As I understand it a virus is received and runs without the computer user's knowledge. The ILU attachment was in plain sight and required that the user click it for it to operate. Perhaps we need a new name like "clickme" or "whatsdis" to describe such scripts.

Can you make virus writing a crime? How would you define a virus? If I write a simple C program that deletes files is that a virsus? If a security expert writes a virus to test security would that be a crime?

Microsoft should take some of the blame for the spread of the ILU e-mail attachment. E-mail clients should not be able to run unknown scripts with a single click. Increasing punishment is not always a deterrent. People still kill, steal and assault others despite tougher laws. What is needed is more secure browsers, e-mail applications, networks and servers.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/32/1790#1790