RE: Worms and CScript/WScript

From: Nick FitzGerald (nick@virus-l.demon.co.uk)
Date: 05/22/02 

Date: Wed, 22 May 2002 17:04:30 +1200
From: Nick FitzGerald <nick@virus-l.demon.co.uk>
To: incidents@securityfocus.com

mwright@allcovered.com wrote:

> The NSA guide, titled: "E-mail Security in the Wake of Recent Malicious Code
> Incidents" actually recommends disabling Windows Scripting Host by removing
> both cscript.exe and wscript.exe.

And that makes it "correct" or "a good idea"?

> I have added that to my logon script so that every time a user logs onto one
> of my networks, WSH is disabled. Add that to a managed anti-virus solution
> that filters attachments by extension, and does real-time protection of both
> servers and workstations and you have a very effective virus/worm/trojan
> defense.

In the corporate arena you often can get away without either of these
"advanced" scripting mechanisms, but Windows Update -- which is
rather critical to SOHO users having any chance of staying vaguely
up-to-date with security patches -- used to and presumably still does
depend on WSH (I think VBS specifically). Thus, suggesting disabling
it as a blanket recommendation may not be a wise thing... (And, even
in the corporate arena, you may better off restricting access to it
rather than removing it -- if your admin group uses VB scripts for
advanced system admin, certainly let them continue to run it so long
as scripts can be run under a suitably privileged security context
without introducing other unwanted problems but lock down your
ordinary users' access to the EXEs.)

> You can download the afore mentioned NSA guide directly here:
> http://nsa2.www.conxion.com/emailexec/guides/eec-1.pdf

I won't comment further on this (and probably nor here but on the
focus-virus list if I ever do) until I've read it...

> or browse through all the NSA guides at http://www.nsa.gov

Let's see -- the NSA gives out security advice from a site that
_requires_ browser scripting to be enabled?

Hmmmm -- do you think we may be able to make an informed estimate of
the likely quality and thoroughness of that advice from just this one
data point?? 

-- 
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3529854

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Relevant Pages

  • Re: sp2,windows security alerts
    ... > permanent disabling ability (registry entry, ... If the "Change the Way Security Center Notifies Me" doesn't stick ... when you reboot, or you want to disable the Security Center totally, ... -- torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway Administration scripting examples and an ONLINE version of the 1328 page Scripting Guide: ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Anti-Phishing with digital watermarking
    ... People who have enough tech knowledge to disable scripting are not the ... Disabling JavaScript doesn't take any kind of technical knowledge. ... author aware of the phishing attempts. ... If the phisher is not aware of or cannot find the exact code ...
    (Security-Basics)
  • Re: How to block these Facebook and Twitter widgets?
    ... You'll have to disable scripting to make them go ... variable) and the batch file is called noscriptIE.bat, ... @echo off ... so prevalent in web pages that carte blanch disabling of scripting in ...
    (microsoft.public.windowsxp.general)
  • Re: How Do I Turn Off IE Pop-Up?
    ... I tried disabling the scripting in IE6; however, I still get pop message. ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Re: A Very Sick W2K Server
    ... I tried disabling it in Services but the Power Chute service window froze and ... about DNS and DHCP, do these usually upgrade successfully, in tact? ... > Please try this to disable the PowerChute service: ... > torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway ...
    (microsoft.public.win2000.general)