webb@webb.applicon.UUCP (11/05/88)
There has been a lot of press recently about the latest virus to hit the
UNIX world. The research lab here was hit, and so were a great many
universities and labs around the country. As a result, our internal network
has been shut down, and we have sealed ourselves off from the outside world.
Though this situation will certainly be only temporary, I wonder if this marks
the beginning of the end of the vast, loose networks that are so prevalent
today. With no way to assign blame or responsiblity to the pranksters who
build these viruses, I would be suprised if some companies thought twice
before agreeing to connect to a network, considering the potential risk.
The benefits offered by USENET are so hard to define concretely, but the
risk of a virus is very real, and a manager asked to choose between them
might justifiably decide not to take the risk.
There has been no official announcement from our management yet, so I have
nothing to report, but I would like to hear what is going on at other sites.
Anyone thinking of dropping off the net?
Peter Webb.
{allegra|decvax|harvard|yale|mirror}!ima!applicon!webb,
{mit-eddie|raybed2|spar|ulowell|sun}!applicon!webb, webb@applicon.comgwyn@smoke.BRL.MIL (Doug Gwyn ) (11/12/88)
In article <35900005@webb> webb@webb.applicon.UUCP writes: >Though this situation will certainly be only temporary, I wonder if this marks >the beginning of the end of the vast, loose networks that are so prevalent >today. With no way to assign blame or responsiblity to the pranksters who >build these viruses, I would be suprised if some companies thought twice >before agreeing to connect to a network, considering the potential risk. You're never going to attain ABSOLUTE security on ANY computer system, even isolated ones in Faraday cages with armed security guards controlling access. What you actually can attain is some probability that your system's mission functions can be performed without outside disruption, or without leaking proprietary information, or whatever your security criteria are. If this probability is high enough, then your security is good enough despite the fact that it cannot be perfect. You have to balance the improved security confidence level you would obtain by disconnecting from the net against the loss of value such a disconnect would entail. That is the only way you can make a rational evaluation of the advisability of yanking the plug. The problem with the Internet is that there are too many unchecked possibilities for security holes to assign a really high probability against unwanted interference. The level can be substantially raised, for example by careful protocol and server code reviews, and it appears to me that this should be done -- with proper coordination! My experience has been that even at a fairly security-conscious organization, the biggest security flaws are not weaknesses in networking software but are rather local "people problems". That is not to say that we shouldn't strive to improve BOTH.
woods@gpu.utcs.toronto.edu (Greg Woods) (11/14/88)
In article <35900005@webb> webb@webb.applicon.UUCP writes: >.... >The benefits offered by USENET are so hard to define concretely, but the >risk of a virus is very real, and a manager asked to choose between them >might justifiably decide not to take the risk. > There has been no official announcement from our management yet, so I have >nothing to report, but I would like to hear what is going on at other sites. >Anyone thinking of dropping off the net? USENET mail is not very virus prone. Sure, you can forge mail, and in some cases read other's mail, but sending a worm or virus through the mail is another thing entirely. I've heard quite a bit about various rmail bugs, but have yet to have it demonstrated that a carefully administered machine can lose a copy of its passwd, L.sys, or Systems files because of these bugs. Please, no stories about long gone bugs (except a sites that are too backward thinking to upgrade). USENET news, on the other hand, is not quite so secure. If not carefully administered, it can pose considerable risk, even in some default configurations. NEVER run ANY kind of shell archive through a real shell running as any priveledged user, or as a user with anything to lose. Any uucp connection, no matter how secure, involves the transfer of files. Any poorly designed installation is prone to resource hogging. Of course, if you can spoof another machine, you can attack with the permissions of the spoofed machine. NO dialup uucp connections should be considered trusted. When you get right down to it, USENET is no less secure than most postal services. The value of open communications CAN be demonstrated, and it DOES have its costs. Almost always they are well worth paying. -- Greg Woods. UUCP: utgpu!woods, utgpu!ontmoh!woods, lsuc!gate!woods VOICE: (416)443-1734 [h], (416)595-5425 [w] LOCATION: Toronto, Ontario, Canada