Test mail

Hi, just verifying email, enjoy the attached file.

Incase someone was stupid enough to open the attachment, and run the exe, DON'T DO IT.

<McAfee>
/Music.exe
Found the W32/Music@M trojan !!!
</McAfee>

On Sun, 29 Jul 2001, it was written:

I'm not even sure what Wine settings I should use...

/me runs

I opened it up just fine in my gzip app, saw that it was most likely another one of those windows viruses, and tossed it out. Can't run it anyway -- I'm a Mac / Linux shop. Sorry about what happened to all those lemmings, though. Hehe.

--
Sincerely,

Jim Potter
45th Parallel Processing
[email protected]

Would it be possible to have lkml setup to filter out this kind of crap?!?

It had no valid email addresses as From: nor To:...

And if anyone running Windows without an anti virus checker for email didn't notice, the zipped attachment had a virus in it...

Cheers,

Anton

  "Nothing succeeds like success." - Alexandre Dumas
-- 
Anton Altaparmakov <aia21 at cam.ac.uk> (replace at with @)
Linux NTFS Maintainer / WWW: http://linux-ntfs.sf.net/
ICQ: 8561279 / WWW: http://www-stu.christs.cam.ac.uk/~aia21/

IIRC lkml already has pretty strict filters.

However, you cannot have your filters prepared for any random thing. Eventually something will get through.

It seems that this month's something just got through.

such is life,

Rik
--
Virtual memory is like a game you can't win; However, without VM there's truly nothing to lose...

http://www.surriel.com/ http://distro.conectiva.com/

Send all your spam to [email protected] (spam digging piggy)

My solution to 99.9% of the trojan/virus problems:

I don't run Windows, and I don't enable Java/Javascript for mail, news, and web sites (unless I trust the site, I MUST view it, and it requires Java/Javascript).

PGA

Paul G. Allen
UNIX Admin II/Network Security
Akamai Technologies, Inc.
www.akamai.com

It's not solution (ex. I like Windows as workstation because of too buggy and inconvenient X, W2k does not crash at all and have much more convenient interface. A lot of people use Linux only on servers and connecting to it using SSH or smth like that), but someone should be moron to run something like that in zip-file.
Best regards,
Alexander mailto:[email protected]
------------------------------------------------------
Let's start the war, said Muggy
------------------------------------------------------
From: "Paul G. Allen" <[email protected]>
To: <unlisted-recipients:>; <no To-header on input>
Cc: <[email protected]>
Sent: Monday, July 30, 2001 10:09 AM
Subject: Re: Test mail

Well The e-mail looks like it may be a variation on SirCam or Code Red (I could be wrong). It appears to have its own mailer attached (from what I saw in the header - I have not opened the attached .zip) and it came from:

cx852567-a.ocnsd1.sdca.home.com

Oceanside, California, USA (about 30 miles North of me).

If this is someone on this list (I'm not about to search all the headers of all the mail in my mailbox to find who it is) - and I believe it very well may be - then it's time to re-install Windows.

(Oh, and I wouldn't use MS Oulook anymore, and be careful with Netscape mail as well.)

PGA

Paul G. Allen
UNIX Admin II/Network Security
Akamai Technologies, Inc.
www.akamai.com

Hi Paul,

I forwarded the message to a Trend Micro based smtp Viruswall which reported it as the TROJ_MUSIC.B virus. Trend reports it as being a non-destructive, low-risk virus that plays a tune (taps?) when activated.

Even a low-risk virus can be a pain to exorcise, I hope that no one here was infected.

Regards,
Lew Wolfgang

Music anyone? ;-)

Paul G. Allen
UNIX Admin II/Network Security
Akamai Technologies, Inc.
www.akamai.com

About the same distance from me, also. a cable modem user on the @home network....

Kelsey Hudson [email protected]
Software Engineer
Compendium Technologies, Inc (619) 725-0771
---------------------------------------------------------------------------

It got caught by my AMaViS scan - apparently it's Worm.Music.

Erm, appologise to everyone if it send the alert to the list - it
sends warning to the message sender as well...I think I might need to do some modification to how it picks the person to warn.

Chris "_Shad0w_" Crowther
[email protected]
http://www.shad0w.org.uk/

Hi Rik.

Surely it should be simple to check that each piece of mail has a from address in it, and either kill any that doesn't, or at least plug in the envelope from address in its place?

Best wishes from Riley.

These things are just the internet's way of natural population control. Those people who execute things blindly of their own accord deserve whatever happens to them.

While these things are a nuisance, they're hardly that big of a deal. These kind of things have existed forever, and people have somehow managed to get by.

If people are that concerned that they might possibly be exploited by it, they have a number of solutions:

1) Get a real OS
2) Get a real Email client
3) Apply common sense where possible

These 3 easy steps are the quickest way to abolish these kind of things once and for all.

Regards,

Paul Mundt <[email protected]>

they ARE a big deal. someone, somewhere pays for the traffic. they didn't CHOOSE to be flooded with virii/worms. but their upstream won't be nice and say "aw you got hit by some email virus i wont bill you for that traffic..."

your attitude seems similar to that of spammers. "just press del!"

j.

"Bobby, jiggle Grandpa's rat so it looks alive, please" -- gary larson

Its more than that. Its the same smug arrogance that is going to get a lot of people nasty shocks one day

ELM, Pine and Mutt have all at various times had holes that could have been used to write an exact Unix equivalent of the windows virus. <img src="file:/dev/mouse"> hangs some web browser email 4 years after the bug was reported and so on...

Alan

This all goes back to opening things blindly, and also ties in the issue of HTML aware email clients.

