New IM Worm Exploiting WMF Vulnerability

An anonymous reader writes "After less than a four days after original mailing list posting there are reports about a new Instant Messaging worm exploiting unpatched Windows Metafile vulnerability. This worm is using MSN to spread, reports Viruslist.com."

Comments

How do I avoid it? Fixes?

[Ruff_ilb]

These would be good things to know...

Re:How do I avoid it? Fixes?

[Anonymous Coward]

Ignorance at it's finest. As soon as Windows is dead and "insert linux distro here" gets their market share we will still be hearing about the latest and greatest worms for that distro. Don't blame Windows lack of security, it's more its market share, transparency between versions to blame and the lack of brains on the end user's parts. But don't blame it on Windows, it owns you...

Re:How do I avoid it? Fixes?

[gb506]

We non-MS users may be ignorant, but not having to deal with the constant parade of Windows security exploits makes our ignorance extraordinarily blissful... ;)

Re:How do I avoid it? Fixes?

[slugstone]

Own it! Can I sell it? Can I make a copy of it? Do I have the source code to look at? I feel like I am just borrowing it. This owner is slow to fix it.

Re:How do I avoid it? Fixes?

[jrockway]

> Don't blame Windows lack of security, it's more its market share

Explain to me, then, why IIS is less widely-deployed than Apache, but IIS has significantly more worms.

Re: How do I avoid it? Fixes?

[Black Parrot]

> There seems to be a first fix.

By Tuesday we'll probably be getting e-mail trojans claiming to be a fix.

Re:How do I avoid it? Fixes?

[ltbarcly]

As soon as Windows is dead and "insert linux distro here" gets their market share we will still be hearing about the latest and greatest worms for that distro.

Pure speculation. There is absolutely no reason to believe that market share is the cause of low security. Shitty programmers with little or no Q/A, and a huge festering codebase which is continually patched together with duck tape to keep it going, along with a refusal to force 3rd party vendors to release software which runs properly (IE doesn't require local admin to run) causes security holes. For example, TOAD, some sql development software for Oracle, requires, REQUIRES, full write privileges to the directory it is installed in, or it refuses to run. This is mainstream software, and is used probably by millions of developers. But it still places fucking ini files in the install directory.

Don't blame Windows lack of security, it's more its market share, transparency between versions to blame and the lack of brains on the end user's parts.

Why would an end user suspect that opening a picture file could cause a virus to be installed on to their computer? Windows doesn't have *bad* security, Windows has no security. In order to have a useable system you MUST run Windows as local administrator. Thus every program you run has the power to format your hard drive if it likes. Every process which is run and has a flaw has the potential to fuck your computer up.

Transparency between versions? How does that cause poor security? Shouldn't the fact that MS recycles about 90% of their code between releases give them a lot more resources to track down those HUGE, GAPING holes in their OS?

FOR CHRISTS SAKE! Windows can be infected by a virus just by having certain things displayed on the screen! What an insane piece of shit it must be.

Re:How do I avoid it? Fixes?

[(negative video)]

Shitty programmers with little or no Q/A, and a huge festering code base which is continually patched together with duck tape to keep it going

Why isn't this drivel modded as flamebait?

Because it's true.

If you have even a shallow knowledge of Microsoft's engineering practices you would know that their Q/A is probably the most intensive that any software company has on the planet, and it's getting more intensive every day. Want an example? The ASP.NET team had 505,000 test scenarios for ASP.NET 2.0 that it had to pass 100% before they would lock it down as RTM.

We're not talking about one bleeding-edge product from one particular team, but rather the tens (hundreds?) of millions of lines of code haphazardly thrown together over the past few decades. It is claimed that the present flaw is in an obsolete interface (the SETABORTPROC GDI escape) provided for compatibility with ancient programs designed for DOS/Win16.

This problem is an extremely difficult one to solve, and a lot of it has to do with Microsoft's failure to produce specs and guidelines from the start that let ISVs know what they needed to do to make sure software ran as non-admin.

No. The sole and exclusive cause is that IDE (compiler and friends) has to be run as Administrator, because Microsoft is too lazy to fix even a single application. This is despite having solid gold opportunities when it was rewritten from scratch three times*, and substantially redesigned several more times.

