Software Firewalls

[JW]

i really liked your statement
"No software or system is as important a preventative as
is user training..."
that might be the biggest missing link in PC security nowadays.

thanks for your reply and the insight of your experience.
it is not really eye-opening that one can get a PC infection, if one is
using AV software that is not up-to-date. what is eye-popping to me is
that one can have everything up-to-date, and still get infected, even by
clicking on Nothing at all. the most recent example of this is the time
period leading up to the most recent patch for MSN Messenger. just open
the program, and zap, you are infected, if your buddy's icon was infected.

while it is all common sense to somebody who has spent years training
and implementing IT security, the fact remains that if you ask 99% of
average non-technical PC users in the world, "What is safe-hex", 99 out
of 100 answers will be different, ranging the full spectrum, from the
many ways to tweak and configure programs and routers that you have
learned through training over the years, to total naivety at the other
end of the spectrum (just avoid porn sites). moral of the story is --
common sense to you and me is Not common sense to the less-educated.

thanks again for your feedback

 

[cquirke (MVP Windows shell/user)]

JW wrote:

It hasn't been true for a long time.

Limiting discussion to malware arriving via email (as opposed to
diskettes, CDRs, peer-to-peer file sharing, LAN, IM, chat, direct
network attacks via the Internet, hostile web sites, etc.)...

1) By design

A few years ago, some thought it would be nice to add eye candy such
as bold text, fancy fonts, inline graphics etc. (and indeed it is).

Outlook first did this in a proprietary way, which was Bad, because
email is supposed to be a standard, not a special format bound to one
particular email application. Do you want to send email or Outlook
mail? I don't deal with Outlook mail, so goodbye.

The next logical step was to find an open standard for "rich" text,
and HTML came to mind. But HTML does more than allow bold, fonts,
inline graphics etc.; it also allows program (scripts, Java etc.) to
be embedded, files to be automatically linked to via the Internet, and
arbitrary text to be laid over URL links.

The most obvious of these risks was scripts and other active content.
Some email applications were smart enough to suppress these (e.g.
Eudora, Pegasus), others were aware enough to offer suppression of
these (Netscape Mail) and others hadn't a clue (OE, Outlook 2000).

The result: By design, the more clueless email apps will autorun
programmatic material in email "message text" when you "read" it.
This is a clear escalation of risk, and when coupled with automatic
preview as is the case in OE, the result is it becomes impossible to
highlight a message to delete it without it running as code.

BubbleBoy demonstrated the concept, Kak used it to spread widely
through OE, and others (BleBla.B, San, Valentine) followed this up to
the extent of adding data-destructive payloads.

2) By design cluelessness

If autorunning scripts by design was dumb intent (or an obliviousness
of implication), then the next layer of badness was design laxity.

Files can be encoded within email messages in various ways. When the
message is plain text, these files are to be linked to as attachments,
but HTML allows certain types of files to be "opened" (intention:
displayed) as part of the message. This is how inline graphics and
autoplaying MIDI tunes work.

There are four layers of content description at work here:
a) The enclosure (encoding) of the file itself
b) The MIME type of the file
c) The file name extension of the file
d) the internal type header data and structure of the file

Where a standard defines an encoding process, as it does for (a), then
all defining criteria should be met before you decode the file. This
MS failed to do, so some improperly-coded files that might be ignored
by some software (e.g. virus checker) may be decoded as files by MS.

Where there is risk, design should be shrink-wrapped around intent.
This applies to (a), (b) and (c), but once again MS has consistently
failed to apply risk awareness to mismatches between these layers. So
we see raw code in .PIF "shortcuts" being run ("opened") as code, Word
macros in .RTF being run even though they should not be there, and in
this case, raw code files mis-represented at the MIME level being
"opened" (run) as raw code when the "message text" is "read".

This is an extreme escalation of risk; you think you are "reading
message text" (or maybe you're just trying to highlight a message to
delete it, and the preview "reads" it for you) but what you are really
doing is running raw code. BadTrans.B was the first to exploit this
clickless email attack, and it's been routine for malware ever since.

3) Via defective code

MS responded to the above as code defects and patched them, somewhat
tardily (WinME's OE still autoran scripts by default, even after Kak
was In The Wild). But if there was a barnacle of defective code, it
was on the back of a volcano of bad design (scripts in "message text")
or absence of code design (failure to sanity-check MIME type against
file .ext against contents of file).

Unlike silly design, true code defects are truly insane, running
roughshod over any sort of safety or risk awareness. That means you
typically can't defend against these via tighter settings; the only
fix is to patch the code defect, or use a non-defective alternate app.

There have been true code defects that facilitate clickless attack via
email, and I expect there will be more in the future. So even if,
right now as at March 2005, you are fully patched and risk managed
against clickless email attacks - tomorrw's another day.

Now that can mean one or more of several things:
- an insane message structure that exploits a raw code defect
- an improperly-enclosed/encoded file
- a MIME-spoofed file the email app will open inline
- an explicit attachment
- a masked link that pulls down malware when clicked
- a remote graphic link that pulls down malware (no click)
- scripts or active content embedded within the "message"
- a valid but insane file that exploits when opened inline

On the last, think of the GDIPlus defect that allows a real (but
malformed) JPEG file to run itself as raw code. Once again, that's
insane, and not something you can manage via safety settings.

Old news, but still serious news that is worth hearing.

