Impartial information about Viruses - Worms ...

[enDomino]

This is more likely a thought ...
I was looking for information about latest most dangerous Worm, Sasser. What I don't really like about the information I've found is that every company is trying to take advance of those problems in they own benefic, Microsoft says you have to download the patches, they will put whatever they want in those patches and they will have more control in the PCs. The Antiviruses companies says you have to download their programs and so on ...
Those worms (blaster, sasser, ...) are not dangerous but annoying, I think people related to those companies are in the background of those worms.
Anyway, this is my question: does anyone knows any place where in could get total impartial information about new viruses - worms?
Thanks

 

[ChrisHirst]

Whoops!

set MyParanoia = New ParanoiaLevel
set MyParanoia = High

http://www.iss.net/

http://searchsecurity.techtarget.com/

(you may need to register)

And of course vendors are going to use some issues as a marketing tool, wouldn't you?

The idea that AV vendors somehow are involved in creating the problem has been discussed at great length and been refuted many times.
Microsoft are the only ones who can fix the problems discovered in their products, just as many other software vendors release patches for their particular products. MS just by being much higher profile get more media coverage, after all if it is so crap why do so many people run it?



Chris.

Indifference will be the downfall of mankind, but who cares?

 

[jrbarnett]

There's a lot of useful information on IT security in general, not just viruses, at

http://www.cert.org,

which is independent of the antivirus labs and software vendors.

John

 

[enDomino]

Perphaps Chris is right and my level of paranoia is high ;-)
Anyway, thanks for the infomation.

Antonio

 

[Sympology]

Sorry to say that blaster, nachi and Sassy are not dangerous but annoying is a bit of an understatement.
If these are left unchecked, thousand, no millions, of pc would be in a constant state of reboot, the internet would fall over the strain and nearly every companies network would be crippled.
Spam has now got to the stage where you are more likley to receive junk, than genuine mails. These hit mailservers and cause them to fill up and slow down just by sheer volume (we get about 40,000 junk mails a month), as well as annoying other people because their email has been spoofed so get thousand of delivery failures. Much of this is due to pc's having worms on them, leaving them open as mail relays for spammers.
Luckily this time we were fully patched against the exploit, so have had only the odd instance of infection of sassy, but we were hit hard by the first blaster strain, which bought our network to an halt. For us it was annoying, but for hospitals, emergency services, goverment agencies etc, then it can become potentially lethal.
I also back up Chris about Microsoft, the only reason it is targeted so much is it's so big. After all, whats the point of hitting a machine running Pascal or Fortran (showing my age now).
At the end of the day, it's the users fault that they don't apply patches. Would you drive a car if someone slashed the tyres because, the it's manufacturers fault they made them so they could be cut?

Stu..

2 decades from retirement, 2 minutes from a breakdown

 

[jrbarnett]

StuReeves

Good point, and it got me thinking. What if there were to be a "Computer MOT", much like vehicles over 3 years old in the UK have to have an MOT to be driven on public roads. It basically checks that they are safe to drive.

The "Computer MOT" would check:
- security patches and service packs for applications and operating system all up to date.
- clear of viruses, malware, spyware etc.
- have an up to date virus/spyware checker installed.

Tests to be carried out by independent inspectors (techs),
Any system that did not meet these requirements was banned from connecting to the internet in a particular country.

Like an MOT, a virus infection, spyware, adware etc would render invalid the license to connect, and require a new pass certificate before the machine would be allowed to connect to the internet.
ISP's would require evidence of a pass before opening an account for somebody.

Yes, its controversial, but it may cut down the number of widespread infections. It would also help people keep up to date with A-V, malware/spyware threats for fear of having their internet access cut off.

John

 

[ChrisHirst]

and as with cars, the most dangerous component is the nut behind the steering wheel



Chris.

Indifference will be the downfall of mankind, but who cares?

 

[jrbarnett]

Unfortunately, computers will do things if left alone, they don't need a driver to press buttons or move controls to emit data, packets etc.
Imagine how less useful computers would be if every server required a human console operator to approve every packet of data to come in or out of the machine.

John

 

[TexasSasquatch]

The MOT idea is an interesting one.

AT&T Wireless is already doing something similar.

On their CDPD network, if they detect that your machine is infected (Blaster in this case), they suspend the registration ability of that IP until the machine is cleaned AND patched.

I was waiting for all of my Win 2K and XP laptops to get hit with Sasser, but so far, nothing. It is hard to be proactive when the threats come so quick.

Gooney goo goo!

 

[Grenage]

It is hard to be proactive when the threats come so quick

This is true although the patches to fix vulnerabilities exploited by worms such as blaster and Sasser were released well before the worms hit the internet.

 

[TexasSasquatch]

True, but Im referring to the life cycle of the support aspect - I wasnt very clear, so I apologize. In other words, with approximately 200 laptops, by the time that I got all of them finished with one update, I would have to start the next. This is difficult for several reasons. One, Im the only one that handles the laptops at my agency and two, the majority of laptops are in use 24/7 (law enforcement) so its difficult to even get them in my possession in the first place until theirs an actual problem with the machine . Keeping up with critical updates for the laptops is all that I would ever be doing.

Gooney goo goo!

 

[Grenage]

I can definately sympathise with that, Scheduling updates and scans is a nightmare when you have no idea if and when a machine will appear on the network.