Full Disclosure mailing list archives
Re: Anti-MS drivel
From: Valdis.Kletnieks () vt edu
Date: Tue, 20 Jan 2004 02:54:44 -0500
On Mon, 19 Jan 2004 19:58:15 EST, "David F. Skoll" said:
It's pathetic that 17 years after CHRISTMA EXEC, hundreds of thousands of Windows machines are succumbing to the same easily-preventable security flaw.
What's even MORE pathetic is that even 17 years ago, CHRISTMA EXEC required for you *first* to receive the file from your "reader" space to your disk space, and *then* to invoke it as a command. So that's the equivalent of first saving an attachment from an e-mail into a directory, and then going and finding the file in the directory and launching it. At that point, there's not much you can do if you're going to allow attachments at ALL. (Also, IBM quickly released a set of patches against RSCS (the communications subsystem in use for VNET and Bitnet) that allowed filtering of filename/filetypes, with either quarantining or renaming of the files - so a site admin could make CHRISTMA EXEC end up being called CHRISTMA CEXE, which then wouldn't run unless the user manually renamed it back.) The other interesting thing was that although CHRISTMA EXEC went on quite the burn then (I should know, I was the admin of a VM system on Bitnet at the time ;), the user community *learned*, and although there were 5-6 subsequent copycat programs, they were nowhere near as widespread. However, today people will *still* click on unknown stuff.... Moral of the story - in the past 2 decades, the users have gotten stupider, and many of the software designers have as well.....
Attachment:
_bin
Description:
Current thread:
- Anti-MS drivel, (continued)
- Anti-MS drivel Edward W. Ray (Jan 17)
- Re: Anti-MS drivel Luca Mihailescu (Jan 17)
- RE: Help Net Security Dot Squatting ? the measly one (Jan 18)
- Re: Anti-MS drivel martin f krafft (Jan 22)
- Re: Anti-MS drivel Gregh (Jan 17)
- Re: Anti-MS drivel David F. Skoll (Jan 19)
- Re: Anti-MS drivel Gregh (Jan 19)
- Re: Anti-MS drivel David F. Skoll (Jan 20)
- Re: Anti-MS drivel Gregh (Jan 20)
- RE: Anti-MS drivel Dinis Cruz (Jan 19)
- Re: Anti-MS drivel Valdis . Kletnieks (Jan 20)
- Re: January 15 is Personal Firewall Day, help the cause Ron DuFresne (Jan 15)
- Re[2]: January 15 is Personal Firewall Day, help the cause Joris De Donder (Jan 15)
- Re: Re[2]: January 15 is Personal Firewall Day, help the cause Ethan (Jan 16)
- Re[2]: January 15 is Personal Firewall Day, help the cause Ron DuFresne (Jan 16)
- Re: Re[2]: January 15 is Personal Firewall Day, help the cause brenda (Jan 16)
- Re: January 15 is Personal Firewall Day, help the cause Cael Abal (Jan 19)
- Re: January 15 is Personal Firewall Day, help the cause Kenton Smith (Jan 15)