Subject: RE: VIRUS WARNING

From: Vernon Schryver <[email-masked]>
Date: Thu, 4 May 2000 10:42:13 -0600 (MDT)

> From: Lillian Komlossy <[email-masked]>

> The whole world will not switch over to Unix 
> - the average user will always be more confortable with Windows 
> unless Unix will at one point offer the same  seamless user-friendliness. 
> So it will always be a problem, one which cannot be solved by telling 
> others not to use what they've accustomed to - and one which cannot be
> ignored.

The issue cannot be ignored, but it has nothing to do with UNIX.  The
only connection with UNIX is that UNIX comes from the old tradition in
which design involved more than increasing already long lists of bullet
items that people with no knowledge or interest in computers think they
understand, but don't and don't care that they don't.

The issue is that the Internet is not merely a big but private corporate
internet such as the one in Redmond.  Authentication and authorization
are not the same things.  That which is most convenient or "user-friendly"
is not safe enough, whether it is using ActiveX to update software from
AOL/Netscape or Microsoft headquarters without the informed consent of
the local user, not requiring the informed local consent before running
the latest dancing baby email attachment, or many other things including
those that are called viruses but that don't differ significantly.

Vernon Schryver    [email-masked]

---

From: "Lipford, Mark" <[email-masked]>
Date: Thu, 4 May 2000 11:48:24 -0500

This discussion is a bad as the virus.  Can we take it off this list and
have it individually please?
Mark A. Lipford

		-----Original Message-----
		From:	Lillian Komlossy [mailto:[email-masked]]
		Sent:	Thursday, May 04, 2000 11:02 AM
		To:	[email-masked]'
		Subject:	RE: VIRUS WARNING 

		Donald,

		The whole world will not switch over to Unix 
		- the average user will always be more confortable with
Windows 
		unless Unix will at one point offer the same  seamless
user-friendliness. 
		So it will always be a problem, one which cannot be solved
by telling 
		others not to use what they've accustomed to - and one which
cannot be
		ignored.

		Lillian Komlossy                     
		Site Manager                         
		http://www.dmnews.com           
		http://www.imarketingnews.com  
		(212) 925-7300 ext. 232 

		-----Original Message-----
		From: Donald E. Eastlake 3rd
[mailto:[email-masked]]
		Sent: Thursday, May 04, 2000 10:48 AM
		To: [email-masked]
		Subject: Re: VIRUS WARNING 

		The whole world does not run software which is a good
culture medium
		for email viruses.  I mostly use nice old UNIX software and
it would
		take a number of extra steps on my part for some embdedded
virus to
		get a chance to run.  If your software automatically
executes stuff
		in attachments, you need to change your software, not
develope a list
		of subject lines you are freightened of.

		Donald

		From:  "Scot Mc Pherson" <[email-masked]>
		To:  <[email-masked]>, <[email-masked]>
		Date:  Thu, 4 May 2000 09:27:19 -0400
		Message-ID:
<[email-masked]>
		Content-Type:  text/plain;
			      	charset="iso-8859-1"
		Content-Transfer-Encoding:  7bit
		X-MSMail-Priority:  Normal
		X-MimeOLE:  Produced By Microsoft MimeOLE V5.00.2314.1300
		Importance:  Normal
		In-Reply-To:  <[email-masked]>
		Content-Transfer-Encoding:  7bit
		X-Loop:  [email-masked]
		Content-Transfer-Encoding:  7bit
		>The is an e-mail virus going around. The subject of the
e-mail is
		>ILOVEYOU...I suggest you delete it the moment you receive
it.
		>
		>-Scot Mc Pherson, N2UPA
		>-Sr. Network Analyst
		>-ClearAccess Communications
		>-Ph: 941.744.5757 ext. 210
		>-Fax: 941.744.0629
		>-mailto:[email-masked]
		>-http://www.clearaccess.net
		>

---

From: "J. Noel Chiappa" <[email-masked]>
Date: Thu, 4 May 2000 14:38:09 -0400

> Actually what happened, was I received this virus from a trusted friend
    > ... I am just glad that I didn't have any e-mail lists in my "address
    > book"

That's actually an interesting bit of "social engineering" on the part of the
virus writer - using the address book as a source of places to propogate to
means that those people who get it are *exactly* the set of people who know
you, and are thus more likely to open a random unexpected attachment...

