[pmmail-list] SirCam Virus Filtering Update

[Kenneth Porter]

On Sun, 05 Aug 2001 01:59:24 -0700 (PDT), Kris Sorem Sr wrote:

>Not opening an attachment whether solicted or not until it has been
>screened does prevent infection. Many users however do not follow that
>advice. Based upon the filter you are using, you've been lucky with no
>false positives.

Was just thinking about this and about how one would know if an
attachment was legitimate or not. It occurred to me that a future virus
could search a user's Sent folder for a message with an attachment
similar to itself and re-send it, replacing the attachment with itself.
This won't spread as fast, but it does place recipients at risk who
depend on the text content of the message being recognizably from the
sender's hand to determine the authenticity of the attachment. Yet
another reason to digitally sign any attachment.

Ken
mailto:shiva@well.com
http://www.sewingwitch.com/ken/
[If answering a mailing list posting, please don't cc me your reply. I'll take my answer on the list.]



- pmmail-list - The PMMail Discussion List ---------------------------
To UNSUBSCRIBE, send a message to mdaemon@bmtmicro.com with the first 
line of the message body being...
UNSUBSCRIBE pmmail-list@blueprintsoftwareworks.com