Slashdot Mirror
New IM Worm Exploiting WMF Vulnerability
An anonymous reader writes "After less than a four days after original mailing list posting there are reports about a new Instant Messaging worm exploiting unpatched Windows Metafile vulnerability. This worm is using MSN to spread, reports Viruslist.com."
From MS' site: 4: Block pop-up windows in your browser
My credit union requires that I allow pop-ups! I don't know how many times I've gone to legitimate websites and scratched my head for a while trying to figure out why I wasn't seeing anything - all because I'm blocking pop-ups! Firefox tells you with that little message on top of the window, but you know how it is, after a while, you don't notice it anymore.
...a dedicated, well-written, well-publicized effort to educate the general public about this sort of thing. We need to establish a meme among the Joe Sixpacks, Moms and Dads, and Grandma Sues of this country that they're foolish if they don't read stories on [whatever].com each week. And on that site, we need to explain, in plain English, [A] what the flaw could do to their computer, [B] what they can do to temporarily/permanently fix the flaw, and [C] what the flaw is due to (99% of the time, this will be 'due to Microsoft software').
Microsoft obviously isn't interested in having an educated user base, or they'd make such a site themselves and advertise it extensively.
Who's with me?
With spending like this, exactly what are "conservatives" conserving?
IM is just a person private email system, period. Try using email, you can even use filters to pick your freinds messages out of the background noise, like inter-departmental mail.
To fix the security risk of IM, either the you give up point to point email that it is to force it though filtering servers (sound like email there again). The Anti-Virus programs on every machine will have to start filtering all that traffic too (wait they are doing this for wmail today also!!)
--
When will people learn that NEW is not always GOOD.
Microsoft recommends, for the time being to just
regsvr32 -u %windir%\system32\shimgvw.dll
BUT according to this analysis, the real fault lies with gdi32.dll ! How the hell do you get rid of that? It's about as deeply embedded in windows as, say, glibc is in Linux distributions..
SCO employee? Check out the bounty
What we need now is for someone to find a remote exploit in a popular webserver and combine both exploits into a worm, 'cause then we're all really fucked.
Belief is the currency of delusion.
but somebody can finish this joke... it has to do with a hacked Windows PC... I am teh lose today.
"and on the 7th day 'after' Christmas my true-love gave to me"
That's about as helpful as advising tsunami victims that they move.
For those who want actual advice: http://www.hexblog.com/ -- a fix which creates a hook to disable the affected code. The fix has been analyzed by Steve Gibson.
Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.
An exploit of "gdi32.dll" using a WMF file for the attack was documented back in November. Does this new exploit use the same attack approach?
Comment removed based on user account deletion
I can understand spreading the fact that the exploit exists. I could maybe argue whether or not you should spread info on the exploit. I can barely see why one would make an example exploit.
But why would someone make a program specifically designed to make an undetectable/untraceable version of the exploit?
I can only see harm coming from this.
And I'm sorry, but "because it's there" doesn't work when you know there's only negative outcomes of what you do.
http://lkml.org/lkml/2005/8/20/95
Out of curiosity, where's the documentation that describes this? I was thinking of writing a WMF that pops up a window saying "Warning, you haven't patched the WMF vulnerability. I was able to open this window on your computer by simply loading a picture. Imagine if this had been a virus too. Click here to download the fix - and here's why you should trust that guy."
completely agreed. it also shows something of a lack of effort on microsoft's part. i believe that the problem has still not been fixed with an official patch (others have to do the dirty work) and i think the vulnerability was known about four days ago! That is unheard of on open source systems because their creators aren't busy marketing the newest XBox game. I recommend gaim or naim (if you don't mind console) for the aim and everything. I hear Trillian is good but have not gotten around to trying it yet. I believe it is for windows, no? Probably has better protection against this stuff than MSN does though (that doesn't say too much...) (-hrair-)
Beware of the shining wires...
Apparently you fail to realize this was a 0-day exploit. That is, there were people already exploiting this flaw before anyone else found out about it. Because they didn't release their source code do you feel safer by this? So your argument that the attackers aren't "awesome programmers" is completely worthless because these attackers found and wrote the original exploit code to begin with. We don't know how long this flaw may have been used in the wild before this one was found. Some "awesome programmers" could've been using this flaw years ago to break into networks. Re-read my original reply.
Now some people who happen to have analyzed that exploit figured out just exactly how seriously this flaw is and what could be done with it if it's not fixed.
A simple explanation is plenty.
So you're saying that if all the attackers have is a simple explanation that they wouldn't be able to write code based upon that explanation? Yeah right. The people who wrote these sample exploits didn't even have that to begin with and look at what they've been able to come up with. The people ("attackers") who wrote the originally known exploit didn't need a simple explanation either.
So now virus scan writers and IDS maintainers, etc, now have a LOT more information for how to defend against this particular threat. A simple explanation isn't sufficient. Now scanners and IDS can use these discovered methods to improve detection and prevention of exploitation of this flaw.
Again, I just don't see why someone would need to make the most evil version of this possible and distribute the source code.
Well, I can't explain it any clearer. You're using the "security through obscurity" argument that history has shown to be insufficient for protecting our computers and networks.
Older versions of FF will open it natively. (pre 1.0 I believe) Newer versions of FF and Opera will pull it up but will ask if you'd like to open the image with MS Picture and Fax viewer or whatever associated program. If you click no, you should be safe. If you click yes, you're infected. If this thing gets stored on you HDD or your cache somewhere though, the mere act of single clicking on the file or even the folder in some cases can trigger it. And if you have Google Desktop Search installed, google will index and execute the code as soon as it hits the drive. Some DOS boxes are getting infected this way even.
Yeah I've been starving them, teasing them, singing off key. Me may mah mo, me mo ma me.
JPG, PNG, GIF etc. all have headers that should surely be checked before displaying the picture. Do IE not do this?
In short, do i have to actively click a "Open this file" dialog on the browser?
their Q/A is probably the most intensive that any software company has on the planet
A bunch of automated tests for one piece of software will prevent bugs which effect *functionality*. They cannot find bugs|vulnerabilities which are the result of poor design.
And as for MS making good software, Windows does not even come with a plain text editor which can handle UNIX line termination! Notepad shits all over it, and Wordpad is NOT a reasonable editor to edit source or shell script code. EVERY OTHER text editor in the world, from nano, vim, joe, emacs, the OSX text editor, even fucking DOS edit can handle Unix line termination properly.
MS's goal is to prevent interoperability with any other OS, and within their OS prevent the creation of software which can run on more than one platform. Beyond that they fail in everything.