This is the cause for a simple reason: Imagine you're a programmer making an app that runs properly as a less-privileged user. You do a little developing. You log out. You log back in as a less-privileged user. You test the app, using printf as the main debugging tool. You log out. You log back in. You restart the IDE and get everything back like it was. You do a little developing. And so forth. It's a waking nightmare of the type formerly encountered only in H.P. Lovecraft stories.

Microsoft's tools punish you for trying to do the right thing, because they want bad software so the customers expect to be on an upgrade treadmill.

*The original total rewrite of the C-language tools, the Java toolset, and the CLR toolset.

The security model in Windows is actually more extensive than the security model in most flavors of Unix, including Linux.

Indeed. If only Bill Gates had put sane people like Dave Cutler (NT kernel chief architect) in charge of every major project, instead of whoring out the codebase in a mad dash to squash Netscape and Sun. It's one thing for a tiny company barely staying afloat to cut standards, and entirely another for a rich company with billion dollar piles of cash lying about. The former is understandable, the latter is recklessness bordering on malice.

Re:How do I avoid it? Fixes?

[ltbarcly]

How about an example of bad design in Windows?

Let's see... How about forcing you to run even much of microsoft's own software as local admin in order to get it to work?

How about running active X code with the same privileges as the current user? Hundreds of exploits have depended on this... clearly bad design.

Instead of closing these ongoing and massive security holes, they have now released anti-spyware as a solution. So MS's idea of security is to have a daemon which can recognize and kill any known threat (which will always be one step behind), instead of just closing the holes those threats make use of.

Of course, I could just point out the huge insane flaws in previous versions of windows, such as the screen saver running as local administrator, and so changing the screen saver to cmd.exe would give one administrator access in NT, or a malformed packet to a certain port bluescreening 98, but you would just reply that "they are better now!". Which is hard to dispute, not because it is true, but because we don't know of all the huge holes that may still be discovered in Windows. You might claim that they aren't there, but that is just arguing from ignorance, and the fact is we don't know. Every single piece of evidence and experience says that they are there and that they are potentially killer threats.

Now I'm going to appeal to my own lying eyes. I rarely surf the web for more than 5 or 6 hours before explorer.exe mysteriously dies and has to restart itself. You'll notice when this happens because everything on your screen goes away except your desktop wallpaper, and about 8 seconds later your desktop and programs reappear (sometimes) and every instance of explorer or internet explorer is missing. Sometimes this will happen repeatedly in a short period of time, other times it won't.

Another example from the lying eyes department. Windows gradually gets slower, and errors start appearing more and more often, as the uptime increases. After about a week or two of uptime on a desktop machine outlook starts to wig out, things paint slowly, applications start to grind to a halt, etc etc. Despite repeated claims to the contrary, this continues to happen even in the newest and most patched versions of windows.

In windows I have to run a virus scan daemon. If I don't I will be infected with a virus within a few days of web surfing. Unless I use Firefox, which doesn't seem to have all the gaping vulnerabilities of IE in this regard.

At work I routinely have to fix computers which are infected with spyware. These machines are fully patched, not that they should allow magic remote spyware installation by default. The user manages to get spyware, not by installing software or running an executable, but merely by clicking on links which have been emailed to them to "look at the funny movie/picture on this website". This is a FUCKING MASSIVE SECURITY CONCERN. There is nothing preventing this spyware from phoning home with lots of information, screen shots, and files from the users computer, including keylogs etc etc.

An since you are accusing me of changing the subject, how does 4 hundred bajillion automated tests have anything to do with Q/A in the sense of vulnerabilities? See: http://www.asp101.com/articles/john/kb887289/defau lt.asp

Re:How do I avoid it? Fixes?

[timcharper]

Linux isn't perfect either. I believe no OS is. Probably because it's made by people, and people make mistakes. Give windows a break. They have a big load to carry. A lot of the things they do are great. Granted they may do some that don't seem so great, but they are in the biggest spotlite. All the guns are pointed at windows users because they are the majority. They undergo the most fire. Parts of my linux distro break from time to time because of upgrades. Luckily linux provides me also with the tools to fix it myself. I'm not saying which OS is better, but windows XP definitely isn't a piece of crap. Its really great and has its place. It has some great components - the device manager is great. Its much easier to install a printer in windows than in linux. A lot of things are easier to do. Its great for people who really don't care about what's going in their computer, but just want it to work. There's really no need to flame about it or get upset. Just let it be.

