Slashdot Mirror
First JPEG Virus Posted To Usenet
Shawn writes "This could possibly be the worst viruses yet! Earlier this month Microsoft announced a problem in their GDI driver that processes the way JPEG images are displayed. Someone has finally posted an exploit to Usenet. Easynews, a premium Usenet provider, found the virus Sunday afternoon. Up-to-date information about how we found it and what it does is located at www.easynews.com/virus.txt. When this picture is viewed it installs remote management software (winvnc and radmin) and will connect to irc."
I want to see what GraphicConverter does with this.
One more reason not to look at that goatse picture!
Congrats, microsoft, for making just about every filetype unsafe.
The worst part is that you don't even need to be using IE. Hopefully mozilla decodes the jpgs itself before rendering them on windows.
autopr0n is like, down and stuff.
It's better to vote for what you want and not get it than to vote for what you don't want and get it.
- E. Debs
Update your systems now! The patch has been out for several weeks. I have already applied it to my corporation via SUS (which is free) and am rolling out the office patch now, as well. There is no reason other than laziness or sysadmin ignorance for this to be another massive virus attack.
This sort of thing ushers in a new era of exploitation in which the warnings of security professionals in the past have been proven dreadfully wrong. Only the bearded terminal hackers are invulnerable to this one, typing away at their command lines being all, "What JPGS?". No longer can we simply give advice on security based on our assumptions as to what is possible and what is not. We must pay the piper and actually consider attack vectors that have formerly not been feasible.
Does this affect Firefox?
It was only a matter of time. Now we wait for a dozen variants to pop up.
"This could possibly be the worst viruses yet!"
Hm...maybe when he started typing there was only one and it spread during the sentence?
I guess those nude pictures of Anna Kournikova could indeed be a virus.
Virus writers should be dragged out in the street and... well, whatever.
The only reason we need security for this crap is because the viruses exist. Which means that we only have security when the need arises. If the vulnerability exists but is never exploited, it tends to sit open and unpatched. As soon as this pops up, we see vendors frantically patching systems.
I usually call it like I see it - which means defending the bad guys when they deserve it. But in this case, there's no doubt that open source has major advantages. The vulnerability has been identified, people are complaining that it's not being fixed... I bet it takes a virus to get MS (and others) moving to fix it.
If you aren't running as an administrator, which you shouldn't be, it can't install itself. It's the same as Linux or any other OS with a basic user system.
Interested in open source engine management for your Subaru?
clamscan possibleVirus.jpg
possibleVirus.jpg: Exploit.JPEG.Comment FOUND
----------- SCAN SUMMARY -----------
Known viruses: 24607
Scanned directories: 0
Scanned files: 1
Infected files: 1
Data scanned: 0.00 MB
I/O buffer size: 131072 bytes
Time: 0.501 sec (0 m 0 s)
also updated nav corp 8 with latest defs (9/27/04) and it found it. AVG free edition doesnt as of yet.
Lawyers, MBA's, RIAA? A jedi fears not these things!
your neighbors open accesspoint, a copy of Airpwn and a suitably infected jpeg. Sounds like a pretty nasty situation in the making to me.
www.linux-skunkworks.com
No Screenshots, please!
Tell the truth and you won't have so much to remember.
No, just a backdoor.
Ok, no offense, but beanie-babies and erotica? There are some newsgroups that just shouldn't exist.
These could be the worst grammar too!!!
If you read through the actual posting, it is apparent that this while may be the first GDI/JPEG-based worm, but it is certainly not going to be the worst. First of all, unless I missed it- this code does not even self-replicate (i.e.- it doesnt mail itself to others, or post itself to usenet, or otherwise exploit vulnerable systems) I would expect to see some script kiddies combine this proof of concept trojan with some social engineering type email worms, and then t**THAT** will be a nasty worm.
yes, if you haven't updated to the latest version.
See this Slashdot thread.
- Leo
You don't use science to show that you're right, you use science to become right.
put the image on doubleclick.net
Real Player and that piece of crap spyware that Dell calls a media player just blithely tried to open the file without performing any integrity checks whatsoever, and damn near crashed the system.