Mail clients should simply be dealing with plain text. As soon as things like HTML support are introduced into the client, you have the same sort of problems that you do with easily exploitable web browsers.

These things are only an issue when your mail client tries to do things for you instead of allowing you to do them yourself. HTML emails can simply be fed through something like a lynx -dump in order to capture their plaintext output.

Keep HTML where it belongs, on webpages, not mail. If someone wants to send you an image, they can do so through an attachment.

Regards,

Paul Mundt <[email protected]>

Most exploits are header parsing flaws, HTML email is irrelevant to this discussion.

No. Most of them are header parsing flaws, they worked with plain text email just fine. In fact HTML parsing vulnerabilities (other than privacy violations) are pretty rare.

Alan

Parsing an <img> tag certainly seems to make HTML email relevant...

There are far fewer header parsing exploits floating around then there are users executing things of an unknown origin and unknowingly sending copies of said thing to everyone in their address book.

While header parsing exploits are indeed an issue, they hardly make up the bulk of these sort of exploits.

Things like Elm, Pine, and Mutt can be as exploitable as anything else as far as header parsing issues are concerned. They still account for far less of the problems than things like Outlook do.

Regards,

Paul Mundt <[email protected]>

Only because the relative %age of the userbase is tiny.

There have actually been some very serious pine based attacks using header parsing bugs to steal password files.

Would it not be simple and effective to filter out mail produced by Outlook?
It sounds to me the equivalent of RBL & co.
RBL filter out mail from open relay used to spam us.
NoOutlook filter out mail from poor software/OS used to propagate viruses.

I guess that 100% of incomming viruses in lkml come from a Outlook mailer. And for the last two ones I'm sure.

Christophe

Christophe Barbé
Software Engineer - [email protected]
Lineo France - Lineo High Availability Group
42-46, rue Médéric - 92110 Clichy - France
phone (33).1.41.40.02.12 - fax (33).1.41.40.02.01
http://www.lineo.com

Um, that's just a little (LITTLE?!?) draconian/elitist. How about putting in a handler that renames EXEs attachments and EXEs in compressed files to something a little
less executable?

Don't get me wrong. I'm no fan of Outlook or OE, but you can't just step on people who use them.

Ignacio Vazquez-Abrams  <[email protected]>

This is a lot less draconian/elitist than banning ISPs. People seldom have a choice between multiple ISPs that offer affordable high-speed connections. Consider yourself lucky if both DSL and cable modem service are available and affordable in your area.

Banning Outlook isn't so bad. Assuming you are stuck with Windows, you still have many choices. Netscape/Mozilla and Eudora would be the obvious choices. I think you can get pine. Emacs has been ported to Windows, so you have the rmail/gnus stuff. Surely you can tolerate at least one of these many choices.

The problem is that in plenty of large companies not only are you stuck with Windows, but you're also stuck with either Outlook or Notes because of corporate decisions (i.e., Exchange or Domino). Trust me; been there, done that.

Ignacio Vazquez-Abrams  <[email protected]>

Hmm... linux developers at large corporations are stuck with [only] windows? How do they get anything done? Just because you're stuck with outlook for scheduling or whatever doesn't mean you can't send to mailing lists from another mailer, another OS, or another country.

justin

Justin Guyett <[email protected]> said:

[...]

What about would-be Linux hackers, or people running Linux (il)legally on some machines inside a WinXX shop? Want to leave them out for good? Not everybody on lkml is a hard-core kernel hacker...

Now, banning some attachment types I could understand...

Dr. Horst H. von Brand                Usuario #22616 counter.li.org
Departamento de Informatica                     Fono: +56 32 654431
Universidad Tecnica Federico Santa Maria              +56 32 654239
Casilla 110-V, Valparaiso, Chile                Fax:  +56 32 797513

How was it.. Be conservative in what you send, and liberal in what you accept?

It took Rik (IIRC) to say he was leaving l-k to get rid of that stupid DUL abusing thing that didn't allow him (and others, including me!) to post.. please lets not get there again.

As Horst says, not everyone is a hard-core hacker.. now imagine one or two of them actually had to post with, say outlook. Would you still want to filter it? I'm sure not.

____/|  Ragnar Højland      Freedom - Linux - OpenGL |    Brainbench MVP
\ o.O|  PGP94C4B2F0D27DE025BE2302C104B78C56 B72F0822 | for Unix Programming
 =(_)=  "Thou shalt not follow the NULL pointer for  | (www.brainbench.com)
   U     chaos and madness await thee at its end."

One problem with the idea of banning "MS virus express" is that most of the lemmings stuck with MS's windows are also stuck with the MS's mail app. If they had the wherewithall (personal, political, whatever) to switch to a different mail app, they'de probably know how & be able to switch the whole thing to a better environment.

--
Sincerely,

Jim Potter
45th Parallel Processing
[email protected]

Why bother? The _occasional_ spam slips through the filters. I don't see any real difference if some weenie slips me a plain spam or a spam with an impotent attachment I'm not going to look at anyway. It all costs me the same.. one 'D'+download cost.

-Mike

Sure you can. Microsoft has done that for decades. Look where it got them!

 Kelsey Hudson                                           [email protected]
 Software Engineer
 Compendium Technologies, Inc                               (619) 725-0771
---------------------------------------------------------------------------

--- "Dr. Kelsey Hudson"

And still does.
And people are too stupid to enjoy this.
Just watch the news on CNN: it's internet the one which is not secure not Micro$oft's operating sistems. :-)

---------------------------------------------------------------------------

__________________________________________________
Do You Yahoo!?
Make international calls for as low as $.04/minute with Yahoo! Messenger
http://phonecard.yahoo.com/

http://unthought.net/msworms.html

Any agent could be vulnerable.

