Indeed... while EDI data is not executable, in theory a buffer overflow in a translator could yield interesting possibilities for an attacker. Having said that, if there's never been an occurrence, and therefore none of the antivirus vendors check for X12-borne attacks, this seems exceedingly unlikely. At the most, I would think it means keeping your translator software up to date.
On 7/14/08, Phil Kestenbaum <[EMAIL PROTECTED]> wrote: > > In theory, if the data is coming from a Windows platform, the server > could have been hijacked and the document could contain commands that > would invoke a virus. > > ________________________________ > > From: [email protected] <EDI-L%40yahoogroups.com> [mailto: > [email protected] <EDI-L%40yahoogroups.com>] On Behalf Of > Shawn Aker > Sent: Monday, July 14, 2008 4:19 PM > To: Hurd, Richard [SLCUS] > Cc: [EMAIL PROTECTED] <bc747%40buffnet.net>; > [email protected]<EDI-L%40yahoogroups.com> > Subject: Re: [EDI-L] Has anyone seen a virus in an EDI file? > > Oh, it's not time. It's billable hours. :) > > Shawn > > On Mon, Jul 14, 2008 at 1:01 PM, Hurd, Richard [SLCUS] > <[EMAIL PROTECTED] <rhurd3%40cscus.jnj.com> <mailto: > rhurd3%40cscus.jnj.com <rhurd3%2540cscus.jnj.com>> > > wrote: > > > Unless you're sending and storing binary objects, that's the most > > ridiculous thing I ever heard. > > > > EDI is textual information and needs to run through a translator. I > sure > > don't see how a virus/trojan/etc. can make it through the > transformational > > steps. > > > > Can you get some sort of certification from your EDI translator vendor > that > > they don't execute the code, they only translate it? > > > > Can you also get certification from your VAN that your connection is > > secured? > > > > I would sure push the burden of this up to your service providers. > > > > Sheesh. Talk about an infosec group with Too Much Time On Their Hands. > > > > > > -----Original Message----- > > From: [email protected] <EDI-L%40yahoogroups.com> <mailto: > EDI-L%40yahoogroups.com <EDI-L%2540yahoogroups.com>> > <EDI-L%40yahoogroups.com> [mailto: > > [email protected] <EDI-L%40yahoogroups.com> <mailto: > EDI-L%40yahoogroups.com <EDI-L%2540yahoogroups.com>> > <EDI-L%40yahoogroups.com>]On Behalf Of > > Richard > > Sent: Monday, July 14, 2008 3:49 PM > > To: [email protected] <EDI-L%40yahoogroups.com> <mailto: > EDI-L%40yahoogroups.com <EDI-L%2540yahoogroups.com>> > <EDI-L%40yahoogroups.com> > > Subject: [EDI-L] Has anyone seen a virus in an EDI file? > > > > Hi all, > > > > We're fighting quite a battle here at my company with the InfoSec > > (information security) folks and I could use some input from the > group. > > > > The core issue is if an EDI file (X.12 format EDI document) could > contain > > a computer virus, trojan horse, worm, etc.? > > > > I say that no they can't but our InfoSec folks say "they could". > Hence, > > they're talking about requiring PGP encryption/decryption, SFTP/SSH > > transmittals, full anti-virus scan before use, etc. > > > > I could see the encrypted transmittal session(s) for security sake, > but > > must I also pass a decrypted EDI file through an anti-virus software > > checker before I can pass it on to my translator and/or before I send > it > > out? > > > > I'm curious what you've seen and/or what you're doing, especially if > > you've actually had a computer virus try to piggyback onto an EDI > file. > > > > Any comments are much appreciated. > > > > Richard Jones > > > > ------------------------------------ > > > > ... > > Please use the following Message Identifiers as your subject prefix: > > <SALES>, <JOBS>, <LIST>, <TECH>, <MISC>, <EVENT>, <OFF-TOPIC> > > > > Job postings are welcome, but for job postings or requests for work: > <JOBS> > > IS REQUIRED in the subject line as a prefix.Yahoo! Groups Links > > > > > > > > [Non-text portions of this message have been removed] > > This message contains information proprietary to our company. It is > intended to be read only by the individual or entity named above or their > designee. > Any distribution of this message or the information contained herein > without written permission from our company is strictly prohibited. If the > reader of this message is not the intended recipient or an agent responsible > for delivering it to the intended recipient, you are hereby notified that > you have received this document in error and that any review, dissemination, > distribution, or copying of this message is strictly prohibited. If you have > received this communication in error, please notify us immediately by > e-mail, and delete the original message. > > [Non-text portions of this message have been removed] > > > [Non-text portions of this message have been removed] ------------------------------------ ... Please use the following Message Identifiers as your subject prefix: <SALES>, <JOBS>, <LIST>, <TECH>, <MISC>, <EVENT>, <OFF-TOPIC> Job postings are welcome, but for job postings or requests for work: <JOBS> IS REQUIRED in the subject line as a prefix.Yahoo! Groups Links <*> To visit your group on the web, go to: http://groups.yahoo.com/group/EDI-L/ <*> Your email settings: Individual Email | Traditional <*> To change settings online go to: http://groups.yahoo.com/group/EDI-L/join (Yahoo! ID required) <*> To change settings via email: mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] <*> To unsubscribe from this group, send an email to: [EMAIL PROTECTED] <*> Your use of Yahoo! Groups is subject to: http://docs.yahoo.com/info/terms/
