Slashdot Mirror
New Virus Can Strike Via HTML E-Mail
cmeans and lots and lots of others have pointed us to this MSNBC article article about yet another e-mail virus. Quote from the story: "The virus can only run if Internet
Explorer 5.0 with Windows Scripting Host is
installed (standard in Windows 98 and
Windows 2000 installations). If security
settings for Internet Zone in IE5 are set to
High, the worm will not be executed. It does
not run on Windows NT." ZDNet also has a story about this "Bubbleboy" virus. Update: McAfee weighs in too. (Thanks, Jade.) Consider yourself warned.
-- $SIGNATURE
Two obvious fixes, disabling scripting in the 'Internet Zone' for IE, and setting Outlook Express to use the 'Restricted Zone' for all content to start with. Anyone using those products should probably be doing both to start with.
-Blake
i'll consider myself immune, thanx ;)
Ok this one isn't even that bad (for micro$haft). It won't run on NT. and your security settings can't be on high.
/.ers run linux don't they.
Isn't there something like this going on constantly on windows machines? A new email, virus, thingy every week. Why is this even here? Most
It has been statistically shown that helmets increase the risk of head injury.
You know, whenever I read some really good piece of science fiction, the terror is never caused by something called BubbleBoy...or Melissa, or Good Times, or any of these other stupid names.
= -=-=-=-=-=-=-=-
At this rate, when some genetic mutagen is released that destroys all of mankind, it'll probably be called the Pokemon virus.
[/tongue in cheek]
- JoeShmoe
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
-- I wonder which will go down in history as the bigger failure: the War on Drugs or the War on Filesharing
Just another one of those "features" that make Internet Explorer so much better than Netscape...No wonder it's winning the browser war.
pine
It has been statistically shown that helmets increase the risk of head injury.
"In fact, it's unclear exactly how users of HTML-enabled e-mail readers can protect themselves from such viruses."
Um, how about ASKING the user if they REALLY want to send all of those emails??? Web pages can't do any real damage by themselves (except by replicating), unless of course they use java to do something nasty.
Of course this begs the question, who _needs_ html email? I mean, do you actually spend hours designing a page to send to someone? HTML emails are big downloads and irritating. Email readers should only look at basic tags (a la slashdot), and not "embed" tags.
Oh, I'm sorry, the users _requested_ that feature bloat for IE 5.0! How silly of me!
And yes, pine does read HTML email.
(Pine Is Not Elm!)
I'm increasingly worried about the ability to send active content in emails... above and beyond people who blindly execute attached files (user stupidity), it's getting to the point where just
READING email can actually spread a virus. Remember the big scare when people realized that Eudora would open up Java applets without asking permission ? I always wondered how netscape mail or Eudora would handle Meta refresh tags...
Anyway, I avoid the whole thing by sticking to good old-fashioned ASCII-mail. Now if only all my co-workers could do the same... *sigh*
25% Funny, 25% Insightful, 25% Informative, 25% Troll
From what I read on Microsoft's advisory on this bug, the same bug exists in NT.
I guess that Bubbleboy isn't exploiting it for NT, though.
NAI's page on Bubbleboy is here.
I read a news story which said that the author emailed the worm to Antivirus companies. So I guess that it was more of a demonstration of a serious problem than something malicous.
This is what we get from Micro$oft's "innovations".....
----------
The virus can only run if Internet Explorer 5.0 with Windows Scripting Host is installed (standard in Windows 98 and Windows 2000 installations).
This is one of those "advantages" M$ talk about in the anti-trust case. Because the OS already comes with a browser, security flaws such as this are built in!
----------
If security settings for Internet Zone in IE5 are set to High, the worm will not be executed.
And IE 4/5 default to medium setting. Wonderful work, Micro$oft! You really know your stuff....
----------
The virus actually takes advantage of a security flaw in Microsoft's ActiveX technology that was discovered in August.
August?!? AUGUST! Why the hell wasn't a patch to repair the error relased in August then? When a monopoly has no competition, they have no motivation to repair errors until they become huge issues for their software....
----------
This is what we get with M$ winning the "browser wars", software with security holes that don't get fixed until they are a real risk. Fortunatly, most sane PC don't use IE, and don't have to worry about ActiveX flaws. However this is one more reason why M$ should not be ruler of the browsers...
gee IE5 with a bug??!! how could that be? anywayz, this is just another reason that netscape/linux rules
Bah, Bubbleboy isn't a Seinfeld episode, its the AUTHOR. What would you do sealed up all day but write malicious virii?
I was hoping that Melissa would make companies wake up and rethink the "lets move everything to Outlook/Exchange/IE" philosophy. Apparently IT people forget quickly...
Now we have time and time again exploits against IE due to its extreme integration with Windows and such. How long until one of these gets really nasty? How long until someone gets bitted a little too hard, and then they want to bite back?
What's a real shame is that, in the world of Windows, the Windows Scripting Host has never really taken off. I mean, it's been around since the introduction of Memphis... Before WSH, any automated scripting had to be done through batch files. Batch files were nice in DOS, but they didn't have a world of flexibility under Windows, and they couldn't interact with the rest of the GUI. WSH fixed all that, and I don't think many windows programmers took advantage of it.
Oh well - Now it's a security issue and will get a bum rap because of it. It's a real waste...
-----------
"You can't shake the Devil's hand and say you're only kidding."
To me, this seems more like a plain-old security exploit, no different than the dozen or so major security flaws in IE and Navigator found in the last 3 years or so.
There are thousands of pieces of code out there that exploit security flaws such as buffer overruns right now and most of them are labled as pieces of code that expose programming flaws in the targeted application/server.
How is this any different and why is it being branded as a 'virus'? It uses a security flaw in Microsoft code to introduce unexpected/unwanted behavior.
I don't see this as furthering the viewpoint of "Well, the day has come when people can catch a virus from reading their email" any more than web servers having buffer overrun probelms furthers the viewpoint of "the day has come when people can catch a virus from running a web server". If a piece of software is poorly written, it will be exploited.
Do you think perhaps it is because a good majority of computer users use email, but a very small number run server software susceptable to typical server attacks? Though if you remember the WinNuke exploit exposed in Win95 several years back, that is an example of a security flaw that could attack any Win95 machine attacked to the Internet.
---- Warning...Maybe a little offtopic
This brings up a question I was wondering about the other day, and I think that I know the answer.
Is it possible for a virus to execute on a unix machine and do any damage?
I know that the same effect as the "bubbleboy" virus could be achieved by targeting pine users or something, if their were those sorts of weaknesses in pine.
In my opinion, though, a malicious virus, that did things such as deleting files, or whatever would have to have the ability to obtain root privileges, or it basically would only be able to delete or change files that the dummy user had access to in the first place.
I assume this is correct, since I have never seen any Virii targeted towards say an i386 Linux system, or any virus scanners for Linux.
There apparently haven't been any known outbreaks according to ZDTV anyway. Now anti-virus companies will really be praised from keeping us safe from everyday things, now there is a full time danger and we must trust "HTML escorters" to surf around the internet. Gee Wiz.
The above is, seriously, the big potential security hole in GNU Emacs. It is documented as such, in the documentation, and users are given suitable warning not to do so...
It seems reasonably likely that the only way to make "executable email" safe is the implementation of some sort of capabilities-based system that can strictly lock down what particular programs are permitted to do. Of course, as we learn more about capabilities, it is also likely that its powers of protection will prove quite finite...
If you're not part of the solution, you're part of the precipitate.
This is the time where we all check back over our warnings and say "If you use Outlook Express 5, yes, you CAN get a virus just from reading an e-mail."
This shouldn't be true, in fact until now, it hasn't been. But hopefully this "feature" will be "fixed" by Microsoft. Until then, i'll just stick to pine.
Oh, can't this ALSO affect Hotmail or any other web based E-mail, since they ALL use IE to display the formatting?
Symantec posted this advisory of the VBS.BubbleBoy here
http://www.symantec.c om/avcenter/venc/data/vbs.bubbleboy.html.
