[ILUG] Porting MyDoom to Linux

[kevin lyda]

On Wed, Feb 04, 2004 at 03:09:31PM +0000, Chris Higgins wrote:
> Do we ? Are we not better to assume that 'untrusted' means
> just that - and not attribute more or less trust based on 
> what we think the data is , isn't that one of the core problems
> in the MS Outlook mail client - it trusts the file-type
> information too much, and passes data onto a helper which 
> ignores the file type information and works it out for itself
> and is then happy to act based on new information learned ?

i suppose i agree.  the distinction exists because if i just execute
an attachment i sent it off unmonitored and unfettered (except by unix
uid and fs permission rules).  if i open it, that means a program is
going to monitor and control what the attachment "does."

but different types of data take different amounts of effort to control
them.  a pager might need to avoid certain terminal control chars.  an
image viewer might need to avoid resource hogging issues.  a postscript
viewer needs to avoid cpu sucking and dangerous postscript commands.
all of them must avoid buffer overflows and other security damaging
bugs.

kevin

-- 
kevin at ie.suberic.net ....... financial math: if bill gates & 10,000 homeless
http://ie.suberic.net/~kevin/cgi-bin/blog .. guys are in a room, the average
net worth of each of them is over $1,000,000.  now, why do you care what the
average bush tax "cut" was again? ........... http://www.deanforamerica.com/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 232 bytes
Desc: not available
Url : http://mail.linux.ie/pipermail/ilug/attachments/20040204/cf8ce6fc/attachment.pgp