Re:Macs

[Hiro Antagonist]

Talk about trolling flamebait. Apple makes money on hardware, not operating systems, so it behooves them to make their operating system work on their hardware. The nice thing about this is that they make some damn nice harware (I'm typing this on a PowerBook), and that they have very little incentive to 'feature-pack' their OS like Microsoft does -- so you get less in the way of quirky 'features', and a hell of a lot of functionality.

Plus, OS X is a Unix, which means it plays nicely with other Unices, and it behaves like a Unix on the command line -- so I get all the power of pipes, vi, Bash, the BSD ports collection (a la Darwinports), gcc, and so on. On the GUI side, it behaves like a Mac -- and I think you'd be hard-pressed to fault Apple for their GUI design.

Best of both worlds; you just have to shell out a slight premium for the hardware, and given that you get a REAL OS with it, I'd say that Mac offers a better bargain for the desktop user than any Dell or Gateway.

It's worse than that

[Anonymous Coward]

I do infosec stuff at a well-known corporation, including Incident Response, and I've been following this closely & working on our response.

Since the first exploit came to light, H.D.Moore of the Metasploit project has reworked the original package they did. The new exploit spits out exploit WMF files that come:

• with a random size;
• no .wmf extension, (.jpg), but could be any other image extension actually;
• a random piece of junk in front of the bad call; carefully crafted to be larger than the MTU on an ethernet network;
• a number of possible calls to run the exploit are listed in the source;
• a random trailer

This makes it rather hard for antivirus and IDS sigs to detect it, though Snort and the A/V people are working late over their holidays to improve detection.

SANS/ISC have provided excellent continued summaries of events around this. Here's their FAQ on the issue.

This is looking truly horrible. On Tuesday morning zillions of Windows desktops will be fired up for the first time in a week or two. This thing's already in widespread use by a number of malware distribution networks for the usual reasons. As such it's a nightmare for network and system admins with Windows machines to look after (and us security people trying to provide advice & assistance for them...) But the stealth nightmare is that this is an absolute jackpot for the less visible targetted attacks, such as those emanating from China for the past couple of years (google around, Slashdot and Schneier have covered this as well as many other places.) There are also the opportunistic types who see an easy opportunity to pwn some key machines where they work, say. I will stick my neck out here and make a prediction. Virtually all organisations with Windows machines are effectively wide open to total compromise by a reasonably informed person. That means much of the IT dept as well as significant numbers of the 'interested poweruser' types, developers with a casual interest in security,.. anyone who's heard of this and is capable of running the findingm, running and using the new exploit, basically. Of course we're all tweaking our IDSes and antivirus, locking things down as tight as possible in the 48 hours remaining, but... *shudder*

For ten years I've been waiting for Microsoft's luck to run out. This is about #3 on my list of catastrophic MS incidents. There aren't many ways things could be worse.

It will be a good time to be running Linux on work machine, though :)

Re:It's worse than that

[lseltzer]

Yes, it's really really bad, but it's not anywhere near as bad as a real network worm and we've had several of those. At least these attacks do require user interaction and there is workaround that's usually effective.

BTW, according to testing by AV-Test of 73 variants all of the major AV packages and most of the others are detecting all of them. You're right though that there will be holes in this coverage, especially in as much as some of them are doing exploit-by-exploit coverage as opposed to a true heuristic. The ones that do sniff out the actual WMFs and look for the exploit sequence seem to be working so far.

Re:It's worse than that

[Lehk228]

this is MUCH worse than a network worm.

worms are pretty easy to seal out with a firewall and are easally patched. this exploit allows all sorts of local user exploits in a corporate environment. it also so far has been able to fly through hardware and software firewalls of all shapes and sizes.

Re:It's worse than that

[borderpatrol]

This too slips right past Internet security packages such as Norton and McAfee. For the money people pay for AV protection the vendors really need to get their act together in my opinion.

