Full Disclosure mailing list archives
Re: AV "feature" does more DDoS than Sobig
From: William Warren <hescominsoon () adelphia net>
Date: Thu, 28 Aug 2003 21:01:28 -0400
I meant if you are NOT on my whitelist...<that is what i get for not checking my mail before sending it..<G>..>
Steve Wray wrote:I'm just going to snip out all the previous stuff because really this isn't strictly following on from it, but is related. *If* you are going to implement an AV system on your servers to filter incoming mail for viruses then you need to make sure that its properly configured. Obviously. And there are a *ton* of things to get right. You are dealing with 'explosive material'; viruses, trojans and *other* files intended to cause ill effect. Now, I am going to attach a binary to this email. Its only about 1.5K, thats not too big an attachment is it? Cool. Just don't try unpacking it unless you have over 20G of disk space available. Oh and that applies to your email antivirus system as well. You might want to check the AV spool space to make sure that it properly cleaned up after discovering that there was too much to decompress (assuming that they even bother with bz2 compressed files; one can do a similar trick with zip). This file is created from about 20G of null characters. I take no responsibility for any ill effects of unpacking this file; you have been warned and besides its a great opportunity to figure out a workaround. Imagine if spammers started attaching these zip-bombs! ewwwwww Check the configuration of your AV, check every detail and think about it; its a public service to the whole internet not just your own users. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
-- May God Bless you and everything you touch. My "foundation" verse:Isaiah 54:17 No weapon that is formed against thee shall prosper; and every tongue that shall rise against thee in judgment thou shalt condemn. This is the heritage of the servants of the LORD, and their righteousness is of me, saith the LORD.
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- RE: AV "feature" does more DDoS than Sobig, (continued)
- RE: AV "feature" does more DDoS than Sobig Richard M. Smith (Aug 28)
- RE: AV "feature" does more DDoS than Sobig Ron DuFresne (Aug 28)
- Re: AV "feature" does more DDoS than Sobig David Vasil (Aug 28)
- Re: AV "feature" does more DDoS than Sobig Darren Reed (Aug 28)
- RE: AV "feature" does more DDoS than Sobig Rainer Gerhards (Aug 28)
- RE: AV "feature" does more DDoS than Sobig Barrett, Rob (Aug 28)
- Re: AV "feature" does more DDoS than Sobig DStark (Aug 28)
- Re: AV "feature" does more DDoS than Sobig yossarian (Aug 28)
- RE: AV "feature" does more DDoS than Sobig Steve Wray (Aug 28)
- Re: AV "feature" does more DDoS than Sobig William Warren (Aug 28)
- Re: AV "feature" does more DDoS than Sobig William Warren (Aug 28)
- RE: AV "feature" does more DDoS than Sobig Steve Wray (Aug 28)