Subject: [Asrg] Viruses

From: [email-masked]
Date: Tue, 24 Jun 2003 13:32:22 -0500

> Ironically, it may well be that a single company can stem the tide of
spam alone and, remarkably enough, it's Mr Gates' company.

OK, Barry, after sitting back on this one for a while, I'm going to pick up your 
bait.

Certainly there is a LOT they could do, but in practice probably little of that 
is at the OS level.

> Apparently much of the spam is forwarded via computers which have been
infected by viruses turning them into unwaitting mail slaves for
spammers.

There's LITTLE excuse for allowing that to happen.

> Reviewing the most common of these viruses, such as Jeem, sobig.a and
Proxy-guzu, indicates that they all target Microsoft's winows
operating system. Versions up to and including their latest XP and ME.

Of course.  If you were writing a virus, you'd also write it to propagate on the 
most likely systems you expected the code to land in.  OF COURSE virus authors 
target Outlook, Windows, Word, etc.  

There have been plenty of worms on other systems, but those are a minority of 
attackable systems so virus authors OF COURSE go for the more fertile ground.

> There's a reason for this: Microsoft's operating systems are
vulnerable to viruses.

ALL operating systems are vulnerable to viruses, as long as the systems are 
user-programmable (or program-extensible).  OK, your digital watch, your 
microwave oven (probably), and your laser printer probably aren't vulnerable to 
viruses.  But that's because nobody else can much change their code, either.

> Other operating systems, or at least late-releases (e.g., Max OSX),
are not susceptible to viruses.

And just what is the "magic bullet" that you think magically makes those systems 
"not susceptible"?  I don't believe that there IS such a magic bullet.

Any computer on which software can be installed could theoretically have BAD 
software installed.  I don't believe it's possible by any kind of automated 
means to determine absolutely that an arbitrary subject program is bug-free, or 
even that it will terminate.

And in particular, a WORD macro virus (for instance) which works on a 
Windows-based OS will probably work on a Mac-based OS too... since the level of 
abstraction provided by the macro facility SPECIFICALLY shields the executing 
macro from vagaries based on the underlying OS.

> The technology for immunizing OS's against viruses has been known for
about 40 years (before viruses even existed!) It's been commonly used
in other OS's for about 20 years. 

What "immunizing technology" are you referring to?

The US military has spent many billions of dollars over the years in research 
trying to find "absolutely secure" operating systems, and although they have 
made some fairly impressive strides, I don't think that any of them has gotten 
anywhere near 100%.

> And it's been available on consumer/desktop PC-class machines for at least 10 
years.

What "it" do you think "immunizes" OSes?  And even if "it" did, what makes you 
think that other vulnerabilities can't be opened by buggy or ill-conceived 
applications?

> So why does Microsoft continue to provide opportunity for spammers
unnecessarily?

While I would never claim that Microsoft has done everything possible to prevent 
abuse (far from it, at times) a LOT of the problem is at the application level, 
and not at the OS level proper.

Buffer overflow exploits, in particular, (along with similar array subscript 
range or string boundary violations) are readily possible with processors which 
permit unconstrained address calculations, and (also in particular) C is pretty 
much totally undisciplined about such things (and that's just as much true of C 
on Mac or Unix systems as it is for C on Windows-based systems).

The better solution is really to put restrictions in place on incoming material 
(and E-mail is our focus here) such that potentially dangerous executable stuff 
(and in practice, this means ActiveX-type stuff, scripting, and potentially 
malicious attachments) simply aren't allowed to be delivered unless they come 
from pre-arranged (or post-permitted, maybe), _trusted_ people who we EXPECT 
such type of stuff to come from.

Just as nobody should ever be stupid enough to run an executable that arrives in 
an E-mail from someone they don't know, they similarly shouldn't run executables 
that arrive from someone they DO know unless they know what it's about, and have 
verified (separately) with the sender why it was sent and that it's legitimate. 
 There is no reason why such windows of vulnerability should be left open for no 
reason at all.

I got a spam just a day or two ago shilling for a porn site and crowing about 
how "no credit card required".  The link said, in essence, "to connect to this 
site directly using your modem, CLICK HERE."  Under the concealment of the HTML, 
the link pointed to a URL of .exe type.  Most lusers wouldn't realize (of 
course) the implication of the (truthful) prompt... that the executable was 
planning to hang up the person's Internet connection through their local ISP, 
then redial on the user's modem to a 900-type international telephone number at 
staggering per-minute charges, which will of course bill to the luser's phone 
bill to arrive a month later.  (And of course, if it's a business line at the 
person's employer, they'll probably never even notice...!  What employee ever 
sees and studies the monthly phone bill for your desk's/computer's phone line?)

Such scams, by the way, also tend to (besides the porn site itself) embody proxy 
servers so that even after the visitor tires of whatever porn is on offer, tends 
to stay connected to the Net and continue their other net surfing through the 
new, international premium pay-by-the-minute dialup connection, totally unaware 
that they're no longer connected through their own local ISP.

Anyhow, here's just another example of a case where the original deception that 
sets this whole mess up comes from the fact that the original message is 
HTML-burdened, permitting the spammer to hide the downloading of an executable 
inside an "invisible" link that just looks like any other "click here" 
hyperlink.  Of course, it would be nearly as easy to include an executable 
attachment (which is the way that most such stuff has been pulled in the past).

Notably, my permission-list idea would most likely squash BOTH of these 
deceptions... no unauthorized attachments, and forcing the user to 
copy-and-paste a more-likely-visibly-dubious URL into their browser before going 
to get it.

Of course, on my machine this particular scam wouldn't work, since I don't use a 
dialup internet connection to begin with.

Gordon Peterson                  http://personal.terabites.com/
1977-2002  Twenty-fifth anniversary year of Local Area Networking!
Support the Anti-SPAM Amendment!  Join at http://www.cauce.org/
12/19/98: Partisan Republicans scornfully ignore the voters they "represent".
12/09/00: the date the Republican Party took down democracy in America.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 24 Jun 2003 12:26:25 -0600 (MDT)

> From: [email-masked]

> ...
> software installed. 

What major operating systems are configured by default to install
software from distant servers unknown to a computer system's owners?

>                      I don't believe it's possible by any kind of automated 

The halting problem is a red herring.

> macro from vagaries based on the underlying OS.

That's another red herring.  I believe the WORD macro virus hole
was closed long ago.  I know that similar holes in emacs and vi
were closed many years ago.

> ...
> made some fairly impressive strides, ...

That's yet another red herring.  The DOD trusted systems efforts have
been targeted mostly at keeping secrets within a system instead of
preventing the installation of bad software.  Historically, the standard
way (on at least some such trusted systems in my personal experience)
for vendors to install software is to be escorted past the armed guards
with your media, bypass and turn off the MAC (mandatory access control)
system, install the software, restore the MAC stuff, and leave your
media to be destroyed.

I think the DOD's trusted system stuff is a boondoggle, waste of money,
and worse, gives people a false sense of security, but that's also
irrelevant here.

>  ...

are powerless unless the exploit is in software that has permission
to install software or at least execute software.  Worries about such
issues is why MTAs often run in "chroot jails".

This is yet another red herring.

>  There is no reason why such windows of vulnerability should be left open for no 

What major system is configured by default to execute programs that
arrive in email and is configured by default gives the MUA of every
user the right to install software?

What major system system vendor touts as an advantage the lack of
a "sandbox" in its competetors to Java?

What does any of this have to do with ASRG or with spam in general?

Vernon Schryver    [email-masked]

---

From: wayne <[email-masked]>
Date: Tue, 24 Jun 2003 13:46:26 -0500

> software from distant servers unknown to a computer system's owners?

Debian Linux does.  Oh, wait, you said "major OSes".  Nevermind!

-wayne

---

From: Steven F Siirila <[email-masked]>
Date: Tue, 24 Jun 2003 14:07:03 -0500

> Debian Linux does.  Oh, wait, you said "major OSes".  Nevermind!

Apparently ASUS Display Drivers for Windows XP!  I traced an FTP session
from my computer to Taiwan at the precise time I was installing those drivers.
(This was a freshly-installed Windows XP behind both a hardware and software
firewall, in case you think the system was compromised.)

---

From: Barry Shein <[email-masked]>
Date: Tue, 24 Jun 2003 18:31:09 -0400

No, there are actually specific weaknesses in the memory and
protection model of windows operating systems which allow programs run
by ordinary users without privileges to infect the machine with
viruses.

Plus or minus the odd serious bug or misconfiguration operating
systems such as unix, linux, VMS, MVS, TOPS-20 (going back 20+ years),
etc are more or less immune to such problems. This is because you
generally have to first obtain super-user privilege to modify system
software.

This is really viruses 101.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*

---

From: [email-masked]
Date: Tue, 24 Jun 2003 23:21:36 -0500

>by ordinary users without privileges to infect the machine with

Viruses and worms can easily enough propagate while operating without 
privileges.

The fact is that Sun, Linux, Mac, VMS, and other OSes (and apps running under 
those) also can be and have been subject to viruses too.  The main reason 
they're not infected more often is because Windows and its apps are more widely 
found, and thus a more appealing target for virus authors.

>etc are more or less immune to such problems. 

I guess you can claim that if you dismiss any vulnerability as an "odd serious 
bug".

OS/MVT had plenty of strong memory and protection features, but (like most ANY 
operating system) there were plenty of holes and vulnerabilities, too.  All 
systems have them;  most nontrivial applications do, too.

> This is because you generally have to first obtain super-user privilege to 
modify system software.

But you don't have to "modify system software" to become infected with a worm, 
virus, or trojan.

>This is really viruses 101.

The problem (here on THIS list at least) isn't viruses, it's the ability to 
install malicious programs that can aid and abet spammers.  That does NOT 
require system root rights.  

One of the things that's so appealing about the sender/recipient pair 
permissions lists is that the SAME mechanism works against BOTH spam AND 
viruses/worms/trojans.  And it doesn't require a special theoretical 
high-security operating system to achieve that.

---

From: Walter Dnes <[email-masked]>
Date: Sat, 28 Jun 2003 00:26:17 -0400

On Tue, Jun 24, 2003 at 01:32:22PM -0500, [email-masked] wrote

> ALL operating systems are vulnerable to viruses, as long as the
> systems are user-programmable (or program-extensible).  OK, your
> digital watch, your microwave oven (probably), and your laser printer
> probably aren't vulnerable to viruses.  But that's because nobody
> else can much change their code, either.
> 
> And just what is the "magic bullet" that you think magically makes
> those systems "not susceptible"?  I don't believe that there IS such
> a magic bullet.

  Because they *DON'T AUTO-EXECUTE EMAIL*.  Yeah, there's been a patch
out for a while, but each time somebody's Windows crashes, and they
re-install, they're back to square 1.  Unixes used to have backtick
expansion enabled in mailcap.  It was determined to be "not a good
thing" and was depracated.  Windows comes with "Windows Scripting Host"
enabled.  And even if you delete it, most 3rd-party programs' install
routines will install a copy to facilitate the install script.  Of
course the installer leaves the scripting host installed.

> And in particular, a WORD macro virus (for instance) which works on
> a Windows-based OS will probably work on a Mac-based OS too... since
> the level of abstraction provided by the macro facility SPECIFICALLY
> shields the executing macro from vagaries based on the underlying OS.

  Not on AbiWord for linux, it won't execute.

> The better solution is really to put restrictions in place on
> incoming material (and E-mail is our focus here) such that potentially
> dangerous executable stuff (and in practice, this means ActiveX-type
> stuff, scripting, and potentially malicious attachments) simply
> aren't allowed to be delivered unless they come from pre-arranged
> (or post-permitted, maybe), _trusted_ people who we EXPECT such type
> of stuff to come from.

  Howsabout the OS not allowing users to execute attachments from inside
email.  Beyond this, what about *AUTO_EXECUTION OF ATTACHMENTS* ?

> I got a spam just a day or two ago shilling for a porn site and
> crowing about how "no credit card required".  The link said,
> in essence, "to connect to this site directly using your modem,
> CLICK HERE."  Under the concealment of the HTML, the link pointed
> to a URL of .exe type.  Most lusers wouldn't realize (of course)
> the implication of the (truthful) prompt... that the executable was
> planning to hang up the person's Internet connection through their
> local ISP, then redial on the user's modem to a 900-type international
> telephone number at staggering per-minute charges, which will of
> course bill to the luser's phone bill to arrive a month later.

  Windows *BY DEFAULT* displays an attachment named "Loveletter.txt.vbs"
as "Loveletter.txt".  *EVEN IF YOU TURN OFF THE OPTION TO HIDE
EXTENSIONS* .lnk and .pif *WILL STILL BE HIDDEN*, unless you get into
some registry hacking that is beyond the ability of the average user.
We pound away at users not to execute executable attachments, and they
think that clicking on a *.GIF or *.JPEG is OK.

-- 
Walter Dnes <[email-masked]>
Email users are divided into two classes;
1) Those who have effective spam-blocking
2) Those who wish they did