Slashdot Mirror
Winamp Skin Exploit in the Wild
An anonymous reader writes "Secunia.com has announced an exploit (derived from xml escaping the Internet zone into IE's local zone) that exploits Winamp's habit of automatically installing skins. Currently all versions of Winamp are affected. Details on the Winamp forums - apparently an exploit is already in the wild, and spreading."
to compromise a system..
Luckily the masses of windows users are content to use windows media player which should slow the spread of this.
?SYNTAX ERROR IN LINE 42
I knew that your oh-so-sexy winamp skin would be my downfall.
One of the winamp betas had the option to use the mozilla engine rather than the IE one. Shame they never spent more time on this feature then they could easily tell people they could fix this exploit by turning off the MS Engine.
I propose "flensing."
But please God, dont give us forced Britney Spears !
Seems to me I was just bitching about skinning and mentioned that security holes were one possible (but unlikely) down-side. I love when the universe makes my point for me.
To use XMMS! XMMS is a wonderful media player XMMS is a multimedia player for unix systems. XMMS stands for X MultiMedia System and can play media files such as MP3, MOD's, WAV and others with the use of Input plugins. XMMS is mainly targeted at music playback, but through thirdparty plugins some rudimentary video capabilities exists, but there are much better systems other than XMMS for video support. XMMS will not be vulnerable to this exploit...it is Highly customizeable and it has an extensive plugin system. Winamp is (currently) being run by AOL which as we all know is evil and heartless...after what they did to poor rich justin. poor poor justin.
who unchecks every option in any program I install that begins with "Automatically [check for/download] and install ..."?
I browse Slashdot at +3, Funny
Makes me glad I use iTunes on a Mac. At least Apple doesn't decide *for me* that I NEED an insecure web browser in EVERY APPLICATION on the operating system.
The fact that OS X has not yet had one critical exploit speaks for itself. (And yes, OS 7-8 *did* have quite a few exploits and viruses.)
Javascript + Nintendo DSi = DSiCade
Don't get your skins from anyone but WinAMP.
OR
Don't use skins at all.
-jls
Techno-pagan
Just as long as the exploit isn't used to install SP2 were all safe.
It seems that this is easy to fix for now by simply configuring your firewall to not allow Winamp to access the network.
The Securia.com link in the profile says that only Winamp 3.x and 5.x. But doesn't mention 2.x... the vast majority of Winamp users I know don't use 3.x or 5.x due to the massive feature bloat.
Is 2.x actually susceptible or is the submitter incorrect?
sig.
So what's the fix?
(Beside removing winamp)
"I can not bring myself to believe that if knowledge presents danger, the solution is ignorance" - Isaac Asimov
am i the only person that finds ever changing interfaces an annoyance??
love is just extroverted narcissism
Program skins with "browser tags" and "embedded xml"? sheesh, what next, word processor documents that have executable code inside?
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
With all the malware packed into the current versions, I thought everyone had jumped ship or stopped upgraded at 1.x long ago.
.
Winamp Unlimited has a friendly summary on how the worm infects the user, as well as steps one can take to avoid being infected.
This is also worth noting: "The Nullsoft team have already implemented a patch for this exploit, which will be included in a very-near future release5.04a or 5.05. This next version is already in its third beta stage, and will include several other unrelated changes/fixes."
...Coz I use XMMS for my MP3 and FLAC goodness. Mind you it is supposed to be able to use WinAmp skins...
Watashi wa chikyubutsurigakusha desu.
Since XP Service Pack 2 came out, it's not like any of those Windows machines can connect to the internet anyway....
Windows Media Play works fine.
:)
Seriously, Microsoft Office and Internet Explorer seem to work just fine for me.
Plus, they all work on my Mac
Heres how it works, you vote for who I want and I vote for who you want
Aah, but I'll want some proof you voted for who I wanted. So, be sure to keep your proof receipt from the Diebold machine!
No wait...
I sympathize with your cause, but I don't think my casting a vote for Kodos for you is really going to affect the election all that much, sorry.
I used to be a big fan of Winamp...but then I switched to iTunes and never looked back. Guess that's a good thing.
