[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: [Fwd: Virus Alert]



Robbie Honerkamp:
> Not true. You can't get a virus from reading an email message.

Not true. The Good Times virus is a hoax, but it is possible to get a virus
from e-mail, in some circumstances.

Some e-mail systems allow the sender to tag the contents as being plain
text, HTML, C source code, a shell script, and so on. This is not something
that MIME invented -- it existed well before MIME. It's a good thing, since
it allows programs to handle mail more intelligently.

However, stupid people can also write mail user programs that automatically
run a program that comes in e-mail. Even more stupid people use such 
programs. For example, I've seen a procmail rule that was essentially 
like this:

	:0
	* ^Subject: runme
	| sed '1,/^$/d' | sh
	
For those who don't understand procmail's syntax, this takes every letter
that has "runme" in the subject and runs its body as shell commands.
Very, very dangerous.

I've been told that some Windows mail programs have something similar
built in (if you receive a Word document, they automatically run Word
and load that document -- Word documents can contain powerful macros
that are run automatically when the document is loaded), but I haven't
verified it.

GNU Emacs had a similar feature (certain magic lines in a file could
run any Emacs commands automatically when the file was loaded -- and
Emacs commands are powerful indeed).

So it's quite possible to get a virus from e-mail, but you have to either
be wantonly stupid (if you install a dangerous procmail rule), or just
ignorant that the program had the capability (what do you mean you didn't
read the footnote on page 481 of the technical reference manual you must
buy separately?).

For more information, you might want to search the RISKS archive (see
the comp.risks newsgroup).

> Notice that the original post came from AOL.. :)

Not everyone from AOL is stupid. I've exchanged mail with an AOL user
who wrote C compilers to cure hangovers...

Most AOL users are new on the net, and they're clumsy, silly and sometimes
irritating, but there's some very shrewd people on AOL as well. With six
million users (three times as many as on the whole of Usenet when I started
reading it) you get all kinds of people.

-- 
Rural sizes win <liw@iki.fi> <http://www.iki.fi/liw/>
Please don't Cc: me when replying to my message on a mailing list.


Attachment: pgp_ekktV031m.pgp
Description: PGP signature


Reply to: