 · Score: 4, Insightful

I've never had to worry about such things.

I use Outlook 2003 every day with an up-to-date virus scanner and I maintain my Windows XP with Windows Update regularly.

Every virus I get is automagically snagged by Norton AntiVirus before it can do any harm.

My Windows 2000 server running IIS is fully visible to the public, and it never gets hacked. Know why? Because I can properly configure IPSec and maintain my patches.

Maybe the solution is not "OMG SWITCH TO LUNIX LOLLERS", but rather, educate the Windows users better. Make them more intelligent and clue them in to what they need to do to not fuck up their system.

People often tout Windows as "it's so easy my dead grandmother can do it" but I've learned in my years of sysadmining that Windows takes quite a bit of general knowledge to get working great, and once you do, you will have no problems.
Re:Switch!!! by the_womble · 2004-03-21 16:42 · Score: 5, Interesting

The reason most (or all) viruses are written for Windows is because that's where they'll do the most damage, since most people use Windows.
So IIS has had more security issues than Apache and SQL server more than Oracle becuase they are more widely used right? Oh...
There has not been ONE single Linux virus that has propagted in the wild: given the huge nubmer of viruses out there I would have thought someone* would have written and released one for Linux just to show it can be done.
* probably one of those fanatical Windows apologists who think that Linux users are communists** or worse
** despite the fact that it is MS that advocates central planning.
Re:Switch!!! by WindBourne · 2004-03-21 16:45 · Score: 4, Interesting

The reason most (or all) viruses are written for Windows is because that's where they'll do the most damage, since most people use Windows.
That is more myth than truth. Most virus writers target MS due to simplicity. Read any of the online articles that dealt with interviews of a number of virus writers and you will see that they target not the plentiful system but the easiest.

If nothing else, consider the case on servers. Apache is now fully 2/3 of all servers, yet IIS accounts for the majority of break-ins.

Likewise, if you watch the credit cards that are stolen, they have been nothing but IIS for about 3.5/4 years. The last url to have CC's stolen that was not MS induced was playboy which uses Sun

--
I prefer the "u" in honour as it seems to be missing these days.
Re:Switch!!! by misleb · 2004-03-21 16:56 · Score: 4, Funny

People often tout Windows as "it's so easy my dead grandmother can do it" but I've learned in my years of sysadmining that Windows takes quite a bit of general knowledge to get working great, and once you do, you will have no problems.
General knowledge... and a whole lot of voodoo! -matthew

--
"THERE IS NO JUSTICE, THERE IS ONLY ME." -Death
Re:Switch!!! by Anonymous Coward · 2004-03-21 16:58 · Score: 3, Interesting

Wearing a condom won't really help.

The reason most (or all) AIDS infections happen through unprotected sex is because that's where the virus will do the most damage, since most people have unprotected sex.

If everyone switches to wearing condoms or practicing abstinence then you'll start to see AIDS mutations that jump through the air or something.

You should be glad you're in the minority that practices safe sex. That's what's keeping the AIDS virus away from your system.

Seriously, is this like the most pointless argument or what??

If you use a Mac or Linux TODAY you will not get these viruses. Period. End of discussion.

Let's say in 5 years, everybody will switch to Mac and start getting Mac viruses. Wouldn't you like 5 years without viruses??
Re:Switch!!! by SanityInAnarchy · 2004-03-21 16:59 · Score: 3, Informative

Even on Windows, a simple download of Mozilla Thunderbird will solve this, among other problems.

It's ridiculous that more viruses (or worms) come through email than through any other means. I predict that someday soon, people will stop using Outlook [Express] and start getting their viruses through Internet Explorer, Samba shares, or straight through the wire (smashing the IP stack). Maybe then it really will be important to switch to Linux.

I agree, people should switch, but if people used Windows with more intelligence... Well, maybe people wouldn't want to switch, which would be a Bad Thing, so maybe I should keep my mouth shut.

--
Don't thank God, thank a doctor!
Re:Switch!!! by ncc74656 · 2004-03-21 17:06 · Score: 4, Insightful

If everyone switches to Linux or Mac OS then you'll start to see viruses for those operating systems.

I'd like to see someone try to write a virus or worm that affects plain-text-only mail readers like Mutt. That would be a clever hack. I also suspect it'd be damn near impossible to pull off. How badly would you have to screw up something that displays plain text for a vulnerability to appear?
The moron who had the "bright" idea to start sending HTML in email needs to be taken out back and shot.

--
20 January 2017: the End of an Error.
Re:Switch!!! by Jeremi · 2004-03-21 17:09 · Score: 3, Interesting

Maybe Microsoft should re-code Outlook so that the incoming-email-handling-and-viewing code runs in some sort of Java-style untrusted sandbox mode. That way even if there is some problem like this, the damage would be contained to that one process and wouldn't subvert the rest of the system.

--

I don't care if it's 90,000 hectares. That lake was not my doing.
Re:Switch!!! by zcat_NZ · 2004-03-21 17:21 · Score: 3, Interesting

You missed a step;

. Save to file
. Set executable (chmod +x)
. Execute (and by default it's not in your path either!)

BUT when Linux gets as popular as Windows, most users are likely to be running something broken like Lindows that does everything as root. And sooner or later someone _will_ write a mail client for Lindows that can automagically run executable attachments because the sort of people who send greeting cards and flash jokes to each other will _ask_ for that functionality.

Linux/freeBSD are safe because they're not generally run by morons; Windows is perfectly safe as long as you know what you're doing. Have a good firewall, replace IE/OE with TB/FF or Moz, be a little careful about what you download, and NEVER run stuff that gets mailed to you! Plus keep backups and be prepared to nuke-and-pave if necessary.

