Full Disclosure mailing list archives
Re: AV "feature" does more DDoS than Sobig
From: 3APA3A <3APA3A () SECURITY NNOV RU>
Date: Thu, 28 Aug 2003 18:12:10 +0400
Dear Fabio Gomes de Souza, Few Russian security and Internet professionals who's mailboxes were flooded by AV reports signed an open letter to antiviral developers, administrators and users called "AntiViruses to ruin Internet?". It ends up with words "If we want to live here we must shut up all these robots". http://www.bugtraq.ru/library/security/antiantivirus.html (sorry, it's in Russian). It was published on few well-known sites. At least few huge mail services now do not generate AV reports to sender. May be it's a time to make same PR action worldwide. --Thursday, August 28, 2003, 5:05:20 PM, you wrote to bugtraq () securityfocus com: FGdS> Hello, FGdS> Anti-virus products are causing more harm than the Sobig Worm. FGdS> Some of my customers are having the following problem: FGdS> B = Customer of my customer (infected) FGdS> C,D,E = Some random company (victims of Sobig) FGdS> A = My customer (victim of AV marketing) FGdS> The Sobig worm infected B. FGdS> In its propagation loop, the worm composes a message, chooses two random FGdS> items in the Address Book, and puts the first in the "From:" and the FGdS> second in the "To:" header. Then all virus messages are spoofed. FGdS> The problem is that many e-mail virus scanners send a "You are infected" FGdS> reply to the address contained in the "From" header. Since the messages FGdS> are spoofed, the inoccent, uninfected user "A" is flooded by automatic FGdS> complaints from "C","D","E" regarding the virus that "B" sends. FGdS> Anti-virus companies seem to spend more money on marketing/visibility FGdS> than on actually protecting their customers. This marketing stupidity is FGdS> done by adding USELESS features, which spreads false information and FGdS> delivers false sense of security: FGdS> - "You're infected" reply (false positive) FGdS> - "This message is 100% virus-free certified" signature line (false FGdS> sense of security) FGdS> - Anti-virus buttons on Internet Explorer toolbar (just to launch the AV) FGdS> - Splash screens every time you: FGdS> - boot your computer FGdS> - send e-mail FGdS> - check pop3 e-mail FGdS> - turn your computer off FGdS> - System tray useless icons (in some AVs, the system tray icon does FGdS> nothing except for launching the AV program) FGdS> - Redundant shortcut icons in Desktop, Start Menu root, Quick Launch FGdS> and Start Menu program folder FGdS> This kind of stupidity from AV companies makes me hate them more every day. -- ~/ZARAZA Âïðî÷åì, âàæíåå âñåãî - àëãîðèòì! (Ëåì) _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- AV "feature" does more DDoS than Sobig Fabio Gomes de Souza (Aug 28)
- Re: AV "feature" does more DDoS than Sobig madsaxon (Aug 28)
- RE: AV "feature" does more DDoS than Sobig Richard M. Smith (Aug 28)
- Re: AV "feature" does more DDoS than Sobig William Warren (Aug 28)
- Re: AV "feature" does more DDoS than Sobig William Warren (Aug 28)
- Re: AV "feature" does more DDoS than Sobig Vladimir Parkhaev (Aug 28)
- Re: AV "feature" does more DDoS than Sobig James Greenhalgh (Aug 28)
- RE: AV "feature" does more DDoS than Sobig Steve Wray (Aug 28)
- Re: AV "feature" does more DDoS than Sobig Vladimir Parkhaev (Aug 28)
- Re: AV "feature" does more DDoS than Sobig 3APA3A (Aug 28)
- RE: AV "feature" does more DDoS than Sobig Richard M. Smith (Aug 28)
- Re: AV "feature" does more DDoS than Sobig Marcos Machado (Aug 28)
- RE: AV "feature" does more DDoS than Sobig Ron DuFresne (Aug 28)
- RE: AV "feature" does more DDoS than Sobig Richard M. Smith (Aug 28)
- RE: AV "feature" does more DDoS than Sobig Ron DuFresne (Aug 28)
- Re: AV "feature" does more DDoS than Sobig madsaxon (Aug 28)
- Re: AV "feature" does more DDoS than Sobig David Vasil (Aug 28)
- Re: AV "feature" does more DDoS than Sobig Darren Reed (Aug 28)
- <Possible follow-ups>
- RE: AV "feature" does more DDoS than Sobig Rainer Gerhards (Aug 28)
- RE: AV "feature" does more DDoS than Sobig Barrett, Rob (Aug 28)
- Re: AV "feature" does more DDoS than Sobig DStark (Aug 28)