FUQ (Frequently Unanswered Questions)...
..sobre a recente epidemia do Sobig.F:
"- How did it spread so fast? It was first seen on Tuesday 19th and by Thursday was a huge proportion of the world's emails. It doesn't particularly exploit MS email readers beyond encouraging people to click on it. And it's ability to spread via network shares was broken. I haven't seen this mentioned anywhere, but was this actually a case of previously exploited machines (perhaps by sobig a-e) being woken up and given new code to run?
- Why do Anti-virus server gateways persist in sending notifications to the sender? The SOBIG series, Klez and several other of the recent email viruses spoof the sender so there's no point in notifying the apparent sender any more. These notifications are nearly as bad as the virus in generating useless email Traffic.
- What was it going to do? At 8pm GMT on Fridays and Sundays until Sept 10, SOBIG.f wakes up and tries to connect to a set of internet machines to collect it's next mission statement. The first event was prevented by removing those servers from the internet. So nobody's worked out yet what that mission was.
- SOBIG, like several other viruses, contains it's own SMTP engine that sends email direct. This could have been blocked by ISPs banning port 25 to anywhere except their own email server. I don't like this because I don't like restrictions on my access but I can see the sense in it. At the same time, many viruses just use the SMTP settings in the machine to send to the ISPs server. So here's the question. We're perfectly happy with using Authentication on POP3. Why don't ISPs use authentication on SMTP? If the email reader can keep athentication ID/passwords secure from code running on the PC, then this combined with blocking port 25 would have stopped viruses propogating.
- One of the few market application segments that Microsoft have stayed away from is AntiVirus tools. Almost every other segment has been embraced and extended usually by MS offering a free minimal app which gets progressively better until the existing encumbents can't compete. Why doesn't MS install a basic anti-virus system in the operating system? They've already got the mechanism to do the automatic updates. They've got the coders. They could get some brownie points from the market for doing it. So why don't they do it?
- The big web based email systems now include hefty anti-spam and anti-virus functions. So it's clearly possible to run hefty filtering systems on high volume email handlers. So why do so few ISPs run antispam and anti-virus functions on all the traffic through their servers? With the spread of "wires only" broadband there's a market niche developing here for boutique "email-only ISPs". These provide a full email service including authenticated SMTP, SSL encryption, anti-spam, anti-virus, web access and have the huge advantage that they are usable from anywhere regardless if you're connected to the net from a WiFi hotspot, hotel room, work, home or whatever. This is a premium service that the big broadband ISPs could provide relatively easily as they already have most of the infrastructure in place.
- After all this time, why is it still so easy to execute code by just clicking on it in Internet Explorer, Outlook and Outlook Express? Every application has bugs in it. And some of these bugs will inevitably lead to exploits. And those exploits will inevitably lead to viruses and trojans. no matter what we say, MS is no more or less guilty of making these mistaes than any other ISV. We expect them to do a bit more quality control, but even that is a little unfair. But we have a situation where the dominant end user applications encourage the naive end user to run bad code insecurely. Simply arranging that the code had to be saved first (as in Mozilla and Firebird) would dramatically reduce the number of accidental infections.
- Klez, Slammer, Blaster, Lovesan, SOBIG.f. What's next? É o que todos nós nos perguntamos, não é?
Encontrei no JB Ecademy