I bet this sort of thing is a helluva lot more endemic than people realize.
apparently, the text indicates, that's the only source for the installed files.
if say, 500 of us were to log into that and stay connected, would we stop the virus? would there be any risk to ourselves? (giving your IP away for a start).
This is my Sig, this is my Gun. One is for Slashdot and one is for Fun.
Our university campus has a huge problem with viruses and this is another exciting addition to our collection. I'm sure I'll start seeing on plenty of guy's asking for help getting this removed, after finding out pornstars aren't virus free after all.
Thankfully, though, this shouldn't cause as much trouble as our current crop of worms. I'm shocked at how dumb our users are, as a whole. We're still having people infected with blaster, over a year after Microsoft patched that vulnerability! Sasser is absolutely rampant. The school even purchased a blanket liscence of Norton, but I would bet less than half of the students have installed it. We have a T3 line providing our outside connection, and it's currently averaging about 7 Mbps combined up/down, because the internal network, which is mostly linked from buidling to building by gigabit fiber, is saturated by virus crap. Although this virus may have a really effective way of spreading, it scares me very little.
Now i can go exploiting people! Thx for the virus easynews! http://easynews.com/virus/virus-jpeg.zip
There's no Freedom like UFP-dom
Come on... admit it you've all been dying for this slashdot posting. You didn't think all this hype about the microsoft GDI thing wasn't going to pay off? Well there you go.... feast on microsofts pain....
Anyone know if this exploit can be done when the user is using a Windows Limited account?
FYI, here's the fix from M$ for this exploit: Security Bulletin
It is very hard to get in right now. I've set FlashFXP to retry 1,000 times every 15 seconds. We'll see how that goes.
The more of us that keep this connection tied up doing innocent things for the next 48 hours, the better.
There really needs to be a distributed DDOS for spammer sites, virus sites, etc. Use The Force for good, I say.
Lose Weight and Feel Great with Isagenix
Why doesn't slashdot allow you to post images! :)
That will help in this case, becuase the malicious code downloads other programs, but what if the code just looks for JPGs on your local drive to modify. Pictures get emailed around so often these days that the virus would still spread at a decent rate.
The code could also contain its own backdoor software, IRC client, etc. Remember with a buffer overflow the code is executing in another program that already has rights to the network, so personal firewalls don't help.
sheep.horse - does not contain information on sheep or horses.
Stop being a tease and saying we can't have pr0n and then using language like "patches the hole." Thank you.
One CPU cycle wasted on digital restrictions management is ONE TOO MANY.
Just out of curiosity, does anyone know if x86 no-execute protection(the NX bit, aka the XD bit, aka Data Execution Protection) prevents against this? With the release of SP2 and DEP support, it would seem that this would be a good test to see if DEP is all its cracked up to be.
What, now you can't even WATCH sex without protection?
In my day, an article like this would have been a downright joke. Seriously, this is such a milestone that I'm filing the article in my permanent news archives.
In retrospect I don't know why we thought such a thing was impossible for so long? After all, buffer overflows or other coding problems can result in malicious code executing. I guess what we didn't expect "back then" was that computers primarily engaged in networking activities would be running vital parsers - HTML, ActiveX, images etc - within the operating system itself, with administrator level privileges.
Wouldn't it make sense to limit the scope of any kind of modular parser/crypto using privilege isolation, so that even if malicious code starts running it is utterly incapable of affecting anything else?
i.e. shouldn't all such modules - crypto, image, parser run within some kind of privilege jails and communicate with the involved application using something like a socket? Hell, couldn't Windows do just that and wrap it up so API users don't notice? What am I missing here? I'm not picking on Windows here, same thing could be done on *NIX.
I just ran the updates on an XP machine. It claimed that there was vulnerable GDI code on the machine and I should go to the office update page. Guess what: the office update page said there were no updates. So, apparanetly the system is vulnerable, but there is no way to fix it. Wonderful!
The real "Libtards" are the Libertarians!
. . . of kiddy porn. The pervs grab the jpeg, load it, and it quietly calls home to the FBI, where a dot matrix printer prints out another warrant for a judge's signature . . .
One CPU cycle wasted on digital restrictions management is ONE TOO MANY.
