Subject: RE: [Asrg] Viruses

From: Barry Shein <[email-masked]>
Date: Wed, 25 Jun 2003 19:21:15 -0400

On June 25, 2003 at 12:49 [email-masked] (Hallam-Baker, Phillip) wrote:
 > > I guess you can claim that if you dismiss any vulnerability 
 > > as an "odd serious 
 > > bug".

To my mind there's a difference between, say, a sendmail vulnerability
which is discovered and a patch issued within hours and a virus which
can infect Windows95/98/NT/XP/2000/ME and probably other versions
which are releases spanning several years. See:

  http://www.symantec.com/avcenter/venc/data/pf/backdoor.jeem.html

I realize you want to defend MS for some reason and just launch into
this sports-team bar babble retort like we're arguing about who was
the best pitcher.

But I maintain with complete professional objectivity that there are
serious flaws inherent in Windows OS design which allow a virus such
as Jeem to infect several generations of Windows OS at a deep, system
level. 

Jeem, as a case in point:

      Copies itself to the system directory

      Adds a new registry key causing it to auto-start on boot

and seems to do all this without any special system privileges.

Now, without invoking how "some other OS is worse in your opinion",
and accepting that this sort of thing (and exactly this also) seems to
be a major vector in the spam problem, tell me how this happens across
at least six major releases.

I mean I want to know what technical flaws it exploits and why those
flaws are present and available across all six OS releases (by "why" I
don't mean philosophical "why", I mean what purpose this flaw serves
or why it hasn't been fixed or has it?)

For example, is it a FEATURE of all mentioned windows OS's that any
non-privileged program can add new .EXE files to the system directory
and modify the registry such that those newly added programs autostart
on boot?

Or is it a BUG which was exploited? And if it's a BUG is it odd that
the same bug exists across all those releases, has it been known
previously, why hasn't it been fixed in, apparently, over 7 years
(Windows95 ... XP.)

Try to remain technical and on point, and please try to avoid
sophistry.

I really believe we are nearing the actual heart of the spam problem.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Tom Thomson" <[email-masked]>
Date: Wed, 2 Jul 2003 17:55:34 +0100

Barry Shein uttered, in the course of one of his boring anti-MS rants, the
following:-

>   http://www.symantec.com/avcenter/venc/data/pf/backdoor.jeem.html

I realize you want to attack MS for some reason and just launch into these
rants as opportunity knocks, but might I suggest that if you compare time
from detection to fixing (in the sendmail case) with time from issue of the
first system that could be vulnerable up to present date in the Microsoft
case you are comparing two very different things.

Jeem was first detected Nov 15 2002. So you can't measure a span of years
from discovery. *nix buffer overruns were first detected long before that
and many remained unfixed for years.

Tom Thomson

---

From: Barry Shein <[email-masked]>
Date: Wed, 2 Jul 2003 15:57:14 -0400

> and many remained unfixed for years.

Buffer overruns have been rampant over the years in all vendors'
software (and freeware, etc.) MS is also forever releasing patches,
particularly in IIS, to fix buffer-overrun coding bugs.

It's a vague and broad description of a generalized problem in coding
quality, a true bug, not an architecture or design strategy such as
allowing any mail macro to add system software and update the
registry.

The problem is finding them all in millions and millions of lines of
code. Occasionally they sneak in somewhat subtly. No one (here anyhow)
is complaining about a true oversight or bug.

Unfortunately for your puff piece, this is not comparable to
tolerating a set of very specific viruses/trojans/worms exploiting the
same (mis-)feature in a family of operating systems released over a
period of several years.

That's just refusing to fix a problem.

Anyhow, you do your cause no good, maybe you should let Microsoft
defend Microsoft, I doubt they need cheerleaders defending them in a
technical forum.

-- 
        -Barry Shein