It contains details of what the virus does, where it goes into the registry and how to protect yourself.
If you already do not have that security patch from Windows Update, you can download the patch from
http://www.microsoft.com/s ecurity/Bulletins/ms99-032.asp.
This is kinda scary... as we have always taught people that you cannot get a virus by reading mail, only opening attachments. I hope this doesn't become a growing trend.
You know, now I understand where Microsoft is coming from. Imagine what would happen to the "freedom to innovate" exercised by virus authors and script kiddies if Microsoft were to somehow be made accountable for their lax security? What would bored pre-teens do with their l33t AOL connections? Learn something useful, like programming or writing?
What kind of world would that be, and where do I sign up for it?
I was working tech support for an ISP when "Melissa" hit. I spent all day explaining to people the truth about the virus..."As long as you don't download and run any attachments..." I can just hear them now "But, you said before that I couldn't get a virus by just reading my mail..."
I feel for you support boys, just keep your favorite UserFriendly strip on the screen to keep you from snapping.
-Al-
The fact is, if Netscape supported Windows Scripting Host, it would probably be succeptible to the same flaw. I don't care for MS anymore than the rest of us, but I can't stand baseless garbage.
-----------
"You can't shake the Devil's hand and say you're only kidding."
Now, how do you turn off HTML? Lemme see here, I'll show you...
Hang on, this is the first time I've ever opened up Outlook.
*rummage*
*rummage, rummage*
*dead end*
*thwack!*
Well how about that, the boneheads won't let you turn off mail formatting. Slick guys, good thinking.
Well I'm sorry folks, it looks like you're going to have to switch to a more sensible mail client. Try Eudora or Pine, both of which have Windows ports, or Mutt or Elm or something if they're available (not sure if they exist on Windows -- don't see why not but don't really want to bother verifying that at the moment).
It's funny how a scare like this comes along every few weeks ...and I find myself completely immune to it. "The Humdinger virus abuses your Outlook addressbook, eh? How tragic. Good thing I don't have one nor ever will. Keep safe though, try not to accept any infected mails there, pal!". heh heh
In the immortal words of the venerable Montgomery Burns, "Look at all these idiots!" Hahahaha
DO NOT LEAVE IT IS NOT REAL
There is an implicit assumption that there will never be a virus for the first poster's OS and that simply isn't true.
Mutt,
Barks like a puppy,
Bites like a Dog.
geach
(mutt user)
(mutt is an E-mail client for the Enlightened)
(mutt is a productivity device)
(mutt is the end all be all)
(mutt is truly open)
(mutt is good for chasing of bad cat>'s)
(mutt is man's best friend)
(mutt it does a body good)
The easiest way to get your fix for Win98 is here: Just use Windows update on your start menu.
In my opinion, though, a malicious virus, that did things such as deleting files, or whatever would have to have the ability to obtain root privileges, or it basically would only be able to delete or change files that the dummy user had access to in the first place.
It sure sounds like you're confused boy! Answer me this question: do you need root privileges to create or delete files?
The reason you don't see viruses on linux is not because they need root privileges but because it's a fairly well designed system...
HTML doesn't belong in email.
I just cannot wait to see my Work Email filled by the pointless drone of our Windows NT "Administrator" preaching about Security on windows boxen.
Gee- What a suprise for Microsoft- A buggy insecure product.
IE5 was made for Micro$oft by the devil.
Read the article, folks. This is the email virus.
/. response to this will be--i.e., this sort of thing is inevitable with HTML email, why can't everyone just use Pine for email and ftp instead of attachments, and while we're at it let's replace all our PC's with teletypes hooked up to a PDP-11--I'm not so sure. IMO, it's a Good Thing that feature-rich email is here to stay, and in the long run there's not so much reason for email to be any more secure than browsing; if a computer can be compromised through its browser, then that's unacceptable right there.
That is, it runs on its own, without the recipient having to open any attachments. All they have to do is open the email itself (or, in Outlook Express, just point at the email so that it shows up in the preview pane), and they're infected.
This is a big deal.
Melissa made it so that we couldn't just tell our less tech-minded brethren/co-workers, "for the last time, you'll be ok if you just don't open any frickin' attachments from people you don't frickin' know!" This one means we can't even tell them "you'll be ok if you don't open any attechments."
Now, this particular virus (well, technically it's more of a worm) isn't too malicious (except that, like Melissa, it could clog the hell out of mail servers), and mails itself under a goofy subject line so that you can be on the lookout for it. (Of course, I'm not sure what being on the lookout for it would accompish if you're running Outlook Express, since there's really no way to delete it from your inbox without first selecting it...which is enough to run the virus.)
But it's a proof-of-concept, and a scary one at that. It just changes the name and organization your computer is registered to and forwards itself to your address book, but the point is that it was screwing around with your registry, and it could have done whatever the hell it wanted to.
Now...there is some good news here.
Namely, this is perhaps the first time in history when Microsoft actually had a patch for a new exploit *before it was released to the public*!! Yes, that's right, this email virus works in exactly the same manner as one of those web-page exploits a couple months back, for which MS has had a critical update patch on Windows Update for several weeks now. Essentially what it does is take advantage of some very very stupidly permissioned ActiveX commands that lets an untrusted source save a certain type of file (.HTA) to your Startup directory...thus allowing them to run arbitrary code upon reboot (shouldn't have to wait too long...ok, so that was a cheap shot).
So, the good news is that my Win98 partition was already immune from this exploit, and hopefully so are many other people's. Of course, I can understand people not wanting to be on the bleeding edge of MS's security patches, because running everything MS throws at you can get you burned as well.
As for what I'm sure the mainstream
On the other hand, I have very little doubt that, as we expand into XML and all these other new technologies, short-sided security permissions are going to bite us (especially those of us that use MS products) in the ass again and again and again, probably with no end in sight until we stop coming up with new features. It's a rather scary trade-off to have to make, and even scarier that 95% of the world has Microsoft making all the decisions for them...
God i love this crap. And people persist using IE/Windoze. And we wonder why they waste soo much time on fixing computers in the business world. Why dont they wake up and smell the coffe. Perhaps they will soon...
MS = Monolopy != Good For You
/* Lobster Stick To Magnet!*/
A message to a moderator. Ignore me..
No matter how cynical you become, it's never enough to keep up.
http://www.m icrosoft.com/msdownload/iebuild/scriptlet/en/scrip tlet.htm
I hate virii, or viruses, or whatever and the paranoia that goes along with them. We have reasonably nice computers at school (P2/266, 32mb, etc etc) that run win95 with Netscape 4 and Word 97. One would think the systems would be reasonably fast, but NO!!!! The stupid admins for the network here load not 1, not 2, but 3 virus scanners into memory! (you know, the gay little ones that scan every file that you open) Netscape takes over a minute (yes I timed it) to load on those decent machines. Takes less time to load on my old 486/66 box. Damn it all to hell
/., but that's just me
PS - HTML is gay for anything except web pages. In point of fact, I don't even like the simple HTML formatting on
It's one thing to bash an OS. It's another to be racist. Ignorance is not what Linux is about. Don't bring your shit in here.
Well how about that, the boneheads won't let you turn off mail formatting. Slick guys, good thinking
Actually it can be done.
Open Outlook
From the memu go to Tools | Options
Click on Mail Format tab in the dialogue box
Change message format to Plain text
Click OK then OK
You should be back at the normal screen - Problem solved
The MyTh - I am a figment of the Imagination - [Im Probably even not here]
Amazing(?) that MS didn't take precautions against this happening. Then again, they've got so many Windows extensions out there, that it's gotta be hard to keep track of the interactions... Seems like they're running as fast as they can just to keep up with the problems.
Then again, some of it is the responsibility (or lack thereof) of the end user. I find it depressing that people will mindlessly follow such simple directives as "Open Me". Even though the subject in this case wasn't quite that direct, it still would seem rather alien in my inbox.
-W-
Is it all journey, or is there landfall?
--Ellison & van Vogt, 'The Human Operators'
A while back (~3 months?) I read an article linked to by /. about bloated apps. The author was stating that users ask for and want bloated software. I see this argument time and time again in the press, newsgroups and so on...
Well, I think the point is really:
Does an app need to be bloated to have features?
Obviously, 90% of the people who read this will exclaim "NO!". So the quesion remains "why is software bloated?" This is the thing that is addressed in the Programmer's Stone as well as many books. Everyone on this site should read The UNIX Philosophy for a dissussion of the stages of software development as well as lots of discussion on why unix has developed into what it is. Only in the second growth stage of development does software become bloated. This is due to the addition of all of the requests for more features being implemented. They all are added withought thought until the software becomes too big and the app just about breaks. The UNIX Philosophy of code reuse and small applications still allow features to be added. An example would be the ability to pipe information from one app to another to gain more functionality. This same philosophy of code reuse still holds true in today's GUI world and is why I find KDE so interesting.
The problem comes when code has to be churned out on a deadline without planning or thought. This is usually driven by coporations and Marketing/management. Without artificial deadlines Open Source/*n*x apps can stay small and elegant.
They can also be trimmed back and restructured by anyone. As a community it is important to always grow as fast as possible by adding features but to also look back and take out the features that only benefit a small group of users. That part might hurt a little, but is very important to get the software into the 3rd stage of life. So look back thorough your code and rewrite some stuff every now and then. It makes your code smaller and you will be able to work faster. You get a net gain in the end.
-pos
The truth is more important than the facts.
The truth is more important than the facts.
-Frank Lloyd Wright
NEWSFLASH:
In an amazing technological breakthrough, a hoard of new email programs have rendered themselves invulnerable to every concievable computer virus. By rendering email in plain text, ignoring worthless html formatting instructions and pesky attatchments which clog up the internet with unwanted and useless files, these programs, known by such arboreal names as pine and elm, sidestep the entire issue of computer viruses. Stay tuned for more details!
i want to know how microsoft is getting away with this..
h tml#discontent
msnbc, as i'm sure a lot of other news sources will be doing, are centering really big on the word "VIRUS!" despite the fact the virus isn't the important part at _all_. the important part is that the activex exploit which allowed web pages to install arbitrary code on the person's computer now run in HTML e-mail. If you accept that, the idea "you could write a virus with this" is so obvious as to be totally irrelivant.
The page kinda implied to anyone who doesn't know what they're talking about that this problem is there because someone "wrote a virus", not because MS shipped a product with bad security.
Meanwhile i want to know why microsoft is getting away with this. Despite the fact that a piece of HTML running an activex (or any other kind of applet or script or anything) that can TOUCH your hard drive, much less install, say, Backorifice (or a program that downloads and installs backorifice..) is to me the most terrifying thing a web browser could do. And yet what kind of attention has this little exploit gotten in the couple of months since it's been found? NOTHING. There was like one article on PCWeek months ago and that was IT.
You can, of course, put activex on high, or even disable it, but that shouldn't be _neccicary_. Something like activex that allows something like this SHOULD NOT BE RUNNING BY DEFAULT, since it targets people who don't know enough about their computers to go to the bother of understanding what this "activex" thing that MS put on their computers along with windows is. Let things like this, or the little "feature" that let remote web pages view the contents of your copy/paste clipboard, be turned _off_ until the user needs to use them, not left on until the user finds out they're there? Even if in theory ActiveX had perfect security in every way, i still don't like the idea of a web page touching anything on your hard disk besides your cache. (but then, hell, i'm also an old-timey purist who doesn't think an interpreted language like Javascript should contain things that are reliably able to crash the machine of the person who runs them.. but that's another rant altogether. "while(1)alert('!')"..)
How is MS getting _away_ with this? They should be in HUGE trouble for this whole activex thing; this is the most pathetic/deadly security exploit i think i've ever heard of. Yet they're barely getting any attention for it. WHY is this happening?
Still i think it's awful funny that apparently the _only_ use for ActiveX-- at least, the only time i've ever heard of someone doing anything with ActiveX-- is a security exploit.
-mcc-baka
why web browsers suck: http://home.earthlink.net/~mcclure111/cyberleary.
Irritable, left-wing and possibly humorous bumper stickers and t-shirts
Win9x WinNT
Information is here.
I really should rant about how hypocritical and ignorant most of the posts here are, but I don't have the energy. How about checking to see whether MS has already fixed the bug, before you complain about the lack of a solution?
Now, if you want to bitch about MSNBC for sensationalizing this, that's another issue entirely...
MSK
Better yet, virri writers just need to create a ViralBasic virus that only triggers if you have "microsoft.com" in your e-mail address. If you do, then you loose all *.doc, *.ppt, *.htm, *.c, *.h, and *.cpp files followed by writing random garbage to the registry:) If one could figure out a way to make swiss cheese out of the FAT, it would be even better:)
"I think this story was sent down from heaven to give us Linux users a chance to gloat over windows users," is the gist of the few messages posted so far. I don't really think we should have that attitude at all. We need to understand that there are [l]users out there who think HTML email is really neat, the same way I think that the new kernel debugging features are cool. We have to understand that our tastes in all things computers are not absolute. So Microsoft f***ed it up yet again; all companies do it. One of the reasons linux has been so secure and powerful is the foundation for it's design: UNIX. Windows is much younger than UNIX. And anyway, UNIX had it's virus/security problems a (not so)long time ago. The Worm anyone?
All computer systems have security holes. Complex ones more so. If you want some more rhetoric on why secuity is never perfect, read Bruce Schneier's interview here.
I think Microsoft was rash in releasing software with this little hole in it, but it doesn't mean that we're better than users of HTML email. Besides, all of Microsoft's really good OS people are on NT(Win2000) which doesn't have this particular problem. Microsoft doesn't really take the security of Win9x seriously anyway.
I personally am waiting to see how linux stacks up to Win2000. After all, this is like comparing the newest NT to version 2.0.36(my first kernel!).
/bye
Yes, I'm still a junky. Are you still a bitch?
is anyone else starting to see a pattern here?
tons of corporate places have hundreds of computers running windows9x. and probably using IE along with outlook express. why is this? because it is the easiest way. the point and click enviorment.
this sort of "non-negotiable" enviorment is sort of dangerous. there are most likely tons of unknown holes (dare i say even a backdoor or two) in the windows operating systems.
how many hours of downtime does a place need to have before they realize windows isnt the way to go? thats one of those impossible to answer questions, obviously they have seen enough yet.
tyler
Heck, if Bill Gates had a nickel for every security hole, bug, and crappy design that company has shipped.... oh wait... never mind. He does.
Don't give me crap about linux being more secure than windows. Everything can be hacked to shreds. If you are at all up to date with your security updates you will realize that there were multiple new remote root exploits for linux that were discovered last month. That's pretty bad. At least with windows everybody is so stupid they don't know how to exploit this stuff. :)
Why not take your racist comments else where.
By default Eudora Pro 4.0 uses Microsofts email viewer.
Turn it off by going to the 'Tools' menu
Selecting 'Options...'
Then 'Viewing Mail'
And unchecking 'Use Microsoft's viewer'
Having had a few weeks to play with Windows 2000, this type of exploit is going to become very dangerous, very quickly. Of great concern to me, as I must use WinNT for work, is the conversion of key OS utilities into COM servers they are calling "Snap-Ins."
When I set up my partition for testing this new OS, I needed to isolate my important partitions from the new OS. A utility called Disk Administrator (innovative name, no?) was standalone in NT4. In Win2000 it now runs as a COM service through the Control Panel which runs in Explorer, which equals IE [this utility is a GUI equivalent of Disk Druid]. With the scripting host is built in, and with Microsoft carefree attitude toward security, and the fact that if you use IE the browser detection from some web sites require you to enable ActiveX controls, means that I am feeling very vulnerable to the whims of whatever gets thrown out into the world next by the more clever script kiddies who will improve on this attack and find more security holes. Am I going to stumble on a site which will end up deleting all the partitions on my hard drive? I have no idea. If I were a cracker this would be the apex of virii.