Editor Emeritus and Senior Writer, TeleRead.org
Just one more reason why I have ceased to used internet explorer for jsut about anything. Firefox all the way!!
It's no hoax. I normally don't go for these things but...Free ipods rock
They haven't added anything good to any new version of WinAmp since 2.81 - I used to run 2.81 on my P133 and it was great. Try running the new versions of winamp on a P133, and all of a sudden your computer isn't fast enough.
If WinAmp doesn't release or realize a worthy fix, they could be dipping their skin in an arcing, amping, electric fryer if the exploits get out of control.
(Hmm, fixes, amping, arcing...)
Previously: "Linux... Toward the Sunrise..." Now: "Linux... Toward the-- No, now, part of Every Sunrise"
I mean, WinAmp can actually look like different kinds of real CD players! Can you believe that? It can look like all sorts of things; it doesn't have to look like a rectangular window at all. That just rocks! You can even change the way it looks at runtime! You can download whole new looks! Man, that is too cool.
Kudos to those guys. This is the kind of thing that really makes computing fun.
Yes you are
Check out www.winampunlimited.com for more details
Just to comment on all the first 11 posts I see here:
..
(1) I've not used WinAmp in many years [like i've not used Windows in many years], but when secunia says the advised course of action is "use another product", i'm guessing that that probably means this feature can not be disabled, or at least not easily? or if it can be, then it's disabling can also be circumvented?
(2) Absolutely right, having a component of the system that is active to ALL programs, wether it wants it or not, is inviting the most bizarre of security holes. Of course, the WinAmp people probably should come up with a better, more secure transport method for getting their skins around, but it's not really their fault that IE is a pile of crap security wise.
(3) what kinda genius would figure out that you could embed an xml file, with instructions to run a specific executeable file, within a zipped skin file, and then manage to trigger a security hole in a web-browser module that really shouldn't have a damn thing to do involved with the program that you're sending this virus through? The people who are BREAKING the security I figure have got to be infinitely more intelligent than the people who are CREATING the security.. or at least a whole hell of a lot more creative..
i really can't imagine that anyone could be thinking, when they write a program like this, "oh, what if someone tries to take advantage of such and such known security flaw in this way through our program, even though they don't have jack and shit to do with each other?"
obviously, you're going to try to cover in advance for security things, but who could predict in attack in such a convoluted fashion?
"Champagne for my real friends - and real pain for my sham friends!" http://ericblade.postalboard.com/
I'm an idiot--I don't get it. Can anybody help?
Is there any way to actually uninstall IE or atleast make it absolutely not the default browser and ban its exicution or engine use by all other programs and perhaps replace that engine with something else? Considering that was part of a big law-suit surly theres a way? Infact i need IE installed for website testing so the second option would be best.. all i can think of is setting the permissions of the engine dll and IE exicutables but replacing it would be nice too..
This comment does not represent the views or opinions of the user.
I've been using the same skin on Winamp 2.8 for years(plug for 'Silence' skin). Maybe that's because its part of my disk image I always wind up going back to.....
- I got my free iPod and a free Nintendo DS....why not
Now that people have started to use firewalls, and the risk of worms and rootkits that infect through open, exploitable, holes grows smaller, it is time to expect more and more exploits to follow alternative vectors.
Note how many buffer-overflow exploits there have been in server daemons. Well, there is no reason to believe that servers are any worse written with regards to input than client applications - quite the contrary actually.
People think they are safe with a firewall. But I'm willing to bet there are undiscovered exploits in just about every application they run. WinZip? WinAMP? Acrobat Reader? Media player? Anything that handles files received over the Internet is potentially a vector for viruses and possibly worms.
This time it was bad escaping, which made the exploit trivial, but there a buffer overflow would have served just as well. Neither firewalls nor anti-virus software will protect you.
Patient: "Doc, it hurts when I do this" Doctor: "Then don't do that"
Yet another unwanted, unnecessary feature involving Internet Explorer embedded into a program that doesn't need it has a remote exploit. To mitigate this problem, disable active anything, automatic anything, and ActiveX anything. That is all.
For what possible purpose does a skin -- which is essentially nothing more than graphical elements -- need to invoke the browser?
