WinXP diaries Yesterday's Office XP virus has now been successfully captured and identified, thanks to Menache Eliazer of Finjan Software's Malicious Code Research Center, who also came up with some useful information for those of you worried about the block settings of Outlook 2002 interfering with your distribution of attachments.
The central problem yesterday was that Outlook had found something it was suspicious about. It unfortunately hadn't found it on the way in, but it was definitely protecting potential recipients on the way out. A virus of some description had penetrated the system, the system was trying to distribute it, but the block suspicious attachments defence was stopping these being sent. It was perfectly happy to send the email without an attachment, so you'd still look like some kind of mug if they got through.
Upside of the Outlook defence system: when something tries to access your address book it warns you. Downside: when you click no, don't do it, it warns you again and again, apparently forever. The pop ups continue even after you've shut down Outlook, the task won't kill, and you can only knock it off when you reboot the system. Subsidiary downside: it turns out it wasn't actually trying to access the address book at all, but was giving me one of those Microsoft messages.
On, then, to today's downside. Menache sportingly volunteered to have me send a virus to him, and correctly guessed beforehand that it was BadTrans worm. But hang on - if Outlook blocks suspicious attachments, then how do you induce it to send one? You know it's in there somewhere, but you can't get at it because Outlook keeps hiding it from you, so...?
Thank you Clippy, for your helpful suggestion that if I'm running Exchange Server my administrator can add and remove file types to the block list. This will be a great comfort to home users everywhere. And I can't help noting that it seems to be the consumer version of Office XP I'm running.
Menache pointed me at Slipstick.com, which gives details of the registry edit that'll roll back attachment performance to the Outlook 2000 SR1 release. This allows me to grab the attachment and send it to him, and he confirms that it's BadTrans. So there you go - Microsoft help shields you from disastrous techie stuff like editing the registry, the only way you get out of the loop is by editing the registry. Go figure.
The intruder is an interesting one. It replicates itself by replying to unread messages in your Outlook mail folders, and also plants a trojan that attempts to mail your IP address to the author, potentially allowing all of your stuff to be swiped.
So far, it doesn't look wildly good for Microsoft's new defence systems. They're clearly not enough, at the default settings, to stop things getting in, and although they'll prompt you about unauthorised stuff going out, and will block weird attachments, they don't attempt to identify the process itself and kill it, and they actively impede your ability to figure out what's going on. The recurring warnings will simply unnerve users, and generate support calls - making it easier this way makes it harder for all concerned.
It's doubly difficult on an XP system, because XP broke existing antivirus software. There is now a patch available for Norton 7.5, apparently, so for the moment that looks like the safest route to go.
But really, I can't help concluding that Microsoft still hasn't figured out what the plot is, despite all of the verbiage about Outlook's defence systems. Outlook is a prime target for attacks, not because it's the most commonly-used email client, but because it's full of security holes, by design. Microsoft's addiction to automation created these holes, and as this is a cornerstone of the software's design, there's really no way attacks can be blocked, without also blocking all of the automation.
Given that most users will carry on using Outlook, and that equally most users won't get around to updating (or even installing) antivirus software, there's only one way out, presuming Microsoft won't rethink its fundamental design premise. Those nice automation systems in XP that keep wanting to check things on the web, keep trying to head off to Windows Update, ought to be doing something useful like updating your antivirus software. As the virus-attracting software is part of the OS, then it seems only reasonable that the antivirus software should be too.
But maybe that's the plan. Trouble is, how confident are you that Microsoft could produce decent antivirus software, and keep it up to date? Outlook: it's a really nice program with tons of useful features, but unfortunately it's a menace. ®
Reg WinXP beta system virus defences breached