Newsgroups: bit.listserv.edi-l
Date:         Wed, 26 Aug 1992 13:45:54 -0700
From:         Bill Laidley <WLAIDLEY@BCSC02.BITNET>
Subject:      RE: Viruses, worms, wildlife & EDI

 > From:         "Donal O'Mahony, Comp Sc,
 >              Trinity College Dublin" <OMAHONY@CS.TCD.IE>
 >
 > It seems to me that the document on Viruses submitted by Bill Laidley
 > is a touch alarmist.
 >
 > Going on his description of this 841 X.12 transaction, the only new
 > change is that a section of data in an EDI message can be tagged to
 > specify that it is to be INTERPRETED as raw binary, rather than
 > ASCII text.

 My reading of the X.12 standard is that the data in the BIN segment is
 binary data, not ASCII text. It may be ASCII text, but I don't believe
 that the is the intent. If it is ASCII and the transaction moves from
 as ASCII host to an EBCDIC host, and the data is treated as binary -
 which means do not convert it from ASCII to EBCDIC - it will be
 unusable.

 > Note that all EDI data is expressed in the machine and on the wire as
 > binary - It is only when it is rendered on an output device, or
 > acted on by software that the interpretation comes into play.

 Yes. But all data types in the X.12 standard are sent using printable
 characters. Numbers are not sent in binary format- they are sent as a
 stream of numeric characters.

 > There is no suggestion in the supplied description that this transaction
 > allows a remote site to implant a file into their EDI partners file
 > system - let alone cause it to be executed.

 Yes. But nothing in the standard says that you are not able to do this.
 It all depends on how the EDI software handles the data when it
 receives it.

 > If this logic is followed to the extreme, any external source of data,
 > (including allowing someone to type in a username in response to a
 > login prompt) could POTENTIALLY implant a virus.

 Thats why computer security people all have gray hair (if they have any
 left  ;-)). Networks are very useful. Networks are very dangerous.

 >
 > If, on the other hand, people start to use this as a means of distributing
 > executable code, then the dangers become exactly analagous to the
 > movement of floppy disks, and the same precautions should be taken.

 My thoughts precisely. Boeing uses it to distribute executable code
 already. The reason I started this particular line of discussion is
 that this issue needs to be thought about and acted on.

 > From:         Dave Kearns <DKEARNS.TCC@KLAVEN.TCI.COM>
 >
 > That scenario has nothing to do with EDI, but everything to do with
 > system security. Any sysadmin who'd allow the possibility of program code
 > being overwritten should be given a one-way ticket to the unemployment
 > line. Every desktop OS I know of is able to implement this minimum
 > security.

 Dave- have you seen many users of PCs who actively protect their systems?
 I haven't. MS-DOS does NOT have the ability to prevent this type of
 problem. There are extensions to MS-DOS which add security, but they are
 such a pain to use that they aren't. The security measures which we
 accept as a matter of course on a mainframe or mini are considered
 un-necessary irritations on a PC. So we pay the price.

 > From:         MacFarland.Hale@HECKLE.MITRE.ORG
 >
 > I don't think Bill intended his writing to be alarmist or to imply that the
 > problem can't be fixed - just to highlight that the problem exists and needs
 > to be addessed (correct me if I'm wrong, Bill).

 Thank you Mac. You understood perfectly. The problem needs to be
 addressed at several levels. The most important is at the user level.
 Users must learn that there are risks, and that they must act
 accordingly. The other key level is that the software vendors have to
 think about the problem, and how they can help to prevent disasters.

 If my EDI translator automatically saves the binary data from an 841
 transaction using the filename supplied, without allowing me to decide
 whether I want it, or feel that it is safe- that translator is out the
 door. I don't care how many other features it has, it is not safe to
 use.

 Regards, Bill Laidley
 EDI Expert Team
 BC Systems Corp. Vancouver (604) 660-9705
Comments: Gated by NETNEWS@AUVM.AMERICAN.EDU