full-disclosure - RE: new outbreak warning

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: ge at linuxbox.org (Gadi Evron)
Subject: RE: new outbreak warning - Bagle

> Say that a remote user with no desktop firewall and old defs got infected...
> THEN---  the user connects to the core switch..  It's only going to spread 
> with the emails collected off the HD right?
> 
> Because it doesn't exploit another *wndoze vuln it has an .exe payload...?

If it exploited the address book like some of these worms, it wouldn't 
be as big as it is. It scans the HDD locally, causing no net lag and 
uses what it finds.

Its simplicity that gets us every time.

The weakest spot gets by our efforts to stop these things. And this is it.

	Gadi Evron

The Trojan Horses Research Mailing List - http://ecompute.org/th-list