What's so eye-opening about getting an infection because one isn't using up
to date AV software or practicing safe hex? That's a given - even if you
update daily, it's possible that your AV mfr hasn't released a pattern file
that can detect it yet, as you mentioned.

Plus, you can't practice Safe Hex if the system is insane (code flaws)
or stupid (inexcusably bad design) to take risks with unsolicited
material on the user's behalf.

You can't Just Say No if you werer never asked.

On networks running their own mail servers (which is what I mainly deal
with), I block a boatload of file extensions & also scan the entirety of the
message itself. Attachment types to block include exe, com, cmd, bat, pif,
scr, etc etc etc - and I also scan within zip files.

That's risk filtering, which modern OE and Outlook can apply in a
rather crude manner. ISPs can't do that for consumers, though what
they can and often do do is scan for known malware. But a new (Day
Zero) malware will cut through the ISP's scanner for the same reason
it cut through the sender's av, and your av.

I'd say that spyware is usually a much larger problem than viruses
are these days, honestly.

Larger in bulk, yes - though traditional malware may bite a lot harder
(cause more damage) than commercial malware ("spyware")

Well, outside the fact that Netsky is indeed delivered via an attachment in
the first place, this is all pretty common sense stuff if you ask me. Keep
everything patched and updated. Use current-generation versions of Windows

Er... no. Yes to upgrading or avoiding vulnerable edge-facing
subsystems such as IE, WMP and MSware email, but I'd take a patched-up
Win98SE over an out-the-box XP Gold any day of the year.

Keep your firewall ON all the time. Use very good AV software (have it
also scan mail if possible) that you update very frequently

A free av updated daily's better than a commercial av updated once a
week, IMO. regular updates can be difficult for dial-up users, but
they have to just do what is required.

-- Risk Management is the clue that asks:

"Why do I keep open buckets of petrol next to all the
ashtrays in the lounge, when I don't even have a car?"

 

[JW]

This is truly astonishing stuff.
I knew there were problems, but i didn't realize it was a plague of
problems. While all of it is amazing, I especially liked the following:

"Plus, you can't practice Safe Hex if the system is insane (code flaws)
or stupid (inexcusably bad design) to take risks with unsolicited
material on the user's behalf. You can't Just Say No if you were never
asked."

All this vague talk of safe hex is deadly! While it is both useful and
insufficient advice, most of this vague talk of safe hex makes as much
sense In Reality as saying the following:

"Here's a bottle full of anti-viral tablets, and here's a bottle full of
anti-bacterial tablets, and here's a bottle full of anti-fungal tablets.
Now you're ready to go have safe sex in Bangkok."

Like hell i am. Even if i have all the best anti-viral tablets,
anti-bacterial tablets, and anti-fungal tablets in the world, I'm a Dead
Man, if the prophylactic i thought was supposed to protect me actually
has "inherent design flaws", or has more "security vulnerabilities" than
a screen door on the exterior of a submarine.

On Sun, 6 Mar 2005 14:28:07 -0500, "Lanwench [MVP - Exchange]"

JW wrote:

It hasn't been true for a long time.

Limiting discussion to malware arriving via email (as opposed to
diskettes, CDRs, peer-to-peer file sharing, LAN, IM, chat, direct
network attacks via the Internet, hostile web sites, etc.)...

1) By design

A few years ago, some thought it would be nice to add eye candy such
as bold text, fancy fonts, inline graphics etc. (and indeed it is).

Outlook first did this in a proprietary way, which was Bad, because
email is supposed to be a standard, not a special format bound to one
particular email application. Do you want to send email or Outlook
mail? I don't deal with Outlook mail, so goodbye.

The next logical step was to find an open standard for "rich" text,
and HTML came to mind. But HTML does more than allow bold, fonts,
inline graphics etc.; it also allows program (scripts, Java etc.) to
be embedded, files to be automatically linked to via the Internet, and
arbitrary text to be laid over URL links.

The most obvious of these risks was scripts and other active content.
Some email applications were smart enough to suppress these (e.g.
Eudora, Pegasus), others were aware enough to offer suppression of
these (Netscape Mail) and others hadn't a clue (OE, Outlook 2000).

The result: By design, the more clueless email apps will autorun
programmatic material in email "message text" when you "read" it.
This is a clear escalation of risk, and when coupled with automatic
preview as is the case in OE, the result is it becomes impossible to
highlight a message to delete it without it running as code.

BubbleBoy demonstrated the concept, Kak used it to spread widely
through OE, and others (BleBla.B, San, Valentine) followed this up to
the extent of adding data-destructive payloads.

2) By design cluelessness

If autorunning scripts by design was dumb intent (or an obliviousness
of implication), then the next layer of badness was design laxity.

Files can be encoded within email messages in various ways. When the
message is plain text, these files are to be linked to as attachments,
but HTML allows certain types of files to be "opened" (intention:
displayed) as part of the message. This is how inline graphics and
autoplaying MIDI tunes work.

There are four layers of content description at work here:
a) The enclosure (encoding) of the file itself
b) The MIME type of the file
c) The file name extension of the file
d) the internal type header data and structure of the file

Where a standard defines an encoding process, as it does for (a), then
all defining criteria should be met before you decode the file. This
MS failed to do, so some improperly-coded files that might be ignored
by some software (e.g. virus checker) may be decoded as files by MS.