Discrimination is hardly a viable solution.

Life sucks get a helmet.

................................................................
:   [email protected]   : And I see the elder races,         :
:.........................: putrid forms of man                :
:   Jakob Østergaard      : See him rise and claim the earth,  :
:        OZ9ABN           : his downfall is at hand.           :
:.........................:............{Konkhra}...............:

No. If you look carefully, you would be surprised at how many are
using OutlookSExpress to handle their email.

Of course in case of Viruses using OE security bugs, we all are seeing the distilled evil.

It is analogous on how I am seeing the UNRELIABILITY of people's email
systems. I see only failure cases, never succesfull deliveries!

If you want to discuss on how to put stricter filters of things into VGER's Majordomo, you can do that with <[email protected]>

Doing it at lists is waste of time, and misses *MY* attention!

/Matti Aarnio <[email protected]>
Co-postmaster of vger.kernel.org

Hi Matti.

First, let's have a subject that reflects the content...

Is there any way we can set up an automatic virus scan of all attachments at vger, and have it deal with any virii at source?

Come to that, is there a decent Linux-based virus scanner around?

Same here...

Hopefully, this caught your attention...

Best wishes from Riley.

Better than that, simply strip all non-text MIME attachments,
or bounce the messages containing them. End of story.

Craig Milo Rogers

Strip rather than bounce. Some of us know how to configure our mail clients to send messages in plain text...

Scott

----- Original Message -----
From: "Craig Milo Rogers" <[email protected]>
To: "Riley Williams" <[email protected]>
Cc: "Matti Aarnio" <[email protected]>; "christophe barb�" <[email protected]>; "Linux Kernel" <[email protected]>
Sent: Tuesday, July 31, 2001 1:12 PM
Subject: OT: Virii on vger.kernel.org lists

| >Is there any way we can set up an automatic virus scan of all
| >attachments at vger, and have it deal with any virii at source?
|
| Better than that, simply strip all non-text MIME attachments,
| or bounce the messages containing them.  End of story.
|
| Craig Milo Rogers
| -
| To unsubscribe from this list: send the line "unsubscribe
linux-kernel" in
| the body of a message to [email protected]
| More majordomo info at  http://vger.kernel.org/majordomo-info.html
| Please read the FAQ at  http://www.tux.org/lkml/
|

This is exactly what is done with the KPLUG mailing lists (Kernel-Panic Linux User Group - www.kernel-panic.org). Attachments are not allowed by the mail server and anyone sending HTML/RTF format mail gets an earful (eyeful?) from other list members.

Of course this would not stop Subseven propagation (generally, Subseven is attached to a web site and an e-mail is sent to you with a link to that site. Clicking on the link, loading the site, infects your Windows box), but then this is a case where simple education is the way to stop propagation.

PGA

Paul G. Allen
UNIX Admin II/Programmer
Akamai Technologies, Inc.
www.akamai.com
Work: (858)909-3630
Cell: (858)395-5043

Hi Craig.

Two problems with that:

1. Some virii are text attachments. Your fix doesn't deal wioth them.

2. The maintainer of the XXX driver just uploaded a large patch that fixes a major bug in their driver to the mailing list, and zip'd it up to reduce its size. You just bounced it...

Basically, that particular fix causes pain and gives no gain, so as far as I'm concerned, it's a non-starter...

Best wishes from Riley.

huh? how do you write an ASCII text virus. if you can do that, I will give you a cookie.

example, maybe:

email receiver, please forward this message to everyone you know and then execute as root "rm -rf /"

(if you refer to vbs text attachments, then that is a different story)

said driver writer should not be uploading huge patches to the mailing list anyways and instead should have a URL that points to the website or ftp site with the patch on it. if it is zipped already, then sending in email defeats the purpose since I cannot view it in my email reader to see if it makes sense. I have to be proactive about viewing it, so it might as well be on a website or ftp site.

-tduffy

Easy... since most Windows mailers ignore the mime-type, just throw your normal virus in a text/plain type.

Alan Shutko <[email protected]> - In a variety of flavors!
If anything can go wrong, it will.

I'm not aware of the TEXT/PLAIN viruses (ignoring jokes, er,
social comments, about the GPL). Could you point me to a sample?

I recall from past discussions that there's considerable
sentiment on l-k that zip'd patches are undesirable. If the patch is inconveniently large, it can be split into several messages, or placed on an FTP server. Inconvenient for the developer, maybe, but better for the list as a whole.

Separately, I think we've spent enough time with the off-topic
topic. Perhaps we can move the discussion offline?

Craig Milo Rogers

Hi Craig.

Are you limiting "text attachments" to TEXT/PLAIN ??? If so, you just killed a large number of very useful attachments. Off the top of my head...

1. Most patches that are attached rather than inline arrive here as TEXT/DIFF so you've just killed a lot of very important attachments.

2. Some of Linus Torvalds' emails come with a TEXT/SIGNATURE attachment, so you've just prevented him posting from the computer that does that.

3. One of the assignments at University was to email a specific MS-Word document (with an auto-starting macro in it) through a mailer that was specifically set to strip any attachments of the relevant mime types. In a class of 43 students, only two failed that assignment, and between the 41 who succeeded, no less than SEVEN different ways to do so were used, ALL of which used TEXT/ mime types for the enclosure - and FIVE of those were new to the lecturer as well. The said lecturer also stated that there were a further NINE ways to do so that none of us had found, but did not go into detail.

