full-disclosure - A worm...

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

From: hobbit at avian.org (*Hobbit*)
Subject: A worm...

Maybe I'm a bit out of the loop, but this one is interesting BECAUSE
of the .zip encapsulation.  The fact that it spreads at all is due
to one or both of

	.ZIP archives now auto-explode and auto-EXECUTE contents
	inside some MUAs

	people are being REALLY stupid

The first one, if true, is disturbing because it used to be that
wrapping content inside a .zip attachment is one way to get known
bad content to colleagues and NOT have it donked by [most] content
filters.  It should take manual, explicit action by the recipient
to open the .zip and be careful with the contents.

Is this no longer the case?!  What idiot mail-readers have auto-
execute-zip-contents capability, if any??  I knew this was comin'
someday, even so...

_H*