WTF? Seriously, help me out here. I've only been a programmer for 25 years, so I may not understand the deeply compelling reasons driving such a design decision.
Schwab
Editor, A1-AAA AmeriCaptions
"We have to let go of a few things here. We have to let go of the notion that for Apple to win, Microsoft has to lose," Jobs told the crowd
But admitted cynical, long-time Mac fans said that the Microsoft investment in Apple has been a good thing for the company.
"And Microsoft products for the Mac can be better than software from other companies that run on the Mac, like Netscape Navigator -- I think Explorer is more stable on the Mac than Navigator,"
Microsoft makes good software for Apple computers, let's give credit where credit is due.
I use a winamp skin in xmms, I hope I'm not susceptible to this attack. Your thoughts?
That's why I use QCD:
http://www.quinnware.com
In Soviet Russia...michael would be rotting in Siberia!
I notice the average vocabularical IQ drops about 50 points once 3pm EST hits.
vocabularical.
I believe you were saying something?
I'm pretty sure the llama is tired of getting its ass whipped.
ANY library that works like the Microsoft HTML control (this is what Microsoft calls all the non-trivial bits of Internet Explorer... the IE application is just a thin wrapper around this) is at risk for exploitation. The only way to be sure that nobody's going to break out of your sandbox is to make sure that the application that creates the sandbox is the application that controls access from the sandbox, and that any helper applications it calls unconditionally implement their own sandboxes.
If you use the *same* application, API, or application binding (eg, the file type bindings used by the desktop and the MS HTML control, or Apple's LaunchServices) for both sandboxed and trusted objects, then you open up the possibility that an untrusted object will look like a trusted object, or that an untrusted object will be passed to a handler that isn't inherently safe.
Apple blew this with launchServices, and they still haven't really fixed the underlying problem. But they've only been in denial a few months, whereas Microsoft has been in denial about this for seven years, so let's look at Microsoft...
Let's suppose the HTML control was split up, so it only did rendering. Whenever it wanted to open a file, open a URL, run a script, load a plug-in, it would ask the parent application "what do I do about a CHM file" or "what do I do about <script language=vbscript>". You'd have an "HTML-only control" and a "Web Access control" and IE would be a very slightly thicker wrapper around both.
So then you register "Word Viewer"[1] with Outlook and IE as the helper application for Word documents, and "Word" with Windows Explorer as the helper application for trusted Word documents. If this was done, then Outlook (which would be a sandboxing application in this model) would open "Word Viewer" for untrusted documents.
Viola, no more email-spread Word macro viruses.
Similarly, Outlook would decline to run VBscript, and IE would decline to run the Windows Update plugin... you'd have a Windows Update program that was a thin shell around the HTML-only control... one that only opened windows update.
Microsoft could have their cake and eat it too, and EVERYONE would have a more secure and less spammy environment.
...is not affected and us sensible users browse with Mozilla/Opera/NotIE as the default so whats the big deal? Who the fuck uses the crappy bloated recourse hog that is 5.x anyway.... ah Internet Explorer users. Bless their cotton socks.... MORE TOOLBARS AND GATOR APPZ AND SKINZ PLEEZE. Makes life worth living watching an Internet Explorer user suffer!
I've noticed that everyone who is for abortion has already been born - Ronald Reagan
[1] I'm assuming that Word Viewer does not implement Word macros. It doesn't seem to, but if I'm wrong about this then (since we're in a hypothetical world) let's assume there's a version that doesn't.
This exploit was discovered about 4 months ago :-/
Yet another reason that skinnable apps are evil.
Since we're on the topic. Does anyone know of a super-small/simple MP3 player that just plays from my system tray?
I want a music player that has no skins, no visiualizations, just a small program that keeps track of a playlist, plays music, and stays out of my way.
~D
This sig has been enciphered with a one-time pad. It could say almost anything.
Cuz you CANT LOOK BACK !!!!
iPodService.exe which Apple gratuitously installed when I tried to upgrade my Quicktime, won't quit.
TaskManger/Select iPodService.exe/End Process and I get a message that says Access denied.
Thanks Steve Jobs !!!!
Thanks for giving me something I didn't ask for.
Thanks for making it so that it doesn't respond to "End Process" commands.
Thanks!
1. You don't know how to create a link using either the slashdot tag or a standard anchor tag.
2. The link you posted redirects to a specific file, so why not just link to that? http://ftp.mozilla.org/pub/mozilla.org/firefox/re
I've just signed legislation that'll outlaw Russia forever. We'll begin bombing in five minutes.
Since the forum basically gives step-by-step instructions of how to recreate the exploit they might want to release the patch sooner or edit the forum post so that happy script-kiddies have to do a little more work then copying and pasting to exploit it... Meanwhile, switch to linux and use XMMS :)
Hey look no pointless curley braces or semicolons... just like Python
:-p
"so I may not understand the deeply compelling reasons driving such a design decision."
*raises hand*
Because since the late 90s EVERY PROGRAM must use the internet in some way. Useful or not. Anyone else notice this trend?
Go here for teh [sic] funny.
"Good ole microsoft has this thing called media player that plays my mp3's..."
"Cant trust those evil 3rd party hacker programs... Thats what they say they wouldnt lie.. See this just proves it.."
Not that Microsoft would be *that* evil to release exploits for 3rd party apps.... but its an idea..
---- Booth was a patriot ----
Still trying to figure out - is it winamp's fault that an XML character escape sequence causes stupid IE to run as in a local zone.
:-)
:-(]
This isn't the first app that gets nailed just because it was using IE (for whatever extent of use - full rendering or peripheral stuff like SSL Certificate handling or XML processing).
Just add this to the IE screwups tally
get a free iPod![This really works! - I have only 3 more referrals to go, my buddy already got his iPod (I should have gotten into this earlier
There is no earthly reason why a skin should be XML, other than to say "we have XML support". Just another misuse of XML.
Add it to the ever expanding list.
Nope. Real is much better behaved that quicktime/Ipod.
Your talking ancient history maybe.
Furthermore, Real has always been a good citizen on Linux. While microsoft and apple refusled to support Linux, Real did support Linux.
Real may have behaved badly at one point on Windows, but Ipod is behaving badly now.
seems that this flaw was reported by the french website security company K-Otik (http://www.k-otik.com) who made this private exploit code goes to "public"
There's a great pic under "Whaling" over at Wikipedia -- sadly, no entry for "flensing".
....
Fav new Firefox extensions: User Agent Switcher
I've never been linked to (well, indirectly) on slashdot before - it's my 30 seconds of fame!
Just to add to the original thread a little, I only saw the worm spreading on IRC and I only saw 2 people who were spamming the link - like all mirc worms the infected person doesn't know they are doing it until someone tells them.
I guess it's not got very far - since I reported the exploit i've not seen another spammed link for it.
I still use winamp 1.90, I highly doubt that it will be affected. Besides what's a skine?!
Screw that... If it's a diebold a slightly creative person could get who everyone voted for and change them right there on the spot.
Integration of Access in a Diebold machine is a much more serious offense than integration of IE in a WinAMP.
LilMikey.com... I'll stop doing it when you sto
While the finger currently points at WinAmp skins, I guess all eye candy with XML etc could potentially be used to do the same thing.
Engineering is the art of compromise.
Not only does evil P2P software break the law, it helps infect your computer! A program called Winamp, used by illegal copyright infringers to play their music files called MP3s, has a security hole allowing evil hackers to enter your system! We need to band together to ban this evil and dangerous Winamp program. Remember, no matter what, it is WRONG to use Winamp to play downloaded MP3s--and now, it is dangerous. Respect copyrights; uninstall Winamp.
I recommend Winamp 2.95 (for all the flavor of Internet TV and Radio without all the bloat).
OldVersion.com (wonderful for pre-bloat Acrobat Reader >=v5.0 et al.) has a great selection of Winamp flavors for all those who want a faster (and more secure) version.
Enjoy.
In related news, our editors today learned of the calc_virus; remote explotation of Windows Calculator utility is possible and attackers can gain access to your machine via this program. The announcment that MS recommends you use an abacus was heralded as a remarkable advance in system security
Need Mercedes parts ?
...pointless skins for media players can go to hell. Foobar 2000 forever!
