Many readers will, by now, be familiar with the results of "SoBig," this
week's worm afflicting Microsoft systems. This worm,
by some
estimates, is accounting for some 70% of all email traffic on the net
as this article is being written. Even those of us smugly running Linux,
and who are thus not directly susceptible to this worm, have been affected
by the flood of incoming email.
Interestingly, here at LWN we might have remained almost unaware of this
worm. SpamAssassin does a perfectly
fine job of filtering out SoBig mail; it never made it to our mailbox. The
same cannot be said for the steady stream of "your email contained a virus"
mail which continues to pour in. Finding our real mail among all of the
virus notifications has become a bit of a challenge.
The thing is, of course, that we have not sent infected mail to anybody.
Honest. Neither have many of the other people who have gotten these
notifications. The software sending these notifications is working on the
assumption that email containing virulent malware will also be so polite as
to contain a
correct return address. SoBig is far from the first infestation which
forges return addresses, and it will certainly not be the last.
If virus notification email ever served a purpose, it has long since
outlived it. Virus/worm scanning software has its place in organizations
which are running vulnerable software, but as soon as it starts sending
mail to addresses found in hostile mail, it becomes part of the problem.
If you have anything to do with the development, deployment, or
administration of such software, please consider turning the notification
feature off.
Comments (21 posted)
Bruce Schneier's CRYPTO-GRAM newsletter for August is out. It looks at
airline security silliness, hidden text in documents, and Bruce's new
book. "
If I can name one overarching goal of the book, it's to explain how we
all can make ourselves safer by thinking of security not in absolutes,
but in terms of trade-offs -- the inevitable expenses, inconveniences,
and diminished freedoms we accept (or have forced on us) in the name of
enhanced security.
"
Full Story (comments: none)
CERT has issued an advisory on the compromise of the GNU FTP server.
"
Because this system serves as a centralized archive of
popular
software, the insertion of malicious code into the distributed
software is a serious threat. As the above announcement indicates,
however, no source code distributions are believed to have been
maliciously modified at this time
"
Full Story (comments: none)
The latest
Linux Advisory Watch and
Linux Security Week newsletters from
LinuxSecurity.com are available.
Comments (none posted)