While I understand the desire to script the OS, MS has a responsibility to isolate the world from my system (or maybe they don't with the new uniform legislation).
I have to use their OS, but I think I'll stick with NT4 and NS 3.02.
...bendawg is simply trying to check his understanding...
t ant_to_the_system"); a y");
"Answer me this question: do you need root privileges to create or delete files?"
Irrelevant to the original post. The logic goes something like...
if (user.name == "root"){
program.delete("/usr/bin/something_really_impor
}else if (user.name == "Joe Luser"){
program.delete("/home/stuff_he_didn't_need_anyw
}else{
program.delete("nothing_because_it_can't_run");
}
It just doesn't seem to have come out that way. Be nice to germinating thoughts and you may find that they eventually germinate into really good insights...
In any event, yes *nix is a better designed system. But, if you have Joe Luser reading his mail as root, the system is just as vulnerable to attack as any Win* system.
censorship is a form of noise, which actively seeks to drown out content with silence - Crash Culligan
Otherwise, someone is going to figure out how modify it RSN, and release a really bad virus to the wild, disabling 5-15% of all home computers.
The shareholder is always right.
The article states that the 'Windows Scripting Host' is the cause of this vulnerability. It seems to me that if this were caused by a buffer overflow error that it should have been implemented with the buffer checks (of course). But perhaps a more fundamental problem might be that instead of using the buffer checks, why not use some sort of String class (assuming C++). I know that the MFC CString class is horrid, but wouldn't a String class as such kill the problem of a buffer overflow outright?
If it wasn't a buffer overflow exploit, then wouldn't something like the Java sandbox or the ActiveX equivalent be appropriate?
It seems to me that networking software should be implemented in a way that puts security over performance.
That MS makes things too powerful that don't need to be. ActiveX, MSOffice Macros...etc. And because MS embeds IE into the OS, your browser can affect the rest of your computer. Microsoft counters this by putting in warnings like "you may get a virus...etc" so that it isn't really their fault if you run these scripts on their page. But users want to see the cool dancing mouse pointer, so they will usually trust the website. Since Outlook automatically uses IE to render HTML email, people now have a way to be sure that the user views the page. That's pretty much the way it is with most MS software now, a bug in one that may be minor affects a whole bunch of others. Even the fix may set off something strange.
You don't need security flaws like the one mentioned in the article in order to compromise a machine. Simply write a small HTML file which uses javascript or vbscript to do the following:
1. Open the c:\autoexec.bat file for reading
2. Write "echo Updating configuration - please wait" to the file
3. Write "format c:" to the file
Voila!
You need to use the scripting engine to access the file, which will give the user a prompt "scripting may be unsafe, etc.". So, maybe the user elects not to enable scripting, in which case they're safe. Maybe, the user decides to click OK, in which case the next time they reboot (being Windows, that's not too far away
The point is: as always, security issues come down to the user. If users can recieve email with inappropriate content, that inappropriate content can end up being executed. The only real way to stop this kind of thing is by identifying it before it gets to the mail client.
This is a security bug, and one that's easily fixed. It's a BUG. Has netscape had security bugs before????? Huh? The reason people move to IE is cause it's faster and more stable. What would you rather have huh? A browser that WORKS and supports more web standards, and one that is written in software and has potential bugs. Or a browser that's bug ridden, only works *sometimes*, tends to bring processor performance down, hogs memory and cpu, forces the UNIVERISTY you go to to limit the amount of processing time netscape can have on all the workstations, and has it's own set of security bugs and potential security problems? God damn you're so lame.
I download the fix, and it's something like three megs. Right off the bat, the size seems a little excessive. (That's completely irrelevant, but it irked me nonetheless.) I fire it up, and I'm presented with three options.
Am I stupid or is there not a goddamn option to apply the patch? I mean, sure, I use Windows NT but I'm not that dumb. Really.
Maybe someone can clarify? Thanks.
-jay
The problem with filtering spam is that any filtering scheme you can come up with can be defeated, since people are smarter than filters. You'd then have to be in a constant arms race with spammers to update your filtering scheme as they find new ways to circumvent it.
After all, once a spammer notices that they're being filtered, then can just look at the filtering software themselves and design a way around it.
Effective filtering email for spam will simply not be possible in the forseeable future.. at least maybe until we have some sort of really adaptable AI doing the filtering. (And even then, we'd still be in an arms race as spammers find ways around the latest AI..)
I don't have any solution for eliminating spam; I think spam is here to stay. I think, though, that you can MINIMIZE spam by keeping your real primary email address from sitting out on the internet in too many places.
As for filtering, I know I'd rather risk the few spams I get than risk have my filtering software accidentally filter something I actually want.
erm, that should have been 'open for writing', obviously...
- So? - So what? - Did he get off? Great movie.
Goto Tools|options select the security tab and select to use the restricted zone and set the restricted zone security settings to not do anything with active scripting etc. This is a good idea anyway, you don't lose any real functionality from it as a mail and news reader.
-------- This space intentionally left blank --------
There was an error in logic in this article. It assumed that just because the virus did not specifically delete files that it didn't destroy data. The virus targetted us (the sysadmins) not the users because it was aimed at the servers. In the small department that I worked, if melissa would have broke out in full force it could have easily overloaded our poor overburdened mail server. Considering the importance of immediate information sharing, bringing the mail server down is just as good as destroying data.
If this was cross-mail-reader than, yeah, it would *not* be another email virus. But its just Outlook users and, specificaly, more problems with ActiveX. Its devlish in the way that it blows right past the 'don't open attached crap' mantra, but at the same time security minded people wouldn't be using OE in the first place.
Is there a sweeter way to learn proper security than by having all hell break loose? MS is doing the public a favor by proving itself to be asleep at the wheel when it comes to security, but forced to inform people on how virii work and what precautions to take.
If anything it'll make x amount of people go "My data is too valuable for MS to screw around with," and switch to a secure mailer.
I'm hoping MS's vision of putting ActiveX+HTML EVERYWHERE vision is dead.
What MS has failed to realized is by putting a scripting ability into Outlook, and running code that can come from anywhere and affect the system is worse than running code by buffer overflow. It's allowing easy execution of random code. Joe shmoe could have done this, but guess what, he has.
It's worse than the javascript actionlisteners that exist that disallow you from closing windows or clicking other links. If IE didn't allow opening of files, I would say leave it in, but if it can connect to random places and do random things... BAD.. NONONOO.. It should follow java rules that java should follow.. well.. at least try to.
---
-
ping -f 255.255.255.255 # if only
My LAN and works use IMAPD on Linux and Netscape -- just another funny story we can laugh at for using IE/Exchange
How do you deploy a company wide mailing about this without infecting your company? Just curious. *grin*
-sporty
---
-
ping -f 255.255.255.255 # if only
Security is going to be big in the next decade as people start to realize it's important. That may only happen after some bank loses a few billion dollars or some terrorist group shuts down the power grid for a few days. It'll take some major disaster, and then security will be in vogue over night. Anyone want to start a security company?
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
Even scarier would be virii embedded in discussion board websites. Say for example, I embedded an HTML virus in this reply! (I haven't :-). I'm pretty sure most discussion boards filter out HTML.. but the readers are taking it on trust.
Also, what a new browser comes out supporting new HTML tags? If the web server is older than the browser you are using, those new tags may not be recognised by the web site as valid HTML... and therefore not filtered.
I wish it were so. Ones you get a worm, it sends mail to people in your address book--- for example: your mom or your coworkers. These are the very people who are unlikely to have filtered mail from you (or your impersonator).
Fortunately, my mom dumps all my email unread and unopened. ;^)
-Henry
I clicked on this and now my Linux system has a start button! What do I do?
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
I do not need to be inundated with the problems of the netherworld of MS Windows users. Since I run Solaris, the most reliable, scalable OS on the planet, I need not be bothered with such mindless drivel! Out with the post!
