Exploit Released for Unpatched Windows Flaw

woodchuck writes "Washington Post reports that another Windows hole has been found and exploit code is now running lose that makes swiss cheese of current patches and security measures. From the article: "Security researchers have released instructions for exploiting a previously unknown security hole in Windows XP and Windows 2003 Web Server with all of the latest patches applied. Anti-virus company Symantec warned of the new exploit, which it said uses a vulnerability in the way Windows computers process certain image files (Windows Meta Files, or those ending in .wmf). Symantec said the exploit is designed to download and run a program from the Web that downloads several malicious files, including tools that attackers could use to control vulnerable computers via IRC.""

Comments

They call hackers researchers now?

[Anonymous Coward]

So they're researchers now? I'm sorry, but I have to disagree, they are computer hackers.

Re:They call hackers researchers now?

[dorkygeek]

They're not hackers, they are crackers. Or intruders. Or black hats. Or fucking idiots. But not hackers. Linus Torvalds is a hacker. Alan Cox is one, and RMS definitely. Maybe even ESR.

Thank you.

Re:They call hackers researchers now?

[slavemowgli]

ESR is not a hacker... he's a nut. :)

Re:They call hackers researchers now?

[Anonymous Coward]

They're not hackers, they are crackers.

Nice...racist. And I suppose that if they were black, it wouldn't be okay to call them niggers.

Re:They call hackers researchers now?

[GaryPatterson]

You're fighting a lost battle there. The common understanding of the word 'hacker' now implies criminal behaviour.

The whole 'white hat' and 'black hat' thing never made it to the media, so all hackers are 'black hats' now.

Re:They call hackers researchers now?

[Anonymous Coward]

They can be called "hackers" all right. While I know that you and a handful of other language fascists would like to change how the rest of the world uses their language, it's a fact that "hacker" now means (in addition to the definition you want it to have -- there's nothing wrong about a word having several meanings which become apparent upon reflecting on the context in which they are used) what you mean by "cracker". What they can't be called is "researchers". Publishing a vulnerability can be considered research, POC code is highly doubtful in most cases, and a full-fledged app starting shit up connecting to an IRC server is just plain maliciousness. Thus, hacker or cracker -- take your pick. But researchers they ain't.

Submitter, stop helping these people feel legitimate. The parent poster and I agree on one thing: they're just assholes.

Re:They call hackers researchers now?

[ninja_assault_kitten]

The exploit was published by HD Moore after reverse engineering some malware. HD Moore is absolutely a very prominent researcher and hacker. Secondly the person(s) who discovered the vulnerabilty and wrote the initial malware to exploit it are also hackers. Even by the historical definition. Intent has no bearing on the term. Skill does. And you can't tell me discoverying a 0day affecting any MS platform doesn't require skill. There are tens of thousands of researchers out there right now who can't.

Re:They call hackers researchers now?

[Mr Thinly Sliced]

Hahaha I just pissed my pants.

Happy New Year Microsoft!

Re:They call hackers researchers now?

[Anonymous Coward]

That this comment is modded -1, Troll shows how extremely intolerant Slashdot has become to dissenting views. It's funny that a community which is supposed to be so strongly against censorship is so quit to remove anyone who has a contrary opinion from view.

I agree with the parent. A researcher may perhaps publish code to prove that the exploit work, but no serious researcher writes a whole app that connects to an IRC server only as proof of concept. That is not research, it's clear malicious intent.

Moderator, if you're beef is with the parent's use of the word hacker: just grow the fuck up. You and ESR aren't going to be able to police the whole world's use of language anyway, so just give up already.

As for people (as one doofus who replied to this post apparently does) who thinks hackers should be called crackers -- what do you propose people who break copy protection should be referred to as then? You hack into a system, you crack a protection mechanism. If you people would have it your way, the scene would become very confusing very quickly.

Let people use those words however they want to, mmkay? If you don't like it, run home to mommy and cry if you want to, but stop using this forum to whine about it everytime someone doesn't use your non-standard definition of a word in common use.

Re:They call hackers researchers now?

[hugzz]

They're not hackers, they are crackers. Or intruders. Or black hats. Or fucking idiots. But not hackers. Linus Torvalds is a hacker. Alan Cox is one, and RMS definitely. Maybe even ESR.

Crackers are hackers*. You cant crack someone's system without being very skilled in toying with technology (ie a hacker).

However, hackers aren't nessearily (or usually) crackers.

*This excludes script kiddies et al, since they dont crack someone's system really. they just run someone elses' crack

Re:They call hackers researchers now?

[jack_csk]

You are redefining hackers, just like those clueless (and hopeless) people who called all the attackers hackers.
I'm sure the rest of us can tell the difference between black hats, grey hats, and white hats (some people argue that purely white hat does not exist), as well as crackers, and clueless scriptkiddies.
Whoever modded the parent informative is actually quite un-informative.

Re:They call hackers researchers now?

[Anonymous Coward]

They're not hackers, they are crackers.

UUuummm no. Ever since the 1980's underground scene the word cracker has refered to a person who breaks the protection on copywritten software. It was that way for years until that ruddy faced blowhard "ESR" decided to start using the term "cracker" as a synonym for "computer criminal."

Talk about hypocrisy. ESR gets all pissed about the media misusing the word hacker so he turns around and starts misusing the word cracker. And because of his position as editor of "The Jargon File" he has influenced the web culture (newbies at least) that the word cracker is synonymous with cybercriminal even though anyone who was in the pirate scene back in the eighties can tell you that a cracker was by the following DEFINITION:

"Software cracking is the modification of software to remove encoded copy prevention. Distribution of cracked software (warez) is generally an illegal (or more recently, criminal) act of copyright infringement. Software cracking is most often done by software reverse engineering."

Re:They call hackers researchers now?

[ichin4]

This post is pure flaimbait. You understood perfectly well what the writer meant by "hacker", and so did everyone else. You also understand perfectly well that one very commonly used definition of "hacker" is "a person who makes unauthorized use of another's computer". And the author probably understands perfectly well that there is a another definition "hacker" that means "a clever and dedicated programmer", although that happens not to be the one he employed. Lots of words have multiple definitions. Your objection is pure posturing and does no one any good.

Re:They call hackers researchers now?

[Ucklak]

Bill Gates is a hacker too.
He dropped out of college and programmed what he did with no training (before he started to buy programmers).
A hacker is an untrained person that has professional skills that profess in a certain area that should have taken them years, education, and experience to receive. They could also be enthusiastic about a diversion (music, sports, computing).

It could be music, sports, computers, driving, etc...

There are plenty of sport hacks and musician hacks. You hear it alot in music especially in piano and solo instruments.

It's kind of sad how the computer revolution has turned this word into implying something malicious.

Re:They call hackers researchers now?

[dorkygeek]

the general population is quite capable of overloading word definitions and parsing the precise meaning from the context

No, it is not. What do you think would happen if I said in public I'd be a hacker. What do you think would my mother think about me then? OMG, my son's a criminal. No, I'm not!

Re:They call hackers researchers now?

[dorkygeek]

You are redefining hackers, just like those clueless (and hopeless) people who called all the attackers hackers.

Ok, then thell me where exactly I redefine hackers?? When the term hacker was first used, it did not have the connotation of being malevolent, trying to harm other people. It was used for individuals who were extremely skilled in some area, or came up with ideas others weren't thinking about.

It was only later when the media started to pay attention to computer related threats. Assholes as these malevolent people were, they called themselves hackers, because they wanted to show off as people who were skilled. The media then quickly embraced the term because it sounded cool and a new term for a new phenomenon is fancy, and started to use it for all black hat people.

Re:They call hackers researchers now?

[dhammabum]

All poodles are dogs but not all dogs are poodles.... (from a Law and Order episode)

Re:They call hackers researchers now?

[dorkygeek]

Bill Gates is a hacker too. [...] A hacker is an untrained person that has professional skills that profess in a certain area that should have taken them years, education, and experience to receive.

No, Bill Gates is not a hacker, and has never been one, because the definition of hacker is not having professional skills although somebody is untrained, it means having exceptional skills, no matter whether trained or not!

It's kind of sad how the computer revolution has turned this word into implying something malicious.

On this one we agree! It's all about clueless media.

Re:They call hackers researchers now?

[dorkygeek]

Yes, I remember these days. But what do you want to prove with that argument? I said that the term cracker should be used because it already had a malevolent connotation, instead of hacker.

So, yes, let's come up with some third term! But remember, it must sound cool, otherwise the media is not going to adopt it. Although I feel that this is already in the making. I guess that in some years, everybody who would have been called a hacker by today's media is going to be called cyber terrorist by then. Just imagine the headlines: "Cyber Terrorist Exploits Security Hole in IE to Send Spam".

Re:They call hackers researchers now?

[Ohreally_factor]

So, if you root his box, that makes you a nut cracker? Sweet!

Re:They call hackers researchers now?

[dorkygeek]

Yeah, and the businesses generate half of their income by using overloaded terms to describe the properties of their products, knowing exactly that Joe Average does not know that the term they've used also means other things than the one they think it means.

That's why I am against overloading terms with meanings which are quite opposite to each other.

Re:They call hackers researchers now?

[hkb]

No, they're hackers, too. See also DefCon, 2600, Phrack, and history itself. Only Slashdotians/ESR fanboys use the term "cracker" to describe a type of "hacker".

Don't be an idiot and "correct" someone when you're wrong.

Re:They call hackers researchers now?

[dorkygeek]

No, they're not. They are malevolent fuckfaces.

Security experts instead might very well be hackers, because they are skilled. But security experts are not malevolent! Crackers who break into other's systems to enrich themself or simply to cause other people damage are idiots, and shall not be called hackers (which are benevolent people!). Period.

Re:They call hackers researchers now?

[pallmall1]

And you can't tell me discoverying a 0day affecting any MS platform doesn't require skill. There are tens of thousands of researchers out there right now who can't. --bold added

Most of those must work for Microsoft. :)

Re:They call hackers researchers now?

[Anonymous Coward]

The metasploit framework module is a direct rip of the original exploit. All I did was remove the download+exec code and allow the user to specify their own payload instead. I needed to test the bug on a few platforms and didn't feel like attaching a debugger each time :-)

The source can be found here:
http://metasploit.com/projects/Framework/exploits. html#ie_xp_pfv_metafile

-HD

Re:They call hackers researchers now?

[lawpoop]

I knew a very smart and experienced admin from Slovenia. He was trying to tell me about script-kiddies. He asked me what the word was for "the froth of piss". I told him we didn't have such a word in English. Well, that was his ideas of script kiddies.

SO, to re-cap:

• Crackers are hackers
• hackers aren't nessearily (or usually) crackers.
• Script-kiddies are the froth of piss.

Re:They call hackers researchers now?

[dorkygeek]

Wow, have you ever looked up the meanings of the verb to hack? It doesn't mean what you think it means. "To hack into a system" is a sentence derived from the term "hacker". It's not god given, nor does it bear much resemblance to the original meanings of the verb "to hack". Let's have a look at M-W's entry:

• a : to cut or sever with repeated irregular or unskillful blows
  b : to cut or shape by or as if by crude or ruthless strokes
  c : ANNOY, VEX -- often used with off
• to clear or make by or as if by cutting away vegetation
• a : to manage successfully
  b : TOLERATE intransitive senses
• a : to make chopping strokes or blows ; also : to make cuts as if by chopping
  b : to play inexpert golf
• to cough in a short dry manner

So, you can see, when seeking for a term to describe the act of breaking into a computer, it doesn't come naturally to use the verb "hack".

But there are two other meanings listed:

• a : to write computer programs for enjoyment
  b : to gain access to a computer illegally

Surprise surprise, M-W even knows about the original meaning of hacking in the area of computers, and lists it as first meaning. Oh, or let's have a look at http://dictionary.reference.com/search?q=hack:

• Informal. To alter (a computer program): hacked her text editor to read HTML.
• To gain access to (a computer file or network) illegally or without authorization: hacked the firm's personnel database.

So you see, "to hack into a system" is an artificial term, and does not directly follow from the original meanings of the verb "to hack".

On the other hand, at least dictionaries are listing the benevolent and the malevolent definitions by now.

Re:They call hackers researchers now?

[DavidTC]

No.

You crack things by breaking them, or part of them. This can be copy protection or security software or DRM. You can even crack into hardware you aren't supposed to be able to open. The metaphor is 'cracking them open' like a coconut.

You hack something by modifying it in a clever way, or using it in a clever way without modifications. The metaphor of 'carving with axes' doesn't really work here.

A hack can be a crack, and crack can be a hack. Witness the X-Box ones that let you run unsigned programs via holes. A hack and a crack.

A hack is not always a crack. In fact, it can be the opposite of one, where a clever modification prevents a crack.

A crack is not always a hack. Sticking a screwdriver into a plastic case and ripping it open with brute-force is a crack, but it not by any means a hack.

The definations are perfectly consistent, and neither requires malicious intent. However, you can hack someone else's stuff in a non-malicious way, but cracking their stuff is almost always malicious, as you're breaking something.

Re:They call hackers researchers now?

[Ignominious Cow Herd]

The last scene was interesting from the point of view of a professional logician, because it contained a number of logical fallacies, that is invalid propositional constructions and syllogistic forms, of the type so often committed by my wife.

