<font face="Verdana, Arial, Helvetica, sans-serif" size="2">Originally posted by ScottC:
Where have you been the past week

Our server park has alreay blocked over 100k of the suckers... Thankfully the title and contents make it very easy to block on a server level...</font>

<font face="Verdana, Arial, Helvetica, sans-serif" size="2">Originally posted by richard:
I've gotten them a few a day, but today was every 10 minutes throughout the day, a giant increase in volume...</font>

<font face="Verdana, Arial, Helvetica, sans-serif" size="2">""one of the basic functions of an operating system is to run programs. There is a RUN API and the command line interpreter is simply an interface to the RUN API. Many viruses are sent through e-mail because it is easy to access the RUN API from an e-mail attachment. Our first suggestion was within e-mail to restrict the ability to run applications and interact with the e-mail system (post office, address book, etc). Only the e-mail client should be able to interact with the e-mail system. Only programs that have registered and authenticated user IDs [ought to be able to] independently interact with the e-mail system. There should be a way to manage and control the RUN API's control by e-mail attachments.”

"While this in itself would not have prevented the MSBLAST worm, the extension of the idea would have. At that point (1991), Microsoft was thinking about their e-mail strategy, the product that became Exchange. To create an e-mail product you need to have a directory. In time, the logical step (even to Microsoft) was to extend the concept of the user directory to cover other security uses, like file and print access.”

"Our second suggestion was at that point to improve the security of the RUN API. The operating system internals would also be registered as users. Legitimate OS functions could use the RUN API. The user could use the RUN API. Any registered and authenticated applications (no longer limited to e-mail) could use the RUN API. Anything else that attempted to use the RUN API would have to ask the user for permission, or would be prevented from working altogether.”

"In this scenario MSBLAST would have gotten past the RPC flaw. It might have been able to download its payload code. But that code would have had a hard time running.”

"Some of the worst IIS bugs involved the ability to basically access the command interpreter from the Internet. If there had been a security interface to the command interpreter (via the RUN API), IIS would have been a lot easier to protect.”

"These were well understood computer concepts in 1991. We realized in 1991 that an operating system with wide-open e-mail and network connectivity would provide a very easy conduit for viruses. At the time, there were virtually no viruses in the PC/DOS/Windows world, but viruses were a big problem in the Macintosh world. We knew e-mail and networks would make PCs a big virus risk. Our suggestions focused on interfering with the means viruses could and would be spread. This approach works BEFORE the code is even recognized as a virus. Prevention is a much more effective way to deal with a problem.”

"Imagine how easy software licensing would have been if you could register applications in a security database and that would permit them to run on one's PC.”

"We also asked for a standard API to give a virus scan application the ability to intercept and scan all e-mail attachments. Basically, you should not be able to touch an attachment until your virus scan checks it.”

"We asked that attachments be stored separately on the e-mail server (post office) so that a virus scanning application could access them. If an attachment was sent to several people, a single copy of that attachment should be kept on the server. If the attachment was infected, its deletion should remove it from everyone's e-mail account.”

"We discussed how we intercepted the Windows password system so that we could track password age and verify one's password followed our security rules (min 6 characters, mix of letters and numbers, etc). Microsoft needed to provide this service. We also brought to their attention they were sending passwords in plain text, over the LAN."

At least that last part has improved, though the rest seems as it was 12 years ago. Despite specific suggestions from a big customer, Microsoft did almost nothing, and here we are, wormier than ever.

Worms and viruses will always be with us in some form, but these are transitory problems. Something else happened last week that is far more serious and is going to create a major disruption in the fabric of cyberspace, yet nobody seems to have noticed. I'll present the evidence and let you decide.
</font>

<font face="Verdana, Arial, Helvetica, sans-serif" size="2">Originally posted by ScottC:
All it takes is one ....... that is unprotected and has your name in his/her addressbook and you are screwed...

Depending on their connection it could yield up to 200 emails a minute... </font>

<font face="Verdana, Arial, Helvetica, sans-serif" size="2">Originally posted by skofarrell:
Spot on on the second point, but way off on the first. The fix has been available for more than a month before the attacks came.

No operating system is invulnerable. </font>

<font face="Verdana, Arial, Helvetica, sans-serif" size="2">Originally posted by ScottC:
Exactly.

Here are the most recent vulnerabilities I've had in Redhat:

RHN Errata Alert: Updated pam_smb packages fix remote buffer overflow.
RHN Errata Alert: GDM allows local user to read any file.
RHN Errata Alert: Updated unzip packages fix trojan vulnerability
RHN Errata Alert: Updated nfs-utils packages fix denial of service vulnerability
RHN Errata Alert: New postfix packages fix security issues.RHN Errata Alert: Updated ypserv packages fix a denial of service vulnerability

And these are ALL just within the past month. That's MORE extreme vulnerabilities than Microsoft has, the only reason they don't cause damage is because most Redhat users know what they are doing. I've said it before and I'll say it again, it's impossible to make bug free software, Microsoft had fixes for this available right away and had it all over the media, and STILL there are people that choose not to listen, not run virus scanners and open any attatchment they receive. Microsoft can be blamed for bugs, but not for stupid users.</font>

<font face="Verdana, Arial, Helvetica, sans-serif" size="2">Originally posted by richard:
There are two differences:

1. MS markets Windows to novice users. Redhat is marketed more to advanced users.

2. MS created huge flaws in their basic OS (see my post above), that were easily visible to someone in 1991. Unix and later Linux were built on a robust model with security taken into account from the get-go.</font>