-=> BO SIMONSEN wrote to KURT WISMER <=-

[snip]
 KW> do i agree? no, not really... it can still spread far and wide since
 KW> there are still plenty of clueless people with poorly protected
 KW> network shares...

 BS> Aha.. But most ISP's is filtering port 137-139/tcp ?

are they? how do you know? i've heard that some big-name ones are, but i
don't think that is the same thing as 'most'...

[snip]
 KW> consider the number of people who *undo* all their security measures
 KW> by rebuilding their system from scratch (and then failing to re-apply
 KW> whatever security best practices they might have half-learned) instead
 KW> of just removing whatever virus or worm they may have had...

 BS> I guess not many people is doing that?

actually, lots of people are doing that... in fact, there are some
supposedly knowledgable folks in europe who seem to think that the only
way to deal with a virus infection is to format and re-install and
they've been trying to spread this idea...

 KW> then
 KW> consider the number of new computer users who haven't applied any
 KW> security best practices yet... then consider the number who ignore
 KW> hardening their system in favour of simply using a firewall (which may
 KW> or may not always be there to protect them)... then consider the
 KW> number of people who just do not learn how to prevent re-infection...

 BS> Firewall is a buzz word in these days.. Personally I've no reason for
 BS> using one..

if you don't connect to the internet then you have no need for one,
otherwise you do... it used to be that people would talk about the myth
of the firewall (the myth being that firewalls were necessary) - nobody
mentions the myth of the firewall anymore...

 KW> in a perfect world, spreading over network shares wouldn't be very
 KW> effective - but we don't live in a perfect world...

 BS> No.. But why not use a non-standard port for doing it?

a non-standard port? why bother?

look, this discussion arose out of an entry from sophos' online
descriptions that i posted a couple weeks back... i don't post
descriptions for viruses/worms/trojans unless sophos is claiming to have
gotten reports of them in the wild, so the malware in question *is* in
the wild... it is spreading, no matter how much you think it
shouldn't...
 
--- MultiMail/Win32 v0.43