Where there is risk, design should be shrink-wrapped around intent.
This applies to (a), (b) and (c), but once again MS has consistently
failed to apply risk awareness to mismatches between these layers. So
we see raw code in .PIF "shortcuts" being run ("opened") as code, Word
macros in .RTF being run even though they should not be there, and in
this case, raw code files mis-represented at the MIME level being
"opened" (run) as raw code when the "message text" is "read".

This is an extreme escalation of risk; you think you are "reading
message text" (or maybe you're just trying to highlight a message to
delete it, and the preview "reads" it for you) but what you are really
doing is running raw code. BadTrans.B was the first to exploit this
clickless email attack, and it's been routine for malware ever since.

3) Via defective code

MS responded to the above as code defects and patched them, somewhat
tardily (WinME's OE still autoran scripts by default, even after Kak
was In The Wild). But if there was a barnacle of defective code, it
was on the back of a volcano of bad design (scripts in "message text")
or absence of code design (failure to sanity-check MIME type against
file .ext against contents of file).

Unlike silly design, true code defects are truly insane, running
roughshod over any sort of safety or risk awareness. That means you
typically can't defend against these via tighter settings; the only
fix is to patch the code defect, or use a non-defective alternate app.

There have been true code defects that facilitate clickless attack via
email, and I expect there will be more in the future. So even if,
right now as at March 2005, you are fully patched and risk managed
against clickless email attacks - tomorrw's another day.



Now that can mean one or more of several things:
- an insane message structure that exploits a raw code defect
- an improperly-enclosed/encoded file
- a MIME-spoofed file the email app will open inline
- an explicit attachment
- a masked link that pulls down malware when clicked
- a remote graphic link that pulls down malware (no click)
- scripts or active content embedded within the "message"
- a valid but insane file that exploits when opened inline

On the last, think of the GDIPlus defect that allows a real (but
malformed) JPEG file to run itself as raw code. Once again, that's
insane, and not something you can manage via safety settings.



Old news, but still serious news that is worth hearing.

What's so eye-opening about getting an infection because one isn't using up
to date AV software or practicing safe hex? That's a given - even if you
update daily, it's possible that your AV mfr hasn't released a pattern file
that can detect it yet, as you mentioned.

Plus, you can't practice Safe Hex if the system is insane (code flaws)
or stupid (inexcusably bad design) to take risks with unsolicited
material on the user's behalf.

You can't Just Say No if you werer never asked.

On networks running their own mail servers (which is what I mainly deal
with), I block a boatload of file extensions & also scan the entirety of the
message itself. Attachment types to block include exe, com, cmd, bat, pif,
scr, etc etc etc - and I also scan within zip files.

That's risk filtering, which modern OE and Outlook can apply in a
rather crude manner. ISPs can't do that for consumers, though what
they can and often do do is scan for known malware. But a new (Day
Zero) malware will cut through the ISP's scanner for the same reason
it cut through the sender's av, and your av.

I'd say that spyware is usually a much larger problem than viruses
are these days, honestly.

Larger in bulk, yes - though traditional malware may bite a lot harder
(cause more damage) than commercial malware ("spyware")

Well, outside the fact that Netsky is indeed delivered via an attachment in
the first place, this is all pretty common sense stuff if you ask me. Keep
everything patched and updated. Use current-generation versions of Windows

Er... no. Yes to upgrading or avoiding vulnerable edge-facing
subsystems such as IE, WMP and MSware email, but I'd take a patched-up
Win98SE over an out-the-box XP Gold any day of the year.

Keep your firewall ON all the time. Use very good AV software (have it
also scan mail if possible) that you update very frequently

A free av updated daily's better than a commercial av updated once a
week, IMO. regular updates can be difficult for dial-up users, but
they have to just do what is required.

-- Risk Management is the clue that asks:

"Why do I keep open buckets of petrol next to all the
ashtrays in the lounge, when I don't even have a car?"

----------------------- ------ ---- --- -- - - - -

 

[JW]

if you're still listening, cquirke, i would appreciate your opinion of
the effectiveness of SurfinGuard Pro by Finjan, or any other products
that intercept PC infections by running them in a caged sandbox.

On Sun, 6 Mar 2005 14:28:07 -0500, "Lanwench [MVP - Exchange]"

JW wrote:

It hasn't been true for a long time.

Limiting discussion to malware arriving via email (as opposed to
diskettes, CDRs, peer-to-peer file sharing, LAN, IM, chat, direct
network attacks via the Internet, hostile web sites, etc.)...

1) By design

A few years ago, some thought it would be nice to add eye candy such
as bold text, fancy fonts, inline graphics etc. (and indeed it is).

Outlook first did this in a proprietary way, which was Bad, because
email is supposed to be a standard, not a special format bound to one
particular email application. Do you want to send email or Outlook
mail? I don't deal with Outlook mail, so goodbye.

The next logical step was to find an open standard for "rich" text,
and HTML came to mind. But HTML does more than allow bold, fonts,
inline graphics etc.; it also allows program (scripts, Java etc.) to
be embedded, files to be automatically linked to via the Internet, and
arbitrary text to be laid over URL links.

The most obvious of these risks was scripts and other active content.
Some email applications were smart enough to suppress these (e.g.
Eudora, Pegasus), others were aware enough to offer suppression of
these (Netscape Mail) and others hadn't a clue (OE, Outlook 2000).

The result: By design, the more clueless email apps will autorun
programmatic material in email "message text" when you "read" it.
This is a clear escalation of risk, and when coupled with automatic
preview as is the case in OE, the result is it becomes impossible to
highlight a message to delete it without it running as code.