	Noel

---

From: "Jim Stephenson-Dunn" <[email-masked]>
Date: Thu, 4 May 2000 13:18:20 -0700

Office for Unix, Now there's a terrifying thought !!!!

(please don't contaminate the purity of my unix system with that filthy
windows software)

Jim

Jim Dunn

Senior Network Engineer
San Francisco NOC

-----Original Message-----
From: A James Lewis [mailto:[email-masked]]
Sent: Thursday, May 04, 2000 11:53 AM
To: Lillian Komlossy
Cc: [email-masked]'
Subject: RE: VIRUS WARNING

The whole world will use what they are presented with.... the difference
between Win3.1 and Win95 is far greater than the difference between Win95
and GNOME or KDE... so actually it's only software availability thats
holding back IS departments the world over!

If MS gets split, we could have Office for UNIX sooner rather than
later too!

On Thu, 4 May 2000, Lillian Komlossy wrote:

> From: Donald E. Eastlake 3rd [mailto:[email-masked]]
> The whole world does not run software which is a good culture medium
> for email viruses.  I mostly use nice old UNIX software and it would
> take a number of extra steps on my part for some embdedded virus to
> get a chance to run.  If your software automatically executes stuff
> in attachments, you need to change your software, not develope a list
> Message-ID:  <[email-masked]>
> >The is an e-mail virus going around. The subject of the e-mail is
> >ILOVEYOU...I suggest you delete it the moment you receive it.
> >
> >-Scot Mc Pherson, N2UPA
> >-Sr. Network Analyst

A. James Lewis ([email-masked])
Don't throw your computers out of the windows,
throw the Windows(tm) out of your computers.

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Fri, 05 May 2000 21:25:57 -0400

In message <[email-masked]>, Brant Knudson writes:
>
>I think I'm starting to see a pattern emerging in email viruses.
>
>Melissa:  Uses script to read user's address book to get the email
>addresses of new victims.
>ILOVEYOU: Uses script to read user's address book to get the email
>addresses of new victims.
>
>What method do you think the next email virus is going to use if
>Microsoft doesn't stop scripts from reading people's address books?  Why
>didn't MS plug this hole after Melissa?

Hardly new -- the IBM Christmas Card Virus, in 1987 (yes, before the Morris 
Worm) used the exact same technique.

		--Steve Bellovin

---

From: Ian King <[email-masked]>
Date: Fri, 5 May 2000 15:05:21 -0700

The goal of those who write viruses is to get attention, true?  I guess they
figure that writing their viruses for Windows is going to get them a lot
more attention than writing for other operating systems with smaller user
bases.  :-)  

Tongue firmly in cheek -- Ian King 
----------
DISCLAIMER: The foregoing is my personal opinion, and should not be
construed as the official position of or statement by my employer.  

-----Original Message-----
From: Randall Stewart [mailto:[email-masked]]
Sent: Friday, May 05, 2000 1:05 PM
To: Michael H. Warfield
Cc: [email-masked]; Scot Mc Pherson; [email-masked]
Subject: Re: VIRUS WARNING

Michael:

I could not agree more, we have a few (possibly .. 3) virus that have
infect *nix systems. Even more telling, look at how linux systems
have NOT been infected or bothered much. I find this interesting
since the code - bugs, wart, and any holes are available to any
who want to look at it...

Now if I take and switch the machine I am typing on over to
that "other" o/s the virus scanner it has lists 100's and I 
mean 100's of viruses...

I do understand that some of us are STUCK with that other
O/S... but there are options.. I too am in theory using it.. but
only when I have to... I do all my real work on the linux side and
only occasionaly fire up the other side to read a awful .doc or .ppt
file...

