Messages in this thread | | | Subject | [OFFTOPIC] Viruses (was Re: TO HELL WITH IT THEN...) | Date | Sun, 23 Jul 2000 07:37:23 +1000 | From | David Luyer <> |
| |
"watermodem" wrote: > Marc Lehmann wrote: > > > On Thu, Jul 20, 2000 at 10:38:02PM -0400, Gregory Maxwell <greg@linuxpower.cx> wrote: > > > > You can, just bit-bang the (ATA|SCSI|other) controller. > > > > > > However, Windows email virus writers are too STUPID and COWARDLY to ever > > > code such a feature into their creations, so it's not a big concern there. > > > > Actually, > > > > a) dead machines don't spread viruses > > A very good point! That is why you see lots of flu but ebola is rare. > A good virus doesn't kill it's host until spreading to many other hosts. > One could make a case that killing the host is a bad trait for any virus.
CIH wasn't exactly rare in many places, DOS/Win virus which destroys the motherboard flash on the 28th(?) of each month. The first time it activated it took out many computers... including some of my friends/relatives who use that other operating system.
I made a post once mentioning partial HDD recovery (since it also wipes the partition table and part of the directory structure, but is partly recoverable in that you can reconstruct the partition table and recover later partitions on the disk) and still get emails from time to time from people mailing in desperation anyone who comes up from searching for web pages mentioning CIH.
Sure the first activation almost wiped it out but it does come back from time to time - and if they'd been more careful such a virus could be lethal (if it had activated more slowly so as to not generate the media hysteria; but maybe the media coverage was the aim...).
That's without even a way to spread in an automated manner, there is so much potential for a really bad virus to be written by someone who studied previous viruses and was very careful about spreading slowly and through multiple undetected means that you really have to worry about the unknowing majority still using DOS/Win these days.
[of course a root-level remote-access hole in a shipping distro has the potential to do this and so much more, which is why we're lucky the major distro's seem to be moving towards not installing any daemons accepting remote connections by default... except samba seems to be popular, better hope nobody ever discovers a remote buffer overflow hole in that, because if a UDP packet on port 13x could destroy your hardware in a default Linux install it would be pretty devastating...]
David. -- ---------------------------------------------- David Luyer Senior Network Engineer Pacific Internet (Aust) Pty Ltd Phone: +61 3 9674 7525 Fax: +61 3 9699 8693 Mobile: +61 4 1064 2258, +61 4 1114 2258 http://www.pacific.net.au NASDAQ: PCNTF << fast 'n easy >> ----------------------------------------------
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |