Full Disclosure mailing list archives
RE: AV "feature" does more DDoS than Sobig
From: "Steve Wray" <steve.wray () paradise net nz>
Date: Fri, 29 Aug 2003 08:34:07 +1200
I'm just going to snip out all the previous stuff because really this isn't strictly following on from it, but is related. *If* you are going to implement an AV system on your servers to filter incoming mail for viruses then you need to make sure that its properly configured. Obviously. And there are a *ton* of things to get right. You are dealing with 'explosive material'; viruses, trojans and *other* files intended to cause ill effect. Now, I am going to attach a binary to this email. Its only about 1.5K, thats not too big an attachment is it? Cool. Just don't try unpacking it unless you have over 20G of disk space available. Oh and that applies to your email antivirus system as well. You might want to check the AV spool space to make sure that it properly cleaned up after discovering that there was too much to decompress (assuming that they even bother with bz2 compressed files; one can do a similar trick with zip). This file is created from about 20G of null characters. I take no responsibility for any ill effects of unpacking this file; you have been warned and besides its a great opportunity to figure out a workaround. Imagine if spammers started attaching these zip-bombs! ewwwwww Check the configuration of your AV, check every detail and think about it; its a public service to the whole internet not just your own users. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Re: AV "feature" does more DDoS than Sobig, (continued)
- Re: AV "feature" does more DDoS than Sobig Marcos Machado (Aug 28)
- RE: AV "feature" does more DDoS than Sobig Ron DuFresne (Aug 28)
- RE: AV "feature" does more DDoS than Sobig Richard M. Smith (Aug 28)
- RE: AV "feature" does more DDoS than Sobig Ron DuFresne (Aug 28)
- Re: AV "feature" does more DDoS than Sobig David Vasil (Aug 28)
- Re: AV "feature" does more DDoS than Sobig Darren Reed (Aug 28)
- RE: AV "feature" does more DDoS than Sobig Rainer Gerhards (Aug 28)
- RE: AV "feature" does more DDoS than Sobig Barrett, Rob (Aug 28)
- Re: AV "feature" does more DDoS than Sobig DStark (Aug 28)
- Re: AV "feature" does more DDoS than Sobig yossarian (Aug 28)
- RE: AV "feature" does more DDoS than Sobig Steve Wray (Aug 28)
- Re: AV "feature" does more DDoS than Sobig William Warren (Aug 28)
- Re: AV "feature" does more DDoS than Sobig William Warren (Aug 28)
- RE: AV "feature" does more DDoS than Sobig Steve Wray (Aug 28)