Security

Thanks junsu and I have got a copy of MyDoom now.

Its MD5 is: 39A7D2BB 5652C9D1 05C0D64A 640C5A9D [UPX unpacked]

Unfortunatelly he said it’s not valuable to research it because a previous analyze done by his colleague indicates that this is not a “skilled” worm.

I’ll keep this for some time. For security reasons I have denied my own execute privilege of that file.

From my Dr.Web log, it seems mydoom is getting its peak. Today it replaced the Win32.HLLM.Gibe.2, to be the king of virus on my mail server :)

It’s to my interest that the virus seemed to be < 32K. So if you have a sample, please send it to me (REMEMBER: Please encrypt it by adding a password in your ZIP or RAR archive, so I will be able to receive it without having the DrWeb to block it.)

What I concerned has finally happend. nectar committed a patch to cvs without (in my view) maintainers’ permission.

Theo de Raddt has pointed out that the /dev/crypto testing program in FreeBSD, like in NetBSD, was derived from a test program which he never published with a free license. It has now been deleted from the NetBSD tree as well.

Today someone posted a patch to qmail 1.0.3 and pointed out this.

I have a quick patch to this issue, hope it’s correct.

那个安全问题是……我曾经让这个blog以root的身份登入mysql

「什么，你居然允许服务以root登入数据库？」

也许有点偏执狂的倾向，不过，不让它以root登录，至少能让我睡个安稳觉了 :)