Great Circle Associates Firewalls
(September 1997)
 

Indexed By Date: [Previous] [Next] Indexed By Thread: [Previous] [Next]

Subject: Re: Guaranteed trouble
From: "Michael H. Warfield" <mhw @ wittsend . com>
Date: Mon, 15 Sep 1997 13:32:10 -0400 (EDT)
To: kirt @ internetmci . com (Tim Kirtley, Unix Systems Admin)
Cc: firewalls @ GreatCircle . COM
In-reply-to: <341D4910 . 2623D1D1 @ internetMCI . com> from "Tim Kirtley,Unix Systems Admin" at "Sep 15, 97 09:41:20 am"

> How can one realistically protect against this one . . .

> Joe Badguy sends an email to a Marketing Rep who passes out his business
> cards at all 47 conventions he displays at per month.  Subject:  Golf
> Tournament this Weekend.

> Marketing Rep, eager to go golfing, clicks on the email in Exchange,
> which finds the message contains a Word document, which calls Word,
> which finds the Word document contains an auto-execute script written in
> VBScript, which calls VBScript library, which finds the VBScript
> contains a BIOS call, which it efficiently calls, which runs a low-level
> format on the first IDE fixed disk.

	Upgrade to the latest version of Word that warns you BEFORE running
an autoexecute script.

> Quick and efficient.  No virus, no prompting,  a very quiet
> assasination.

	Latest version will prompt.  Won't help if said individual is dumb
enough to say "sure go ahead and execute that macro I've never seen", but
at least it will ask.

> How could you have stopped it without disallowing either Word or
> Exchange, or both ?

	Upgrade.  This was addressed in Word 7.0a.

	Mike
--
 Michael H. Warfield    |  (770) 985-6132   |  mhw @
 WittsEnd .
 com
  (The Mad Wizard)      |  (770) 925-8248   |  http://www.wittsend.com/mhw/
  NIC whois:  MHW9      |  An optimist believes we live in the best of all
 PGP Key: 0xDF1DD471    |  possible worlds.  A pessimist is sure of it!


References:
Indexed By Date Previous: Re: Guaranteed trouble
From: NB Keenan <nbk @ gsionline . com>
Next: Re: Guaranteed trouble
From: Leonard Miyata <leonard @ geminisecure . com>
Indexed By Thread Previous: Re: Guaranteed trouble
From: Peter da Silva <peter @ baileynm . com>
Next: Re: Guaranteed trouble
From: Leonard Miyata <leonard @ geminisecure . com>

Google
 
Search Internet Search www.greatcircle.com