Slashdot Mirror
Windows Vista Tool Targeted By Virus Writers
An anonymous reader writes "Five proof-of-concept viruses that target Monad, the next version of Vista's command prompt, have been published on the web. Monad is a command line interface and scripting language that is similar to Unix shells such as bash, but is based on object-oriented programming and the .Net framework. The viruses' only action is to infect other shell scripts on the host's operating system. They would cause little harm in the wild, but would be relatively easy to modify using the information from the article, said Mikko Hyppönen, the director of antivirus research at F-Secure."
But seriously, this article is very light on the details. I assume that these virus writers found a way to gain administrative rights using Monad, but the article makes it sound like these are just malicious scripts. It might as well be a advanced batch script that can spread it self then del
Microsoft Windows is insecure! More details later, movie at 10.
The fact that MSH is used as the execution vehicle is really a side-note, as it does not exploit any vulnerabilities in Monad. The guidance on shell script viruses is the same as the guidance on all viruses and malware: protect yourself against the point of entry, and limit the amount of damage that the malicious code can do.
That's not to belittle the dangers of script viruses, though.
I wrote a blog entry about it here, in relation to Monad.
It all goes downhill from first post
Behind attacking Microsoft?
For MS.
But seriously, this is like tipping over someone in a wheelchair. It's a BETA of WINDOWS. Hopefully MS will learn from this before the release, though. I'm not up for a whole new vector of threats against my windows boxen.
Jerry
http://www.cyvin.org/
I would think that people would quite going after all Windows. After all, there is not that much sport shooting ducks in a barrel. And it will be at least another decade before these ducks learn to fly.
I prefer the "u" in honour as it seems to be missing these days.
Something which requires you to execute a script on the computer is not a virus. Think if you execute a bash script in Linux and it goes on and put itself in all your bash scripts, would you call it a virus?
This is actually nothing, it simply prepends/appends or put itself in the middle of existing MSH scripts. It is equivalent to, if you run a binary on your machine, it can attach itself to all the binaries on your machine.
On top of that, MSH by default on let digitally signed scripts to execute hence once infected scripts on execute. This is not really a threat at all.
I'm sort of surprised that it didn't happen earlier.
What would really be a surprise, pleasant one at that, is to see a F/OSS program actually plug the holes in Vista before it can sink?
Support NYCountryLawyer RIAA vs People
Monad can be used to write scripts that do stuff!
How is this different than writing a ksh or bash script virus? Ksh and bash script viruses can be just as bad. Heck, remember the Morris worm?
./er, but this might not be their bad just yet.
I like bashing M$ just as much as the next
The bitter lessons of a veteran coder: http://bitterprogrammer.blogspot.com
Why? Do you prefer the release versions of Windows to be vulnerable instead? ;>
Monad's not going into Vista/Longhorn, hadn't you heard?
I can mail you a Slackware boot disk. It will cure all of Vista's problems, before it is even released. :)
;)
That said, a lot more people would plug Windows holes (if for no other reason than to rid the world of zombies)... if MS would just free the source. But that would probably make poorly-written Perl code look good.
never mind the virus-
windows now has a decent shell?!
will wonders never cease?
K.
Comment removed based on user account deletion
Give M$ some time to work its magic, then there will be plenty of holes and viruses for all!
http://www.macworld.com/news/2005/08/04/vistavirus es/index.php
OMG a shell! it like does things! and without a mouse!!
Wow! Now I get a choice?
The first rule of USENET is you do not talk about USENET.
I'm certain this comment will pit Slashdoter against Slashdoter, but with all the so called "free speech" that is actively being censored one subject at a time today, why is it that these people aren't under the sociopolitical microscope for publishing this kind of information?
Furthermore and looking at the situation from a different angle, not long ago I heard (or read, I can't remember which) someone in the government refer to the writing of malicious code and hacking of computer systems (especially crucial and/or sensitive ones) was to be considered an "act of terrorism." Now tell me, if I or anyone else can be arrested for training people how to commit "acts of terrorism" in the real world, why hasn't this applied to the digital world as yet?
Oh, and just for completeness, vulnerabilities have been found in Firefox since 1.0, so the argument that only Microsoft releases "beta" (read: vulnerable/insecure) code as production-level software doesn't work either.
All this proves is that Monad can find and modify text files (and that there are idiots out there who will misuse tools).
About the only way around this is code-signing to prevent modification (yeah, like I'm gonna sign every single perl script I ever wrote.....)
It's not like you can't do this in bash, awk, sed, perl, python, REXX etc. etc.
I must be getting old when i see the full circles everywhere.
when windows 95 came out the windows zealots where so quick to point out "no more haveing to type in dos windows is better than everything" now they will say "we have a shell windows is better than everything"
Plus, Hakko Mipponen (or whatever his name is) has to make a living scaring the bejezus out of everyone - what better way to get started than with something that's not even really out of alpha?
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
Actually, code signing does partially solve this problem, so that's one of the avenues we've taken. See my post about it (although I feel like a whore for posting it again.)
That said, once you have a code signing infrastructure to save you from untrusted script publishers, your signing keys become the attack point. Malicious code can create another malicious script, and then sign it with your keys. To prevent that threat, always password protect your signing keys. When you do so, Windows brings up a dialog asking for your permission before it signs the file in question.
It all goes downhill from first post
Quoth the wise man in his treatise Monadology (1714):
"There is also no way of explaining how a monad can be altered or changed in its inner being by any other created thing, since there is no possibility of transposition within it, nor can we conceive of any internal movement which can be produced, directed, increased or diminished within it, such as can take place in the case of compounds where a change can occur among the parts. The monads have no windows through which anything may come in or go out. The Attributes cannot detach themselves or go forth from the substances, as could sensible species of the Schoolmen. In the same way neither substance nor attribute can enter from without into a monad."
And they they've managed to attack them??? Oh, the humanity...
The power of accurate observation is commonly called cynicism by those who have not got it. -- G.B. Shaw
Awwww, crap guys. Let it go already. It's a bit like kicking a crippled at this point.
Well I guess they've really got Microsoft by the monads now, eh?
;)
Highest form of wit!
All it does is find every .msh file and replace its contents with itself. That's it. You could do it with a .CMD file in any version of Windows (and of course in any other scripting language).
The other scripts get a bit more complicated (insert at a random spot in the file, etc) but that's basically it. There's no new vulnerability exposed by Monad.
- adam
- adam
Am I suppose to believe you're him?
But very few of the most widespread viruses in the world rely on vulnerabilities.
Right, and assuming you are Hypponen, how does this affect you (or not)? I was making a comment about Slashdot, not you.
OTOH, assuming you are who you say you are, let me just say that I'm hardly the first person in the world to point out that companies like F-Secure tend to be on the unfortunate side of hysteria when it comes to reporting vulnerabilities. So don't be offended by that, we understand how the business works. It's OK.
Cheers.
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
That's the same issue with email attachment virii... the OS is actually capable of RunningStuff(tm). I mean, sure have the prompt/warning (for a while, didn't norton do this with every script that used the filesystemobject, then they used the ado text object, next it will be something else.. I mean as long as an OS is usable, and the user is a privileged user, it is vulnerable from the user.
I'm glad that low privilege users will be a focus in the new version, but the ability was there since nt3.x iirc, and nobody really focused on it, and 3rd party software was so badly written, you couldn't do much with it a lot of times. Another issue, is you can't change many UI settings as an unprivileged user in windows, this pisses people off... fix that, get developers to write their software for proper use, and a lot of these issues will fade.
Michael J. Ryan - tracker1.info
It should be "Windows XP/2003/Vista Tool Targeted By Virus Writers". It won't just be for Vista. The tool is also still in early beta, and I'm not even sure what the script did; is it a script like "rm *", or does it exploit any actual vulnerabilities? There's too little info here to know if this is anything to call news or not...
Monad will also not be included with Windows Vista RTM.
Beware: In C++, your friends can see your privates!
First off -- credit where it's due, it took a few days for these to show up. Unlike the mere hours it took before.
Big pat on the back to all you Windows coders out there in Redmond!
Second and most important, these are only shell scripts meant to be executed in Monad -- not some nasty Outlook/IE infecting VB script that spreads like super-flu.
No... those wont babies wont be hatching till NEXT week.
I'd say this is a marked improvement in Windows Security overall. Bill must be proud right about now.
"Only problem is, Monad is not included in the Windows Vista beta code."
It will probably not be included in the final Windows Vista code either.
It'll be a separate, downloadable tool for all MS OS'es since Windows XP.
I'm still looking for the connection to Windows Vista here...
Beware: In C++, your friends can see your privates!
I do actually. I get opportunities to say "well what do you expect if you use Windows?" to people that way.
Of course, to be fair to MS, in this case the article is BS.
Combine the power and flexability of Unix-style scripting with the robust security of a Microsoft environment. As long as the millions of less savvy users are all operating within least-privalege account model this should be great.
Monad is now a "Windows Vista Tool." And just 2.5 months ago, Slashdot indicated Monad wouldn't be in Windows Vista (then codenamed Longhorn).
So when Monad is considered a feature, it won't be in WV, but when it is a problem, it's magically back in there.
The truth is, no one knows for sure if Monad will be in, and this "virus" is just a fucking shell script.
Everyone, type rmdir c:\ and pass it along.
Ironically, the word ironically is often used incorrectly.
As much as i despise microsoft and avoid using windows at whatever cost. They have not released Vista to end users yet. The purpose of a beta is to find out what the problems and issues are and resolve them. Wait until they release a final before criticising I am sure there will be plenty of viruses and bugs to get excited about then! (How else are they going to continue shipping their AV software ?)
Electronic Music Made Using Linux http://soundcloud.com/polyp
But I'm sure that's just a coincidence.
You must think in Russian.
Monadology seems to be a protoscience towards the understanding of the fundamental building blocks of the universe. Today we call things Quantum back then it was essences. Notice how consciousness is described as an attribute of matter instead of an emergent artifact which in a real sense does not physically exist within our Universe, it only logically exists like calling a collection of cells a "glider" in Conways Game of Life.
My 2 cents anyway.
Here's the very Squashed version with the important text reproduced here:
All the plenum of the universe is entirely filled with tiny Monads, which cannot fail, have no constituent parts and have no windows through which anything could come in or go out. Every Monad is different and is continuously changing. All simple substances or Monads might be called Entelechies, for they have in them a certain perfection and a certain self-sufficiency. As they have some perception and desire, they may be called souls, but animal Souls are accompnied by memory. In dreamless sleep our soul is like a Monad. The knowledge of necessary and eternal truths distinguishes us from the animals and gives us Reason. Truths of reasoning are necessary and their opposite is impossible: truths of fact are contingent and their opposite is possible. When a truth is necessary, its reason can be found by analysis, resolving it into more simple ideas and truths. The final reason of things must be in a necessary substance, which we call God. God holds an infinity of ideas, and chooses the most perfect ones. Each simple substance has relations which express all the others, and, consequently, that it is a perpetual living mirror of the universe; though it represents more distinctly the body of which it is the entelechy. Each portion of matter is like a pond full of fishes, where each drop of its liquid parts is also another pond. Thus there is nothing fallow, nothing sterile, nothing dead in the universe. All the parts of every living body are full of other living beings, each with its dominant entelechy or soul. Thus there never is absolute birth nor complete death. Minds are images of the Deity, capable of knowing the system of the universe, each being like a small divinity in its own sphere. Whence the totality of all spirits must compose the City of God, where no good action would be unrewarded and no bad one unpunished. If we could understand the order of the universe, we should find that it exceeds the desires of the wisest men.
Shh.
The real issue is that Microsoft - with Windows - made it too easy to run just about anything without the user knowing just what it is that they are running. They even had an option - set by default - to hide the file extension from the user - which was also honoured by outlook.
How/if this will change in the latest round of "new user inerface - give us your money" from Microsoft we will just have to wait and see.
(Does longcock/vista still have that side panel that eats 20% of your desktop ?)
2) assume you already have command line access
a "virus" at this point is trivial... just append the code to append itself at the end of every file it assumes is a script for this command line.
this is like batch file viruses that format the drive... it isn't anything special, it's just a matter of getting the mark to run the file. nothing to see here.
The real issue is that I do not want a case-sensitive file system, or one that requires me to do all sorts of command line incantations to run a script. It's not my fault that Joe User and his 1,000,000 friends are stupid.
In any case, I can send you a tarball with the execute bit turned on and ask you to unpack it and run the REAL COOL ANNA KOURNIKOVA SCREENSAVER!!!, and chances are you'll do it. Chances are when Linux hits the "big time" there will be something slightly more functional than FileRoller out there. Chances are you'll give me your root password if I ask for it nicely. Chances are your assumptions or superiority are unfounded. People got infected with worms that came in on password protected zip files. Do you think you can engineer away user stupidity? That's scary.
to hide the file extension from the user
Bad design call, yes. OTOH, I could care less, I always turn it off.
Does longcock
OMFG, you're hilarious.
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
Thing is, msh is not registered as handler for *.msh files, so in order to run the script you will have to execute 'msh.exe script.msh' from the command-line, it will not work by clicking an icon in Outlook Express for example.
fair enough.. I don't consider it a big issue in and of itself.. it's a scripting language, it's usable.. that's the point of it.
Michael J. Ryan - tracker1.info
If Microsoft made Windows completly immune to viruses, spyware, and the like, they would be immediatly sued by every dying for-profit anti-virus company, just like Netscape did.
CRIPPLE FIGHT!
I'm going to go create my own technology news site, with blackjack and hookers. You know what? Forget the news site.
The more sophisticated you make a system, the more failure modes you introduce -- and the harder it gets to test the edge cases, because there end up being too many edges. You want Obejct Oriented? I'll give you an Object Oriented example. Let's have a "length" type with properties which correspond to its conversion into different measuring units.It may well be pretty, but outside of any programme dealing with units conversion it's fairly unnecessary. And it contains many programming hazards which would thwart the careless implementor. {BTW, that was a fictitious example; but I'm willing to bet there is at least one programming language out there that actually implements something like it.}
All a command shell really has to do is be able to launch programmes, police the I/O traffic and keep hold of some state information. If it can do all that right, any other functionality you need can be provided by external programmes. That way, everything is kept as simple as it needs to be; you haven't got code cluttering up things that don't need it. If you do build functionality into the shell, there should be a bloody good reason -- usually that reason is that some external programme is getting launched more than its fair share. And in that case you already have the code you need to incorporate and it's been thoroughly tested.
Je fume. Tu fumes. Nous fûmes!
Slashdot has a history of reporting user-executed attachments as "vulnerabilities"
Wrong ! That's actually Windows executed attachments which are vulnerabilities.
Users don't want to execute anything when they click on something that Windows tells them is a picture, for example.
So Windows fool the user, and worse, Windows do things that the user never wanted.
to the never ending delight of the peanut gallery, who consider that it's Microsoft's fault if I run something I shouldn't have on my computer, but if I do the same thing on any other OS, it's my fault.
Like I said before, what you say is completely out of place. What you describe just does not happen in other OS, that's why. In case you did not understand, I'll take the example of Linux mail clients :
- No one of them tell you an attachment is a picture when it is an executable, even if it is called boobs.jpg.
- No one of them will execute the attachment when you just click on it.
Plus, Hakko Mipponen (or whatever his name is) has to make a living scaring the bejezus out of everyone - what better way to get started than with something that's not even really out of alpha?
I thought it was a beta ?!!!
But it's good to know that now, you can experience what Linux users feel when MS do the same stupid FUD that this writer does.
Hasn't Monad been dropped from the Vista/Longhorn Feature list?? I thought that it as just going to have the same/similar CLI as Windows XP? and Monad was going to be an 'upgrade' some time in the future?
.
As time goes on, they keep reinventing bits and pieces of Unix.
A firewall can not protect you from yourself. Turn off what you do not need. Do not use the firewall to do your work.
Apparently they haven't been around things like BASH enough because it's not very hard to write a similar "virus" in BASH script
1. It's like a batch file and therefore doesn't count as a virus.
...but viruses started out as batch files and wiped a lot of harddrives.
...but Windows has a long history of MSTD (Microsoft Terminal Disease) wherein everything is accessible all the time because they built an OS (nay, an NOS) on the principle of "everything is accessible unless explicitly stated otherwise." No other NOS has done this -- no serious one that's broadly used -- so Windows viruses, no matter what they are, have been very egregious.
2. Microsoft can't be held responsible because shell scripts can be written and ran in *nix/*nux too, so what's the big?
The issue, to me, is whether or not Microsoft has finally figured out to really seperate the kernel (if they've ever really developed one) from what the user has access to. The reason viruses, malware, whatever, have never really bothered *nix/*nux/Netware is because of the basic principle of denying everything unless explicitly stated otherwise.
Our old Netware guys here still joke and laugh about the insanity that is Windows and security issues around it that a symbiont industry thrives on. Never did, or have, other NOSes generated such a special security area in the free market....
"All great things are simple & expressed in a single word: freedom, justice, honor, duty, mercy, hope." --Churchill
Bugs and security holes in a beta? No! It's impossible. Not that Microsoft gets the benefit of the doubt anymore, but let's at least wait until the product is out of the beta testing phase before we begin harping on it for bugs and security flaws. Unless, of course, the flaws exist because of fundamental problems with the design of the product (a la Internet Explorer). Then by all means, pile on!