"All wood burns", states Sir Bedivere. Therefore he concludes, "all that burns is wood". This is, of course, pure bullshit.

Universal affirmatives can only be partially converted; all of Al McCogan is dead, but only some of the class of dead people are Al McCogan. Obvious, one would think.

However, my wife does not understand this necessary limitation of conversion of a proposition, so consequently she does not understand me. For how can a woman expect to appreciate a professor of logic if the simplest cloth-eared syllogism causes her to flounder.

For example, given the premise all fish live underwater and all mackerel are fish, my wife will conclude not that all mackerel live underwater, but that if she buys kippers it will not rain, or that trout live in trees or even that I do not love her any more.

This she calls "using her intuition". I call it "crap" and it gets me very irritated because it is not logical.

"There will be no supper tonight!", she will sometimes cry, upon my return home. "Why not?", I will ask ask; "Because I have been screwing the milkman all day!", she will say, quite oblivious of the howling error she has made.

"But", I will wearily point out, "even given that the activities of screwing the milkman and getting supper are mutually exclusive, now that the screwing is over, surely then, supper may now logically be got."

"You do not love me anymore!" she will now often postulate. "If you did you would give me one now and again, so I would not have to rely on that rancid Pakistani for my orgasms."

"I will give you one", I now scream, "after you have gotten my supper, not before." as you see, making her bang contingent on the arrival of my supper.

"Good, you turn me on when you're angry you ancient brute", forcing her sweetly throbbing tongue down my throat.

"Fuck supper!" I now invariably conclude, throwing logic somewhat joyously to the four winds. And so we thrash about on our milk-stained floor, until we sink back exhausted onto the cartons of yougurt. ...I seem to have strayed somewhat from my original brief. But in a nutshell, sex is more fun than logic. One cannot prove this. But it is in the same sense that Mt. Everest is or that Al McCogan isn't.

Good night.

(from the Soundtrack, of the Trailer, of the Film, of Monty Python and the Holy Grail)

Re:They call hackers researchers now?

[ichin4]

Actually, I think the two usages are quite close. In my daily work as a programmer, we use the word "hack" to describe a clever piece of programming that enables something to be done that really wasn't forseen in the original design. For example, perhaps my subroutine is handed a file-reading stream for it to interrogate. Clearly the architect of the program did this so I could only read, but not write, to that file. But perhaps I figure out some neat to feature I can add if I can get around that restriction and nevertheless write to the file. I'd call that a "hack" -- in this case a good and useful one. Getting a system designed to read a media file to execute arbitrary code is a "hack" in a similiar way -- just an evil and destructive one.

In any case, whether you're against overoading the meanings of words is really immaterial. Many, perhaps even most, english words do have overloaded meanings. In any case, Webster's gives both our definitions: yours as #3 and mine as #4.

And supposing you were to convince English-speakers that overloading is bad -- why should your prefered defintion of "hacker" win instead of the one that you seem to agree is most common?

Re:They call hackers researchers now?

[aichpvee]

I always call Linus "Fucking Sweet", but the FCC kept the media from picking up on that one.

Re:They call hackers researchers now?

[Nogami_Saeko]

Hmm... Maybe like a beer? piss-head?

N.

Re:They call hackers researchers now?

[Weedlekin]

Ah, but you've missed the point entirely. Bill Gates isn't considered a hacker by most of /. because he lacks several important attributes that are vital to hackerdom:

1) Be heavily associated with open source software (preferably Linux).
2) Have a healthy contempt for copyrights and patents.
3) Believe that Microsoft is the root of all evil, and say so _a lot_.
4) React with vitriol and contempt to anyone who suggests that open source is not a universal panacea to all that ails the world.

Re:They call hackers researchers now?

[stanmann]

Cleave.

Context is always important.

Re:They call hackers researchers now?

[stanmann]

A hacker TYPICALLY will not have malevelolent intent, but most hackers ... Defcon, 2600, phrack, etc are more typically Chaotic Neutral, and will not intentionally cause damage, but won't be concerned if it occurs in the course of freeing or expanding knowledge. If a component gets "used up" in the pursuit of knowledge that is just a casualty, and not to be worried about.

Re:They call hackers researchers now?

[Scarblac]

You're fighting a lost battle there. The common understanding of the word 'hacker' now implies criminal behaviour.

The whole 'white hat' and 'black hat' thing never made it to the media, so all hackers are 'black hats' now.

He's not even fighting that battle, he's fighting the one before that. What he calls a "hacker" is not what you call a "white hat hacker". A hacker is an exceptionally gifted programmer, the term has nothing to do with security. People trying to break into computers are crackers, regardless of their intentions. So-called "white hats" are crackers.

That said, yeah, that battle is rather lost...

Re:They call hackers researchers now?

[flosofl]

A hack can be a crack, and crack can be a hack. Witness the X-Box ones that let you run unsigned programs via holes. A hack and a crack.

A hack is not always a crack. In fact, it can be the opposite of one, where a clever modification prevents a crack.

A crack is not always a hack. Sticking a screwdriver into a plastic case and ripping it open with brute-force is a crack, but it not by any means a hack.

With a little work, this could read like a Dr Suess book :)

Re:They call hackers researchers now?

[robogun]

I said that the term cracker should be used because it already had a malevolent connotation,

Is it because "cracker" is also pejorative term for southern whites? Yeah, it's unlikely that Cletus and Cooter will r00t your b0x, however the confusion exists when the general public reads headlines such as CRACKER STEALS 100,000 IDENTITIES

Re:They call hackers researchers now?

[umeboshi]

The smartest criminals do research. In fact almost any group of criminals that are halfway organized, are likely to do a certain amount of research during the crafting of a caper. In order to bribe a person with some authority, some research is necessary. It is easier to bribe a judge or politician who is living among the shadows of scandal, than it is to bribe a 'Dudley Do Right'.
Good bank robbers do research on payroll arrivals, or armored car deliveries.
If you run a chop shop, you need to do research on where the uid's are on the equipment that you are chopping up.

With all of the discussion of what words mean, there should be no reason to try to change the meaning of a definition of a word that's been in the vernacular for centuries to clarify a term that's only been used for a few decades.

Publishing a vulnerability cannot be called research, because you already correctly called it publishing, even though the publication could be the product of research. The claim that a group of people who engage in research, aren't researchers because of how they publish their findings is fallacious.

Sorry for posting like this, but I can't stand for people to use a false understanding of words to redefine/clarify other words. It undermines the whole process of building off of other ideas, kind of like weakening the foundation and perpetuating confusion.

Re:They call hackers researchers now?

[operagost]

I'm sure there's a really long word for this in German. Like Schadenpissenfrothengroden or something.

Re:They call hackers researchers now?

[uradu]

> why should your prefered defintion of "hacker" win instead of the one that you seem to agree is most common?

In that case I am going to use the OTHER other definition of hacker--one who makes furniture with an axe--and call you both fools!

Re:They call hackers researchers now?

[meregistered]

Ummm what does the use of their abilities have to do with the imperical evidence that there are major security flaws in IE?

Ad hominem attacks only detract from the issue.

Please remember that there have been multiple warnings by CERT (Computer Emergency Response Team) that IE is an insecure application.

The issue here really is not an IE issue but a security issue. CERT issues warnings when there is a significant computer related security risk.

This is only continued security weakness as security experts have advised that there might be, (and of course IE is far from the only application with security weaknesses).

Re:They call hackers researchers now?

[Bush Pig]

There certainly are a lot of musicians who are hacks (Britney Spears springs to mind), however I think that any musician, particularly talented ones, would object to you describing them so.

Re:They call hackers researchers now?

[shaitand]

Actually, the hacker term applies to any geek who excels at learning the component pieces of things in arranging them in a way that causes his will to be done. There are electronics hackers, phone hackers, programming hackers. and security hackers.

Those who learn how security mechanisms work and exploit the way they function to achieve their ends are also hackers. It was never wrong to call security crackers hackers. Script kiddies need not apply, and the term was never exclusive to security crackers in true definition.

Re:They call hackers researchers now?

[shaitand]

The headline would be appropriate use of the language. The assumption that scientific researchers is intended would be incorrect even if common. Look at ancient mythology, simply because the majority of the human race believes in magic men in the sky controling our fate hardly makes it less of a fable.

Easy workaround to avoid the exploit

[kawika]

Unregister the dll that provides WMF viewing. Click Start, Run, and enter this:

    REGSVR32 /U SHIMGVW.DLL

Sunbelt has more detail here.

Re:Easy workaround to avoid the exploit

[LiquidCoooled]

To add to this, the exploit may be in more than one image file viewer, it could be a common handling problem with WMF files in Windows.
If you can remove ALL associations to the fileformat (at least until the extent is known) this would be beneficial.

Users of webbrowsers (all) must be careful when saving image files of type WMF.
Once saved on your computer the associated image viewer is used to display the file.

Take care with IM and email attachments as well, because this is another possible vector.

Re:Easy workaround to avoid the exploit

[Anonymous Coward]

Just my own experience... After issuing the reg command I was unable to view thumbnails in explorer of jpegs taken by my camera. I was also quite unable to open any of them until I issued the command to register the dll again ( regsvr32 shimgvw.dll ).

Re:Easy workaround to avoid the exploit

[Pneuma ROCKS]

I'd rather go with workaround #2. It's easier to do and undo IMO. It's also cleaner in that you know exactly what will stop working.

Re:Easy workaround to avoid the exploit

[bergeron76]

And break a whole bunch of other stuff in the process!

Great advice.

Re:Easy workaround to avoid the exploit

[1u3hr]

after issuing the reg command I was unable to view thumbnails in explorer of jpegs taken by my camera. I was also quite unable to open any of them until I issued the command to register the dll again

You probbaly have some kind of image viewing app (usually bundled with digital camers). Otherwise try a free one, eg Irfanview. Install and it will take the jpeg association and display them, allow you to move, rename, and do basic image editing as well.

Re:Easy workaround to avoid the exploit

[klui]

Not totally true. You lose thumbnails, but you should be able to double-click and launch whatever program set to view/edit your files. Just make sure your filetype association is correct.

Re:Easy workaround to avoid the exploit

[klui]

Well, I was wrong. :)

Once I rebooted, Preview stopped working.

Re:Easy workaround to avoid the exploit

[VMSBIGOT]

The other work-around is to enable DEP on everything, not just key system services

To open System Properties, click Start, click Control Panel, and then double-click System.
Click the Advanced tab and, under Performance, click Settings.
Click the Data Execution Prevention tab.

Set this to "Turn on DEP for all programs and services except those I select" and make sure the list is empty (unless you have an app that won't run with it on)

This basically enables the no-execute bit on memory marked as data. This can cause problems with some crappy applications, but this will prevent buffer overflow problems. Windows 2003 Server has it on for all application by default, but XP only protects the OS and services by default.

Re:Easy workaround to avoid the exploit

[Nogami_Saeko]

Assuming of course that you have a CPU that supports DEP (less than a year old, more or less)...

Without it, setting DEP in windows won't do very much...

N.

Re:Easy workaround to avoid the exploit

[mochan_s]

Just my own experience... After issuing the reg command I was unable to view thumbnails in explorer of jpegs taken by my camera. I was also quite unable to open any of them until I issued the command to register the dll again ( regsvr32 shimgvw.dll ).

Yes, all the thumbnail images - Views->Thumbnails on the toolbar feature doesn't produce any thumbnails. Just the icons for the files only. Also Windows Picture and Fax viewer doesn't load (a big annoyance) since I use it to quickly scan through images on disk at full size.

Re:Easy workaround to avoid the exploit

[Software]

>If you can remove ALL associations to the file format (at least until the extent is known) this would be beneficial.

ASSOC .wmf=txtfile

The ASSOC command to the rescue! The command above should cause wmf files to be opened in Notepad. It should be used in combination with unregistering the DLL, though, because I think the ASSOC command only affects opening the files within regular (not Internet) Explorer.

Re:Easy workaround to avoid the exploit

[yanw]

Camera pictures? Fess up dude, pr0n.

Re:Easy workaround to avoid the exploit

[plover]

File type associations are evaluated when a process calls the Win32 API call "ShellExecute()"

The "more right" place to disable this would be with "ftype". This is what my box looks like right now:

C:\WINDOWS\SYSTEM32>assoc .wmf
.wmf=wmffile

C:\WINDOWS\SYSTEM32>ftype wmffile
wmffile=rundll32.exe C:\WINDOWS\system32\shimgvw.dll,ImageView_Fullscre en %1

C:\WINDOWS\SYSTEM32>

Unregistering the DLL (as TFA posits) only affects the COM aspects of dealing with WMF files. While COM is how Explorer resolves the association, it does not alter how ShellExecute() will behave. Your suggestion will certainly prevent "launching" attacks that the unregister solution won't stop. The two need to be installed together for maximum protection.

If instead of changing the assoc you change the ftype, you will prevent attacks from any file type that resolves to a wmffile. (Of course now that I said that I just grepped and found the only file type on my system that resolves to wmffile is in fact .wmf.)

Hmm. This led me to check on any other uses of shimgvw.dll.

C:\WINDOWS\SYSTEM32>ftype | find /i "shimgvw"
emffile=rundll32.exe C:\WINDOWS\system32\shimgvw.dll,ImageView_Fullscre en %1
giffile=rundll32.exe C:\WINDOWS\system32\shimgvw.dll,ImageView_Fullscre en %1
jpegfile=rundll32.exe C:\WINDOWS\system32\shimgvw.dll,ImageView_Fullscre en %1
Paint.Picture=rundll32.exe C:\WINDOWS\system32\shimgvw.dll,ImageView_Fullscre en
%1
pjpegfile=rundll32.exe C:\WINDOWS\system32\shimgvw.dll,ImageView_Fullscre en %1
pngfile=rundll32.exe C:\WINDOWS\system32\shimgvw.dll,ImageView_Fullscre en %1
TIFImage.Document=rundll32.exe C:\WINDOWS\system32\shimgvw.dll,ImageView_Fullscr
een %1
wmffile=rundll32.exe C:\WINDOWS\system32\shimgvw.dll,ImageView_Fullscre en %1

C:\WINDOWS\SYSTEM32>

I wonder if any of the other file types listed above also have this vulnerability?

how long?

[Anonymous Coward]

before MS starts using less-quick security patches as the reason to move from XP to vista?

Re:how long?

[spacefight]

WTF. Vista isn't even out yet, can we please move such conspiracy theories after the release of Vista? Thanks.

Re:how long?

[HairyCanary]

Once the majority of people have already switched. Reducing security updates as an incentive can easily backfire, by making your customers hate you. If you piss them off enough, they may consider upgrading to OSX or Linux instead of the latest flavor of Windows.

The Fix

[Anonymous Coward]

The important line filtered from the article, the fix:

"regsvr32 /u shimgvw.dll"

Re:Virus company

[BushCheney08]

From what I read about this earlier (sorry, don't have the link), this exploit was already in the wild and was being used before any of the security companies learned of it. So no, the AV companies did not "let this one loose".

Upside.

[grub]

With Vista you'll be able to get this from the comfort of an RSS feed!

Fix from article

[Rangsk]

Here is the fix, from the linked article in case you DNRTFA:

----
According to iDefense, Windows users can disable the rendering of WMF files using the following hack:

1. Click on the Start button on the taskbar.
2. Click on Run...
3. Type "regsvr32 /u shimgvw.dll" to disable.
4. Click ok when the change dialog appears.

iDefense notes that this workaround may interfere with certain thumbnail images loading correctly, though I have used the hack on my machine and haven't had any problems yet. The company notes that once Microsoft issues a patch, the WMF feature may be enabled again by entering the command "regsvr32 shimgvw.dll" in step three above.
----

I'm not sure if you need to type this every reboot, or just once. Since it requires re-enabling, I'm hoping it's just once.

Re:Fix from article

[CargoCultCoder]

I'm not sure if you need to type this every reboot, or just once. Since it requires re-enabling, I'm hoping it's just once.

regsvr32 registers a COM/ActiveX "server" by modifying Windows registry entries. So, in theory, you need only run it once.

It is possible, however, that if you later install other software, the installer may re-register the DLL in question, in which case you'd want to manually unregister it again.

(Hmm. I suppose it's only coincidence that this novel approach to registering appeared on thedailywtf yesterday...)

Re:Fix from article

[dtfinch]

I'm pretty sure that disabling shimgvw.dll will disable more than WMF rendering.

Amazing

[k00110]

I read the article and realized it's the same trojan I got like 1 week ago. The first thing I did was a good old format. When stuff get messed, there is nothing better than a good old format. Now realizing they say they don't have a fix yet, I assume I did the right thing quickly.

Re:Amazing

[k00110]

Because we never know what else can be installed and I lost all trust in Security companies since the Sony Root Kit. Removing it my-self implies searching infos over the internet and it's not a good idea to browse the web when your computer is compromised. I had nothing important installed so it did'nt matter. I had a new OS installed in a few minutes after that with ZoneAlarm and AVG(both free) and all the latest patches. I also just did the "REGSVR32 /U SHIMGVW.DLL" to not be infected again.

Re:Amazing

[Yehooti]

I'm amazed that more /. folks don't frequent http://isc.sans.org/ They've been on Yellow Alert most of the day due to this one.

Broadband Reports' Security Forum Thread...

[antdude]

Also, read Broadband Reports' security forum thread for discussions and what people observed.

Re:Broadband Reports' Security Forum Thread...

[TubeSteak]

I got tagged by a trojan using the same exploit on IRC.

I downloaded the wmf file to my desktop, but accidentally double clicked it when I was trying to submit it to trendmicro

I closed the connection with TCP View, but it took out explorer.exe with it.

This is much worse than potential spyware, this exploit is silent and can easily be used to drop keyloggers, or in my case, it opened up a shell back to the guy i was chatting with.

(btw - I knew it was a trojan when i downloaded it)

Re:Broadband Reports' Security Forum Thread...

[antdude]

Ouch! You should post in Broadband Reports' forum thread about this. I don't think anyone has mentioned this.

Just checking...

[sootman]

... there has not yet been a real, severe, in-the-wild exploit (like Sasser) since XP SP2, right? I hate to admit it as much as the next guy, but MS has been pretty tight for a while--unless there's something I've missed. Have I?

Re:Just checking...

[Anonymous Squonk]

If a 100 security flaws exist but are never found, does this still make the OS tight?

If even only one unpatched security flaw exists, an OS should never be called "pretty tight". This flaw has always been there, even if it has only been exploited just now...

Re:Just checking...

[NaruVonWilkins]

Give me a break. There are thousands of unpatched flaws in every OS on the market, they just haven't been found yet. So yes, if 100 security flaws exist but are never found, it does make the OS tight.

Re:Just checking...

[Superfarstucker]

I love how well the "...like an American" meme has propogated throughout the "non-american" population. Here on slashdot it is quickly approaching legendary status, and will be placed alongside such greats as goatse.cx and in soviet russia jokes. Perhaps I should go to a predominantly German news aggregator and start spouting "Spoken like a national socialist" at every opinion I don't like.

Re:Just checking...

[Lehk228]

no, 5 years to stop the flood of wormable remote exploits isn't "pretty tight"

Re:Just checking...

[CrazedWalrus]

Well said.

Is there any such thing as a "true American"? How about a "true German"? "True Englishman"?

I'm so sick of the double standards people have when it comes to stereotyping. We can't stereotype based on skin color or sex, but we can on a much larger group -- nationality! I'm sure that if all black Americans don't fit into one package, nor do all asian Americans fit into one package, then the group that includes them and many other sub-groups doesn't fit into one package either.

This American bashing got started when the media decided it was hot to call the President every name under the sun, compare him to monkeys, insult his intelligence, and otherwise malign him in ways heretofore unheard of for American presidents. It's not a far cry from insulting an elected official to insulting the people who elected him.

Unfortunately, in international armchair politics, rarely does the average person differentiate between different political groups of a foreign power, because they usually aren't informed enough. The result is that they lump every citizen of that country into a neat little package that obviously elected said official as a whole.

I guess the moral of the story is that a nation's approach to politics represents them to the world. I don't need to re-iterate the sad story of American politics nowadays with regard to the quality of debate and election campaign ethos. What I do need to say is that, if we don't clean up our act and have a little more respect for each other and our own elected officials, a little "true American" stereotyping is going to be the least of our worries.

This is as coherent as I can make an argument at 3:40 in the morning. I hope it's clear enough.

Not Previously Unknown

[Trick]

This is hardly a "prevously unknown security hole." In fact, MS released a patch for it two weeks ago.

The exploit's new, but the vulnerability has been known for a while and is only still around because the patch doesn't work.

Re:Not Previously Unknown

[ninja_assault_kitten]

Actually that's not true at all. This vulnerability was discovered by some analysis HD Moore performed on a spyware infection which broke through a completely patched XP SP2 system a couple days ago. It was reverse engineered and made into a Metasploit plugin. Get your facts straight.

Re:Not Previously Unknown

[Martin Blank]

It's completely new. The WMF patch released before does not protect against this exploit.

http://www.securityfocus.com/bid/16074

Re:Not Previously Unknown

[Anonymous Coward]

MS has released a patch for it...

so that explains why fully patched systems are still vulnerable, yes?

I guess you are really not doing your research. Read the Sunbelt article:
http://sunbeltblog.blogspot.com/2005/12/new-exploi t-blows-by-fully-patched.html

particular where it says: "We saw a new nasty exploit yesterday around 5:00 PM. This is a totally new exploit and is not the same one posted by FrSIRT back on 11/30/05."

The previous one they referred to is here:
http://www.frsirt.com/exploits/20051130.MS05-053.c .php

Microsoft Windows Metafile (WMF) "mtNoObjects" Header Remote Exploit (MS05-053)
Date : 30/11/2005

Advisory ID : FrSIRT/ADV-2005-2348
Rated as : Critical
Note : Proof of concept exploit (DoS) /*
* Author: Winny Thomas
* Pune, INDIA
*
* The crafted metafile (WMF) from this code when viewed in explorer crashes it.
* The issue is seen when the field 'mtNoObjects' in the Metafile header is set to 0x0000.
* The code was tested on Windows 2000 server SP4. The issue does not occur with the
* hotfix for GDI (MS05-053) installed.

This is the one that has been patched by Microsoft.

I guess you thought it's just not possible for there to be more than one hole per rendering engine, right?

Re:Not Previously Unknown

[juhaz]

Shut the fuck up and stop lying.

Yes, Microsoft, who very much agree this is a new vulnerability has fixed a wmf hole before, and no this is not the same hole. Guess what? Same piece of software can have several entirely unrelated buffer overflows.

CERT:
This new vulnerability may be similar to one Microsoft released patches for in Microsoft Security Bulletin MS05-053 (VU#433341). However, publicly available exploit code has been discovered that reportedly affects systems updated with MS05-053.

Re:Not Previously Unknown

[Trick]

I gotta wonder if people actually read any more.

That's what I said! It's a new exploit to an older vulnerability.

Argh.

Re:Not Previously Unknown

[Martin Blank]

And you were completely wrong. It's a new exploit to a new vulnerability. It happens to be a similar to a past vulnerability, but it is not the same.

Read the following and understand:

This affects even a FULLY PATCHED system, including the patch to which you refer, which is MS05-053. This is not fixed by applying the MS05-053 patch.

The only workaround for it right now, even on a fully-patched system, is to unregister the Windows Picture and Fax Viewer.

If you have any doubts about this, read this.

Maybe you're the one who should consider reading once in a while?

Re:so what else is new?

[atari2600]

Actually it's security and they are trying. Go ahead and mod me down as flamebait but nothing is more ironic than "experts", who cannot spell security, ridicule another organisation for failing to be more secure.

In other news...

[guruevi]

Microsoft said in it's late night response on new years day that a patch is being made, the flaw is not critical since no-one actually uses WMF and the rest who do use them never should surf to porn and warez sites anyway. A patch will be available in Windows Shoehorn.

Scary.

[Anonymous Coward]

Surfing for porn with IE on Windows is like having unprotected anal sex with everybody on the internet.

Re:Scary.

[k00110]

You can get it with Firefox too.

Re:Scary.

[squishybit]

...as it were.

Re:Scary.

[HermanAB]

No you cannot get infected with FF. On Exploder, it is a true worm that installs automatically without user intervention. On FireFox, you have to click a button to allow the site to install the crapware. Granted, 99.999% of Windoze Doodz will probably click it, but at that point the browser has washed its hands of the problem and you cannot blame Firefox for user schtoopidity.

Re:Scary.

[k00110]

"Update, 12:30 p.m. ET: Several security groups are reporting that it is extremely easy to get whacked by this vulnerability/exploit just by visiting one of a growing number of malicious Web sites that are now employing this attack. F-Secure's blog post on this indicates that -- because the vulnerability lies in the way Windows parses WMF image files -- Firefox and Opera users also can get infected -- although they at least have to agree to download and run a file first"

That's what they say in the article but the only thing I did was to open a .wmf movie in Firefox. I did not click/agree/install anything else.
The thing just auto-installed it-self from that point.

Re:Scary.

[HermanAB]

How did you remove the critter? A similar piece of work called Smitfraud-C can be removed with the smitrem tool: http://noahdfear.geekstogo.com/

Re:Scary.

[Tenareth]

That means at some point you told FireFox "No, I'm an idiot, don't warn me about this stuff in the future!".

That still isn't a FF issue.

Re:Scary.

[WGR]

WMF are not static images. There are a script of the Windows GUI instructions to create the image you see, so they are a program and can have all the problems of a program. This allows .WMF files to be edited by layers and scaled easily.

Re:so what else is new?

[jp10558]

Also watch out for Google desktop search, as that caused a downloaded file to be run and exploited the machine.

Kye-U also has released a filter for proxomitron that will block wmf file downloads:

[HTTP headers]
In = FALSE
Out = TRUE
Key = "URL-Killer: Kill WMF Connection [Kye-U] (Out)"
URL = "(^*=(^http://./^([a-z]+{2,4})(^/))))*.wmf(*)\1$TS T(\1=(^/))"
Match = "*&($CONFIRM(.WMF FILE EXTENSION FOUND\n\nAllow connection to the URL below?\n\n\u\n\1)|$SET(1=URL with .WMF Extension Killed\k))"
Replace = "\1"

[Patterns]
Name = "Kill .WMF [Kye-U]"
Active = TRUE
Bounds = ""
Limit = 256
Match = "*.wmf*"
Replace = "$ALERT(.WMF Extension Killed on:\n\n\u)"

Re:Other platforms?

[ninja_assault_kitten]

No, it's a buffer overload in Windows Picture and Fax Viewer.

Re:so what else is new?

[EllynGeek]

Secuarity is absolutely the correct spelling, because Microsoft knows squat about security. Just like you know nothing about irony. But that's all right, I don't like you anyway.

No kernel problem, but Winows only

[Sycraft-fu]

It's a Windows only format, or at least seems to be. I don't find any references of ports to other platforms. It's an old format for doing vector graphics in Windows 3.1.

Re:No kernel problem, but Winows only

[AEton]

It may be unfashionable, but I still rely on a clip art CD set that comes in WMF.

(Illustrator CS2 on OS X opens the things just fine.)

Re:No kernel problem, but Winows only

[whitehatlurker]

There is an OpenSource project which uses WMF. WMF is still the default format for a lot of graphics transfer under Windows.

I don't think libwmf is vulnerable though.

Re:No kernel problem, but Winows only

[Ucklak]

I know plenty of designers that still use Corels vector art from Corel 4.

Re:No kernel problem, but Winows only

[m50d]

Libwmf is there if you want to use them on other platforms, and is optionally used by imagemagick and just about anything that handles images.

How/Why does thi skeep happening

[Anonymous Coward]

Can someone explain to me exactly how an image viewer
program running on my client computer can be
made to execute code? Honestly, I don't really understand
these exploits that supposedly take advantage of
a client buffer overflow (or some such thing) to execute
code on my local machine. What makes the instruction pointer in
the code that is reading (in this case) the wmf file suddenly
jump to code that is in the data segment? (Presumably embedded in
the wmf file itself).

Re:How/Why does thi skeep happening

[HermanAB]

It is a carefully crafted buffer overflow in the stack causing a return address to be overwritten. A subroutine return instruction then jumps to the exploit code, instead of the parent routine. This an old trick to implement dynamic jump tables, exploited for malicious purposes.

Re:How/Why does thi skeep happening

[dtfinch]

On x86 processors (and probably most others), the stack pushes backward in memory. Each function call pushes the return address onto the stack. Because the stack pushes backwards, a buffer overflow will overwrite the previously pushed values that follow it in memory. So when the overflowed function returns, it'll return to the new address that has been written by the overflowed buffer.

Good stack overflow exploit code is pretty reusable for exploiting newly discovered stack overflows with little modification, which makes these exploits appear so quickly after a new vulnerability is discovered. There's also something called a heap overflow, but using it to run executable code is quite a bit harder and must be tailered to each specific vulnerability.

Re:How/Why does thi skeep happening

[mr_tap]

On x86 processors (and probably most others), the stack pushes backward in memory As I understand it, this is not the case for PowerPC processors - so once Apple migrates to x86, so potentially a class of exploits will become possible. This is one of the things that I am not looking forward to about the "switch" :(

Re:How/Why does thi skeep happening

[Anonymous Coward]

That address has to be somewhere in the memory mapped to the currently executing process. That includes both the memory used to store the program code as well as the memory used to store any data. The x86 doesn't understand a difference between the two, and until x64 also had no way of marking sections of that memory as non-executable. So the combination of non-protectable memory, a reversed stack and the return address being stored on the stack, combined with languages that have no inherent bounds checking, and you have the recipe for disaster.

All you have to do is find a method with a buffer on the stack of a set size which uses a function to write to the buffer which does not accept and enforce a maximum length and pass it much more data than it expects. The first few bits of extra data will overwrite some of the local variables, if any exist, and the return address of the function. The rest can be the executable code that you wish to call. With a little tweaking you can determine where in memory that executable code will be written so you can target the return address to that location. That's all it really takes.

The No-Execute flag of x64 CPUs help. The stack memory isn't executable so while the overwrite will be successful the return address will point to a section of memory which cannot be executed and the program will fail. However this requires hardware upgrades. DEP and their kin attempt to emulate NX through software however that imposes performance penalties and is not as pervasive as the NX flag.

There are also compiler tricks to try to prevent this problem. One is the canary method where a piece of data is written to the stack just before the return address. This piece of data is randomly written each time at the very beginning of the method and is copied into a second section of the memory as well. At the end of the function it checks to see if the piece of data in the stack still matches the second copy of that data. If not it assumes that something has overwritten a buffer which has changed the return address and the program crashes. These methods are, however, not perfect. It is assumed that a simple canary mechanism will catch 60% of the types of overflows that can be exploited, but that these are the most common vulnerabilities. Of course, to actually be protected the program has to be recompiled with a compiler that supports automatically inserting the necessary code.

You'd think that this would have been one of those obvious things that should have never been possible. However, 25+ years ago nobody thought about security at all, and we suffer today as a result.

Re:How/Why does thi skeep happening

[mugnyte]

If they are recompiling for a new processor, it's pretty trvial to scan the code for known functions that enable attacks such as this. But then you have to change it, which can be a huge undertaking for large systems. Exploits on forward stacks are possible as well, but are debatably more complicated (outright pointer arithmetic operations are a dying breed but live as arrays in C/C++).

Re:How/Why does thi skeep happening

[m50d]

The path to enlightenment

Re:How/Why does thi skeep happening

[DaveM753]

What you said:

"It is a carefully crafted buffer overflow in the stack causing a return address to be overwritten. A subroutine return instruction then jumps to the exploit code, instead of the parent routine. This an old trick to implement dynamic jump tables, exploited for malicious purposes."

What I heard:

"It is a carefully crafted buffer overflow in the stack arf arf arf arf arf. Arf arf arf arf arf arf arf JUMP BOY! arf arf arf, arf arf."

Re:How/Why does thi skeep happening

[HermanAB]

Whazat!? Damn, these earbuds are ruining my hearing...

Bleeding snort rules here:

[Saint Aardvark]

http://www.bleedingsnort.com/cgi-bin/viewcvs.cgi/s igs/CURRENT_EVENTS/CURRENT_WMF_Exploit

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:I'd feign surprise if I felt it was worth it...

[mumblestheclown]

Your argument basically is that:

• computer systems should not be released until they pass some theoretical threshold of security
• and if the above is not done, then the authors of said systems shall be held (financially? criminally?) liable.

In other words, you have just basically killed off free (both as in beer and as in speech) software as we know it.

Not to mention about the fact that we're talking about an exploit in an older DLL that has gone unnoticed for years. Exactly how many years until your theoretical notion of "reasonably" safe is met? If you dont think (OS of your choice) has similar weaknesses, you are deluding yourself. And so what if it 'affects only one user, not the whole system?' To that user, that IS his world.

Re:Virus company

[k00110]

Security companies are useless if they can't protect us. First the Sony Root Kit and now this in a short period of time. I wonder what else we probaly got and don't know about. Their attitude is to be questionned, they are waiting for people to report virus/trojan. What they should do is put up some "ghosts dormant computers" around the net and check if they get infected of any way. They should also browse porn/warez sites more often ;-)

Stop the dupes!

[Skiron]

Why doesn't somebody just *pin* a story (maybe the 1996 one) with the security issues with MS and/or IE and leave it there...

Then we don't need to read about it all over again every 20 days ;-)

I remember the days...

[Anonymous Coward]

I remember the days when only exe and com files were what you had to guard. The day word files became dangerous I thought - why did they put all the functionality in them? Idiots. At least image files and plain text files were safe.

I was eating crow shortly thereafter.
I miss the old days.

Re:I remember the days...

[Waffle Iron]

Plain text files were never really safe if you had ANSI.SYS turned on.

Breaks thumbnails and Windows Picture Viewer

[bogie]

So I'm kind of curious why he states "though I have used the hack on my machine and haven't had any problems yet. " since it breaks basic XP functionaliry.

Anyway, losing thumbnails and that program is IMHO a very minor price to pay for not having your machine rooted. So just make sure and warn others before you tell them to use this temporary workaround.

I wonder how long we will have to wait for MS to fix this one? Oh well, more money for me if they don't.

Re:Breaks thumbnails and Windows Picture Viewer

[jafiwam]

Yeah, so how am I supposed to sort my porn without thumbnails?

I'll take my chances, they still gotta get me to open a stupid .wmf in the first place.

Re:Breaks thumbnails and Windows Picture Viewer

[TedRiot]

According to F-Secures weblog they really didn't have to open the file, it was enough that Google Desktop Search indexed the file..

Re:Breaks thumbnails and Windows Picture Viewer

[bryhhh]

I'd read this before you take your chances, because it appears as though the exploit will work when the .wmf is disguised as a .jpg (or other extensions)

Genius Idiots.

[mumblestheclown]

The people who took advantage of this loophole did so with a clear economic motive. This is because the loophole is used basically to a) install spysherriff, a bogus anti-spyware program and try to get the user to pay for it with a credit card b) install surfsidekick and other idiot spyware programs c) install a spam sender, in order to make a few more billionths of a cent.

In other words, whatever asshat took advantage of this loophole did so because he thought he could make a buck. If his goal was simply to bring Windows to its knees, cause havoc, or make a political/economic statement of some sort, he would have chosen something else. Wiping out My Documents of all the infected machines, for example.

Whoever did this is obviously deluded. While some money will of course ultimately flow from this nonsense to the "see no evil" people who are the beneficiaries of spamvertisements, spyvertisements and so forth, the actual exploiter basically has little to know chance of getting it (even if he is in Russia, as I'd suspect is a good bet) as his affiliate commission links will be tracked, as will wherever the hell that credit card box for SpySherriff was pointing to and so forth.

So we have somebody smart enough (and make no mistake, it takes some smarts) to either discover or be in a small clique of people discovering a quite obscure loophole (it must be obscure, given just how old the affected .dll is), but have ABSOLUTELY NO FUCKING CLUE how to go about exploiting it other than in the most juvenile and unlikely way to fail imaginable. Furthermore, even though it is likely to fail, the guy has shown himself to basically be a psychopath, with little to no concern about the hundreds of thousands of hours (read: PEOPLE-LIFE-EQUIVALENTS) that will be spent agonizing over and fixing this.

Whoever that person is, they are human filth. But, there's a lot of human filth out there. The sad thing is that this person obviously has potential to do so much more but simply pisses it away intead. Pathetic.

Re:Genius Idiots.

[oztiks]

Youve raised a wonderful point which doesnt get spoken about on /. nearly enough and the intents of these people vary quite considerablly. One thing you have to understand that being a cracker like this guy can be considered a profession. I.E pharming DNS, phishing Passwords, and virii distribution, all these things are turning into an actual industry and there is big money to be made. Crackers never play fair and why should they, they are afterall a part of an _underground_ community. I dont mean to promote the behaviour but there is always cause for an effect and it usually isnt dimenta.

Re:Genius Idiots.

[Anonymous Coward]

I thought this way until I read up this week on World of Warcraft gold mining businesses located in China and India where the entire business model is based off of exploiting in-game exploits and exploiting people to make a quick buck. After reading the many blogs I found from Google, I have an entirely different perspective of how people in less economically blessed countries choose to work to make a living.

It's still wrong though.....

Re:Genius Idiots.

[HermanAB]

Here they are. According to their web site the company employs 32 people: http://www.spyaxe.com/

Re:Genius Idiots.

[Gogo0]

I have always wondered why they arent made, and i actually want one to be made and set loose: An exploit that deletes the My Documents directory. Imagine the havoc it would cause.

That is the kind of thing regular people need to experience to wake up and actually care that this sort of thing will go unpatched for a week or two or even longer. Right now patching is transparent to most people, but when they see how some of this stuff just sits on someone's desk while ALL their data goes into the pooper -they'll think that maybe something is wrong.

Re:Genius Idiots.

[Anonymous Coward]

There are a lot of countries out there where people are really smart and hard-working, but there are just no kobs out there. What do you do if you have a family to feed, and you can't get a job that pays enough...no one will hire you. You can get pretty desperate. I can see why people in a desperate situation like that would turn to crime.

Yes, if you have a posh tech job it may seem easy for someone that smart to just get a job. But you (or, should I say, your company) wouldn't hire him. Your company probably wouldn't care how smart he is--you wouldn't hire him because he's not a US citizen, or because he doesn't have five years of PHP or whatever is the latest buzzword the idiots in HR decided you must have.

People are desperate in those eastern-bloc nations and I can see why they end up making these kinds of tough decisions.

Re:Genius Idiots.

[Aceticon]

Gifted but very immature people are also very much on display on the online gaming world.

Somehow the percieved anonimity of the online world will have many persons behaving in an anti-social way in the virtual world, something which they would not do in the real world were that sort of behaviour often has consequences.

Some of them are even gifted at what they do (granted, being gifted in a FPS/MMORPG is not in the same class as being gifted as a software developer).

Re:Genius Idiots.

[magicmonster]

You're assuming that the people who discovered the flaw (which requires talent imo) are the same people that released the malicious exploit.

Smitfraud-C

[HermanAB]

Isn't this just another incarnation of the Smitfraud extortion by the nice New Zealand company SpyAxe?

The tool to remove that crapware is called smitrem, available here: http://noahdfear.geekstogo.com/

Re:Smitfraud-C

[themonkman]

I'm actually quite suprised that SpyAxe isn't sued from MS for using the Windows Update icon for it's system tray item. I've removed this nasty spyware off of many computers, and the lengths that spyware companies will go to in order to look legitimate never ceases to amaze me.

