Nmap Security Scanner
*Intro
*Ref Guide
*Install Guide
*Download
*Changelog
*Book
*Docs
Security Lists
*Nmap Hackers
*Nmap Dev
*Bugtraq
*Full Disclosure
*Pen Test
*Basics
*More
Security Tools
*Pass crackers
*Sniffers
*Vuln Scanners
*Web scanners
*Wireless
*Exploitation
*Packet crafters
*More
Site News
Site Search:
Exploit World
Advertising
About/Contact
Credits
Sponsors:




fulldisclosure logo Full Disclosure mailing list archives

RE: A worm...
From: ATD <simon () snosoft com>
Date: 26 Jun 2003 11:14:46 -0400

Yes, 
        And this was my point. Are the crafty "worm gods" creating worms that
evade detection by using compression and other methods?  If they are
doing this, and if they are creating the "stealth worms" whats next. Zip
files would be just one of hundreds of ways to hide worms. Maybe the
virus scanning technology needs to be kicked up a notch or two.

On Wed, 2003-06-25 at 16:32, *Hobbit* wrote:
Maybe I'm a bit out of the loop, but this one is interesting BECAUSE
of the .zip encapsulation.  The fact that it spreads at all is due
to one or both of

      .ZIP archives now auto-explode and auto-EXECUTE contents
      inside some MUAs

      people are being REALLY stupid

The first one, if true, is disturbing because it used to be that
wrapping content inside a .zip attachment is one way to get known
bad content to colleagues and NOT have it donked by [most] content
filters.  It should take manual, explicit action by the recipient
to open the .zip and be careful with the contents.

Is this no longer the case?!  What idiot mail-readers have auto-
execute-zip-contents capability, if any??  I knew this was comin'
someday, even so...

_H*
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

Attachment: signature.asc
Description: This is a digitally signed message part


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]