Home page logo

fulldisclosure logo Full Disclosure mailing list archives

RE: Backdoor not recognized by Kaspersky
From: "Thor Larholm" <thor () pivx com>
Date: Wed, 3 Mar 2004 15:46:53 -0800

SMTP authentication will not do much to stop viruses from spreading.
Some viruses are already moving away from just implementing their own
SMTP server to reusing whatever SMTP credentials you have on your
machine. Having your own SMTP engine is a nice fallback solution just in
case, but if you can read the users login credentials to his corporate
mailserver you are far better off.

Imagine us all implementing SPF, Caller ID or Domain Keys - what would
happen? We would all have to use a mail server that has implemented one
of these 'solutions'. Naturally, virus writers would then just reuse
your SMTP login credentials to spew their virus through that same MTA.

Another quick workaround to SPF, Caller ID and Domain Keys has alredy
been implemented by spammers for a year or so. The only premise behind
S/C/D is that you are trusted if you have access to a DNS server.
Spammers are using compromised machines not only as SMTP servers, but
also web servers and DNS servers. The end result is that spammers have
already completely circumvented all three solutions way before they were
ever implemented.


Thor Larholm
Senior Security Researcher
PivX Solutions
24 Corporate Plaza #180
Newport Beach, CA 92660
thor () pivx com
Phone: +1 (949) 231-8496
PGP: 0x5A276569
6BB1 B77F CB62 0D3D 5A82 C65D E1A4 157C 5A27 6569

PivX defines "Proactive Threat Mitigation". Get a FREE Beta Version of

-----Original Message-----
From: Larry Seltzer [mailto:larry () larryseltzer com] 
Sent: Wednesday, March 03, 2004 1:38 PM
To: 'Mike Barushok'; full-disclosure () lists netsys com
Subject: RE: [Full-disclosure] Backdoor not recognized by Kaspersky

I feel the need to address the problem from an ISP perspective, since 
the corporate
and government and other institutional persective seems to give
different answers. And because the ISP end user problem is still the
majority of the reservoir for viruses (and spam proxy/relay/trojans).

I really feel for you guys. As I've argued in another thread, I think
SMTP authentication will likely cut this stuff down to a trickle
compared to the current volume. As an ISP, how big a problem would you
have with that. An even better question: Would you have a problem
implementing SPF, Caller ID and Domain Keys (i.e. all 3)? It gets to the
same issue of changing practices for your users: at some point you have
to either bounce or segregate mail that doesn't authenticate. 

Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]