WMF

[Omeger]

People actually use that image file format? I've never used that file format in my life (and never even heard of it before), so no exploits for me! :-D

Re:WMF

[brain defrag]

Oh well. It's best to stick to convention and standards when it comes to file formats anyway. Not to mention how much easier it is to send files cross-platform when the file extension doesn't have "Windows" in it.

Re:WMF

[Lehk228]

old versions of powerpoint and publisher used it for clipart vector graphics

Re:WMF

[Kenshin]

WMF is the only bulletproof way I know of getting CorelDRAW vector files into Microsoft Word. Looks like crap on-screen, but prints-out fine.

Ya, I could just plain embed the CDR files, but OLE (or whatever the hell it's called nowadays) is a bitch.

Re:WMF

[cybathug]

You may never have owned a gun in your life, but someone can sure as hell shoot you with one. Windows has the ability to read and hence be exploited by WMF files regardless of whether you use them or not.

Watch out for Google Desktop

[Repton]

From F-secure's blog:

Do note that it's really easy to get burned by this exploit if you're analysing it under Windows. All you need to do is to access an infected web site with IE or view a folder with infected files with the Windows Explorer.

You can get burned even while working in a DOS box! This happened on one of our test machines where we simply used the WGET command-line tool to download a malicious WMF file. That's it, it was enough to download the file. So how on earth did it have a chance to execute?

The test machine had Google Desktop installed. It seems that Google Desktop creates an index of the metadata of all images too, and it issues an API call to the vulnerable Windows component SHIMGVW.DLL to extract this info. This is enough to invoke the exploit and infect the machine. This all happens in realtime as Google Desktop contains a file system filter and will index new files in realtime.

steps ahead (again)

[fihzy]

Once again, as noted previously here and here:

10) find big remote vulnerability in product
20) perfect the exploit
30) have fun with it for months
40) find another big hole in same product
50) perfect exploit for hole
60) alert vendor about original hole
70) have fun with new hole
80) goto 40

Re:steps ahead (again)

[EiZei]

I find the amount of having fun with holes in this post a little disturbing.

Re:But ...

[HermanAB]

No, you just have to visit a porn site with Internet Exploder to get automatically infected by this worm. It doesn't require any user action, apart from clicking links in normal browsing.

If you are using Firefox, then what you say is true, since FF requires the user to confirm that he really wants to run the malicious program, so the user actually has to click a confirmation button. The infection is not automatic on FF.

Already being used by scumware sites?

[allankim]

Coincidentally I was browsing an ad-heavy lyrics site in another tab (Firefox, of course) and was prompted for an action to handle "track5.wmf" ... Geez, they don't waste any time, do they?

Post to Broadband Reports' Thread...

[TubeSteak]

http://www.dslreports.com/speak/print/default;1512 1004

There's an excerpt of our chat in that post too.

Re:Say it isn't so!!

[raistphrk]

Say it isn't so!! (Score:1, Redundant) by Foofoobar (318279) Alter Relationship on Wednesday December 28, @07:56PM (#14355427) Windows Exploit? Isn't that redundant?

Wow...sometimes, Slashdot ratings really DO match the content in posts!

Layers upon layers

[robotoverflow]

Isn't modding a post about the redundancy of windows exploits as redundant in itself also redundant?

Re:so what else is new?

[EllynGeek]

woo, I am sooo scolded, chastised, shamed, and abashed. I shall now crawl under a rock and die, as you so wisely suggested. Thank you thank you, o wise whoever, for pointing out the error of my ways! I'm a better person for it, even though I'm dead. You may have my dead carcass for making tasty stews, I'm a bit tough for steaks and roasts. BTW, anyone who defends Microsoft's security record is so not credible. But nice try! Hopefully you're getting paid to be that wrong!

Additional Resources

[Heembo]

Internet Storm Center Coverage - Alert moved to yellow as of this morning. http://isc.sans.org/diary.php?rss&storyid=975
Also, take a look at this movie from websense: http://www.websensesecuritylabs.com/images/alerts/ wmf-movie.wmv it shows step-by-step what happens to a clean machine as it gets exploited by this new menace.

Take a preemptive strike.

[CFrankBernard]

Users of PivX PreEmpt (formerly called Qwik-fix) have been protected against WMF vulnerabilities since December 7th. PivX is the company which maintained the infamous 'still unpatched IE vulnerabilities' webpage a few years ago.

Re:Why does /. report so much on Windows flaws?

[The Ape With No Name]

Please indicate a recent worm on an FOSS operating system.

Actual cause of exploit - poor spelling

[jvance]

There is an exposed method in the .dll that has gone unnoticed for years:
ExploitCodeRunningLose()

It has been confounded with a private method,
ExploitCodeRunningLoose()

Lesson: coders should lern2spel.

Re:PATCH!!

[Anonymous Coward]

Umm, numbnutz, there is no patch there. Just an advisory.

Re:so what else is new?

[Ohreally_factor]

Hey, I typed "regsvr32 /u shimgvw.dll" in the terminal, and I got "tcsh: regsvr32: Command not found." Does this mean I was racked or hooted?

Re:so what else is new?

[grcumb]

""Kye-U also has released a filter for proxomitron that will block wmf file downloads[....]"

Careful, The folks at the Internet Storm Center are warning that Windows often ignores the file extension and reads the 'magic bits' at the beginning of the file to decide how to process it. This means that someone could rename a .wmf to .jpg, for example, in order to get it past that filter.

The best workaround currently available is to un-register the shimgvw.dll as suggested above.

Re:How/Why does this keep happening

[Audacious]

There were, in some older file formats, methods for running programs so that images could be overlaid with other images (as in schematics). If I remember correctly AutoCAD and some of the other CAD type files used to use this to link various files in to a give file (like layers on diagrams). Some file formats (one of the GE file formats - can't remember the name right now) actually had such things as the capability to send e-mail built in to the specs. Many of these "gotcha" things have been removed from the file formats now and others were dropped either due to concerns over viruses or just because they were a flash-in-the-pan kind of thing that never caught on.

Like the other poster though - this has nothing to do with an overflow problems. Which, if I remember correctly, first started showing up (for me) with TCP/IP stack overflows and PING of death kinds of things. Not that viruses were not around before this (I remember an IBM PC XT having a list of something like fifty viruses), but the first viruses I actually ran into had to do with the TCP/IP stack overflows and PINGs of death (another type of buffer overflow problem).

But to answer your question - some older file formats for graphics actually had commands in there to execute other programs. Sort of a "Look! You can have this graphics start this other graphic" and so on. You give it the command and the path to that command and it tries to execute it. So long as the program is just on your system there isn't a lot of problems with this. When the program resides on another computer somewhere on the internet and when a company integrates the capability to execute programs anywhere on the net (for whatever reason they may want to state), then it becomes bad news. Because you basically are giving control of your system to the other person.

My big question is - why are they even bothering to ask you for credit card information? Why not first do a scan to see if you have this information already on your hard drive and then just suck the info over the net to their site? I guess that maybe they've already done the search thing, but it doesn't seem (from those reporting in) that a search was already done. It looks more like they just tried to make it seem like you had to pay them to get rid of the virus activity. Maybe they think people really are that stupid. :-/

Re:Why does /. report so much on Windows flaws?

[umrguy76]

You must be new around here...

Re:A security hole? In WINDOWS?

[kimvette]

"hey look at me, I can hurl weak insults anonymously"

Dork.

Small price to pay

[green pizza]

And break a whole bunch of other stuff in the process!

Small price to pay for security. I'd rather give up thumbnails (they slow down explorer anyway) and avoid being r00ted by the latest internet worm.

Re:Small price to pay

[Sarisar]

Doesn't he mean Windows Explorer rather then Internet Explorer? As in the old filemanager for those who remember the win 3 days (and I still remember it was called fileman.exe and was still available in windows NT)

Re:Small price to pay

[I'm Don Giovanni]

It's a very high price to pay considering I don't download WMFs. ;-)

Re:Small price to pay

[CarbonPath]

I agree, just disable the .dll and have done with it.

But how do I tell that to my users at work, most of which can't wait to upload and view all of their Christmas pix?

Believe me, this won't float around here. I'm hosed either way.

Re:I'd feign surprise if I felt it was worth it...

[grcumb]

"Your argument basically is that:"

• computer systems should not be released until they pass some theoretical threshold of security

Sounds reasonable, except that the threshold should be measurable. This is relatively easily achieved, even in very complex applications, if responsible coding practices and code management are used. I refuse to work for companies that do less than that, and avoid recommending any software that wasn't developed using that method. Which, of course, is why I've only supported *nix servers from about 1999 onwards.

• and if the above is not done, then the authors of said systems shall be held (financially? criminally?) liable.

I don't want to put words in the GP's mouth (it's unsanitary), but IMO software should be warrantable just like any number of other products. There is a de facto expectation of suitability to use, EULAs notwithstanding, and it only remains for law to catch up to consumer expectations.

My preference would be to see financial liability for software vendors measured as a proportion of the sale price, except in cases where software failure directly caused death, disability or significant loss of property.

"In other words, you have just basically killed off free (both as in beer and as in speech) software as we know it."

Not at all. Under the model I've described above, only those companies who package and sell the software would be responsible for maintaining a certain degree of quality. Hackers in the FOSS community would not be directly liable for releasing a no-cost application, unless it actually kills people, which is somewhat unlikely. 8^)

I think that decent software quality is achievable. I've seen it done. One company I worked for not so long ago ran a network operations centre whose management software had a six week development cycle. Two weeks of design, followed by two weeks of development, followed by two weeks of testing.

This had a very salutary effect on code quality, not the least of which was that stupid errors (e.g. syntax mistakes, border conditions, fencepost errors etc.) never saw the light of day. But the biggest benefit was that the cost of failure was low. We deliberately worked in small increments for this very reason. Even if a new feature turned out to be a steaming pile, we'd typically find out before release. But even if we didn't, the cost of rolling back was very low.

Now, I realise that this particular model doesn't apply directly to a number of areas, not the least of which are desktop client applications. But consider that if this incremental development approach were used internally (i.e. without constant public releases), the same practices could be used. This is only one example, though, of the many ways in which code quality can be improved without undue effort or expense.

One key to ensuring quality is frequent review and auditability of the code. This of course puts developers of proprietary applications at a bit of a deficit, but heck, them's the breaks. 8^)

Broke thumbnail feature - big deal

[green pizza]

This workaround broke thumnail view for me in explorer, but it's no big deal, thumbnail view looks pretty but it slows down explorer. At least you have a choice -- being r00ted by some new worm or lose one little eyecandy feature.

Nasty!

[sdh968251]

This thing is nasty! I was browsing the internet this afternoon and got it. I have a fully patched copy of Windows XP SP2 with Symantec Antivirus Corporate 9.0. Neither stopped it. I spent about 6 hours running virus scans, Ad-Aware, and Spy-Bot in safe mode. This didn't even come close to detecting everything. I had to manually remove files based on searches by creation date. Interestingly, none of the three tools picked up any of the DLLs mentioned in the next paragraph.

I traced it to an ad within an ad within an ad that sources a WMF file in an iframe. If you want to see this thing in action then use VMWare to load the following link: h**p://iframeurl.biz/dl/xpladv470.wmf. After all is said and done, you'll have trojan.byteverify, trojan.dropper, trojan.bookmarker, download.trojan, w32.conycspa.G@mm, backdoor.shellbot, backdoor.trojan, w32.looksky.A@mm, among others. I also had some new DLLs that were particularly hard to get rid of - msupdate32.dll, msctl32.dll, uytpu.dll, qrlmq.dll - all in the system32 directory.

This has actually never happened to me. I am religious about keeping Windows and my antivirus software up-to-date. It was a good learning experience to see it all in action.

And, by the way, I was not browsing for porn. I was doing a google search for a old Macintosh program named Cache Killer. One of the links listed was "Download Cache Killer Pro v5.0 crack / keygen / serial / patch ...". I clicked on this and ... WHAM! Here's the Google search - http://www.google.com/search?q=cache+killer&hl=en& lr=&start=0&sa=N. It's the last link on the page - h**p://www.crackz.ws/down/25335/Cache.Killer.Pro.v 5.0_crack_serial_keygen.html. This is the page that contains the ad within an ad within an ad. Beware!!!

Re:Nasty!

[toddestan]

Out of curiousity, were you browsing in Internet Explorer or some other browser? I'm half tempted to click on those links in Opera to see what happens, but I don't particularly feel like rebuilding my Windows install at the moment.

Re:Nasty!

[sdh968251]

Actually, I was browsing in Firefox 1.0.7. I was not prompted or anything. I have since upgraded to 1.5 (shame on me for not having done that a while back) and this version at least prompts to open or save the file. If you open it then your infected.

Re:Nasty!

[klui]

There is a prompt. I tried this under VMWare Player and FF1.0.7 displays a dialog box that asks me if I wanted to use wmffile (default) to display this file. When I click OK it installed the programs.

Re:Nasty!

[symbolset]

I was interested in this xpladv470.wmf file you posted a link to, so I downloaded it with Firefox to my desktop.

Unfortunately, I can't seem to get this exploit business to work. It just sits there like any other image file, doing nothing.

Sadly, like other .wmf files, it won't even display.

Do you know of any software I can get for Fedora Core 4 that will help me explore this situation further?

Re:Nasty!

[J. Random Luser]

Good news: Google seem to have pulled that link, but
Bad news: the file offered for download is dsi_ckp5.exe which is not likely to run on your Mac.

The site is infested with the usual warez crop of pr0n & gambling camp followers. I went there using Safari on a Mac, and collected a cookie from fuck-access.com, and exhibitionist.ws, which will both be valid for 15 years ;-) I had my access counted by ads.clicksor.com, banner.paypopup.com, counter.yadro.ru, gfx.passwordbyphone.com, popunder.paypopup.com, t0.extreme-dm.com, and that's without any malware...

Of course fwiw crackz.ws is one of the anchor sites for this exploit as listed by F-Secure, and it's still up at the time of this posting :-(

Re:Nasty!

[tokul]

> And, by the way, I was not browsing for porn.

You have browsed to warez site that exploits anything in order to get something installed on client's machine.

Re:Nasty!

[themonkman]

If your running Fedora Core 4, the only way that your going to be able to simulate this exploit to run on your machine is either: 1.) Be running VMWare and install Windows into it, 2.) Dual boot into Windows and try it, if you have it installed. This exploit, like nearly 99.9% of other Windows exploits don't apply to us Linux users. Even a better reason never to go back to M$ software, besides the fact that it costs far too much.

Re:Nasty!

[MyForest]

Some real estate agents in the UK use WMF files to show the floor plan. They didn't even realise as they are using a generic house-selling application from some vendor. When I was looking to buy a house I used the following command under Fedora Core 4:

convert xpladv470.wmf xpladv470.png

and all was revealed.

Unfortunately my Fedora Core 4 is also failing to install the viruses - I feel so left out.

Re:Nasty!

[Bert64]

Aparrently windows is too much trouble to use as an unprivileged user.. I have had this exact same argument with MANY people, even supposed "security professionals".. They argue that windows is far too inconvenient to use as an unprivileged user, and yet they stick to using this "flawed design" in an unsafe manner..
If it cannot be used in a safe and secure manner then it's UNFIT FOR USE, and should therefore not be used.

Re:Nasty!

[Keebler71]

I run XP Home as a limited user and it really is not that hard at all. Right-click -> run-as (admin, **********) ta-da. I never even log on to my admin account. The real problem are the software developers who refuse to let their programs be run from a limited account if they were installed from an admin account. This has gotten a lot better, I am down to one program that won't run from a limited account - most of these were older games btw. So you just "run-as" them or alternately, use CACLS to give the limited account access to the folder in question (that usually doest the trick).

In summary, the real blame should be placed on the developers and somewhat to Microsoft for not making the user create a limited account during install.

Re:Nasty!

[eatmadust]

you feel left out?
I can't even use convert properly ...

sh: wmf2eps: command not found
convert: Delegate failed `"wmf2eps" -o "%o" "%i"'.

Re:Nasty!

[ccsp]

Ever heard of Cisco Security Agent? Stops it dead in its tracks! Even an out-of-date version of it -- I tested this on a Virtual PC installation of Windows XP with CSA that I had laying around from March, 2005, and CSA caught it, just as I expected. Cisco Security Agent is an EXCELLENT protection against "Zero-Day" attacks, this one included.

Re:Nasty!

[WhiteWolf666]

Both GDI32.DLL and the WMF DLL run with Administrator privlidges, apparently. User accounts won't stop it.

I believe LUA accounts do stop it, however, they aren't an option on XP.

Microsoft has released a security note

[Rosyna]

See http://www.microsoft.com/technet/security/advisory /912840.mspx for all the goodness than can only come from MS. It just gives the same info given other places but is done in an official capacity.

Re:Microsoft has released a security note

[Dave AM]

Sounds like the lawyers thoroughly edited these lines:

"Microsoft is aware of the public release of detailed exploit code that could allow an attacker to execute arbitrary code in the security context of the logged-on user, when such user is visiting a Web site that contains a specially crafted Windows Metafile (WMF) image. An attacker would have no way to force users to visit a malicious Web site. Instead, an attacker would have to persuade them to visit the Web site, typically by getting them to click a link that takes them to the attacker's Web site."

Microsoft makes it sound like we have nothing to fear, because the attacker can't make you go to his site, but how many times a day do you misspell a URL and go to some strange site?

Luke: "I am not scared master."
Yoda: "Oh you will be, you WILL be..."

Re:Microsoft has released a security note

[Bert64]

Or cross site scripting, you could exploit a bug in a trusted site to get it to redirect or load an image from a malicious site..
Or how about ebay, when you place an auction you can specify a url to an external website containing a picture..

Re:Microsoft has released a security note

[daviddennis]

Could this exploit be hidden in a normal-looking image?

What if you uploaded this type of image to Flickr, and it was a nice image and people rated it well?

That could be a very successful attack and you wouldn't even have to get hosting for it.

D

Re:so what else is new?

[tonyr60]

Neither. You are just one of the .00001% of /. posters that don't run Windows.

The file extension is not critical

[whitehatlurker]

I want to point out that the file extension is not used exclusively for file type detection, and the magic string at the beginning of the file will trigger the use of the WMF processing. A ".tiff" extension will also work in a similar manner. (Likely there are several good candidates.)

A few people on this thread don't seem to be familiar with the WMF format or GDI. This format provides for a set of commands which are supposed to be graphics only. (I guess they got carried away in this case.) As the viewer is basically a scripting engine, the exploiters would certainly try to target it for vulnerabilities. I don't have a copy of the dangerous file, so I don't know whether this particular exploit is a buffer overflow or something else.

Re:The file extension is not critical

[Dave AM]

If I understand you correctly, a tiff file could actually be internally labeled as a wmf file, and if you download a tiff you may actually be downloading a keystroke logger. So just how many pic types can be interpreted as wmf files?

Trojan pics may be kept as a safe tiff on your patched system only to become a keystroke logger when emailed to your relative's unpatched system.

I fear the Internet may be down at work sometime this week because companies will have to stop using IE until the next MS patch is released.

http://en.wikipedia.org/wiki/Windows_Metafile/
(If any pic can be loaded from a web page, can we even trust your Wiki?)

Re:The file extension is not critical

[Bert64]

The problem stems from windows users assuming that the file extension has anything to do with the actual content of the file.
IT DOES NOT.
If you rename the exploit code and call it "blah.jpg" it doesn't become a jpeg image, it's still a windows metafile containing exploit code.. Some incredibly stupid apps (and users) may be fooled into believing it's a jpeg, but windows itself will load the first few bytes of the file and determine what it really is.
The "file" command on unix is very usefull to find out what a file really is, it ignores the filename and reads the file contents.

Re:The file extension is not critical

[Q2Serpent]

Here's the stupid bit - Windows DOES use the file extension for MOST files - if you double-click a .mov, QuickTime may open, but then if you rename it to a .mp3, Winamp will open. So why does Windows need to scan only some files, and screw everything up? People have been trained for the past 6 years that the file extension is the important part on Windows because it mostly is. I wonder why it isn't in this case.

Re:The file extension is not critical

[whitehatlurker]

The file extension, as someone else noted below, isn't the sole basis for determining how a file is handled. There is also a mime-type which is set by the web server, and also the "magic numbers" or signatures which can identify a file inside the file itself.

Someone else notes that you could call it a .jpg file. This will work to some extent, but usually the web browser knows that it can handle jpegs and will try to render it as a jpeg and note that it can't. (File is corrupt.) There may be problems with Internet Explorer using the same routines as the vulnerable programs. I use Opera, don't know about IE, sorry.

The file will get downloaded into your cache, and may cause problems later.

Perhaps browsing with images off is the best solution until this gets rectified ;-)

If any pic can be loaded from a web page, can we even trust your Wiki?

It's not my Wiki ;-) anyone can put stuff there. There is a minimum amount of paranoia one should have at all times. There is also a maximum amount one should have at any time.

Re:The file extension is not critical

[Bert64]

Well it sees .wmf and passes it to the image library, then the image library tries to determine what the file really is.. So if you rename an image file so it has the extension of a different type of image file, it still works.

Re:The file extension is not critical

[Q2Serpent]

That makes a little more sense (so you are saying if I renamed it to *.txt, it wouldn't exploit the flaw in the wmf file handling because it'd open with notepad). However, I assume this works for *.jpg or *.gif because they also open with Windows Picture Viewer by default? Surely if I have *.jpg set to open with something written against a different image-reading library (gimp?) I'd be ok. Just confirming that Windows actually does use the file type on its own to determine which app to open a file with.

Re:The file extension is not critical

[Bert64]

Windows uses the file extension, not type (never confuse the two) to determine what to use to open a program, so yes your correct in that if you configured it to load such files with gimp you'd not be exploitable via that avenue..
The trouble is things windows does behind your back, like generating thumbnails..

Re:The file extension is not critical

[zerofret]

I once had to chase down what appeared to be a webserver problem, that eventually turned out to have been caused by Windows incorrectly autodetecting a filetype based upon the "Magic String".

The server was set up to archive files generated by our operations folk. These files are plain old ASCII text, and have no file extensions. One particular file was constantly coming up as an invalid file format in the browser. Remoting into the server and opening the file in vi showed no problems, it looked like any other text file in the archive.

After much hair pulling and gnashing of teeth, I eventually tried to do a 'Save link as...' to download the file to the Windows box, and discovered the file save dialog was defaulting to Windows Bitmap (BMP). Turns out that the 'Magic String' for the BMP file format is an ASCII 'BM' in the first two bytes of the file. This text file started with those two characters.
Reference BMP: http://www.fileformat.info/format/bmp/egff.htm#MIC BMP-DMYID.3.2/

Apparently when Microsoft designed the BMP format, they assumed that nobody would ever use those two characters to begin a text file. They probably also assumed that any text file would have a TXT file extension. Since file extensions don't really mean anything to the OS in the Unix/Linux world, we never saw a need to put extensions on these files.

At any rate, after seeing first hand how easily Windows can incorrectly autodetect a file type, I have no problem believing this attack can succeed with an extension other than WMF. The black hat just makes sure his attack has the right magic string in it and he can give it any extension he wants.
Reference WMF: http://www.fileformat.info/format/wmf/#MICMETA-DMY ID.3.1/

Microsoft Corporation

[Penguinoflight]

... let this one loose. It is a problem with windows, and it was disclosed by a responsible hacker. If you want to protect the general population still using MS software, this is the only option. Microsoft isn't about to make a secure platform on their own, so until the next big mistake hits the news they wont do anything about it.

If anything, we need earlier reporting so the public can realize just how little microsoft cares about security.

Re:Virus company

[pallmall1]

They should also browse porn/warez sites more often ;-)

I'll bet they browse them often, but they're looking for XXXploits instead of exploits. :)

Re:But ...

[jliendo]

not sure about the "you are going to get inffected if you are browsing porn sites"...if an attacker is already performing an arp spoofing attack he can easily redirect (dnsspoof) any web traffic to a web site under his control so under this scenario, any vulnerable explorer browser may get exploited regardless of the site it is visiting (it could be CNN's, whitehouse.gov, etc.)...

Hmm

[Azureflare]

I would say about 80% of the comments on this site tend to be pretty evenhanded in their treatment of windows security. If you actually read comments on stories about windows flaws, you would see that the people that get modded up are those that say "really, this isn't that serious, this is just Anti-MS stuff." You don't see people saying "OSS RULES MS SUCKS" getting modded up. Sure, people making jokes get +5 funny, but so do the people making jokes on the firefox articles about firefox vulnerabilities. Jokes get modded up not necessarily because they're true, but because they identify with a common recurring theme.

The fact is, the impression that slashdot is anti-MS and pro-linux is wrong. We just like to know about vulnerabilities in an operating system that 90% of computer users have installed on their systems, and utilize every day. Not many people care about vulnerabilities in gqview for gnome (to take a random app for example). There are just so many apps that are not core to the system. Now, if there was a vulnerability in PHP or Apache that had an exploit in the wild, then that would make the news I'm sure.

Honestly, I think someone should go through all the windows vulnerability stories and count the number of anti-ms, pro-ms, and the smart people posts (i.e., those who realize that simply bashing an OS because of a discovered security flaw is silly, because all Operating Systems have flaws). In the end I think you would see that the majority of people on slashdot do not see Microsoft Windows as the Ultimate Evil. I could be wrong of course. I'm not exactly an authority on the subject. I haven't gone through counting the number of posts.

BTW where on slashdot does it say it's geared towards linux users?

Re:Hmm

[Anonymous Coward]

You are missing the point!

If you actually read comments on stories about windows flaws, you would see that the people that get modded up are those that say "really, this isn't that serious, this is just Anti-MS stuff."

Really, this is serious, M$ cannot code a simple image viewer without creating a new vulnerability! This has already happened once (just search for JPG vulnerability); now it has happened in a format that M$ championed because they didn't like NIH! and they still fscked it up!

You gotta wonder: are they capable at all?

this may sound bad but

[Revek]

Hell bring it on. I opened my own shop about 4 months ago and can clean most anything off a machine. Its 95% of my buisness so far and im tired of being poor. This week alone Ive cleaned 8 xp home boxes all still sp1 with no antispy or antivirus still running. Only one of the machines needed parts. It had a winlogon popup running that killed windows update and automatic update (senslogn key was missing). I think the real proplem with the current state of affairs is not that the exploits are produced and released but that microsoft builds to fast and to often. They need to can vista and put more R&D into fast fixes. If they want discreet disclosure of exploits they should offer $$ for it. Just tell them and get a check :)..... nah never happen they will just build the new big security hole called a OS.

Re:this may sound bad but

[pe1chl]

It always amazes me how Microsoft can have a resource problem, or at least a claimed one.
Doesn't this company earn enough money to hire separate teams to work on new products and maintenance of old stuff?

Re:Why does /. report so much on Windows flaws?

[lumber_13]

because nobody bothers other than few /.ers to use Foss anyway. 95% desktop runs Windows, 3.5% OSX and rst may be 100s of flavours of *nixs. So why would bother to write any exploit for them?

wmf?

[digitaldc]

I hear Windows Vista is going to fix all of these previously unknown problems...stay tuned for the exciting conclusion in 2006.

Re:wmf?

[Jarth]

there's surely something about you i cannot quite put my finger on yet ...

Interpretation vortex

[Pete]

From the summary: "...and exploit code is now running lose..."

For a second - just for a second - I thought this might be an extremely clever play on words, making fun both of Windows ("Win") by referring to it as "Lose" (as the exploit code would be running on Windows and controlling it, so you could (in a slightly ungrammatical way, but whatever) say the code is running Win, or indeed Lose) and combining this with a witty rejoinder at all the individuals who write "lose" instead of "loose" (and vice versa), emphasising what losers they are.

Then I remembered that this is Slashdot.

Sigh.

Hmmm, I think I remember them

[porkThreeWays]

Was Thor Larholm ever assosiated with this company? As my memory recalls, he had an extensive list of his own, and I'm thinking maybe they are on in the same.

Re:Hmmm, I think I remember them

[CFrankBernard]

Yes. http://www.webservicessummit.com/TLarholm.htm

Does it affect LUAs?

[QCompson]

Anyone know if you can get hit with this if you are running a limited user account?

Re:Does it affect LUAs?

[jofi]

It dies in LUA.

Some of the things it does requires admin, so it wouldn't totally be a question of just file system permissions.

Re:Does it affect LUAs?

[Mancat]

This is a question that needs to be answered, like, right now. I'm using a LUA, but I'm not sure if I'm protected as such. I would bet that I am, but I'm not about to try.

Re:Does it affect LUAs?

[FoamingToad]

From the security focus posting (http://www.securityfocus.com/bid/16074/discuss):

"The issue may be exploited remotely or by a local attacker. Any code execution that occurs will be with SYSTEM privileges due to the nature of the affected engine."

Under this circumstance I would expect that having a limited user account will not offer you any degree of protection, as the malware is running at system level.

F_T

Re:Does it affect LUAs?

[Mancat]

But what allows it to take on SYSTEM priveleges? Is there a privelege escalation exploit being used by the bug, or is it allowed to do so because most users already have Administrator priveleges? There are simple tricks that allow any Administrator-level Windows user to take on SYSTEM priveleges. These don't work for limited user accounts, without the help of a privelege escalation exploit.

Re:pr0n sites are FAST!

[ChimaeraX]

I clicked on the link and was prompted by firefox if I wanted to open the file in xine or save it to disk. What should I do? If I open it in xine, will crossover office install the malicious code and then I will be infected by M$ sploits? I'm at a loss. Should I open it in xine or save it to my home directory and view it later?

Re:But ...

[HermanAB]

Sure, though I would like to think that whoever is running the DNS for the Federal Gov or AOL, would be reputable and won't spoof things and try to infect visitors. Therefore, one would usually only pick up fluff from sites of ill repute.

Re:Holy cats

[srite]

And was the code 100% bug free all the time ?

To err is human To err always is MicroSoft...

Re:But ...

[jafiwam]

Confirming what Herman states above.

A user on my network got this thing about two months ago. It's been around a little while.

(Spyware Sherriff installed, keylogger, IRC bot and swears up and down didn't do anything but visit a web page.)

Had to format the machine. At least it was ready for it.... but damn!

Why blame porn sites?

[I'm Don Giovanni]

Porn sites != "sites of ill repute", necessarily.
Warez sites are more of ill repute, and are the cause of most virus infection.

Re:Why blame porn sites?

[HermanAB]

Here are some details:
http://www.f-secure.com/sw-desc/spyaxe.shtml

Here is the very nice NZ company behind it:
http://www.spyaxe.com/

and for a quick infection just go here:
www.needupdate.com

or here:
http://www.dns404.net/

sigh...

Explorer is Explorer... and a stupid IRIX trick

[green pizza]

Doesn't he mean Windows Explorer rather then Internet Explorer?

The Windows file manager is the same thing as Internet Explorer, and Control Panel for that matter. Don't belive me? Change the path sometime... load up "http://www.google.com", then change the address to "C:\" or "Control Panel". Or conversely, open the control panel from the Start menu, then change the address from "Control Panel" to your URL of choice.

This kind of works with the file manager in IRIX 6.3+, although it's HTML engine is very outdated. Open up any file manager window and change the path to a URL, such as "http://www.google.com"! Neat stuff back in 1996...

Re:Explorer is Explorer... and a stupid IRIX trick

[Sarisar]

Yes, OK you can browse through windows explorer, although it uses a different executable to run (according to my firewall anyway) and I've got my firewall blocking that (and a lot of IE as well). I was trying to say that I thought my original post's parent was talking about windows explorer, not internet explorer as in looking at his own thumbnails and not on the internet like the parent was suggesting. Actually that doesn't sound much clearer.

This is also the same as the linux one that I can't remember the name of IIRC (I keep dipping in and out of linux, when I get sorted with another machine I will put some flavour back on my laptop but until then I want to play games and I have the windows versions so still need it). Konqueror is it? I'm sure someone will flame me for being on slashdot and not having linux now...

Re:Explorer is Explorer... and a stupid IRIX trick

[drsmithy]

The Windows file manager is the same thing as Internet Explorer, and Control Panel for that matter.

By that logic, Firefox and Flash Viewer are one and the same.

Re:Explorer is Explorer... and a stupid IRIX trick

[rikkus-x]

This is also the same as the linux one that I can't remember the name of IIRC (I keep dipping in and out of linux, when I get sorted with another machine I will put some flavour back on my laptop but until then I want to play games and I have the windows versions so still need it). Konqueror is it?

Yes, Konqueror does this. It loads components which perform tasks such as showing a PDF, a directory, or a web page, and put their drawing/interacting area inside its window.

That's what you get for browsing for warez

[I'm Don Giovanni]

Silly rabbit, don't you know that pirated warez sites is much more dangerous than browsing porn sites? This'll learn ya!!

Re:That's what you get for browsing for warez

[sdh968251]

Curiosity killed the cat.

this workaround causes another bug

[ffflala]

This workaround makes one unable to view thumbnails when you're uploading images.

slashdot has no cred regarding MS stories

[I'm Don Giovanni]

The /. threads themselves regarding MS have gotten less bias over the past year, but until /. stops using the Borg icon for Microsoft stories and broken stained glass for Windows stories, /. has no credibility regarding Microsoft stories. Every other topic has a neutral icon without editorial spin.

Re:slashdot has no cred regarding MS stories

[Slashcrap]

Dear I'm Don Giovanni,

Many thanks for your defense of our company and products on the evil Linux site Slashdot. We rely on people like you, as we are unable to afford our own marketing department. As a token of our thanks, please accept this summons for unauthorised use of our trademark "Windows" in your comment.

Thanks again,
Microsoft

Watch out, it's a hoax!

[ichigo 2.0]

Installing that patch took almost an hour, and when my computer restarted the internet is missing from the desktop! And I can't find bonzi buddy anywhere, I think my Windows got formatted!

Surprise!

[gmuslera]

I suppose that an exploit for a windows flaw should count as #11 MS surprise (specially in the unpatched part) in this list, no?

Er... wait, where is the surprise in this?

Re:PATCH!! NOT!

[thirty2bit]

It's not even a patch, but an advisory! Furthermore, Microsoft's "advice" is to "keep your antivirus software up-to-date, and download Microsoft's AntiSpyware Beta"

Great. An <duh>obvious</duh> recommendation, and an invitation to load more junk (beta!) Microsoft ware.

huh?!

[subtropolis]

My big question is - why are they even bothering to ask you for credit card information? Why not first do a scan to see if you have this information already on your hard drive and then just suck the info over the net to their site? wtf?

Re:huh?!

[Audacious]

Ok, I hate stating the obvious but....

Everyone who has posted about this virus just says that it asks for your credit card information. No one (as far as I've read) has posted anything about the virus scanning your hard drive for credit card information and/or encrypted information. Therefore, my question.

Re:Why does /. report so much on Windows flaws?

[HermanAB]

Because it is us Linux advocates who get called in to fix all the Windoze machines. Fixing MS Crapware is actually a major part of my revenue...

Re:Why does /. report so much on Windows flaws?

[HermanAB]

Well actually, there are many times more Linux machines in the world than Windows machines. Windows only dominates the desktops. Linux dominates servers, routers, cell phones and so on. Last I saw, IBM Marketing estimated that there are more than 2 billion Linux systems in the world (mostly cell phones).

Re:pr0n sites are FAST!

[HermanAB]

Nah, doesn't work in CxOffice. SpyAxe won't work in CxOffice either. I even downloaded the program and ran the installer and it just sat there. We should complain to http://www.spyaxe.com/ since they are discriminating against Linux users.

Re:Don't think so.

[NaDrew]

Also, take a look at this movie from websense: http://www.websensesecuritylabs.com/images/alerts/ wmf-movie.wmv it shows step-by-step what happens to a clean machine as it gets exploited by this new menace.

Somehow I'd be a little more reasured if the exploit movie was in a different file format than the exploit. Quicktime maybe?

WMV = Windows Media Video
WMF = Windows Metafile
They are not the same format. Which is not to say that there may not be vulnerabilities in WMV.

Essential part of Windows experience

[HermanAB]

Linux just isn't ready for the desktop yet, since these programs are obviously an essential part of the Windows experience and they just won't run on Linux.

Re:How/Why does this keep happening

[Da Web Guru]

Maybe they think people really are that stupid. :-/

Well, in many cases, yes, people really are that stupid.

Re:Don't think so.

[Heembo]

http://www.websensesecuritylabs.com/ is a reputable security provider that I have personally done business with as Director of Vendor Relations at SANS. I did not post that URL lightly.

Re:Don't think so.

[Heembo]

Ok, to calm your nerves, here is the screenshot version: http://www.websensesecuritylabs.com/alerts/alert.p hp?AlertID=385

Re:Don't think so.

[NaDrew]

I did not post that URL lightly.

You're replying to the wrong post. I was disputing AC's suggestion that your link was somehow dangerous.

MS's Advice...

[Val314]

http://www.microsoft.com/technet/security/advisory /912840.mspx
"Microsoft encourages users to exercise caution when they open e-mail and links in e-mail from untrusted sources."

well... not really helpfull, but when MS has a patch, it should be linked on this page

Re:The fix was released months ago

[Richard_at_work]

Problem is, that patch breaks more of my programs and utilities I like to use than Windows XP SP2 did. How can I fix this? Someone told me I needed Wine, but I fail to see how getting drunk will solve anything!

sneaky thing - Mozilla 1.7.12 affected

[quick_dry_3]

bugger, I wish I'd read /. before browsing porno this afternoon.

despite it saying you must agree to something, my XP SP2 laptop got hit by this this afternoon - no 'downloads', just happened to browse to a porno page that wanted to auto-start a download of:
http://85.255.115.171/bt/7/wmf/wmf_dcode.wmf

I clicked no, I didn't want to run or save the file... but a few minutes later, up came the spyware. First time this box has been infected. This was on Mozilla 1.7.12

Re:sneaky thing - Mozilla 1.7.12 affected

[pe1chl]

This bug is not in the browser, but in a document handler on Windows. So it does not matter which browser you use.
When you open a .DOC file with a Word Macro virus it also will not matter if you get it via IE, Mozilla, FTP or a diskette, the virus affects Word.
In this case the GDI is the affected component.

is that all?

[thegoldenear]

Is that all the hackers you can come up with?

Firefox and the .wmf trojan...

[Hamster Lover]

Friend of mine sent me a link to some topless video of whatever movie star he thought was hot. Being only mildly retarded but not completely so I fired up Firefox and disabled Javascript before I opened the link. I was asked by Firefox if I wanted to open or save a file called "xxxxxx.wmf" and I canceled the operation at that point.

Score one for Firefox.

Google desktop indirectly runs the malicious code

[Gopal.V]

According to the article, Google desktop was partly responsible for executing the code - even when the file is being downloaded without IE.

This means that you firefox users are also vulnerable (and what user does Google desktop run as ?)

Registry key for confirmation?

[dreamer-of-rules]

I want to confirm on all systems at work that the WMF viewer has been unregistered with "regsvr32 /u shimgvw.dll". This command modifies the registry in some way to disable the .dll. Would anyone know what specific registry key is changed? I can easily check registry settings on all the work machines, and I'd like to to make sure that the fix above worked for each system. Thanks in advance.

Re:Registry key for confirmation?

[gonk]

Consider this:

      http://www.sysinternals.com/utilities/regmon.html

robert

About the WMF format

[Nurgled]

The WMF format is simply a stream of GDI commands. GDI (Graphics Device Interface) is the Windows API and abstraction layer for graphics, allowing the same set of drawing functions to be targetted at a variety of different "device contexts" such as printers and the screen.

A WMF file is (traditionally) created by obtaining a device context on a file and drawing to it using the GDI API functions, which "records" the sequence of commands to disk ready to be replayed later to recreate the image. These days, of course, there are libraries and applications which read and write WMF files directly, such as libwmf. There's little practical use for this format outside of Windows development, however.

There's a second format called "Enhanced Metafile" (EMF) which is a newer, 32-bit version of the WMF format introduced with the 32-bit Windows API.

Re:Is Windows 2000 vulnerable?

[Nurgled]

Since the vulnerability is apparently in GDI32.DLL, I'd guess that every version of Windows going back to Windows 95 is vulnerable, since metafiles have been around since Windows 3 (I think?) and GDI32.DLL was introduced with the 32-bit Windows API.

AH, I miss the 90's

[SmallFurryCreature]

Those wild days when the sky was the limit and the internet was called the information superhighway and you could run an succesfull company with half the workers playing on the consoles drinking beer.

Oh and those wonderfull windows exploits, works, spyware, wild tangent, trojan horses, worms and blue screens. And then, linux. What I never thought I could afford happened. I had a unix at home. It looked just like the real thing. Root easily accesible from your user account to make it workable to split your accounts. Didn't you hate it when in windows if you wanted to install any software no matter how trivial you had to logout and login as admin to do it and the only way to get some work done was to always get admin privileges on every machine?

Nowadays when someone gives me the root password on a unix like machine I always demand a pay raise. It probably means they expect me to fix it in the weekend.

Thank you MS for making me stick with linux. The energy bill had me y contemplating scrapping my dual P3 linux desktop and only keep my P4 gaming rig. Windows 2003 is actually pretty stable, now all they got to do is clear the goddamn fucking security holes.

Geez, just a few articles ago people were actually talking about how MS was changing and bam we get the mother of all exploits. The only thing worse would be a worm. This is so easily exploitable. Just make an account on forum that allows those awfull avatar images and bam.

I can't believe the slashdot reader reaction either, first bunch of posts are some insane ramblings about hackers/crackers and the rest have some insane fix that even the most moronic idiot can see is a total failure.

Yes fucktards who suggest that whole unregister crap, because of the way MS has setup its OS many a windows program comes with its own copy of the dll it uses EVEN if it is a copy of a Windows OS dll. To avoid versioning problems it is easier to include it then hope the user OS has the right version.

Do a dupe check your dll's in the main windows directories and where you install your programs some times. What do you think the chances are they will all be patched? It is a well known problem and in fact one of the reasons the whole dynamic linking idea was so attractive.

Re:AH, I miss the 90's

[Dave AM]

Perhaps this flaw hurts so much because many people who thought they were computer savvy found themselves as vulnerable as everyone else. Remember the first pop up windows that had fake close buttons? With the introduction of this new image file flaw IT professionals are reminded how the novice feels daily.

This MS image file flaw is further complicated because so many fixes contradict each other and leave systems vulnerable. Security professional may want to step back and focus on the real problem.

1. Microsoft needs to declare a new wmf standard.
2. All programs using flawed dll's need to be clearly listed on one of Microsoft's security sites.
3. Microsoft Update must request updates from each vender to be automatically distributed via Microsoft Update.

While I'm no MS fan, I hope this issue is quickly resolved.

AdBlock

[jackbird]

Will Adblocking *.wmf stop a malicious site from infecting me?

Nasty but Brilliant

[microcentillion]

Like you I was surfing around this morning and I got nailed by it. I went to open a page, and suddenly 'Windows picture and fax viewer' popped up blank for about a quarter second, and went away. I am on my friends computer (because he leaves it at my house, and it is faster than mine), and luckily I installed spyware doctor a few hours earlier. It went nuts. I had about 400 attacks within 30 seconds, and it blocked all but the spysherrif. I ran an antivirus scan and got it all off before it could finish doing anything, so I barely saved it. That was some scary sh*t though.

What are FOSS devs doing about a future threat?

[cornev]

As a Linux user, I do worry that Linux distro's could end up as bad as windows in say 10/15 years time. I realise that as linux users we do things differently, like run regular user accounts etc. bla, bla, bla; but it would be interesting to find out how the FOSS development community take into account the potential threat of a community of crackers targeting unix systems.....mmmmmmmm......

come on!

[crashelite]

lets see here this will take M$ about 2 weeks to fix AFTER half their users become affected by it

What does WMF stand for?

[tepples]

the flaw is not critical since no-one actually uses WMF

Unless a site trojans your computer by getting an inexperienced user to confuse WMF ("Windows Media File"?) with WMV.

WMF? Is that some new kind of WMV?

[tepples]

Movie? Read up on Windows Meta Files, it's static images.

Inexperienced users are the target of such attacks, and they're not likely to have "read up". It's like those trojans that prey on people who think command.com is the domain of a web site.

Re:Why does /. report so much on Windows flaws?

[jayloden]

http://linux.slashdot.org/article.pl?sid=05/11/08/ 140203&tid=220&tid=106

I'm no Microsoft fan, but Linux and Unix boxen aren't invulnerable.

And here's how a Windows 0-day works over Wi-Fi

[b33t13]

Beating the rogue access point (AP) dead horse a bit here, and spelling it out for those who don't "get it".

Badguy creates hostile "website" with Windows exploit. Badguy goes to local airport terminal or Starbucks and pretends to be a legitimate wireless hotspot using Airsnarf or similar rogue AP utility. Badguy FORCES any user who joins wireless network to browse the hostile website that has the Windows exploit. User gets owned. Lather, rinse, repeat.

You can do this to your neighbor, too, if they have an open access point. FYI.

The point is that it does NOT require coincidental surfing of hostile websites to gather and exploit targets with a Windows 0-day these days. The rich and elite road warriors carrying all their financial and corporate data with them are prime targets. Attackers with rogue AP setups can make easy money from hotspot users by FORCING them to browse a hostile "website" with a rogue AP "splash page".

Particularly vulnerable, are hotspot users that have the Windows operating system installed and use IE as their default browser.

Sincerely,

Beetle

Firefox opens wma and wmv files...

[Dave AM]

I may be a bit paranoid but I'd like to turn off images and video for a few days until this ".wmf" issue is resolved.

".wma" and ".wmv" file extensions seem closer to the ".wmf" extension than ".jpg" or ".tif" extensions, so they may also be loaded by programs that open ".wmf" files only to read the internal label and execute the malicious code.

I unchecked the box called "load images" in Firefox, but animated web sites still come up. So I reinstalled Firefox (also deleting the directory) to try to return to Firefox's original default settings, but my settings were still active. Apparently, Firefox saves personal settings in the registry even after it is uninstalled.

Security web sites seem to be of little help:

Secunia, Kaspersky strongly caution against opening any untrusted *.wmf files
http://secunia.com/advisories/18255/
http://www.viruslist.com/en/alerts?alertid=1767016 69

VNUNet.com says Firefox will first ask the user before opening the file.
http://www.vnunet.com/vnunet/news/2147909/hackers- attack-zero-day-windows

Pete Lindstrom, research director for Spire Security LLC, said,
"There's no such thing as 'extremely critical' when user interaction is required. [...] That's just silly."

Lisa Vaas of eweek.com says "Google had no immediate comment. To avoid the problem, security experts suggest disabling the feature's indexing of media files, or to remove Google Desktop altogether."
http://www.eweek.com/article2/0,1895,1906177,00.as p

Jay Wrolstad at CIO-Today says, "Current exploits use the Windows Picture and Fax Viewer to attack any application that can handle Windows Metafiles. Disabling the Windows Picture and Fax Viewer will not eliminate the risk as the flaw exists in the Windows Graphical Device Interface library".
http://www.cio-today.com/news/Flaw-Detected-in-Win dows-Metafile/story.xhtml?story_id=131004IKPNAU

Alex Eckelberry, president of Sunbelt Software.
"There is no user interaction required," he wrote in an e-mail exchange. "You hit the Web site, you get hit immediately. No prompts, nothing."
http://www.eweek.com/article2/0,1895,1906489,00.as p

Re:Firefox opens wma and wmv files...

[whitehatlurker]

CERT probably has the best write up on this. But, as they say, "We are currently unaware of a practical solution to this problem."

".wma" and ".wmv" file extensions seem closer to the ".wmf" extension than ".jpg" or ".tif" extensions
It only seems that way - image formats (wmf, jpeg, tiff, gif ...) would be opened by the routines that vulnerable. Animations would have a different handler. Though as you say, if the handler is working correctly, it should detect WMF and use the appropriate routines.

If you are using FireFox, and don't open images with external viewers or plug-ins, you should be reasonably safe. FF doesn't appear to have WMF capability. (Someone should submit an enhancement request.) The same goes for Opera. (No enhancement requested there.)

If you use an MS IE based browser, they will render wmf files "natively", even with the extension changed to mask the contents. This will likely trigger the vulnerability, given what CERT says.

The question now is - does this affect embedded images in, say, Word documents?

When M$ will fix this? Who knows.

[twitter]

In a security advisory posted on its Web site, Microsoft confirmed the vulnerability and the associated release of exploit code, but declined to give a timetable for its patch.

Yeah, the usual. They won't say. This one is high profile, so they will move quickly. That won't save you from the other exploits that have been around for years. This one reaches back to Windoze 98, eight years of exploits!

Rich Text Files May Carry WMF's

[Dave AM]

To test this I emailed an ".rtf" file to myself and the ".wmf" (dragged and dropped via wordpad) was carried within it.

Re:Why does /. report so much on Windows flaws?

[ctheory]

Then why bite the hand that feeds? Enjoy your pay/flaws. Welcome to the first ever noted form of job security in the IT industry.

Re:Google Desktop runs as SYSTEM

[dreamer-of-rules]

Google Desktop runs as SYSTEM.

If you get infected because IE tried to view the file, then the exploit runs as you.

If you get infected because you saved/cached the file, and Google Desktop decides to index it, then the exploit runs as SYSTEM.

That's how I understand it after reading these threads, but I could be wrong..

(VIVA LA MAC! -- Virus-free since 2003!) ;)

Why are you using google desktop search?

[Tiffsterr]

Have you tried Ask Jeeves Desktop Search? I have seen them side by side and I don't think there's any comparison. Ask Jeeves has a much better tool here. Better indexing, more readable, allows you to attach files & pix in email without even knowing where they are located on your machine. I'm not a tech person, but I think I'm a typical user. I use it every day - makes me feel way more organized than I deserve. If anyone knows of any problems with Ask Jeeves Desktop Search let me know, I've never had an issue.

Tiffany Felicienne

Recruiting SW Developers & Linux Admins for MobiTV, Inc.

tfelicienne at mobitv dot com

Re:Google Desktop runs as SYSTEM

[FoamingToad]

Partially correct - it's the call to SHIMGVW.DLL which handles the display functionality for the .WMF file. This is bundled with Windows and has been since 16-bit days, IIRC. Although it's not integral to the system and can be disabled (look at earlier articles for using regsvr -u to disable the functionality) it is considered part of the OS in a vanilla install of Windows. It is considered a system process in the same way that gdi is.

As I understand it, any attempt to read an affected .wmf that results in a call to shimgvw.dll, will expose a machine to the risk of compromise; this includes google desktop on a Windows box.

TXT Files May Carry WMF's

[Dave AM]

Any attached gmail files with the ".txt" extension can not be safely opened to notepad directly from the Firefox browser.

This is probably about as in depth as I care to research or discuss this ".wmf" problem for now.

The holes are leaking all over the place.

Windows Major Foul-Up

[spellraiser]

Larry Seltzer has a concise column about this exploit, where he doesn't exactly pull the punches on Microsoft. The most interesting piece of information there is this:

The problem with the WMF (Windows Metafile) file format turns out to be one of those careless things Microsoft did years ago with little or no consideration for the security consequences.

Almost all exploits you read about are buffer overflows of some kind, but not this one. WMF files are allowed to register a callback function, meaning that they are allowed to execute code, and this is what is being exploited in the WMF bug.

I find this mind-boggling to the point of absurdity. Regardless of any supposed benefit gained by this, allowing a data file to execute arbitrary code upon it being viewed is simply begging for an exploit like this. No matter whan spin Microsoft will try to put on this one, it makes them look bad. Extremely bad.

Re:Why does /. report so much on Windows flaws?

[LubosD]

Because FOSS community fixes problems immediately?

P.S.: there are little bit more Linux users than OS X users... Definitely in Europe and in global probably too: http://www.w3schools.com/browsers/browsers_stats.a sp

Write a virus to patch the exploit???

[doublem]

There are kits for building payloads for this exploit all over the Net.

There's a third party patch that tries to block the exploit.

Any Gray Hats out there interested in creating a variant that patches the vulnerability????

apologies

[subtropolis]

OK, i really misunderstood what you were saying. I thought you were talking about some company's legitimate web app or something. Sorry.