You're safe simply because the majority of the virus writers out there these days probably don't know what COBOL is.
From: [email protected] [mailto:[EMAIL PROTECTED] On Behalf Of Brian Lehrhoff Sent: Tuesday, July 15, 2008 2:08 PM To: Jesse Sightler; [email protected] Subject: Re: [EDI-L] Re: Has anyone seen a virus in an EDI file? Gentran Unix Server is a compiled COBOL application that doesn't run IE. Is it still vulnerable? Brian Lehrhoff, EA ([EMAIL PROTECTED] <mailto:blehrhof%40cybernex.net> ) Messaging Consultant 201-913-4506 Upgrade your Quickbooks for 20% off at http://ea.brianlehrhoff.com Circular 230 Notice is located at http://ea.brianlehrhoff.com/230notice.html ----- Original Message ---- From: Jesse Sightler <[EMAIL PROTECTED] <mailto:jsight%40gmail.com> > To: [email protected] <mailto:EDI-L%40yahoogroups.com> Sent: Tuesday, July 15, 2008 1:53:30 PM Subject: Re: [EDI-L] Re: Has anyone seen a virus in an EDI file? Here is one example from about 30 seconds of googling: http://secunia.com/advisories/12959/ Of course, with EDI, the only practical defense is to trade only with trading partners that you trust, and use secure communication protocols. (ie, I agree with those who argue that protecting against this specific threat is ridiculous, when there are many more likely channels that you should be directing your energy towards defending) On 7/15/08, Holt, Jake <[EMAIL PROTECTED] <mailto:jholt%40samsill.com> > wrote: > > I've never seen a buffer overflow vulnerability with straight HTML, all > of them utilize an object of some sort be it a faulty HTML>RTF > conversion library or imagine object. The difference is browsers are > made to support thousands of different objects, languages, formats and > media types - EDI processes are not. Where are you going to place your > compiled virus code? In all those binary images you swap back and forth > with your trading partners? > > From: [email protected] <mailto:EDI-L%40yahoogroups.com> <EDI-L%40yahoogroups.com> [mailto: > [email protected] <mailto:EDI-L%40yahoogroups.com> <EDI-L%40yahoogroups.com>] On Behalf Of > Jesse Sightler > Sent: Tuesday, July 15, 2008 10:01 AM > To: [email protected] <mailto:EDI-L%40yahoogroups.com> <EDI-L%40yahoogroups.com> > Subject: Re: [EDI-L] Re: Has anyone seen a virus in an EDI file? > > While I agree with the basic premise that virus scanning against EDI > files > is currently worthless, I think that your logic is flawed. Several web > exploits have used HTML (pure html, no Javascript) to exploit buffer > overflows in browsers to coerce them into executing arbitrary code. An > edi > translator with a buffer overflow exploit is theoretically exploitable > to > run executable code. > > On 7/15/08, Steve Moses <[EMAIL PROTECTED] <mailto:moses%40iomega.com> <moses%40iomega.com> <mailto: > moses%40iomega.com <moses%2540iomega.com>> > > wrote: > > > > I agree. > > The possibility of executable binary source code being completely > lower > > ASCII readable text (especially that actually made sense) is > astronomical > > > > Steve Moses > > Systems Analyst > > Iomega Corporation > > (303) 681-2593 > > [EMAIL PROTECTED] <mailto:moses%40iomega.com> <moses%40iomega.com> <mailto:moses%40iomega.com<moses%2540iomega.com> > > > <moses%40iomega.com><mailto:[EMAIL PROTECTED] <mailto:moses%40iomega.com> <moses%40iomega.com> <mailto: > moses%40iomega.com <moses%2540iomega.com>> > <moses%40iomega.com> > > > > > > > ________________________________ > > From: [email protected] <mailto:EDI-L%40yahoogroups.com> <EDI-L%40yahoogroups.com> <mailto: > EDI-L%40yahoogroups.com <EDI-L%2540yahoogroups.com>> > <EDI-L%40yahoogroups.com> [mailto: > > [email protected] <mailto:EDI-L%40yahoogroups.com> <EDI-L%40yahoogroups.com> <mailto: > EDI-L%40yahoogroups.com <EDI-L%2540yahoogroups.com>> > <EDI-L%40yahoogroups.com>] On Behalf Of Holt, Jake > > Sent: Tuesday, July 15, 2008 8:27 AM > > To: [email protected] <mailto:EDI-L%40yahoogroups.com> <EDI-L%40yahoogroups.com> <mailto: > EDI-L%40yahoogroups.com <EDI-L%2540yahoogroups.com>> > <EDI-L%40yahoogroups.com> > > Subject: RE: [EDI-L] Re: Has anyone seen a virus in an EDI file? > > > > You could take the 10 worst viruses out there right now, paste their > > source code into notepad, save it and email it to all your friends > > without a single one getting a virus. > > > > Compiled code cannot exist inside plain, human readable text. Tell > your > > infosec folks to focus on finding a solution for "Acts of God, Natural > > Disasters, War, Terrorism... and the other fun ones" because at least > > those risks exist. > > > > Jake Holt > > > > Samsill Corporation > > > > EDI / .Net External Application Development > > > > (817) 536-1906 ext 217 > > > > [EMAIL PROTECTED] <mailto:jholt%40samsill.com> <jholt%40samsill.com> <mailto:jholt%40samsill.com<jholt%2540samsill.com> > > > <jholt%40samsill.com><mailto:jholt%40samsill.com <jholt%2540samsill.com> > <jholt%2540samsill.com> > > > > > > > [Non-text portions of this message have been removed] > > > > [Non-text portions of this message have been removed] > > > > > > > > [Non-text portions of this message have been removed] > > [Non-text portions of this message have been removed] > > > [Non-text portions of this message have been removed] ------------------------------------ ... Please use the following Message Identifiers as your subject prefix: <SALES>, <JOBS>, <LIST>, <TECH>, <MISC>, <EVENT>, <OFF-TOPIC> Job postings are welcome, but for job postings or requests for work: <JOBS> IS REQUIRED in the subject line as a prefix.Yahoo! Groups Links [Non-text portions of this message have been removed] [Non-text portions of this message have been removed] ------------------------------------ ... Please use the following Message Identifiers as your subject prefix: <SALES>, <JOBS>, <LIST>, <TECH>, <MISC>, <EVENT>, <OFF-TOPIC> Job postings are welcome, but for job postings or requests for work: <JOBS> IS REQUIRED in the subject line as a prefix.Yahoo! Groups Links <*> To visit your group on the web, go to: http://groups.yahoo.com/group/EDI-L/ <*> Your email settings: Individual Email | Traditional <*> To change settings online go to: http://groups.yahoo.com/group/EDI-L/join (Yahoo! ID required) <*> To change settings via email: mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] <*> To unsubscribe from this group, send an email to: [EMAIL PROTECTED] <*> Your use of Yahoo! Groups is subject to: http://docs.yahoo.com/info/terms/