BubbleBoy demonstrated the concept, Kak used it to spread widely
through OE, and others (BleBla.B, San, Valentine) followed this up to
the extent of adding data-destructive payloads.

2) By design cluelessness

If autorunning scripts by design was dumb intent (or an obliviousness
of implication), then the next layer of badness was design laxity.

Files can be encoded within email messages in various ways. When the
message is plain text, these files are to be linked to as attachments,
but HTML allows certain types of files to be "opened" (intention:
displayed) as part of the message. This is how inline graphics and
autoplaying MIDI tunes work.

There are four layers of content description at work here:
a) The enclosure (encoding) of the file itself
b) The MIME type of the file
c) The file name extension of the file
d) the internal type header data and structure of the file

Where a standard defines an encoding process, as it does for (a), then
all defining criteria should be met before you decode the file. This
MS failed to do, so some improperly-coded files that might be ignored
by some software (e.g. virus checker) may be decoded as files by MS.

Where there is risk, design should be shrink-wrapped around intent.
This applies to (a), (b) and (c), but once again MS has consistently
failed to apply risk awareness to mismatches between these layers. So
we see raw code in .PIF "shortcuts" being run ("opened") as code, Word
macros in .RTF being run even though they should not be there, and in
this case, raw code files mis-represented at the MIME level being
"opened" (run) as raw code when the "message text" is "read".

This is an extreme escalation of risk; you think you are "reading
message text" (or maybe you're just trying to highlight a message to
delete it, and the preview "reads" it for you) but what you are really
doing is running raw code. BadTrans.B was the first to exploit this
clickless email attack, and it's been routine for malware ever since.

3) Via defective code

MS responded to the above as code defects and patched them, somewhat
tardily (WinME's OE still autoran scripts by default, even after Kak
was In The Wild). But if there was a barnacle of defective code, it
was on the back of a volcano of bad design (scripts in "message text")
or absence of code design (failure to sanity-check MIME type against
file .ext against contents of file).

Unlike silly design, true code defects are truly insane, running
roughshod over any sort of safety or risk awareness. That means you
typically can't defend against these via tighter settings; the only
fix is to patch the code defect, or use a non-defective alternate app.

There have been true code defects that facilitate clickless attack via
email, and I expect there will be more in the future. So even if,
right now as at March 2005, you are fully patched and risk managed
against clickless email attacks - tomorrw's another day.



Now that can mean one or more of several things:
- an insane message structure that exploits a raw code defect
- an improperly-enclosed/encoded file
- a MIME-spoofed file the email app will open inline
- an explicit attachment
- a masked link that pulls down malware when clicked
- a remote graphic link that pulls down malware (no click)
- scripts or active content embedded within the "message"
- a valid but insane file that exploits when opened inline

On the last, think of the GDIPlus defect that allows a real (but
malformed) JPEG file to run itself as raw code. Once again, that's
insane, and not something you can manage via safety settings.



Old news, but still serious news that is worth hearing.

What's so eye-opening about getting an infection because one isn't using up
to date AV software or practicing safe hex? That's a given - even if you
update daily, it's possible that your AV mfr hasn't released a pattern file
that can detect it yet, as you mentioned.

Plus, you can't practice Safe Hex if the system is insane (code flaws)
or stupid (inexcusably bad design) to take risks with unsolicited
material on the user's behalf.

You can't Just Say No if you werer never asked.

On networks running their own mail servers (which is what I mainly deal
with), I block a boatload of file extensions & also scan the entirety of the
message itself. Attachment types to block include exe, com, cmd, bat, pif,
scr, etc etc etc - and I also scan within zip files.

That's risk filtering, which modern OE and Outlook can apply in a
rather crude manner. ISPs can't do that for consumers, though what
they can and often do do is scan for known malware. But a new (Day
Zero) malware will cut through the ISP's scanner for the same reason
it cut through the sender's av, and your av.

I'd say that spyware is usually a much larger problem than viruses
are these days, honestly.

Larger in bulk, yes - though traditional malware may bite a lot harder
(cause more damage) than commercial malware ("spyware")

Well, outside the fact that Netsky is indeed delivered via an attachment in
the first place, this is all pretty common sense stuff if you ask me. Keep
everything patched and updated. Use current-generation versions of Windows

Er... no. Yes to upgrading or avoiding vulnerable edge-facing
subsystems such as IE, WMP and MSware email, but I'd take a patched-up
Win98SE over an out-the-box XP Gold any day of the year.

Keep your firewall ON all the time. Use very good AV software (have it
also scan mail if possible) that you update very frequently

A free av updated daily's better than a commercial av updated once a
week, IMO. regular updates can be difficult for dial-up users, but
they have to just do what is required.

-- Risk Management is the clue that asks:

"Why do I keep open buckets of petrol next to all the
ashtrays in the lounge, when I don't even have a car?"

----------------------- ------ ---- --- -- - - - -

 

[JW]

i meant to say

....or any other products that intercept PC infections by running
scripts, ActiveX, and other mobile code in a caged sandbox.

if you're still listening, cquirke, i would appreciate your opinion of
the effectiveness of SurfinGuard Pro by Finjan, or any other products
that intercept PC infections by running them in a caged sandbox.

On Sun, 6 Mar 2005 14:28:07 -0500, "Lanwench [MVP - Exchange]"

JW wrote:


there once was a time when the only way to get an infection from an
Email message was to click on something. this is no longer true.

It hasn't been true for a long time.

