Full Disclosure mailing list archives
Re: [inbox] Re: Fwd: Comment on: USB devices spreading viruses
From: "Elazar Broad" <elazar () hushmail com>
Date: Mon, 24 Nov 2008 02:08:02 -0500
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Symantec's Endpoint Protection has a device control feature which basically functions as you have stated. I haven't really played around with it much, however, it can block devices based on device id... elazar On Mon, 24 Nov 2008 00:17:34 -0500 Bipin Gautam <bipin.gautam () gmail com> wrote:
On 11/24/08, James Matthews <nytrokiss () gmail com> wrote:bit9 and kaspersky offer this new service. Companies should makeuse of it.what service, James! Could you please explain more... I find it ridicules to know that this problem has been there since the earliest version of windows but still without a generic solution! Is this unwillingness for the approach to a proper solution is what has fueled the "antivirus business" for so long? If you look in the *nix side you will see this technique is tested/proven. Signature based or behavior based approach detection will continue to fail. To address this never-ending problem of virus infection from removable media, i have implemented no-execution-from-removable to dorzons of computers in the past years, even the dumbest of users understand what is being done and feel safe about they wont likely have virus infection from the removable media ever, even if the media has a virus. They know workaround on how to temporarily disable the restriction if they are willing to run something trustworthy as i have made the users clear there is no solution to the problem of virus infection from removable media and and you have to learn these few things ...like you have learned to use antivirus software to stay safe. Users get it, really! Antivirus companies should take similar approach (as described previously) to address it but adding USABILITY. This problem is there to stay for years to come. What better could be the proper solution to this problem? thanks, -bipinOn Sun, Nov 23, 2008 at 10:05 PM, Bipin Gautam <bipin.gautam () gmail com>wrote:On 11/23/08, Mike C <mike.cartall () gmail com> wrote:Of course, blindly thwacking people / dragging them to HR bythe hairwhen they're really just trying to do their jobs is counter-productive. The calls also show us where we,security, arefalling down. Perhaps it's poor awareness training (if theuser didn'tknow that they shouldn't run unapproved software, or why wehave thatrule, or how to get a new app approved); or could be thatthe officialroute is being seen as too slow or bureaucratic, in whichcase itneeds fixing. And so on.All I hope is we can fix the issue. Hopefully in the nearfuture.Yeah! Here is my prospective to a possible solution that wouldn'tcompromiseusability. But, first lets all agree on "banning execution of any binaryfromremovable media" is the only straightforward solution thisdecades oldproblem of virus infection/propagation from removable media. See, if a web-page tries to install an activeX / browserplugin, yourbrowser (non intrusively) waits for user interaction with asecuritywarning message on "if you really intend to install the plugin(Whichmay be harmful!)" or .......may choose to ignore the dialog and continue browsing. Here, it is assumed "user understands" the security impact of executing untrusted programs from internet and let theexecutiondecision left to the end user with manual interaction. If theplugininstallation behavior is not intended user can simply ignorethemanual interaction request for execution and instead continue. In similar way, anti virus company or Microsoft should createsimilarfor "My Computer Zone" where the first execution of a binary"fromremovable media" is denied by default and prompt for userinteractionto execute, white list&execute or terminate/ban the request for execution from removable media like the way internet explorer(nonintrusively) handles installation of activeX like in IE. Binary execution from removable media should be treated that way (untrusted! ) Pen drive / SD have unique serial numbers which can be used to identify and permanently whitelist or blacklist the media from execution. Windows already has a feature for prompting if user tries toexecutebinary from intranet/shared folder or execution of binarymarked asdownloaded from "Internet Zone" Why not have similar for binary execution from removable mediaas well!?What better could be the solution to stopping virus topropagate fromremovable medias with (default) FAT file system. (lackingACL's)For corporate environment let there be feature to sync thesewhitelisted/blacklisted hashes of executable or removable media UIDfromanti virus server/domain controller to anti virusclients/relatedservice running in user end. Will this work :)? -thanks, bipin _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/-- http://www.goldwatches.com/ http://www.jewelerslounge.com/luxury-insurance-- x-no-archive: yes _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
-----BEGIN PGP SIGNATURE----- Charset: UTF8 Version: Hush 3.0 Note: This signature can be verified at https://www.hushtools.com/verify wpwEAQECAAYFAkkqUtIACgkQi04xwClgpZitOQP8D1lV4X3nBEKbynQ0RUX5RMO3U/5Z cpJAalM0CPllm0sbTkAMeuogsyB4vhZ9J4UdXcRzyVOZPLs1nMOvQHttNTTXAKQDXsiv 6aexWRZvg4UeE5YSbgs7bU8PjWsNAW3kPL9d2/fkuLisCA2leOMMjPUdxZQu8vRg5oIC IQQl5TM= =/TSf -----END PGP SIGNATURE----- -- Click for huge discounts on pet food and supplies - up to 70% off http://tagline.hushmail.com/fc/PnY6qxt2l8TNc9jVLBmA5nygUPHxBXPtdRHOAicTVOCmlIMT7aiDW/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: [inbox] Re: Fwd: Comment on: USB devices spreading viruses imipak (Nov 23)
- Re: [inbox] Re: Fwd: Comment on: USB devices spreading viruses Mike C (Nov 23)
- Re: [inbox] Re: Fwd: Comment on: USB devices spreading viruses Bipin Gautam (Nov 23)
- Re: [inbox] Re: Fwd: Comment on: USB devices spreading viruses James Matthews (Nov 23)
- Re: [inbox] Re: Fwd: Comment on: USB devices spreading viruses Bipin Gautam (Nov 23)
- Re: [inbox] Re: Fwd: Comment on: USB devices spreading viruses James Matthews (Nov 23)
- Re: [inbox] Re: Fwd: Comment on: USB devices spreading viruses Bipin Gautam (Nov 23)
- Re: [inbox] Re: Fwd: Comment on: USB devices spreading viruses Mike C (Nov 23)
- <Possible follow-ups>
- Re: [inbox] Re: Fwd: Comment on: USB devices spreading viruses Elazar Broad (Nov 23)
- Re: [inbox] Re: Fwd: Comment on: USB devices spreading viruses Salvador III Manaois (Nov 23)