--
455fe10422ca29c4933f95052b792ab2
Re:Switch!!! by KevCo · 2004-03-21 17:28 · Score: 4, Insightful

Exactly. So many people go on and on about how Linux or MacOS would be hit just as hard as Windows if they had the same market share. So what? The reality is that in the here and now they are safer alternative. If it is because of superior design, or simply insufficent user base to make them juicy targets, the result it the same to the end user.
Re:Switch!!! by mpaque · 2004-03-21 17:48 · Score: 3, Funny

Sure. Just install a good software firewall like Black Ice, and you're good to put that Windows box on the Internet.

http://www.securityfocus.com/news/8291
Re:Switch!!! by tgibbs · 2004-03-21 17:53 · Score: 3, Informative

The reason most (or all) AIDS infections happen through unprotected sex is because that's where the virus will do the most damage, since most people have unprotected sex.

If everyone switches to wearing condoms or practicing abstinence then you'll start to see AIDS mutations that jump through the air or something.

That is nonsense. A HIV strain that propagates through the air will be strongly favored whether people practice safe sex or not, because people breathe more than they have sex. Taking precautions against venereal spread of HIV will do nothing to increase the mutation rate of the virus.
Re:Switch!!! by Anonymous Coward · 2004-03-21 18:04 · Score: 3, Funny
2. ...people breathe more than they have sex.
Maybe you do...
Re:Switch!!! by IntlHarvester · 2004-03-21 18:33 · Score: 3, Insightful

Agreed. And I'm not particuarlly fond of Mozilla using it's full-featured HTML renderer for E-mail either. (Even though there's no known problems.) Ideally, you'd have a mini-render that would only operate on a Netscape v1-level HTML -- fonts and styles only.

As for text clients, there's been a few real world mail-based exploits for Pine over the years. Buffer-overflows in date or MIME parsing isn't exclusive to GUI programs.

--
Business. Numbers. Money. People. Computer World.
Re:Switch!!! by skinfitz · 2004-03-21 20:17 · Score: 3, Informative

There has not been ONE single Linux virus that has propagted in the wild

You mean apart from the Ramen Worm?

In fact wasn't that the first effective worm on the net? One that affected only Red Hat Linux systems?
Re:Switch!!! by the_womble · 2004-03-21 22:24 · Score: 3, Informative

Still not a lot compared with Windows.
Even if viruses existed in line with market share you would expect 100s or thousands of linus viruses.
Also the linked article does explain why Linux is an attractive target for virus writers: which supports point - that Windows viruses are not more prevelant purely, or even mainly, because it is more widely used.

How about.... by sethadam1 · 2004-03-21 15:51 · Score: 3, Informative

How about...

a. Turn off preview pane
b. Use OWA
c. Stop using Outlook/Outlook Express

?!

Re: How about.... by Black+Parrot · 2004-03-21 15:58 · Score: 5, Funny

How about...

a. Turn off preview pane
b. Use OWA
c. Stop using Outlook/Outlook Express

d. Read your mail on someone else's computer

--
Sheesh, evil *and* a jerk. -- Jade
Re:How about.... by photon317 · 2004-03-21 15:58 · Score: 4, Insightful

Mozilla Thunderbird is a great lightweight email client replacement for Outlook. Your average home user who has an imap or pop account from an ISP really has no good excuse not to uninstall Outlook from their machine and switch. Corporate users on the other hand are a little more screwed, since many of them use Exchange servers that don't have OWA turned on and/or aren't Exchange 2000/2003, which precludes using Evolution's commercial plugin to get calendaring integration and whatnot. However corp users that do meet those server-side requirements can do so. Or if you don't use or need the calendaring part in your organization and the exhcnage server has IMAP, then you can also go Thunderbird there too.

--
11*43+456^2
Re:How about.... by pyite · 2004-03-21 16:03 · Score: 4, Insightful

And it costs MORE not to switch. Unfortunately, most companies can't see past their nose as far as technology costs are concerned.

--
"Nature doesn't care how smart you are. You can still be wrong." - Richard Feynman
Re:How about.... by big+tex · 2004-03-21 16:06 · Score: 3, Interesting

a. and b. are not acceptable answers.

I have to use outlook at work, much as I do not like it.

I love the preview pane concept, it makes much more sense with email. I use it with Kmail at home as well. Turning off the preview pane is just treating the symptoms and ignoring the root. Our IT people do a good job of patching and filtering, so I can keep using the preview pane.

OWA sucks to a degree that makes Outlook look good. OK when you are on the road and checking from someone else's computer, but not an acceptable replacement. Once again, a symptom, not a cause.

--
I think I need a new sig here.

one word by Diclophis · 2004-03-21 15:52 · Score: 3, Insightful

pine (or mutt)

--

Jon Bardin

Two Words: by Limecron · 2004-03-21 15:52 · Score: 5, Funny

Right-click

err...

One word, hyphenated.

Re:Two Words: by ceejayoz · 2004-03-21 16:26 · Score: 4, Funny

They've been blocking around 70% spam on average, with 1% false positive rate, and only about 0.1% false negative rate

How can you get a 0.1% false negative rate when 30% of spam is getting through?
Re:Two Words: by MyHair · 2004-03-21 17:30 · Score: 3, Funny

How can you get a 0.1% false negative rate when 30% of spam is getting through?

Who claimed they were blocking all the spam? Obviously they intentionally allow about 29.9% of the spam on average.
Re:Two Words: by hallucination · 2004-03-21 17:32 · Score: 4, Insightful

How can you get a 0.1% false negative rate when 30% of spam is getting through?

He isn't saying that 30% of spam is getting through.... He is saying that they are blocking 70% of their incoming mail as it is spam. That means that 30% is determined to be real mail.

1 answer. by numbski · 2004-03-21 15:52 · Score: 3, Insightful

Use thunderbird, connect to exchange via IMAP4, use the web interface for calendaring.

--

Karma: Chameleon (mostly due to the fact that you come and go).

Re:1 answer. by tepples · 2004-03-21 15:57 · Score: 4, Insightful

Unless your IT department cluelessly refuses to turn on IMAP4 "for security reasons."

I know when I want virus info by Anonymous Coward · 2004-03-21 15:53 · Score: 4, Funny

I head straight to the Motley Fool. Likewise, when I want financial info, I'm on Slashdot.

Aside from... by ZiZ · 2004-03-21 15:53 · Score: 5, Insightful

...applying the patch which the article says was out last October?

I don't know. Webmail, one of the numerous non-vulnerable email clients for Windows, maybe give up email entirely?

--
This flies in the face of science.

Monoculture is bad by lavalyn · 2004-03-21 15:54 · Score: 4, Insightful

The viruses have mutated in the wake of developed resistance (slightly more educated users). It's an evolutionary battle being fought...

But as there are way too many deployments of Outlook as it is, and because it is Outlook/IE that is being exploited, the first solution would be to increase diversity in that field. Other mail clients, such as Thunderbird, or Eudora, will thrive while Outlook continues to succumb to these new diseases.

Oh who am I kidding, Outlook will continue to wreak its wrath upon the Net and cause us to all suffer as a result.

--
Doing the Right Thing should not be preempted by making a buck.

Re: Monoculture is bad by Black+Parrot · 2004-03-21 16:02 · Score: 5, Insightful

> But as there are way too many deployments of Outlook as it is, and because it is Outlook/IE that is being exploited, the first solution would be to increase diversity in that field.

IMO e-mail viruses don't result from monoculture; they result from bad software design. Namely, e-mail clients that execute attachments.

We'd have Linux e-mail viruses in a minute if the popular e-mail clients added support for automatic execution of attachments. (Assuming anyone was foolish enough to use them.)

--
Sheesh, evil *and* a jerk. -- Jade
Re: Monoculture is bad by bgarrett · 2004-03-21 17:12 · Score: 5, Insightful

Bad software design can emerge from a monoculture. Linux et al. is mostly virus-free because there is no Linux Inc. who writes email clients that auto-execute attachments simply because some corporate customers like it that way. The design goals and objectives of FOSS are capable of being highly secure because there is no central management ensuring that something else takes priority at all costs.

--
Nothing worth doing is worth doing today.

Not just clicking on it by Unordained · 2004-03-21 15:54 · Score: 5, Interesting

As per the article (Motley, at least) ... the virus is executed by some malicious HTML in the message, which would be activated if the message is viewed in full or preview(pane) modes. Simply clicking on the message in the list (you -did- turn the preview pane off, didn't you?) won't infect the machine. However, this does mean that similar HTML, from a web browser, might also be dangerous. Anyone have info on that idea? (Malicious websites giving you the virus by visiting the site?)

how to fix by AnonymousCowheart · 2004-03-21 15:54 · Score: 4, Insightful

How to fix this? Install mozilla!
Anyway, according to this article here,
"Bagle exploits a flaw in Outlook, revealed in October of 2003, that allows a hacker to upload and execute a file on a user's PC without that user opening the file. Microsoft has issued a patch for the flaw in October, but users who have not updated their systems with this patch are at risk."
If you run an MS machine, and don't know that you have to update regularly, you need your head checked. Besides, updating an MS machine really is easy.

Re:how to fix by oolon · 2004-03-21 16:42 · Score: 4, Informative

Easy if you have a cable modem, some of those patches are huge, service packs require 5+ hours to download on a modem.

James

Download Email Headers Only by Boyceterous · 2004-03-21 15:57 · Score: 4, Insightful

One feature of MS Outlook that is missing from most other email clients is the ability to download just email headers. I use this feature to review sender/subject and I can identify all spam just from that.

Actually, I use my own program to download headers, score them for likely spam, delete the garbage emails(without ever downloading the actual content), then start outlook to get the real ones.

Obviously, if a legit sender transmits a virus, it's a problem, but I guess that's why I pay Symantec.

well... by LBArrettAnderson · 2004-03-21 15:57 · Score: 5, Funny

Given that you have to select an E-mail to delete it, how are users supposed to protect themselves from this one?

place 2 other junk emails around it, select the top 1, hold shift, select the bottom one.... DELETE.

How about... by Spacejock · 2004-03-21 16:02 · Score: 5, Insightful

... using email software which doesn't render HTML, and instead shows it as plain text without images?

Yes, I wrote it. I wrote it because 99% of the messages I receive in HTML format are advertising. Most of those use dinky little images with referrer IDs to verify your email address is valid. The 1% I really need to see in HTML ... well the program has a link so you can view it in your default browser, if you really have to.

I know it's going back to the dark ages, but maybe NOT running javascript, html, etc is actually GOOD when it comes to emails.

I'm not advertising this thing, it's freeware anyway. I was a moderately happy Outlook Express user for years, but the lack of spam torturing implements drove me to write my own. Yes, I tried Mozilla, Eudora, etc etc. I think Thunderbird looks interesting too, and I recommend it. But personally I can't do without my POP3 preview window with colour tagging for spam, valid mail, blocked senders, ignored, etc. And deleting stuff before download. And bayesian filtering. And anything else I feel like adding, whenever I want to.

--
Hal Spacejock: Science Fiction with Nuts

All you poor poor Outlook users by GillBates0 · 2004-03-21 16:03 · Score: 5, Insightful

I pity you so :'( tsk tsk Proud user of Pine since 1994. Thank you, Univ. of Washington! ? HELP - Get help using Pine C COMPOSE MESSAGE - Compose and send a message I MESSAGE INDEX - View messages in current folder L FOLDER LIST - Select a folder to view A ADDRESS BOOK - Update address book S SETUP - Configure Pine Options Q QUIT - Leave the Pine program Copyright 1989-2003. PINE is a trademark of the University of Washington. ? Help P PrevCmd R RelNotes O OTHER CMDS > [ListFldrs] N NextCmd K KBLock

--
An Indian-American Hindu committed to non-violent thought/speech/action alarmed by the global explosion of radical Islam

Not a problem at all! by numbski · 2004-03-21 16:03 · Score: 3, Informative

Except that it's on by default. :)

I found that out when I started work at a new company with my PowerBook. Connect to the Exchange via IMAP4 for mail, point the address book at the exchange server via LDAP. iCal wasn't around then, but using that along with groupcal would allow you to do your calendaring, and all without using a single 'authorized' MS client.

