New VIRUS threat Sober.p (4% of emails contain .zip files-DO NOT OPEN!)

http://vil.nai.com/vil/content/v_133409.htm ^ | May 4 2005 | Self

[Bald Eagle777]

My "hunch" is that China is up to no good. Maybe, just maybe, they are using information warfare tactics. No way, the Clintons and Kerry and all their hangers-on said it can not be so! Just a hunch that China's behind some bad stuff. We should say... "That wasn't nice" ... Now, let's see, are there any snakes we can train to take them on also? They mess with the bull, they get the horns. Bulls don't like Red.

Check out these links when you have some spare time:

http://www.sinodefence.com/c4i/default.asp
http://www.sinodefence.com/c4i/ew/ew.asp
http://users.bigpond.net.au/pongrass/security/security.htm (SMH, 8/18/2001)
http://www.specialoperations.com/Foreign/China/IW.htm
http://www.ceip.org/programs/info/infowar.htm
http://www.sans.org/rr/whitepapers/warfare/896.php
http://www.global-defence.com/2000/pages/china.html
http://www.fas.org/irp/world/china/docs/iw_mg_wang.htm
http://www.taipeitimes.com/News/front/archives/2003/09/04/2003066387
http://www.gyre.org/news/related/Information+Warfare/China
http://www.rand.org/publications/CF/CF145/CF145.chap9.pdf
http://www.strategypage.com/fyeo/howtomakewar/default.asp?target=HTIW.HTM
http://www.herolibrary.org/p113.htm (Chinese, sic)
http://www.iwar.org.uk/iwar/resources/news/china-io-2003.htm
http://www.iwar.org.uk/iwar/resources/china/iw/chininfo.pdf
http://www.infowar-monitor.net/
http://www.carlisle.army.mil/ssi/pubs/display.cfm/hurl/PubID=62
http://www.fas.org/news/taiwan/1999/cn-08-17-99-11.htm (1999)
http://www.taiwansecurity.org/AP/2002/AP-072902.htm (AP 2002)
http://www.au.af.mil/au/awc/awcgate/ndu/chinview/chinacont.html
http://www.au.af.mil/au/awc/awcgate/awc-info.htm
http://library.nps.navy.mil/home/bibs/IWbooks.htm (IW resources)

[Bald Eagle777]

Ref:

http://www.theatlantic.com/doc/prem/200506/kaplan (Atlantic - Kaplan - 05 - sic)
http://www.voanews.com/english/2005-03-23-voa76.cfm (VOA March 23, 2005)
http://www.jamestown.org/publications_details.php?volume_id=408&issue_id=3232&article_id=2369263 (Jamestown February 15, 2005)
http://www.csis.org/burke/hd/#reports (CSIS – resources)
http://fmso.leavenworth.army.mil/FMSOPUBS/ISSUES/china-internet.htm
http://www.sans.org/rr/whitepapers/warfare/ (SANS)
http://www.fofg.org/news/news_story.php?doc_id=782 (May 13, 2004)
http://armedservices.house.gov/issues/opeds/03-09-12tcs-china.html (HASC, 9/12/03)
http://www.space.com/news/china_dod_030801.html (August 1, 2003 – Space)
http://www.defenselink.mil/pubs/20030730chinaex.pdf (annual PRC report July 2003)
http://www.military-information-technology.com/article.cfm?DocID=51 (November 15, 2002)
http://www.cia.gov/nic/speeches_telecommunications.html (CIA – Gannon - April 2001)
http://www.spacedaily.com/news/china-01c.html (Space Daily Jan 2000)
http://www.heritage.org/Research/AsiaandthePacific/BG1340.cfm (Heritage - Wortzel - December 2, 1999)
http://www.ndu.edu/inss/siws/ch1.html (William Fast)
http://www.aracnet.com/~kea/Papers/threat_white_paper.shtml (Kent Anderson, 1998)
http://www.securityfocus.com/library?cat=132&offset=70 (Inf. Ops /IW 1996

[Spktyr]

Yes, they will actually execute in the preview pane of most versions of Outlook or Outlook Express unless you tell the program not to allow it - or turn the preview pane off.

