Trustworthy Computing

Anonymous Coward writes "This is a first: the Internet Storm Center is recommending trustworthy computing. They want you to trust that the unofficial patch for the Windows Metafile Volunerability that is currently being exploited by an IM worm. No patch from Microsoft at this time, and the exploit is arranged in such a manner that it cannot be detected by most intrusion detection systems (the snort rule will peg the CPU on your router) nor filtered by packet-inspecting firewalls (it spans two or more ethernet frames). Not really a whole lot of choice about this one."

Comments

Some won't

[SavoWood]

As it says in the article, some people in the corporate world won't do it if the patch didn't come from MS. It's sad, really. If I had an exploitable machine around, I would trust their patch.

Re:Some won't

[Jugalator]

It's sad, really.

Yes, definitely if this was an open source system.

It can be discussed whether it's sad or smart to wait for someone with insight in the closed code to fix it.

If I had an exploitable machine around, I would trust their patch.

I may just have chosen to suffer from using a slightly crippled OS (i.e. no workie Fax & Picture Viewer, etc) by unregistering the DLL until it's fixed.

Re:Some won't

[grasshoppa]

I may just have chosen to suffer from using a slightly crippled OS (i.e. no workie Fax & Picture Viewer, etc) by unregistering the DLL until it's fixed.


And even better, it's an easier work around ( which is all this unofficial patch is ) in a large enviroment. AD, made a script to disable the dll, and bam! One reboot later, work around implemented.

Re:Some won't

[NoMercy]

They recomend both deregistering and applying the 3rd party patch, if some 3rd party application loads the DLL directly, unregistering it won't help.

I'm a trusting person, and if ISC, and Fsecure's lab both recomend it, I don't mind applying it, I'd trust there code more than MS's :)

Re:Some won't

[grasshoppa]

But it seems to be if you do the work around and block WMF files at the border.

Unless you have evidence to the contrary.

Re:Some won't

[SillyNickName4me]

If you'd have followed your own suggestion, you'd know that for as far as the current IM worm goes, the workaround works perfectly fine.

What is more, re-registering the dll by some bit of software is a possibility, but for this to happen without action from the user, there needs to be another vulnerability that allows running the code to do this (or another way to access this specific vulnerability). If there is another vulnerability then the hotfix won't make you safe, The hotfix does work and provide some extra protection but only for the cases where this specific vulnerability can be exploited through a different path (that does not use shimgvw.dll).

Re:Some won't

[Professor_UNIX]

As it says in the article, some people in the corporate world won't do it if the patch didn't come from MS. It's sad, really. If I had an exploitable machine around, I would trust their patch.

But you're probably coming at it from a different mindset. If you're used to open source software you probably regularly trust patches from people who you otherwise wouldn't know simply because they released the patch as open source. You probably figure SOMEONE out there must know how to read the thing to determine if it's malicious and would throw up a red flag if they found something.

With Windows users they're not used to that level of trust, even when it involves a patch that includes source code. How many Windows desktops do you know of that have Visual Studio on them to compile this patch from scratch to verify the binary version isn't malicious? Coming from a UNIX world, not having a compiler on your system just seems weird, but Windows users are trained to trust in their binary patches and cross their fingers.

Re:Some won't

[kimvette]

If all you need to do is compile a project the Visual Studio express edition ought to be good enough. It's free but doesn't come with all of the extras that Visual Studio Architect comes with.

It can be downloaded from http://msdn.microsoft.com/vstudio/express/default. aspx

Re:Some won't

[shibashaba]

It's only free until the end of this year, then it'll be $49.

Re:Some won't

[Sarisar]

Should I just block all .WMF images?
This may help, but it is not sufficient. WMF files are recognized by a special header and the extension is not needed. The files could arrive using any extension, or embeded in Word or other documents.

From here

So blocking WMF files doesn't seem to help :(

Re:Some won't

[HermanAB]

The old job preservation argument - Need to be able to blame Microsoft.

As for me, I test all patches - the ones from MS too - before deployment. I don't blame Microsoft, I take responsibility for what I do.

Re:Some won't

[grasshoppa]

So blocking WMF files doesn't seem to help :(

From my understanding of the issue, blocking *.wmf and unregistering the dll should be sufficient to block the vulnerability. By unregistering the dll, you block the "check in the headers and see what it really is" behavior of *.wmf.

I could be wrong, but that's what I've gathered from all I've read.

Re:Some won't

[LordSnooty]

That will protect against the exploit doing the rounds in its current form. I wonder if the quote implying "not just *.wmf are affected" is a warning that an exploit doing the rounds tomorrow could take the form of a jpg, gif or indeed any binary file, not just an image. It could arrive as almost any sort of document, as long as it has the WMF metadata then the vulnerable code in Windows will "execute" the payload.

Over/Under

[chrisgeleven]

What is the over/under for Microsoft getting a patch out for this?

If there is a time to deviate from their monthly patch cycle, this is it. The patch should have been out days ago, yet we are still waiting.

And Microsoft wonders why no one takes their security promises seriously.

Re:Over/Under

[Malor]

It's probably a hard problem to patch. From what I've gathered, this is a feature of WMFs, not a bug. They were designed before people even knew what the Internet was. WMFs, apparently, have the ability to specify code to be run on a failure to render. So the bad guys give you a bad WMF file, cleverly renamed as JPG, and stick it in an ad banner. You browse a site (with any browser), Windows fails to render the WMF (which it will recognize even if the filename says JPG), runs the specified failure code, and you're hacked. That fast.

Changing code that's this deeply buried in Windows is risky. The interpreter for WMF is one of the remnants of code left over from single-user computers, and they'll have to test changes very thoroughly. They're GOING to break things with this patch, because they're removing a designed-in feature. They're probably working feverishly to figure out how to minimize the damage, but some damage is inevitable. And the problem could be far worse than it appears; that DLL could be riddled with problems. It may not have been audited in many years.

This is yet another example of how you can't retrofit security; the first Windows versions were designed when security wasn't even an issue, when the Internet was barely a twinkle in Al Gore's eye. There's a mountain of code that was written just to work, not to worry about being handed malicious data. If a user passed bad values to a system call and it crashed, oh well. It was their fault for doing it. It's not like they had anything to gain from it, after all. They owned the computer. Why on earth would the computer need to protect itself from its owner?

With the advent of the Net, Microsoft decided to both stay backward-compatible and extend what they had onto the Internet. And their focus for many years was on new features, not security. Essentially every security person at the time warned them -- stridently -- against the choices they were making. It was obviously going to be a trainwreck. This is just the latest in that ongoing collision between a single-user operating system and exposure to every computer in the world.

This particular exploit is BY FAR the worst one yet...even very competent administrators, doing everything exactly as they should, can get nailed by this one. As bad as this is, though, it's not like they're going to stop here.

Trying to retrofit security onto the Win3.1/Win95 model is like trying to use scotch tape to make cheesecloth waterproof. No matter how much tape you use, even if it's a lot more tape than cloth, it will ALWAYS leak. It might hold water for a bit, but leaks will constantly spring up. They've added tremendous functionality in the NT/2k/XP kernels which can limit what users can do and limit the possible scope of compromises, but many many programs (especially games) require administrator privs just to run. So most people run as Administrator even though they shouldn't. And that makes hacks like this one very easy and *extremely* damaging.

Hopefully Microsoft will get a patch out fast.... they certainly must understand how overwhelmingly bad this problem is. The fact that they're reacting slowly is likely an indication that it's hard to fix.

Re:Over/Under

[Dachannien]

What is the over/under for Microsoft getting a patch out for this?

You mean this year?

Re:Over/Under

[Dachannien]

This shouldn't be difficult to fix. They just have to change the code for gdi32.dll not to register the callback function (or not to call it, perhaps). If it breaks some WMF files, then the WMF files were technically broken anyway, since the callback only gets called when the renderer has to abort for some reason (like detecting an error in the file).

This could have been a 0-day fix, quite honestly.

Re:Over/Under

[mce]

One wonders how long MicroSoft themselves have known about this one. Despite them being "The Incompetent Company", they do have a lot of very competent software people working for them. I'd be willing to bet some money that some of those have identified this particular flaw some time ago already but that, after looking at the consequences of fixing it properly, the company decided to hope that nobody would notice until they finally get around to publicly breaking backward compatibility.

With stuff like this in their closet, one surely can understand at least to some extent why they advocate closed source. The feature in question is likely well documented, and thus reasonably "open", but the idea of what might happen if crackers get access to all the non-safe zombie code that dates from their pre-history truly must horrify them.

Re:Over/Under

[mwvdlee]

In theory they could have the render-failure code run in a sandbox environment.

Re:Over/Under

[Malor]

As I'm saying in my very verbose way up yonder... if it was that simple, we'd have a patch already. Microsoft must understand how devastating this is.

Re:Over/Under

[lawpoop]

The blog of the guy linked in the article says that we can't expect anything from MS before the 9th.

Re:Over/Under

[arminw]

.......but many many programs (especially games) require administrator privs just to run......

That in a nutshell is the biggest problem with Windows. It is still suffering from its roots as a single user computer system in the world before networking. *NIX systems, such as Linux and OSX are more secure mostly because of they do not require administrator status to run application programs. MS will have to FORCE developers to change this by making two users on every system -- one the admin and another the user, one or more ordinary users with limited privileges. Programs that ask for higher privs, would just die with a nasty message from the OS.

The other change would be to get rid of the registry which is used to ensure that malware runs when the system is booted, among other functions. If in VISTA, ordinary programs, games or anything other than system utilities and installers STILL require the user to be an admin, there certianly is no reason to upgrade in the hopes of finally getting a system at least as secure from malware as OSX. In combination with this MS should then spend some serious money to educate their customers not to EVER give their admin password unless they KNOW they are installing some new software. An internet greeting card, picture or e-mail should not EVER allow the introduction of new, executeable code onto a computer without the explicit permission of the educated user.

Re:Over/Under

[0WaitState]

Malor said:

This is yet another example of how you can't retrofit security; the first Windows versions were designed when security wasn't even an issue, when the Internet was barely a twinkle in Al Gore's eye.

Uh, no. The internet was already alive and well and quite mainstream in academe in the early 80s, when Microsoft still thrashing around with early versions of MS-DOS, and networked PCs were well-known by the late 80s. Even before that almost every PC came with a modem.

So, no, sorry, Microsoft does not get a pass for allegedly having developed windows in some misty time of yore when "security wasn't even an issue". Security was an issue on MS-DOS, for modem-using consumers, academic networks of shared PCs, and especially for corporate deployments.

Re:Over/Under

[Malor]

Dude, how old are you? I was *there* at the time. Nobody thought about security in networks back then. Hardly anyone thought about security, period. Regular Windows barely even DID networking... they added that later in Windows for Workgroups. (heh, and it still barely did networking :)) Networks were weird and unusual. They were isolated, not tied together, and everyone just assumed you could trust anyone you could run a LAN cable to.

Modems existed, sure, but a FAST modem at the time was 19200 baud. People didn't use that to network. Before the Internet arrived, people used modems to call BBSes. When the Internet arrived in my town, it didn't offer SLIP or PPP... you dialed in and ran programs at the Unix shell prompt. There WAS NO LONG DISTANCE NETWORKING, except on the part of a few eggheads in academia. The concept of a worldwide network was something out of science fiction. In 1990, people would have given the ideas of a global network just ten years later and an invasion from Mars about equal credence.... ie, nearly none.

I assume you're too young to remember, but Microsoft had a huge revelation awhile after Netscape had that first monster IPO. "Wow! This internet thing.... it matters!" And THEN they started revamping all their single-user stuff to go on the Net.

In hindsight, it's very easy to see that they should have started really thinking about this in 1993 or 94, when the Net was first really making headway.... people liked it. A lot. Not figuring it out until 95 was pretty darn boneheaded on their part. And then in their rush to get on the Net and take it over, they made a lot of really, really stupid mistakes. And we're still paying for them.

But fer chrissake, the design of WMF... Microsoft is supposed to magically realize that the long-distance network between about five thousand academics is going to *take over the entire world*? When they were designing WMF, they had probably never even *heard of* ARPANET.

So yes, they DO get a pass on this. Their really serious errors were in trying to push '95 and '98 onto the Net, and writing all that functionality into Office that didn't need to be there. They didn't feel they had time to do it right, so they did it quick to grab the market. From 95 on.... the blame is entirely theirs. It was obvious what would happen.

But in 1991? You're high if you think security was much of an issue back then. DOS had *NO* security. None whatsoever. Neither did 3.1, 95 or 98. (well, 95 and 98 had a tiny bit of security, but it was a thin veneer). And everyone got along just fine, at the time. The only time security was needed was when you were in a corporate environment. Nobody talked from one computer to another, it was all from the workstations to the servers.

The only people that needed security at the time, in other words, were big businesses, and they ran Netware. Other than that, if you wanted to secure your data, you locked your computer up.

Extrapolating from that mindset to 'talking to every computer in the world', in advance, would be nearly impossible. Even having BEEN there, it's hard to wrap my head around how different things were back then.

Re:Over/Under

[rodbegbie]

More worryingly -- If I install this unofficial patch, will it screw up the offical MS patch when that's released?

Rod.

Re:Over/Under

[kimvette]

And then 3-4 years for it to reach the majority of installed computers, if home users EVER bother to run Windows update - and six months before any large corporate types will accept such a patch due to bureaucratic red tape.

Re:Over/Under

[angulion]

There's a mountain of code that was written just to work, not to worry about being handed malicious data. If a user passed bad values to a system call and it crashed, oh well. It was their fault for doing it. It's not like they had anything to gain from it, after all. They owned the computer. Why on earth would the computer need to protect itself from its owner?

It is new, it is called DRM.

Re:Over/Under

[innocent_white_lamb]

In 1990, people would have given the ideas of a global network just ten years later and an invasion from Mars about equal credence.... ie, nearly none.
 
I agree with all of your post except for this line.
 
You seem to have forgotten about FidoNet. It wasn't real-time, but it was worldwide and it even had Internet gateways to get email back and forth. I used to run a multi-line FidoNet BBS and spent hours every day reading various echomail groups (similar to NNTP newsgroups). And I sent email back and forth to my brother who had an account on a university Internet server too.

Re:Over/Under

[0WaitState]

Dude, I think I'm older than you--I remember when my job first gave me a 2400 baud modem, and at the time thinking ruefully of all the time I had wasted with 300 baud modems. I still have a Codex 2264 modem (It's the size of a shoebox, has a three prong plug and a fan, and seems to be immortal).

As to your contention that microsoft gets a pass because nobody thought of security back "then", I'll take "then" to be the 10 years immediately prior to the release of Windows 3.0. Multi-user PCs were a well-known concept to every student who's done work in the general-population 'computer lab'. Remember Banyan, Appletalk, Netware (you mentioned it)? They may not have been Microsoft products, but they were ubiquitous. Unix workstations (Apollo, Sun, Microvax, etc.) were in very common use among engineers and product designers, and they all were networked. (of course, most unixes and VMS versions were very hackable, but that was part of the fun)

What's more, there were thousands of anti-mal-ware software products for MS-DOS, some samples here. The virus vector was BBS downloads and floppy disks rather than open port attacks or browser overruns, but the concept of attacking PCs was already well known. So, no, Microsoft does not "get a pass" for a security problem that nobody could have predicted (sarcasm). They made conscious choices to de-emphasize and ignore security in order to maintain market share at all costs. The economics proved them correct, so far, but they still should carry the blame for those choices.

Re:Over/Under

[hkmwbz]

"You browse a site (with any browser), Windows fails to render the WMF (which it will recognize even if the filename says JPG), runs the specified failure code, and you're hacked."

No you aren't. Not if you are using Firefox or Opera. They don't use Windows to render WMF. They don't support the format at all. They will simply fail to display the image.

Re:Over/Under

[eakthecat]

No.

It was designed to be easily uninstall-able (listed in Add/Remove Programs, not leave cruft behind, etc). Furthermore, the authors of the patch recommend that you uninstall their patch before installing the official fix (assuming Microsoft ever gets it out the door).

Re:Over/Under

[Malor]

The actual DLL at fault is gdi32, I believe. You will probably have a hard time running your machine without it. :)

The DLL to be unregistered, if I understand correctly, is just one attack vector to get at gdi32... it is not, itself, the problem.

The current exploits may not bite you on 98, but later ones certainly could.

Re:Over/Under

[TubeSteak]

I'm not sure whose opinion deserves more weight, someone with a 4-digit /. UID or another user rationally rebutting his argument.

Re:Over/Under

[yestertech]

Funny, I recall dealing with networked Macintosh worm/virus in '86 on appletalk (something that inserted itself in the window frame rendering callback and another CODE resource virus) - and there were already virus scanners and defenses being developed - and WMF is conceptually like the Mac PICT format, so not completely clear of the networking age.

Re:Over/Under

[drsmithy]

That in a nutshell is the biggest problem with Windows.

No, it's a problem with software developers. If you're going to apportion blame, do it correctly.

*NIX systems, such as Linux and OSX are more secure mostly because of they do not require administrator status to run application programs.

_Windows_ doesn't "require" it either. Incompetent/lazy/ignorant software developers write software that does.

The other change would be to get rid of the registry which is used to ensure that malware runs when the system is booted, among other functions.

And how is it any different in that regard from the configuration files on any other platform ?

Re:Over/Under

[arminw]

....._Windows_ doesn't "require" it either......

Well they ought to tell the users that to run as admin is very DANGEROUS to the health of their computer. Then tell the users they must set up a non-admin account for everyday use and put up a nasty dialog box every time a user is asked for an admin password.

"Are you sure you want to do this? If this came over the Internet without your EXPLICIT request, you may be installing dangerous programs". Then highlight a big RED NO button as default.

In school and business settings, the user should not even have the admin password at all. It seems that MS ought to have sufficient clout over their developers to FORCE them to write applications that do NOT require a user to be an admin. If MS had done this ages ago, most of the malware on the Internet would be diminished to a livable nuisance, like flies in the summer. Maybe someone can compile a list of programs of all kinds, written in the last four years, that will not run correctly for a non-admin user.

In OSX, which is infinitely more secure (zero malware in the wild) there is no registry or other central place where application and other computer settings settings are kept. Each user keeps the settings for all programs in their own user space. If there is a problem, only that user is affected. Also, each user can set any given program parameters to their own choosing. Trashing the settings file(s) for that user will make the computer to create a new default set. There is no need to figure out how to edit an arcane file, which if corrupted can prevent a computer from booting. In OSX there is also a user specific login file and unlike Windows, nobody gets root access by default. The registry is one of Microsoft's biggest abominations. Stop defending the world's richest computer company who can't, or maybe worse, won't come up with a safe computing environment for their customers.

Re:Over/Under

[drsmithy]

Well they ought to tell the users that to run as admin is very DANGEROUS to the health of their computer. Then tell the users they must set up a non-admin account for everyday use and put up a nasty dialog box every time a user is asked for an admin password.

Both of these practices are recommended by Microsoft.

The problem is that even the concept of "admin" and "non-admin" account is alien to the typical end user. Even the ones who say they understand, often don't (just look at the number of people who think OS X not allowing root logins means "nothing can run as root").

In school and business settings, the user should not even have the admin password at all.

That is an issue for the IT department, not Microsoft.

It seems that MS ought to have sufficient clout over their developers to FORCE them to write applications that do NOT require a user to be an admin.

The current situation would suggest they do not. Indeed, history demonstrates it is the developers - by proxy of their customers - who have the sway over Microsoft.

To be eligible for the "Made for Windows XP" sticker, applications have to run as a regular user. Microsoft have also been telling developers to write software assuming users aren't Administrators since at least 1996-97 (and probably a lot earlier, but 1996-97 was the first time DOS-based Windows supported the per-user registries and profile concepts that Windows NT had always had).

If MS had done this ages ago, most of the malware on the Internet would be diminished to a livable nuisance, like flies in the summer.

No, it wouldn't, because the vast bulk of malware doesn't need Administrator-level access to do its job.

In OSX, which is infinitely more secure (zero malware in the wild) [...]

No, it's "infinitely" less exploited. There's a difference between "secure" and "not attacked".

[...] there is no registry or other central place where application and other computer settings settings are kept.

Yes, there is. How do you think the system keeps track of global configuration and runtime data ?

Each user keeps the settings for all programs in their own user space.

Just like Windows !

Trashing the settings file(s) for that user will make the computer to create a new default set.

This is an application dependant issue. Properly-written Windows applications, also, will regenerate default settings if none are found. It's not something the OS does (or even could do).

There is no need to figure out how to edit an arcane file, which if corrupted can prevent a computer from booting.

If you want to trash preferences, however, you do have to first *find* an "arcane file" to trash. It's not markedly different from finding an "arcane" Registry key to delete.

In OSX there is also a user specific login file [...]

Just like Windows !

[...] and unlike Windows, nobody gets root access by default.

Nope, but they get "Admin" access, which in some technical ways is worse (an Admin user who enters their password at the sudo prompt gives the running process more access to an OS X system than a process running as an Administrator account has in Windows).

The whole "Administrator by default" thing gets dramatically overplayed (at least in the context of the home user - managed environments are a whole different kettle of fish). The vast bulk of malware has no real need of Administrator-level privileges to work. The only reason switching to a non-Admin account helps _now_ is because most malware is just as badly written as the average Windows program and *assumes* the user is running as Administrator. It won't be an effective defense forever.

The registry is one of Microsoft's biggest abominations.

Given your demonstrated lack of knowledge or understanding of the Registry thus far, I think any criticism you make needs to be taken with a grain of salt

Re:Over/Under

[mce]

That of someone with a 3-digit /. UID obviously... :-)

More to the point: I was there too (I got on the net - the real one, that is, not just BBs-es - in 1988). IMHO, both grandparent posters were right.

The net was very real back then, and multi-user machines were in common use in engineering (I used graphical DomainOS Apollo workstations for my master's thesis, while we mostly still had an experimental and barely usable X11R2 floating about on some of the non-Apollo workstations). But security was indeed very lax in those days. We pulled some amazing pranks on each other back then and didn't really see the true potential impact of what we could do. It was just "having fun amongst the good guys at each other's expense". The bad guys were the ones that wrote viruses for MS-DOS. But since everyone knew that MS-DOS was a toy for kids, it really didn't matter. Once the kid's clever enough to write viruses would grow up a bit and go to college, they'd surely repent. And since they were that clever around computers, they'd be eagerly welcomed "on the job" as soon as they had a CS degree of their own.

Hell, the only security X had was xhost. Get past that, something horribly trivial (especially if open remote access to X is the default as it used to be), and you can do anything you want with people's machines and easily captured passwords. We didn't even need buffer overflows or callback-based image formats to get anything nasty done back then... :-)

My first real understanding of what was about to happen came "only" in 1991 when I spent a year in the Belgian Navy (conscripted) and when one day I had to pull the plug on the network of an entire Navy school due to some stupid but harmless virus that was spreading through the network. Up to that point' I'd never seen standard PC's and any sort of network in ome combination. So that day I really did "see some of the light".

But even so I didn't really get it yet. Back then I thought I'd done a very good job: stopped the spread, got the network cleaned, and defined some rules about not bringing "aboard" untrusted floppies that weren't needed for the job. Now I know what a fool I was: I'd been on the real Internet for several years; I'd just seen "live" what a network could do when combined with MicroSoft toyware; but since that particular school was not on the Internet (after all, they were not using UNIX :-), I imagined that things would be and remain under control if only people would implement a few rules about bringing in floppy disks form home. Real computer users didn't use PCs anyway... Silly me!

Re:Over/Under

[mce]

The problem is that even the concept of "admin" and "non-admin" account is alien to the typical end user.

It's worse. Even many programers in the Windows world still don't get it.

Have you ever run Photoshop as a non-admin user? It works just fine, *BUT* the very first thing that it does when starting is to put up a dialog box that says "You are logged on as a limited user and therefore have limited access privileges on this system." Is there a better way to scare clueless users into using admin?

And that's not the only sign that Photoshop still hasn't embraced multi-user either. Have a guess where its default catalog is stored? Yep: Under "All Users". Because it is just sooooo nice to share everything with everyone by default. Especially since we all know that in the PC world "everyone" is just one physical person anyway. Someone who sometimes will log on as an admin and sometimes as a limited user. Surely he or she would be confused if both account's don't show the same sets of photos...

Re:Over/Under

[cpu_fusion]

I completely agree. Anyone with a basic understanding of computer security would be able to see this was a wide open gaping hole. And according to the news sites I've seen, it's been in Windows for 15 years.

ANY DECENT AUDIT of such an "important" piece of code should have seen this with big flashing red signs. Registering a callback in a DATA DOCUMENT is patently stupid.

I agree with you that the real question is: who has known about this and for how long?

Because of how easy it is to get someone to view one of these files, how silent and universally easy the callback is (doesn't even need a stack or heap overflow!!!), how easily it can evade intrusion detection signatures, how rediculously easy it would be for an expoloiter to erase their tracks after breaking in -- it is downright scandalous.

Microsoft, organized crime, the NSA, North Korea, the zit-faced kid across the street could have used this bug to: spy on competitors, spy on the government, spy on YOU. And you'd never know. And only now after 15 years is it getting fixed, because HACKERS revealed it.

This should be the pearl harbor for data security. This should be on every tech blog. There should be congressional hearings. People should be talking under oath about this.

Re:Over/Under

[arminw]

.....The vast bulk of malware has no real need of Administrator-level privileges...

On OSX, any install of any program wanting to run for the first time asks for an admin password and gives a warning. If the user doesn't give the password and clicks "Cancel" the program cannot run or install. There is NO way to get a program running on OSX without some indication. Assuming that OSX were also vulnerable to the latest worm embedded in graphics files, when this worm tried to run, a warning would come up that code xxx was trying to run, giving the user a warning and a chance to cancel this operation. Why can't Windows be programmed to do this? It is of course not fool proof, but it may prevent many infections. Scaring the s**t out of clueless users by a dire warning in the name of security may not be such a bad thing if it benefits the over all computing community.

Finding a file and trashing it is a lot easier than calling up a special program to edit a special file. Trashing a user's ENTIRE library is still preferable to having to format the drive and re-installing everything because something like Sony's rootkit screwed up the entire computer. Trashing such a user library doesn't prevent the computer from ever working again, which is often the case if the registry file is corrupted. Is it not instructive that Sony nor any other DRM crazy music outfit has yet come out with a way to prevent Mac users from playing their damn infectious music abominations with impunity? When I deliberately put one of these rootkit disks into my Mac, iTunes comes up and the disk rips and plays just like any other music CD. If it were so easy to do the infection crap on Macs, don't you think that these greedy music companies would have figured something out by now? Apple, ("rip, mix, burn") was FORCED to put some DRM into their iTunes store to appease the music moguls, but MS pushes DRM as a selling point, calling it a feature! They are also the ones pushing "trusted" computing. If they have their way, they, not the user will be "trusted" to do whatever THEY want to do with YOUR computer.

Re:Over/Under

[0WaitState]

Ah, the fun with "melt"--I think every first-time Apollo user got hit with that one.

Just to make my points more briefly, by MS-Dos 3.0 it was well known that one needed a virus scanner/disk cleaner. And the internet worm of 1988 was devastating. I still assert that by the end of the 80s O/S vendors had no excuse for ignoring security concerns. Unixes slowly got better (took Sun until about 1995 to clean up the easy SunOS hacks), but the Microsoft platforms didn't. VMS could be locked down, though often wasn't.

Re:Over/Under

[udippel]

What makes you think so ? Are you an insider ? I ask, because most of the sources (including sans) state differently. Why would Opera or Firefox not resort to using the built-in image rendering ?

Or, if you talk about the extension .wmf, then you didn't do your homework.

Re:Over/Under

[hkmwbz]

You don't have to be an insider to know that Firefox and Opera don't support WMF files, nor do they use Windows to draw images. To be affected when using Opera or Firefox you'll have to click a link to a WMF file and choose to open it in Windows.

Where exactly does "sans" state differently?

Re:Over/Under

[udippel]

* Is it better to use Firefox or Internet Explorer? Internet Explorer will view the image and trigger the exploit without warning. New versions of Firefox will prompt you before opening the image. However, in most environments this offers little protection given that these are images and are thus considered 'safe'.

I take the liberty to read this passage differently from the grandfather.

* Should I just block all .WMF images? This may help, but it is not sufficient. WMF files are recognized by a special header and the extension is not needed. The files could arrive using any extension, or embeded in Word or other documents.

http://www.kb.cert.org/vuls/id/181038: Please note that Windows Metafile data may be saved with an extension other than WMF. A file with any extension that is associated with Windows Picture and Fax Viewer can be used to exploit this vulnerability. By default, Windows Picture and Fax Viewer is associated with the following file extensions: BMP DIB GIF EMF JFIF JPE JPEG JPG PNG TIF TIFF WMF

I have yet to read the definite statement that Opera and Firefox do not fall back to gdi.dll, ever.

However, disabling the Windows Picture and Fax Viewer will not eliminate this vulnerability as it is currently thought to exist in the Windows Graphical Device Interface library (GDI32.DLL).

I know, speculation. But not more uncertainty than in the grandfather's post.

Re:Over/Under

[hkmwbz]

Opera and Firefox are cross-platform browsers. No, they do not fall back to gdi32.dll.

Re:Over/Under

[online-shopper]

Just one problem with your thinking.
This is currently affecting XP, which was based on NT, which was supposed to be networked and all that jazz. MS claimed a DoD security rating on an OS affected by this. Which really should tell you what they think of security.

Re:Over/Under

[Malor]

The flaws that have plagued NT have most often come from backward-compatible features re-implemented on the newer OS. (SMB filesharing and the vast numbers of holes that still exist in it is a great example.) Had it *truly* been written from the ground up without trying to be compatible with existing programs, it would, most likely, have been far more secure. NT has a very rich security model. It's leaky because of all the hacks to get the old code running, and to support old clients. The fundamental design is very strong, probably better than any Unix, but it was crippled by the backward compatibility layers.

Most likely, had they abandoned backward compatibility, it would still be less secure than we would like, but it would be much better than it is now. But it might never have gotten really popular if it didn't run the old code.... so Microsoft went the route that was more likely to make them a lot of money.

Even had NT been a fresh start, I'm sure Microsoft would have found ways to screw it up... they were desperate to kill Netscape. They would have done anything they had to, and cleaned up afterward. So we'd still have problems, but I bet they'd be much less severe.

Of course, there's always the argument that one of the worst security blunders they ever made, ActiveX, had nothing whatsoever to do with old software. It was a brand-new, from-scratch implementation of an incredibly bad idea, at a time when they should have known better. It was obvious even to me at the time that it was stupid. They should have understood, far better than a junior admin in a small company, just what a dismal idea it was.

From Microsoft's perspective, however, it was probably the right thing to do. All the billions they've made from that software will pay for an awful lot of fixing. Customers won't have much fun, but Microsoft hasn't been about customers in a long, long time.

Re:Over/Under

[Malor]

Yes, networking existed at the time. But it was unusual. And it was always local; nobody could anonymously access your computer. All these different types of networking you mention just prove that point.... networking wasn't even all compatible. If you had a machine set up for VINES, and someone else was set up for Netware, and a third person was set up for Token Ring, well... you were pretty much hosed, no? No interoperability.

Viruses, such as they were, spread via physical media.... sneakernet. That was the only way they COULD spread, because networks were too different. A NetBEUI exploit wouldn't work on an IPX network, for instance. In some cases they'd be able to spread via network shares, running at a higher level and infecting programs directly, but I'm aware of very few viruses at the time that did that. DOS, of course, had ZERO security... if you got a virus, all your files could be infected in just a few minutes.

In other words, the concept of a remote exploit, of a virus attacking you over your network from somewhere in Russia, was something you'd see in a movie, not something that happened for real. I don't believe I ever even *saw* a PC virus before the advent of email, as a matter of fact... there was lots of scare press about viruses, but they never infected me or the people I knew.

It's ridiculous to blame Microsoft for not seeing the advent of universal networking. Nobody but a few academics had even HEARD OF TCP/IP at the time. From 1995 and later, I agree with you completely. But blaming them for stuff designed and written back in the Windows 3.1 era.... that's crazy.

It's like criticizing Henry Ford for failing to put a catalytic converter in the Model T.

Re:Over/Under

[Suppafly]

What default catalog are you referring to? Do you mean the sample pictures? Of course the sample pictures would be stored in a folder thats available to everyone, otherwise you'd have many copies of the same files all over the place. If someone is going to use one of the sample files for a project, the resulting file would be saved in their my documents, but there is no reason for everyone to have their own copy of the sample files.

If by catalog you mean something other than the sample photos, I apologize. No version of photoshop that I've ever used has stored anything under All Users.

Re:Over/Under

[Suppafly]

If security had been a concern earlier in the history of the internet, we wouldn't have any problem with spam now. Getting rid of spam would have been trivial had it been anticipated back when the internet was just a few acedemic institutions connected up.

You may have a different definition for PC than most people, but almost every personal computer by the late 80's didn't come with a modem. I remember buying PCs in the early 90's where a modem was an additional cost if it was even offered at all.

Re:Over/Under

[mce]

Nope, I do not mean the sample pictures. I actually did see it do what I described. I installed as a user with admin priviledges (not even the real administrator account!) and imported a of my own few pictures to test the installation. Guess where they ended up. I initially found out because when starting to use the thing for real as a normal limited user, those test pictures were already there when opening up the "new" catalog.

In any case, even if I f*cked that up somewhere, the silly warning that I mentioned is extremely real. I actually fired up Photoshop just to make sure that I got the wording right.

Re:Over/Under

[mce]

Libel, he? Then what about http://it.slashdot.org/article.pl?sid=06/01/13/151 9204

Re:Over/Under

[mce]

Stephen Toulouse of Microsoft said this about it:

The potential danger of this type of metafile record was recognized and some applications (Internet Explorer, notably) will not process any metafile record of type META_ESCAPE, the overall type of the SetAbortProc record. That restriction is the reason it's not possible to exploit this vulnerability by simply referencing an image directly in HTML. IE just won't process it.

So yes, they did indeed know about it before the world did.

Shame

[Jonnty]

It'd be nice to have a computer that I can use the patch on.. Maybe I can Wine it?

Re:Shame

[Janek Kozicki]

if not wine it, then just whine at it ;)

Re:Shame

[Grey Ninja]

Yeah, when I heard about that WMF security vulnerability, I was up half the night trying to get it working in Wine, so that I could have the genuine Windows experience. But to no avail. It just didn't work. Maybe this patch will fix that?

Re:Shame

[julesh]

It'd be nice to have a computer that I can use the patch on.. Maybe I can Wine it?

That's an interesting question -- is wine vulnerable to this flaw? As I understand it, it is essentially a design fault in the way WMF files work (i.e., the entire process of using a WMF file was never designed to be secure in the first place, so it is able to do stuff like set up callbacks into the application's address space).

Re:Shame

[Jonnty]

Well, I don't know whether Wine support WMF.

Re:Shame

[Anonymous Coward]

If you were up half the night, then you already got one of the experience.

Re:Shame

[julesh]

I would have expected it to; it has been a core part of GDI since Windows 2.0 was released, I believe. To not implement such a basic feature would be disastrous for app compatibility.

Re:Shame

[Mad Merlin]

From the Wine developer's IRC channel:

<puk> _Marcus_: wonder if you had a look what Wine does with the WMF exploit
<_Marcus_> puk: not yet. i can try with the heise testpage
<puk> nah, don't worry
<puk> just wondered if we are missing a very "important" compatibility feature with Win ;)
<_Marcus_> hmm, i wonder what wmfs are ... just some other word for enhanced metafiles?
<puk> .wmf
<puk> probably the old windows metafiles?
<puk> not yet enhanced?
<_Marcus_> yeah
<_Marcus_> but in general
<_Marcus_> we handle META_ESCAPE with SETABORTPROC

I would interpret that as Wine not being vulnerable to this, but I haven't tested it myself.

Sometimes I think they do it on purpose

[User 956]

Sometimes, I really start to think that security is so poor in commercial operating systems, because they want to use protection from all these exploits as the bait to get us into the "trusted computing" cage.

Trusted computing is a farce, because the one thing that *isn't* trusted, is the user.

Re:Sometimes I think they do it on purpose

[JulesLt]

Hmm, care to name any other commercial OS known for poor security / response to security issues? Solaris, OS-X, BeOS?

Re:What's wrong with...

[chrisgeleven]

Yeah because 98% of PC users know how to disable the offending DLL. Heck, 98% of PC users don't even know what a DLL is.

SPI Aren't meant for this type of filtering...

[PPGMD]

SPI firewalls aren't meant for application filtering, on my company servers I just blocked WMF files at the Exchange server, and set our ISA Servers to block WMF from websites also. Company policy already blocks the various IM clients.

I imagine that I could push out the deregistering fix, and associating WMF with Notepad, but that seems a little extreme because our attack vector has become limited, and our anti-virus is now updated with the newest signatures that detect this exploit.

Re:SPI Aren't meant for this type of filtering...

[grenthal]

FTFA

* Should I just block all .WMF images?

This may help, but it is not sufficient. WMF files are recognized by a special header and the extension is not needed. The files could arrive using any extension, or embeded in Word or other documents.

Re:SPI Aren't meant for this type of filtering...

[Pac]

You may not be out in the open - from what I gather, the exploit can use any extension and Windows will recognize the Metafile from the headers (ie, even if it is disguised as a .gif or .jpg). So it would be wise deregistering the dll for the time being.

Re:SPI Aren't meant for this type of filtering...

[Anonymous Coward]

They also embed nicely into PowerPoint files. WMF is one of the very few vector formats that I know of that will import into PowerPoint without it looking like crap, or without requiring additional software to be installed on another machine in order for it to work properly (this is especially important for portable presentations that might be taken to a conference or some other setting where you do not have control over configuration).

So much for that.

It goes without saying

[ZerocarboN]

FTA:
You cannot wait for the official MS patch, you cannot block this one at the border, and you cannot leave your systems unprotected.

This has always been the case with Windows, if I'm not mistaken.

Re:It goes without saying

[HiThere]

No, usually you've been able to block things at the border. Some have even been harmless enough that you could wait for MS to address them. E.g., I still have an unpatched MSWind5 machine that I'm patiently waiting for the right patch for. But the unpatched state is harmless, because until the patch arrives I can just keep it isolated from the net (and externally originated floppy disks).

Shows how much MS cares for its customers.

[Anonymous Coward]

How many late nights, allnighters, and missed holidays have you experienced, thanks to things like ILOVEYOU and Slammer? How many times have you had to clean up the mess created by Microsoft's shitty, unsecure software?

Clearly Microsoft wasn't interested in calling people in over the holidays to whip up a patch for this critical vulnerability-- something that you could go in a couple hours early tomorrow and roll out to the PCs in your organization. They're going to let you suffer. And why should they care? They've already got the money of the company you work for. People are going to return from their holiday vacations tomorrow, load the wrong web page in IE, and get pwned. And you'll be left to clean up the mess. Again. Better pack an extra sandwich with your lunch tomorrow, because you probably won't be getting out at 5.

Re:Shows how much MS cares for its customers.

[Anonymous Coward]

How many late nights, allnighters, and missed holidays have you experienced, thanks to things like ILOVEYOU and Slammer? How many times have you had to clean up the mess created by Microsoft's shitty, unsecure software?

None. I've had plenty of all-nighters, late nights and missed holidays because of Linux though.

Re:Shows how much MS cares for its customers.

[A beautiful mind]

Yeah, but not everyone can be you, Linus...

Re:Shows how much MS cares for its customers.

[jacksonj04]

Never, because we set up our systems properly in the first place.

Re:Shows how much MS cares for its customers.

[TuomasK]

Out at 5? I already leave at 15.00.

Programmers?

[Claire-plus-plus]

Windows have produced a datatype that allows people to place executable code into image files? How can they call themselves programmers. Seriously whoever engineered the WMF format should be ashamed.

Re:Programmers?

[jimktrains]

I can't tell from the 3 sentences if you are joking or not. Executable code can be placed in ANY file (.doc, .jpg, .wmf, .anything) and if you can get it into the right place, it will run. Windows (and I would venture many OS, to an extent) do not place restrictions around what is data and what is execuable. To the OS it's all a string of bytes.

Re:Programmers?

[Claire-plus-plus]

I am aware of that type of exploit, but that's not what I was talking about. For an exploit like the one we are facing to work the metafile holding the image would have to actually run a program, because if the image is placed into memory by another program it wouldn't be able to overwrite any addresses (because the program storing the image in the stack chooses it's address.

If I read the article properly it is saying that windows has metafiles that can contain code, but can be used as images. That is bad engineering.

Re:Programmers?

[Claire-plus-plus]

You can place executable code in any file. The problem is executing it. That is, operating systems don't "execute" text files. If you place a text file into memory the program that reads text files reads it and assumes it's all text. I am perfectly aware that the CPU and the OS it's all the same thing, but the operating system keeps track of the memory locations of running processes. It is impossible for a data file to run executable code because it is not a process. To run the executable code in a data file something has to either tell the scheduler to run it or copy the code over a process that is already on the list.

Windows has a unique problem in that it has data formats that are runnable as scripts. That is bad engineering. It was also done intentionally. That was bad.

Re:Programmers?

[iBod]

Agree with you there C++, but this kind of sloppy design/coding would not be possible with a an architecture that implemented memory protection at the hardware level.

IBM mainframes were able to designate the usage of 'pages' or 'frames' of memory by using 4-bit 'storage keys' in the mid 1960s!

You requested the storage in a specific key (in your own address space) and any program accessing that storage with a different key. The ability to change storage key was strictly controlled by OS privilleges and any program violating that rule would immediately die with a 'storage protection' exception.

The guys at Intel in the late 1970s didn't consider things like that - if they ever knew about them - as they were mostly IC designers, not proper computer architects.

I think the Motorola 68000 series was following in the footsteps of the IBM S/3x0 mainframe CPU architecture but never quite got there.

Re:Programmers?

[daboochmeister]

Uhh ... can you say "Postscript"? They didn't invent the idea of embedding code as part of graphic/print rendering.

Unless you're willing to say that everyone involved in engineering Postscript should be equally ashamed (and maybe you are).

Re:Programmers?

[iBod]

You are correct Godfathr!

I think that upholds my point that instruction and data spaces should not be shared in any decent CPU architecture.

Re:Programmers?

[julesh]

If this *were* a stack overflow, you'd have a good point.

However, the WMF format allows you to embed a code in it that basically says "when you've finished drawing this, call the function at this address to execute it". The reason that this exists is that WMF was not originally intended to be a file format. It was intended to allow Windows applications to record the steps necessary to draw an object, so they could do it again later (presumably using less processing at that point because everything's precalculated).

Re:Programmers?

[Claire-plus-plus]

I guess since I am _that_ stupid I should tell all the students I was teaching compiler theory and systems programming to last year they should ask for a refund.

Google is NOT an academic reference.

Re:Programmers?

[TheSpoom]

Actually, Windows will try to avoid running code in the wrong location. It works better with hardware (CPU) support, but it does also have a software component.

Re:Programmers?

[iBod]

Yes, you are correct.

This exploit could have been prevented by good design, but it wasn't.

My point was that good CPU architectures should be made so that you can't set the instruction pointer to some arbitrary, untrusted address.

Re:Programmers?

[Anonymous Coward]

BZZZT!!! Wrong answer! Thanks for playing though.

Read this to find out where you went wrong

Re:Programmers?

[drunkennewfiemidget]

Let me try and dumb this down for you a bit.

This is your CPU:

Those are three registers. The first two are data registers, the second one is the instruction register (Where code locations go.) I've given them 12 hyphens each.

You try and put 18 of the letter 'a' into the FIRST data register. If your code properly validates, you get:

However, if your code DOESNT validate correctly, you get:

So now you have data that's OVERFLOWED into the next register.

Now, instead of just 18 characters, lets put in 36!

Ooh.. we've now overwritten the INSTRUCTION POINTER register with a bunch of As. In Linux, this would usually result in a 'segmentation fault'. In Windows, you'll get "This program has performed an illegal operation.. bla bla bla" or a blue screen of death.

Now, if you know you can overwrite that instruction pointer, then you can craft some code and put it into EIP (the instruction register) and make the system execute the code pointed to by EIP which is code you made to make the system do basically whatever the hell you want.

What the (grand-grand?)-parent was saying was that the x86 architecture should have the ability to mark data as 'data' bytes or 'instruction' bytes, so if those As got thrown into EIP, the system would know better than to do anything with it, because it's not runnable data.

This particular bug *IS* the fault of Microsoft, but it certainly wasn't put there on purpose (or at least it wasn't the result of any 'callback' built into the metafile type.)

IANAL, YMMV, IMNSHO, I could be wrong. ;)

Re:Programmers?

[IamTheRealMike]

WMF is a very old image format and dates from the time of Windows 3.1 and earlier. In other words, it dates from a time before the web and the idea that people would be transmitting malicious image files around was foreign. The idea that programs would routinely display thousands of images every day from potentially untrusted sources was also alien (remember most PCs were in business at this time not at home). So I can't really blame them for not forseeing this over 10 years ago, nobody did really.

Remember that even very modern "data" formats like HTML allow you to embed code into them.

Re:Programmers?

[gothfox]

Those are the very same people who brought us viruses starting automatically on disk insertion (unthinkable on PCs before MS), viruses in mail (unthinkable before MS), DOS attacks using font renderer in the kernel and other wonders of technological innovation in the art of pwning the customer.

Re:Programmers?

[drunkennewfiemidget]

Gah. I had written a bunch of lame ascii diagrams using [------] to show the registers, but I kept hitting the 'lame filter'.

Fucking slashdot.

Re:Programmers?

[ciroknight]

And what archetecure would you suggest? IIRC, every archetecture I've worked on has allowed for an arbitary jump. This is a neccesity because this is how looping structures work.

For an archecture that you present, you'd have to have some way of trusting a section of RAM, but how can you lend a section of RAM trust? Furthermore, how do you move items with trust into and out of the trusted RAM cell? Any programmer worth his title knows that if trust (in this case a flag, a CRC, an encrypted value, whatever you want) can be given to one object, it can be given to any other object as well. If you "trust" the data by encrypting it with a certain key, then all that is needed to encrypt any data is the key and the data.

Let's keep going; if you want the computer to be a general use computer (and not something like a DVD player or a music player), you'll have to distribute that key to people. Why? Because people make programs too.

Now let's step back and see what all you affected with Trusted Computing: You've first reworked the processor, so that requires distributing and replacing everyone elses, then you've reworked the memory, that may or may not require a rework, but it'll at least take investigation into reworking it. You've reworked network protocols so they can be "trusted", you've reworked the Kernel (because of course, it has to be loaded from an untrusted medium), you've reworked the programming language to support trustable code, and you've reworked the compiler to make trusted code. You've changed the whole industry, and you're banking on the fact that there wasn't a single bug introduced *anywhere* along the process, especially in the Hardware, which is much harder to revise once it's distributed.

Now let's look at the alternative: Better code. What needs to be changed? The code. That's it. Oh, I guess that's cheaper, more sensible, and it works with what we've got.

I'll stick with the latter thanks.

Re:Programmers?

[jimktrains]

Thanks:-D

That's what I meant by "getting it intot he right place"

Re:Programmers?

[Lagged2Death]

There is not an 'EXEC' segement type in the metadata specification itself, if you will.

In the internet age, it's hard to believe, but in fact, yes, there is. This isn't a buffer overflow exploit; this is actually the way metafiles were intended to work. AC makes the same point a bit more rudely.

Re:Programmers?

[iBod]

Obviously you know nothing about CPU architecture. Like the designers of the x86 series, you think you have to invent the wheel from scratch, when so many better wheel-designers have already done the job for you.

An 'arbitrary jump' is fine inside your own address-space, so long as you jump to storage you own, AND you have requested, AND have the 'key' to, AND is marked 'executable' in your current key/ring.

Jeeze! The mainframe guys had this figured out decades ago.

Don't trust the coder first - trust the computer architect first!

Re:Programmers?

[qodfathr]

Well, my mistake AND it is ugly! (Although, as your link indicates, this is a throwback to a time when such things were needed.)

Re:Programmers?

[ciroknight]

I believe that comment makes you out the fool not me.

You've basically said your archecture only allowed code from one company/programmer to be ran at once; sectioning off address space to each program means that for shared components to work, they'd have to be loaded into each address space, which of course, defeats the point of having a Shared Object (and unless you're working on a computer that nobody can afford with 64GB of ram, this is ridiculous; imagine every program on your computer statically linked).

The part about "you requesting"; computers don't request anything. They follow instructions. And if the instruction says "Jump to this address", that's exactly what to do. Whether that address is off a bridge or on in secured ram with No Execute or just ram, it's going to jump there (whether or not it gets executed, it will jump, causing the program to crash, which is bad in itself, or causing the exploit to run). If your CPU has a No Execute flag on the ram, and you're lucky enough to have an operating system that supports it AND you're lucky enough that the exploiter isn't smart enough to figure out how to attach code arbitarily to executable files, then and then alone would this work.

Hell, if you were a good crypto-stenography student, you probably could write a program that is exceptionally beign at one offset, only to reveil a nastier, malevolent program when you offset the code by a certain number of bytes. The program would load into memory and do what its supposed to do, but then when the program hit an instruction to jump to the address space within itself, the exploit would run, and you'd be just as owned as before.

Trusted computing just doesn't work. You've got to trust everyone on every step of the development process, and even then, someone will find a way in. Bugs happen because nobody is perfect and nobody can afford to be, not even Microsoft.

Re:Programmers?

[1u3hr]

Windows have produced a datatype that allows people to place executable code into image files? How can they call themselves programmers.

The same people have been making EVERYTHING executable for years. Going back at least to Word for Windows 1, when they rolled macros into the document file, which promptly led to the Word Concept virus and its many descendents.

Re:Programmers?

[r00t]

Well, it'll halfway jump there. It winds up in an exception handler of course, trapping into the OS to get something like a SIGBUS or SIGSEGV.

I suppose you could have an architecture with the address being simply unrepresentable. For example, you use 32-bit registers for apps but need a 40-bit address for kernel code.

There's also LISP machines and the AS/400 virtual machine, but that's weird as Hell. Typed memory, enforcing the inability to modify the bits of a pointer as you please, is pretty much unused these days. It isn't very compatible with C and C++. You kind of need to program in Java or COBOL.

Re:Programmers?

[iBod]

Well, it's nothing to do with 'Virtual Machines' on an IBM mainframe, or even an AS/400.

When you request a chunk of storage, you request it in a particular 'key', or else it defaults to the key of the data space of your own address space.

An arbitrary program cannot request memory in another key unless it has specific privillages (dependent on secure rules in the OS security subsystem).

The ownership of the chunk of storage is determined by your address space and the storage key.

I constantly amazes me that younger IT professionals seem to have learned nothing from the past.

Re:Programmers?

[Alioth]

This is not a buffer overflow exploit - it's WMF working as it was designed to work - i.e. WMF was a security trainwreck just waiting to be discovered.

On the subject of buffer overflows, the OpenBSD crew have solved that one for x86 - W^X, a secure malloc and free implementation and everything being compiled with ProPolice.

Re:Programmers?

[clem.dickey]

But IIRC, IBM's S/360 key-controlled storage did not distinguish "read" from "execute." The storage keys were originally used to separate users in a single address space, since S/360 had only one address space.

I don't think you could guard against execution (separately from read, on a S/360 successor) until IBM introduced data spaces. Execution is limited to data space 0, and if you don't let a program write to that space you are OK. But even now, though the architecture *can* separate read/write space from execution space, do mainframe OSes take advantage of that?

Re:Programmers?

[deaddrunk]

In the words of a million spotty Counterstrike players: "ha ha pwned" :)

Re:Programmers?

[deaddrunk]

Except that VBA is incredibly bloody useful and I would hate to have to use Word or Excel without it.

Re:Programmers?

[arminw]

......This exploit could have been prevented by good design, but it wasn't.....

There are still a number of code leftovers in Windows that go way back to the days before the Internet or networking as a whole common. Each computer stood alone and data was passed around on floppies. The fact that much, if not most Windows software still won't run, unless it has full access to the whole system, also goes back to the days when a computer was a single user PERSONAL computer, much like a single celled organism. Today, the Internet makes each computer one cell in an interconnected, world wide organism. The old components of the cellular structure have to be replaced, one by one and MS has been having trouble doing that fast enough. The *NIX heritage systems which do not suffer from these single user leftovers, were conceived with networking and security in mind and are therefore more resistant to the external attacks. MS should examine every byte of their code that was written for the single user paradigm.

Re:Programmers?

[julesh]

My point was that good CPU architectures should be made so that you can't set the instruction pointer to some arbitrary, untrusted address.

Well, that's true. And if used in the way Intel intended, the x86 architecture is one of these. You're supposed to set up your CS segment descriptor to point only to executable code; it's just programmer laziness that means almost all systems on the platform actually include the entire virtual address space in it. One of the BSDs (FreeBSD, I believe) actually uses this feature to provide a non-executable stack. I believe WinXP SP2 does the same for some applications, but only if they are marked as compatible with the approach. Windows XP SP2 on x86-64 is perfectly capable of providing such protection for all applications, using the 'NX' bit in page tables, as does (I believe) Linux.

However, this kind of protection doesn't prevent vulnerabilities. It just makes them somewhat harder to exploit.

In the present case, for instance, you would (I believe) still be able to arrange for any function you wanted to be called with any single parameter you wished. WinExec("\\[my ip address]\public_share\install_rootkit.exe") should do the job.

Re:Programmers?

[r00t]

I can fully and efficiently emulate that with page tables. I'll need something decent of course, not just any old 32-bit PC. I can make it work with:

• alpha - 8K pages with full rwx permissions
• x86-64 - 4K pages (and other sizes) with rwx,r-x,---,rw-,r-- permissions
• powerpc - 4K pages with read/write control, plus execute with 256M granularity
• ultrasparc?

I can do better in fact. The OS gets to decide, being as permissive or restrictive as I like. If I want an opcode for this, which is silly, I can pick one of the many trapping instructions to emulate a made-up instruction.

Re:Programmers?

[1u3hr]

except that VBA is incredibly bloody useful and I would hate to have to use Word or Excel without it.

I'm not against macros or automation in general; it's embedding it with the document text that's the problem. There has never been a time I want to run a macro someone has sent to me along with their Word file, and hardly ever they intentionally did so. In Word 5, for instance, you had separate doc files, with the text, style files that defined the styles, and macro files. Now everything goes by default into the doc file, and it's all fucked up; macros appear unexpectedly on the toolbar when you load a document, styles change seemingly at random; by seeking greater simplicity for the user (i.e. treating him as an idiot who doesn't need to know about these things, just loading them all automatically) it has become much harder to keep control of your workspace. Either you have to become a guru to use the features effectively, or do as most users do and use it like a glorified typewriter.

I have to work with files from all kinds of users; no matter their education or skill not one in many years has known how to use macros, stlyes, or any of the "advanced" features that automation should give them. And I have to carefully check for and occasionally remove nasty macros.

Re:Programmers?

[buysse]

No, shared code is stored in segments "owned" by each process, with copy-on-write semantics. An OS can handle this with the appropriate hardware support. The parent's ideas aren't quite right, but they don't preclude use of shared libraries at all.

Re:Programmers?

[udippel]

MS should examine every byte of their code that was written for the single user paradigm.

Fine. And who's going to pay for that ? You know, they have investors breathing down their neck. Nobody who invests money wants code audit. I wouldn't want that either. Which is why I don't invest in Microsoft: I'd invalidate my own principles.

But I take bets that > 50% of the code compiled into XP is unaccounted for. That is, nobody knows exactly how it works; except if you don't link to it, the build will break.
Just think of approaching 100 million lines.

Still have to make up my mind how many percent of Vista will fall into the same category ... .
I am sure that Microsoft simply hopes and preys that one fine day the last line of code written before 2000 will have been replaced 'naturally'.

Re:Programmers?

[deaddrunk]

There are times that the macro needs to be embedded though. In my job for example we have an Excel spreadsheet where the user fills in start and finish times and all the work they do. At the end of the week they click a button that fires off a macro which generates a weekly timesheet to be sent to the agency they work for. Now I'm sure you'll tell me that I should write an Excel extension or have that macro in a global template, but I'm not in IT and IT are way to busy to work on trivia like that and are totally unwilling to let a mere office clerk have the access or install VB.NET.
The only alternative to what I've done is for the users to fill in two separate sheets which sorta defeats the object of having computers to automate tasks.
I work with people now who do use the more advanced features of Word and I have learned a great deal about it from them since I've worked there. My dad is no computer guru but he can do stuff with Excel that I have no idea about. To say that the advanced features of Office are never used is simply not true. Not everyone needs them it's true but there are plenty of people that use the more advanced Office features.

Re:Programmers?

[1u3hr]

I was specifically talking about Word, a spreadsheet is another thing; there have been functions and macros attached to cells since 123 for DOS.

To say that the advanced features of Office are never used is simply not true. Not everyone needs them it's true but there are plenty of people that use the more advanced Office features.

I didn't say "never used". Just no one I've ever worked with in the last 10 years seems aware of anything beyond the formatting bar and spellcheck. If they include macros it's a mistake and/or a virus. But if you look at what I wrote, the problem is not the features as such, it's more with how they're configured, often hidden, or activated without an obvious indication of why they're doing something or how to turn them off. Many advanced features cause more grief and hairpulling than a simple crash. I frequent Word newsgroups to find out how to turn off things that are screwing up my files; often the solution is simple, but unfindable in the help. For instance, anything that looks like a hyperlink is made live by default, to turn it off select and shift-ctrl-F9. I've got a file full of stuff like that.

Re:Programmers?

[deaddrunk]

Ah I see where you're coming from now and I agree there probably isn't any good reason for embedding macros into documents, I thought you were saying that that applied to all Office apps. I reckon we're pretty close to being of the same opinion when it comes to Word.
I've got most of the stupid stuff switched off and some of the bugs are shocking. The worst I've seen is working on a document that's on a network share and the network goes down. The document gets corrupted. I mean what the hell is that all about? Last time that happened it took me over an hour to go round and calm down panicking typists and do the best I could to recreate proper documents from the mess.

I deployed it

[rylin]

Today was supposed to be my fifth vacation day this christmas.
I've had two; and decided to come in to the office today to make sure we were patched up against the exploit.

Yes, I took the plunge.
The patch is now deployed in our small office (30 windows PCs atm); and so far so good.
Would I have felt safer if the sourcecode was released? Perhaps.

That said, I'd rather take the ISC's word on the fix than have a guaranteed hell within a couple of days.
The dedication of the people involved with ISC, as well as that of Mr. Guilfanov brightened my start of the new year.

Kudos, people.

Re:I deployed it

[tsvk]

Would I have felt safer if the sourcecode was released? Perhaps.

But the source code is released, too . The installation package should have copied it into the "WindowsMetafileFix" folder under the "Program Files" folder.

TFA conclusion is BS

[prgrmr]

Not really a whole lot of choice about this one

Sure there is. Don't use MSN to IM, for starters. Don't open e-mail from senders you don't recognize. Don't click on hyperlinks in e-mail without verifying that the URL is really what the text states it is. And if you are in a coporate setting and the Network Admin hasn't blocked IM, you've already got bigger problems to worry about.

Re:TFA conclusion is BS

[X-chan]

You don't really think all users would investigate email senders and links before clicking, do you? This flaw is pretty bad because an image is like the ideal vector for a nasty piece of code. Images can be embedded in a bunch of thing, making it a pain to filter them out. Being careful with what you open/click on is a good policy for aware individuals. However, with a large group of average users, some shit *will* slip in one day or another. Either you take the risk to use an unofficial patch, or you take the risk to wait for official patch while the flaw might get happily exploited in your network. And while I loathe the thought of using a unofficial fix because someone said "hey use it, it's good and secure" without any consistent proof, it still might be better than watching my network turned into an army of zombies.

Re:TFA conclusion is BS

[finkployd]

Don't open e-mail from senders you don't recognize.

What would this accompolish? Since around 1999 or 2000, the vast majority of viruses and trojans have grabbed all the email addresses in someone inbox, address book, etc. and sent themselves out using a random return address from this list. There is a good bet that any virus/trojan you get will have a known return address in it, however it is just as good a bet that it will not be the address of the person infected.

Geeze, here it is 2006 and people still think that the return address in unsigned email means ANYTHING.

And if you are in a coporate setting and the Network Admin hasn't blocked IM, you've already got bigger problems to worry about.

It really seems sad that the norm is to block reasonable communication tools (I use IM almost exclusively for work related communication) simply because corporate America is infatuated with Microsoft despite the massive security headaches they cause.

Off topic, I'm really getting annoyed with Microsoft admins where I work constantly complaining about IE problems. I'm starting to ask these people how many times they had to put their hand on a hot stove when they were children before they decided it was a bad idea. Is pattern recognition a skill that we as a society just no longer have?

Finkployd

Re:TFA conclusion is BS

[SillyNickName4me]

Sure there is. Don't use MSN to IM, for starters. Don't open e-mail from senders you don't recognize. Don't click on hyperlinks in e-mail without verifying that the URL is really what the text states it is. And if you are in a coporate setting and the Network Admin hasn't blocked IM, you've already got bigger problems to worry about.

Not using MSN messenger is not going to help much, it is merely a transport, and not related to the vulnerability itself.

Even when you do not open attachments, this vulnerability can still be triggered by email as has been pointed out by ISC and others. Merely having an infected WMF file anywhere in your system can be enough.

Re:TFA conclusion is BS

[prgrmr]

You don't really think all users would investigate email senders and links before clicking, do you?

I've not used Outlook ever. For the last 14 years I've worked in places that use Groupwise, and I've used netscape/firefox/on-line clients for reading e-mail at home. Doesn't Outlook display the URL of a hyperlink in an html'd e-mail? I occassionally get those phishing e-mails asking to verify my supposed paypal or ebay account, and the text in the e-mail looks like it's going to paypal's or ebay's server, but when I hover the mouse over the link, the URL displayed is usually something else, like a 201.x.x.x or 64.x.x.x address. It doesn't take a much to understand that if the real URL is different from the text--even if you don't know who really owns the 201.x.x.x address in question--that the message is bogus. Is the propagation of the trojan in question truly that different this time?

Re:TFA conclusion is BS

[prgrmr]

Since around 1999 or 2000, the vast majority of viruses and trojans have grabbed all the email addresses in someone inbox, address book, etc. and sent themselves out using a random return address from this list.

I have never gotten a bogus e-mail with a return address of anyone in my address book or in my in-box. But then I've never used MS Outlook to read my e-mail. I've gotten mail with my own e-mail address as the return address, but that just makes for an obviously bogus message.

It really seems sad that the norm is to block reasonable communication tools (I use IM almost exclusively for work related communication) simply because corporate America is infatuated with Microsoft despite the massive security headaches they cause.

For the longest time, all IM clients were blocked by our firewall. We in the IT department can use the Groupwise IM client for internal chat, but not out the firewall. Recently AIM was re-enabled as a requirement by one of our Vendors, but you can bet as soon as anyone fires-up MSN or Yahoo and downloads a trojan or some porn (or does either with AIM) that AIM will get shutdown again.

Re:TFA conclusion is BS

[jonadab]

> Geeze, here it is 2006 and people still think that the return address in unsigned
> email means ANYTHING.

Well, yeah. I had to explain to two coworkers just last week that the scary messages they were getting weren't really from eBay, and they were quite surprised. (So I told them that if they were concerned that they might need to check their eBay accounts, to use the bookmarks they usually use to go there, because they would know that those really go to eBay. The link in this message only says it goes to eBay, and really it goes someplace else, to another site. Such gasps of outrage and astonishment as I then heard, you'd have thought I was telling them that their husbands lied about the business trip and were really with in Las Vegas with girlfriends.)

This is at least partly because of the way mailreaders present the data. Instead of showing the headers as part of the message (which is, essentially, how they're transmitted), most mail readers parse the headers and present certain pieces of data from them (the From address, for instance) separately from the message, as metadata. Well, yeah, it *is* metadata in a sense, but the way it's presented makes it appear, to the casual user, as if it's something the mailreader knows about the message, rather than something the message claims about itself. Other critical headers, such as Receives:, are not shown at all (unless the user specifically goes looking for them in a "Show All Headers" or "View Message Source" option or somesuch.

There are, of course, good solid usability reasons why these things are the way they are, but it doesn't take a doctor of psychology to tell you what people are going to think as a result.

Personally I'd like to see the information parsed out of the headers, especially the sender information, labelled just a little differently, e.g., "Claims to be From:". I'm not sure that would entirely solve the problem, but it might help a little. I'm also deeply annoyed that our ISP's mail server accepts HTML messages for delivery (if we had our own mail server in house it sure wouldn't), and that all the decent, deployable, user-friendly mail clients I can find happily render and display HTML mail. Even recent versions of Pegasus cannot, as near as I can determine, be configured to show the source or treat the HTML as an attachment.

Re:TFA conclusion is BS

[jZnat]

Good corporate environments usually deploy a private Jabber server or Novell's Groupwise IM thinger. There is no way in hell I'd allow shit like AIM or MSN become our "official" method of private chatting. Services like AIM and MSN are created to be public, and any attempt at making a private version of such is likely flawed and already bested by the offerings of Jabber, Groupwise, etc.

I'd also allow external Jabber conversations, but only because I know that anyone who knew how to do that wouldn't be your typical AOLer...

Re:TFA conclusion is BS

[hawaiian717]

all the decent, deployable, user-friendly mail clients I can find happily render and display HTML mail. Even recent versions of Pegasus cannot, as near as I can determine, be configured to show the source or treat the HTML as an attachment.

Mozilla Thunderbird has the option of displaying messages as plain text: View - Message Body As - Plain Text. Perhaps that will work for you?

Re:TFA conclusion is BS

[azrider]

Recently AIM was re-enabled as a requirement by one of our Vendors...

WHAT... since when do vendors define what communications methods (other than TCP/IP) can be used to communicate with them. As soon as a potential vendor says to me "you have to enable this IM channel" they are shown the door.

Haha!

[Trip Ericson]

Saturday's word was "transferbangle." Today's word is "volunerability." I wonder what tomorrow's word will be!

Patch tuesday?

[Mathiasdm]

I'm still not sure myself whether or not I will install this unofficial patch.

Reasons for not installing it:
-I'm behind a router and use a firewall, virus scanner and several anti-spyware programs.
-I don't visit any suspicious websites (though this is probably not limited to 'suspicious' websites.
-I use Firefox for browsing, which (if I remember correctly) is not directly affected, unless you accept to run the .wmf-file.

My possible reasons for installing this patch beforehand:
-I don't know if the virus scanner and anti-spyware programs will pick this up in time.
-I have exams in two weeks from now. I don't have the time to spend hours on end to remove crap like this (and yes, I do have time to type this message :-P ).

Oh, and patch tuesday, is that tomorrow or next week?

Re:Patch tuesday?

[ciroknight]

Reasons you should install it:
-You refuse to (or can't) use an operating system where executability is set by a filesystem flag and not an extension.
-The simple act of clicking on this image anywhere in your filesystem will cause the arbitrary code to be executed.
-Firefox, while being a more secure broswer than Internet Explorer, isn't going to do any bit of good for an image that may already be on your computer as we speak.
-This exploit isn't limited to the WMF extension; any file with Windows Meta information is subject to the insertion attack, which includes all image formats and a lot of document formats (Word).

The fact is, you're being ignorant of the problem instead of trying to be part of the solution, and your post outlines the different various reasons why. The fact is, Microsoft might not even include a fix for this specific bug on the next patch Tuesday. They've been known to forego fixing certain bugs for arbitrary amounts of time. This is fact, not opinion.

Here's to hoping you don't get infected before Microsoft gets a patch out.

Re:Patch tuesday?

[Mathiasdm]

Okay, thanks for the heads up.

And just in reply:
I have the healthy intention of installing Linux. I've already done so before, but haven't done so on this computer (the one I use most) yet.
In february (right after my exams), that should change.

*goes off to install this patch*

Re:Patch tuesday?

[KwKSilver]

Next week. While you are sitting there waiting to die, why not download & burn a live cd like Knoppix, Mepis, Ubuntu, etc. You can float above the wreck and wrack on one of them a while & still access files on the HD. Lots of choices at here. Whatever floats your boat... Good luck!

Stuff like this is why I just put Linux on my squeaky-new box.

Re:Patch tuesday?

[Tibor the Hun]

you need not install linux. just use one of the live distributions.

Re:Patch tuesday?

[Mathiasdm]

I've used live-cd's before, but I'm not switching because of this patch.

I'm switching because I want to stick with Linux. That's easier using dual-boot than a live-cd (as I can actually install things :-P).

Is it just me

[goombah99]

or Is the original healline post for this thread written in gibberish enhanced by misappropriation of terms and conflation of concepts? How is trusting the unofficial patch conceptually related to "trustworthy computing" and why should packet spanning make it invulenrable to filtering?

Re:Is it just me

[BushCheney08]

It's a thing called sarcasm. MS are the ones pushing "trustworthy computing" but are showing that at a time like this, they can't be trusted to do the right thing.

Re:Is it just me

[abirdman]

You are absolutely correct, sir. This aricle has absolutely nothing to do with "trustworthy computing," (aside from the use of the word "trust"). It is perhaps interesting that the headline was enough to persuade me to read the summary, and click the link to the story. Maybe, in some strange way, they're demonstrating how the exploit works.

Re:Is it just me

[Tim C]

And what's the right thing? Rushing out an untested patch as fast as possible that either doesn't fix things or even makes them worse? Or is it taking your time to make sure that you get it right and don't end up making an even bigger mess of things?

Re:Is it just me

[darkonc]

The point about "trustworthy computing" is that you are giving over control of your computer to some other semi-random person who can then force your computer to do, or not do, whatever they want it to.

It all comes down to the question: Who do you trust? A company like Microsoft that has made billions of dollars with sometimes shady and even outright illegal business practices, or a bunch of diehard security enthusiasts who just hate to see their (and other people's) computers hacked?

No matter how you answer the question, it's likely to be an obvious answer.
For you.

Re:Is it just me

[schweinhund]

your name must be sarcasm as well... bush and cheney quite obviously can't be trusted to do the right thing either!

Re:What's wrong with...

[forsetti]

Reading the article, the ISC (and a few others) say that you *should* disable the DLL. There are two ways, with caveats, listed:
*Unregister the DLL : some apps may actually reregister the DLL.
*Rename/Delete: make sure XP File Protection is off, otherwise it will be replaced. Also, some apps may behave badly.

So, disabling the DLL is a *good* idea -- but may not be a complete solution by itself.

Shame on Hemos

[slavemowgli]

No flamebait intended, but that's a typical sensationalist misleading Slashdot headline. Noone's advocating "trusted computing" or similar initiatives here; all they do is saying "here's an unofficial fix, and we'd like to recommend even though it *is* unofficial, considering the seriousness of the vulnerability and also considering it was written by a reputable windows expert, namely Ilfak Guilfanov (author of IDA Pro)".

And for that matter, there's no mention of "the Snort rules will hog your router's CPU", either - that's total rubbish, probably made up by the article submitter. And it slipped, too, since the Slashdot "editors" never care to actually edit stories before they publish them.

Shame on you, Hemos!

Re:Shame on Hemos

[Jugalator]

Noone's advocating "trusted computing"

"Trustworthy" was what was spoken of though (distinction sometimes used), but yeah, I thought that looked out of the subject here. I thought that was more of an initiative to add "trust" as in digital signatures, DRM, "Fritz chips", etc, thereby making systems/data "trustworthy" and not having been tampered with (which can also be used to protect media from piracy), not something having to do with this. I may be confused though as it feels like a pretty broad subject..

Re:Shame on Hemos

[BushCheney08]

I'm guessing you missed the part where the blog entry linked in the summary that advocates the use of this unofficial patch is titled "Trustworthy Computing".

Re:Shame on Hemos

[Pinky3]

Noone's advocating "trusted computing"

The posted slashdot submission uses the headline and the words "trustworthy computing." The article at sans (Handler's Diary) is titled "Trustworthy Computing." The article asks the reader to "Please, trust us."

This is all about trustworthy computing and who is worthy of your trust.

Shame on you for not reading carefully.

Oh, you post on slashdot, never mind.

Re:Shame on Hemos

[Saint Aardvark]

There should've been a link to this:

There is one important note in regards to ALL published signatures including this one. All these signatures will fail to detect the exploits when the http_inspect preprocessor is enabled with default settings. By default, the flow_depth of the preprocessor is 300 which is too short to cover the whole exploit. Should the exploit be transmitted on port 80 and http_inspect is enabled, no alert will occur. Note that it will still alert on any ports (using the all port sig below) that are not configured in http_inspect (ie FTP).

One solution is to add the statement "flow_depth 0" to the http_inspect preprocessor (actually the appropriate http_inspect_server line in the config). This will tell the preprocessor not to truncate the reassembled pseudo-packet, but it will have an adverse impact on performance. On busy networks, this will lead to 100% CPU utilization of the Snort process and major packet drops.

And you should've checked before saying it was all made up.

Re:Shame on Hemos

[Anonymous Coward]

No flamebait intended, but that's a typical sensationalist misleading Slashdot headline. Noone's advocating "trusted computing" or similar initiatives here;

Who's Noone?

Re:Shame on Hemos

[GarrettZilla]

In defense of our Slashdot overlord, it says "Trustworthy", not "Trusted". And it's not like Hemos made it up, either - that's the verbatim headlne SANS/Mr. Liston put on the article.

And the CPU usage is also basically a quote from the SANS site: "On busy networks, this will lead to 100% CPU utilization of the Snort process and major packet drops."
http://isc.sans.org/diary.php

Re:Shame on Hemos

[1u3hr]

And it's not like Hemos made it up, either ...

On the other hand, he IS responsible for "Windows Metafile Volunerability".

Hah

[Jugalator]

Not really a whole lot of choice about this one.

OK, that just makes it too easy.

*awaits avalanche of "Linux is the cure"-style replies*

Which, of course, is correct, as it's not affected by this, but not suitable more than as a worn joke, as many organizations can't make the switch easily either for lack of own competence, will to hire those who have, lacking software compatibility and/or counterparts, etc.

Re:Hah

[neomunk]

That got me thinking about somethning funny see... How bout a worm that pops up windows saying "If you used linux, you wouldn't have this malware!"

That's just funny to me.

Re:Hah

[udippel]

Mhhm; I for my part consider this *very* funny ! But lack of modpoints force me to spill my karma. Worthwhile.

Trust not the issue...

[pla]

They want you to trust that the unofficial patch for the Windows Metafile Volunerability that is currently being exploited by an IM worm.

The problem there (aside from the FP's atrocious grammar) comes from how the "unofficial" patch will interact with MS's eventual real fix.

I certainly don't consider myself a Microsoft apologist, but I KNOW that anyone who installs this patch, then discovers some bizarre (potentially very serious) problem from Microsoft's solution, will bitch loudly that Microsoft should have taken the interim fix into consideration. These same people currently bitch that Microsoft should throw caution to the wind and issue a fix ASAP, out of their normal patch cycle and without adequate testing.


Personally, I don't see the problem with temporarily unregistering the affected DLL... I NEVER view thumbnails through explorer (slows it down beyond belief), and MS's built-in image viewing/printing software lacks even the basic editing capabilities necessary to print "grandma" rather than "a grandma-like dark smear, 27 unknown people, and 90% sky".

Re:Trust not the issue...

[coolGuyZak]

They want you to trust that the unofficial patch for the Windows Metafile Volunerability that is currently being exploited by an IM worm.

The problem there (aside from the FP's atrocious grammar) comes from how the "unofficial" patch will interact with MS's eventual real fix.

And let's not forget that "vulnerability" is misspelled. ;)

Re:Trust not the issue...

[Rufty]

If a security guard firm refused to alter their "normal patrol cycle" to deal with an in-progress intrusion, would they get the next contract???

Re:Trust not the issue...

[ciroknight]

Come again? Any Microsoft patch is likely to outright remove the file and replace it with the patched copy. If it were a binary-patch, it would scroll to the right location in the file, check to see that what was supposed to be there was, and when it discovered that it had already been affected in some way, it would die with some error.

Microsoft's patch and this patch surely won't be compatible, but that doesn't mean that they won't be identical. If you don't understand this, try patching your already patched software sometime. You'll find you can't do it.

I don't have a problem unregistering the DLL either (if I had a Windows computer to unreg the DLL from), except for that some programs, despite library registration, still search for certain libraries in the file system, and of course, when they stumble upon them, they load them. And this, of course, puts you right back into the hot seat. How do you know if you're running one of those programs? Well, delete the DLL and see how many programs have a fit including Explorer itself).

So this is a total non-issue.

Re:Trust not the issue...

[Myen]

Err..

This "patch" is more of a loader. It hooks every program loaded, and redirects the vulnerable function to its own implementation, which disables the buggy functionality and passes everything else back to the original buggy implementation. Sort of like overzealous sanity checking.

It does not modify the original code (gdi32.dll) on disk. After Microsoft's patch, it will still try to load, and either 1) the function will change and workaround will realize this and fail to load (since it checks the 5 initial bytes of the vulnerable function to see which version it's patching), or 2) it will load, still neuter the previously-vulnerable path, and continue as normal.

The source code is included; read it. (Unfortunately, the source code was not a separate download, and therefore we can't read it before installing :( )

See also http://www.grc.com/groups/securitynow:423

Re:Trust not the issue...

[julesh]

Personally, I don't see the problem with temporarily unregistering the affected DLL...

Because the flaw isn't in the image previewer used by the shell, it's in GDI32 which is a core OS component and can't be unregistered. Unregestering the image previewer will prevent a lot of attack vectors, sure, but there are probably others.

Re:Trust not the issue...

[1u3hr]

The problem there (aside from the FP's atrocious grammar) comes from how the "unofficial" patch will interact with MS's eventual real fix.

Since the patch is fully uninstallable (or at least claims to be -- it's certainly listed in "add/remove programs") you just uninstall it first.

Re:What's wrong with...

[Claire-plus-plus]

Of course they don't know what a DLL is. Windows has been marketed as a consumer OS, it was designed to be used by people without a clue. By default you can't even see the DLLs. People shouldn't need to have IT qualifications to use a computer, it should be secure enough for them to use it. What you are suggesting (to use a car metaphor and probably get flamed for it) is that people should need to strip and reassemble an engine to get a drivers liscence.

Talking of 'Trustworthy Computing'

[peterpi]

I love the way the story starts 'Anonymous Coward writes', with an email address link to the author.

Trusted Computing? I think not!

[Anonymous Coward]

I wouldn't call what they are offering as trusted computing. They are not
the manufacturers of the OS, so whatever they are offering is NOT trusted computing.

Since it's a typical binary patch you have to trust them that this
patch won't hose your system or make you pwned by these or other folks.

As a long time Linux user, I find this situation appalling. If I were stuck
using a Windows box I would be pissed off by this. Look, when I want to upgrade
my box, I just do a apt-get update; followed by either apt-get dist-upgrade
or use synaptic. I know my sources (I select them myself), I know that the reality
checks exist (gpg keys, outside sources verifying the software, etc.). I know
I'm not getting hosed when I install software from my usual Debian repositories.

Do any of you windows folks know these security folks? Do you have any
reality checks that you can apply against this binary patch? What control do
you think you have of your operating system?

I guess if you haven't been a Linux user for a long time you might not understand
the depth of how bad your security model is when you're stuck with windows.

--Johnny

Re:Trusted Computing? I think not!

[tsvk]

I wouldn't call what they are offering as trusted computing. They are not the manufacturers of the OS, so whatever they are offering is NOT trusted computing.

"Trustworthy" was here used only as a saying. As in "Please, trust us". Please read the ISC diary entry.

Since it's a typical binary patch you have to trust them that this patch won't hose your system or make you pwned by these or other folks.

The patch is distributed by Ilfak Guilfanov, who develops the IDA Pro Disassembler and Debugger. The WMF fix installation package includes source code for the DLL it installs.

Look, when I want to upgrade my box, I just do a apt-get update; followed by either apt-get dist-upgrade or use synaptic. I know my sources (I select them myself), I know that the reality checks exist (gpg keys, outside sources verifying the software, etc.). I know I'm not getting hosed when I install software from my usual Debian repositories.

Sure, you use apt-update when your os vendor has relased a fix. But what do you do when no official fix is yet unavailable, as the situation is now for Windows users?

Re:Trusted Computing? I think not!

[tsvk]

...no official fix is yet unavailable ...

Argh, double negative.

...no official fix is yet available...

Re:Trusted Computing? I think not!

[awkScooby]

Do any of you windows folks know these security folks?

Yes.

SANs has some top notch security folks, and if they've vetted this patch and believe that it's safe and is the best thing to do right now, I trust them. I should probably qualify the yes above -- I've been a Linux user since 1995, use Mac OS X on my laptop which is essentially my primary system, and have racks full of Windows servers (that I'm fortunately not primary on).

The "trustworthy computing" remark was sarcasm. See, in a world with trustworthy computing, the unofficial patch wouldn't be possible. So, you would be left completely vulnerable. But somehow you're better off, because your software is "trusted". This is the same model by which future "Sony rootkits" will be possible, because we all trust big corporations, but open source software will not be trusted. Obviously trust == security... yeah.

Re:Trusted Computing? I think not!

[udippel]

The WMF fix installation package includes source code for the DLL it installs.

Have seen this a ten times now in here.
Where is the karma whore to finally help out ?

Re:Trusted Computing? I think not!

[tsvk]

The source code is now online, too.

Re:"the snort rule will peg the CPU on your router

[PenguinOpus]

I believe this is because _any_ image is vulnerable to infection. Because Microsoft checks the header for every image file and treats it as WMF if the header matches, all jpegs, gifs, and pngs are potential vectors for the disease. A router that has to inspect _every_ image that is surfed by users behind it will immediately turn into a bottleneck.

A couple of the other comments here seem to miss this very important point:

It's not just files with ".wmf" at the end. Any image file will get unwrapped by Microsoft code and the callback will get executed. Woof.

Re:"the snort rule will peg the CPU on your router

[peterpi]

Sounds like an nth complexity binary loop sort of problem to me.

o.O

[xx_toran_xx]

They want you to trust that the unofficial patch for the Windows Metafile Volunerability that is currently being exploited by an IM worm.

OK, tell me how that sentence is supposed to make sense. Come on :|.

Re:o.O

[eluusive]

I think the slashdot editors pick out the worst submissions for any given topic and post those -- just for fun. Now Josh Hudson looks like a fool in front of everyone on slashdot. Mwahaha..

Re:o.O

[kfg]

You have to apply a patch. Trust me.

KFG

Re:What's wrong with...

[kuzb]

So perhaps instead of using this as another opportunity to post your sig with the stupid referral link, you could explain to them how it's done.

Re:What's wrong with...

[Anonymous Coward]

you... actually... _READ_ the article?!!!

*faints*

You're right

[Pac]

The title come directly from the ISC's Handler's Diary post that uses it as a joke, to reflect the fact that they will ask people to trust them on this one. Quote:"I find myself in the very peculiar position of having to say something that I don't believe has ever been said here in the Handler's diary before: "Please, trust us.".

Re: Migrate to Linux, not Vista Migrate to Linux

[kuzb]

They loved it so much you posted anonymously, in your room, with the lights out, under a blanket?

Is Trustworthy Computing same as this?

[pioni]

http://www.lafkon.net/tc/

If it is, I can live without it.

Why do folks still use Windows?

[putko]

What is the calculation that Windows users -- esp. businesses -- make that allows them to keep on using Windows?

When I had to pick an OS, I did research and picked one that I felt was secure enough for my needs. Windows didn't make my cut.

Somehow the Windows folks keep on choosing to use Windows, even though after the WMF exploit is history, they'll just be waiting for yet another "shoe to drop".

I understand that legacy apps/data formats get you locked-in to Windows, but doesn't "remote exploit" concern you enough to make you think "must switch!"?

Re:Why do folks still use Windows?

[TrueBuckeye]

For one thing, it is a significant investment for a company like mine (medium size, about 1200 systems, 100 servers) to make a move like that. Current enterprise software runs in the millions of dollars for us, so to do a complete switchover would be unbelievably expensive.

Then you have to hire/retrain all of the support staff (currently about 25 of us).

Then you have to retrain all 1200 end users.

Somewhere in there you have to find solutions to fill the roles that you currently use such as tablet computers with broadband wireless access for certain users.

All in all it is very easy for Linux idealists to sit back in their chair and preach about the evils of Microsoft (which I don't necessarily disagree with) and call any company using Windows a bunch of idiots, but that sort of migration would probably cost a company like mine tens of millions of dollars and months, if not years, of headaches.

Re:Why do folks still use Windows?

[Will2k_is_here]

For the server market, you have a valid point because whatever you run should be your choice and should be transparent to the end user (a fairly simple task for most situations).

End users on the other hand cannot be forced to use something different like Linux because they will not be able to function in an unfamiliar environment.

If I have read correctly and this is an image/media file exploit, this is more likely to affect the non-tech savvy end users anyway.

Re:Why do folks still use Windows?

[Fortran IV]

What is the calculation that Windows users -- esp. businesses -- make that allows them to keep on using Windows?

I usually stay out of the Windows/Linux/Mac arguments, but I'm afraid you just don't understand my world.

I work for a very small company, probably typical of thousands of other very small companies. Our company is too small to afford a full-time IT staff; I'm the entire IT department, and it's a very small part of my job. I'm the IT guru because I'm the only one there who knows a DLL from a dungheap.

I have formal training in computers, but so long ago that the field was still called EDP and time-sharing was a big deal. I've spent years learning what I know about Windows and Windows networks, in my spare time. It would take me years more to reach a similar level of expertise with a brand-new OS. And until I reached that level, we'd be more vulnerable than with Windows.

My company has about a dozen computers, including a single domain server with no backup server. We have about $60,000 invested in software (other than OS's) that will only run under Windows. We have no hardware to set up a test server, no money (or time) to spend on unsuccessful experiments.

The only person in our company who has ever used Linux is our 21-year-old secretary. We have one Unix machine, which I despise, because its desktop GUI is primitive and its command interface makes MS-DOS look well-designed and intuitive.

I rarely get to spend more than two or three hours a week on network maintenance, security monitoring, and research combined. If I hadn't automated them I wouldn't have time to do file backups some weeks. I have no time to spend trying to research the seventeen hundred different distros of Linux available, or whether Wine will support our COM+-dependent network applications--or whether the WMF exploit still applies if we run Windows applications on Linux.

We can't afford to have a regular support contract with a local computer-specialist firm. That's assuming we could even find someone in town we can trust--the overpriced morons who did our last batch of installations gave us a two-NIC server with only one NIC enabled (so no firewall), and set up user workstations with the Administrator password left blank!

I loathe Microsoft, and have since I first saw Windows 3.11. But what possible reason do I have for trusting the claims of Red Hat or Debian more? What research I can do is hardly reassuring. Remember Saturday's story here: researchers found 812 flaws in the Windows operating system, 2,328 problems in various versions of the Unix/Linux operating systems (Mac included)?

Somehow the Windows folks keep on choosing to use Windows...

I didn't choose Windows; I inherited it and have no resources to replace it. My company didn't really choose Windows; it was forced on us by the marketplace. Be realistic! My wife just bought an Apple, and the first thing she installed on it was the OS-X version of MS Office, necessary for compatibility with her company.

Maybe in another ten years Linux will be enough of a force that applications will be written for cross-compatibility, but little companies like mine can't wait that long. We have to use what we can, right now.

Re:Why do folks still use Windows?

[Just Some Guy]

My company has about a dozen computers, including a single domain server with no backup server. We have about $60,000 invested in software (other than OS's) that will only run under Windows.

I rarely get to spend more than two or three hours a week on network maintenance, security monitoring, and research combined.

OK, so you're not a full-time IT guy. That's cool. But if you can't manage 12 machines and only $60K worth of vendor lock-in, then you absolutely, positively need some outside help. It's not an issue of whether you can afford it; at this point, I'd say you have to.

But what possible reason do I have for trusting the claims of Red Hat or Debian more? What research I can do is hardly reassuring. Remember Saturday's story [...]?

I did, but I don't think you did, because it was thoroughly debunked within the first 10 replies.

Let me put that another way. The article you're reading right now is full of stories about people going in on the holidays to patch their Windows systems. How many stories did you hear about Unix admins rushing in this weekend? All of last month? All of last year? So far this millennium? The latest unpatch{ed,able} Windows exploit is set to cause more work for the people who have to manage affected systems than the rest of us have had in the last five years.

But you can choose to believe whomever you want. As for me, I'm enjoying my four-day weekend and relaxing by reading about stuff that doesn't affect me. Hope your new year goes this well!

Re:Why do folks still use Windows?

[rtaylor]

I didn't choose Windows; I inherited it and have no resources to replace it. My company didn't really choose Windows; it was forced on us by the marketplace. Be realistic! My wife just bought an Apple, and the first thing she installed on it was the OS-X version of MS Office, necessary for compatibility with her company.
Unforunately as with most poor business decisions it is far cheaper and easier to reverse them early on. The longer that decision is carried out the more it will cost (in effort and expenses) to get out of.

Sometimes sticking with a poor decision is worth while as the short-term revenue gained outweighs the change cost at a later time.

The poor decision in the case of your business wasn't using Windows. The decision to get locked in to a single vendor on a singal platform with no resonable option for changing could make things very difficult.

I'm fairly certain steps have been taken to ensure that the company is not locked in with a single bank or insurance company or most suppliers. Sure, they picked the cheapest and most accomodating but someone will have thought of an escape plan for most things. Risk management applies to computers just as much as any 3rd party tool required for doing business.

Re:Why do folks still use Windows?

[Runty McGhee]

I completely and totally understand your world. I was there doing the same job you were doing in the same way.

Your management is absolutely, positively, undeniably, incompetent. They probably don't understand what you have to do to keep the network running and they don't care. All they care about is squeezing as much money out of their business as possible before they sell it or retire.

I guarantee you have tons of malware hiding on your system right now. Anti-virus software is completely inadequate in a Windows environment. As for Windows anti-spyware/adware software suitable for a business environment, it doesn't exist.

That your management can't justify the expense of a single full-time IT employee is not only short-sighted, it's complete incompetence.

I am sure your coworkers experience numerous frustrations caused by malware every single day - they just don't know it. You probably don't even know it because you don't have the time to investigate your network.

It is now - especially after this exploit - undeniable that Windows is an inadequate OS.

Yeah, switching to another OS would be painful in the short term. Of course. But in the long run it would save your business untold hours of productivity (due to improved security and stability) and cold hard cash. Working in a Windows environment you are constantly forced to upgrade (ie purchase) software. Not so true of the open source model.

If you're running a Windows network at your business then you'd be a fool not to be experimenting with open source right now. You should have at least one station on your network (preferably manned by a demanding employee) running on as much open source software as possible. Once that station is running smoothly, the configuration could be mirrored to other stations. Your server could come last.

I understand your situation. I was once there. I also understand that your management is filled with complete techno-idiots. The difference between open source and Windows is as stark as the difference between businesses that use computers and businesses that don't.

You sir are too good for that place and should seek employment elsewhere. Preferably where the management respects their employees and values their contributions to the organization. By not adequately protecting their IT infrastructure, your business is not only endangering their own network (and someday the chickens WILL come home to roost) but also endangering every network connected to the Internet. Not only is your management incompetent, but they should be put up on criminal charges. What the virus/adware/spyware writers do is evil, but neglect is also evil.

Re:Why do folks still use Windows?

[Runty McGhee]

Go one station at a time. You should be able to find open source equivalents (or nix equivalents) for all your software. Once you've worked out the bugs on one station, mirror it and move onto the next. Also, you're working out the bugs with the user too.

It's an experiment, and you have to find employees of the right temperment to experiment on, but it can be done. In the long run you'd save uncountless time and money.

Re:Why do folks still use Windows?

[Anonymous Coward]

Q: Why do folks still use Windows?

Short answer: It easily runs everything I want it to. The Linux user experience is significantly worse than Windows.

When I had to pick an OS, I did research and picked one that I felt was secure enough for my needs. Windows didn't make my cut.

What are you doing to make Windows insecure? Downloading unmarked executables from newsgroups and executing them? Running Outlook and double-clicking on every attachment you receive? Running without a firewall?

Let me rephrase your quote:

When I had to pick an OS, I did research and picked one that I felt was compatible enough for my needs. Linux didn't make my cut.

The last time I tried Linux (and I have, I really have), it didn't support all my hardware out of the box. Hardware support should simply work instead of having to recompile my kernel 36 times trying to figure out the correct settings (there were none, I had unsupported hardware). How ancient is that? And then I hated the distribution wars - the infighting over which was the "best way" to do something - the way that distro X does things completely differently from distro Y to the extent that they're binary and logically incompatible to the detrement of the user - and you end up hating both distros as neither of them uses a solution that makes sense for the user.

Then there's the sheer hypocracy of KDE - instead of supporting Microsoft, it's supporting Trolltech, but nobody seems to understand that ought to be just as much of an ethical problem. Trolltech are no better than Microsoft when it comes to trying to leverage a monopoly. The pond may be smaller, but if Linux ever takes off, Trolltech gets a free ride. Except that Linux will never take off while Trolltech are stunting commercial growth and charging $4000 per seat for commercial development licences - Microsoft couldn't have a more unlikely ally in supressing Linux.

And as far as a free OS, I found FreeBSD to be significantly better than Linux as it's logically organized and the maintainers are mature adults compared to the screaming teenagers of the Linux world.

Although neither Linux or FreeBSD run the games or applications that I want to play. If they reliably (and with no messing around) ran the very latest games (eg: World Of Warcraft), tax and financial software (eg: Taxcut and MS Money) - with full support for my graphics card, sound card and printer - I'd take another look. I did once manage to get Unreal Tournament 2003 running under Linux (which was the game I was into at the time) with full 3D acceleration, but the sound was delayed about 2 seconds so it was unplayable.

But given that I no longer use my computer for the sole purpose of messing with my computer, I'm sick of that shit not working. 15 years ago it would have been a fun challenge to "stick it to the man" and "rebel" against Microsoft, but I no longer care. I want as little maintainability as possible - I simply want to be able to read email, yell at people on /., play games and do some serious stuff once in a while. So I run Windows XP on my desktop (instead of Linux or FreeBSD, although my other computer is an Apple Powerbook running OS X). I sit behind a hardware firewall, have autoupdates turned on, run a memory-resident virus scanner and antispyware scanner, use Firefox and Thunderbird - and I've never, ever had a security problem.

Re:Why do folks still use Windows?

[HermanAB]

What you are saying is that fixing broken Windows takes up so much of your time, that you can't afford to look at an alternative. Stand still and think about it for a moment.

The fact is that you can install almost any shrink wrapped Linux distribution, do a default installation and have almost zero support issues for the next year. Honestly, I almost never patch my Linux servers and only upgrade them every 3 years.

In a small business situation, any Linux box is as reliable as a refrigerator. Just leave it alone and it will keep working for a long, long time.

Think of that ancient UNIX machine you talked about - how much effort do you invest in maintaining it? Pretty much zero huh? After all, you don't even know how it works. Now imagine if all your computers were that reliable...

Re:Why do folks still use Windows?

[Fortran IV]

Sorry, but I have to call counter-bullshit: You still don't understand my world. You've given the longest and most detailed response so far, so allow me to concentrate my answers on your post.

First, please, I'm not a "Windows Guy(tm)". I loathe nearly every Microsoft product I've ever used. (Notepad's not too bad.) My nickname is no accident; I started out as a mainframe FORTRAN IV programmer. I still maintain an MS-DOS machine at home, although it rarely gets fired up any more. I have used Linux-based utilities, although I know nearly nothing about Linux itself.

Before these fancy computer systems a small business involved dozens of people just typing and tabulating stuff... If the boss gets a personal secretary all to himself yet your bread-in-butter computer systems have a good coating of dust, someone isn't minding the store.

Our entire company doesn't involve "dozens of people"; we literally have as many computers as employees at the moment, including the owners of the company, who share our one secretary. We don't have an accountant, or payroll clerk, or HR manager, either. We literally can't afford a full-time IT person. Hell, we can barely afford me.

...get off UNIX's nuts about command interfaces. Unlike Windows you have a choice of both GUI and command line environments in UNIX.

Okay, this was a bit offtopic and maybe inappropriate. I should have said we have one elderly Unix machine; it is legacy, with proprietary software, and I don't have much control over it. I don't have root access, and I can't change how it's set up. But MS-DOS from the same period (or the DOS available in Windows 2000/XP) is better documented and easier to use than the command interface on that Unix system.

Stop reading newsgroups. Block slashdot.org while at work. Spend one of those hours learning about filtering out stupid work emails....You mentioned all your training is from work done "in my spare time" so I can assume that you're willing to sacrifice personal time to work.

Not very bloody much. By "in my spare time" I meant at work. I have a family life and I like to enjoy it; this is the longest stretch I've spent on Slashdot in weeks.

We're a small independent manufacturing company, and I'm the draftsman and designer, so my workload is highly variable. Last week I worked overtime to get a particular project out the door; next week I may have thirty hours of production work. I spend the extra time as productively as I can, learning how our systems work, documenting what I've done to them (Yes, real documentation!)--and reading the Microsoft newsgroups, where I find answers to many of my more puzzling questions (like why our server failed to reboot last fall). I learned about the WMF exploit from Slashdot; should I have skipped the headlines that day? "[Learn] about filtering out stupid work emails"--learn where? In the MS Outlook help? Ack!

How many inches of your resume are taken up with MS technologies you learned in your free spare time? Your work situation has little to do with the OS Marketplace and everything to do with the resume marketplace.

How many inches? About 2-1/2 lines, actually--I am no longer an IT professional! That's my primary point: A company the size of mine can't afford to have full-time IT support. I learned Windows NT, then Windows 2000, then Windows SBS 2003 (which I'm still learning) because there was nobody else who could, not because I wanted them on my resume.

In our town there are only about three PC sales-and-service firms that have more than three employees, and from past experience I wouldn't trust a single one of them to reset the high scores on Minesweeper. (Remember the guys who left the Administrator password blank?) A company like ours that can't afford to hire an MCSE t

Re:Why do folks still use Windows?

[Fortran IV]

What you are saying is that fixing broken Windows takes up so much of your time, that you can't afford to look at an alternative.

No, what I'm saying is that I spend very little time at all on Windows maintenance, because it's not my primary job. My company couldn't afford to keep me if it was.

I don't spend time fixing broken systems. Our systems are clean, according to every check I can make up to HijackThis and RootkitRevealer, and have been clean for four years, since my boss got one of the relatively harmless Klez variants in his mailbox.

Think of that ancient UNIX machine you talked about - how much effort do you invest in maintaining it? Pretty much zero huh?

Yep, but I also know that the last time it needed an upgrade (for Y2K, something Windows already handled gracefully), we had to ship the entire box cross-country to get the upgrade installed.

Honestly, I almost never patch my Linux servers and only upgrade them every 3 years.

Our one NT 3.51 workstation hasn't been patched since it was installed in 1998. It never locks up; it never shuts down.

Except for one incident caused by third-party software using Java, our Windows SBS 2003 server has never crashed or failed to boot in the nearly two years since it was installed.

I loathe Windows, but in my experience the NT-based versions do not deserve to be painted with the reputation for unreliability that the home versions have rightfully earned.

Security, of course, is another matter...

Re:Why do folks still use Windows?

[HiThere]

Sorry, but many businesses use computers until they are to slow for a modern Linux. Yeah, a stripped down Linux without X Window and KDE or Gnome will run on nearly anything, but that's not appropriate for the environment he's talking about. He needs to choose the OS that's sized to the computers he has free to run it on. If what he's got is i386 233MHz, then that means command line (or possibly Red Hat 6.x with KDE 1.x, which was slow, but did work).

Face it, Linux may be light compared to MSWind in any particular year, but year by year it has been getting heftier, it's just that the computers have been getting faster even faster. When you talk about "reviving an old discarded computer", yes, it can be done. But that's not a job to cut your teeth on, unless you're still in school (and even then it's a lot of work for the reward). With experience you learn that this machine is suitable for an e-mail gateway, or a light database+print server. Probably for a file server, too. I've never seen it used that way, so I can't speak from personal knowledge. But it's NOT a user machine. If you try to make it one, you'll just convince people that Linux is painfully slow.

Re:Why do folks still use Windows?

[HermanAB]

"Yep, but I also know that the last time it needed an upgrade (for Y2K, something Windows already handled gracefully), we had to ship the entire box cross-country to get the upgrade installed." Good grief - and how many years ago was that? Must have been very traumatic if you are still upset about it. Linux is maintenance free - much like your WinNT - just much better...

Re:Why do folks still use Windows?

[azrider]

Think earlier than Linux. I used to work for a company that had Ultrix machines (DEC pre-unix o/s). No vi, no sed, no window manager. The apps on the two systems were proprietary, obselete and undocumented. They were also ABSOLUTELY VITAL to the operations of the affected lab.

Re:Why do folks still use Windows?

[drsmithy]

What is the calculation that Windows users -- esp. businesses -- make that allows them to keep on using Windows?

The one that dictates what applications they need to run.

Somehow the Windows folks keep on choosing to use Windows, even though after the WMF exploit is history, they'll just be waiting for yet another "shoe to drop".

Very few Windows "exploits" are anywhere near as serious as this one and other platforms have had and will have the same level of exploit.

Re:Why do folks still use Windows?

[timbo234]

But what possible reason do I have for trusting the claims of Red Hat or Debian more? What research I can do is hardly reassuring. Remember Saturday's story here http://it.slashdot.org/article.pl?sid=05/12/31/081 2210&tid=172: researchers found 812 flaws in the Windows operating system, 2,328 problems in various versions of the Unix/Linux operating systems (Mac included)?

You can't be serious. Even if just counting vulnerabilities wasn't completely meaningless as a measure of security (it doesn't take account of severity or difficulty of exploitation which are the really important metrics) its still an apples-to-oranges comparison. Linux distros include way, way more software and components in their updates (everything from office suites, photo-editing programs to every server program you'd ever need to run an ISP) than Windows does (the OS, IE, OE and a few core services like DHCP, web and FTP). The inclusion of Mac (yes its unix-based but its a completely seperate OS) vulns. in the Linux stats is just the icing on the cake to make that probably the most stupid, biased security report you can get.

I can see some of your points in the rest of the article but if this is the kind of reasoning you're using to evaluate security then you need to have a serious rethink.

Re:Why do folks still use Windows?

[Fortran IV]

Your post is largely based on a misconception that's entirely my fault. Sorry about that.

I am--by default--IT support for my company, but I don't make the purchasing decisions. My only allowed input to our network upgrade two years ago was to tell my boss that one of the consultants was a known idiot, which advice was ignored. I was not consulted at all about our single biggest software purchase until after the contract was signed, when I was asked if we would need new hardware. But now that the purchases are here, I have to keep them running, because I'm the only one who has a clue.

I wasn't "complaining about my well thought choice"; I was complaining about the people (unlike you) who seem to think that any company can convert to Linux with a snap of the fingers. I have twenty years of familiarity with MS-DOS; it's going to be a long time before I know Linux that well. As you say, it's not a two-week crash course.

And lots of small companies don't even have somebody like me--they're at the mercy of Best Buy or Dell or a local company like the idiots who set up our new server so that what looked like a backup of C:\ (the system drive) was in fact a backup of C:\Documents and Settings\Administrator (the Administrator user profile).

Re:Why do folks still use Windows?

[Fortran IV]

Actually, you've kind of emphasized my point. I never read past the headline of that particular article, because I don't have time to do the research necessary to sort out the truth from the FUD.

I haven't been an IT professional for nearly twenty years; these days I'm just the one who knows more about it than anyone else at my company. These days I can provide a professional viewpoint, but not the professional experience. That's not enough--not nearly enough--to set up and maintain a secure server in Linux.

Re:Why do folks still use Windows?

[timbo234]

I don't have anywhere near 20 years experience either, but you don't have to be an absolute guru to spot FUD like that Microsoft 'study'. Setting up a secure Linux server is no more difficult, and probably a bit easier, than doing the same in Windows. But of course you need have a bit of experience in Linux, just like you needed a bit of Windows experience for your current job.

Re:Why do folks still use Windows?

[raddan]

Hate to break it to you man, you just sound crusty. I work in a two-man IT shop for an office with roughly a hundred machines and about a hundred remote machines. I learned about Windows, MacOS, and UNIX in my spare time as well. But I'm not struggling for time. I don't know how big your installation is, but using UNIX is about working smart, not working hard. It's a better lever.

Take a look at OpenBSD. Once you understand the UNIX philosophy, using it is a breeze. Combine a bells-and-whistles shell like bash with a terminal multiplexer like screen and you have a powerful and elegant user environment. And your investment in time will pay you back double.

We've replaced half of our servers at this point-- very little new hardware required. The new machines stay up longer, they require less maintenance, and they work the way you expect them to. They aren't susceptable to viruses. When they finish running nightly jobs, they email me reports, even if the programs aren't designed to do so because I have the control. Need new functionality with your app? Usually piping the output to some other built-in utility gets the job done. None of our users know the difference; they still use Outlook to check email, use file and print servers. What they don't know is that most of these services aren't running on a MS platform anymore. But MY job is a lot easier. And that is only the tip of the iceberg.

Obviously, I don't know what you spend your time doing, and if you say you don't have the time, then maybe you really don't. But I've heard this same argument before, from admins at my company who work in different offices, and you just sound just like them. They just can't be bothered. Too bad. I'm not working nearly as hard. Remember the Perl motto: "The three principal virtues of a programmer are Laziness, Impatience, and Hubris."

Re:Why do folks still use Windows?

[raddan]

And I forgot to add: to try a Linux/BSD out, all you need is an old machine. OpenBSD will run happily on a 486 with 24 MB of RAM as long as you're just learning. I'm sure you can find at least a Pentium hanging around somewhere. My router at home, which has been running nonstop for about 3 years, is an AMD K6-2, and it runs OpenBSD.

Re:Why do folks still use Windows?

[Fortran IV]

Hate to break it to you man, you just sound crusty.

Too true. I said I usually avoid these discussions. But I do get tired of the automatic assumption by so many people that switching to Linux/Unix would be as easy for everybody as it was for them. Some people don't seem to realize that there is more to running some businesses than Office and email.

Remember, I started out trying to answer the great-grandposter's question: "What is the calculation that Windows users -- esp. businesses -- make that allows them to keep on using Windows?" And the OpenBSD website is a perfect example of my answer. If anywhere on OpenBSD.org is an answer to the question, "Can I run AutoCAD under OpenBSD?" their search function doesn't reveal it. And AutoCAD is the least expensive and most commonly used of the packages I would have to migrate.

If I can't migrate our applications, I can't use Linux. They range from DOS-based CNC programming software to a COM+-based shop management package so complex that even Windows doesn't play well with it. Who knows how a Windows emulator would react? I don't, and I can't afford to gamble.

I simply loathe many aspects of Windows. I am interested in Linux, and I probably would like it once I got used to it, in two or three years. But whether my company can afford to switch to it, whether I could manage the migration myself, and whether there's some company in town competent to do it for a reasonable price are much more complicated questions, ones my regular job (draftsman and designer) simply hasn't allowed me the time to answer.

Cue Howard Bannister: "I am not repeating myself! I am not repeating myself! Oh, God, I'm repeating myself!"

All I set out to say was that a small company like mine, even if they have somebody with a clue, often can't spare the resources even to find out if such a migration is feasible, can't always cut through the blind Linux loyalty to distinguish the truth from the hype, and can't withstand the potential loss of tens or hundreds of thousands of dollars resulting from a failed migration.

Re:Why do folks still use Windows?

[HiThere]

There are several OSes that are light. The context, however, was Linux vs. MSWind, and my point was that Linux was only *relatively* light. If you put a modern Linux on a machine that was capable under MSWind95, you will, at best, have a very unhappy user. The windowing applications are too heavy.

Actually, my point was really that you shouldn't be selling Linux to people with the advertisement that it will bring new life to your old discarded computers. While the statement is literally true when used to mean "adapt them to a specialized role that doesn't need heavy graphics, etc.", it's not true when understood in the naive manner.

Re:Why do folks still use Windows?

[theurge14]

I rarely get to spend more than two or three hours a week on network maintenance, security monitoring, and research combined. If I hadn't automated them I wouldn't have time to do file backups some weeks. I have no time to spend trying to research the seventeen hundred different distros of Linux available, or whether Wine will support our COM+-dependent network applications--or whether the WMF exploit still applies if we run Windows applications on Linux.

No offense intended, but you could use the time you spend reading Slashdot for researching those Windows alternatives.

Re:Why do folks still use Windows?

[udippel]

Hey, as much as I sympathise with you, I find a few items illogical in here.
OpenBSD probably doesn't run AutoCAD. But does your NT 3.5 with an uptime since 1998 run AutoCAD ? Does the NT 3.51 run your DOS-based CNC programming software ?
What does the old, proprietary Unix do ?
Surely neither of these.

When we talk about 'switch', nobody suggests to switch all and everything overnight. It is learning, studying, on an old machine; one that has been replaced by a more resource-hungry Windows box. And there will always be one or another box remaining with an application that cannot be ported. But our discussion is not so much about that last DOS box and the CNC; rather on all the other applications; like e-mail, databases, printing, file servers, backups.

Re:Why do folks still use Windows?

[putko]

Your response is really good.

Not only informative, but funny as hell! E.g.

"How many stories did you hear about Unix admins rushing in this weekend? All of last month? All of last year? So far this millennium? The latest unpatch{ed,able} Windows exploit is set to cause more work for the people who have to manage affected systems than the rest of us have had in the last five years."

The sad thing is, you could be running *BSD, Solaris, Linux, whatever -- and it is all nothing important. But every single Windows machine out there is a sitting duck.

Just this one incident should convince people that they have to do something different -- yet, fundamentally, there have been incidents like this before, and they didn't learn yet.

So I guess they never will learn.

Re:Why do folks still use Windows?

[putko]

Linux didn't make my cut either. I use a BSD.

I can't run the games and stuff - but that's OK. I'm supposed to be working.

OpenBSD has "just worked" for me. Certain things are a bit irritating, so I'll probably switch to a more user-friendly BSD, or at least one that scales better under load.

All that being said, all you have to do for a remote exploit with windows is preview an image. That's too low of a bar. I can't believe that the whole world has decided to run Windows. E.g. if you just need a box for productivity, use something includes the stuff that comes with Knoppix. End of story.

Re:Why do folks still use Windows?

[Just Some Guy]

If what he's got is i386 233MHz, then that means command line (or possibly Red Hat 6.x with KDE 1.x, which was slow, but did work).

Or thin client. That's more than enough horsepower to display applications that are running an a beefier server elsewhere. Remember: doubling the number of users on a system doesn't mean doubling the amount of resources.

Re:Why do folks still use Windows?

[winwar]

"I am--by default--IT support for my company, but I don't make the purchasing decisions. My only allowed input to our network upgrade two years ago was to tell my boss that one of the consultants was a known idiot, which advice was ignored. I was not consulted at all about our single biggest software purchase until after the contract was signed, when I was asked if we would need new hardware. But now that the purchases are here, I have to keep them running, because I'm the only one who has a clue."

A few thoughts come to mind. One, you're screwed. Two, if hiring competent help will send the business into bankruptcy but poor decisions won't, something doesn't add up (Now competent help PLUS stupid decisions....) Third, you are enabling the poor decisions.

If you aren't paid to do the IT work, don't. If you are, do it (yeah, it may require overtime). In either case I would be looking for another job-the future there sucks from your description (not to mention the present).

Re:Why do folks still use Windows?

[fire-eyes]

I didn't choose Windows; I inherited it and have no resources to replace it. My company didn't really choose Windows; it was forced on us by the marketplace. Be realistic!

Be realistic! You choose to keep working there.

Change up or Shut up.

Re:Why do folks still use Windows?

[Fortran IV]

Sorry--she got married just last week. To an undertaker. Seriously.

Well the truth is....

[ciroknight]

..that if we all were running "trustworthy" computers, this problem would be much, much worse than it is now. Imagine that now instead of having a patch that's already been made by someone else while we sit and wait for Microsoft to get off their asses, we now have to wait on Microsoft, who still hasn't shown up.

Instead of having *some* machines patched, we'd have none. This late after the exploit has been released, and a zero-day attack has happened, we'd see no respite.

If you try to argue that Trustworthy computers wouldn't allow this to be exploited, what if the trustworthy compontent itself was exploited? As the Xbox and soon the Xbox 360 have shown, the more complex the hardware, the more complicated the bugs are. Microsoft's betting that the hardware complexity can outgrow the programmer's abilities to crack it, but if there's any truth in the world, it's that if it can be engineered, it can be destroyed. So imagine if this virus was actually signed by Microsoft through the exploit. How would this look for their company? How can you save face from a disaster like that?

No, trusted computers aren't the answer, just more secure computers, with better code. And the fact of the matter is, the more eyes that are on the code, the better it is, and that's why Open Source will always succeed. No amount of cryptography will help you if there's a hole in your crypto system.

Re:Well the truth is....

[frankie]

what if the trustworthy compontent itself was exploited?

There's no "if" about it. The vulnerable component is a genuine Microsoft DLL, shipped as part of Windows, intended to render an official Windows file format. If you were running a "Trusted"(tm) PC, this DLL would 0WNZ0R you with no way out.

Re:Well the truth is....

[IamTheRealMike]

..that if we all were running "trustworthy" computers, this problem would be much, much worse than it is now. Imagine that now instead of having a patch that's already been made by someone else while we sit and wait for Microsoft to get off their asses, we now have to wait on Microsoft, who still hasn't shown up.

Huh? I am not aware of any current implementations of "trustworthy computing" that would prevent you applying this sort of patch. The TPM chip and the like simply let you prove things about the configuration of your computer to other computers (and lock data to a particular machine) - by all means, go wild, do whatever you want to your own computer. Just don't expect to then be able to lie about it to others.

If you then rely on others for various things who refuse to trust you because you're loading patch DLLs into every process then you may have a problem yes, but this is only temporary and the benign applications of such a technology (death to game cheaters!) IMHO outweigh the very slight theoretical risks.

Re:Well the truth is....

[ultranova]

There's no "if" about it. The vulnerable component is a genuine Microsoft DLL, shipped as part of Windows, intended to render an official Windows file format. If you were running a "Trusted"(tm) PC, this DLL would 0WNZ0R you with no way out.

You have it backwards. If you were running a DRM'd PC, this DLL would allow you to retake your own computer.

Remember, security flaws are only bad when security is protecting you. DRM protects Disney against you, so any hole in a DRM'd computers security makes it more, not less, valuable to its owner.

Maybe, in ten years time when only DRM'd computers are legal to buy, and attempt to install anything but Windows Whatever into them is a crime punishable by death, we will yet end up praising Microsofts total incompetence with anything resembling security.

Re:Well the truth is....

[ciroknight]

Huh? I am not aware of any current implementations of "trustworthy computing" that would prevent you applying this sort of patch. The TPM chip and the like simply let you prove things about the configuration of your computer to other computers (and lock data to a particular machine) - by all means, go wild, do whatever you want to your own computer. Just don't expect to then be able to lie about it to others. If you then rely on others for various things who refuse to trust you because you're loading patch DLLs into every process then you may have a problem yes, but this is only temporary and the benign applications of such a technology (death to game cheaters!) IMHO outweigh the very slight theoretical risks.

So let's say I'm JoeISP. Hi JoeISP you might say, I'd laugh and go about my business. Some nasty cruel internet underdwellers would go about writing their programs as they do today, and start delivering their payloads to people over my network. I can't really stop them from doing this; there's simply too much data that goes through my network to look at every packet and assure that the content isn't executable or worse, a virus. I can take some countermeasures, but not to many. Nope, it's the end users who have to be trusted.

So over there is Miss Jane. She loves the internet, and her newly bought Laptop from Dell with a pretty new TPM chip in it. She's a customer as JoeISP, and I love her for it, she pays me a pretty penny a month she could be getting for free if her neighbor would share his wireless access point, but sadly for Jane, her computer doesn't detect that his WAP has a TPM chip, and her operating system says to her that even if the network weren't protected by WPA2, she still wouldn't be allowed to connect to it because it isn't a Trusted connection. She shrugs it off.

So, Jane goes about checking her email when she sees a really funny picture her aunt sent her. Oh boy that's funny she said, and she saves the picture on her desktop so she can look at it later, or maybe even send it to a friend! But what's this? Her computer suddenly locks up tighter than a steel drum and a little popup tells her that "Windows Trusted Computing has detected unauthorized code in memory, and will not allow it to be executed." But she wants to save the image! She dismisses the popup, and saves it again, same message.

She is disheartened and goes to Trusted Go^W Microsoft Search to find an answer. Turns out, lots of people have been having this same exact problem, and nobody knows why. Some guy with a pocket protector and glasses tell them to reboot their computers, go into their BIOS and turn off TPM protection, and she does.

Now when she gets back on the Internet (this of course, assuming that she can, more on this in a minute), she saves the picture and poof, she's now got the exploit running on her machine. Her virus protector (assuming she has one) goes haywire! Of course, Windows File Protection make certain that she can't easily select the file and delete it, after all, it is a running executable now. (Or, even if WFP *did* allow it, most viruses these days are smart enough to break virus protectors in a way that they can't remove the virus on their own, even if their data files are up to date).

She's smarter than your average bear, however, and is able to go to another computer and get back on the internet. She finds a patch for the bug, and a clean up tool that allows her to remove the code from the image. "Goodie" she thinks.

She goes back to the other machine, fixes the DLL, turns back on TPM, and goes to get on the internet.

My ISP (remember me, JoeISP?) instantly alerts an error. Someone has connected to our network with TPM on, but has modified their files! Our policy is not to let those people on our network at all, since that's what Microsoft told us to do. So we block her MAC and continue about our day. She calls in later, furious that she can't get the Internet to work in her house anymore. Any attempts to quell her ar

Re:Well the truth is....

[davecb]

If we were running the kind of Trusted Systems
that the military uses, the attack code would
probably fail for lack of permissions.

Trusted is not the same thing as Trusted, you see (;-))

--dave

Re:Well the truth is....

[jZnat]

You mean like SELinux? The NSA did primarily develop it after all...

Re:Well the truth is....

[HermanAB]

"If you were running a DRM'd PC, this DLL would allow you to retake your own computer."

Oh no! Call the RIAA Goon Squad! Got to go and beat the snot out of Paul Allen to get this fixed ASAP!

Re:Well the truth is....

[davecb]

Absolutely!

--dave (who used to run TS 7 until the
                machine suffered a lightening strike) c-b

Re:Well the truth is....

[Anonymous Coward]

It's very unlikely Windows will ever try to stop you running "unauthorized code"

Oh? XP stopped me running a CD crack for a game (a game I own, I might add). It absolutely refused, because it was an unsigned binary. You know, unauthorised code?

So, yeah. There y'go.

Get the joke, will travel...

[Pac]

So we have to explain the joke again:
The title comes from the original note in the Handler's Diary. You see, it creates a mental tension between "Trustworth Computing", the lack of an official patch and ISC's "Please, trust us". It makes some readers smile.

you must be a genius

[js3]

because the os you pick will have no exploits ever

Not really an "IM Worm"....

[Paperghost]

...because the IM side of things had a limited spread in the Netherlands. The main jump off for this thing was rotating banner ads (along with about six billion pics on Myspace by this stage of the game)..

I trust the patch, the source is included

[ei4anb]

I have read the source and compiled it before installing, of course I trust it ;-)

Re:I trust the patch, the source is included

[Myen]

How?

The patch came as an EXE (InnoSetup), and to get at the source you need to install it... At which point an executable has already been run, *and* a DLL has been dropped to %systemroot%\system32 and schedule to load for any subsequent apps that load user32.dll (according to the description anyway).

I've managed to read the source after installing it... but if it was bad, I'd've already been hosed by that point.

Re:I trust the patch, the source is included

[Fortran IV]

I've managed to read the source after installing it... but if it was bad, I'd've already been hosed by that point.

There's a fundamental lack of logic here that nobody ever seems to point out. It doesn't matter in the slightest whether you read the source before or after you run the EXE. If these guys are black hats, there's not the slightest reason to expect the EXE to match the source.

Even if they're legit, what guarantee do you have that they're sufficently competent and orderly to keep all the components in sync, to make sure that somebody didn't make one last little tweak in the EXE without updating the published copy of the source?

Any time you run an EXE or DLL you didn't compile and link yourself, you are expressing trust in the honesty and competence of the people who provide it, whether the source code is published or not. Even among those who understand the source code, very few of them are competent to check if the compiled code matches the source.

Corporate? Try college.

[mendaliv]

Think users are bad in the corporate sector? Wait until everyone gets back to the college dorms after winter break with their completely unpatched computers. And all the people who have new computers that they got over the holidays. It wouldn't matter if Microsoft had patched it last week, I guarantee that the student users who need it won't have it.

Speaking as a poor sap who has to fix these computers, I have one thing to say: "Thanks for the easy money". And a heads up to all you dorm technicians, get ready to start burning virus CDs.

Re:Corporate? Try college.

[ZachPruckowski]

The worst part is that about half the campus IT staffs are students (hence not working right now), and the other half are probably part time over the winter break, because they shouldn't have much work to do. And students are really bad about patching their computers, because we are sort of lazy/reckless about it. Luckily I have a Mac, but I was planning on trying to get X11+Darwine working.

On the flip side, classes don't start at most colleges for a week or two, so they have some lead time.

Re:Corporate? Try college.

[Tesla Tank]

I'm the "IT guy" on my floor in res. There is no fucking way I'm spending the first few days of school, when workload is not too heavy, fixing everyone's computer. Think I'm gonna put up a poster informing them of the exploit, and where they should go to grab the patch. If they don't do it, I'll just tell them they've been warned. Provided of course, that their computers haven't been infected yet. *shudder* I can just imagine the number of porn and warez sites actively using this exploit. I feel bad for the sysadmins that have to work with thousands of computers.

P.S. I wish someone could write a program that uses the exploit to apply the unofficial patch. That way, I can just point everyone to that program and be done with it.

Re:Corporate? Try college.

[mendaliv]

They tried that with Blaster, remember? It was called Welchia, and ended up being even worse in the end, wreaking havoc on networks.

Bottom line, it's a cool idea, but can cause some messed up problems.

Re:What's wrong with...

[kuzb]

OK, start->run->cmd.exe

In the console window, type 'regsvr32 /u shimgvw.dll' without the quotes and press enter. You will see a notice telling you that the DLL has been unregistered.

That's adding something to the conversation BTW. Do us a favour and quit trying to use slashdot for your own profitable gain.

Re:What's wrong with...

[Cobralisk]

They don't have to.

1. Write a 1 line .bat file that does the deed for the cluefully challenged.
2. Package and publish as a Hotfix and push to Windows Update.
3. ???
4. Profit!

"98%" of PC Users don't know how a patch works any more than they know how to disable a DLL. I'm sure they don't even know how scheduling works. Shockingly, the inner workings of a computer are as mysterious to the average user as a woman's body is to a slashdot reader. We should all just give up on them, because we don't need Joe Sixpack to drive the tech economy so we can actually afford to have computers and affordable bandwidth. Just tell them to put it back in the box, return it to BestBuy, and tell the clerk they're too fucking stupid to own a computer. The GP post suggested a method that apparently works for disabling the vulnerability. This information is useful to the slashgeeks who will end up servicing the computers of friends, family, and co-workers one way or another. A quick heads-up now on this saves a few hours later when after some porn surfing (it just popped up and it wouldn't let me close it) or email attachment (I didn't open it) you end up removing the worm and all the damage it did anyway.

Re:"the snort rule will peg the CPU on your router

[Anonymous Coward]

It's not just files with ".wmf" at the end. Any image file will get unwrapped by Microsoft code and the callback will get executed.

Yes. You see, when the HTTP 1.1 protocol was being developed, they made it a solid rule - you MUST NOT GUESS the content-type when it's supplied.

Anybody want to hazard a guess as to what Internet Explorer and everything that uses its rendering engine does? Yep, that's right, it ignores the standard and guesses.

That means that instead of having to check <1% of images going through your firewall/proxy (WMFs and unlabelled content), you have to check 100% of them. Heck of a job, Billy-boy!

Re:What's wrong with...

[MikaelC]

It may not be enough.

From http://www.viruslist.com/en/weblog?discuss=1768925 30&return=1:

"... Going back to the wmf vulnerability itself, we see number of sites mention that shimgvw.dll is the vulnerable file. This doesn't seem correct as it's possible to exploit a system on which shimgvw.dll has been unregistered and deleted. The vulnerability seems to be in gdi32.dll... "

Re:What's wrong with...

[Jugalator]

People shouldn't need to have IT qualifications to use a computer, it should be secure enough for them to use it.

Yeah, I wonder when we'll see such an OS though. Usually it involves tradeoffs for security at the cost of features; something big business often aren't very interested in. I feel all popular *nix OS'es are out of the picture still, but they may be getting there, perhaps in the generation of distributions to follow Ubuntu. Ubuntu still means considerable digging on forums if you want to do something "advanced", such as connecting a special peripheral. Not at the fault of the distro or OS per se, but at the support. Still, that doesn't make it less of a problem. Is OS X perhaps closer to this vision? Or is it that just because it's less common, and not something we can merit the OS itself for being?

In English please...

[samj]

WTF are you trying to say:

"They want you to trust that the unofficial patch for the Windows Metafile Volunerability that is currently being exploited by an IM worm."

Possibly the worst story ever.

Holidays!

[antdude]

I think the problem is the timing: Holiays. However, I do agree that MS people should be called in to work on this serious patch. I can't wait to see the messy outcomes tomorrow (back to work, school, etc).

Sure, people needs lives (e.g., vacation, time off, etc.). Just reimburse those later on (if not, then the employer isn't good). They really need to get this fixed, tested, and released ASAP. So far, MS is not doing a good job as usual. :(

Re:Holidays!

[SillyNickName4me]

Sure, people needs lives (e.g., vacation, time off, etc.).

And so do those who work as network administrator etc..

I can tell you that many a company that takes internal security seriously has had people working on this over the last weekend to make sure they are as safe as can be when everyone starts working today.

MS could have had a few employees working on this during the hollidays, get it properly fixed, and have an update installed with windows update.. as it is, they got a few thousand people working on implementing workarounds and unofficial fixes instead. Lots of extra work that has to be undone when the official fix is there.

Re:Holidays!

[antdude]

I agree. That is why they have plans for any emergencies. Not everyone can have time off at the same time. Of course, this is planned ahead of time too. I have seen this happened at my workplaces all the time. :)

Re:Holidays!

[kimvette]

{
I think the problem is the timing: Holiays.
}

If they can force, er, "encourage" microserfs to pull 60 to 100 hour workweeks away from their families for months at a time to squeeze more features into Winbloat Vista and Microsoft Office, certainly they can ask one or two developers and QA folks to implement a security patch and roll it out quickly as at least a BETA release?

reason 8,181,842 I quit running Windows.

Re:Holidays!

[SillyNickName4me]

Its part of my job, and actually a part that I like a lot. I do not like people or companies wasting my newyear weekend while that could very easily be prevented however, and that is exactly what MS did here.

Treacherous Computing

[Dogmeat83]

Don't be deceived by the headline! To see how ugly this beast really is, take a look at Ross Anderson's excellent TC FAQ http://www.cl.cam.ac.uk/~rja14/tcpa-faq.html. It's the best investment you can make (20 minutes) to get informed on computer ethics, and now is the time to be informed.

Re:Not really a whole lot of choice about this one

[coolGuyZak]

Other choices:

• Use an alternative OS
• Do not use the pr0n Internet
• Do not open any images
• Do not use your computer
• Use your computer as is and reinstall windows after a patch is released
• Do not use your computer
• Use your computer as is and pray
• Use the unofficial patch
• etc...

This Is Incomprehensible!

[TexVex]

Anonymous Coward writes

Writes? Wouldn't a high school English teacher send this back with a little markup and a big fat red "F" on it?

"This is a first: the Internet Storm Center is recommending trustworthy computing.

I think this is the one valid sentence in this whole summary!

They want you to trust that the unofficial patch for the Windows Metafile Volunerability that is currently being exploited by an IM worm.

Obviously one instance of "that" is an extra. But which? Remove one, it means one thing; remove the other, it means something different.

No patch from Microsoft at this time,

Fragment (consider revising).

and the exploit is arranged in such a manner that it cannot be detected by most intrusion detection systems

Flowers and furniture are arranged. Music is arranged. Why the hell is the bolded phrase even in there? Try "the exploit cannot be detected by most modern intrusion detection systems" on for size. That edit gets rid of the passive voice and that meaningless phrase all at once!

(the snort rule will peg the CPU on your router)

I guess somebody's snorting something. What the hell does this mean?

nor filtered by packet-inspecting firewalls (it spans two or more ethernet frames).

Ooh, somebody just loves the parentheses! Why not kill them and insert ", since" after "firewalls"?

Not really a whole lot of choice about this one.

Fragment (consider revising).

I don't know who's more of an idiot -- the submitter or the "editor" who accepted this turd of an article summary.

Re:This Is Incomprehensible!

[cciRRus]

Hi there, Mr. English Teacher. You missed out this one.

Windows Metafile Volunerability

Re:This Is Incomprehensible!

[julesh]

"They want you to trust that the unofficial patch for the Windows Metafile Volunerability that is currently being exploited by an IM worm."

Obviously one instance of "that" is an extra. But which? Remove one, it means one thing; remove the other, it means something different.

Actually, I parsed it as having a missing verb. Add "works correctly" to the end of the sentence and it's fine. Omitting the second 'that' results in a nonsensical statement, given the context. Removing the first 'that' is a possibility, and now you point it out it seems more likely than my original theory, but still both are possible I think.

"No patch from Microsoft at this time,"

Fragment (consider revising).

Definitely revise. "Microsoft have not yet released a patch" is good for placing the emphasis on the fact that MS need to do it, and "No patch has been released by Microsoft at this time" works better for emphasising that there isn't a patch. I prefer the former, but that could be my bias. It's also slashdot's bias, so would probably better suit the article.

(the snort rule will peg the CPU on your router)

I guess somebody's snorting something. What the hell does this mean?

I think it's pretty clear from context that snort is an intrusion detection system. Still, its name should have been set in italics or in quotation marks (the latter, given the way slashdot's submission system works), as it isn't one that most readers will be familiar with and there is a danger of confusing the name with the word that it is based on. Also "peg the CPU" is a colloquialism used only by a very restricted group of people. It's also somewhat inaccurate; I would say that "peg" in this context means "cause to be constantly in use", but I have little doubt that a suitably powerful router could cope with it on an average link without this happening.

"Not really a whole lot of choice about this one."

Fragment (consider revising).

I'd leave this one. It enhances the style of the sentence over the obvious alternatives.

Re:This Is Incomprehensible!

[VGPowerlord]

"Microsoft have not yet released a patch."

I find that this reads better as

"Microsoft has not yet released a patch."

Re:This Is Incomprehensible!

[earthbound kid]

and the exploit is arranged in such a manner that it cannot be detected by most intrusion detection systems

Flowers and furniture are arranged. Music is arranged. Why the hell is the bolded phrase even in there? Try "the exploit cannot be detected by most modern intrusion detection systems" on for size. That edit gets rid of the passive voice and that meaningless phrase all at once!

"Cannot be detected" is passive voice. Duh. "Most modern intrusion detection systems cannot detect the exploit" is not. But "most modern intrusion detection systems"? Like seriously? Ugh. Language nazi, nazi thyself.

Re:This Is Incomprehensible!

[iroll]

Both are correct; referring to organizations in the plural (Microsoft have) is more common for folks in the UK, while referring to organizations in the singular (Microsoft has) is more common for folks in the US.

Re:This Is Incomprehensible!

[Woy]

And free markets suck!

Re:This Is Incomprehensible!

[VGPowerlord]

Ah. I wasn't actually thinking of it as singular or plural, but rather that the name Microsoft is a proper noun.

Re:This Is Incomprehensible!

[orbitalia]

"Anonymous coward writes" is okay. writes is third person singular form of "write".

write at wictionary

Re:This Is Incomprehensible!

[HermanAB]

American public school English is to be helping and not to be laughful at...

Re:Not really a whole lot of choice about this one

[coolGuyZak]

Erg. in the post above, "pr0n" should read "pr0n^H^H^H^H" ... why the hell does /. disable strikethrough??

Trust Worthy

[Anonymous Coward]

I know the title was meant partially as a joke. However this is exaclty the kind of thing you _COULD_NOT_ do if a computer was enabled with trustworthy computing. You could never apply a patch from an "untrusted/third party" source.

Re:What's wrong with...

[DarkOx]

Why should people be allowed to operate a dangerous machine in public without a good understanding of how it works. If your engine sezies on the innerstate in front of me I COULD DIE. If people knew how an engine worked they'd have a much better understanding of when it needs critical attention. I think people SHOULD be required to know basic engine mechanics to drive a car. You are expected to know that stuff to get a pilots license for instance.

Re:"the snort rule will peg the CPU on your router

[fuzza]

Because Microsoft checks the header for every image file and treats it as WMF if the header matches, all jpegs, gifs, and pngs are potential vectors for the disease.

Deja vu... wasn't this the basis behind the vulnerability a couple of years back, caused by the integration of the browser into the OS?

Something like sending EXEs with text headers, so that the browser saw the text part and regarded it as safe, blindly passing it to the file handling engine (whatever it's called) which looked at the EXE extension and executed it. After all, the browser would have flagged it if it were dangerous, right? :-/

Re:What's wrong with...

[SillyNickName4me]

OK, start->run->cmd.exe

In the console window, type 'regsvr32 /u shimgvw.dll' without the quotes and press enter. You will see a notice telling you that the DLL has been unregistered.

One step too much, and possibly incorrect.

start->run

in the dialogbox type 'regsvr32 /u %windir%\system32\shimgvw.dll' without the quotes.
You will get a popup confirming that the dll has been deregistered.

So is there a patch ?

[smoker2]

or not ?

according to Microsoft

If you are a Windows OneCare user and your current status is green, you are already protected from known malware that tries to attack this possible vulnerability.

That sounds like they must have some kind of patch out there, or are they hoping to get more users "hooked" on OneCare ?

Otherwise, this statement doesn't make sense :

Upon completion of this investigation, Microsoft will take appropriate action to help protect our customers. This will include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs.

Maybe I'm being picky, but I think all their customers have a quite urgent need, right now !

Written from the sublime security of Fedora Core, thanks.

Re:So is there a patch ?

[clem.dickey]

Perhaps no one currently has "green" status. That would make Microsoft's statement correct today (assuming no fix is available) and the statement would still be correct after Microsoft releases a fix.

Just like the old joke: Pilot, lost in fog, yells to man in building "Where am I?" Man yells back "You're in an airplane." Pilot knows he is passing the Microsoft [originally "IBM"] building, because the information he got was entirely correct but entirely worthless.

Re:So is there a patch ?

[glsunder]

So... Has anyone used their OneCare Live service during the beta?

Re:So is there a patch ?

[rjstanford]

Then there's the follow on. In the original (or a frequent variation thereof), the pilot chews the information-giver out by saying, "Well, its obvious that I'm in Seattle, because...." Its also usually a balloon that's being piloted in order for the exchange to work.

The .com version added, "I bet you're a [consultant/VBer/whatever]," said the man in the building. "What makes you say that," asks the pilot? "You don't know where you are, or how you got here. You're just as lost as you were a few minutes ago, but now its my fault.

Or something like that. There are better versions of the joke out there, but I'm too lazy to google for them.

WTF... Cannot parse

[hikerhat]

They want you to trust that the unofficial patch for the Windows Metafile Volunerability that is currently being exploited by an IM worm.

I think I know english pretty good. And my brain filters out even the worst spelling errors such that I know what they mean when they say 'Volunerability'. But I really can't make heads or tails of this 'sentence', if you can call it that. WTF does this mean?

Re:WTF... Cannot parse

[Yahweh Doesn't Exist]

>I think I know English pretty well, and...

fixed.

Re:WTF... Cannot parse

[hikerhat]

Arrg! Head exploding. "I think I know english pretty good..." is a common joke.

I'm a digital dummy, but I deployed this "fix"...

[BruceMcAuley]

So far so good, and isn't this what the RESTORE function of Windows is about. Better safe than sorry, IMO. Bruce

Misplaced fear? That's what security IS!

[gelfling]

I don't understand the elevated fear that this unofficial patch may cause some problem in the future, compared to the certainty that doing nothing will compared to the certainty that some MS official fixes cause problems of their own.

Yes there is a likelihood this could breaksomething down the road, just as de-registering shimgvw.dll might cause some other problem - probably with in-house apps later on too. That's pretty much the nature of security though, isn't it?

Intel architects

[kybred]

The guys at Intel in the late 1970s didn't consider things like that - if they ever knew about them - as they were mostly IC designers, not proper computer architects.

You are mistaken. If you look at the 8086 (and 8088) design you'll see the segment registers which could be used to separate data from code memory. I believe the current x86 processors still retain these registers. Of course, using memory segments was a pain and the OS designers (probably pressured by application developers) stopped using them in preference to the flat memory model.

To say the Intel designers didn't know about HW protection is incorrect.

Re:Intel architects

[iBod]

Yes,

No doubt the designers knew about hardware protection - but their project managemers considered it a low priority in the race to get the chip to market.

Probably a good call business-wise, but it leaves quite a legacy in it's wake, doesn't it.

Just plain ignorant post

[akalat]

The assertion that packet filtering firewalls cannot block this attack is just plain wrong. For instance, Check Point, and probably other firewall manufacturers, had a block for this attack back in April of 04. Firewalls aren't just the freeware open source flavor of the month gang. Some corporations actually buy more advanced tools that have features beyond blocking a given port.

Reference: http://www.checkpoint.com/defense/advisories/publi c/2005/cpai-28-Dec.html

Does not compute

[MadJo]

"They want you to trust that the unofficial patch for the Windows Metafile Volunerability that is currently being exploited by an IM worm."

They want us to trust that the patch does what? eat my pc?

Re:What's wrong with...

[kuzb]

Granted you could do it in the run dialog, but the rest works just fine. Did you bother to test it before chiming in?

Re:What's wrong with...

[SillyNickName4me]

but the rest works just fine. Did you bother to test it before chiming in?

Yes, and in most cases it works. That said, I doubt it works in all cases, and I am pretty sure that both Microsoft and ISC (and others) explicitly include the path for a reason...

No it's much worse.

[goombah99]

What's evil about this one is not that someone couldlure you to a rigged speical website but that they can reach out and get you. For example, they can just take out a banner add from double click and have this rigged jpeg displayed on tens of millions of computers. Or they could post it as a picture on FLikkr and hope it gets into the rotation for a picture of the day. get it into google images. Post it on a bulliten board that allows thumbnail jpegs. Lots of ways to get the code onto trusted web sites.

Pushing the patch via Zenworks/SMS/Tivoli???

[mosel-saar-ruwer]

I have patched all my clients by hand; the patch requires user interaction via two or three manual mouse clicks. [It also requires a reboot, BTW.]

Has anyone automated the thing so that it can be pushed to hundreds [or thousands] of clients via something like Novell Zenworks, Microsoft SMS Server, or IBM Tivoli?

I know that e.g. Zenworks has a "diff" mechanism that will isolate a "before/after" differential, but that's a lot of work, and frankly it's a little bit of a kludge [no offense to Novell].

Re:Pushing the patch via Zenworks/SMS/Tivoli???

[pyrros]

The fix can be applied in the automatic mode using the following command line:

wmffix_hexblog13.exe /VERYSILENT /SUPPRESSMSGBOXES

These switches do not suppress dialog boxes about installation errors.
The /LOG="file" switch can be added to the command line to create a log file.


[from http://www.hexblog.com/2005/12/wmf_vuln.html ]

There's a MSI version in the works as well.

Win98 patch?

[GreatDrok]

I wonder if anyone is going to be able to patch Win98 against this? There are still a lot of machines and this vulnerability could make them essentially useless and force an upgrade. While we would all love for them to upgrade to Linux or OS X it is more likely that they will shell out for WinXP and MS will benefit from a windfall of sales as a result of their inept programming. If someone produced a workable patch this would at least allow people to keep using their computers without pouring more money down the MS bottomless pit.

Re:Win98 patch?

[Reziac]

I ran the test util on my Win98 box (http://www.hexblog.com/security/files/wmf_checker _hexblog.exe small download)

It said -- Not Vulnerable.

The referring page (which I can't find again offhand but is one of the links from GRC) said not to take it as gospel, since it only tests for one of several possible entry points, but it's better than nothing.

Re:Win98 patch?

[Cyno]

Well, at least all likely options sound like a win-win situation for Microsoft.

Unlikely they'll start supporting Windows 98 anytime soon. But I'm sure they'd recommend an upgrade to Windows XP, complete with all its Trusted Computing Security Enhancements and Everything. Trusted by all Windows users Everywhere. And you only have to call their activation center once during installation.

Everyone must love Windows to keep putting up with this treatment. Either that or they love pain. If its the later I'm going to have to change my business model.

Re:What's wrong with...

[kuzb]

Which is?

Re:What's wrong with.. - A LOT!!

[dr_skipper]

THAT DOES NOT WORK.

Read the ISC posts re the DLL re-registering. Opening the WMFs in certain apps will cause them to re-register the DLL, open the file, and infect you. See the Lotus Notes updates for an example of such an app.

Your TPM software might refuse to run

[Lonewolf666]

In some DRM scenarios, the TPM chip is also used to prove to your software that the OS has not been modified. Unless you have the skills to hack that software, your bought and paid for TPM programs may refuse to work any longer.

A much tougher case would be the "rely on others" programs where you have to prove to an external instance that your system has not been hacked. Take the "death to game cheaters" implementations as an example:
Want to fix your vulnerable Windows with a non-official patch?
World Of Warcraft II won't let you play anymore ;)

I also don't believe this is temporary. Except in the sense that TPM might be (hopefully!) a colossal failure in the market. And considering the current vulnerability, this looks like more than a slight theoretical risk to me.

Re:Your TPM software might refuse to run

[IamTheRealMike]

I meant it was temporary in that the unofficial patch was temporary. This kind of in-memory patching of binary code is absolutely not common, nor to be encouraged. It's a 5 day fix type thing and is needed (and possible!) so rarely that writing off an entire infrastructure because of it would IMHO be silly.

ReDesigners

[symbolic]

I'm trying to figure out why the people who designed this architecture didn't realize that putting this level of functionality down at the OS was NOT a good idea. This shouldn't be used as a justification for "Trusted Computing," it should be used as a prime example of what happens when one vendor decides to tightly couple all manner of functionality with its OS. I realize they might not have seen this when the WMF format was implemented, but the reason for implementing it this way most likely had something to do with Microsoft's monopolistic mindset.

It seems to me that the client should be responsible for ALL failures of this nature- what would have been so difficult about simply returning a result code?

Re:ReDesigners

[Sigma 7]

I'm trying to figure out why the people who designed this architecture didn't realize that putting this level of functionality down at the OS was NOT a good idea.

While you're trying to figure that out, why not do the same to the 640KB barrier?

At the core, Windows was designed from a base where there was a severe limitations from memory and other resources (and in the case of Windows 1.0, could not even support overlapped windows.) Even Windows 3.0 had "silly" limitations that would be brought down simply by being a Moderator on Slashdot. In addition, when 32-bit computing was made easily accessable with Windows 95, there was still a "silly" 16-bit coordinate system limitation for drawing.

It seems to me that the client should be responsible for ALL failures of this nature- what would have been so difficult about simply returning a result code?