On windows...dunno, perhaps there something similar to the groupcal/ical combo to get your calendaring done without Outlook, but I'm not aware of one offhand.

--

Karma: Chameleon (mostly due to the fact that you come and go).

another alternative by Azureflare · 2004-03-21 16:03 · Score: 4, Informative

is The Bat!. This application is a great replacement for Outlook. In fact I've switched my mum and dad over to it from Outlook, and they love it (though the calender does leave something to be desired). It doesn't automatically view emails in HTML mode, but you can select the HTML if you really want to view it in html. Also, it doesn't automatically load external graphic files in emails. (I don't think it loads ANY external files; not sure).

It really ensures the user wants to open attachments to emails, and it integrates fine with Norton Antivirus. It even comes with a Bayesian Spam filter (Which really works, once you get a lot of spam emails for it to learn from).

The Bat is a great program, and it's really improved, especially over the past year.

This is really old news by gvc · 2004-03-21 16:04 · Score: 5, Informative

The mime-type bug has been known for a long time. Microsoft has corrected it (twice :-)). I know this because my parents' computer was infected between their first and second attempts to fix the problem.

In a nutshell, Microsoft uses the filename extension, not the mime type, to decide how to open a particular file. On the other hand, Outlook uses the mime type to decide whether or not to automatically launch images, sound files, etc. So all you had to do was to send a mail with an embedded image with a filename ending in .exe, and it was executed.

It has been more than a year since Microsoft crippled^H^H^H^H^H^H^H^Hfixed IE/OE sufficiently to remove this vulnerability.

I must concur with previous posters that the best approach is to avoid these software products.

Preview Pane Virii are not New by kwpulliam · 2004-03-21 16:05 · Score: 3, Insightful

It has been STANDARD practice for quite some time to not use the "Preview Pane" feaute in Outlook. Since html code is displayed as if it were in a browser, this has been open to malicious attacks for quite some time.

This is not New.
This is not News.
This doesn't even matter.
This is not even accuratly portrayed. Selecting an email isn't the problem, displaying it is the problem.

Generic Rant by _Potter_PLNU_ · 2004-03-21 16:06 · Score: 4, Insightful

<Insert Generic Windows Rant Here>

<Insert Generic Praise about Linux/Mac Here>

<Submit knowing that anyone that has the problem will never see it here>

--
"Hard work never killed anyone." -- Some Dead Guy

Re:Generic Rant by Gleng · 2004-03-21 16:16 · Score: 4, Funny

You forgot to close the tags! Now, the rest of Slashdot will be anti-windows, pro-linux/mac...oh, wait...

--
"Proudly Posting Without Reading The Article"

What to do by Alien54 · 2004-03-21 16:07 · Score: 4, Informative

There are a number of decent free and unfree antivirus programs available, as seen in this list

Also nice are programs that let you delete the email at the server before you download, such as mailwasher, and with free versions.

Of course, there are a number of alternate email clients out there that will also help block this beastie

--
"It is a greater offense to steal men's labor, than their clothes"

Wow, people love to blame Outlook. by DroopyStonx · 2004-03-21 16:08 · Score: 5, Informative

I've said it before, and I'll say it again: people need to start being responsible for THEMSELVES. It's not Outlook's fault that the user didn't patch their system.

I'm sure that if someone wanted to take the time and analyze the source for Thunderbird, they could easily write the same type of worm/virus. However, you won't get the same type of media coverage that the others written for mainstream products will get. And yes, MS does write some exploitable code.

Most users who aid in the spread of these viruses/worms are ignorant. Time after time, news report after news report, they CONTINUE to fail to keep their systems up to date.

What's funny is each and every mainstream worm has been written AFTER the patch has been released.. and it's not like the day/week after, it's 5-6 months after. That's sad.

--
We have secretly replaced these Slashdot mods' sense of humor with a rusty nail. Let's see if they notice!!

Re:Wow, people love to blame Outlook. by lone_marauder · 2004-03-21 16:49 · Score: 3, Insightful

I'm sure that if someone wanted to take the time and analyze the source for Thunderbird, they could easily write the same type of worm/virus.

The virus writers have the source code for Outlook? No wonder there are so many viruses for it!

--
who are those slashdot people? they swept over like Mongol-Tartars.
Re:Wow, people love to blame Outlook. by Ironica · 2004-03-21 17:15 · Score: 4, Informative

I'm sure that if someone wanted to take the time and analyze the source for Thunderbird, they could easily write the same type of worm/virus.

I'm not, for several reasons:

1. Thunderbird has never thought implementing auto-launch of executables embedded in email was a good idea.

2. If you're using Thunderbird, you're probably using Firebird, and it's not as likely to try to do what the malformed HTML tells it to.

3. Even if you *do* manage to get Firebird to do it, it's not part of the operating system, and isn't likely to be able to do really nasty stuff to your computer.

--
Don't you wish your girlfriend was a geek like me?
Re:Wow, people love to blame Outlook. by kurt_cagle · 2004-03-21 18:11 · Score: 5, Interesting

I have had received more than a few patches from Microsost which:
a) Failed to solve the problem in the first place,
b) Caused another problem to appear in a seemingly unrelated application, resulting in significant time spent debugging, uninstalling, and otherwise wasting time for something I had no control over,
c) Ended up adding significantly to the amount of unusable space on my Windows XP system,
d) Added considerably to the bloat of the System Registry.

I moved our entire company off Windows to SuSE Linux after one of our primary public facing servers became infected with a worm which enterprising hackers used to store (and later serve) German porn movies. This despite our sysadmin religiously installing patches.