But this is where the issue lies and why IMO viruses are of virtually no threat anymore, it's going to be all ad/spyware from here on. For instance, I finished up a cleanup of a machine yesterday. Went through it with 1 AV scanner, and 7 different AntiSpyware tools, plus had to go in by hand and do manual removals. 1 virus, over 36 different ad/spyware programs from over 900 traces. Norton was of course expired and hadn't been updated in 8 months.

When the virus fight used to be AV Companies vs. Johnny Scriptkiddy, it's now AV Companies vs. Permission Based Marketing (read: Adware) companies, or an army of zombie bots controlled by the Russian Mafia.

Companies like Symantec, Mcafee, and Microsoft are very careful to step on toes in labeling other companies products as ad/spyware. Those very companies profiting from the adware also have their own army of lawyers and will file suit against anyone who dare defile their product! After all, you read the EULA right?

So when a customer tells me she still has Norton and she wants to know why she is still getting popups, I have to explain to her what the difference between viruses and adware, and why Norton just plain sucks for the new threats we face.

Never thought I would wish for the days of Melissa again, lol

BTW, Sometimes after a cleanup I install MS AntiSpy and Firefox with the IE Theme (http://www.firefoxie.net/). Just change that blue "e" to point to FF, and they're just a bit more secure.

Re:Another GOOD reason not to run IM!

[unity]

My customers use IM. My coworkers use IM. I use IM.

IM is potentially the most influential communication medium since email.
I have had quite a few of my customers tell me that "The simple fact that I can reach you via IM, has made your company's service better than any other partner."

IM is "instant", offers logging of communications and doesn't require somebody to check their email (it pops up on their screen). In many ways it is a better communication tool than other options: phone, email or fax. You can even use it to see if somebody is in the office yet, or out to lunch. I could go on and on...

Feel free to not use it; the rest of the modern business world won't be joining you.

Re:There needs to be...

[W2k]

The problem isn't that the user base is completely uneducated - it's that for the majority of the educated users on Windows, they're not switching because THERE'S NOTHING BETTER TO SWITCH TO. I'm not trolling; I'd be off Windows in a heartbeat if I had the option. I've replaced pretty much everything else on my box with FSS/OSS alternatives. Windows remains because for the stuff I do with my computer and the expectations I place upon it, there's nothing else to use.

Re:Another GOOD reason not to run IM!

[the_macman]

IM is just a person private email system, period. Try using email, you can even use filters to pick your freinds messages out of the background noise, like inter-departmental mail. To fix the security risk of IM, either the you give up point to point email that it is to force it though filtering servers (sound like email there again). The Anti-Virus programs on every machine will have to start filtering all that traffic too (wait they are doing this for wmail today also!!)

Ummm, not really. Half the people I know check their email via the web and have to login everytime vs IM where you just keep a small window open (in fact you can minimize it) and messages pop up if someone contacts you. Plus with IM, when I send someone an IM I *know* if they are in front of their computer that instant, or idle, or away. Plus according to your plan it's effiecient to send an email to someone saying "Hey wanna goto the movies tonight" only for them to check their email the next day.

Re:Another GOOD reason not to run IM!

[S.O.B.]

I am forced to use IM at work and all the benefits you list also have negatives associated with them.

Being "instant" allows people to annoy you for any little thing. The dozen or so phone interruptions I used to get a day are now 20-30 IM interruptions.

"Logging of communications" also means you have no privacy. And if you think your boss isn't tracking you by your IM status you're kidding yourself.

Screen popups mean that you don't have to wait for the recipient to check their email/vmail but it also means that you just interrupted what they were doing. I don't know how many times I was trying to solve a problem and I got IMed by multiple people asking if I had solved the problem.

The difference between IM and previous forms of communication is that I used to have a choice.

Straw Man, Mod Parent Down

[Moth7]

No one said that using something other than Windows would solve all security problems, only this one. The grandparent was entirely correct in its observation.

Re: There needs to be...

[Black Parrot]

> Windows remains because for the stuff I do with my computer and the expectations I place upon it

If people would aim their expectations at their software vendors rather than their computers, that problem would go away.

Re:There needs to be...

[Hosiah]

Who's with me?

