Internetworkers: http://www.ibiblio.org/internetworkers/

[Steven Champeon <schampeo AT hesketh.com>]

On Sat, 27 May 2000, Thomas A. Beckett wrote:
>       I note today yet another Microsoft Outlook virus: 
> http://www.cnn.com/2000/TECH/computing/05/27/new.virus.resume/index.html

Oh, joy.
 
>       And the other day, while perusing Steven Champeon's JaundicedEye site,
> I read his somewhat mossy essay on the potential for the "subscribe"
> function of Internet Explorer (ver. 4.0, that's what I mean by mossy) to
> be used in a conspiratorial fashion to mount a DoS campaign. 
> http://a.jaundicedeye.com/dark_fiber/article.html  (It appears that this
> was actually written by Greg DeKoenigsberg and not Mr. Champeon
> himself.)  

You mean people still read a jaundiced eye? :)

>       Putting 2 & 2 together and getting 5, I wonder if a Melissa or Love 
> Bug
> style virus could be created which would do the following things:  
> 
> -  When opened, start a VB script which would *slowly* mail itself to
> everyone in the victim's Outlook address book.  Slowly so as to not
> overwhelm mail servers and make itself known.  

I dunno - is there a "sleep" function in VB? The problem here is that if
the virus is discovered too early the virus writer loses out on a large
part of their distribution.
 
> -  After accomplishing the foregoing, and perhaps after an additional
> time delay, "subscribe" the victim's Internet Explorer to a given Web
> site.  Let's continue to use Steven's example of www.microsoft.com.  Set
> the refresh rate for the subscription to once per minute.  
> 
> -  Do nothing further to the victim's computer.  

Ooh. Better still, instead of subscribing them to microsoft.com, just
have it set a bookmark - which fetches the favicon.ico file - only set
bookmarks to randomly generated files, so the requests are all bogus.
(I hate the default behavior of IE WRT favicon.ico, if it's not already
plainly obvious.)
 
>       This would accomplish the delicious irony of Microsoft's entire
> installed base of Windows and Office engaging in a distributed denial of
> service attack on Microsoft's own Web site.  My question is just, is
> this still possible in the current version of IE and with the
> "antivirus" patches recently promulgated by Microsoft?  

I don't know whether the subscription stuff is exposed to external
scripting or not. The big question is whether it's exposed to the HTML
rendering control, and whether an HTML-formatted email with a VBScript
that (set the bogus bookmark|altered the subscription info) would work.

My guess, as a person who avoids both Outlook and VBScript, is yes. Any
informed people out there?

Steve

-- 
tired of being an underappreciated functionary in a soulless machine?
hesketh.com is hiring: <http://hesketh.com/careers/>