Cthulhu n'garn N'gah K'thuun pinkybrain!
Another IE exploit.
You know, one of these days, someone's going to have to develop a real anti-virus for Linux. And Unix. And BSD.
And a defragger...
The last time I tried it, WinAmp wouldn't work for me unless I had administrator privileges--so this exploit can do maximal damage. Maybe this will move a rewrite to work reasonably in a multi-user environment up on their priority list? (We can hope...)
Speaking of low IQ, school is still out for the summer in most parts.
The exploit was posted on SecuriTeam: http://www.securiteam.com/exploits/5TP0Q1PDPM.html
- Agilo
Why are you geeks worried? Shouldn't you be using Foobar2000 anyway? It is about 2000 X better than winamp and packed with geek friendly features.
Revolutions are never about freedom or justice. They're about who's going to be top dog. -- Kilgore Trout
nothing that a thin film of miconazole nitrate on the monitor can't fix in 2-3 weeks...
"why you tattoring fan sucked doo belly - i have to go buy something to strike you with... excuse me."
...it's another WINDOWS problem. The OS and any apps for it are "run at your own peril". That includes mozilla stuff. It's because it's designed to run on WINDOWS.
WINDOWS
WINDOWS
WINDOWS
I don't care how leet folks think they are, as long as people run windows stuff, develop for windows, run windows apps, think about windows, they are gonna get hosed, sooner or later.
You would think after 10 years of this stuff that it would be noticed, nope, folks still think just one more patch or one more version higher of their windows apps or OS is gonna magically fix windows.
Charlie Brown
Lucy
Lucy holding football
Charlie Brown on his butt looking lame
Charlie Brown = windows
Lucy = windows apps
Lucy holding football = thinking just this one more time, that this is the time she will hold it correctly, that just this time it will work and be "secure"
Charlie Brown on his butt for the 9,863rd time = windows users, never learn, always going to think if they hold out one more time it will be OK.
It's how it is delivered. The simpilest way involves:
iframe src="http://www.blah.com/winamphackedskin.wsz"
That right there, in any browser, will initiate a download of the winamp skin file. In Opera/Firefox/Mozilla you are given a download confirmation prompt. However, if IE is your default browser then IE will auto download and install the winamp skin without your knowledge.. or at least until your winamp pops up suddenly with a new skin. We can't tell people to "don't download skins" merely because it's far more serious than that. Manual skin changing or not, that iframe trick is going to nail a lot of people.
The best bet would be to ignore winamp completely until a patch can be provided, or have Firefox set as your default browser.
"We're breaking out the ramen noodles. . . "
"Really? Is it someone's birthday?"
Who the hell cares, I use XMMS like a real man. I hope all you microcrap windows users get viruses from your ad based spyware programs.
Slashdot geeks using Windows. Hmph. I would have expected mpg123/mixerctl. Oh well. Whatever works.
Oz
In spite of all the shameless plugs for various assorted flavors of media players, I haven't seen one plug Quinnware yet. More specifically, their Quintessential Player. Sure the default interface might not be as "nice" as Winamp, but if you're using that OS from Redmond, WA, you get a player that also includes CD ripping/mp3 encoding.
Apologies ahead of time for the shameless plug, but I figured it's only fair to list alternatives in addition to the ones already provided!
He who has no
Use Work Offline mode in IE when you aren't using it. This setting will be saved even when you close IE thus keeping IE exploits such as this down. As a side note, it also kills the ads in AIM which is a nice plus. The only downside is when a program does try to access the internet using IE (such as AIM) it prompts you to Stay Offline or Connect. All you have to do is click stay offline and you'll be fine. If anyone knows how to suppress this prompt I would love to hear it.
No other audio player can touch Foobar2000 in terms of quality or flexibility.
Revolutions are never about freedom or justice. They're about who's going to be top dog. -- Kilgore Trout
"Seems to me I was just bitching about skinning [slashdot.org] and mentioned that security holes were one possible (but unlikely) down-side. I love when the universe makes my point for me."
If security holes are proof that skinning's stupid? Then likewise browsing the Internet is stupid. OK, everyone shut 'em down. lets all head home. It's not safe out their.
Do you see the problem here? Winamp embeds the whole Internet Explorer application, not just the HTML rendering control. That's rarely a good idea, since you effectively lose control over your own application - for example, Winamp is "restricted" by the Internet Explorer policies based on zones, instead of disabling active content period
Make a difference - use Windows! (open source clone of Windows NT)
...when the best open-source *nix audio players (mpg321 & ogg123, of course) will get their skinning enabled?
;-)
P.S. By the way, I might suggest that you, the ones still using WinAMP, to start migrating to the more compact (both on the HDD & in RAM), free (as in ``free beer''), almost-equally-featured (expect for the auto-execution of the skinning scripts, emphatically...) and, what really matters, not as baroque, state-of-the-art universal audio players for the win32 & compatibles (and, by using WINE, under the GNU/Linux too), - ``XMPlay'', see http://www.un4seen.com || Alternately, use the open-source, quite reach featured and cross-platform ``Zinf'' (ex-FreeA*p) - http://zinf.org
P.P.S. Or, quite a way better, stop listening to digitized music at all, mha-ha-ha!
I CANNOT help this...
m l?tid=172&tid=1&tid=218
1 9&ncid=519&e=2&u=/ap/20040826/ap_on_re_us/cremator y_lawsuit_8
8 26/bs_nm/leisure_krispykreme_earns_dc_9
All in one day...
1. WinAmp is being skinned alive
2. Cremators settle for $80M suit
3. Krispy Kreme profits fall by 1/2
1. is at (redundantly) http://slashdot.org/articles/04/08/26/1919249.sht
2. http://story.news.yahoo.com/news?tmpl=story&cid=5
and
3. http://news.yahoo.com/news?tmpl=story&u=/nm/20040
Talk about skinning, slashing and burning...
DOH!
David Syes
Previously: "Linux... Toward the Sunrise..." Now: "Linux... Toward the-- No, now, part of Every Sunrise"
I live in a swing state (not one you mentioned). But Kerry should be leading in this state by 40 points, not the 3 he's currently leading by. He's screwed.
You might as well just vote for Michael Badnarik.
If anybody wants to recommend their favorite open-source Windows or Linux DVD player, feel free. But if it's skinnable, I'm not interested!
WinAmp 2.91 works for me under Windows 2000 with User priveleges. I haven't tried WinAmp 5 because I hated WinAmp 3 so much...
My username does not make me Apathetic. It's irony, get it?
Who let's winamp pass through their firewall anyway? That's like hooking up with a homeless woman without a condom.
Sorry Gary, I love you buddy, but when you hooked up with that homeless woman, I realized how suicidal you really were. Oh ya, and you made out with my ex-wife too! LOL! You so crayZEEE!
Security 101: Don't let any process have access to the internet unless you absolutely need it. Having Winamp look up the titles of your ill gotten mp3 files does not sound like a sound security strategy to this sap!
But then again, I was the one that married Janelle!
It's for the subset of slashdot geeks that think having a player that handles 48-bit audio makes a difference. (Nevermind that most of their music is 128kbps mp3s downloaded from kazaa, and they have a cheap commodity soundcard and speakers) To them, FooBar2000 just sounds better, and it's useless to try and debate it.
I looked and looked but there are no skins for my mp3 player. Is it lame or what? Am I just another maroon (thanks Bugs) who happens to be skinless?
:)
Player: cmp3
Where: freshmeat.net
Any help with this skin problem is way too much!
Everything in the Universe sucks: It's the law!
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
My sysadmin commanded all his minions to uninstall WinAmp "immediately"!! He reckons that "Since the software manufacturer has yet to issue a patch, the only workaround at this point is to uninstall the software"
:o)
Get a grip dude. The problem is only applicable if you
* habitually download 100's of winamp skins
* get dodgy software off IRC
* allow automatic switching of skins in your winamp Preferences
This scaremongering is a capitalist ploy hatched by the corporations, RIAA, BSA, and the Illuminati, to force you to use the festering pile of crud called 'Windows Media Player'..
