Slashdot Mirror
Windows Vista Tool Targeted By Virus Writers
An anonymous reader writes "Five proof-of-concept viruses that target Monad, the next version of Vista's command prompt, have been published on the web. Monad is a command line interface and scripting language that is similar to Unix shells such as bash, but is based on object-oriented programming and the .Net framework. The viruses' only action is to infect other shell scripts on the host's operating system. They would cause little harm in the wild, but would be relatively easy to modify using the information from the article, said Mikko Hyppönen, the director of antivirus research at F-Secure."
But seriously, this article is very light on the details. I assume that these virus writers found a way to gain administrative rights using Monad, but the article makes it sound like these are just malicious scripts. It might as well be a advanced batch script that can spread it self then del
Microsoft Windows is insecure! More details later, movie at 10.
The fact that MSH is used as the execution vehicle is really a side-note, as it does not exploit any vulnerabilities in Monad. The guidance on shell script viruses is the same as the guidance on all viruses and malware: protect yourself against the point of entry, and limit the amount of damage that the malicious code can do.
That's not to belittle the dangers of script viruses, though.
I wrote a blog entry about it here, in relation to Monad.
It all goes downhill from first post
So l337 h4x0rz c4n pwn j00!!!!
For MS.
But seriously, this is like tipping over someone in a wheelchair. It's a BETA of WINDOWS. Hopefully MS will learn from this before the release, though. I'm not up for a whole new vector of threats against my windows boxen.
Jerry
http://www.cyvin.org/
Something which requires you to execute a script on the computer is not a virus. Think if you execute a bash script in Linux and it goes on and put itself in all your bash scripts, would you call it a virus?
This is actually nothing, it simply prepends/appends or put itself in the middle of existing MSH scripts. It is equivalent to, if you run a binary on your machine, it can attach itself to all the binaries on your machine.
On top of that, MSH by default on let digitally signed scripts to execute hence once infected scripts on execute. This is not really a threat at all.
Maybe it's because they pound their chests and declare they're the most secure, cheapest, bestest, fastest, etc, etc, even when there's overwhelming evidence to the contrary. When someone gets big-headed it's only natural to poke fun at them, or in a more sinister way, to want to exploit holes & make a big noise about it. It's like throwing cream pies at famous people, to embarass them in public. (Disclaimer: I'm a programmer, not a cracker or virus writer. I've never chucked a cream pie at a Personage before, either.)
On the other hand, if their next marketing campaign had a slogan like 'This OS is almost as polished as OS/X' or 'Vista is almost as secure as Linux' I can see how it might impact sales. However, perhaps if they stopped making outlandish claims in marketing, cracking would be left to the crimanals trying to steal your ID, rather than script kiddies hurling virtual cream pies.
Truth vs marketing. I wonder which will come out on top?
Hal Spacejock: Science Fiction with Nuts
How is this different than writing a ksh or bash script virus? Ksh and bash script viruses can be just as bad. Heck, remember the Morris worm?
./er, but this might not be their bad just yet.
I like bashing M$ just as much as the next
The bitter lessons of a veteran coder: http://bitterprogrammer.blogspot.com
never mind the virus-
windows now has a decent shell?!
will wonders never cease?
K.
Give M$ some time to work its magic, then there will be plenty of holes and viruses for all!
Oh, and just for completeness, vulnerabilities have been found in Firefox since 1.0, so the argument that only Microsoft releases "beta" (read: vulnerable/insecure) code as production-level software doesn't work either.
All this proves is that Monad can find and modify text files (and that there are idiots out there who will misuse tools).
About the only way around this is code-signing to prevent modification (yeah, like I'm gonna sign every single perl script I ever wrote.....)
It's not like you can't do this in bash, awk, sed, perl, python, REXX etc. etc.
I must be getting old when i see the full circles everywhere.
when windows 95 came out the windows zealots where so quick to point out "no more haveing to type in dos windows is better than everything" now they will say "we have a shell windows is better than everything"
Plus, Hakko Mipponen (or whatever his name is) has to make a living scaring the bejezus out of everyone - what better way to get started than with something that's not even really out of alpha?
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
Quoth the wise man in his treatise Monadology (1714):
"There is also no way of explaining how a monad can be altered or changed in its inner being by any other created thing, since there is no possibility of transposition within it, nor can we conceive of any internal movement which can be produced, directed, increased or diminished within it, such as can take place in the case of compounds where a change can occur among the parts. The monads have no windows through which anything may come in or go out. The Attributes cannot detach themselves or go forth from the substances, as could sensible species of the Schoolmen. In the same way neither substance nor attribute can enter from without into a monad."
And they they've managed to attack them??? Oh, the humanity...
The power of accurate observation is commonly called cynicism by those who have not got it. -- G.B. Shaw
Awwww, crap guys. Let it go already. It's a bit like kicking a crippled at this point.
Yeah, it sucks when that happens.
Of course you can always "embargo" all your vulnerability details (see for example bug #294795) - and feel comfortable in your superior position!
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
All it does is find every .msh file and replace its contents with itself. That's it. You could do it with a .CMD file in any version of Windows (and of course in any other scripting language).
The other scripts get a bit more complicated (insert at a random spot in the file, etc) but that's basically it. There's no new vulnerability exposed by Monad.
- adam
- adam
Am I suppose to believe you're him?
But very few of the most widespread viruses in the world rely on vulnerabilities.
Right, and assuming you are Hypponen, how does this affect you (or not)? I was making a comment about Slashdot, not you.
OTOH, assuming you are who you say you are, let me just say that I'm hardly the first person in the world to point out that companies like F-Secure tend to be on the unfortunate side of hysteria when it comes to reporting vulnerabilities. So don't be offended by that, we understand how the business works. It's OK.
Cheers.
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
It should be "Windows XP/2003/Vista Tool Targeted By Virus Writers". It won't just be for Vista. The tool is also still in early beta, and I'm not even sure what the script did; is it a script like "rm *", or does it exploit any actual vulnerabilities? There's too little info here to know if this is anything to call news or not...
Monad will also not be included with Windows Vista RTM.
Beware: In C++, your friends can see your privates!
"Only problem is, Monad is not included in the Windows Vista beta code."
It will probably not be included in the final Windows Vista code either.
It'll be a separate, downloadable tool for all MS OS'es since Windows XP.
I'm still looking for the connection to Windows Vista here...
Beware: In C++, your friends can see your privates!
As much as i despise microsoft and avoid using windows at whatever cost. They have not released Vista to end users yet. The purpose of a beta is to find out what the problems and issues are and resolve them. Wait until they release a final before criticising I am sure there will be plenty of viruses and bugs to get excited about then! (How else are they going to continue shipping their AV software ?)
Electronic Music Made Using Linux http://soundcloud.com/polyp
But I'm sure that's just a coincidence.
You must think in Russian.
2) assume you already have command line access
a "virus" at this point is trivial... just append the code to append itself at the end of every file it assumes is a script for this command line.
this is like batch file viruses that format the drive... it isn't anything special, it's just a matter of getting the mark to run the file. nothing to see here.
The real issue is that I do not want a case-sensitive file system, or one that requires me to do all sorts of command line incantations to run a script. It's not my fault that Joe User and his 1,000,000 friends are stupid.
In any case, I can send you a tarball with the execute bit turned on and ask you to unpack it and run the REAL COOL ANNA KOURNIKOVA SCREENSAVER!!!, and chances are you'll do it. Chances are when Linux hits the "big time" there will be something slightly more functional than FileRoller out there. Chances are you'll give me your root password if I ask for it nicely. Chances are your assumptions or superiority are unfounded. People got infected with worms that came in on password protected zip files. Do you think you can engineer away user stupidity? That's scary.
to hide the file extension from the user
Bad design call, yes. OTOH, I could care less, I always turn it off.
Does longcock
OMFG, you're hilarious.
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
Thing is, msh is not registered as handler for *.msh files, so in order to run the script you will have to execute 'msh.exe script.msh' from the command-line, it will not work by clicking an icon in Outlook Express for example.
The more sophisticated you make a system, the more failure modes you introduce -- and the harder it gets to test the edge cases, because there end up being too many edges. You want Obejct Oriented? I'll give you an Object Oriented example. Let's have a "length" type with properties which correspond to its conversion into different measuring units.It may well be pretty, but outside of any programme dealing with units conversion it's fairly unnecessary. And it contains many programming hazards which would thwart the careless implementor. {BTW, that was a fictitious example; but I'm willing to bet there is at least one programming language out there that actually implements something like it.}
All a command shell really has to do is be able to launch programmes, police the I/O traffic and keep hold of some state information. If it can do all that right, any other functionality you need can be provided by external programmes. That way, everything is kept as simple as it needs to be; you haven't got code cluttering up things that don't need it. If you do build functionality into the shell, there should be a bloody good reason -- usually that reason is that some external programme is getting launched more than its fair share. And in that case you already have the code you need to incorporate and it's been thoroughly tested.
Je fume. Tu fumes. Nous fûmes!
As time goes on, they keep reinventing bits and pieces of Unix.
A firewall can not protect you from yourself. Turn off what you do not need. Do not use the firewall to do your work.
From a Dec. 2004 "chat": Q: How is security addressed in Monad? A: This is a very board topic. We spend a lot of time on security. One of the common questions is "are we reintroducing script attacks?". We are doing a number of things to mitigate those exposures. 1) we will not have a doc handler for .msh files (this means that you won't be able to double-click a .msh file and have it run). 2) We'll have a policy that only allows signed scripts (from people you trust) to run (we'll then make it easy for you to sign scripts).
It's just a beta product. All flaws are not fixed yet.
I suppose you all remember when Whistler (codename for windows XP) came out, it was full of bugs and security holes. This is normal, it's a beta. Now we all know that Windows XP is stable and secure as hell *cough cough*