OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.


Help: OASIS Mailing Lists Help | MarkMail Help



   Re: [xml-dev] Can A Web Site Be Reliably Defended Against DoS Attacks?

[ Lists Home | Date Index | Thread Index ]

Dare Obasanjo wrote:
> how would you solve the problem exploited by
> this current virus on any one of the popular operating systems existing
> today?

You serious?  You want me to solve one of the Internet's biggest 
problems, when the world's largest software company hasn't been able to 
do so?  Wow, such faith you have in me, it's humbling. :)

Anyhow, here's a couple of ideas.  They don't solve the problem of how 
you get all those customers who are new screwed by the original crappy 
versions to upgrade.

1.  The only thing you can do with an email attachment is SAVE it. That 
probably meets the 80/20 rule.

2.  Provide separate executables that are viewer-only versions of the 
Office Suite.  (Don't use the standard program with a flag as that's 
susceptible to stack-smash attacks.  If the code isn't in the 
executable, it can't be run.  Along those lines, use a special version 
of LoadDLL that limits where it will load from)  Ensure attachments can 
only run those programs.  Make it extensible, by providng an "Attachment 
Exectuables" directory, and let others add programs into there.

Prior art: http://research.sun.com/research/techrep/1997/abstract-60.html
I think I created the concept -- I should have filed a patent. :)


Rich Salz, Chief Security Architect
DataPower Technology                           http://www.datapower.com
XS40 XML Security Gateway   http://www.datapower.com/products/xs40.html
XML Security Overview  http://www.datapower.com/xmldev/xmlsecurity.html


News | XML in Industry | Calendar | XML Registry
Marketplace | Resources | MyXML.org | Sponsors | Privacy Statement

Copyright 2001 XML.org. This site is hosted by OASIS