Archive of UserLand's first discussion group, started October 5, 1998.

Re: PS: Don't open email enclosures, ever.

Author:Jacob Levy
Posted:5/4/2000; 9:43:21 PM
Topic:Virus from Manila
Msg #:16951 (In response to 16948)
Prev/Next:16950 / 16952

Microsoft Corp., for its part, said the virus was not indicative of any particular vulnerability associated with Microsoft Outlook.

"Viruses are really an industry-wide issue," said Scott Culp, program manager for Microsoft's security response center. "They can be written for any platform. They can be written to use a variety of e-mail clients.

"In this case the virus author chose to target Outlook probably because it gave him better reach," he said. "There isn't a security vulnerability in Outlook involved in this at all," Culp said.

What a load of crap.

This is very simple, really. When you open an attachment, the VB code in it runs with full privileges on your computer. To call this not a security vulnerability in Outlook takes the most serious self delusion possible.

Security is a contraint. People will be people and therefore are unlikely to place constraints on themselves, voluntarily. Asking people to only execute signed (and signed by trusted parties, you forgot to mention) attachments is a constraint noone will place on themselves unless they've been burned once or twice.

In other words, the design is seriously flawed. Instead of relying on users to "do the right thing", MS is responsible for designing a working security framework.

The argument that this is an industry-wide issue is also disingenious. Outlook is the industry, all of it. Or at least its all of the vulnerable part of the industry. Have you heard about disasters such as this ILOVEU virus spreading through Netscape mail? No? Why not? Maybe because that is immune to such juvenile attacks?

There are responses to this message:

This page was archived on 6/13/2001; 4:55:04 PM.

© Copyright 1998-2001 UserLand Software, Inc.