That is a big part of the reason why I no longer find the argument that Windows is just simply the largest target even remotely accurate. My sysadmin also does some coding work, and every patch that needs to be uploaded reduces his profitable time; to have something that compromises the integrity of our system in such an egregious manner is not acceptable.

I would rather have a good sysadmin that knows what he's doing maintaining a secure Linux system than having a less competent sysadmin maintaining a Windows system because the system tools are easier to use, even if it means paying more to the Linux admin.

Re:Not hard by catch23 · 2004-03-21 16:16 · Score: 3, Insightful

Easy for casual email users, but not for corporate people like myself. All meetings are scheduled via Outlook and if I don't promptly respond to meeting requests, I get rough verbal feedback from my boss. Even though I do most of my development in Linux, I still need a windows machine to use Outlook 2003. You're lucky if your company doesn't force you to use Outlook for all the meeting/appointment scheduling. But unfortunately there is no solution here. Even Evolution is not a solution since it doesn't quite support calendaring very well. Would you care to offer more useful advice? Thanks!

Yes They Are Sexually Transmitted by amigoro · 2004-03-21 16:20 · Score: 4, Insightful

One could argue that most of these viruses appeal to the base elements of the human psyche. For example, how likely are you to open an email with a topic like:
Re: My Photo by Cindi
Re: Hi Sweetheart by Melissa
Re: From you Secret Admirer by Linda Lovelace

etc.

Moderate this comment
Negative: Offtopic Flamebait Troll Redundant
Positive: Insightful Interesting Informative Funny

--

Nothing to see here

Block the email on server by richard_za · 2004-03-21 16:22 · Score: 3, Insightful

The following can be done to stop the spread of this Beagle/Bagle worm:

scan all email for virus/worms/malware when they enter the email server, such software is available for Linux/Unix/MacOS X/Windows etc.. This software has to regularly download virus definitions.
if your email is at kept your isp, or email passes through them before it reaches you, make sure that your isp offers this service.
do not use the ubiquitous outlook client, I have found Novell Ximian Evolution to be an excellent alternative
Make sure you patch your operating system, against known security flaws, most operating systems now have a automated way of doing this
pressure your bosses/university/school to not use software with a poor security record - outlook, internet explorer etc.
lay a charge with law enforcement officials when you are damaged by a worm/virus attach.

Re:Well, its pretty easy actually.... and painful by EmbeddedJanitor · 2004-03-21 16:24 · Score: 4, Informative

I work at a place that has a policy of doing auto updates. It's a bit scary thinking that someone else is deciding what shit to load on your box, but hey you just shut your eyes.

The problems come about when you have a bunch of software set up together that works. Then MS goes change something in IE and Acroreader stops working forcing you to go upgrade or reinstall acroreader. Things seem OK for a while, then something else stops working...

This is fire-fighting of an out of control software platform. It is not exactly a great user experience. MS stuff was never really designed to be hooked to the internet.

--
Engineering is the art of compromise.

Lame Post, Lame Articles by windside · 2004-03-21 16:28 · Score: 4, Funny

It occurs to me that both of the articles in the post are extremely light on facts. Furthermore, one of them has the rather pithy headline "Five new Windows Bagle virus variants break nasty new ground; Macintosh unaffected". Frankly, I don't care enough about the story to go hunting for news from appropriate sources like Symantec or McAffee, but it would be nice to see /. posters and/or editors go the extra mile to get out there and find information that is slightly higher than tabloid-quality.

Normally, I would bite my tongue on something like this, but it seems pretty obvious that in this case, the underlying theme of the article is "ha ha, isn't Microsoft terrible", which is pretty juvenile and meaningless. Here's a company that provided - in October - a working patch to prevent the flaw that is exploited by this virus. I'd say that's pretty reasonable, given the circumstances.

[Cue flames.]

--
...Whether my Maker is prepared for the great ordeal of meeting me is another matter.
Churchill

Linux is the solution? I don't buy it. by Brightest+Light · 2004-03-21 16:43 · Score: 3, Insightful

That's funny, I'm typing this on a Windows 2000 machine, and I've yet to get infected with the virus/worm/trojan of the week. Maybe its because i use a mail client that isn't riddled with security holes and an anti-virus program. Might I also add that I encrypt/sign all of my email, and I don't open attachments unless I've confirmed the veracity of the email (either by decrypting it (if the sender is clueful) or by talking to the person that "sent" the email (if they aren't)).

I've said this before, SWITCHING FROM WINDOWS TO LINUX WILL NOT ELIMINATE THE PROBLEM.
If a user does not know how to run a windows machine (keeping up to date on patches, running antivirus software, etc) then please explain to me how they'll be able to admin a linux machine. The truth of the matter is, they can't and they won't. The ranting of *nix fanbois aside, the problem exists between chair and keyboard. The email viruses that require you to open a password-protected .zip file prove that.

I'm certainly not trying to hold up windows as the platform of choice, because it sure as hell isn't mine; but regardless of your operating system of choice, if you're clueless you're clueless; and unless you fix that first, you're not going to fix the overall problem.

Re:Linux is the solution? I don't buy it. by Brightest+Light · 2004-03-21 16:48 · Score: 5, Funny

might I also add that closing off the bold tag is usually a good thing too :-\
Re:Linux is the solution? I don't buy it. by Coryoth · 2004-03-21 17:56 · Score: 4, Funny

If a user does not know how to run a windows machine (keeping up to date on patches, running antivirus software, etc) then please explain to me how they'll be able to admin a linux machine.

No idea. An unfortunately MacOS X is also well known for it's extreme complexity and difficulty to use.

Jedidiah.

--
Craft Beer Programming T-shirts

The solution is easy, but... by Infonaut · 2004-03-21 16:52 · Score: 5, Insightful

The fact of the matter is that we're dealing with Windows. Most Windows users just want to use their computer and know as little as they can about how it actually works. They don't know the meaning of terms like "dialog box", "alert message", "preview panel" and so on.