If there's no name yet, how about the Medusa virus?
So what happens when someone hacks the ad server that cnn or google uses, and puts this jpeg up?
Millions of instant zombies.
Thats f*cking scarry....
TechNet Home Security Microsoft Security Bulletin MS04-028 Buffer Overrun in JPEG Processing (GDI+) Could Allow Code Execution (833987) Issued: September 14, 2004 Updated: September 21, 2004 Version: 1.2 Summary Who should read this document: Customers who use any of the affected operating systems, affected software programs, or affected components. Impact of Vulnerability: Remote Code Execution Maximum Severity Rating: Critical Recommendation: Customers should apply the update immediately. Security Update Replacement: None Caveats: If you have installed any of the affected programs or affected components listed in this bulletin, you should install the required security update for each of the affected programs or affected components. This may require the installation of multiple security updates. See the FAQ section of this bulletin for more information. Tested Software and Security Update Download Locations:
Affected Software:
Microsoft Windows XP and Microsoft Windows XP Service Pack 1 - Download the update (KB833987) Microsoft Windows XP 64-Bit Edition Service Pack 1 - Download the update (KB833987) Microsoft Windows XP 64-Bit Edition Version 2003 - Download the update (KB833987) Microsoft Windows Server(TM) 2003 - Download the update (KB833987) Microsoft Windows Server 2003 64-Bit Edition - Download the update (KB833987) Microsoft Office XP Service Pack 3 - Download the update (KB832332) Microsoft Office XP Service Pack 2 - Download the administrative update (KB832332) Microsoft Office XP Software: Outlook® 2002 Word 2002 Excel 2002 PowerPoint® 2002 FrontPage® 2002 Publisher 2002 Access 2002 Microsoft Office 2003 Software: Outlook® 2003 Word 2003 Excel 2003 PowerPoint® 2003 FrontPage® 2003 Publisher 2003 Access 2003 InfoPath(TM) 2003 OneNote(TM) 2003 Microsoft Project 2002 (all versions) and Microsoft Project 2002 Service Pack 1 (all versions) - Download the update (KB831931) Microsoft Project 2003 (all versions) - Download the update (KB838344) Microsoft Visio 2002 Service Pack 1 (all versions) and Microsoft Visio 2002 Service Pack 2 (all versions) - Download the update (KB831932) Microsoft Visio 2003 (all versions) - Download the update (KB838345) Microsoft Visual Studio .NET 2002 - Download the update (KB830348)
Microsoft Visual Studio .NET 2002 Software:
Visual Basic .NET Standard 2002
Visual C# .NET Standard 2002
Visual C++ .NET Standard 2002
Microsoft Visual Studio .NET 2003 - Download the update (KB830348)
Microsoft Visual Studio .NET 2003 Software:
Visual Basic .NET Standard 2003
Visual C# .NET Standard 2003
Visual C++ .NET Standard 2003
Visual J# .NET Standard 2003
The Microsoft .NET Framework version 1.0 SDK Service Pack 2 - Download the update (KB867461)
Microsoft Picture It!® 2002 (all versions) - Download the update
Microsoft Greetings 2002 - Download the update
Microsoft Picture It! version 7.0 (all versions) - Download the update
Microsoft Digital Image Pro version 7.0 - Download the update
Microsoft Picture It! version 9 (all versions, including Picture It! Library) - Download the update
Microsoft Digital Image Pro version 9 - Download the update
Microsoft Digital Image Suite version 9 - Download the update
Microsoft Producer for Microsoft Office PowerPoint (all versions)
Microsoft Platform SDK Redistributable: GDI+ - Download the update
Office Users Note Office XP Service Pack 2 and Office XP Service Pack 3 are both vulnerable to this issue. However the security update for Office XP Service Pack 2 is only provided as part of the Office XP administrative security update. For more information, see the Security Update Information section. Office
Furthermore, you would not need a firewall if you were not running services that bound to things other than localhost. Since Windows firewall (prior to SP2, not sure whether SP2 has this functionality) doesn't let you pick who gets through to your ports, users should have the choice to shut down all ports exposed to the net. Keeping ports open and firewalled to everybody seems stupidly inefficient.
Does anyone remember those ANSI bombs of old? I remember BBS's had all sorts of elaborate protections against them, zipfile comments etc.
members are seeing something, your seeing an ad
"Quality freefall"? Not really. They've always produced third tier code.
I dunno. NT 3.51 always seemed to be rock-frickin'-solid, but then I didn't use it for long before NT 4 came out.
Of course, Windows 95 was stillborn and they kept pumping the corpse full of formaldehyde for 5 years for they finally let it rot in peace, but the NT branch was really good until they started making every app they wrote effectively part of the core OS.
Remember when NT ran on 4 different processor architectures and Win32 was just one API on top of the kernel in addition to Posix and OS/2? Now that IE and WMP are practically part of the kernel it seems so long ago, and yet, in a sense, it was far more advanced because it was modular enough and clean enough to be ported.
You are in a maze of twisty little passages, all alike.
You'd be breaking several laws in the process. So I wouldn't suggest it ;)
http://www.archive.org/details/ThePowerOfNightmares
That'll fix it...
Oh well, what the hell...
Technically, this is a Trojan Horse, not a virus.
Sorry to be nitpicky here, but this is a trojan horse, not a virus. A virus propagates through replication.
LS
There is a fine line between being a cultivated citizen and being someone else's crop. - A. J. Patrick Liszkie
That /.ers can reference generic sounding apps like GraphicConverter and Preview without mention of the operating system?
Apple really has come a long way around here, eh?
It's all pretty simple there. To install something you have to put in the admin password. Unix made easy.
The way Apple does it (by app) is FAR more intelligent than having to make a user an admin or log out of the system entirely to log in as an admin.
I have a few applications here at the school that demand admin privs. I've all but given up trying to restrict them. But as anyone who has seen the proliferation of unwanted toolbars can attest - the cost is high.
"...Well, there's egg and bacon; egg sausage and bacon; egg and spam; egg bacon and spam; egg bacon sausage and spam..."
Interesting that this virus, which has been in the wings and known of by select groups for years now, should at this time be given lots of promotion, (a few virus releases and big, loud press attention like a freekin' summer movie advertising run), right when the most important US election in the history of mankind is gearing up.
Having people scared out of the public places so that they can't discuss the events which are about to unfold. . ?
And some dorks still laugh at me and say I'm a paranoid conspiracy nut.
--Goodness! Well, if conspiracies don't exist, why are there laws like, 'Conspiracy to commit _____' on the books? And who but the lying psychos in government are better suited to pulling such stunts? Only a nut would actually lower his/her guard over the next couple of months!
Count on this: If any 'terrorism' happens in the next 5 weeks, you can be sure it will have been be aided and abetted by the US and/or Israeli secret services.
Not that you'll be able to talk about it on-line, what with all the scary viruses and all!
Buckle up, kids. This stretch of road is about to get bumpy.
-FL
Bleeping Computer has a tutorial on how to use GDI Scan, offered by ISC, to find apps with the vulnerable gdiplus.dll. The tutorial can be found here:
GDI Scan Tutorial and how to fix the GDI+ JPEG Vulnerability
Either update those apps so they dont have the problem anymore, or do not use the app.
...at isc.sans.org (internet storm center). Do
not use the one from microsoft. It *sucks*.
Watch dshield (like a hawk). Read www.cert.org.
read "comp.risks" (usenet).
and still lose too much time..
We didn't have Clippy the paperclip in 1994...those were dark times indeed. Praise be to Microsoft, for delivering anthropomorphized office supplies unto the wretched masses!
The workaround is to not use any programs which require graphics. Please switch to using the command prompt for all applications until a patch has been made. Edlin is the recommended editor for security minded users. Now Microsoft just needs to post documentation on how to edit microsoft word format docs via binary editing in edlin and we'll be back to normal!
MSN reencodes all images to PNG
That brings to mind the question of if the reader on the server is using a standard library that might have buffer exploits, so that you could alter the server to start feeding out PNG's with viruses (assuming a similar attack could be found in the PNG reader in windows, not sure if that's true or not).