One good thing is that I have discovered the joy of foobar2000 instead
Don't be taken in by this idiot--he has accounts under the names bonch and Overly Critical Guy. He has a history of astroturfing for Microsoft, bashing anything Open Source, using lies and half-truths to get modded up, karma whoring, and the usual trolling (under his bonch account, he got a troll posted to the front page of Slashdot).
All you have to do to check the veracity of this is to look at the posting history of his two old personnae (linked above) and his current one to figure it out.
Please do not mod this jerk up--every time you do the Slashdot S/N ratio goes down while bonch/Overly Critical Guy/rd_syringe just laughs at you.
This has been a public service announcement
if you aren't a moron you are also NOT affected.
-ashot
Predictably, you've already gotten an 'authoritative' no answer. That poster is wrong. There is a way. I use it, and it's great. LitePC makes 98Lite (for DOS based Windows versions 95, 98, 98SE, ME) and XPLite (NT based Windows 2000 and XP.) It's a WONDERFUL thing if you have to use Windows.
Back in the old days, there were no need for security because nobody but you had access to the machine anyways. It's incredible to think of how floppy-viruses propagated compared to the Internet today. But essentially, there were no "hackers" that could take you down via the phone-line. Back in those days, that was considered a joke on the ignorant.
The more convenience and interconnectivity you offer, the more security you need to implement at all those gates and pathways of code.
The reason for so many security holes are twofold:
1) Ignorance conserning security among programmers. Implementing features without making security-layer AT THE FOUNDATION. Adding security after the first designs, always fails horribly. Security and convenience seem always to be at odds with eachother, so security gets lower priority.
2) True and tested methods of programming are not so secure. Using programming-languages / libraries with no checks and balances of possible overruns is Bad. It's like inviting hackers to break your code. If everyone used Java or some compiled language with protection, most exploits would dissipate.
Obvious: Advancing hacking expertise among white/black-hats. Somebody is always eager to learn new ways to break others' efforts. The methods are in many ways the same (stack overflows , mangled input, etc), but with encryption and authentication protocols, there's always new challenges even the methods stays relatively the same.
The next step in security is to build everything with stack-overflow protection. As is done in Open BSD and a few hardened Linux distributions. There is really no reason why overruns shouldn't be prevented as much as possible. Using insecure methodologies, new code will always pose a higher risk.
The simplest answer is:
Security is just not as sexy as Features.
Features are really, really sexy, and people pay money for Features. (She's hot!)
So I believe programmers aren't necessarily more sloppy these days, it's just that the consciousness for security is lacking because Features have enthralled everybody's mind!
--Rick "If it isn't broken, take it apart and find out why."
Having read Winamp's EULA, I believe "circumcision" would be much more appropriate.
Sincerely,
Pan Tarhei Hosé, PhD.
"Homo sum et cogito ergo odi profanum vulgus et libido."
Oh, so that's what "geek friendly" meant? "Gives you an excuse to keep an extra PC on your desk".
No, seriously.
NotePad in XP has major bugs not present in earlier versions, such as when you save a file, the current Word Wrap margins become actual line breaks. The saved file is fine but the open document now has hard CR/LFs in it, so if you save it a second time without closing and reopening the file, the file is corrupted.
"Time is an abstract concept devised by carbon-based lifeforms to monitor their ongoing decay." - Thundercleese
I think that the issue may not totally be Nullsoft's fault as they are just using the IE engine for the browser function in Winamp. Let's point the fingers at who friggin broke the damn browser years ago.
someone astroturfing for microsoft and bashing open source is posting about how media player skins are bad and linking to an open source media player?
no, I keep my music/video PC where it belongs, in my AV rack.
Revolutions are never about freedom or justice. They're about who's going to be top dog. -- Kilgore Trout
I guess I am thinking like 'mod' files for the original Doom series (haven't messed with quake or later...), sure you could instruct it to place the walls in goofy places, and make them look different, but you couldn't give your character the ability to fly, etc. because you weren't writing code to be executed; you were only supplying data that the existing code would reference.
I reserve the right to be stupid about this, but it seems so simple.... so I might be missing something.
McFly777
- - -
"What do people mean when they say the computer went down on them?" -Marilyn Pittman
Nullsoft has updated their website with Winamp 5.05. This build fixes the security exploit that was reported. good times.