I'm not saying this to single out Windows users. Most non-professional Mac users are the same way. It's just that Windows is used by people who use what everyone else uses because they feel safe in doing so. They may not know how their computers work, but they're more afraid of looking deviant than having technical malfunctions.

The subconscious refrain of Windows users around the globe is, "Well, at least I'm not the only one with this problem."

Those Windows users who actively try to prepare themselves against the almost daily barrage of new worms, viruses, vulnerabilities, and other Windows annoyances still have a difficult time keeping up with it all. Even experienced Windows power users frequently find themselves overpowered by the ongoing war against malicious code.

So the solution to this vulnerability is simple. But when you look at the situation in context, the potential for widespread havoc is a lot greater.

--
Read the EFF's Fair Use FAQ

Yes and No by macdaddy · 2004-03-21 16:54 · Score: 5, Informative

Yes mail admins should implement AV solutions at their borders and within the central mail system itself. All outbound/inbound, inbound/outbound, and inbound/inbound mail should be scanned. However, the providers should not bear the full burden of AV filtering by itself.

AV solutions can and do break. Our's did at my provider. We still haven't got it back online. Our users have had to endure the full brunt of infected email for far too long.

No single AV solution can be up-to-date at all times. For starters we can't update our virus definitions within minutes of a newly discovered virus. It just doesn't happen. AV companies couldn't afford the bandwidth without raising our costs beyond what's considered reasonable. Free solutions such as ClamAV certainly couldn't afford it. Also, not all AV companies discover viruses at the same time. F-Prot might find the latest version of MyDoom before Symantec does. The fact that they found it means it's already in the wild as someone has had to analize it, create a patch for the defs to match this virus, get the patch through Q&A, and get it approved for the next release. There could be numerous hours between the virus getting into the wild, being discovered, being analyzed, and being caught in the latest virus defs.

Finally no defense of any kind should ever be one layer thick. One layer thick means you have no backup plan. No backup plan means you have no contingency for failures. No contingency for failures means your DRP (disaster recovery plan) has either been written fraudulently or you don't have one. In today's business world that means you'd better start updating your resume. A provider's mail system should not be the only line of defense from email-based viruses. Every single end-user desktop should have an up-to-date AV tool scanning all mail ahead or as a companion to the MUA. This is the *only* acceptable means of defense. You have to have end to end protection.

Many AV company's licensing scheme take both mail system users and desktops into account. Read the wording carefully because you may very well be able to use the end-user license to cover that user's part of the mail system....

Re:Mod Parent Down by Alien54 · 2004-03-21 16:55 · Score: 5, Informative

So you think you're smart because you know full well virus scanning and patches (release since last year) will solve this problem?? SHUT UP AND STOP TELLING EVERYONE THAT MICROSOFT PRODUCTS WORK, YOU CAPITALIST PIG!

Well, actually, I do well helping out joe sixpack with exactly this sort of thing. Not everyone is a programmer.

and you might be interested in these articles

Eric Raymond's rants: Part One
http://www.catb.org/~esr/writings/cups-horror.ht ml

Some follow-ups:
http://www.catb.org/~esr/writings/luxury-part-de ux.html

And mind you, I really don't like bill gates, either. So your criticism might be slightly off base. have a beer or take a pill, please

--
"It is a greater offense to steal men's labor, than their clothes"

Patch was available on October by gad_zuki! · 2004-03-21 17:19 · Score: 5, Informative

>c. Stop using Outlook/Outlook Express

I dont know why slashdot posted this particular fact-free article and with the "what are users supposed to do?" tagline.

The patch is six months old, people. This isn't some major zero-day exploit that is tearing the internet apart.

I use firefox/tbird on windows, but still, lets be sensible here. People can use the IE/OE combo without too much fear as long as they keep auto-update running.

Re:Not hard by tunabomber · 2004-03-21 17:21 · Score: 4, Funny

Don't use Outlook/OE.

There are tons of other options out there that aren't vulnerable, such as Mozilla and Thunderbird.

Thank you for telling me this!! As a Slashdot reader, I never would have known that Microsoft's products suck and far superior open source equivalents exist!
Everything I ever read on Slashdot has been pro-MS propaganda until your brilliant comment escorted me out of the cave of ignorance to the enlightened world above!
My eternal thanks.

--

pi = 3.141592653589793helpimtrappedinauniversefactory71 ...

Re:What do you do? What do you do?! by Raffaello · 2004-03-21 17:26 · Score: 3, Informative

Their study specifically excluded email client and web browser vulnerabilities, the principal vectors of Windows viruses, worms and trojans. No wonder they found Windows to be "more secure" than Linux - their study left out most of the Windows security problems.

The firm doing the study are known bozos - they pretty much predicted armageddon on 1/1/2000, and still have much egg on their face from that. They also stretched the truth about their experience and expertise in the computer security field - they were doing something quite different for the first several years of the company's existence, but their press claims security expertise for the whole time.

An AC citing a "study" known to be flawed, designed to gain free press for the flawed company conducting it should not be trusted.

Even lesser-used apps by 0x0d0a · 2004-03-21 17:40 · Score: 3, Insightful

Even if you don't switch to a client that's more secure, switching to one that's *less used* will work equally well. How many viruses are going to target, say, Pegasus Mail, even if it's riddled with overflows? Not a hell of a lot. I can understand interoperability issues with Word, Excel, etc, but this is *email*. All the clients out there work fine together, and it's not as if it takes long to learn an email client. The main concern in such a switch would be moving old stored email, and I would guess that any major Windows-based email client would provide Outlook import.

Email is also a good candidate for a piece of software to be written in eiffel or ocaml or some other safe language (Java might use too much memory, but there are safe languages that aren't as RAM-intensive). An email client does very little that's computationally expensive.

--
May we never see th

Devil's Advocate by EventHorizon · 2004-03-21 17:49 · Score: 5, Insightful

I love Linux and have used it since 1996, but I don't love half-truths. Mods, do what you must:

1. Unless you have a special 'l00s4h' account for running network programs, you can lose anything owned by your normal account. Typically that's all your data (norp, zeraw, 3PMs, financial data, etc). You're saying losing all that stuff is _better_ than losing the core OS, which you can replace over HTTP in 10 minutes?

2. Even with 'l00s4h', if your kernel has priviledge escalation bugs, bad guys can still get r00t. Linux had two of these in the past six months.

3. You've personally audited mutt for overflow issues? How about the 1GB mozilla codebase?

4. You trust Debian? Gentoo? GNU? Even though they don't always cryptographically sign binaries and even though their servers were 0wned a few weeks back?

5. apt-get, emerge, etc don't typically use SSL, so how do you know you aren't being man-in-the-middled when you run it (as root)?

Linux can be made more secure than d0ze--but don't delude yourself, or others.

Nothing New by rixstep · 2004-03-21 17:57 · Score: 4, Informative

Given that you have to select an E-mail to delete it, how are users supposed to protect themselves from this one?

This is nothing new. Leigh Stivers of DP Technology, researching in the wake of ILOVEYOU from May 2000, demonstrated in the fall of that same year that anything goes with poor products like Microsoft Outlook.

This revelation, like ILOVEYOU and all that followed, did nothing to move the masses away from their bad habits. AnnaK followed, and after that things only got worse, and still we find people trying to batten down the hatches and still use Outlook and Swiss cheese Microsoft technology.

So how do you avoid threats like these new Bagles? Easy. You stop using Windows because you're supposed to be smarter than that at this point in time - after getting the shit kicked out of you for four years straight.

Second, if you're simply too lame to abandon your beloved Windows, then you at least abandon Outlook and all IE-related email technologies such as Eudora. Any email client relying on Internet Explorer is a sitting duck, and you know it.

I am not telling anyone anything they do not already know; even posing such a question - 'how in heavens will we protect ourselves now?' - is so lame it's beyond description.

The Bagles are hardly the worst threat right now anyway. Phatbot is out there, harvesting machines like they're going out of style, and coming ever closer to the first million mark. This is outright organised crime. The machines are left as backdoored P2P bots and can harvest bank account details, credit card details, passwords all over the place, and the corrupted machines can be used in further spam attacks - where the unwitting, claiming ignorance and helplessness, go ahead and click on things and use Windows and Outlook and then ask 'how can we protect ourselves?'

It's not interesting anymore. There's no point in trying to help those who categorically refuse to help themselves and take the necessary steps to be safe. The only concern, voiced for years now, is that these ignoramuses are ruining the Internet for the rest of us - and that is a very real and very justified concern.

for the ultimate in virus protection... by captivity · 2004-03-21 18:04 · Score: 3, Funny

this is why I check my email on other people's computers...

Four Years Old by rixstep · 2004-03-21 18:07 · Score: 5, Informative

New Outlook Hole Found
http://radsoft.net/news/roundups/luv
May 8, 2000 0:00 AM UTC
This is getting ridiculous. An email appears in Outlook's inbox, and even before the user does anything, a message pops up on the screen. 'Had this been a real virus, you would not be happy', it reads. The relieved user clicks 'OK' and another box pops up.

'Deleting hard drive now... Just kidding!'

It was written by Leigh Stivers of DP Technology, who is trying to draw attention to a hole in Outlook that is far more dangerous than the ones ILOVEYOU found - this hole allows any email to be loaded invisibly with a destructive program that could go as far as deleting an entire hard drive.

Unlike viruses like ILOVEYOU or Melissa, these programs have no attachment and give no indication that they are anything other than ordinary email.

And with Outlook's factory defaults, this program - which might have been set to wipe your entire hard drive clean - can start running without you having to click a thing, before Outlook even tells you mail is there.

'The script can do almost anything', said Stivers. ''We were amazed to see how open everything was in house here, and we take security pretty seriously.'

You shouldn't have been amazed, Mr. Stivers. But thanks for the tip. We shall now visit the C|net link and read the article and within 30 minutes be running a better email client - for this writing on the wall is surely enough for even the lamest Outlook user?

http://news.com.com/2100-1001-240189.html

Re:Complete lie by WindBourne · 2004-03-21 18:16 · Score: 4, Informative

I guess you missed the study Slashdot itself posted that showed Linux was the most-breached OS. Incidentally, BSD was the least-breached.

I saw the study. It was done the British group Mi2, who is about as useful as IDC or Gartner, with their own vested interest. In almost every situation, the Linux openings were simple PHP's being hit on systems with multi domains rather than the systems being owned. Too be honest, I would love to see a company/group without a vested interest do a real study and report the numbers.

BTW, even though your BSD statement was a simple red herring, I suspect that it has merit.

--
I prefer the "u" in honour as it seems to be missing these days.

Re:.NET by Rick+Zeman · 2004-03-21 18:23 · Score: 4, Insightful

It's called the .NET runtime, and when Longhorn comes out and EVERYTHING including Windows itself is running on .NET libraries, you're going to have some damn secure systems. What will Slashdotters find to bitch about next? There's always something--it's impossible to satisfy people around here. The friggin' sky is always falling.

Color me cynical, but didn't MS tout the absolute security of W2k3? And Win2k before that? Sorry, with their record they're guilty until proven innocent.

VBA is useful by Fred+Ferrigno · 2004-03-21 18:32 · Score: 3, Interesting

It's astonishing that you can do anything useful in it, let alone write a virus in it.

I spent a large part of my last job writing custom Excel applications in VBA. Most of them were for engineers who wanted an easy yet flexible way to input and summarize data. Excel provides an interface they're already familar with, and I provided a few bits of VBA code to make complicated tasks easy. Sure, I could have written a custom application for each task, but that would have been overkill, not to mention a waste of my time and my employer's money.