"There is more worth loving than we have strength to love." - Brian Jay Stanley
you're a goddamn idiot. a suitably constructed jpeg will cause an overflow in the gdi+ library which ie and most msft programs use to render jpegs, when that happens the jpeg can be made such that the overflow will cause virus code to be loaded. god you're an idiot.
.EXE file, except for the fact that the code is hiding inside what is supposed to be data, not code, and it gains control of the CPU by smashing the stack.
.TXT file to execute arbitrary code. Who knows?
Jesus, an obvious end user asks a perfectly legitimate question and you call him an idiot for being surprised by the notion of a hostile JPEG- something that should rightfully amaze everybody. I doubt he understood your high level description. To the grandparent: here is a meandering crappy description of how a buffer overflow attack works:
A function call, in C, pushes the current program counter on the stack. Then it pushes the arguments onto the stack, and control jumps to the function which pops the arguments off the stack and does whatever with them. At the end it invokes a RET instruction that pops the program counter back off the stack and control jumps to the address there (to the point right after the CALL). These are just normal C calling conventions.
Variables defined in the function are stored on the stack. If a string like a URL (for example) needs to be defined, a buffer is allocated for it there. When the function returns, the space is automatically deallocated, the RET pops the program counter off the stack, and the function call returns. By default no bounds checking is done on data stored in these buffers. Some library functions, like gets(), don't do bounds checking. They can't, since they don't know the buffer size and would need to have it provided as an argument. Newer, safer versions exist that do take buffer size arguments, but that means these aren't the same library functions anymore. (FWIW the gets() call takes a pointer to a buffer of unknown size as an argument, reads a newlined string from stdin into the buffer, and returns the buffer pointer that was passed to it.)
It's up to the programmer to do bounds checking if he uses library calls vulnerable in this way. But this is extra work, and people are lazy. It's easier to just allocate a big, big buffer that's probably larger than you'll ever need, that "no reasonable URL" will ever exceed. So the programmer allocates a fixed 10K buffer on the stack and passes its address to a library function like gets().
The attacker gains control in these situations by creating a program input like a long, carefully crafted URL, slightly longer than 10K, that overflows the buffer inside the library function. The goal is to overwrite the return address on the stack with an address that's within the buffer. In the case of the Code Red worm, someone meticulously put together a URL that attacked an obscure ISAPI routine, and not only overwrote the return address, but also had machine code instructions waiting at the replacement address within the buffer- encoded right into the damn URL! (The buffer has been deallocated at this point, but hasn't been zeroed, so it's still there.)
It's harder to explain with a JPEG than with a URL. But a JPEG contains variable length data structures that are read into buffers on the stack. Someone writing the JPEG decoder forgot to do a bounds check- and so a mundane function for decoding JPEGs never returns. Instead it jumps into an endless loop that's been placed within the image buffer by the attacker.
So yes it is a bit like running an
Older versions of Notepad gagged on files larger than 64K, which seems suspicious. It's theoretically possible that a vulnerability could exist even in a text editor like Notepad allowing a carefully constructed
From www.ijg.org. This library is very popular.
And if yes, are all application linking this library subject to the vulnerability?
If yes this will be a lot of work to update all applications.
In cyberspace nobody knows you're a cat!
So you see what happened. The unchecked library call in this case was memcpy(). The decoder trusts its input and sends a small signed integer (-2) off to memcpy() without checking the sign bit- and memcpy() thinks -2 is a huge unsigned integer (4294967294). What's the difference? Any reasonable number is going to be positive anyway, right? Who would give a comment a negative length!
I saw someone make this kind of goof even in Java, where you have signed-only types forced on you. Someone forgot that InputStream.read() returns an unsigned byte as an int (between 0-255), and they cast it to a signed byte and back without the &0xFF to zero out the 24 high bits. That got caught right before our product release. The consequence in that case would have been a hash algorithm with inconsistent output between stream and byte array inputs- not a security nightmare like this, but a long lasting migraine nevertheless.
The GDI Scan tool from ISC reveals that after all of the latest patches for Windows and Office, I am still left with vunerable .dll files within office.
