full-disclosure - AV "feature" does more DDoS than Sobig

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: steve.wray at paradise.net.nz (Steve Wray)
Subject: AV "feature" does more DDoS than Sobig

I'm just going to snip out all the previous stuff
because really this isn't strictly following on 
from it, but is related.

*If* you are going to implement an AV system
on your servers to filter incoming mail for
viruses then you need to make sure that its
properly configured. Obviously.

And there are a *ton* of things to get right.

You are dealing with 'explosive material';
viruses, trojans and *other* files intended to
cause ill effect.

Now, I am going to attach a binary to this email.
Its only about 1.5K, thats not too big an attachment
is it?

Cool. Just don't try unpacking it unless you have over
20G of disk space available. Oh and that applies
to your email antivirus system as well.

You might want to check the AV spool space to make sure that
it properly cleaned up after discovering that there
was too much to decompress (assuming that they even bother
with bz2 compressed files; one can do a similar trick
with zip).

This file is created from about 20G of null characters.

I take no responsibility for any ill effects of
unpacking this file; you have been warned and besides its
a great opportunity to figure out a workaround.
Imagine if spammers started attaching these zip-bombs!
ewwwwww

Check the configuration of your AV, check every detail
and think about it; its a public service to the whole internet
not just your own users.