Once you allow TEXT/* to pass, you discover just how many virii will get straight past your filter without any problems at all. Basically, you get nowhere doing that...

Personally, my own stance on attachments (zip or otherwise) is that they should be below the limit at which my mailhost rejects them. On at least one mailhost I know, emails over 25k are killed without notice. My own mailhost kills any over 1,536k so that isn't a problem for me, but others have much smaller limits.

Other than your comments, it already is offline...

Best wishes from Riley.

Mime header based ones: there have been several
Body text based ones: I know of one that exploited the escape vulnerability in X11R5 xterm - it really was a 'README' virus.

Alan

That has the rather stupid effect of also killing gzip/bzip2ed patches that come to the list. Survey says: BZZZZZT!

Kelsey Hudson [email protected]
Software Engineer
Compendium Technologies, Inc (619) 725-0771
---------------------------------------------------------------------------

Don't use attachments on l-k. If patch is small - include it in the body. If it isn't - post URL.

Nice theory but netscape, mozilla, and most versions of pine tend to make a mess of patch files sent plain

and the response to that argument was that such patches are just as hard or harder to turn into readable/usable form when included on the list as when posted on an ftp/web site, so it's better to spare people's mailboxes from huge attachments and just provide a url to the patch.

justin

That is the always repeated answer. I could get a web page at some box at the University, but there are many people that have not a permanent address. Going to the mess of using a ISP-provided web page is a pain. Instead of bzip your patch and send it to the list you have to go through bizarre http interfaces to manage your web page (tell me about a ISP that lets you telnet/ssh/ftp to your account).

I do not see why a bzipped patch is so bad. The only person I was aware he won't read anything but plain text is Linus (and now some on this thread look with the same feeling).

J.A. Magallon                           #  Let the source be with you...        
mailto:[email protected]
Mandrake Linux release 8.1 (Cooker) for i586
Linux werewolf 2.4.7-ac3 #1 SMP Mon Jul 30 16:39:36 CEST 2001 i686

[cc list trimmed]

i assume by "bizarre http interfaces" you mean webdav as used by modern msie (on windows at least) and many many other applications? it's hardly bizarre. http://www.webdav.org. people i've set it up for (mostly mac users with the Goliath client) preferred it to ftp.

j.

"Bobby, jiggle Grandpa's rat so it looks alive, please" -- gary larson

IMHEO, they should be placed in a repository, not sent to the list. But then, who am I to say? :)

PGA

Paul G. Allen
UNIX Admin II/Programmer
Akamai Technologies, Inc.
www.akamai.com
Work: (858)909-3630
Cell: (858)395-5043

[SNIP]

There are a few reasons why zipped attachments, large attachments, and even large text-only patches are bad on a mailing list such as this:

1. Not everyone uses a mail client that will support the various attachment encodings and therefore can not get the attachment without jumping through hoops. Why subject them to this?

2. Some mail clients pervert the standard attachment formats, such as Outlook Express, making them undecipherable by anyone using anything other than that very same client. Again, why subject people to that?

3. Many, many people PAY PER BYTE for their Internet connection. Adding a large attachment, or sending a large text patch file, costs them money. Many times they do not want it anyway and you are costing them money by forcing them to D/L it.

4. Not everyone has a high speed connection and with the volume that a list like this creates, it is a LARGE burden on them to wait, and wait, and wait, for the few messages they want, and/or need, to see.

So, as with other large projects I've worked on (though none quite this large) involving a mailing list, the best solution is to a) strip attachments atthe mailing list server and b) provide a repository for people to D/L patches, new kernels, etc. for public access.

PGA

Paul G. Allen
UNIX Admin II/Network Security
Akamai Technologies, Inc.
www.akamai.com

<snip>

One interface that provides an easy mechanism for posting attachments is Bugzilla. See http://bugzilla.gnome.org. If you open a bug report, you can add file attachments after initially creating the bug. Something similar might work very well for the LKML needs. All that is really required is a web server, some Bugzilla-like method of pointing to a file and having that get posted to the web server. Then, a unique link to the posted file can be returned that the user can then send along to LKML.

Miles

Craig Milo Rogers <[email protected]> wrote:
| Better than that, simply strip all non-text MIME attachments,
| or bounce the messages containing them. End of story.

.... and don't forget to check for lines starting with "begin ":

http://support.microsoft.com/support/kb/articles/Q265/2/30.ASP

Dick Streefland                      ////                      Altium BV
[email protected]           (@ @)          http://www.altium.com
--------------------------------oOO--(_)--OOo---------------------------
.

|  > No. If you look carefully, you would be surprised at how many
|  > are using OutlookSExpress to handle their email.
|  > Of course in case of Viruses using OE security bugs, we all are
|  > seeing the distilled evil.

Of course, non of the common "holes" in OE are left unfixed. People should be responsible to update their mail clients. People using Windows (like me) should also be responsible to maintain current virus software themselves, rather than leaving that job to the mail server, which seems like an unfair burden on the mail server to me. I personally use McAfee, as it will auto update itself periodically if you tell it to. Using OE as patched, and McAfee, Virii like the one that just hit are not a problem - they are caught and killed before they can execute... I got hit once (and if you search through the archives, you'll find a message from me about it - one that I caught holy hell from many of you for, but anyway) and learned from that incident to secure my system. It has not happened since, and won't if I am careful.

The user has the responsibility to be careful, I think. Not the list server.

| Is there any way we can set up an automatic virus scan of all | attachments at vger, and have it deal with any virii at source?

Yes.

| Come to that, is there a decent Linux-based virus scanner around?