It's not a security issu ewith the OS, it's the way that MicroSoft has tied its email programs so tightly to the OS.
I use Windows 98(lite) and Netscape. Am I at risk? Yes, but NEARLY as high as if I was using IE or Outlook.
Boobies never hurt anyone. - Sherry Glaser.
silvio's going to shoot me for putting this up on .
slashdot. however, for those interested in virus
development upon unix, have a look at unix-virus.beergrave.net
it's mainly dealt with linux and freebsd techniques,
however sparc/solaris has been discussed. The charter
has recently been revised, so it now includes worms as well
as viruses.
check out virus.beergrave.net, or send a message to majordomo@virus.beergrave.net with 'subscribe unix-virus' in the body
"Hope is the denial of reality, it is the carrot dangled before the draft horse in a vain attempt to reach it" - Raistl
other then "stupid nigga" i would say the same thing but if guy was ghetto he would know that "nigger" is a racist term, "nigga" is a partner in crime.
This guy seam to be what would be called a "wigger" or a white person thinking thier black to fit in. He is also a fool.
So many people are advocating Pine, Elm, Mutt, and the other Unix mail clients. I think we've all forgotten that these clients are just as susceptable to viruses and malicious code execution. I would like to propose an alternative:
/var/spool/mail/username |more
cat
This wonderful method of reading mail will allow you to view your messages without ever having to worry about viruses or evil code execution. Both cat and more handle MIME types in the correct way, by completely ignoring them.
Those that do receive attachments can always use uudecode or hexbin to retrieve the original file. Of course, you're on your own at that point.
This just shows that security by obscurity does not work. This incident proves some basic things about handling any computer connected to the net:
- any OS or application might have security holes, hence security patches have to be installed on a regular basis (this also totally invalidates the hackpcweek security test)
- therefore it is obviusly in the interest of the users to find security holes fast
- an open source system reviewed by a large userbase for possible exploits, along with the practice of making such exploits and the countermeasures known, thus provides a good instrument to enhance security.
- on the contrary obscure applications can result in security holes known to a select few illmeaning individuals (while a patch for this exploit exists i understand that it is not known how exactly this exploit works.)
- also obscurity results in users/administrators lacking necessary knowledge about the system, in contrast to a well documented system where security holes can often be patched temporarily by simply turning off the exploited component
- furthermore an open source system makes it nearly impossible for illmeaning programmers to install backdoors for later exploits
In short: for well documented open source software you can expect a higher level of security due to better educated users and quick responses to exploits. Thus exploits will have a much smaller time window in which they work.
An other main issue here is the widespread distribution of windows (complete with IE), making it an ideal target for exploits. It is a very old rule, that heterogeneuos environments are generally more robust and thus healthier.
"By the way if anyone here is in advertising or marketing... kill yourself." -- Bill Hicks
I was asked, and I should probably know.... is it possible to scan incomming mail on the spooler for virii? I've heard of M$ Mail Server apps that could do this, but it's never been high profile in the UN*X world, near as I can tell. Anyone done this, had any experiences, etc?
"A child of five could understand this! Fetch me a child of five." -Groucho Marx
Um, how about ASKING the user if they REALLY want to send all of those emails??? Web pages can't do any real damage by themselves (except by replicating), unless of course they use java to do something nasty.
I have heard time and time again from Linux users how they HATE when an OS asks those sort of questions "Do you really want to do this?". In fact, they often use this in conjunction with "That's why I use Linux".
Now you're saying that it should ask MORE questions?
- A.P.
--
"One World, one Web, one Program" - Microsoft promotional ad
"Remember when the U.S. had a drug problem, and then we declared a War On Drugs, and now you can't buy drugs anymore?"
There comes a point where blaming the victim starts to actually make logical sense. How many more times do things like this have to happen before you just want to throw up your hands and shout, "Well, what the hell did you expect?!?" Microsoft users can keep desperately trying to dodge responsibility for their decision, but sooner or later, the boss is going to look at the "nobody ever got fired for buying Microsoft" saying and wonder if he should keep accepting the same old tired excuses.
There's only so many times teacher can hear "The dog ate my homework" before she tells the kid, "Keep your homework away from the dog if you don't want repeat 2nd grade."
Forget what Monty Burns said. Fire the idiots!
So far NAI seems to be the only people that have it and it isn't in the wild. So, it seems to me the media is once again being played like a cheap saxophone. If someone does actually have it, send it to me at trojans@moosoft.com so it can but put in a real anti-trojan scanner.
That's a good idea, but it doesn't work. That setting is simply to change the default format of outgoing mail... if you reply to someone who wrote an HTML message, the reply is still in HTML format unless you explicitly change the format to Text in that message window.
/. user had a good idea:
Some other
Open Outlook
From the menu go to Tools | Options
Click on Security
Change the Zone to "Restricted sites"
Click OK
That will keep HTML formatting in tact and turn off script processing (set the security for incoming mail to HIGH).
The judge in the Microsoft case ruled that the benefits of bundling IE into Win98 could have been achieved by having them as separate programs. He also ruled that there were disadvantages to consumers for bundling (he cited slower performance for users who wanted to use Netscape).
But this is a big-time disadvantage. Since IE5.0 is automatically installed on my Win98 machines (and is not listed in the Remove Programs list), I cannot turn my IE security settings to "high" without disabling some web sites in Netscape Communicator.
Eternal vigilance only works if you look in every direction.
This virus won't, because it's written that way. However, avoiding this virus is not an issue because it has never occurred in the wild, and judging by the AV companies' reports, probably never will.
But, according to MS's patch at:
http://support.micro soft.com/support/kb/articles/q240/3/08.asp,
WinNT running IE5 is susceptible to this problem and there is no reason a new email or web page designed to do so could not exploit this.
Am I wrong?
I hope so because I'm using NT4IE5 right here at work.
Ah yes, I'll just change th... oh. I can't. Admin has disabled the Internet Options menu entry, and the Control Panel version crashes. Marvellous. Hooray for Pok^H^H^H MS.
--
This comment was brought to you by And Clover.
I have a feeling the media's gonna have fun distorting this one. I read the article at school, get into the car, turn on the radio, and what do I hear? '...this new virus that will affect your computer even if you don't open the e-mail it was sent with is called "Bubbleboy"'.
*grumble*
There is one sure-fire way to control spam - the same mechanism that controls paper junk mail. Charge by volume for internet access.
After all, everyone knows that when yet another remote security hole for Linux is found, it won't get reported on Slashdot. Funny that, seeing how most of the people here seem to be Linux users and would have the greatest need to know. But hey, as far as you're concerned, there have been no rootshell exploits for Linux, just exploits for Windows, so you're safe.
Kudos to Slashdot for blaring a warning about an exploit that hasn't been seen in the wild, reported by an Anti-Virus firm, and that can only work on computers that haven't been updated by a patch released three months ago. Job well done, boys!
And to think that Katz has the stones to bitch about the mainstream media overhyping stories...
Cheers,
ZicoKnows@hotmail.com
MSNBC's (read as: BillG's) article is dancing around the point and is just a tad bit misleading, IMHO. :)
The article does admit that this problem is due to a specific bug in ActiveX -- NOT because of some general vulnerability in emails. It's not different than any internet exploit which crackers can use to hack into machines, bluescreen them or spread worms... Without the bug, there wouldn't have been any problem. It's just a coincidence that this time the bug allowed the worm to penetrate through HTML mail rather than an open vulnurable port or a defective browser. The article doesn't bother to make it clear how vulnurable are OTHER mailers. In fact, it mentions a very specific configuration required to have the worm effective, but mentions Eudora as a vulnerability.
Yet the article talks little about ActiveX being responsible and turns to throw the blame on the entire internet, in effect. I'd guess they hope that since the blame is so general, the already-desensitized world would take it lightly... If they admitted MS responsibility in this users might've started to notice this is not the first MS-specific security problem for the past few months alone and might've chosen a different mailer. Like Eudora.