Limiting discussion to malware arriving via email (as opposed to
diskettes, CDRs, peer-to-peer file sharing, LAN, IM, chat, direct
network attacks via the Internet, hostile web sites, etc.)...

1) By design

A few years ago, some thought it would be nice to add eye candy such
as bold text, fancy fonts, inline graphics etc. (and indeed it is).
Outlook first did this in a proprietary way, which was Bad, because
email is supposed to be a standard, not a special format bound to one
particular email application. Do you want to send email or Outlook
mail? I don't deal with Outlook mail, so goodbye.

The next logical step was to find an open standard for "rich" text,
and HTML came to mind. But HTML does more than allow bold, fonts,
inline graphics etc.; it also allows program (scripts, Java etc.) to
be embedded, files to be automatically linked to via the Internet, and
arbitrary text to be laid over URL links.

The most obvious of these risks was scripts and other active content.
Some email applications were smart enough to suppress these (e.g.
Eudora, Pegasus), others were aware enough to offer suppression of
these (Netscape Mail) and others hadn't a clue (OE, Outlook 2000).

The result: By design, the more clueless email apps will autorun
programmatic material in email "message text" when you "read" it.
This is a clear escalation of risk, and when coupled with automatic
preview as is the case in OE, the result is it becomes impossible to
highlight a message to delete it without it running as code.

BubbleBoy demonstrated the concept, Kak used it to spread widely
through OE, and others (BleBla.B, San, Valentine) followed this up to
the extent of adding data-destructive payloads.

2) By design cluelessness

If autorunning scripts by design was dumb intent (or an obliviousness
of implication), then the next layer of badness was design laxity.

Files can be encoded within email messages in various ways. When the
message is plain text, these files are to be linked to as attachments,
but HTML allows certain types of files to be "opened" (intention:
displayed) as part of the message. This is how inline graphics and
autoplaying MIDI tunes work.

There are four layers of content description at work here:
a) The enclosure (encoding) of the file itself
b) The MIME type of the file
c) The file name extension of the file
d) the internal type header data and structure of the file

Where a standard defines an encoding process, as it does for (a), then
all defining criteria should be met before you decode the file. This
MS failed to do, so some improperly-coded files that might be ignored
by some software (e.g. virus checker) may be decoded as files by MS.

Where there is risk, design should be shrink-wrapped around intent.
This applies to (a), (b) and (c), but once again MS has consistently
failed to apply risk awareness to mismatches between these layers. So
we see raw code in .PIF "shortcuts" being run ("opened") as code, Word
macros in .RTF being run even though they should not be there, and in
this case, raw code files mis-represented at the MIME level being
"opened" (run) as raw code when the "message text" is "read".

This is an extreme escalation of risk; you think you are "reading
message text" (or maybe you're just trying to highlight a message to
delete it, and the preview "reads" it for you) but what you are really
doing is running raw code. BadTrans.B was the first to exploit this
clickless email attack, and it's been routine for malware ever since.

3) Via defective code

MS responded to the above as code defects and patched them, somewhat
tardily (WinME's OE still autoran scripts by default, even after Kak
was In The Wild). But if there was a barnacle of defective code, it
was on the back of a volcano of bad design (scripts in "message text")
or absence of code design (failure to sanity-check MIME type against
file .ext against contents of file).

Unlike silly design, true code defects are truly insane, running
roughshod over any sort of safety or risk awareness. That means you
typically can't defend against these via tighter settings; the only
fix is to patch the code defect, or use a non-defective alternate app.

There have been true code defects that facilitate clickless attack via
email, and I expect there will be more in the future. So even if,
right now as at March 2005, you are fully patched and risk managed
against clickless email attacks - tomorrw's another day.

the following came out a year ago on April 15:


"The latest Netsky is squirming across the Internet as an email
without an attachment.

Now that can mean one or more of several things:
- an insane message structure that exploits a raw code defect
- an improperly-enclosed/encoded file
- a MIME-spoofed file the email app will open inline
- an explicit attachment
- a masked link that pulls down malware when clicked
- a remote graphic link that pulls down malware (no click)
- scripts or active content embedded within the "message"
- a valid but insane file that exploits when opened inline

On the last, think of the GDIPlus defect that allows a real (but
malformed) JPEG file to run itself as raw code. Once again, that's
insane, and not something you can manage via safety settings.

Yep, you heard me right, by using a combination of Windows security
flaws, the creators of Netsky.v figured out how to infect a vulnerable
computer without requiring the computer's owner to double-click on an
attached file.

Old news, but still serious news that is worth hearing.

What's so eye-opening about getting an infection because one isn't
using up
to date AV software or practicing safe hex? That's a given - even if you
update daily, it's possible that your AV mfr hasn't released a
pattern file
that can detect it yet, as you mentioned.

Plus, you can't practice Safe Hex if the system is insane (code flaws)
or stupid (inexcusably bad design) to take risks with unsolicited
material on the user's behalf.
You can't Just Say No if you werer never asked.

On networks running their own mail servers (which is what I mainly deal
with), I block a boatload of file extensions & also scan the entirety
of the
message itself. Attachment types to block include exe, com, cmd, bat,
pif,
scr, etc etc etc - and I also scan within zip files.

That's risk filtering, which modern OE and Outlook can apply in a
rather crude manner. ISPs can't do that for consumers, though what
they can and often do do is scan for known malware. But a new (Day
Zero) malware will cut through the ISP's scanner for the same reason
it cut through the sender's av, and your av.

