Slashdot Mirror
McAfee Manufactures Virus Threat
The latest "news" to come out of the AV industry is New Virus Infects Picture Files. McAfee put up their description and made sure to issue a wide-spread press release to stir up some interest. McAfee's spokesdrone fans the flames:
- "Potentially no file type could be safe."
That evolution should make computer users think twice about sending pictures or any other media over the Internet, Gullotto said.
"Going forward, we may have to rethink about distributing JPGs."
Now, if you know much about computing, you may be a little suspicious of this. JPEGs are compressed image files that only contain data representing an image to be displayed, not code to be executed. A modification of that data might screw up the picture of your cat dangling from the edge of the kitchen table you like so much, but it won't turn the image into a potential virus transmitter, because the programs that display JPEGs don't read them with an eye toward executing the code. An image file is just data to be displayed. The line between "data" and "code" is a little bit fuzzy - often particular characters or a particular file can be both data and code, depending on the context of how other code handles it. Or a particular file can include both data and code separately, like a Microsoft Word file that includes data (your text) and code (some macro designed to be executed by Word when the document is opened).
But for JPEGs there's a well-designed standard, and it doesn't include executing code of any sort. If a JPEG-handling program doesn't like the data it sees, it should just stop trying to display the image, not decide to start executing code from the image. JPEGs are mostly harmless.
McAfee's claim of a virus spread through JPEGs requires one essential element: you have to have already been infected by ANOTHER virus transmitted by some actual executable code. What it comes down to is:
Once you're infected with a virus, the virus can set you up to be infected by other viruses.
No shit, Sherlock. Once you have enemy code running on your system, you're toast. A virus could alter Microsoft Word so that opening any Word document at all would erase every file on your hard drive, making every single Word document in existence a deadly threat -- to you, and to you alone. But this isn't a new virus threat of any sort. It isn't a breakthrough. It's a consequence of being infected, not a new method of being infected.
Two weeks ago, we ran a story about a cross-platform virus. Like this one, it didn't really exist in the wild. Like this one, it was mainly a PR ploy (by Symantec, in that case). But we thought it had at least some minimal technical interest as a bit of code that would run under Windows or Linux.
McAfee and Symantec (and all the other AV vendors out there) are waging a PR war to "discover" ever more news-worthy viruses to defend against. To get maximum coverage, your new virus needs to do something unique or different -- make your computer turn green, or infect something previously uninfectable, or whatever it might be. Compare this to Klez, a very basic virus similar in most ways to viruses that have gone before, which is still out there looting and pillaging tens of thousands of computers every day, but isn't ideal for AV vendors because they don't have a monopoly on the cure.
The press is catching on, to some tiny extent at least, that most virus alerts are fictitious and just designed to drum up business for the vendors. But it's far easier to repurpose a vendor's press release and call it a story than to dig into real threats that exist on the Internet, and the causes of those threats. Today, like last year and the year before and five years ago, there are major email-borne virus threats out there. (There are still old-school viruses out there too, transmitted by sneaker-net or by downloading suspicious software, but email is clearly the way to go for the discriminating virus creator.) All the real email virus threats share a few distinguishing characteristics:
- They only affect Microsoft Windows. If you aren't running Windows, you are safe.
- They're usually transmitted by email. If you know enough on your own, or you've had a half-hour class in "Email 101", you should be able to avoid executing random files received by email.
- They auto-execute in Microsoft Outlook or Outlook Express. Microsoft has finally made some progress, after many years, in reducing the vulnerability of their flagship email programs. So if you have a recent or fully-updated version of these programs, you may not be as vulnerable as people running older versions. Nevertheless, this was (and still is, since so many people don't have recent or fully-updated versions) a primary vector.
And that's really it. If you don't run Windows, you're safe. If you have basic email skills, you're safe. If you don't run Outlook, you're safe. That's the story of modern viruses, and fortunately or un-, it's a pretty boring one.
McAfee, and Symantec, and everyone else involved in the anti-virus FUD business: lay off. I mean that literally, as in, "Lay off the people you employ for the purpose of drumming up new virus threats." Lay off the public relations people you employ to say things like, "We may have to rethink about distributing JPGs." Lay off the BS. There's a real market for your product, people who (for whatever reason) are using Windows and/or Outlook, and haven't received the half-hour training course necessary to avoid viruses. You can market to them based on your fast responses to real virus threats - you don't need to manufacture any more.
. . . that all this time, the satire about the virus development divisions of anti-virus software companies actually contained a kernel of truth? Who woulda thunk it?
Call (206) 338-5780 COLLECT for information about a genuine BA, BS, MA, MS, MBA, or Ph.D.
I use AVG from Grisoft and just updated the signature file. I am SOOooo glad I use a freeware/shareware product that keeps up with REAL virus and not marketing. As they say here in the U.S. "There ought to be a law..."
"If you are on fire you can just stop, drop, and roll. If you fall into Lava you are just dead." - my 5yr old daughter
Attention, AV companies:
You could make some money offering training classes on how to avoid common viruses.
Against misinformation the public via the news channels? I understand they want business, but using FUD techniques will only backfire and cause major distrust among the public.
Would you want to use a product from an entity you don't quite trust?
I am the evil aardvark!
It's pretty simple to stay safe, and I have repeated this many many times to customers when I worked at an ISP. If you are using Windows or Outlook, do not open an attachment if you don't know what it is. It's very simple. I don't care if it says "This is very important, Bob and you must open this now." Unless you know specifically what it is and you were expecting it, don't open it. There is no need to, and you aren't going to miss out on much.
Of course, in the case of stupid users, there are some steps you can take on the server side to filter some viruses, but it's not perfect. In the end, patch Outlook, and educate your users. You could probably pretty easily drop any potentially executable attachments before they even got to Outlook (which drops many of them on its own).
What?
Shows what you know. You Linux lusers don't even have Microsoft ActiveJPEG Technology yet?!?
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
I'm running Windows and Outlook, and I haven't been infected with a virus yet. It's just common sense... "MY WIFE NUDE.JPG.exe" probably isn't something I want to open. The real anti-virus software is common sense, but there don't seem to be many available copies out there. :-/
say an attacker knows you use a certain program to view JPEGs, or other data/multimedia files. This attacker knows that certain program contains a buffer overflow, and how to exploit it. The attacker can assemble a specially formed file that exploits the overflow and opens a backdoor on your machine, granting himself some level of access to your computer (most likely user level access). Combined with knowledge of a local root hole, the attacker now has root access to your machine (ie, he 0wns j00). The attacker delivers this specially formed file to you in some manner (email, webpage, etc).
Suddenly, this "data" file is now containing a virus, isnt it?
The One Rule Of Chess You'll Ever Need: Don't play someone who carries a kit in their bookbag.
Someone should make a special program to detect and turn off Virus programs! I get a lot of calls from family members complaining about their slow computers, I check it out and they have the defacto McAfee install which checks all email, boot sector and floppy on boot, and (the worst one) EVERY exe before it starts. This causes a horrible delay everytime you do anything! I refuse to install any AV software on my computer simply because I am not stupid enough to open any of these files, and I consider the AV software itself to be a performance affecting Virus.
Intelligence is my anti-virus. I have been running Windows for a long time now, and have never been infected with a virus. Why? Because I am careful about what I allow to run on my computer. Linux or Windows, it doesn't matter. If you don't have some common sense, you are going to get burned.
The world moves for love. It kneels before it in awe.
I would rather throw out Windows out of the computer...
One statement of yours needs modification:
They only affect Microsoft Windows. If you aren't running Windows, you are safe.
There have been macro viruses which have inadvertently worked on the Mac versions of Word and Excel. I would correct the statement to:
They only affect Microsoft products, primarily Windows. If you aren't running Windows, you are almost entirely safe.
Check out this spam email a bunch of people in my office got yesterday:
s ion: 1.0
-=-=-=-=-
Return-Path: postmaster@salisbury.net
Received: from salisbury.net (12.152.4.9) by myoffice.com with ESMTP (Eudora
Internet Mail Server 3.0.3); Wed, 12 Jun 2002 23:08:21 -0400
Date: Wed, 12 Jun 2002 23:09:46 -0400
Message-Id: 200206122309.AA2564817116@salisbury.net
Mime-Ver
Content-Type: text/plain; charset=us-ascii
From: "postmaster " postmaster@salisbury.net
Reply-To: postmaster@salisbury.net
To: people in my office
Subject: WARNING: YOU WERE SENT A VIRUS
X-Mailer:
X-Mozilla-Status2: 00000000
On 06/12/2002 at 23:09:45 Our special virus software on our servers at salisbury.net
reported that your were sent an Email Virus containing the Unknown Virus in the Unknown File attachment.
The subject of the E-mail was "L Specifies the length". The E-mail containing the virus from kbndl@salisbury.net has been quarantined on our servers to prevent further damage. The virus never made it to your mailbox. (emphasis mine)
Internet Of Salisbury, Inc. provides this service free to our customers while other providers charge
a monthly fee. Though this software should catch up to 99 percent of viruses, a new virus could make it in.
If you are not running Anti-Virus software you should ASAP!
Please Contact N-Techsolutions @ 704-638-2422 or visit their website at:
http://www.n-techsolutions.com Look for the Norton Anti Virus Special! (emphasis mine)
Please do not call Internet Of Salisbury, Inc.
-=-=-=-=-
Not that there was ever any question about sleazy spammers being out there, but this one takes the cake.
