On Mon, 19 Jan 2004 19:58:15 EST, "David F. Skoll" said: > It's pathetic that 17 years after CHRISTMA EXEC, hundreds of thousands of > Windows machines are succumbing to the same easily-preventable security flaw.
What's even MORE pathetic is that even 17 years ago, CHRISTMA EXEC required for you *first* to receive the file from your "reader" space to your disk space, and *then* to invoke it as a command. So that's the equivalent of first saving an attachment from an e-mail into a directory, and then going and finding the file in the directory and launching it. At that point, there's not much you can do if you're going to allow attachments at ALL. (Also, IBM quickly released a set of patches against RSCS (the communications subsystem in use for VNET and Bitnet) that allowed filtering of filename/filetypes, with either quarantining or renaming of the files - so a site admin could make CHRISTMA EXEC end up being called CHRISTMA CEXE, which then wouldn't run unless the user manually renamed it back.) The other interesting thing was that although CHRISTMA EXEC went on quite the burn then (I should know, I was the admin of a VM system on Bitnet at the time ;), the user community *learned*, and although there were 5-6 subsequent copycat programs, they were nowhere near as widespread. However, today people will *still* click on unknown stuff.... Moral of the story - in the past 2 decades, the users have gotten stupider, and many of the software designers have as well.....
pgp00000.pgp
Description: PGP signature