The virus writers started to piss me off when we switched to Office XP. XP automatically sets your macro security to maximum, and it became a big hassle to tell my users to lower their security. Anymore, they don't trust any macros, even from someone in the same company. (In anticipation of someone mentioning signed macros: setting up my cert on every computer is no easier than setting the macro security to medium.)

By strip all executables... by rsilvergun · 2004-03-21 18:33 · Score: 4, Funny

...I think he meant strip out Outlook too :).

--
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/

Simple rules for avoidance by dtfinch · 2004-03-21 18:42 · Score: 3, Informative

If you refuse to use a mail client besides Outlook Express:
1) Disable the preview pane. View messages by double clicking them. That way you're never forced to view a message you haven't made the decision to view, either by trying to delete it or by it being the top message in your inbox. This also helps to reduce spam, because spams with linked images can be used to verify that you read the email.
2) Only view email you trust. For the rest, view the message source or ignore the message.
3) The above will stop 99% or more of email viruses out there. To further reduce the risk, patching frequently and using a spam filter helps. Virus scanners like AVG also help but you can expect a noticeable slowdown in system response if you use one. I don't. No virus problems ever in 12 years.

stop using Outlook by msblack · 2004-03-21 18:44 · Score: 3, Informative

. . .reporting that the latest versions of the Beagle/Bagle virus can infect users' computers whether or not they open an attachment.

Aparently they've never heard of e-mail software other than Outlook. Many e-mail programs do not execute the VBS code or other attachments of a message simply by selecting it from the Inbox.

--
signature pending slashdot approval

Re:MacDailyNews? by dbirchall · 2004-03-21 18:46 · Score: 3, Informative

Huge numbers of Macintosh users run Microsoft products (MSIE, Office v.X, Virtual PC, etc.). Some of us even run Windows under Virtual PC, and need to keep our Windows instances up to date security-wise. Last time I ran Windows Update on the Windows XP instance I have on my iBook, it came back with something like 35 things it needed to download. And I'm sure the same folks who let us know that a vulnerability doesn't affect our Macs would let us know if one did, too.

Re:.NET by Doctor+Crumb · 2004-03-21 20:57 · Score: 3, Interesting

Yeah right. The other day I saw a programmer write a .NET aspx page that provided a command shell, with full permissions on his computer. Very scary, especially since he just used a built-in library and no hacks. .NET is not going to suddenly make people write good code. Windows will continue to have exploitable holes for the foreseeable future.

In the meantime, I'm running clamAV, Amavis, and spamassassin on my mail servers and haven't been happier.

Re:Duh... how do i avoid viruses? by Felinoid · 2004-03-21 21:43 · Score: 3, Flamebait

The sad thing is the parent is both a troll and insightful.

The Unix experts have been saying for decades now that using a secure operating system will protect you from viruses.
The anti-virus industry would have you believe Unix was never populare enough to make this possable. WHAT A LOAD OF BS.

Unix was THE operating system for mainframes in the 1970's and 80's.
So they adjust the excuse "Oh well virus writers are only after desktops"... Wrong again.

First what is a virus?
According to The Dirty Dozen it is "The Ultimate Trojan Horse".
What do hackers do with trojens?
According to the book "Outside the Inner Circle" (By Microsoft press) trojens are used by hackers to gain more access to the servers they already have low level access on.

But to use the trojen you need to hack into the system to start with. Wouldn't it be great if you could trick a system admin (or better yet user) to install the trojen for you?
Thats what a virus is. That is what it's for. Every script kiddies wet dream has been for the last 2 decades a Unix virus.
And we don't have a Unix virus yet becouse the virus writers don't have any motivation to write one? Bull.

Outlook is just one example of just how sloppy Microsoft really is when it comes to software design.
Download and install ANY other e-mail client and you won't need to fear e-mail viruses. That's easy enough isn't it? You don't even need to install a new OS just use a better e-mail client.

--
I don't actually exist.

Preview Pane by Jace+of+Fuse! · 2004-03-21 21:48 · Score: 3, Insightful

Given that you have to select an E-mail to delete it, how are users supposed to protect themselves from this one?

Disable the Preview Pane (Pain).

It's a stupid feature anyway, it's unsafe by design, and the last thing on earth I want is my computer opening my e-mails without my input.

This is OLD news. The Preview Pane shouldn't even exist until Microsoft can find some way to totally secure it, which probably won't ever happen as long as harmfull tricks can be planted in e-mail.

I've NEVER used the Preview Pane, and I don't miss it one bit. Maybe more so called "computer experts" should stop carrying stupid misconceptions and actually learn the truth behind the stupid ideas they so firmly hold onto.

--

"Everything you know is wrong. (And stupid.)"

Moderation Totals: Wrong=2, Stupid=3, Total=5.

Solution by Idaho · 2004-03-21 22:14 · Score: 4, Informative

Given that you have to select an E-mail to delete it, how are users supposed to protect themselves from this one?

From best solution to workaround:

1. Don't use a Microsoft E-mail client
2. Use a virus-scanner that catches it before it is opened
3. You do not *have* to view an e-mail in order te delete it, if you close the preview pane you can delete it without viewing (even in Outlook Express). This is not exactly what I'd call convenient, though.

--
Every expression is true, for a given value of 'true'

Block tcp on port 81 by advocate_one · 2004-03-21 23:05 · Score: 3, Informative

breaks the vector and the virus can't pull it's payload in.

Disallow connections to TCP port 81 through your network firewall. Blocking outbound port 81 connections stops computers on your network from downloading the worm from outside. Blocking inbound port 81 connections means that even if you do get infected you will not pass the virus on to others.

--
Donald 'Duck' Dunn: We had a band powerful enough to turn goat piss into gasoline.

too poor to build a second box... nonsense by jotaeleemeese · 2004-03-22 00:32 · Score: 3, Informative

Try Knopix or any other of the several live CD distributions.

Stop the excuses, you can try Linux today.

--
IANAL but write like a drunk one.

126 of 1,050 comments (clear)