full-disclosure - Anti-MS drivel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: Valdis.Kletnieks at vt.edu (Valdis.Kletnieks@...edu)
Subject: Anti-MS drivel 

On Mon, 19 Jan 2004 19:58:15 EST, "David F. Skoll" said:

> It's pathetic that 17 years after CHRISTMA EXEC, hundreds of thousands of
> Windows machines are succumbing to the same easily-preventable security flaw.

What's even MORE pathetic is that even 17 years ago, CHRISTMA EXEC required for
you *first* to receive the file from your "reader" space to your disk space,
and *then* to invoke it as a command.  So that's the equivalent of first saving
an attachment from an e-mail into a directory, and then going and finding the
file in the directory and launching it.  At that point, there's not much you
can do if you're going to allow attachments at ALL. (Also, IBM quickly released
a set of patches against RSCS (the communications subsystem in use for VNET and
Bitnet) that allowed filtering of filename/filetypes, with either quarantining
or renaming of the files - so a site admin could make CHRISTMA EXEC end up
being called CHRISTMA CEXE, which then wouldn't run unless the user manually
renamed it back.)

The other interesting thing was that although CHRISTMA EXEC went on quite the
burn then (I should know, I was the admin of a VM system on Bitnet at the time
;), the user community *learned*, and although there were 5-6 subsequent
copycat programs, they were nowhere near as widespread.  However, today people
will *still* click on unknown stuff....

Moral of the story - in the past 2 decades, the users have gotten stupider, and
many of the software designers have as well.....
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040120/11776159/attachment.bin