Internet Virus can appear on RT

Thread View: comp.sys.ibm.pc.rt

3 messages

[T] Back to Threads [V] Tree View [G] Group Articles

3 total messages Started by Dave Fetrow Fri, 04 Nov 1988 06:48

#1453

Author: Dave Fetrow
Date: Fri, 04 Nov 1988 06:48

15 lines
1139 bytes

 In news.announce.important warnings on an Internet virus were made.

It was expected only to infect SUN and Vaxen. It can partly infect an IBM
RT as well....at least to the extent that an RT can accept the virus files
and run at least one virus process. (We found the virus on most of our RTs.
We are running ACIS/AOS not AIX)

 It may not be virulent on an RT but sysops should know enough to check and
delete virus files and processes. 
 
BITNET:   dfetrow@uwarita                            -- david d. fetrow --
UUCP:     uw-beaver!entropy!fetrow 
INTERNET: fetrow@bones.biostat.washington.edu
(cond ((lovep you (quote LISP)) (honk)) (t nil))

Re: Internet Virus can appear on RT

#1454

Author: Hal Birkeland
Date: Sat, 05 Nov 1988 02:51

36 lines
2298 bytes

In article <1044@entropy.ms.washington.edu> fetrow@bones.biostat.washington.edu (Dave Fetrow) writes:
>
>It was expected only to infect SUN and Vaxen. It can partly infect an IBM
>RT as well....at least to the extent that an RT can accept the virus files
>and run at least one virus process. (We found the virus on most of our RTs.
>We are running ACIS/AOS not AIX)
>
> It may not be virulent on an RT but sysops should know enough to check and
>delete virus files and processes. 
> 
>BITNET:   dfetrow@uwarita                            -- david d. fetrow --

david has summarized the situation very well... IBMs are succeptable to some aspects of
the virus, but not all. For example, my RT running ACIS 4.3 w/NFS was not fully struck
by the virus either.  The sendmail i am running has debug turned off which defeats the
initial attack by the virus.  furthermore, the machine doesn't appear in any .rhosts
files or hosts.equiv.

just remember, any UNIX machine running sendmail can get the first stage of the virus (the
mailer -> sed -> cc -> net communications to get the rest of the virus) but it seems that
only VAXen and Sun 3's will actually compile and run it (at least we couldn't infect our
RT even though we tried).

--hal
REMEMBER:  fix fingerd
	   fix sendmail
	   run viruscheck on passwords (so accounts aren't broken into)
	   discourage .rhosts files
	   strip hosts.equiv to the vare minimum

	INSTALL THE CONDOM (the directory /usr/tmp/sh owned by root, protected as 000 with a couple of files
                            in it with the same protection. Therefore, the virus can't get a toehold)

Thank god that it didn't infect HP9000s3x0 workstations running HP-UX6.0

hkbirke@media-lab.media.mit.edu

Re: Internet Virus can appear on RT

#1456

Author: Dan Ehrlich
Date: Sun, 06 Nov 1988 00:00

12 lines
1176 bytes

In article <3259@mit-amt>, hkbirke@mit-amt (Hal Birkeland) writes:
>In article <1044@entropy.ms.washington.edu> fetrow@bones.biostat.washington.edu (Dave Fetrow) writes:
>>
>	   fix sendmail
>	   run viruscheck on passwords (so accounts aren't broken into)

Where can I get a copy of 'viruscheck'?  Thanks in advance.
-- 
Dan Ehrlich <ehrlich@shire.cs.psu.edu> | Disclaimer: The opinions expressed are
The Pennsylvania State University      | my own, and should not be attributed
Department of Computer Science         | to anyone else, living or dead.
University Park, PA   16802            |

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads