|
 |
Orchid XP v8 wrote:
> Gail Shaw wrote:
>
>> The interesting (and unfortunate) thing about SQL Slammer is that the
>> patch that closed the exploit had been released a couple of months before
>> the worm appeared. The reason is was so widespread is that most
>> organisations hadn't bothered applying any service packs
>
> Indeed. Some of these things use a hole that was patched a week or two
> ago, but some hit really "old" holes that were fixed ages ago.
I heard of a really interesting one. Microsoft found a security bug (or was
responsibly and privately notified of it by another company/individual). As
usual, on Patch Tuesday they released an update fixing it, along with other
updates.
Some motivated hacker *reverse-engineered the update*. He compared the
relevant DLL before and after the update, basically. And figured out what
the vulnerability was.
And proceeded to pwn unpatched machines.
Post a reply to this message
|
|
|
|
On Thu, 07 Aug 2008 08:56:40 +0100, Invisible wrote:
>>> Well it's a lot safer than "keeping a collection of real viruses for
>>> test purposes". ;-)
>>
>> Depends on what you want to test. I was using it to test virus
>> interaction with software; the Eicar test file isn't particularly
>> useful for that.
>
> Surely this is going to vary arbitrarily for each individual virus?
Not necessarily. In my example of running WordPerfect from a networked
drive, the problem was reproducible every time. Infect machine, start up
WP, start doing work, WP starts creating massive temporary files on the
network drive until the space is used up.
Similarly, we had write-protected boot diskettes for the machines, but
the lab assistants would re-enable write by taping over the hole (3.5"
diskettes, we'd remove the write protect tabs on the boot diskettes) so
the diskette would get infected. Warm boot infected machine with write
protected diskette, you'd get a "write error" on boot every time. The
virus was actually coded to intercept a warm boot and keep itself in
memory while actually rebooting the machine, then would try to write
itself out to the boot diskette in order to spread.
Really strange to get a write protect error before DOS seemingly started
up.
Jim
Post a reply to this message
|
|