[Spktyr]

Those are special cases. I recommend Sophos for those installations. This isn't the first time Trend has screwed up and killed machines with an update...


(kicks back and checks the status on his Cisco Pix firewall)

[PFKEY]

I have never caught a virus from any email attachment and I always use the preview pane. I wonder if I have something set to not allow it? I don't recall ever being prompted to allow a program to execute. I keep my virus sw upto date on my laptop but have an old desktop that runs without any virus protection. Guess I'm lucky.

[LTCJ]

I've seen a definite shift in my firewall log lately - China is absolutely at the top of the list. Tracing the source of rejected packets either reads like a tour list of Chinese cities or, increasingly, shows unregistered IP addresses with "Asian" super domains.

When I first entered the Army in '75, I elected Mandarin Chinese as my foreign language of choice figuring I was going to need it eventually. Looking back thirty years later, not a single thing has happened to make me change my mind.

If my instincts in real estate and the stock market had been 1/10th as good, this message would have been typed by my personal Freeping assistant.

[zeugma]

Just rename the extension to .txt and then back to .zip when the recipient receives it.

That shouldn't be necessary. If they are going to take the time to scan mime for zip files and/or executables, why not scan for viruses and pass uninfected items along.

This issue is another one of those things that makes defects in MSWindows platform affect everyone else adversely.

[zeugma]

...and I'm not a Windows bigot.

Didn't mean to imply that you were. Sorry if it came off that way. I was making more of a general statement than one directed directly at you. I should have clarified that.

[zeugma]

Sounds like Linux would work for you. If you're into a lot of gaming on your computer you'd need to keep a windows partition around. There is excellent Linux versions of 'office'-type software (Open Office, amonst others). For email and general internet access Linux is far superior to windows as viruses/worms/spyware are much less of a concern. I still strongly reccommend that you use a hardware firewall/router even if you only have one computer to give you that extra layer of protection from some of the evil types that roam the net.

Check out LinuxISO.org. They have links to many of the major distributions. If you need more information or general assistance with the migration, FreepMail me.

[timtoews5292004]

You're one of the first mac people I've come across on this forum (or many other forums) that has said essentailly "who cares what OS you use, as long as it does what you need it to do."

[Bald Eagle777]

Wow. I believe you, but something sounds out of place.

I have had experience w/Trend for years, as do many of the $95-$125/hr type IT guys that set up networks w/Trend and they have never reported any incidents to me. I'll ask around, but so far, no bad news.

Interesting, I will be on the Red Alert for ANY problems w/Trend and I'll try to post any anomalies in all honesty and objectivity.

[Disambiguator]

[Bald Eagle777]

Don't sell yourself short. You had the vision and foresight to opt for Mandarin in the 70s, now apply that skill set to the market!

Make a million $. Do it for the Gipper!

Yes, the ChiComs are being naughty, the rascals.

[Ramius]

You're one of the first mac people I've come across on this forum (or many other forums) that has said essentailly "who cares what OS you use, as long as it does what you need it to do."

Well, in the interest of full disclosure... I *was* a mac head. Now I'm pretty much immersed in Winders Server and XP. But... we do support lots of mac users around the company. I've only dabbled around with OS X. It's pretty, but I haven't owned one since system 7 (which *rocked* by the way). :-)

We also have a little linux, even some Sun and SGI gurgling along around here somewhere. And... I kid you not... I've got one remaining Alpha running VMS. Just can't get the damn thing to die, but I'm trying.

[Humidston]

Bump for tomorrow.

[backhoe]

That refreshes my memory for the old days of MS-DOS without Windows. Long ago I use to write my own Autoexec.bat and now I am scared that my skills have faded away by the influence of GUI. :)

Yep, and config.sys as well. Still remember that feeling of triumph getting vdisk to run properly the first time...

Used to have DR-DOS around here somewhere... Jameco was giving away the discs with some hardware I bought years ago. Still have Windows 3.1 ( not 3.11 ) on the original IBM discs, in my "box of OS's for weird & obsolete iron." Salavaged them from a dumpster behind an office that was tossing out old stuff.