I'd say that spyware is usually a much larger problem than viruses
are these days, honestly.

Larger in bulk, yes - though traditional malware may bite a lot harder
(cause more damage) than commercial malware ("spyware")

Well, outside the fact that Netsky is indeed delivered via an
attachment in
the first place, this is all pretty common sense stuff if you ask me.
Keep
everything patched and updated. Use current-generation versions of
Windows

Er... no. Yes to upgrading or avoiding vulnerable edge-facing
subsystems such as IE, WMP and MSware email, but I'd take a patched-up
Win98SE over an out-the-box XP Gold any day of the year.

Keep your firewall ON all the time. Use very good AV software (have
it also scan mail if possible) that you update very frequently

A free av updated daily's better than a commercial av updated once a
week, IMO. regular updates can be difficult for dial-up users, but
they have to just do what is required.

-- Risk Management is the clue that asks:

"Why do I keep open buckets of petrol next to all the
ashtrays in the lounge, when I don't even have a car?"

----------------------- ------ ---- --- -- - - - -

 

[Lanwench [MVP - Exchange]]

There have been true code defects that facilitate clickless attack via
email, and I expect there will be more in the future. So even if,
right now as at March 2005, you are fully patched and risk managed
against clickless email attacks - tomorrw's another day.

Sadly, always true.

Now that can mean one or more of several things:
- an insane message structure that exploits a raw code defect
- an improperly-enclosed/encoded file
- a MIME-spoofed file the email app will open inline
- an explicit attachment
- a masked link that pulls down malware when clicked
- a remote graphic link that pulls down malware (no click)
- scripts or active content embedded within the "message"
- a valid but insane file that exploits when opened inline

On the last, think of the GDIPlus defect that allows a real (but
malformed) JPEG file to run itself as raw code. Once again, that's
insane, and not something you can manage via safety settings.


Old news, but still serious news that is worth hearing.


Plus, you can't practice Safe Hex if the system is insane (code flaws)
or stupid (inexcusably bad design) to take risks with unsolicited
material on the user's behalf.

True. However, much of this can be mitigated by using current-gen stuff,
keeping it patched, firewalled, and exercising a "I trust nothing til it
demonstrates it is safe" policy - I say much, not all.

You can't Just Say No if you werer never asked.

No. But you can lock down your browser (whatever you use) such that it may
be somewhat inconvenient to use, and hence lower your risk of any infection,
by usually saying No by default unless specifically told to permit Yes.

That's risk filtering, which modern OE and Outlook can apply in a
rather crude manner. ISPs can't do that for consumers, though what
they can and often do do is scan for known malware. But a new (Day
Zero) malware will cut through the ISP's scanner for the same reason
it cut through the sender's av, and your av.

Sure - no question. One is only ever about a few steps away from the
marauders. This is all risk management, plain and simple.

Larger in bulk, yes - though traditional malware may bite a lot harder
(cause more damage) than commercial malware ("spyware")

Yes. That was implied. Let's accept the fact that "spyware" has become a
generic term, not unlike "Kleenex" or "Cellophane". To most people,
spyware/malware/adware/scumware are all interchangeable - I'm in Rome, doing
as the Romans do, despite my own ornery nature.

Er... no. Yes to upgrading or avoiding vulnerable edge-facing
subsystems such as IE, WMP and MSware email, but I'd take a patched-up
Win98SE over an out-the-box XP Gold any day of the year.

XP Gold isn't truly considered current generation now, is it.;-)
I was fairly happy with 98SE for a while - the best of the non-NT breed.

A free av updated daily's better than a commercial av updated once a
week, IMO. regular updates can be difficult for dial-up users, but
they have to just do what is required.

Yep, in most cases.

 

[Kerry Brown]

It's my view that Joe Public (ie those who are buying computers outside of
a corporate scenario) should be TOLD about computer security when they buy
one. For example, I was watching a show on a cable channel here in the UK
the other day going through the basics of computing. The presenter had
gone RIGHT through almost everything to do with getting an ISP, logging
on, browsing the internet and email use before even MENTIONING the fact
that "you might consider using a firewall", and I think they only did that
because I rang them up and told them about the ommission! The security
aspect should have been the FIRST thing the program covered!

This is a very interesting discussion. I'm going to print it out for my
customers. For my small business customers I recommend at least one computer
set up ready to go with the point of sales software and not hooked up to the
internet in any way. That way when the point of sales go down they can
restore last night's backup and still make sales with a reasonably up to
date database. It's a hard sell, They don't want to pay for a PC and not use
it. They don't believe the internet is that dangerous. The common response
is "I've got Norton and I do Windows updates". It's scary how many of them
have a Norton subscription that expired last month, no fire wall (although
usually a router), SP1 (they heard SP2 caused too many problems) and the
last time anyone scanned for spyware was the last time I was there. All I
can do is point out the folly of their ways to them. Even when it's pointed
out and made clear it will cost them money by calling me in once a month to
fix things there still seems to be a "Oh well it can't be helped" attitude
when in reality it can be mitigated to a large degree.

Kerry
Kerry Brown

 

[Gordon]

Kerry Brown wrote:
|| They don't| believe the internet is that dangerous. The common response
is "I've
|| got Norton and I do Windows updates". It's scary how many of them
|| have a Norton subscription that expired last month,

Even more scary is the places I've been where the Norton AV expired last
YEAR! (Or whenever the free trial was up, after the machine was bought!)

