Re: Another new worm???

[Dan_Schrader () TRENDMICRO COM (Dan Schrader)]

Bennett Todd wrote:

> Your reply shows a lack of understanding of the security community
> and how we work.

Full disclosure has resulted in proliferation of security fixes.  It also
has resulted in a proliferation of security exploits.

> We develop understandings of problems, and work together to evolve
> the best possible fixes for them. Many of us maintain our own email
> filtering systems. I've developed one, which I maintain, which spots
> problem messages (currently a long list of attachment types,
> recognizing either MIME or uue, plus one magic string from one
> HTML-bourne worm), and sanitizes the messages on the way through the
> mail transport agent.

Good work - then 2 years ago when the shs exploit was publisized you should
have added shs files to your filter, and you should have had no problem with
the stages virus

> The commercial Anti-Virus business community has developed a
> symbiotic relationship with virus writers.

Yes, and doctors have a symbiotic relationship with bacteria, drunk drivers
and crooks with guns.  But they dont distribute rotten food, beer and guns -
and we don't distribute viruses.

> Do you make recognition
> databases publicly available in a publicly-documented format,

No - then the virus writers would find it simple to work around our
detectors.  You fail to grasp the significance of having thousands of
intelligent (ok, some are only semi intelligent) agents actively seeking to
break our defences.  dozens of viruses have been written specifically to
beat popular av products.  This is not a passive exploit we are tyring to
deal with, it is active, hostile coders.  If it were a passive exploit, I'd
say go ahead and publish.

> for
> those of us who don't want to run your software to use to try and
> keep up with the evolution of email worms?

We have 63 worms listed in our encyclopedia, another hundred that haven't
made the list.  How many have analyzed and added filters for?  If you are
just filtering on file extension, you don't need to analyze the code - all
you needed was provided long before this virus was posted to the list.

> If not, please go away,
> or at least give up trying to silence those of us who are trying to
> solve this problem, rather than to profit from it.

yup, I'm guilty of drawing a salary.  I'm also guilty of trying to limit
development and spread of copy cat viruses.

Dan