Nice to see them fix it fast though
Yes, at least one version of Turnpike, as packaged
by Demon Internet, uses IE to view HTML.
perl -e 'fork||print for split//,"hahahaha"'
Everyone says "well, you have to keep up with your patches". OK. I accept that.
Windows 98 warned me a MONTH ago I needed to do a security update, all on it's own, it took two mouse cliks to review the updates, select the ones I wanted and install them.
All done, and the bug that this virus exploits was closed in early September.
I hate to tell you, but this is not an MS problem, the updates are easy, the system WARNS you when you need one, and the patch was out long before there was an exploit.
Sounds like good work to me.
You don't delete anything. That's trivial to recover from. You change a letter here, a word there.
how can you have linuz warez when its all free anyway? dumb honkey-boi
>if (user.name == "root"){n t_to_the_system"); " );
/usr/bin (which I can easily reinstall from the .debs), or /root (which has nothing of value in it anyway), than $HOME, which is where I actually do things of (questionable :P) value. Yes, I know, running as root I could just as easily lose the entire /home, but if the program has the logic you describe, I think I'd rather run it as root in my personal situation. And I don't think I'm the only one in a similar situation. When push comes to shove, on your average person's computer, their personal data files that they put hours of work into are far more valuable than programs which can just be reinstalled in a few minutes.
:)
> program.delete("/usr/bin/something_really_importa
>}else if (user.name == "Joe Luser"){
> program.delete("/home/stuff_he_didn't_need_anyway
>}else{
> program.delete("nothing_because_it_can't_run");
>}
Well, I agree *nix is a better designed system.
However...
On my linux machine, I'd much rather lose
So when it comes to nasty programs, I don't really think the fact that emacs (or word, or whatever) still runs is much consolation to someone who's just lost their precious work (at least since their last backup).
- thandor
"Now watch what you say or they'll be calling you a radical, liberal, fanatical, criminal." - Supertramp, The Logical So
I always thought that the plural of 'virus' was 'viruses'. But then, I also think that the plural of 'box' is 'boxes', so what do I know?
Allowing fully-fledged OS-dependent executables to be embedded in web pages (i.e. ActiveX controls) is clearly idiotic. Allowing those executables to run _as the current user_ is still more idiotic. In the end, you wind up with three accounts just for one person - one Admin, one User and one Web Browsing - the Web Browsing one being little more than Guest, since it's the only way to stop things breaking your PC!
Things are made worse by the "Trust this content?" dialog. Oh, yes, hang on! It has a lovely bitmap that looks like a security seal! It MUST be trustworthy and authentic!
Finally, in defence of Windows NT, I'd like to point out that it has a very good security architecture, which is flexible and actually quite straightforward once you're used to it. What makes it so useless is that standard NT never actually sets the security on the OS! After a base install, any user can go in and remove Program Files or erase various fundamental bits of the OS, unless an Admin painstakingly sets all the permissions.
Of course, anyone who has ever installed the Zero Administration Kit knows why they've made things that way - the moment you make the OS directories secure, Microsoft's products won't run on it.
Yet again,the Linux community shines through with such profound comments like this.
Lost Carrier
Lost Carrier
http://www.geekboys.org
This doesn't force messages to display properly. All it does is causes your messages to default correctly. Now, why couldn't that be the default?
Gates' Law: Every 18 months, the speed of software halves.
This would scare me if I used IE5.0 because I don't like the idea of untrusted websites being able to run native code on my computer. At least with Java and Javascript they run in a sandbox of sorts (although one of the two can core dump Netscape). ActiveX needs to die as an interesting, but flawed experiment.
I like html formatted mail, they are nice and they make it easier for me to format stuff. Sure I can use ascii formatting, I ususlly *use* ascii formatting but even so a little html tag can guarantee (almost) that, for example, the recipient reads my ascii formatted table in a fixed width font.
All opinions are my own - until criticized
Under the general tab hit the Add-In Manager and uncheck the selection for Server scripting, the remove button should then ungrey, allowing deinstallation of server scripting.
I sure as hell don't see a need for scripts to be running in my email, some porn spammer will use it to pop up adverts on me. Rift
(3) Reject all mail not sent to one of my mail accounts explicitly or that does not come from a mailing list I'm subscribed to.
If you want, that mail can be shuffled off to a "Spam" mail box just in case the filter gets a false positive.
I used to do what you have listed as rule #2. I stopped after I noticed that procmail had to be constantly tweaked to avoid getting a block of spam or (valid) email would get killed. Your rule #1 is necessary to avoid loosing mail from friends who discover mailing lists.
There are a number of reasons this won't work:
2.Charging a few cents for each email will make me pay a few bucks a month, which I wouldn't like. Charging a very small amount per email will not produce effects, as it will only give the spammer a bill of a few hundred dollars (provided that the correct person is billed at all - see #1). considering the amount of money spam brings in (yes, sadly, this is still true), a few hundred dollars is nothing compared to the profits.
but - what if the small charge for email was not to the ISP but instead to the receiver of the email (with maybe an even smaller percentage commisison to the ISP)?
then you would be paid for receiving spam (as you should be) whilst if you were corresponding with a friend/relative/contact, the charges would tend to cancel out over time.
we need cybercurrency. yesterday.
ohwell.
What I can't understand is why mail readers have to support every HTML tag to begin with. Sure, there are some advantages to formatted email, but why on earth would you need to embed Java/JavaScript/ActiveX/etc. in an email message? What possible utility could come from doing this? And even if you could come up with a good reason, wouldn't a few decent uses for the technology be less important than huge gaping security holes like this?
This isn't a problem related to just email, either -- eBay has (or had a few months ago, anyway) a similar vulnerability, because it allows users to embed HTML into descriptions of their items for sale. Because they allow any HTML tag, this opens the door for malicious, active code to be embedded into an auction item; the best-known example of this is the eBayla bug, which uses javascript to steal passwords from people browsing your auction.
IMHO, the right course for any product that wants to support HTML that isn't a Web browser is to support a subset of HTML -- like Slashdot does for posting "HTML Formatted" posts. Allow people to add harmless formatting tags such as B, A, or BLOCKQUOTE, but ignore tags such as EMBED or SCRIPT. This may ruin the day of anyone who's implementing a Java-based accounting package with an e-mail interface, but it would make life substantially nicer for all the rest of us.
-- Jason A. Lefkowitz
Read my blog.
I have been reading the various news reports and it absolutely pisses me off that they are saying "you don't even have to open it". WTF do they think is happening in the "preview pane"? Outlook OPENS the message so it can be displayed. The "preview pane" is an absolutely moronic device, and I have always had it shut off (View | Layout and uncheck Preview Pane). If I want to read something I double click and manually open it in its own window. This is sad. Why don't tech writers write plainly about what is going on? All this is, is another display of fundamental computer security ignorance on M$ part. Outlook Express automatically opens each message and displays a few lines in the preview pane as you scroll the list.
======
"Rex unto my cleeb, and thou shalt have everlasting blort." - Zorp 3:16
Sacred cows make the best burgers.
The only viruses we've heard about over the last two years or so, are ones that exploit Microsoft software. And not on the OS level either, these things just crawl in thru security holes in applications. Of course, saying this on slashdot is preaching to the converted, but...
Why is there not a public backlash? Why isn't the media down Gates' throat over this? Why is there no bad press? Is the FUD really that good? Has Microsoft brainwashed people to such an extent that only the people writing the virii are in the wrong?
Certainly, the thief in the night is to blame for the theft. But if the company that makes your windows doesn't provide a means of keeping them closed...
Ahh, I know it, you know it... Moderate down for Redundancy... It just frustrates me to no end that M$ is shirking its responsibility to make a secure product. Good thing I don't use IE... Heh!
-- What you do today will cost you a day of your life.
Kramer worm: Enters and leaves system randomly at own volition, pilfering files and leaving others strewn around open.
/var or /temp directory, and frequently thwarts itself. George is the product of the merging of two equally dysfunctional parent worms.
Newman virus: The newman virus compromises sendmail and pop services. Every once in a while something bad will happen unexpectedly...this will be due to Newman.
George worm: George is pretty much harmless. It often gorges on files in the
It's 10 PM. Do you know if you're un-American?
Aside from Symantec and Network Associates both having updates that protect against this, and aside from Microsoft having a patch that protects against us, there are two more possibilities: Either set the security settings in outlook to "restrictive", or for the really paranoid among us, simply look through windows\startmenu\programs\startup\ before shutting down, and get rid on anything you don't want. THis won't beat us die-hard MS users if we don't want it to...
Than solaris.
Microsoft is the clear Leader in the exciting new world of Open Computing. If you install Micro- Soft products on your computer, your computer is completely Open. To anyone. It is wonderfull to see a company so trusting of its fellow man. And it would be a shame to see the Justice Department do anything to hamper Microsofts move to free the world from secrets.
If we define a Trojan Horse as a program which appears to do one thing -- perhaps productive, perhaps not -- and actually does something else, such as breach the heck out of your system security, could it not be argued that Windows, Internet Explorer and Outlook could be catagorized as Trojan Horses?
Just a thought.
Nick.
These type of worms/whatever are aimed more at your average computer user who knows nothing about security, or active X, or changing settings for their mail reader. Most people who purchase a computer are thinking "internet" "email"... they don't have a clue about how any of it works. I'm not saying that this is bad, just these people have a different mindset than your average slashdot reader.
To blame MS for shipping products with security holes is the easy way out, it's true they share the blame, but we can't ignore the fact that your average consumer is purchasing a very complex machine and they have zero understanding as to how to secure it. A computer is not like a toaster but your average person tends to view it that way.
Actually, you can delete it without selecting it. Outlook Express stores all mail in plaintext format. If you have to run this program under Win98/2000 like I do at work, you might have to deal with it, though the article says this worm is not known to be out in the wild right now. If you see a message entitled "Bubbleboy is Back!" appear in your mailbox, and you are running a vulnerable client, do the following:
Or, you can do like the article suggests, and get the patch, or just set your security to high. I still wouldn't trust it though.
Communication is only possible between equals
They have all the damn market share!!!! If your going to stay up all night designing a worm/virus/whatever/ - you will focus on the market leader. Yes - MS leaves gaping security holes in the name of user friendliness all the time - but I believe Netscape and most other commerical applications have just as many holes. Its just that nobody cares enough about Netscape to bother trying to exploit their applications.
:)
I use IE5 on my windows box because it is a far better browser than the current rev of Netscape. I use OE5 because it came with the browser and my wife likes it... But I turned off Java, turned off ActiveX and am slowly building my listed of trusted sites so I can run the Internet Zone is high security all the time. Part of this is the users - read the damn manual and look at the option for God's sake! I'll bet 1/2 of all IE users have NEVER even looked at the user options on brower or email. As somebody's sig says - in any large group of people, most of them are idiots. Guess what - IE users are a large group of people. I count myself in that minority group of non-idiots though
Chris
Please, for the good of the earth, see a psychiatrist, or keep yourself locked up away from technology.
Thanks.
When I found out about WSH earlier this year, I thought it was the best thing since sliced bread. And as soon as I found out you could slap a COM interface onto a JS file, it just went neat from there. Sad thing is, there wan't much use for it after the initial "oooooh" and "ahhhh". Although, I am still waiting for the change to use dynamic code generation... as soon as I find something of value to use it on.
Well, send email as you like. But any email I receive that is in HTML (or sent as an attachment) gets the R key (I run Pine, R replies, and HTML looks like line noise). I send them:
Sorry, I didn't read your message. The HTML/attachment method makes it unreadable. Please reformat it into the email standard, ASCII.
Thanks
Pretty simple really, if you want to talk to me, you have to speak a universal language. I dismiss HTML the same way I would dismiss someone talking to me in Swahilli with "In english, please" (I can't speak Swahili). Unless, of course, I was living somewhere where Swahili is spoken as the universal language. Where I am now (Canada) English or French is the standard.
A simple way of keeping most of those little evil things out of your life is to keep most things "incompatible" with the rest. Never use windows with IE or Outlook express. Use Netscape or Eudora. Don't use Windows if you don't have to. Simple huh? :)
--
"I'm surfin the dead zone
In the twilight, unknown"
If it weren't for him nobody would have realized that programs==data.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
At work: Win95 (not by choice) Win3.1 for some ancient stuff At home: WfW3.11 for some ancient stuff OS/2 Warp Connect (v3) NT4 Workstation Linux HP-UX 10.20 (maybe a *BSD soon, too)
The virus actually takes advantage of a security flaw in Microsoft's ActiveX technology that was discovered in August.
August?!? AUGUST! Why the hell wasn't a patch to repair the error relased in August then? When a monopoly has no competition, they have no motivation to repair errors until they become huge issues for their software....
Sloooow Down. A Patch was released, and has been available on windows update as a "critical update" for some time now. I've installed it, as has anyone who checks windows update with any regularity.
-------------
The following sentence is true.
The following sentence is true. The preceding sentence was false.
'nuff said
'nuff said
-Seth
I use Eudora Lite 1.5.2, circa 1993. Windows 3.1 application. It suits my purposes just fine. :)
I also used mIRC 4.x until about two weeks ago, and Netscape 3 for an eternity. I recently picked up IE5, though.
It just proves that it's dangerous to adopt new versions of programs too soon. Hopefully with several years of buffer time to let all those bugs get worked out.
Eudora Lite 1.5.2 forever!
This is a problem that could affect everyone.
:) ), only he included an explanation in the mail text, and limited the forwarding to a fixed list of 20 addresses.
All someone has to do, is write an email that when activated, forwards itself to everyone in your address book. When they recieve it, it is then forwarded on again to all those in the next users; address book, and so on.
The success rate in each individual case will be high (>50%), given how many people use Outlook and don't fix the security.
People won't even know that they've been infected, until their friends complain about the email, and they ask 'what email?'.
A friend of mine made a similar virus at IBM with Lotus Notes (everybody's favourite cross-platform mail client
It still took us the best part of a week to eradicate the 'Christmas!' email, because as soon as someone came back from holiday, the first thing they would do is read their email, and thus forward it on to everyone else yet again. The fact that it activated on preview also meant a fair number of accidental mouse-slips, even when people were aware of the problem.
With probably over 50% success rate at each stage, and the potential to multiply by the number of people in the average address book at each stage, such a virus/worm could easily overload mail servers everywhere.
An alternative way would be to grab email addresses from all the messages currently in the inbox.
What would be too cool is if we could impliment multiuser into a single user environment - have a non-root but master account where you run your desktop from and have different apps in their own account but accessable from the master account. You open Netscape which has only "netscape" priviledges, read your email and poof a virus attacks. But rather than raping your computer or your $home dir, it can only ravage your "netscape" account. What would be so hard about implimenting something like that? We'd need that kind of accessibility and security if Linux is ever to succeed in the desktop market (if that's indeed what we want Linux to do). Maybe I'll start hacking some code and see what I come up with - but I'm sure there are a lot of more qualified programmers out there that can do better...
Since when do we have a security hole in linux that compromised the system with the simple act of clicking a message? The problem with Microsoft is that their software is orders of magnitude less secure than any other OS on the face of earth.
What's next? Sneezing on your computer will infect it?
If you spam filter first and then send all the suspected spammers instructions on resending, your false positives go way down. Procmail is a good way to go in a unix environment, since there are a number of kill files floating around that do a good job of spam filtering. If you're interested, email me and I'll send you mine (the email address above is legit, incidentally I get very little spam that I can trace to slashdot postings, go figure).
--
"L'IT c'est moi!"