Yes.

|  > It is analogous on how I am seeing the UNRELIABILITY of people's
|  > email systems. I see only failure cases, never succesfull
|  > deliveries!
| Same here...

No, you both miss the point. Some PEOPLE are ignorant or unreliable, the email system performs exactly as instructed... No matter if it runs on Linux, or *BSD, or Mickey$oft.

Regards,
Scott

Not everyone has control of the system they can post from. Some IS departments are poor at keeping systems secure, but still won't let users touch them.

Or have been told by management that they are required to use buggy e-mail clients because "it is company policy".

They tried to get me to use Exchange at the last company I worked for. I laughed and then moved all my mail to the Linux box under my desk. I was one of the few people in the company that had a stable mail account.

[email protected] | Note to AOL users: for a quick shortcut to reply
Alan Olsen | to my mail, just hit the ctrl, alt and del keys.
"All power is derived from the barrel of a gnu." - Mao Tse Stallman

Totally irrelevant. As long as the other people those messages get sent to have their act together, the problem dies there. If not, then the morons responsible for maintaining the clients and mailservers that will still allow this to happen get taught a lesson, don't they?

----- Original Message -----
From: "Ian Stirling" <[email protected]>
To: <[email protected]>
Sent: Tuesday, July 31, 2001 4:27 PM
Subject: Re: Virii on vger.kernel.org lists

| >
| > |  > No. If you look carefully, you would be surprised at how many
| > |  > are using OutlookSExpress to handle their email.
| > |  > Of course in case of Viruses using OE security bugs, we all are
| > |  > seeing the distilled evil.
|
| > Of course, non of the common "holes" in OE are left unfixed.  People
| > should be responsible to update their mail clients.  People using
| > Windows (like me) should also be responsible to maintain current
virus
| > software themselves, rather than leaving that job to the mail
server,
| > which seems like an unfair burden on the mail server to me.
|
| Not everyone has control of the system they can post from.
| Some IS departments are poor at keeping systems secure, but still
| won't let users touch them.
|
| -
| To unsubscribe from this list: send the line "unsubscribe
linux-kernel" in
| the body of a message to [email protected]
| More majordomo info at  http://vger.kernel.org/majordomo-info.html
| Please read the FAQ at  http://www.tux.org/lkml/
|

Hi William.

Depends how you view it - I'd much rather host my mailing lists on a server that I knew scans for virii and deals with any it finds than one that doesn't.

McAfee isn't a guarantee, no more than any other virii scanner is. I used to use McAfee, and had it in auto-update mode. I still got hit by FOURTEEN virii within half an hour of it updating itself!

Even if you're careful, you can still get hit, so don't rest on your laurels...

My own viewpoint is somewhat less blase than yours - the more virii scanners between the originator and me, the lower the likelihood of my systems getting a virii.

Perhaps you'd care to give details, since you're so blase about it...

Oh?

Whether people are ignorant or unreliable has about as much to do with whether their computers can catch virii as with whether they can. The only people likely to claim otherwise are virii writers, IMHO.

The basic point of this duscussion is that the email system's instructions are flawed and need changing.

Best wishes from Riley.

Hello Riley!

As I said in another post on the list,

"http://www.mcafeeb2b.com/naicommon/buy-try/try/products-evals.asp

Go there, select your language and LINUX, and you will get a survey to fill out that then lets you test drive their stuff for linux."

I don't feel that I am particularly blas�, but I will concede that you have several good points. My main point was that people seem to be more interested in the server doing the scanning for them rather than taking responsibility for their own (lack of) security. Your view point is just as valid.

And I don't think your experience with McAfee as reported is typical at all. If it was, I'd still be having problems, and NAI would be out of
business. How long ago was this? What version of the product? What
OS? How did you update? What 14 Virii were you hit with? Did you contact McAfee for support? I'd be very interested to get more details about this.

Regards,
Scott

----- Original Message -----
From: "Riley Williams" <[email protected]>
To: "William Scott Lockwood III" <[email protected]>
Cc: "Matti Aarnio" <[email protected]>; "Linux Kernel" <[email protected]>
Sent: Tuesday, July 31, 2001 5:41 PM
Subject: Re: Virii on vger.kernel.org lists

| Hi William.
|
|  > Of course, non of the common "holes" in OE are left unfixed.
|  > People should be responsible to update their mail clients.
|  > People using Windows (like me) should also be responsible to
|  > maintain current virus software themselves, rather than leaving
|  > that job to the mail server, which seems like an unfair burden
|  > on the mail server to me.
|
| Depends how you view it - I'd much rather host my mailing lists on a
| server that I knew scans for virii and deals with any it finds than
| one that doesn't.
|
|  > I personally use McAfee, as it will auto update itself
|  > periodically if you tell it to. Using OE as patched, and McAfee,
|  > Virii like the one that just hit are not a problem - they are
|  > caught and killed before they can execute...
|
| McAfee isn't a guarantee, no more than any other virii scanner is. I
| used to use McAfee, and had it in auto-update mode. I still got hit by
| FOURTEEN virii within half an hour of it updating itself!
|
|  > I got hit once (and if you search through the archives, you'll
|  > find a message from me about it - one that I caught holy hell
|  > from many of you for, but anyway) and learned from that incident
|  > to secure my system. It has not happened since, and won't if I
|  > am careful.
|
| Even if you're careful, you can still get hit, so don't rest on your
| laurels...
|
|  > The user has the responsibility to be careful, I think. Not the
|  > list server.
|
| My own viewpoint is somewhat less blase than yours - the more virii
| scanners between the originator and me, the lower the likelihood of my
| systems getting a virii.
|
|  >> Is there any way we can set up an automatic virus scan of all
|  >> attachments at vger, and have it deal with any virii at source?
|
|  > Yes.
|
|  >> Come to that, is there a decent Linux-based virus scanner around?
|
|  > Yes.
|
| Perhaps you'd care to give details, since you're so blase about it...
|
|  >>> It is analogous on how I am seeing the UNRELIABILITY of people's
|  >>> email systems. I see only failure cases, never succesfull
|  >>> deliveries!
|
|  >> Same here...
|
|  > No, you both miss the point.
|
| Oh?
|
|  > Some PEOPLE are ignorant or unreliable...
|
| Whether people are ignorant or unreliable has about as much to do with
| whether their computers can catch virii as with whether they can. The
| only people likely to claim otherwise are virii writers, IMHO.
|
|  > The email system performs exactly as instructed, no matter if it
|  > runs on Linux, or *BSD, or Mickey$oft.
|
| The basic point of this duscussion is that the email system's
| instructions are flawed and need changing.
|
| Best wishes from Riley.
|
|

Hi William.

I've not seen that post yet, so must apologise for missing it...

I've met people like that, and earn quite a reasonable living from securing systems for computer novices. In my case, most of my customers are elderly people who're interested in tracing their ancestry and have been persuaded by the local computer mart that they need a computer to do so, and nothing less than the latest all-singing all-dancing system will do the job - and oh, Internet connectivity isa a must so you'd better sign up to our company ISP for which we get £X commission for everybody we sign up. I'm sure you know the type I'm talking about...

I contacted McAfee about this straight away. Their response was that on average, there's a timelapse of 53 hours from a virii first appearing to their having a signature for it, and as there are at least 370 new virii produced each day, many with multiple strains, it was quite possible for such as I reported to happen.

The timeframe was around October 1999, so was mixed in with the intensive Y2K tracing that was going on then, and I don't have details of the specific virii any more, so can't advise there...

Best wishes from Riley.

I hope it got out! Perhaps someone already started striping out mail from OE/Hotmail. :-)

----- Original Message -----
| Hi William.
| I've not seen that post yet, so must apologise for missing it...

Hi William.

I've now read every email received to date in L-K with either "Test" or the above as the subject, and it's not amongst them...

Best wishes from Riley.

For some reason, seeing "virii" is somewhat painful to my eye. I know, people invent fantasy plurals, like Vaxen and Unices/Unixen, but somehow this is worse, yes indeed, it is badder.

[The singular is virus. The plural in English is viruses. In Latin there is no plural - it is even debatable whether virus is a noun in Latin - in any case it is indeclinable.]

Well, my plans to hack on a weird piece of hardware in order to experiment with kernel hacking did not go as planned. Seems the device works fine without any problems at all. (The device is the eFilm Reader-7 PCMCIA PCI card.) The only "hacking" needed was to remove two bits of plastic that kept me from inserting one card.

But in getting this installed, I found something that does not seem right...

The module that used to be called "ide_cs.o" is now called "ide-cs.o".

It this on purpose or have I found a bug?

The reason I am wondering is that it requires some serious search and replace in /etc/pcmcia/config to correct the problem or renaming the module by hand. Not much of a hassle for me, but others will find it very confusing. (Especially since the rest of the card service modules seem to use "_cs.o" instead of "-cs.o".)

[email protected] | Note to AOL users: for a quick shortcut to reply
Alan Olsen | to my mail, just hit the ctrl, alt and del keys.
"All power is derived from the barrel of a gnu." - Mao Tse Stallman

drivers/ide/Makefile was added to the kernel in 2.4.3-99pre on approx. May 19, 2000. The module was called ide-cs.o then and has had that name ever since. The inconsistency between the kernel and the pcmcia package is annoying but changing the kernel name now would probably cause more problems that it solved.

I found out about a minute or so *after* I sent that message that the problem is documented in the pcmcia-cs README-2.4. (Though it was a little less than clear.)

I am a little surprised that the whole thing worked at all, given the changes I had to make...

I still have a puzzling problem though.

I have a removable ide drive that has always been a bit contankerous. Under 2.2.x, it would error out the first time, but a "cardctl reset" would make it work fine.

Now when i try to mount it, the cardmgr code complains about a timeout on the socket and suggests increasing setup_delay. That does not help. It just delays the real problem.

When I insert the card, I get a beep from the cardmgr program seeing the card being inserted. Then the whole system refuses to respond to anything on the keyboard. (I have not tested if the system is reachable by network when that happens.)

The drive is powered up at that point. If I pull the pcmcia card out, once the process times out, the system returns to usable again.

Ideas what is causing it? I am suspecting that I am getting some sort of irq lockup. All the other pcmcia devices run fine. Just ide is giving me the problem.

[email protected] | Note to AOL users: for a quick shortcut to reply
Alan Olsen | to my mail, just hit the ctrl, alt and del keys.
"All power is derived from the barrel of a gnu." - Mao Tse Stallman

Gunther posted this patch ages ago which seems to solve the problem

@@ -324,6 +324,9 @@
     if (link->io.NumPorts2)
        release_region(link->io.BasePort2, link->io.NumPorts2);
 
+    outb(0x02, ctl_base); // Set nIEN = disable device interrupts
+                         // else it hangs on PCI-Cardbus add-in cards,

wedging irq
+

     /* retry registration in case device is still spinning up */
     for (i = 0; i < 10; i++) {
        hd = ide_register(io_base, ctl_base, link->irq.AssignedIRQ);

@@ -685,6 +685,8 @@
 #else /* !CONFIG_IDEPCI_SHARE_IRQ */
                int sa = (hwif->chipset == ide_pci) ? SA_INTERRUPT|SA_SHIRQ

: SA_INTERRUPT;
#endif /* CONFIG_IDEPCI_SHARE_IRQ */
+
+ outb(0x00, hwif->io_ports[IDE_CONTROL_OFFSET]); // clear
nIEN == enable irqs

                if (ide_request_irq(hwif->irq, &ide_intr, sa, hwif->name,
hwgroup)) {
                        if (!match)
                                kfree(hwgroup);

I will try that. Any reason it did not make it to 2.4.7?

[email protected] | Note to AOL users: for a quick shortcut to reply
Alan Olsen | to my mail, just hit the ctrl, alt and del keys.
"All power is derived from the barrel of a gnu." - Mao Tse Stallman

Andre didnt like it for obscure ATA technical reasons. If it works then personally I think its a candidate to go in anyway

Well, without the patch it does *not* work. I will make sure it functions with this card. (Weird finding PCMCIA PCI cards in the electronic camera supply section.)

[email protected] | Note to AOL users: for a quick shortcut to reply
Alan Olsen | to my mail, just hit the ctrl, alt and del keys.
"All power is derived from the barrel of a gnu." - Mao Tse Stallman

Well, it gets rid of the hanging behaviour. There is a bit of sluggishness, but it is because it is trying to setup ide2 and failing.

Aug  2 11:28:38 summanulla kernel: hde: IBM-DADA-26480, ATA DISK drive
Aug  2 11:28:38 summanulla kernel: hde: IBM-DADA-26480, ATA DISK drive
Aug  2 11:28:38 summanulla kernel: ide2: Disabled unable to get IRQ 5.
Aug  2 11:28:38 summanulla kernel: ide2: Disabled unable to get IRQ 5.
Aug  2 11:28:40 summanulla kernel: hde: ERROR, PORTS ALREADY IN USE
Aug  2 11:28:40 summanulla kernel: hde: ERROR, PORTS ALREADY IN USE
Aug  2 11:28:42 summanulla kernel: ide2: ports already in use, skipping
probe
Aug  2 11:28:42 summanulla kernel: ide2: ports already in use, skipping
probe
Aug  2 11:28:53 summanulla last message repeated 7 times
Aug  2 11:28:53 summanulla kernel: ide_cs: ide_register() at 0x110 &
0x11e, irq 5 failed
Aug  2 11:28:53 summanulla last message repeated 7 times
Aug  2 11:28:53 summanulla kernel: ide_cs: ide_register() at 0x110 &
0x11e, irq 5 failed
Aug  2 11:28:53 summanulla kernel: Trying to free nonexistent resource
<00000110-0000011f>
Aug  2 11:28:53 summanulla kernel: Trying to free nonexistent resource
<00000110-0000011f>
Aug  2 11:28:54 summanulla cardmgr[1023]: get dev info on socket 1 failed:
Resource temporarily unavailable
Aug  2 11:29:51 summanulla cardmgr[1023]: shutting down socket 1
Aug  2 11:29:51 summanulla cardmgr[1023]: executing: 'modprobe -r ide-cs'

I need to look at where ide2 is trying to be set later. (I have a LUG meeting to get ready for.)

[email protected] | Note to AOL users: for a quick shortcut to reply
Alan Olsen | to my mail, just hit the ctrl, alt and del keys.
"All power is derived from the barrel of a gnu." - Mao Tse Stallman

I found that the first part (adding outb(0x02, ctl_base)) was necessary but the second part (outb(0, ...)) was not. Setting nIEN early on seems safe to me, but it was not clear to me that enabling IRQs (clearing nIEN) just before the ide_request_irq call was safe - fortunately it doesn't seem to be necessary, I presume the IDE code clears nIEN when it wants to start getting interrupts.

On my powerbook I also use a patch which makes sure that the chipset gets set to ide_pci so that the IDE code will let me share the irq - the pcmcia controller here has just one interrupt that is used both for card interrupts and for controller interrupts. I'm not sure whether that came from Gunther or someone else.

Paul.

Hi.

During my medical training, it was made abundantly clear that the plural of virus is virii. Since the whole idea of a computer virus comes from the medical world, I'd have to assume the terminology came with it.

I'll stick with what my training taught me.

Best wishes from Riley.

PS: Plural of bacteria is bacterium, from the same source.

As an ex-virologist, English usage has its plural as viruses almost everywhere, even in books written in "U.S." English. Even in medical virology texts in the aforesaid language.

Not that Caesar ever spoke at length concerning viruses, but viral taxonomies usually refer to viruses of a kind with a collective noun ending with thus:-

papillomaviridae - wart viruses
herpesviridae - herpesviruses
retroviridae - retroviruses

Here's an example of both the plural "viruses" and the collective ending being used...
http://www.utoronto.ca/virology/bio351/papova/Papova.html

Indeed, if you should search Google for the terms "viruses" and "virii", the former will find mostly biological/medical pages while the latter while the latter finds almost exclusively descriptions of computer "virii" which may be indicative of the orgin of the latter.

I look forward to computer virus taxonomies discussing Sircamidae and no doubt Code Red could be classified as member of phylum Annelidae with Linnean name Tabes whitehouseii.

You did mean it the other way round, didn't you?

D. Huen, Dept. of Genetics, U. of Cambridge

Hi David.

{Shrug} Blame my training on the medical staff at Aberdeen Royal Infirmiry, Scotland, where I did the 18 months of medical training that I have behind me before switching to Computing...

