Re: And You Thought You Were Paranoid...


Renu Raman (ram@Sun.COM)
Tue, 8 Nov 88 16:47:20 PST


In article <31997@bbn.COM> wbe@BBN.COM (Winston B Edmond) writes:
>In article <7080011@eecs.nwu.edu> naim@eecs.nwu.edu (Naim Abdullah) writes:
>>those huge incremental backups that you keep on disk; or to give you some
>>free space, the worm could silently truncate files that hadn't been touched
>>for three months or so).
>
>Even easier -- use the 10% free space area to hold the virus's files,
>then adjust the used-block count. The penalty is somewhat worse disk
>performance, and the possibility of detection when the disk is fsck'd,
>but how many people worry about reports that the free block count has
>been adjusted when there are no reports of broken files?
>
> -WBE

    If Morris had used the technique to fix all those sendmail's (fingerd)
    with the debug option turned on, that would have been the quickest bug fix
    done in the history of computing. Then what would one call it?
    (in the likes of worm/virus).

    Renu Raman

    Disclaimer: I speak for myself (isn't that obvious)



This archive was generated by hypermail 2.0b3 on Thu Mar 09 2000 - 14:44:29 GMT