| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <200308201316.h7K0p1g9000716@turing-police.cc.vt.edu> From: Valdis.Kletnieks at vt.edu (Valdis.Kletnieks@...edu) Subject: Filtering sobig with postfix On Wed, 20 Aug 2003 10:17:16 +0200, vogt@...senet.com said: > /see attached file for details/ REJECT > > ever since, I've not had a single one coming through. The reason this one works for the worm writers is because it's standard English usage - as a result, it's *very* prone to false positives. And you give no indication of *why* the file was rejected, so the sender has no idea that if he re-sends but says "Hey check out the file for the long version" instead it will get through. If you're going to do this, scan for something that's almost certainly unique to the worm(s) you're fighting, and give the user a hint what the problem is.... -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 226 bytes Desc: not available Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20030820/4cc72b61/attachment.bin
Powered by blists - more mailing lists