Full Disclosure mailing list archives

Re: AV "feature" does more DDoS than Sobig


From: William Warren <hescominsoon () adelphia net>
Date: Thu, 28 Aug 2003 21:01:28 -0400

I meant if you are NOT on my whitelist...<that is what i get for not checking my mail before sending it..<G>..>


Steve Wray wrote:

I'm just going to snip out all the previous stuff
because really this isn't strictly following on from it, but is related.

*If* you are going to implement an AV system
on your servers to filter incoming mail for
viruses then you need to make sure that its
properly configured. Obviously.

And there are a *ton* of things to get right.

You are dealing with 'explosive material';
viruses, trojans and *other* files intended to
cause ill effect.

Now, I am going to attach a binary to this email.
Its only about 1.5K, thats not too big an attachment
is it?

Cool. Just don't try unpacking it unless you have over
20G of disk space available. Oh and that applies
to your email antivirus system as well.

You might want to check the AV spool space to make sure that
it properly cleaned up after discovering that there
was too much to decompress (assuming that they even bother
with bz2 compressed files; one can do a similar trick
with zip).

This file is created from about 20G of null characters.

I take no responsibility for any ill effects of
unpacking this file; you have been warned and besides its
a great opportunity to figure out a workaround.
Imagine if spammers started attaching these zip-bombs!
ewwwwww

Check the configuration of your AV, check every detail
and think about it; its a public service to the whole internet
not just your own users.


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html



--
May God Bless you and everything you touch.

My "foundation" verse:
Isaiah 54:17 No weapon that is formed against thee shall prosper; and every tongue that shall rise against thee in judgment thou shalt condemn. This is the heritage of the servants of the LORD, and their righteousness is of me, saith the LORD.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Current thread: