Guardian Digital Inc. > InfoCenter > Mailing List Archives > Full Disclosure

Full Disclosure Mailing List Archive

From: Brett Glass (brett@lariat.org)
Date: Sat Dec 25 2004 - 23:43:40 EST

At 06:23 PM 12/25/2004, Valdis.Kletnieks@vt.edu wrote:

>I smell blood in the water - the sharks will be here soon... ;)

Well, of COURSE they will. Unlike the lazy dudes at Microsoft, no self-respecting
worm or spyware author would goof off on Christmas when there was such a tempting
vulnerability to exploit. I expect to see half a dozen worms, spyware programs,
"phishing" spams, and hacked Web sites to be infecting users within the week.

What's more, McAfee and Symantec say that they won't be automatically updating
users' machines to block exploits (Some? All? Who knows?) until the 29th. (I realize
that antivirus vendors have an incentive to allow a delay before they update their
patterns, because a rash of infections can help business.... However, this is
downright irresponsible.)

Which is why I'd like to capture the API entry point and put in the bounds
check that should have been there in the first place. Alas, I don't have the
Windows programming tools to do it here, so I'm looking for a bit of help.


Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

[ About Guardian Digital ] - [ Press Center ] - [ Contact Us ] - [ System Activation ] - [ Reseller Info ] - [ Online Store ] - [ Site Map ]
Copyright (c) 2000 - 2004 Guardian Digital, Inc. Linux Lockbox and EnGarde are Trademarks of Guardian Digital, Inc.