[28538] in North American Network Operators' Group
Re: uuencoded Love Worm variant
daemon@ATHENA.MIT.EDU (Stephen Sprunk)
Fri May 5 15:22:25 2000
Message-ID: <013b01bfb6c6$df62b0b0$642544ab@glock>
From: "Stephen Sprunk" <ssprunk@cisco.com>
To: "Bennett Todd" <bet@rahul.net>
Cc: "North American Noise and Off-topic Gripes" <nanog@merit.edu>
Date: Fri, 5 May 2000 14:10:32 -0500
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Errors-To: owner-nanog-outgoing@merit.edu
My Outlook Express happily presented his uuencoded file just like any other
attachment, which it then offerred (no thanks) to execute for me. Whether
attachments are MIME or UUE makes no difference to modern MUAs.
(No) thanks to Eric Conrad for intentionally sending us a live virus; I'd
managed to not get any copies so far.
S
| | Stephen Sprunk, K5SSS, CCIE #3723
:|: :|: Network Consulting Engineer, NSA
:|||: :|||: 14875 Landmark Blvd #400; Dallas, TX
.:|||||||:..:|||||||:. Email: ssprunk@cisco.com
----- Original Message -----
From: Bennett Todd
To: Eric Conrad
Cc: nanog@merit.edu
Sent: Friday, May 05, 2000 13:18
Subject: Re: uuencoded Love Worm variant
Does anyone know for sure that the uuencoded version isn't actually
devenomed by the uuencoding? I.e. is there any known gateway that
will turn the uuencoded attachment back into the known-virulent
MIME, or any known MUA that will offer to execute the uuencoded
script with a simple click? If the user has to go out of their way
to expressly decode the thing into a file, then deliberately execute
that file, that varient of the worm won't spread like wildfire; I'm
content to let it pass.