Now, if you know much about computing, you may be a little suspicious of this. JPEGs are compressed image files that only contain data representing an image to be displayed, not code to be executed. A modification of that data might screw up the picture of your cat dangling from the edge of the kitchen table you like so much, but it won't turn the image into a potential virus transmitter, because the programs that display JPEGs don't read them with an eye toward executing the code
.exe files. In windows 98/2k you can be infected simply by clicking on a file once (because of the little preview window thing). Holes in Word, outlook, IE, IIS, and even windows explorer have made things completely ridiculous.
No, and HTML readers don't download HTML with an expectation to run the code natively, but it can happen thanks to bugs in IE.
Just like Outlook, the program you deride for its ubiquity, a huge, huge number of jpegs are viewed through the Microsoft libraries. If a hole was discovered in that library, it could be used as a vector for viruses.
The truth of the matter is that if you run windows, there is a real risk of getting a virus from things other then just running
Also, Your list of things not to do to catch a virus reminds me like avoiding pregnancy via the 'pull out' method. Sure it might improve your chances, but it won't 'protect' you in any real sense.
I don't think viruses on Linux have any real future, due to the fact that the most obvious holes would get fixed quickly, but if you run windows you really should get some Anti virus software.
autopr0n is like, down and stuff.
It's been more-or-less common knowledge that McAfee has done this since the Michelangelo scare in 1993.
I recommend going to vmyths.com to read their "rantings" section.
Let me predict that about 50% of the replies in this thread will consist of arguments like "Well even if we did get rid of MSFT products we'd still have a virus problem: look at staoG or Bliss or Ramen or the '88 Internet worm."
Those replies are guilty of a flaw called The Excluded Middle where one argues that a situation that in reality has a spectrum of situations only has the 2 extreme cases. In this case the replies will say that even Linux has viruses and worms (true and probably inescapable for a Turing-complete computer) so doing away with the source of 99.44% of viruses and worms won't solve the problem.
Of course this is crap. I'm still getting hits from Code Red I v2 nearly 10 months after it was released. When was the last time you got a sadmind/IIS hit? The problem isn't to eliminate 100% of all worms chainmails and viruses the problem is to keep worms chainmails and viruses from ramping up the exponential part of the logistics curve.
Quit playing Monopoly with Bill. Switch to one of many non-Microsoft products today.
Years ago - early 90s, the AV vendors had cash 'awards' for new virus discoveries.
Therefore, this story is not a big surprise.
a steady stream of new threats. There was another model for anti-virus
software. One that didn't have a patch model, but it was ignored because
profit driven companies require "revenue streams".
Rather than having a program that removes a virus from your system after
you've been infected or which requires an "inoculation" to recognize
viruses, the other system looks at program activities.
The actions taken by a virus are painfully obvious when you look at them
from a macro point of view (no pun intended). While not a trivial coding
task, it's possible to monitor for these types of action and freeze a
program that would take them. More over, with an ample supply of ram and
CPU, new programs could be tested in a "Safe Zone" the first time they are
run, ensuring that problem programs would be caught in the act.
Unfortunately this type of protection doesn't require incremental upgrades
from Anti-Virus companies and so we're stuck with something that can make
profits rather than something that works pro-actively. Thus is the basic
flaw of capitalism.
I'm lead tech at a small computer store. The massive onslaught of Klez in the wild makes us techs more money per day than a good, strong lightning storm will in a week with modem replacements. People in the general public that aren't in the "know" on computers are deathly afraid of viruses, and generally have no idea how to protect themselves.
Most of the John Q Publics out there buy a cheap computer from *.mart that has MS Windows pre-loaded on it that has virus protection software that will expire in 3 months, or require the end user to manually update the definitions. Most of them have no idea that their protection will run out, or that they need to update their software in order to keep it up to date and protecting them from the latest greatest virus.
So these folks turn to their cousin's brother who knows a bit about computers, and ends up screwing the computer up worse, or finds that they are unable to remove the virus from the computer. That's when they turn to us, and other techs. And they're generally willing to pay good money to get rid of the virus, have up to date protection that actually works installed, and be shown how to keep it up to date for a very long period of time, not to mention given a quick tutorial on what to open in their email and what to delete immediately.
In a perfect world un-educated folk wouldn't be given the option to purchase un-educated software, but until that time comes they need to rely on people that do know something about computers, and on software that can help protect them from their own lack of knowledge.
Duris MUD - The best pkill MUD. Ever.
If you have basic email skills, you're safe.
.jpg and mp3 files with dummy executables that Explorer will foolishly make look like the original files. So common MP3 shares and such make a pretty good vector for crossing the network, as well.
Unfortunatley, this is not entirely true. Quite a few of these viruses are happy to infect non email files once they get on a network via the email vector. We haven't seen many where I work, but we have seen a few that will infect various system files. Then, when a user logs into that system, the virus infected system will gleefully infect any exe's on the network that that user has write access to. Log into a machine like this as a domain administrator, and the chances of it getting to every machine on the network without them opening any email message is quite good.
Some of them will replace
They key is that the virus scan software tells you when you have a virus. What if you somehow get infected with a virus that gives no outright signs of infection? You could be making your backups for months without relizing that you data was compimized. The virus could have gotten in though some buffer overflow attack, or something that was no fault of your own. Without the anti-voris software you have no idea how far back you need to go for a good backup, or if any of your backups are even good.
BS. Lusers are called lusers for a reason. I'm not talking about every Windows user here, but all it takes is one to be a problem.
With some people, You can tell them to their face "Do not open emails from people you do not know", print it out in 124 point font banners hung over their cubicles, show them pict-o-grams of evil viruses destroying their data, bring Special Guest Star Burt Lancaster to reinforce the point, and drop by daily with the message written in icing on delicious chocolate cake. The minute you turn your back, they're off checking out the cool new Shakira screen saver someone sent them. The point is, it's still a problem, and it's not a problem you can completely solve with "30 minute training courses".
And please don't lay this all on Windows and Outlook either. Yes, there are some questionable design decisions in these programs. But if the whole world was running Linux or something similar, people would be causing problems running everything as root, or whatever other stupid things you can do to get yourself in trouble.
Do McAfee and Symantec sometimes go overboard with their warnings to sell more copies of their software? Of course they do. What company doesn't? Or did you think it was absolutely, positively necessary to see your doctor about Prilosec?
The next question is does such an exploit exist and does it affect enough users that it could gain critical mass? The answer is probably no. Every piece of image software, emailer, browser uses it's own implementation jpeg. This is true even on Windows where there was no way to read a jpeg file via Win32 until recently. Even apps that just use libjpeg will use different versions, might be customized and compiled with different flags. So the landscape is too hetrogeneous to favour a virus.
If I had to lay money down, I would say this is McAfee playing up a threat (just like Ashcroft and dirty bombs) for their own interests.
I'm surprised that McAfee's consultant (they admit that they received the virus from the author; they didn't deny hiring him) didn't create a real JPEG virus. It shouldn't be too difficult; just select an application that is widely-used to view image files, and then look for a buffer-overflow bug that can be exploited with a non-standard file.
Suppose you found a bug in IE that let you execute code packaged in a JPEG. With some clever coding, it would still display normally, but it would alter all other JPEGs on the system. When a web developer gets infected, his web site will spread the virus. It could spread quite widely.
Open-source anti-virus would be very cool, but it's really labor intensive and the signature databases are the vendor's crown jewels.. as it were.
The Virus Bulletin's VB100 test rates AVG fairly low. Do other tests rate it higher?
In fact, if the file name say "MY WIFE NUDE.JPG", I don't recommend opening it. (Well, ok, if it was MY wife, no problem. Quite the cutie. But I know some people's wife who.... *SHUDDER*)
Davis Ray Sickmon, Jr - looking for something to read? Check out my three free novels at MidnightRyder.org
True, it helps, but dropping Outlook (Express) for any other mail program of your choice will have largely the same effect.
Actually I think they farm this out to their overseas operations in Bulgravia or someplace similar. Keeps it better for the bean counters. Plausible denial, etc.
Although I can see the scandal if it was found that they actually do have virus writers on payroll someplace.
"It is a greater offense to steal men's labor, than their clothes"
Ever hear of calligraphy? Its a process of hiding data into pictures, and lots of it.
Calligraphy? I thought it involved writing fancy-shmancy letters with a special pen or brush.
Do you mean, perhaps, "steganography"?
Until a virus comes out that seeks out Linux boxes, uses several well known vulnerabilities to attempt to get root only to then set itself up on that box and seek out other boxes to infect.
What? You thing that everyone who runs Linux as a server keeps it fully up to date with all the latest patches?
Face it, if you're connected to the internet -you're stupid to assume you're safe.
So, to correct you: If you don't run Windows you're safer .
Avantslash - View Slashdot cleanly on your mobile phone.
I give it 45 minutes before the storm of emails from family, friends, etc., arrives warning about this one.
All caps, of course.
::sigh::
I won't dance in a club like this...All the girls are slags, and the beer tastes just like piss! -The Specials
Seriously, as cynical as it sounds, this happens every day in security marketing. I've had sales reps look me in the eye and straight-out lie about their products. When caught, they'll back off frantically, or try to talk their way out of it, but never admit that they lied.
The main problem these days is that security software sales are driven not by business decisions, but by fear. Fear of virii, 3v1l h4ck3rz, etc. Once you're buying something out of fear, it's really easy for the sales folks to play off that to make their product sound like it's the ultimate safety blanket.
I hate it. Not just because it's unethical, but also because it makes my job of evaluating products much harder. I can't even trust the feature lists in deciding which products to evaluate, since some of those are full of lies & vaporware. I keep wanting to explain the Tragedy of the Commons to the sales folks that try this c*$p, but they're always too stupid to understand it.
sigh.
Go out and get FRISK Software'sF-Prot antivirus instead. It is competently written with timely updates. I have relied on it since before I ever heard of the internet. There are DOS, Windows (network or standalone) and ($free) Linux versions. They do not generate hype or nasty bloated programs. They do generate a good antivirus product.
I do not work for this company. I am just a satisfied customer. You can get free trials on their site. Prices: US$25/yr for single private license, US$2/machine for corporate or educational ($40min) and there are extra educational discounts.
http://www.sophos.com/virusinfo/articles/perrun.ht ml
.JPG virus, and urges anti-virus companies to exercise restraint
Picture this: a virus in a JPEG
Sophos advises on threat posed by new
Sophos, a world leader in corporate anti-virus protection, today called for the anti-virus industry to act responsibly in light of the discovery of the first virus capable of infecting JPEG graphic files.
The virus, known as W32/Perrun-A, was sent directly to the anti-virus community by its author and is considered to be a "proof of concept". It spreads in the form of a traditional Win32 executable virus (usually called proof.exe), making changes to the Registry to mean that JPEG (.JPG) graphic files are examined by an extractor (called EXTRK.EXE) before they can be viewed. If the extractor finds viral code inside the graphic file it is executed.
"Some anti-virus vendors may be tempted to predict the end of the world as we know it, or warn of an impending era when all graphic files should be treated with suspicion. Such experts should be ashamed of themselves," said Graham Cluley, senior technology consultant for Sophos Anti-Virus. "Not only is this virus not in the wild, but also graphic files infected by this virus are completely and utterly harmless, unless they can find an already infected machine to assist them. It's like a cold only being capable of making people who already have runny noses feel ill."
"The virus relies entirely upon you running an infected EXE file, which is hardly rocket science," said Paul Ducklin, Head of Global Support for Sophos Anti-Virus. "Yet we are already seeing reports suggesting that this virus could spread via websites containing so-called 'infectious' images. This sounds like scare-mongering about image files to me."
Sophos has issued protection against W32/Perrun-A to customers concerned by the media reports and alerts from other anti-virus vendors.
"I can't give you a brain, so I'll give you a diploma" - The Great Oz (blatently stolen sig)
Do any of you remember the double free zlib bug?
Very wicked, but you had to a) know the type of system and b) the viewer the person was using. This sort of technique, using data to act as code is clever and quite real. In fact, there is nothing different between this and those URL hacks for IIS; data appears where it wouldn't normally be expected and it can be leverage into code space and executed.
However, in the case of JPEG, considering its block oriented format it would be quite difficult to engineer a buffer overflow condition.
Black holes are where the Matrix raised SIGFPE
This onion-like story may have been prescient:
Anti-Virus Software Pop-Up Reminders Behave Much Like Virus
Well, let's be fair. Once upon a time, there was no such thing as an email virus, and a great way to have some fun was to email someone with a message saying, "If you're reading this, you've been infected with a virus!" or some such. Then, Microsoft discovered the internet and wrote an email client, and now the old-fashioned method of spreading viruses by infecting a file and uploading it for public consumption is completely defunct. All viruses that make the news are spread by email attachments.
Shutting down free speech with violence isn't fighting fascism. It IS fascism!
I used AVG for quite a while, but I very VERY rarely get viruses. I thought AVG was great. Then my brother got Nimda, so I recommended he download it and clean his machine. And it didn't work. New infected files kept being detected by AVG until eventually he went and bought Norton which fixed the problem right away. Freeware may be good, but not great.
Netscape 4 on linux had an exploitable hole in their JPEG decoder. That is, a specially crafted JPEG could be used to execute arbitrary code on the target's machine. Could that code then "infect" other JPEGs? Sure. Would it actually spread? No, but if there were a similar bug in the default windows JPEG viewer, it wouldn't be surprising at all to see a similar worm spread.
a pe -jpeg.txt
http://www.openwall.com/advisories/OW-002-netsc
(I recall that this bug was successfully exploited; that advisory seems more tentative..)
Appreciate the reference... I have a new copy of McAfee AV 6.0 at home, but, well, it sucks. It locked up both my computer and my wife's computer repeatedly. She finally removed it. I finally blew away Windows and installed Linux.
What's particularly interesting, however, is for anyone who remembers the origin of McAfee -- they started out as a shareware/freeware shop. Corporations "had" to pay, individuals were "encouraged" to pay, and educational (and possibly non-profit) were totally free to use it at no cost.
They've long since abandoned that license and even abandoned free updates. You have to pay for support every 12 months, which I dislike. Particularly since at irregular intervals they change their core engine and render all older versions of the software incompatible with new updates.
How can you expect them to fund their research efforts without some sort of recurring income? If they are public, they are also doing the 12 month license thing so they can give some sort of future projections so their stock price doesn't ride a roller coaster. I agree that releasing FUD press releases is sleazy, but the recurring license thing lets them employ good people in stable jobs. Unfortunately, life in commercial software is not as simple as it is for open source software. Sure, you can get paid writing OS software, but some people don't like the idea of living with 5 other roomates and eating cold pizza for breakfast every day. If they are actively updating their virus definitions, then the cost should be worth it.
Now if MSFT made a virus cleaner, you would probably have to wait 3 months for a patch. From what I've seen, the AV companies tend to come out with fixes fairly quickly. Having people available to do that type of work on short notice takes some money.
... and at one time there was.
... corporate rights to lie are not (unless more than an average number of justices have been smoking crack of late).
... i.e. the only way there will ever be a remote chance for the free market to work as intended (and as it is advocated to supposedly work).
It was called "truth in advertising," which has gone completely by the wayside. Corporate speech is not the same as individual speech, and is NOT entitled to the same constitutional protections.
Individuals' rights to lie may be constitutionally protected
I am not normally one to advocate new legislation, but in this particular case it is sorely needed.
We need firm, explicit, unequivocable laws requiring truth in advertising and marketing (and yes, that includes press releases), with real punishments, involving real sums of money (and/or real jail time) for those who violate the law. It is the only way corporate entities like McCaffee will ever be forced to modify that sort of behavior, and the only way consumers will ever have even a remote chance of making an informed purchase
The Future of Human Evolution: Autonomy
Back a decade or so, there was a similar "scare" involving the possibility of putting executable code in the generally-unused comment field of GIF files.
While it was demonstrated to be doable, it never occurred in the wild.
The hitch being that GIFs aren't self-executing files. To be executed, the virus code would need to be extracted and run by whatever program is viewing the GIF. Relying on the chance of some 3rd party app doing just what you need it to do is a lousy way to propagate viruses. So while it was an interesting concept, it never went anywhere because it simply wasn't practical.
~REZ~ #43301. Who'd fake being me anyway?
Someone posted a link on IRC to a JPEG image min_tjej.jpg, That's my_girlfriend.jpg for those who's not familiar with swedish.
w w.gay . om:80'",pik);
It contained the following code, wich was instantly executed by IE 6.
var pik;
var temp;
function test(temp) {
pik = temp * 100
setTimeout("window.location.href='telnet://w
}
for (i=0;i
1000 , how thoughful to not make an endless loop.
A link to the code, edited to only run once.
http://peterj.freeshell.org/code.jpg
I dont know the reason for a webbrowser to execute code in a file that ends with JPG, Maby it's a way of IE to work even if a user has put the wrong file ending.
Still I think IE is the best web-browser and i would use it on all platforms if it was available.
W3C's web-browser Amaya
will not execute code in JPEGS , but then http://www.w3.org/ is one of the few pages that will display correct in that browser.
Be sure to look out for the new halitosis worm!
In case you don't get the allusion, listerine invented a disease called halitosis and claimed that Listerine cured it--very much like what today's anti-virus industry is doing.
Now, they use it as a scientific-sounding term for bad breath
any sort.
However, if you know of bugs in the jpeg decoder (and on Windows it should be built-in to the system, so you only have to find a bug in a single decoder), then you could craft a jpeg such that the decoder chokes on it, overruns some buffer, and get it execute code that way (same method as with any other buffer overflow really). I'm sure Michael meant well, but they say that jpegs are by definition safe is just too naive.
"Researching" is a joke. It's merely a tech support thing of "Hey, you found a new virus. Neat...give it to us and will put it in the definition file." Nevermind CLEANING the virus; the only solution for every virus problem nowadays is deleting the file. Virus cleaning used to be sort of an artform, but now they are too lazy for their own high-paying jobs.
Zodiac Survey
Your assertion is effectively nullfied by the fact that much smaller niche operating systems have had their share of viruses. If a system is fundementally insecure, SOMEONE will start writting virii for it.
It doesn't really matter how widespread the platform is.
A Pirate and a Puritan look the same on a balance sheet.
>>3) Throw your computer out the window!
;-)
;-)
Alternatively, let a moving truck do it for you.
A while back, I read this story (don't remember where -- I think it may have been 'Computer Stupidities' on rinkworks.com or some such place) about a fellow who wanted to network his PC with that of a friend who lived in an apartment directly across the street from his window.
They ran a regular 10Base-T crossover cable from one computer, out the window and across the street, straight into the friend's window and then into their computer. I guess they thought they were high enough up, floor-wise, that vehicle traffic in the street below would not be a problem.
They were soon proved very wrong. The setup worked just fine until, one day, this guy's computer literally flew straight out the window in mid-type (his friend's computer was saved when the network cable snapped). It seems that a good-sized truck, with a nice tall exhaust stack, had passed by and snagged the network cable as neatly as any fighter jet's arresting hook would snag the braking cable on an aircraft carrier.
Is that taking 'mobile computing' just a bit far, or what?
Bruce Lane, KC7GR,
Blue Feather Technologies
Funny thing about that, Linux and other Unix OS's actually had the biggest GIF/JPEG vulnerability to date. It was in all Netscape's prior to 4.77, and it allowed javascript to be embedded in comments of GIF89a/JPEG and executed.
GIF/JPEG comment vulnerability in Netscape
Good thing this wasn't widely deployed around the world, or bought by millions during Christmas time. Having a small marketshare does offer a lot of "protection". Most virii writers are going for a large impact.
-Malakai
A Dragon Lives in my Garage
Reading email recently I had a good laugh. There was a .sig at the bottom that said
"Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system http://www.grisoft.com)."
But there wasn't a message digest, a pgp signature, or anything. What's to stop me from taking that signature and appending it to my email, especially just before I send out an infected file? Or if I were a virus writer, having my virus include this in some of its email payloads?
AVG's message is training people to trust a message (and all attachments) based on a simple text sig. What could be more easily faked?
Seems like a backwards step in security, to me.
Sorry, but I'm tired of hearing this piece of crap "solution".
Anyone who works in an ourward-facing business capacity (read: not most IT people, but most everyone else at the company) generally receives email from people they don't know, and they don't have the luxury of simply trashing it. If you work in customer service, marketing, accounting, sales, you have to check out these emails and see if they are for real. Fine, not the ones that are obviously spam, but the spammers are getting smarter and disguising their spam as legitimate email. Just because the address is unfamiliar doesn't mean that it can be trashed.
Any IT person who thinks they can issue the "Don't open emails from people you don't know" edict and then just crawl back into their cubicle with a smug little CYA attitude is living in a fantasy world. Stop making such an unrealistic demand of your "lusers" (who, BTW generate the business needed to pay your paycheck, process the invoices needed to get you your latest gadgets and do all those things you hate so that you can stay happily employed.)
Instead; treat with them with either a) respect or b) a grade school mentality. In either case, please assume that they are really not sitting at their cubicles trying to think up the best way to make your life hell. Assume that they just want to do their job, and the computer is one of the tools they need to do it. Just as most of them don't know how to program their speed dial or change the copier's toner, they don't know or care about the inner workings of the computer. That's YOUR job. Make it fool proof if needed. Explain as necessary. Give them a reason to trust that you are not simply trying to make THEIR job more difficult. That distrust works both ways; if a "luser" thinks you are just making unrealistic demands that make them unble to do their job, they're going to ignore you and do what they need to do to get their job done, and you're left with cleanup duty when something goes wrong.
And above all, work with them. Understand what their needs are (do they receive unsolicited business mail? does it have attachments that they have to read? so what are they supposed to do?) and then help them understand the consequences that viruses can have and minimize their risk of catching and spreading one. Yeah, sure, that means actually pulling yourself away from Slashdot and Doom tournaments for a while, but that's the way it goes when the company pays you money to do your job.
Now, I won't disagree that it is possible, but then this wouldn't really be a virus, would it? From my understanding, if you imagine each data block as looking like this:
...
10 01 01 01 01 44 44 44 44 88 88 88 88 CC CC CC CC 00
Where that first byte is the length (hex 10, or 16 bytes) and then there are 16 bytes following it, followed by '00' to signal the next header is coming up. The specially-constructed one might look like
10 01 01 01 01 44 44 44 44 88 88 88 88 CC CC CC CC 15 24 5A C8
And those last four bytes overrun the buffer, and are executed as code. Yes I know it's extremely simplified, but this (AFAIK) is the basic premise of the buffer overflow. A proper JPG viewer should crap out at this point, but the MS product starts executing it as code. It sounds more like there is a vulnerability in the MS (surprise surprise) fax and image viewer, and a specially formed JPEG file could exploit that vulnerability. That's a problem with the viewer, not the input file.
Calling the vulnerability-exploiting JPEG a virus will lead to some interesting conclusions. What if, for example, a similar vulnerability existed in a Linux viewer application? I might make my specially-constructed jpeg (named hole.jpg) but leave off the executable code. Then, I'd make a simple program in C (called yes_oncrack) that fills /dev/hda with the character 'y'. Last but not least, I'd pipe the output of `cat hole.jpg yes_oncrack` to the viewing program.
If the jpeg is the virus in your example, then what is the virus in my example: hole.jpg, yes_oncrack, cat, "|", or stdin?
I'm not trying to be a jerk about it because I see where you're coming from, but calling the jpeg a virus is inaccurate since it is merely the exploit for a vulnerability.
I really hate signatures, but go to my website.
I'm not an expert on exactly how and when a file's MIME information gets parsed, but I know enough that I don't totally discounted the possibility of a trojan or virus masquerading as a JPG.
.exe, I'll know something is amiss. And I DO think the major AV vendors are some of the worst FUD mongers out there. But I also think it pays to be cautious, and not shrug off the possibility of a threat entirely just because it is couched in a lot of overblown hype.
For instance, if I take an animated GIF, rename it to image.jpg, and link it on my website, the server (or browser) is still smart enough to know it's really a GIF and display it as intended.
I've seen people use similar tactics on free web hosts which don't allow external image linking. They link the file as "image.txt" (the web hosts do allow external linking of text files), but it shows up as an image just fine.
If tactics like this could be used maliciously, I don't think it'd be a trivial task -- after all, if I click on link.jpg and the browser tells me it wants to fire off an
"They only affect Microsoft Windows. If you aren't running Windows, you are safe. "
This speaks for itself....
IBM used to sell the excellent IBM Antivirus program. They also had a webpage that explained viruses. But IBM was too honest for their own good. Their website had articles about how you can't catch a virus from a jpeg, tips on how to avoid viruses, and a diatribe from Gibson on how virus writers weren't evil geniuses but malcontent dumbnuts.
All in all, the IBM website was very informative, very honest, and killed their antivirus business. Oh well. I guess MacAfee, Norton and all the rest think dentists are stupid for telling their customers to brush their teeth.
A Government Is a Body of People, Usually Notably Ungoverned
...calligraphy? (sic) Its a process of hiding data into pictures, and lots of it.
You'll be really pissed off what the non-assuming 500k browser-cached picture off the Internet quietly hides a MEGA virus that will toast your entire machine, innocently awaken by a harmless worm you mistakenly opened up elsewhere.
As I read the McAfee press release, it didn't give the virus a severity, just an "FYI" stuff like this will be happening down the road (which it will). I guarantee we will see a virus like this eventually, given the massive amount of images on the web.
No, a stenograph could not be used to transmit a virus. Viruses can't be secret. A program designed to view the "correct" data must be unaware of the stenograph or it has failed.
Let's say I have an old-fashioned bitmap image and I use the least significant bit of every byte to encode one bit code or text. My bitmap viewer will display an image that looks almost exactly the image prior to stenography. Then I widely distribute my bitmap, but only people who know where to look (every 8th bit) will be able to extract the hidden message. When certain people read the file using their Secret Decoder Programs they'll know what the message was.
Stenography is a sophisticated form of security by obscurity for data, not a method for transmitting mobile code.
It doesn't make sense to distribute a virus in two parts. A virus doesn't need to be 30K to be really malicious or destructive. And you'd still have to get the decoder in somehow and have the stenographic data already downloaded. A stenographic encoder or decoder for lossy formats like jpeg or mp3 is rather large by itself. The initial virus would have to include a decoder for the stenographic data, which would probably exceed the size of the code it could hide. It just isn't very feasible.
I think I read somewhere that most of the new virus defs are submitted by the "whitehat" virus writers (you know, the ones that write them for educational purposes and the virus is usually one step away from being actually functional). In addition, I'd be shocked & amazed if the AV ppl didn't have some programmers writing new virii. As a preemptive measure (but good for FUD, too).
jred
I'm not a mechanic but I play one in my garage...
It's simpler than that, don't use Outlook. Try Balsa, Pine, Mutt, Mozilla or exim. They all do the job.
I resent your presumption and the way you blame the user. At work I've had several Outlook viruses autoexecute with NO ACTION ON MY PART. Would you call me a stupid user? In fact, you should never call any user stupid because their software screwed them. It's the program's fault that it can be broken not the users. The programer should consider all possible user actions and have well defined error code responses to them, especially when they are going to sell the silly code as a non modifiable binary.
DMCA, Hollings, Palladium. What might have sounded like paranoia is now common sense.
This is NOT a hoax, or FUD. There IS FUD in the A/V industry, but this isn't it. The press release does a bad job of explaining why the JPEG virus is a big deal. However it DOES say (clearly) that this virus is not a danger in itself - it's a proof of concept. Without going into more detail than would be prudent, *please* believe me when I say that there are significant reasons (a) why this PoC virus is significant, and (b) why virus writers will be exploiting concepts from this virus to make Very Bad Malware. Hey , why should it bother me, I run Linux! Well *i* run Linux too, in fact I develop my code on Linux; it will affect us when the world's NSP backbones are choked with worm scans, ARP requests and buffer-overflowing HTTP requests. This IS going to happen. And, whatever Sophos would like you to believe, this is NOT a case of NAI/McAfee whipping up a hype over nothing. I can't say anything more, but I'm going to take the chance of losing my job by not posting anonymously in order to emphasise how much I mean this.
It's sooooooo frustrating knowing things about this and not being able to talk about it...
"None are more hopelessly enslaved than those who falsely believe they are free." -- Goethe
...and much more effective than any certification.
Got time? Spend some of it coding or testing
As a techdesk monkey at like local college, I can say that Klez is a bitch to get rid of.
Actually, www.sarc.com provides a free klez removal tool, which will fix all executables, etc. which were infected by klez.