We've all been trying this years ago. But just yesterday, I got my ass kicked down to troll and flamebait for daring to suggest that Linux/Open Source/OS X/BSD/Anything-but-Windows is anything but an utter turd. What hope is there to educate a public who cannot get past the idea that the internet is just AOL and Bill Gates invented the computer and a hundred other misconceptions? You're advocating college education for people who can't pass kindergarten.

From my ledge, I see it as counterproductive to call users "Joe Sixpack" and "Gramma". These are false stereotypes. Given the opportunity, anybody can learn. Nobody was born knowing Windows 20 years ago, but it caught on, didn't it? There's more "for Dummies" books where "DOS for Dummies" came from.

But yeah, I do my part to post hints 'n' tips every other day on my geek blog, but it's more directed at people who've already found Linux. I tried in a past life to do similar for Windows users, and got nowhere: it's a hole with no bottom.

Re:why would they do this?

[drachen]

They do it to show what can be done with a flaw such as this. The people who we really have to worry about can (and probably have) already come up with other ways of crafting exploits around this bug that we aren't likely to find out about until after the major exploits come out. And the people we really have to worry about aren't going to make major exploits at all, but use it to exploit machines with potentially sensitive information (such as your personal information).

Until Micorosft fixes the problem, publishing information such as linked in the post above helps those of us who have to actually secure machines. True it might result in more end-user Windows PC's being exploited, but at least we can figure out how to protect the computers that must be secure.

The information may help the "bad guys" but it's not anything they couldn't have come up with themselves. "Because it's there" isn't the reason.

Re:so...

[FhnuZoag]

Jesus freaking Christ...

Worse is that implanting this thing doesn't even need ownership of a site. If a site allows tags, an anonymous commenter, forum poster or anything can drop an infected file on it, and screw over every IE user that visits. I don't know if it is possible, but imagine if someone adds an infected file to the Main Page of Wikipedia...

Re:There needs to be...

[Q2Serpent]

Just because you get everything you need from your Mac doesn't mean it can replace Windows for everyone else. It's a crummy world, but some of us still rely on software that is Windows-only. As long as certain vendors still publish Windows-only software and certain business still require their use, many users will be stuck on Windows. C'est la via. No amount of "Mac does everything I need it to" will change that.

Re:There needs to be...

[dbIII]

With the exception of games (and I don't play PC games anyway), my Mac does everything Windows can do, plus some

There is a lot of in house software out there - which is why MS Windows98 was installed on a few single purpose machines where I work this year. The current developers are making all new software as portable as they can - and not developing to the moving MS Windows target.

The earlier poster was correct - some poeple have no choice but to use MS Windows - but the answer as it has been for years is not to let their machines onto the net without adult supervision. I completely block this MS windows clone of IRC and it doesn't bother anyone - using instant messaging for business communication is a braindead idea anyway unless everyone is tied to their desks and focuses on short term tasks, and luckily I don't work in such an environment.

Can IM/RSS clients download automatically?

[mosel-saar-ruwer]

I have seen in the past week our work increase 5 fold because of this exploit. What is normally a very slow time of the year for us has become very busy for us and it's making me nervous myself.

I know next to nothing about IM/RSS software, so I am just speculating here.

But suppose you had some IM/RSS client [MSN, AOL, Yahoo, whatever] that had an image rendering aspect to it. For example, suppose your IM/RSS client were capable of rendering the JPGs in an HTML message.

Then it seems to me that if you had such an IM/RSS client running on your desktop, and if someone knew your IM/RSS handle, then they could send you an IM/RSS message with very elementary instructions for downloading the evil file:

<img src="http://blackhats.com/evilfile.jpg">

and you'd be hosed without ever having clicked on any link. And if the worm were really smart, it could then install "thttpd" trivial http daemons to spread itself internally on any corporate network [via each person's IM/RSS "address book"].

If that's true, and if lots of employees left their computers running and logged into windows with such "automatic" IM/RSS clients running on the desktop, then Tuesday or Wednesday morning [or whenever people decide to come back from their New Year's vacation], there could be literally MILLIONS of infected machines.

So the question: Are there IM/RSS clients that can download files automatically?

Re:Most importantly: THERE IS A FIX

[chris_eineke]

You actually want to trust Steve Gibson? That's a pretty bold move.