Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Re: What is wrong with schools these days?
From: Paul Schmehl <pauls () utdallas edu>
Date: Wed, 26 Apr 2006 17:39:09 -0500

Pavel Kankovsky wrote:
On Tue, 25 Apr 2006, Paul Schmehl wrote:

  We haven't had a Windows box hacked in a long time.

Does it include Windoze boxes possesed by malware? Such a box is not
hacked in a strict sense but the difference is almost irrelevant (esp.
when backdoors have become a standard feature of malware).

I have no idea how you would put a number on that, because the way the AV software reports an "infection" is biased to inflate the numbers. If, for example, I go to a webiste, and while I'm there an exploit attempts to run but the AV software prevents it from running, it will report an "infection". Yet the box was never infected. The AV prevented the exploit from completing successfully.

If I get a virus through email (extremely unlikely here), and I click on the attachment deliberately trying to get it to run, and the AV software stops it, but reports an infection, is that an infection? Or simply a detection and prevention?

Does adware count? If so, which ones? Which viruses would count as "hacks"? And what actually counts as a hack? A detection/prevention? Or only actual infections?

If you point is to say that Windows is far more susceptible to attack, then that's a given.

--
Paul Schmehl (pauls () utdallas edu)
Adjunct Information Security Officer
The University of Texas at Dallas
http://www.utdallas.edu/ir/security/

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault