lkml.org 
[lkml]   [2000]   [Jul]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Subject[OFFTOPIC] Viruses (was Re: TO HELL WITH IT THEN...)
Date
From
"watermodem" wrote:
> Marc Lehmann wrote:
>
> > On Thu, Jul 20, 2000 at 10:38:02PM -0400, Gregory Maxwell <greg@linuxpower.cx> wrote:
> > > > You can, just bit-bang the (ATA|SCSI|other) controller.
> > >
> > > However, Windows email virus writers are too STUPID and COWARDLY to ever
> > > code such a feature into their creations, so it's not a big concern there.
> >
> > Actually,
> >
> > a) dead machines don't spread viruses
>
> A very good point! That is why you see lots of flu but ebola is rare.
> A good virus doesn't kill it's host until spreading to many other hosts.
> One could make a case that killing the host is a bad trait for any virus.

CIH wasn't exactly rare in many places, DOS/Win virus which destroys the
motherboard flash on the 28th(?) of each month. The first time it activated
it took out many computers... including some of my friends/relatives who
use that other operating system.

I made a post once mentioning partial HDD recovery (since it also wipes the
partition table and part of the directory structure, but is partly
recoverable in that you can reconstruct the partition table and recover
later partitions on the disk) and still get emails from time to time from
people mailing in desperation anyone who comes up from searching for web
pages mentioning CIH.

Sure the first activation almost wiped it out but it does come back from
time to time - and if they'd been more careful such a virus could be lethal
(if it had activated more slowly so as to not generate the media hysteria;
but maybe the media coverage was the aim...).

That's without even a way to spread in an automated manner, there is so much
potential for a really bad virus to be written by someone who studied previous
viruses and was very careful about spreading slowly and through multiple
undetected means that you really have to worry about the unknowing majority
still using DOS/Win these days.

[of course a root-level remote-access hole in a shipping distro has the
potential to do this and so much more, which is why we're lucky the major
distro's seem to be moving towards not installing any daemons accepting
remote connections by default... except samba seems to be popular, better
hope nobody ever discovers a remote buffer overflow hole in that, because
if a UDP packet on port 13x could destroy your hardware in a default Linux
install it would be pretty devastating...]

David.
--
----------------------------------------------
David Luyer
Senior Network Engineer
Pacific Internet (Aust) Pty Ltd
Phone: +61 3 9674 7525
Fax: +61 3 9699 8693
Mobile: +61 4 1064 2258, +61 4 1114 2258
http://www.pacific.net.au NASDAQ: PCNTF
<< fast 'n easy >>
----------------------------------------------



-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:57    [W:0.047 / U:0.440 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site