I simply refuse to allow our IT dept to have there way with me and
infect me with the worst virus... that other O/S :-)

R
[snip]

---

From: "Jim Stephenson-Dunn" <[email-masked]>
Date: Sun, 7 May 2000 23:52:14 -0700

Sorry Lillian, Forgot to add the smiley !!! Did not intend to upset anybody

I actually use both systems, but prefer Unix ;->

Jim

-----Original Message-----
From: Lillian Komlossy [mailto:[email-masked]]
Sent: Thursday, May 04, 2000 2:28 PM
To: Jim Dunn
Cc: [email-masked]'
Subject: RE: VIRUS WARNING 

Let's not make it political. We've all been attacked, it is pointless
to bring in the Unix vs Windows debate. Office, Windows, Unix, Linux, Mac 
are all great as long as somebody likes to work with them. 
I personally like Microsoft products, but I respect those who don't - and
expect the same respect from them.

Lillian Komlossy                     
Site Manager                         
http://www.dmnews.com           

-----Original Message-----
From: Jim Stephenson-Dunn [mailto:[email-masked]]
Sent: Thursday, May 04, 2000 4:18 PM
To: 'A James Lewis'; 'Lillian Komlossy'
Cc: [email-masked]
Subject: RE: VIRUS WARNING 

Jim

Jim Dunn

Senior Network Engineer
San Francisco NOC

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 11 May 2000 08:20:19 -0600 (MDT)

> From [email-masked] Thu May 11 06:36:01 2000
> From: Steven M. Bellovin [mailto:[email-masked]]

> ...
> > Note the two crucial points -- it ran with the user's permissions, and 
> > it was explicitly run by the user, rather than by any automatic 
> > mechanism.

> From: "Castro, Edison M. (PCA)" <[email-masked]>

> That is exactly the same way that all Windows virus work. As a Windows 
> user (as well as other OSes), I can say that people have to be responsible 
> for their actions.  Whenever you receive any Email attachment, the only way
> that attachment can produce any damage is if you run it.
> ...

> Not only that, this version of Word (2000) is configured to only ask me when
> a signed (with a certificate of a trusted party) macro is included.

There are serious mistakes in that.
First, is the perhaps minor point that rumor has it that Outlook Express
(as opposed to Outlook) is eager to open attachments automatically.

Second, what matters is not only what configuration changes can be made
to close some of the holes, but how systems are configured by default
from the CDROM's and how they are most commonly configured in practice.

Third, and where the first serious mistake lies, on Windows 98 the worm
did not run with merely the user's permissions.  That constrasts with
reasonable operating systems, where much of its damage would be impossible.

Forth, the most serious problem is that most computer users and many who
consider themselves more than mere users have no clue what is meant by
"the user's permissions."  The main desktop operating system vendors can
be blamed more for obscuring that notion among users than for their other
crimes.  It is the equivalent of refusing to equip cars with seat belts,
air bags, stop lights and tail lights on grounds of "user-friendliness."

Never mind that the current worm involved Visual Basic instead of Word
macros.  Regardless of the programming language, given the familiar
"feature rich," "user friendliness," it's probably trivial for a worm to
find the user's signature and sign its spawn.  You wouldn't want users to
need to type a passphrase, use a smart card, or anything else so
complicated and user-unfriendly merely to send mail, would you?  Thus,
the next act in this circus will not only involve email from people you
know (as this one did), but it will also be cryptographically signed by
the apparent senders.

---

From: "Scot Mc Pherson" <[email-masked]>
Date: Thu, 11 May 2000 16:10:33 -0400

strictly speaking the US postal service is not a form of electric or
electronic data communication

strictly speaking...my sig IS plain text...it is the browser that recognizes
that it could be used as a link

Strictly speaking

RFC2046, section 4.1.3
says pretty specifically:

4.1.3.  Plain Subtype

   The simplest and most important subtype of "text" is "plain".  This
   indicates plain text that does not contain any formatting commands or
   directives. Plain text is intended to be displayed "as-is", that is,

but it says nothing of e-mail browsers recognizing a string of "plain-text"
as an address.

-Scot Mc Pherson
-RF Engineer

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Thursday, May 11, 2000 3:32 PM
To: Scot Mc Pherson
Cc: [email-masked]
Subject: Re: VIRUS WARNING

On Thu, 11 May 2000 15:04:48 EDT, Scot Mc Pherson
<[email-masked]>  said:
> 	The necessity to send e-mail in html is NOT. Regardless of whether a list
> or commerce wishes to advertise through e-mail, there are already avenues
> for distributing material to demographically selected individuals. Its
> called the WWW and creating hypertext links in an e-mail to direct a user
to
> desired content is certainly MORE than enough, and also solves part of the
> congestion problem, because the user must take the time to visit the site
in
> question as opposed the site making a visit to each and every recipient of
> the message, whether they care about this week's issue of the newsletter
or
> not.

Strictly speaking, part 1:  E-mail as a while is not a necessity.  The US
Postal Service has a 200 year record of delivering large amounts of material
in a reasonably cost-effective manner.

Strictly speaking, part 2:  A case could be made that there should *NOT* be
hypertext links in a text/plain segment of an E-mail.  RFC2046, section
4.1.3
says pretty specifically:

4.1.3.  Plain Subtype

   The simplest and most important subtype of "text" is "plain".  This
   indicates plain text that does not contain any formatting commands or
   directives. Plain text is intended to be displayed "as-is", that is,

OK? Got that?  In other words, it's *PLAIN* text.  You want hyperlinks,
use text/html or some other type that is defined to support them....

(Yes, I *know* people violate this all the time.  Doesn't mean we should
encourage it *more* just because we don't like text/html....)

--
				Valdis Kletnieks
				Operating Systems Analyst
				Virginia Tech

---

From: "Dawson, Peter D" <[email-masked]>
Date: Fri, 12 May 2000 20:45:57 -0000

this is a good idea !! maybe the security wg could look
into this. Jeff, Marcus , any comments ??
/pd

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Friday, May 12, 2000 2:05 PM
To: [email-masked]
Subject: Re: VIRUS WARNING 

On Fri, 12 May 2000 13:38:43 EDT, Jeremy said:
> Can you plase pleaes stop this Virus Thread.

Actually, there *ARE* important issues here.

Would the IESG support the creation of a WG to discuss these, with the
charter of producing a BCP documenting what *should* be done to minimize
these risks in today's internet? 
-- 
				Valdis Kletnieks
				Operating Systems Analyst
				Virginia Tech

---

From: Christian Huitema <[email-masked]>
Date: Fri, 12 May 2000 15:12:22 -0700

> All of that can be done in pure ASCII.  

... that is, if you speak english. You can definitely write the way of
Shakespeare, but you have a tiny problem writing the way of Molière, let
alone Confucius. Then, there are things that are hard to do in writing,
however able is your prose. Maps and pictures, songs and recordings come to
mind. There was a rationale for creating MIME.

Framing the debate as ASCII versus HTML is a bit reductive. The real
separation here is self-contained versus network based. Carrying a picture
in a message is definitely valuable, carrying a link to a picture that is
stored on some random web site creates an obvious privacy risk -- the URL
itself can be the hidden communication channel that tracks you.

---

From: [email-masked]
Date: Mon, 15 May 2000 08:20:36 -0400

PLEASE change the title of this thread.  It's borders on a partial self
denial of service, since the title is now misleading.  Thank you.

Bill Flanigan

-----Original Message-----
From: Henry Clark [mailto:[email-masked]]
Sent: Sunday, May 14, 2000 4:35 PM
To: Jeremy
Cc: [email-masked]
Subject: Re: VIRUS WARNING

>Can you plase pleaes stop this Virus Thread.

This thread _is_ the virus...