Subject: RE: VIRUS WARNING

From: "Castro, Edison M. (PCA)" <[email-masked]>
Date: Thu, 11 May 2000 08:24:11 -0400

That is exactly the same way that all Windows virus work. As a Windows 
user (as well as other OSes), I can say that people have to be responsible 
for their actions.  Whenever you receive any Email attachment, the only way
that attachment can produce any damage is if you run it.

At least in my copy of MS Word anytime I open a word document and it
contains
any macros, Word readily ask me if I want to allow the macro to execute. 
Not only that, this version of Word (2000) is configured to only ask me when
a signed (with a certificate of a trusted party) macro is included.

-----Original Message-----
From: Steven M. Bellovin [mailto:[email-masked]]
Sent: Thursday, May 11, 2000 7:40 AM
To: [email-masked]
Cc: Brant Knudson; [email-masked]
Subject: Re: VIRUS WARNING

In message <[email-masked]>, Einar Stefferud writes:

>
>The first of these "worm/virus/addressbookmailers" was the IBM PROFS
>"Chrismas Card" caper that occurred some time in the early 1990's,
>long before MS willfully adopted the design.

It was in December, 1987.
>
>Seems to me that this beloved "feature" (giving root privs to random
>EMail messages) should (by now) now be fully discredited, and should
>be destined for extinction, if only the customers will accept its
>disappearance in trade for an absence of a continuing flood of these
>$6,000,000,000 economic loss episodes.

See http://catless.ncl.ac.uk/Risks/5.80.html#subj1 for details on how 
it worked -- but it didn't involve any analog to 'root' privileges.

When the recipient got a copy, there was an included (or attached; I 
don't quite remember) REXX file.  (REXX was a scripting language for VM/
CMS.)  The message told you that it would display a Christmas card if 
you ran it; most users did just that, since the note appeared to come 
from someone they knew.  And then the file replicated itself; you all 
know the rest.

Note the two crucial points -- it ran with the user's permissions, and 
it was explicitly run by the user, rather than by any automatic 
mechanism.

		--Steve Bellovin

---

From: [email-masked]
Date: Thu, 11 May 2000 09:44:36 -0400

> that attachment can produce any damage is if you run it.

Well, it's worse.  Melissa, the Love Bug, and the Christmas worm all required
the user to take an action (click/open/run the payload).

However, there's apparently ANOTHER hole....

Seen on a SANS posting yesterday:

/Valdis
-- 10 May 2000  Email viruses are now spreading WITHOUT THE USER
                OPENING ANY ATTACHMENT.
Personal computers running Internet Explorer (IE) version 5.0 and/or
Microsoft Office 2000 are vulnerable to virus attacks using most email
systems, even if the email recipient opens no attachments.  You don't
even have to use IE; just have it installed with the default security
settings.  If you have not closed the hole, you can receive viruses (and
spread them) by viewing or previewing malicious email without opening
any attachment, or by visiting a malicious web site. The problem is
caused by a programming bug in an Internet Explorer ActiveX control
called scriptlet.typelib.  This is by far the fastest growing virus
distribution problem and ripe for a hugely destructive event - at least
as large as the ILOVEYOU virus.  Updating your virus detection software,
while important, is not an effective solution for this problem. You must
also close the hole.  The hole can be closed in five minutes or less
using tools available at Microsoft's security site:
http://www.microsoft.com/security/bulletins/ms99-032.asp 
The correction script may be run directly from:
http://www.microsoft.com/msdownload/iebuild/scriptlet/en/scriptlet.htm
Editor's Note: Thanks to Jimmy Kuo of Network Associates and Nick
FitzGerald of Computer Virus Consulting Ltd. for raising the visibility
of this dangerous problem.

---

From: "Scot Mc Pherson" <[email-masked]>
Date: Thu, 11 May 2000 10:07:13 -0400

I believe the one of the most important holes is html based mail, because
the e-mail is processed as a webpage which can be used to download
undesirable content. If you configure your e-mail browser to display all
messages as text you will close this hole...You will notice my e-mails are
nearly 100% text

Scot

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Thursday, May 11, 2000 9:45 AM
To: Castro, Edison M. (PCA)
Cc: 'Steven M. Bellovin'; [email-masked]; Brant Knudson; [email-masked]
Subject: Re: VIRUS WARNING

> that attachment can produce any damage is if you run it.

Well, it's worse.  Melissa, the Love Bug, and the Christmas worm all
required
the user to take an action (click/open/run the payload).

/Valdis

---

From: Dennis Glatting <[email-masked]>
Date: Thu, 11 May 2000 07:46:48 -0700

> messages as text you will close this hole...You will notice my e-mails are

Downloading content is also a form of receipt notification and
capabilities discovery, which mass e-mailers love to know. Barnes and
Noble have done mass e-mailings learning to tailor future content,
whether you want it or not. 

Another case is teenpicks.com (teen sexual pictures). If we suppose a
CEO, CFO, or directors of a corporation received sexually oriented
HTML e-mail and that e-mail deposited cookies then a claim of a
sexually hostile atmosphere by an employee can be hard to dispute.

-- 
Dennis Glatting
Copyright (c) 2000 Software Munitions

---

From: "Doug Sauder" <[email-masked]>
Date: Thu, 11 May 2000 17:54:41 -0400

> From: Castro, Edison M. (PCA) [mailto:[email-masked]]

Suppose you made the mistake of opening a Word document with a VBA (Visual Basic for Applications) script virus.  (I did this once and I am sharing a real-life experience.)  The VBA script turns off the option that disables automatically running scripts.  I kid you not!  Next time you open a Word document that contains a script, you won't be asked whether you want to run it.  If you go into the options settings and set the option to disable running scripts, you have done nothing, because the virus script runs when you close the document and turns the option back off again.

At least not allowing macros to disable the don't-run-macros option seems reasonable to me, but it seemed to have escaped the engineers who created Microsoft Word.

Doug Sauder
Software Engineer
Broadsoft, Inc