Here was my first thought (it's obvious i didn't get much sleep last night)
Monad kinda sounds like it's a daemon related to a female...something that most geeks probably don't know much about....I bet this is a hoax...
Maybe it's time for sleep again.
AccountKiller
OSS developers combine Northern charm with Southern efficiency.
He found a hole in a peice of BETA software...
last I checked the entire point of BETA sofware was to find holes in it.
ZOMGWTFBBQ he did exactly that! Whooptie fucking do!
you have earned yourself a cookie! go report it to whatever bug tracking sceme they're using and feel proud. or, do something tantamount to screaming "LOOKIT ME! I'M EVER SO SMART!" into a bullhorn while dancing naked with undies on your head in the middle of times square...
...I got nothing.
From a Dec. 2004 "chat": Q: How is security addressed in Monad? A: This is a very board topic. We spend a lot of time on security. One of the common questions is "are we reintroducing script attacks?". We are doing a number of things to mitigate those exposures. 1) we will not have a doc handler for .msh files (this means that you won't be able to double-click a .msh file and have it run). 2) We'll have a policy that only allows signed scripts (from people you trust) to run (we'll then make it easy for you to sign scripts).
Mikko, how do you explain the quote you gave: "The only surprise here is that it came so early...It's been eight days since the beta of the operating system was out." Monad has been out for a while, and is not even in the Windows Vista beta. Yet you are obviously implying that someone took the Vista beta and started pounding away and in only eight days found a vulnerability.
I don't see how you can defend this as anything except pure sensationalism.
- adam
Why do I get the feeling that this is the Monad equivalent of
$ echo "#!/bin/rm -rf" > ls
and probably not nearly as dangerous as the article makes it sound.
Why not fork?
similar to Unix shells such as bash, but is based on object-oriented programming and the .Net framework.
.Net framework was supposed to prevent malicious code by sandboxing things.
I thought that the
Coder's Stone: The programming language quick ref for iPad
Didn't Microsoft recently admit that .NET was a failure? If so, why are they including it in the core of Windows Vista?
why is this modded insightful?
"Our interests are to see if we can't scale it up to something more exciting," he said.
The vulnerabilities found are just a function of how popular the system is in the real world. Microsoft is a victim of its own success.
If Linux had as huge an installed base as Microsoft Vista then we would see all the script kiddies exploiting and 'owning' Linux boxes.
(c)2007
They whose government reduces their essential liberties for temporary security, receive neither liberty nor security.
It's a security best practice in a multi-user system, so I'm not sure what your point is. It was in Unix long before it was in Windows, but that doesn't change anything. The flow goes both ways.
That said, Monad does offer many things that make it incredibly unique as a shell. You can try it for yourself, or simply read commentary from people who have. There are a lot of unix geeks (myself included) that really think it is a lot of fun. I have a lot of Monad examples on my blog, should you be interested.
It all goes downhill from first post
Am I the only one to have seen every release of Microsoft since CP/M? Must be.
OF COURSE the virus writers already have a jump on the product before the beta is done. You don't really think 8,000 viruses this year so far, just *happen* do you?
The cycle continues.
The release.
The press proclaiming that it isn't selling. A handful of corporations jump on it for the same stupid reasons one can only make when earning more than a million dollars each year. (corporate stupidity).
Then comes the inevidable "We're going to stop supporting old release X" when more jump on board.
Just as people are getting settled in, OH! It's time for a new Office and maybe Works! The old ones are grossly incapable of doing simple math and are seriously lacking 'cool', so the herd begins to turn and shed their cash.
There are still people running DOS, ya know. And Wfw. And Win9x. They're happy as long as they don't use the net. (So they're safe)
When will corporate America and the man on the street tire of being surprised at this rope-a-dope?
--- For a good time mail uce@ftc.gov
is more akin to the bastard child of wmic and cmd; at least the beta i last saw was.
It's just a beta product. All flaws are not fixed yet.
I suppose you all remember when Whistler (codename for windows XP) came out, it was full of bugs and security holes. This is normal, it's a beta. Now we all know that Windows XP is stable and secure as hell *cough cough*
Because this certainly confirms that windows virus's have a new VISTA to exploit!
[Now, I'm off to lift my le... Um, visit... at another place.]
Mynecology?
There is no right to feel safe thru security vaudeville at the expense of everyone's freedom, privacy and tax money.
Sure, Microsoft will fix some holes on the way to the final product. But given there past history, there are going to be new viruses for Windows Vista the day it comes out, along with new type of spyware . The same old story.