I did, yes - blame that on a brain failure...mine!

Best wishes from Riley.

Huh?

I really don't know much Latin, but the plural of virus is viri. Virii would be the plural of virius if there were such a thing.

"For badder or worse."

Rik
--
Executive summary of a recent Microsoft press release:
"we are concerned about the GNU General Public License (GPL)"

		http://www.surriel.com/

http://www.conectiva.com/ http://distro.conectiva.com/

On Wed, Aug 01, 2001, Riley Williams wrote about "Re: [OT] Virii (sic)":

What I don't understand is why people use the form virii, with a double I!

Just like the plural of abacus is abaci, the plural of cactus is cacti (check the dictionary if you don't believe me), shouldn't the plural of virus be viri, with one I at the end (of course, "viruses" is also currently accepted as a plural, and even preferred by some people).

I think people get confused by the fact that the plural of radius is radii. That extra "I" comes from the i in radius - it shouldn't appear in the plural of "virus"! The plural of the different word "virius" should have been virii.

Note that bacteria is already plural - bacterium is the singular.

There's a more computer relevant fact: "data" is a plural noun, whose singular is "datum". Similarly, "media" is plural, whose singular is "medium". So constructions like "datas" or "medias" are wrong, although they are becoming more and more accepted...

Does anybody still use the form formulae as a plural of formula? I do, but I think I belong to a dying breed :)

[Oops, I don't think this discussion is very relevant to Linux kernels any more...]

Nadav Har'El                        |       Wednesday, Aug  1 2001, 12 Av 5761
[email protected]             |-----------------------------------------
Phone: +972-53-245868, ICQ 13349191 |A city is a large community where people
http://nadav.harel.org.il           |are lonesome together.

Stoooooooooooooooop !!

PLEASE

-------
Jean-Luc

As Andries says, there is no known use of plural of 3 nouns from the
2nd Latin declension: vulgus, pelagus and of course virus.

This is btw referenced here: http://language.perl.com/misc/virus.html .

Hopefully the thread can be dropped...

--alessandro

"Nothing can light / the dark of the night / like a falling star"
(Julee Cruise, "Until the end of the world" soundtrack)

Uh? I'd say it's the other way around at least ...

Vojtech Pavlik
SuSE Labs

If the plural of mouse is mice, shouldn't the plural of spouce be spice?

 Lab tests show that use of micro$oft causes cancer in lab animals

and the ever popular boni for plural of bonus ;-)

J o h a n  K u l l s t a m
[[email protected]]
Don't Fear the Penguin!

Yes: www.amavis.org

The german antivirus tool AntiVir is free for personal use (www.free-av.com) and i am pretty sure they would sponsor a version for the list server if asked (if linux-kernel would be considered commercial use).

But even better would be to also use the procmail sanitizer:
ftp://ftp.rubyriver.com/pub/jhardin/antispam/procmail-security.html

It does not scan for virii but defangs attachments and html tags so that braindamaged apps would not automatically execute the required interpreter for the virus.

Dominik Kubla

ScioByte GmbH, Zum Schiersteiner Grund 2, 55127 Mainz (Germany)
Phone: +49 6131 550 117  Fax: +49 6131 610 99 16

GnuPG: 717F16BB / A384 F5F1 F566 5716 5485  27EF 3B00 C007 717F 16BB

Hmm. Apparently their free product is just available for Windows. ARGH! But one can pickup an evaluation version for Linux from their commercial site:

www.antivir.de.

Dominik Kubla

ScioByte GmbH, Zum Schiersteiner Grund 2, 55127 Mainz (Germany)
Phone: +49 6131 550 117  Fax: +49 6131 610 99 16

GnuPG: 717F16BB / A384 F5F1 F566 5716 5485  27EF 3B00 C007 717F 16BB

I always thought it was bad form to send any sort of enclosure/attachment to a mailing list.

I guess in this MIME-era too many mail clients too easily send the message itself as an attachment.

How much does this list need real attachments? Might the list server strip out all attachments?--and if a message has only attachments, maybe try to find the one that is the body, break out it, and re-send it as a boring 822 body with none of the doo-dads likely to catch the attention of Outlook and other clever mail clients.

If Outlook is too clever by half, sending only non-clever ASCII content is tempting.

-kb, the Kent who has been lurking with mutt.

Ack, should have done that long ago...

....

I have been asked, several times, if I could integrate some
virus scanner wrapper, like Amavis, into ZMailer. The more I think of that, the more it appears to be stuff for 3.x series of ZMailer; not for current 2.x ... but the technology slated for 3.x implements something like 2/3 of Amavis for other internal system purposes ...

Nevertheless, that is just the interface from email system to separate file scanner. Those scanners are available in abundance for winblows,
but are very rare for anything else. Amavis pages seem to point to
a bunch of products with Linux support, so perhaps there are something usefull to be plugged in ?

/Matti Aarnio

----- Original Message -----
From: "Matti Aarnio" <[email protected]>
To: "Riley Williams" <[email protected]>
Cc: "Linux Kernel" <[email protected]>
Sent: Tuesday, July 31, 2001 5:00 PM
Subject: Re: Virii on vger.kernel.org lists

| Nevertheless, that is just the interface from email system to separate
| file scanner.  Those scanners are available in abundance for winblows,
| but are very rare for anything else.   Amavis pages seem to point to
| a bunch of products with Linux support, so perhaps there are something
| usefull to be plugged in ?

http://www.mcafeeb2b.com/naicommon/buy-try/try/products-evals.asp

Go there, select your language and LINUX, and you will get a survey to fill out that then lets you test drive their stuff for linux.