I think you want "format c: /y"
"Historically, as long as you don't open e-mail attachments you're safe from virus infection, but this changes all that,'' said Sal Viveros, a marketing manager at Network Associates. ''We've finally come to the point where if you're using e-mail, specifically (Microsoft Corp.'s) Outlook, you need to have some sort of virus protection or you shouldn't read e-mail."
precisely becoz microsoft creates software that fucking lets them.. why should consumers always suffers for their buggy "commercial" programs? i bet microsoft doesnt have ISO 9001 cerification. they do? aw shucks. mebbe they should just have 3 to 5 yrs of beta testing before releasing it.
Once again, I smile because I don't have this festering sore of Windoze on my desktop. unfortunately, half my fuqking networkin Win98/95. So guess who now has to waste some time this week updating the DAT files....AGAIN? Thanks, Bill, for continuing to release crap that is less secure than a broken window (no pun intended.).
maybe MS should crate a virus scanner which is a BUGS SCANNER in disguise.. theres too many of them..
I read on the Gnome site that they are working on (maybe finished now) a Registry for Gnome.
Do Gnome users need this, Will it open us up to the same problems windows has? Will our software just fail to work after install other software, and will Linux then develope Gnome Worms.
Imagine the evil, an e-mail that changes the Lilo default to boot windoze!
Tokyo Joe
http://kimihia.cjb.net/articl-asso rt-cookie.html
not that close to first post!!!!
put escape characters in subject lines, its neither a virus nor a worm but it is a pain. :)
:) Put that sequence in a text file at linux console and cat it. Now present that to a newbie. Result: ahh! what happened to my computer? Answer: nothing. But it looks like something did. :)
^[[2J^[1;1H^[[30m^[[40m^[12;7] should be a good sequence to scare someone.
OFTC: By the community, for the community
"Server Too Busy" Slashdot effect is comical at times...
I don't need anyone to escort me around the web. I don't let anyone run *anything* on my box unless there's a good reason and I have cause to trust the server/person sending it to me.
...you can get one of those for the Mac, too. It's called 'Eudora Light', doesn't even cost anything, and the settings dialogs (especially with the Esoteric Settings component) are the apex of lightly GUIed geekiness :) you can specify down to the pixel where new messages will open on the screen- who knew you could do this sort of thing on anything but Unix?
*shrug* dunno why anybody would _want_ to sound like a little kid, but whatever :)
I totally contest the notion that feature rich email is here to stay. Email is _WORDS_. There's no justification for damaging the ability for people to openly communicate just to add stuff that can more sensibly be done in another medium.
Email should be like the telephone- no matter how unpleasant somebody's words may be, they cannot cause your hard disk to erase itself. A telemarketer can try to get you to buy maple syrup, but cannot start pumping 10,000 gallons of maple syrup through the phone in case you want it. Email (and news, which is another story) _must_ be as safe and reasonable as the telephone. Having email be progressively less safe than the telephone is an incredibly bad precedent.
I remember when the Good Times email virus was a complete hoax, and nothing of the sort was possible. Many of you will be able to say the same- "Grandpa, tell us about when people could read email without danger!". As I see it, there is exactly _one_ vendor that has consistently, one could even say maliciously, obliterated this safety and put maybe 50% of the world (actual users of this new software) at risk. I welcome correction suggesting that Netscape HTML email is also to blame, but am not aware of any exploits remotely comparable to this new nightmare.
Forget the future, just for a second, and let's seriously consider how to progress without obliterating the benefits we used to have (that some of us still have, so far). What is so shocking about the idea of having certain basic technologies such as text email and text news remain utterly text? If you want features so badly, have the text scroll across a tickertape as the email comes in, or have it etched in neon letters on the desktop- but the written word is too important to throw away in the mad rush to meaningless features and bizarre activities done by the content in the name of improvements.
Here is a workaround for EE. Im sure MS will be posting this on their site soon.
When ever you get an Email do this:
1) DELETE THE EMAIL right away. Dont even preview it. Yes just reading an Email can fsck up you system.
or
2) TURN OFF YOUR PC and wait untill MS puts out a fix in service pack 345.5 (You will be able to download this 1.4G patch from microsoft.com or buy the low priced CD for only $99.99(US).
I have to return some videotapes...
A hundred years from now, some mathematician will find Black Parrot's comment, fail to figure out the answer, and name this conundrum "Black Parrot's Last Theorem". Mark my word.
"If one is really a superior person, the fact is likely to leak out without too much assistance" -- John Andrew Holmes
I say Tru64
Someone explain (please!) why a Trojan payload couldn't just throw up a fake BSOD, fake reboot, and fake login screen? "Active content" of all kinds is supposed to do that kind of screen manipulation, right? The main exploit is that people take sudden BSOD for granted.
Lacking <sarcasm> tags,
just for informational porposes eudora uses the ie engine is is not operable without it (eudora for windows 98). if you put that into place then you have only your netscape. but many clients do their own html rendering. and activex is so unused it's not even funny. ms uses it and that's about it. funny how they keep a spec that is basically defunct around.
/dev/null
activex = security >
dead angel
i am strange people. -me
spreading linux lovin' since 1998!
For the record, I've never sent a HTML mail. But that doesn't mean it isn't a good idea.
Standards progress. HTML mail should be the new standard. It's very simple.
What is holding up HTML mail are (1) the original styling problems I mentioned, (2) people still using recalcitrant mailers that don't support it yet ( possibly because of (1) ) and (3) the lack of any way to do content negotiation on email accounts and newsgroups.
Seriously, if you want to only support HTML 1 for web pages, GIFs for images and ASCII for email, that's your choice, but you're not going to stop progress.
This is an new exploit on an old problem that MS patched back in August. Go to Windows Update and apply the "scriptlet.typelib/Eyedog" Patch, problem solved. Stupid media, I wish people would do their research instead of creating unnecessary hysteria. As for Slashdot, well any excuse to bash MS.
MS fixed problem this months ago. New exploit, old bug. Go here for the fix.
This is yet another reason to run IBM OS/2 Warp. Big banks do. So be smart!
If I ever get a msg that is Bcc'd to me (which isn't as unoften as one might think), I wouldn't see it for a while. (Unless I check my spam box every day.. in which case I might as well just get the spam.)
Also, interestingly enough, most of the spam I get at my primary address actually have my email address in the headers...
*sigh*
I just checked, my email archive is about 4x my netscrape code size. I need to prune...
I did not know that. But on the other hand, I use eudora 3.0, so I need not worry anyway. ;)
--
"I'm surfin the dead zone
In the twilight, unknown"
I can beat it by one character:
main(){main(fork());}
(I found several ways to tie yours, but this was the only one that could beat it.)
main(){fork();fork();}
main(){fork();main();}
main(){for(;;)fork();}
main()(while(fork());}
/peter
Don't think the above will work, exactly. At least not create a fork bomb. fork() returns two different values - the parent receives the process ID of the child, the child receives 0. So, what will happen here? The parent will call fork(), a child process will be created. The child will have fork() return 0, so the while loop will terminate. The parent will infinitely keep creating children, but the chirldren will keep killing themselves. Fraid you got an infinite loop there, not a fork bomb.
Also am wondering about the first one:
main(){fork();fork();}
In fact, enter that, compile it, run it, and your program will terminate. :) A total of three children processes will be created, but only one of the three will create another child process, and it will only create one child process at that, which will not create its own child process.
Your other, two, however, look valid.
Happy Programming! :)
I could not justify my existence if I were a turkey farmer. Would I terminate myself? Undoubtably, yes.
Oops, you're right. The short one's still valid though. That's the one I was most proud of :)
/peter
main(){main(fork());}
Ok, So I'm going for the offtopic moderation, but hey.
Netscape's client did it first, or at least that's the first place Iv'e run into it. It was a response to MS's "Rich Text" option in (what was then) the Exchange Client which allowed such things as bold, itialics and colours.
On the bright side, at least Netscape had the decency to implement this feature using some kind of standard.
AND...
At least Netscape is realatively well sandboxed.
John.
If you're using Windows 98 or 2k, or have the Windows Scripting Host installed on any flavor of 95, then you're vulnerable using any mail client that can read HTML. That includes Eudora.