Path: utzoo!attcan!uunet!dasys1!tneff
From: tneff@dasys1.UUCP (Tom Neff)
Newsgroups: comp.protocols.tcp-ip
Subject: Re: Virus - did it infect "secure" machines
Message-ID: <7671@dasys1.UUCP>
Date: 14 Nov 88 22:51:11 GMT
References: <881107224915.20c01427@Sds.Sdsc.Edu> <10846@ulysses.homer.nj.att.com>
Reply-To: tneff@dasys1.UUCP (Tom Neff)
Organization: Independent Users Guild
Lines: 15

In article <10846@ulysses.homer.nj.att.com> smb@ulysses.homer.nj.att.com (Steven M. Bellovin) writes:
>I keep looking for a system model that would have blocked this sort of
>attack.  Except for some sort of ``fairness scheduler'' -- one that would
>have kept any one user, such as daemon or nobody from chewing up the
>whole CPU -- I don't see one.  I'd like to, though.

How about a daemon to kill orphan processes?  The Morris attack tried to
obscure its origins once installed.



-- 
Tom Neff			UUCP: ...!cmcl2!phri!dasys1!tneff
	"None of your toys	CIS: 76556,2536	       MCI: TNEFF
	 will function..."	GEnie: TOMNEFF	       BIX: t.neff (no kidding)