.dll dated May 2004.
x s.dlll ll ln dows.GdiPlus_65 95b64144ccf1df_1.0.0.0_x-ww_8d353f13\GdiPlus.dll
Version: 5.1.3097.0 -- Possibly vulnerable (Windows Side-By-Side DLL)P lus_65 95b64144ccf1df_1.0.10.0_x-ww_712befd8\GdiPlus.dll P lus_65 95b64144ccf1df_1.0.2600.1360_x-ww_24a2ed47\GdiPlus .dll
Further... the version of the GDI redistributable on the MSDN site still includes a vunerable version of the GDI
On this fully patched Windows XP system GDI Scan reveals the following information:
Scanning Drive C:...
C:\Program Files\Common Files\Microsoft Shared\Office10\MSO.DLL
Version: 10.0.3501.0 -- Possibly vulnerable (Under OfficeXP only)
C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL
Version: 11.0.6360.0
C:\Program Files\Common Files\Microsoft Shared\VGX\vgx.dll
Version: 6.0.2800.1106 -- Possibly vulnerable (Win2K SP2 and SP3 w/IE6 SP1 only)
C:\Program Files\Microsoft Office\OFFICE11\GDIPLUS.DLL
Version: 6.0.3264.0
C:\Program Files\Microsoft Works\GDIPLUS.DLL
Version: 5.1.3102.1360
C:\WINDOWS\$NtUninstallKB833998$\s
Version: 5.1.2600.1106 -- Possibly vulnerable (Backup for uninstall purposes)
C:\WINDOWS\$NtUninstallKB839645$\sxs.d
Version: 5.1.2600.1336 -- Possibly vulnerable (Backup for uninstall purposes)
C:\WINDOWS\system32\dllcache\sxs.dll
Version: 5.1.2600.1515
C:\WINDOWS\system32\dllcache\vgx.d
Version: 6.0.2800.1106 -- Possibly vulnerable (Win2K SP2 and SP3 w/IE6 SP1 only)
C:\WINDOWS\system32\sxs.dll
Version: 5.1.2600.1515
C:\WINDOWS\WinSxS\x86_Microsoft.Wi
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Gdi
Version: 5.1.3101.0 -- Possibly vulnerable (Windows Side-By-Side DLL)
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Gdi
Version: 5.1.3102.1360
Scan Complete.
What you can do now to limit the spread:
* Update all of your virus checkers and make sure that they are fully active (auto, not just on-demand).
* Disable images in your email applications, just use text only.
* Switch your primary browser to Firefox or another browser whose latest version is immune from this specific attack. If you have to still use IE, then do so only for sites you truly trust.
* Eye of Gnome seemed to work okay, but I got all sorts of weird redraw problems when I tried to resize the window.
* Gimp (2.1) says the JPEG is unsupported and couldn't be imported by the filter, then segfaults.
* Konqueror seems to work okay, but just shows a tall black rectangle, and its spinner is still chugging away, as if it's still busy loading something.
* Firefox 0.9.3 has no troubles at all; it just shows a nice white rectangle on a white background
These programs are not vulnerable to the the exploit in the same way that Windows machines are vulnerable. In fact, the issues you saw appear to be in no way related to the intended result of the virus. GIMP's segfault seems to be the most serious of these, and it is still a minor problem. I believe all of your results can be achieved by opening a mangled/corrupted
Nutshell: One cannot conclude that graphics-related processes/apps on Linux machines are vulnerable to this virus.
PS Conclusions posited based on "unprofessional research and wild conjectures" are likely to cause much more harm than good. Is this really necessary? (not a flame - just an observation)
I want to drag this out as long as possible. Bring me my protractor.
Be quick.
Sample squid code:
Or, more reasonable:
and stick 209.171.43.27 into that file (and all following IPs that will use that code).
Then use ClamAV to scan your squid-cache the next couple of days and remove infected files.
There's been some discussion of the problems facing "fleet operators" due to this bug. It seems that various product teams have spewed so many private versions of the .DLLs all over users' systems that the people who maintain the security-patch list in XML just gave up. SMS won't detect the need for the patch, and neither will MBSA, I'm told. Whether SUS (standalone, not the Feature Pack for SMS) will is not yet clear.
Well, that's just dandy. I've got 200 machines that need patching and no centralized tools, maybe. Oh, joy.
Now I'm wondering how I'll ever trust those tools again.