full-disclosure - AV "feature" does more DDoS than Sobig

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <3F4E8896.3040904@adelphia.net>
From: hescominsoon at adelphia.net (William Warren)
Subject: AV "feature" does more DDoS than Sobig

nice point..
While very few are willing or able to take the "draconian" measures i am 
taking..two things..what i will be doing when i turn on the "virus wall" 
is implement a whitelist....if you are on my whitelist..the mail gets 
dropped before it gets scanned.  Any .<compressed> files will go into 
immediate quarantine<since i have a 10 gig drive for the firewall server>

Mind you i would only do this(the immediate quarantine of compressed 
attachments) if someone did that zip bomb..otherwise i will just use the 
whitelist and attachment filters..<G>

Steve Wray wrote:

> I'm just going to snip out all the previous stuff
> because really this isn't strictly following on 
> from it, but is related.
> 
> *If* you are going to implement an AV system
> on your servers to filter incoming mail for
> viruses then you need to make sure that its
> properly configured. Obviously.
> 
> And there are a *ton* of things to get right.
> 
> You are dealing with 'explosive material';
> viruses, trojans and *other* files intended to
> cause ill effect.
> 
> Now, I am going to attach a binary to this email.
> Its only about 1.5K, thats not too big an attachment
> is it?
> 
> Cool. Just don't try unpacking it unless you have over
> 20G of disk space available. Oh and that applies
> to your email antivirus system as well.
> 
> You might want to check the AV spool space to make sure that
> it properly cleaned up after discovering that there
> was too much to decompress (assuming that they even bother
> with bz2 compressed files; one can do a similar trick
> with zip).
> 
> This file is created from about 20G of null characters.
> 
> I take no responsibility for any ill effects of
> unpacking this file; you have been warned and besides its
> a great opportunity to figure out a workaround.
> Imagine if spammers started attaching these zip-bombs!
> ewwwwww
> 
> Check the configuration of your AV, check every detail
> and think about it; its a public service to the whole internet
> not just your own users.
> 
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
> 

-- 
May God Bless you and everything you touch.

My "foundation" verse:
Isaiah 54:17 No weapon that is formed against thee shall prosper; and 
every tongue that shall rise against thee in judgment thou shalt 
condemn. This is the heritage of the servants of the LORD, and their 
righteousness is of me, saith the LORD.