 

[Scott M.]

Even MORE scary is when the user doesn't understand what you mean when you
say the AV has expired. They believe that the initial purchase is all they
need to do to be eternally protected.

 

[cquirke (MVP Windows shell/user)]

On Sun, 6 Mar 2005 14:28:07 -0500, "Lanwench [MVP - Exchange]"
Plus, you can't practice Safe Hex if the system is insane (code flaws)
or stupid (inexcusably bad design) to take risks with unsolicited
material on the user's behalf.

[/QUOTE]

True. However, much of this can be mitigated by using current-gen stuff,
keeping it patched, firewalled, and exercising a "I trust nothing til it
demonstrates it is safe" policy - I say much, not all.

Yep - the bottom line is, it's "all of the above". This question
blows up whenever someone pronounces the problem as being solely due
to users (e.g. one poster who still speaks of commercial malware in
terms of "software you chose to install") or system software (e.g. as
if all malware were clickless in nature).

Let's accept the fact that "spyware" has become a generic term,
not unlike "Kleenex" or "Cellophane".

Let's not. One's understanding flows from the terms one uses, and the
more inaccurate these are, the more mental dissonance is involved in
understanding things. So I'll still refer to commercial malware as
commercial malware, even if I have to write extra text bridging the
gap between that term and "spyware"

The other reason is that one of the defining things about commercial
malware is that because the vendors are commercial entities with
pretentions to legitimacy, they can sue you for calling them bad
things. So a creator of pushed software that steals revenue from
sites by covering the ads (or the whole page) with their own material
can win thier case as long as they don't send info home, because if
they don't gather info from your PC, they are not "spyware".

XP Gold isn't truly considered current generation now, is it.;-)

Yes and no.

The good news is that XP Gold users don't have to pay for SP2 as a new
Windows version, in order to get an updated installation CD.

The bad news is that XP Gold users cannot get an updated installation
CD. They can get SP2 on a CD, yes, but that's not the same thing.

So as long as "just" re-install Windows (either as a "repair install"
or fresh) is seen as a valid maintenance strategy, XP Gold lives.

I was fairly happy with 98SE for a while - the best of the non-NT breed.

Using it still, as the phone answering software doesn't work on XP
(seems as if phone messaging is too drab an application for anyone to
do it properly; MS hasn't taken an interest)

Yep, in most cases.

I'm trying to think of an av that's bad enough to be the exception to
this rule, and failing

--------------- ----- ---- --- -- - - -

Never turn your back on an installer program

 

[JW]

True. However, much of this can be mitigated by using current-gen stuff,
keeping it patched, firewalled, and exercising a "I trust nothing til it
demonstrates it is safe" policy - I say much, not all.

Yep - the bottom line is, it's "all of the above". This question
blows up whenever someone pronounces the problem as being solely due
to users (e.g. one poster who still speaks of commercial malware in
terms of "software you chose to install") or system software (e.g. as
if all malware were clickless in nature).

Let's accept the fact that "spyware" has become a generic term,
not unlike "Kleenex" or "Cellophane".

Let's not. One's understanding flows from the terms one uses, and the
more inaccurate these are, the more mental dissonance is involved in
understanding things. So I'll still refer to commercial malware as
commercial malware, even if I have to write extra text bridging the
gap between that term and "spyware"

The other reason is that one of the defining things about commercial
malware is that because the vendors are commercial entities with
pretentions to legitimacy, they can sue you for calling them bad
things. So a creator of pushed software that steals revenue from
sites by covering the ads (or the whole page) with their own material
can win thier case as long as they don't send info home, because if
they don't gather info from your PC, they are not "spyware".

XP Gold isn't truly considered current generation now, is it.;-)

Yes and no.

The good news is that XP Gold users don't have to pay for SP2 as a new
Windows version, in order to get an updated installation CD.

The bad news is that XP Gold users cannot get an updated installation
CD. They can get SP2 on a CD, yes, but that's not the same thing.

So as long as "just" re-install Windows (either as a "repair install"
or fresh) is seen as a valid maintenance strategy, XP Gold lives.

I was fairly happy with 98SE for a while - the best of the non-NT breed.

Using it still, as the phone answering software doesn't work on XP
(seems as if phone messaging is too drab an application for anyone to
do it properly; MS hasn't taken an interest)

Yep, in most cases.

I'm trying to think of an av that's bad enough to be the exception to
this rule, and failing
[/QUOTE]


maybe the free AVG AntiVirus program by Grisoft is an example.

according to tests conducted for the following article (not conducted by
the actual writers/editors of PC World), up-to-date AVG only caught 82%
of all malware included in the test, and only caught 24% of all Trojans
included in the test.

http://www.pcworld.com/reviews/article/0,aid,115939,pg,5,00.asp

if McAfee were not updated but once a week, it would still detect 99% of
all malware and Trojans, minus the number of new infections spread
within the last 7 days.

remember i said "maybe". i know this is offset by the probability that
attacks by new infections are greater than by old infections.

 

[Lanwench [MVP - Exchange]]

On Sun, 6 Mar 2005 14:28:07 -0500, "Lanwench [MVP - Exchange]"
Plus, you can't practice Safe Hex if the system is insane (code
flaws) or stupid (inexcusably bad design) to take risks with
unsolicited material on the user's behalf.

True. However, much of this can be mitigated by using current-gen
stuff, keeping it patched, firewalled, and exercising a "I trust
nothing til it demonstrates it is safe" policy - I say much, not
all.

