<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.32.2">
</HEAD>
<BODY>
On Thu, 2011-10-13 at 18:52 -0400, Jim Kinney wrote:<BR>
<BLOCKQUOTE TYPE=CITE>
That's a very narrow definition of malware. What term is more suitable? Deceitware? Clickware?<BR>
ALL malware requires some degree of human processing. At a minimum, someone must join power source to computer power input. Surely that act of human involvement would not relegate all forms of miscreant operations involving software out of the bad or 'mal' designation.<BR>
Symantical hair-splitting rarely works well with this group. Best keep philosophical discussions at a high enough level to avoid overly passionate nuance flame wars<BR>
<BR>
On Oct 13, 2011 6:28 PM, "Pat Regan" <<A HREF="mailto:thehead@patshead.com">thehead@patshead.com</A>> wrote:<BR>
<BLOCKQUOTE>
On Thu, 13 Oct 2011 17:16:50 -0400<BR>
David Tomaschik <<A HREF="mailto:david@systemoverlord.com">david@systemoverlord.com</A>> wrote:<BR>
<BR>
> On Thu, Oct 13, 2011 at 3:58 PM, Pat Regan <<A HREF="mailto:thehead@patshead.com">thehead@patshead.com</A>><BR>
> wrote:<BR>
> > If the malware in question here were using an exploit, why would it<BR>
> > bother trying to get the user to click on it?<BR>
> ><BR>
> > Pat<BR>
><BR>
> You've never seen "AntiVirus 2009" (and I imagine there is 2010, 2011,<BR>
> etc., but I stopped doing any Windows support in 2009). It's malware<BR>
> that pretends to do an AV scan, finds a list of things, and tells you<BR>
> it can remove them... for $39.99. You go to their website, put in<BR>
> their credit card details, and you're toast. I'm not sure if they<BR>
> actually charge you $39.99, just capture your CC info, or both. Never<BR>
> tried it to find out.<BR>
><BR>
<BR>
I understand the concept. What I'm saying is that any malware that<BR>
has to trick someone into installing it is almost certainly not making<BR>
use of any exploits. If it were, it wouldn't need to attempt to<BR>
socially engineer the user.<BR>
<BR>
Pat<BR>
</BLOCKQUOTE>
</BLOCKQUOTE>
I have seen many types of maiware that exploit both the user by some form of social engineering and others that exploit security flaws in the software. Older versions of Windoze were notorious for allowing code to act without direct use involvement.<BR>
<BR>
Both Java and Flash have some nasty security problems that could allow remote execution of code. In fact to some extent they rely on remote execution of code without user intervention for many web uses. <BR>
<BR>
<TABLE CELLSPACING="0" CELLPADDING="0" WIDTH="100%">
<TR>
<TD>
-- <BR>
<FONT SIZE="4">Jay Lozier</FONT><BR>
<FONT SIZE="4">jslozier@gmail.com</FONT>
</TD>
</TR>
</TABLE>
</BODY>
</HTML>