THREAT MONITOR
Remind users to never patch from e-mail attachments
Tom Lancaster
05.11.2004
Rating: -4.00- (out of 5)
|
A recent variant of Netsky seeks to worm its way onto people's desktops by claiming to patch various "hot" recent viruses or worms, including Sasser, Netsky itself, Beagle (aka Bagle in some listings), Mydoom, and MSBlast (aka Blaster in some listings), according to a recent news report. As with any other e-mail attachments, it's essential to train your users never to use them to patch systems. In another tip, in fact, I wrote about an incredibly convincing hoax that looked and read exactly like a real Microsoft security bulletin. That is, except for one thing: neither Microsoft nor any other reputable software vendors, including antivirus companies, ever send patches or updates to subscribers or users via e-mail. The hoax asked users to install the attached update!
"Why don't vendors send updates via e-mail?" you might be tempted to ask. Although they could use mechanisms such as public key encryption or digital signatures to prove their identities for e-mail delivery, software vendors uniformly choose to send notification of updates by e-mail, and let users download patches from verifiable sources at their convenience. Otherwise, in some cases vendors offer registered, up-to-date users subscription services that can initiate downloads (when available, such as Symantec's LiveUpdate service) to keep software and data files current, or automated update services (such as Windows Update) to do the same thing.
Making user software pick up downloads automatically or on demand is good policy from a security standpoint, as recent events clearly illustrat
To continue reading for free, register below or login
To read more you must become a member of SearchSecurity.com
e. But there are also size and message fan-out issues to consider as well. Because Microsoft Service packs are normally over 100 MB in size (if not much bigger), it's irresponsible to broadcast mail with attachments that big to large numbers of users. This is not only because of the size of the attachment itself, but also because of the large number of such messages that would be generated. The same thing is true, in fact, for most attachments over 1 MB in size. As responsible Internet citizens, most companies won't send that much data attached to e-mail; it's simply more efficient to have customers grab and use downloads when and as they need them (and many companies stage local copies of downloads as well, to prevent their users from having to copy the same thing repeatedly across the Internet).
The simple rule of thumb to teach users is: Never open or install anything that calls itself an update, a patch, a fix or whatever that shows up in your e-mail inbox. If you must install something (on a home or traveling machine, away from the office, for example), go to the vendor's Web site or use an automatic update service to download the patch. These simple words of advice, with properly patched and updated systems, will help users avoid nearly all sources of infection that might show up in their inboxes.
Tom Lancaster, CCIE# 8829 CNX# 1105, is a consultant with 15 years experience in the networking industry, and co-author of several books on networking, most recently, CCSPTM: Secure PIX and Secure VPN Study Guide published by Sybex.
|
|
Rate this Tip
|
To rate tips, you must be a member of SearchSecurity.com.
Register now
to start rating these tips. Log in if you are already a member.
|
DISCLAIMER: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.
|
|
|
|
|
|
|