Yep - the bottom line is, it's "all of the above". This question
blows up whenever someone pronounces the problem as being solely due
to users (e.g. one poster who still speaks of commercial malware in
terms of "software you chose to install") or system software (e.g. as
if all malware were clickless in nature).

Let's accept the fact that "spyware" has become a generic term,
not unlike "Kleenex" or "Cellophane".

Let's not. One's understanding flows from the terms one uses, and the
more inaccurate these are, the more mental dissonance is involved in
understanding things. So I'll still refer to commercial malware as
commercial malware, even if I have to write extra text bridging the
gap between that term and "spyware" [/QUOTE]

OK - the important thing is that everyone know what everyone else is
referring to. In these groups, which get posts by a lot of home/small office
users, note that when *they* say spyware, they mean spyware/malware/adware.
MS itself realizes that and that's why it's Microsoft Antispyware, not
Microsoft AntiSpywareMalwareAdwareScumwareAKAStuffYouDidn'tMeanToInstall.

The other reason is that one of the defining things about commercial
malware is that because the vendors are commercial entities with
pretentions to legitimacy, they can sue you for calling them bad
things. So a creator of pushed software that steals revenue from
sites by covering the ads (or the whole page) with their own material
can win thier case as long as they don't send info home, because if
they don't gather info from your PC, they are not "spyware".

Semantically, true. However, they can't sue me for saying their stuff is
crap. I am not a representative of a major consumer entity. Libel and
slander laws do not apply in this venue. They could sue Microsoft or IBM,
probably- although I'm not sure how far they'd get.

Yes and no.

The good news is that XP Gold users don't have to pay for SP2 as a new
Windows version, in order to get an updated installation CD.

The bad news is that XP Gold users cannot get an updated installation
CD. They can get SP2 on a CD, yes, but that's not the same thing.

So as long as "just" re-install Windows (either as a "repair install"
or fresh) is seen as a valid maintenance strategy, XP Gold lives.

Again, I ain't arguing - just saying, it isn't what you'd now buy from a
retailer or get as an OEM bundle.

Using it still, as the phone answering software doesn't work on XP
(seems as if phone messaging is too drab an application for anyone to
do it properly; MS hasn't taken an interest)

What softwae, just out of curiosity? That isn't my area of expertiese.

I'm trying to think of an av that's bad enough to be the exception to
this rule, and failing

Well - I reckon one might go into the various "Which antivirus software is
best??" threads and look at some of the sites that compare the efficacy of
one over the other - "Product X catches this - Product Y doesn't". But then,
I'm too lazy and I already have my preferences. Best idea is software that
updates hourly, and is pushed out from a central computer/server to the rest
of the network. Presuming one can afford that. ;-)

 

[Lanwench [MVP - Exchange]]

Even MORE scary is when the user doesn't understand what you mean
when you say the AV has expired. They believe that the initial
purchase is all they need to do to be eternally protected.

"Yes, I have antivirus. Norton version 0 came with my Gateway when I bought
it in 1995. What do you mean "subscribe" ?"

 

[Scott M.]

"Yes, I have antivirus. Norton version 0 came with my Gateway when I

bought
it in 1995. What do you mean "subscribe" ?"

YES!!! Absolutely! Can't tell you how many times I've heard that.

 

[Lanwench [MVP - Exchange]]

YES!!! Absolutely! Can't tell you how many times I've heard that.

Me too. That's one of the reasons I rarely do any work on home computers -
if they pay me cash, maybe - and only then if I know it's a newish computer,
already in pretty decent overall shape, they have all their software
installation media, etc. Otherwise I suggest that the user take the PC to a
computer repair store as they likely can't afford to pay me my hourly rate
for as long as it will take me to fix their stuff up.

 

[Kerry Brown]

Me too. That's one of the reasons I rarely do any work on home computers -

if they pay me cash, maybe - and only then if I know it's a newish
computer,
already in pretty decent overall shape, they have all their software
installation media, etc. Otherwise I suggest that the user take the PC to
a
computer repair store as they likely can't afford to pay me my hourly rate
for as long as it will take me to fix their stuff up.

I wish I could pick and choose but I made my decision when I decided I
wanted a rural life. I have to take the work that presents itself

Kerry

 

[cquirke (MVP Windows shell/user)]

cquirke (MVP Windows shell/user) wrote:

What softwae, just out of curiosity? That isn't my area of expertiese.

Bitware 3.xx, an old and crusty Win16 app that I still find best for
fax and voice message reception.

You can generally use any faxware with any modem, but the voice
component tends to be hardwired to the modem the sware shipped with.
And this is where the quality still sucks; poor scalability (duh,
no-one would ever have more than 20 voice messages, right?) and even
when they store the voice message recordings as .WAV, there's no
ability to play part of the recording.

Your typical voice message mumbles along for 30 seconds and then
rattles off the number to call back at high speed. So you have to
play the entire message from the beginning, again and again,
ballpointing down two extra digits from the rattled-oof number at a
time. Frankly, mostly I can't be bothered and don't return calls.

--------------- ----- ---- --- -- - - -

Tech Support: The guys who follow the
'Parade of New Products' with a shovel.

 

[Scott M.]

I only do work like this for friends and relatives, but when I do, the
problems are usually so bad that a complete formatting of the hard drive
(along with an FDISK /mbr) is in order. It turns out to be a whole lot
easier than chasing every bad registry key and trojan.