Slashdot Mirror

← Back to Stories (view on slashdot.org)

Public Exploit For Windows JPEG Bug

Posted by michael on from the here-comes-the-worm dept.

Khoo writes "A sample program hit the Internet on Wednesday, showing by example how malicious coders could compromise Windows computers by using a flaw in the handling of a widespread graphics format by Microsoft's software. Security professionals expect the release of the program to herald a new round of attacks by viruses and Trojan horses incorporating the code to circumvent security on Windows computers that have not been updated. The flaw, in the way Microsoft's software processes JPEG graphics, could allow a program to take control of a victim's computer when the user opens a JPEG file." We mentioned this earlier.

7 of 509 comments (clear)

  1. pr0n by Lord+Prox · · Score: 5, Funny

    Damn. Now in addition to worring about going blind I also have to worry about catching something.

  2. safe sex by gusmao · · Score: 5, Funny

    Does that mean when you watch porn on the Web it is not safe sex anymore? Damn it!!!

  3. Re:Patch is Already Out by Gzip+Christ · · Score: 5, Funny
    This is dumb ownership, if this bug becomes prevalent.
    Phew... I was worried there for a second. It's a good thing we can rely on Windows users to not be dumb, otherwise the Internet would be bogged down in viruses, spyware, and spam.
  4. Re:Knew it by jb.hl.com · · Score: 4, Funny

    It's a gaping security hole.

    --
    By summer it was all gone...now shesmovedon. --
  5. Microsoft patches by Anonymous Coward · · Score: 4, Funny

    You can make a big fucking quilt with all those patches they keep giving out!

  6. Everyone knew it by Pan+T.+Hose · · Score: 4, Funny

    I knew there was something wrong with Goatse when I saw it!

    Everyone knew it was a backdoor.

    --
    Sincerely,
    Pan Tarhei Hosé, PhD.
    "Homo sum et cogito ergo odi profanum vulgus et libido."
  7. Re:Are you patched? by ajs · · Score: 4, Funny

    Not too long until we see a remote shell.

    And therein lies the rub. For the people that write these things, it's reaching the point of diminishing returns in terms of getting the tools installed that they need in order to efficiently, remotely manage these boxes. It was all fun and games when you just wanted 10,000 boxes to send out ping-of-deaths or SYN floods, but now you have to manage a farm of zombies and get real work out of them. The competition is fierce and the other guy is trying just as hard as you are to get large-scale admin working, and of course, like all large-scale Windows installations, they're finding that this sucks.

    Several things would help:

    * A virtual OS layer is needed so that the user can have Windows for their games, but the crackers can do their admin from a maintainable OS. Heck, even DOS would be more managable.

    * Users should make themselves available to the crackers for physical admin needs like reboots.

    * Microsoft needs to stop pushing these auto-updates. It's not as if the crackers can't find new holes faster than MS can push the updates, but the rapid change to an installed base is just too difficult to remotely manage. Bill: you're killing profits here!

    Overall, we just need to start making doing business on the Internet more friendly. I don't understand why people can't understand this!

    PS: ;-)