How does returning a result code help when you queue up tasks for being done in the background? As any Windows programmer knows (and perhaps for Motif or X11), there are a lot of functions that provide capability for doing non-blocking calls to resources and I/O activity - a return code is useless if you want to know about the status of the operation once it finishes (aside from determining if it was started.)

anguished english

[mennucc1]

They want you to trust that the unofficial patch for the Windows Metafile Volunerability that is currently being exploited by an IM worm.
Hey, what is that supposed to mean? I suppose the above should be
They want you to trust their unofficial patch for the Windows Metafile Volunerability that is currently being exploited by an IM worm.
Since my first language Italian , (that comes from Latin, and is quite picky about sentences construction), it took me quite some time to understand; I suppose that the above was not a problem for anglosaxon people, since nobody seemed to notice....

Re:What's wrong with...

[kuzb]

OK, since I'm certain we're not actually going to GET an answer, here it is: When no path is specified, the system32 directory is used. Ergo, it's not required to enter a path unless the file you're trying to unregister exists somewhere other than the system32 directory.

Perhaps you could enlighten us about which cases (following your statement 'in most cases it works') this fails.

This is what I love about slashdot - you'll get a thousand people attempting to add their pearls of wisdom, and very, very few who actually have any idea what it is they're talking about. Doubly so when it comes to Windows.

I do trust Microsoft...

[eyepeepackets]

...to do what they do best. Which is why I use a different OS and suggest others do so as well.

What does Microsoft do best? Why, get the money out of the pockets of suckers, of course.

Suckers.

Cheers!

The problem is with false extensions

[gmcgath]

Not stated correctly. If a file has a WMF header then it isn't a JPEG, GIF, or PNG. The problem is that applications which determine type by header will accept a WMF document that's hiding behind a .jpg, .gif, or .png extension. This doesn't mean that the "disease" can be stuck into a valid document of any of these types. The terms "disease" and "infection" for malicious code are misleading anyway.

The best description I've found of the WMF format is here. Based on this information, it looks as if a filter can look at the first four bytes of a file and identify it as a WMF document with very few false positives.

Doing this with discrete files might not be too bad. Applying this check to every part of a MIME document, or to various compressed file formats, could get very painful.

Trustworthy Computing != Trusted Computing

[hanssprudel]

There seems to be a lot of confusion in this thread regarding these two terms. It isn't that surprising, since they are both purposely misleading, but still.

"Trustworthy computing" is Microsoft's bullshit name for their so-called initiative to start taking security seriously. It was under this banner that Bill sent all his coders to secure coding seminars so they could learn what a buffer overflow is. The article is ironic in its title: that Microsoft have failed to find such a glaring issue as a native image format that purposely allows images to execute arbitrary code, and that they have not offered a patch even now when exploits are in the wild since almost a week, shows how trustworthy they really are.

"Trusted computing", on the other hand, is the bullshit name for a nefarious scheme involving hardware and software whereby control over PCs should be taken out of the hands of their owners, and given to the software and hardware vendors. This is sometimes claimed to be about security, but is actually motivated by DRM and DRM only (the name is short for "Trusted Client Computing" and comes from the ability of DRM vendors to trust that your computer, the client, will obey their directions).

The people pushing "trusted computing" are actually not so much Microsoft as Intel and IBM: Microsoft completely support the concept of trying to put the freely programmable computer back in the bottle, but they have had their own ideas about implementation (their version was first called "Palladium", but when they realized that it is bad to have a recognizable name for something customers actually don't want it was renamed "Next Generation Secure Computing Base" and after that it was renamed to nothing at all so they can be snuck into the coming versions of Windows without people noticing.) // oskar

can't remove the callback feature

[r00t]

The WMF file is really a list of Windows drawing functions to call, along with their parameters.

Guess what else uses this.

There are in-memory and on-disk WMF files. Some are used by apps for repainting the screen. Some are used by apps for printing; Windows printing is based on the WMF. You want error handling with printing, right?

Now, I'm not saying how to fix this unless Microsoft shares some cold hard cash with me, but there are reasonable solutions. It's just not as simple as patching out the feature.

Re:can't remove the callback feature

[r00t]

It doesn't look all that obsolete in Microsoft's documentation.

CERT may think the function is obsolete, but that doesn't mean
that apps no longer depend on it. Stuff breaks if you go ripping
pieces out of an ABI. Somebody's critical business app might
even depend on the function.

Re:can't remove the callback feature

[3rd_Floo]

Considering the company I work for has critical desktop (Win XP) business apps that depend and backed to a scarcely alive VMS cluster, the likelihood of this little API call being widespread are indeed very high.

Re:can't remove the callback feature

[udippel]

You might have cited properly from CERT; but then CERT is wrong; FYI.
Otherwise, the thing would have been done easily and none of the applications would break by applying the 'hotfix'.

Do you always believe what someone else states ? I have no reason to distrust CERT, but also these people could be wrong.
The only correct method: lay the sources open and we can all find out what is going on.

Re:can't remove the callback feature

[Dachannien]

Let's review the dilemma then, shall we?

Option A: Fix the issue as quickly as possible (perhaps as a temporary fix until a more compatible permanent fix can be issued), possibly allowing an unknown number of old pieces of software to malfunction.

Option B: Don't fix the issue immediately, allowing millions of computers to get rooted and exposing the passwords, credit card numbers, and other personally identifiable information of unprotected and unaware users to organized identity theft rings.

Are you really advocating/defending Microsoft choosing option B here?

Re:Cringley discussed this back in September

[1u3hr]

This could have been a 0-day fix, quite honestly.

It was, though not by MS. The Hexblog hotfix is 200 lines of code (he includes the source), including comments.

Kidding, eh?

[RedLaggedTeut]

But did you (or the OP) check whether the sourcecode matches the binary patch?

Did you audit the sourcecode for security leaks which might have been maliciously inserted?

Wiki

[r00t]

Some wikis probably don't check file content.

Wikipedia tries to block stuff like this, but I don't think it is all that reliable. They just use the UNIX file command to see if a file matches the file extension.

WMF files start with 0x01 0x00, are are unrecognized by the file command.

JPEG starts with 0xff, so that won't do. Well, there are other formats to try.

Turn off Image Rendering?

[Eadwacer]

In Opera, I can toggle "show images". If I set that to show no images, can I assume that is an effective workaround? Drawbacks are, it won't help with images embedded in files, and it breaks a lot of websites (some label their buttons, others just say 'image'). I wonder if Lynx runs under XP?

Re:Turn off Image Rendering?

[linuxrocks123]

> I wonder if Lynx runs under XP?

Yes: [http://www.fredlwm.hpg.ig.com.br/cygwin/lynx/%5D

With a packet driver it'll even run under DOS.

Re:Turn off Image Rendering?

[linuxrocks123]

(sorry for the repost; I botched the URL)

Yes, it does. See http://www.fredlwm.hpg.ig.com.br/cygwin/lynx/

It'll even run under DOS if you install a packet driver.

Its not a DLL -its Windows, and its a feature

[steve_l]

F-Secure has more on it: http://www.f-secure.com/weblog/#00000761

Windows Metafiles are a file representation of drawing commands. They are more flexible than bitmaps and get used quite a lot in things like for caching images of every OLE object embedded inside a MS word or powerpoint document. There just happens to be one operation to set a callback when a printing aborts which can be saved to a WMF file, which, when followed by something to abort the rendering, lets you jump to the nominated location.

This back door is built into windows from version 3.0 onwards. Any app that displays WMF images from untrusted sources (lotus notes, maybe msword, even google desktop search) is vulnerable. This is potentially code red for the desktop.

I have the patch on all my systems, the author works for IDA, the debugger tool, and is well respected. I dont care whether IT central will push it out or not; I think they ought to before the back to work/school event causes major worm attacks using it. It will be pretty embarrassing for microsoft though -a third-party emergency fix for windows, in the same year that Vista, "Windows Secured" is due to ship.

Re:Its not a DLL -its Windows, and its a feature

[ePhil_One]

It will be pretty embarrassing for microsoft though -a third-party emergency fix for windows, in the same year that Vista, "Windows Secured" is due to ship.

Embarassing? This is why we need to upgrade to Vista as soon as its available. None of this lollygagging like we did with our Windows XP upgrades! NOW!

Re:Its not a DLL -its Windows, and its a feature

[Wolfrider]

Is it just me, or is the Slashdot "unofficial patch" link at the top absolutely useless?

After banging around the SANS site for a good 15 minutes, I *finally* found WHERE YOU CAN DOWNLOAD THE PATCH from:

http://isc.sans.org/diary.php?storyid=999
http://isc.sans.org/diary.php?storyid=1004

Re:Its not a DLL -its Windows, and its a feature

[richpulp]

When is Windows Vista supposed to emerge from Redmond? I have been signed up on their "we'll let you know list" for a while and nothing much has appeared.

OT. If it is RTM by July, maybe they will force OEMs to put sufficient Ram on their PC solutions, unlike the measly 128mb supplied on early machines with XP or 32mb with Windows ME.

I would happily upgrade if MS weren't overcharging. I guess also that it is goodbye to Home and Pro flavors too. A Vista for all.

Re:What's wrong with...

[rhendershot]

>>And you are tested on all of these things before you are granted a driver's license.

I liken it more to riding a bike than to driving a car. Yes there are laws governing a bike on the road but they're largely ignored both by riders, drivers and law enforcement (ymmv). Likewise, there are 'rules of the road' for computer use. Likewise they are largely ignored by users, suppliers and administrators ***. Training consists mostly of learn-by-doing. Skills improvement mostly static after initial success. Maintenance often relegated to 'I turn up the headphone volume so I don't hear that noise', until something breaks. Knowledge of design detail relegated to 'that gear doesn't work right so I just skip it'.

It seems to me reasonable to have cut Microsoft some slack with '95, but as of Windows ME they should have nailed down the training and design to produce reliable and safe 'appliances' as they marketed them. Win2k is a joke perpetrated on both home users and business users alike in that installations required writing to system areas that required admin account. Even with XP Microsoft did not get it right.

Yes, there would have been monetary cost to Microsoft and 'pain' to novice users, but to not have driven a conversion to safe computing is nothing less than willful neglect of the most serious kind.

Too much elitism exists in the debate. Don't you think that Joe User would *agree* to run as user-mode if given the basic facts that it prevents most exploits (and an OS that allows Application installation of -not software, which is mostly trojan, but Applications- the software the user has decided s/he wants) and that it protects private data in their own protected home?

Do we need a licensing beauracracy to enforce that? I don't think so. And I don't think an IT degree is needed on the part of users. User mode, out/inbound firewalling, more carefull system lib programming... that would swat 90% of the issues. Possibly even achieve the computer-as-appliance goal that we all share (admitted or not).

-rsh

*** - users; when was the last time you sent an attachment to a group of people who might not know you, say an internal corporate email alias. suppliers; Windows. administrators; users allowed to run as god

I havent tested this on vmware yet...

[steve_l]

I have the december beta on vmware; I need a safe version of the exploit to test it. I bet all vista does is stop the third party hotfix from working

Re:What's wrong with...

[r00t]

Why not just use an ACL on it?

Time for another self-healing worm?

[PGillingwater]

As a long-time Linux advocate, I must admit to a little Schadenfreude in the latest WMF exploit, however as a responsible member of the security community, I think we have to take this problem very seriously.

Whilst Microsoft may indeed publish an official patch in the next few days, they have no way to push it out to all the vulnerable systems. Savvy admins may have already applied the unofficial patch, and kudos to them.

However, the biggest problem is the great masses of unpatched systems that will never receive an official or unofficial patch. For them, I am afraid the only solution is a fix which exploits the vulnerability to patch the system automatically. If this is not done, it will exacerbate the problem of DDOS botnets and Spam relays, making life even worse for the rest of us.

Experienced security people will recall this has been done before. I suspect this may be the only way to patch enough of the vulnerable systems that won't be protected either by Microsoft's efforts or those of a competent admin. Any takers?

Windows 3.1 used segments

[steve_l]

Win31, still 16 bit, used the intel segments to manage memory. you had to alloc separate code and data segments, and use an API call, PrestoChangoSelector to flip it. The segments were only 64K and special 'huge' pointers were needed to do the proper arithmetic on a set of sequentially allocated segments.

That went away in 32 bit mode, because 32 bits was all we needed, and because 'flat' is simpler to work with. And because security in winnt was about untrusted users on trusted 'enterprise' systems, not trusted users with untrusted data.

I Compiled it myself

[steve_l]

I built my own release.

The code is only 200 lines, and is primarily patching logic with a switch in there. The biggest risk is that it patches the wrong place and doesnt provide protection, the next that it doesnt uninstall. Those are hard to test.

Re:Data point from one corp

[Swootech]

I'm curious. Did the option of using one of the workarounds posted in the Microsoft Security Advisory (912840) article come up?

Running "regsvr32 -u %windir%\system32\shimgvw.dll" or even removing the DLL from the system seems like a reasonable workaround while the official patch is being tested by Microsoft.

there is always choice

[Heembo]

it cannot be detected by most intrusion detection systems (the snort rule will peg the CPU on your router) nor filtered by packet-inspecting firewalls (it spans two or more ethernet frames).

You *can* run 2 instances of snort in-line to get around this CPU-pegging issue.

Not really a whole lot of choice about this one.

There is always choice - have you considered a defense-in-depth multi-layered approach? I'm taking the following steps
1. unregister the ms pic and fax viewer dll
2. make WMF file extension default to an erroneous app like notepad
3. turn DEP up a notch
4. turn off downloads in IE if you must use it (set default security settings to HIGH)
5. block all WMF files at the perimiter
6. keep antivirus up to date and consider frequent manual updates and scans of key machines

These things in combo with being vigilant over the next few days should keep you and your corporate networks safe. There are even MSI versions of the patch for mass distribution.

Re:there is always choice

[Sedennial]

Did you miss the fact that blocking .wmf files/extensions means nothing for XP users? Because XP took a page from the 'magic bytes' of Unix and recognizes .wmf files from the image header, it can (and will) in some circumstances render them regardless of the extension. So naming it .bbb will bypass your perimeter filters completely.

Re:there is always choice

[Heembo]

Did you miss the fact that I am talking about defense-in-depth and am trying to close every attack vector possible? Blocking WMF at the perimiter is a very wise way to stop a large number of potential attacks, since you really almost never need to download wmf files anyways. And I'm talking network perimiter - that means a lot to most slashdotters.

Re:there is always choice

[Heembo]

Again, we are talking defense-in-depth, trying to use a multi-layered defense plan to mitigate every possible attack vector. I'm maintaining a list just for you, Sedennial - don't just do one, do them all. Yes, you are right, wmf perimiter defense is not enough, but is valid as part of a comprehensive strategy. Here you go! http://www.manico.net/wmf_alert.html

Comment removed

[account_deleted]

Comment removed based on user account deletion

Deploying to many machines is hard

[ilfak]

I'm the author of the hotfix and one could expect me to say 'yes, please go ahead and install it on your corporate network with thousands of machines'.

But I won't say that.

First of all deploying any software on a large network is a serious task. It should be carefully planned and performed with the correct (read: responsible) approach.

The hotfix must be tested on as many machines as possible. Possible negative consequences must be determined and decided upon if they are acceptable or not.

In short, more rigorous testing is required.

-------
Ilfak Guilfanov, the author of the hotfix

Re:Deploying to many machines is hard

[plopez]

What you have said should be SOP for any fix on any large network. Even vendors can get it wrong, so testing is always important.

Ahhhh!

[gQuigs]

I've removed:
ActiveX for streaming video
AOL ART Image Format Support
Intel Indeo codecs
Media Center
MIDI audio support
Movie Maker
Old CDPlayer and Sound Recorder
Speech Support
Windows Media Player
Windows Media Player 6.4
Client for Netware Networks
FrontPage Extensions
Internet Connection Wizard
Internet Explorer
Internet Explorer Core
IP Conferencing
MSN Explorer
Netmeeting
Outlook Express
Vector Graphics Rendering (VML)
Windows Messenger
Desktop Cleanup Wizard
Framework
Help
Out of Box Experience (OOBE)
Shell Media Handler
Tour
Web View
Zip Folders
Fax Services
Imapi
Indexing Service
System Restore
(nliteos.com)
AND I AM STILL VULNERABLE!???

Perhaps I should switch to linux :) |scroll lock||scroll lock| (KVM)

Re:"the snort rule will peg the CPU on your router

[CommanderData]

The AC is correct, Internet Explorer will look at up to 256 bytes of each data stream returned (images, html, etc) and attempt to "guess" the MIME type.

An interesting fix for this problem- Rather than having your hardware router/firewall sniff all the packets, you could write a pluggable MIME filter registered to ALL image types on your PC (Google it for more info- I've done a lot of research on MIME filters and Asynchronous Pluggable Protocols for IE, but I'm too lazy to dig it all up right now). If the MIME filter examines the returned image data stream and sees evidence of the WMF exploit, trash the stream and substitute your own image (maybe a jpeg of a skull and crossbones). If registered as a permanent MIME filter it would have the benefit of blocking the exploit in anything that uses IE as a rendering engine- which includes many e-mail applications (Outlook!), and some IM apps.

I looked at doing this myself, but dropped it assuming MS would have created a fix by now. Maybe I should start working on it again....

Ok, cool

[RedLaggedTeut]

I was wondering how many people are out there who have their compilers set up and ready to compile it, seems there are quite a few.

Non NT-based Windows?

[SleepyHappyDoc]

TFReadMe text on the patch states that it is suitable for 2000/XP/2003, but it says nothing about Windows 98 or prior. The vulnerability affects prior versions of Windows, including those outside of active product support by Microsoft. Has anyone tested the patch on Windows 98 or 95 for NT4? If so, what have been your results? I maintain a rather large number of legacy systems here (for regular people, not for a company) still running 98SE, and I'd like to be able to protect them without forcing them to switch to 2000 (XP has a heck of a time on a P233 with 64MB, which is often the best these people can afford). Even the workaround doesn't seem to work right in 98.....is there even a regsvr32 command in that?

Re:Non NT-based Windows?

[quiddity]

the unofficial patch fixes the vulnerability through shimgvw.dll, which us win98 users dont have. but the actual problem is in GDI32.dll which is required for windows to function. so basically we're SOL atm.
info

In case you haven't heard this...

[hullabalucination]

...several thousand times already: Thanks for the patch!

There is an official fix available!

[Admiral Burrito]

In an interview with an anonymous MiroScoft employee, it has been reported that MS has found a working fix!

"We've all turned off our computers, and are sitting on our hands. This has effectively blocked all intrusion attempts."

When asked when the fix would be distributed, he replied:

"Once the threat has passed, it will be safe for us to turn our computers back on and email everyone with instructions for turning their computers off and sitting on their hands. Until that time comes, we're asking everyone to be patient."

Suspend your disbelief?

[jefu]

Should I believe this statement?

The checkpoint page you point to just lists this as a vulnerability and gives a password protected link to "FULL ADVISORY and SOLUTION" (caps theirs). Since I don't have a checkpoint login, I have no clue as to what they are saying. I therefore have no reason whatever to believe that they have anything to offer.

Nope

[Clovert Agent]

Read it carefully - "you are protected from KNOWN MALWARE" that uses the vulnerability. Ie: standard AV response. They haven't fixed the flaw, but they are rolling out signatures to protect against known malware as and when it pops up.

What did they do wrong

[badriram]

I do not want a patch that is untested, and could cause even more hell. You really think, they could have created a patch, and tested it well to be deployed on 200+ million machines connected to Windows update, and not have any bad effects on other apps.
If you look at the patches realeased by others, they also say it might break applications, and you might have problems with it etc. I do not think MS has that option while creating a patch.
Microsoft accpeted there was a flaw, posted information about it, told you about workarounds. If you want to be protected just turn on DEP on all applications. Want to do it on multiple machines, use scripts to edit boot.ini and add /NoExecute=OptOut to the options, and kick in a restart. Atleast that is a better thing to do than trust a random untested patch.

Re:What did they do wrong

[daviddennis]

Wrong. DEP only works with specific AMD hardware. Apparently Windows' software DEP doesn't work in this instance.

I think I could trust a patch to fix a problem this horrible that has a pretty well-defined goal. It doesn't seem like a fix likely to have heavy reprecussions, and the possible consequences of not having a fix are too horrible to contemplate. Someone who doesn't fix this is literally one myspace profile away from disaster.

  Fortunately I'm a Mac user so I don't have to worry about this one.

D

Re:What did they do wrong

[PhYrE2k2]

A patch posted a couple weeks ago stopped IE from loading gif images from select sites. They show up as invalid (X) images. Strange isn't it? A 'security' patch should never break functionality.

-M

Re:What did they do wrong

[rtb61]

Of course security patches should break functionality where appropriate, it is a balance, where the functionality lost is of little consequence and the security risk of failing to apply the patch is extreme. It is obviously worth while to sacifics a bit of functionality in order to avoid a complete loss of functionality.

Just to be clear, any delays on microsoft patches are because they have to out source a lot of the testing because they are incapable of doing it internally with any degree of reliability. How could anybody forget the fun of NT patches, the dice roll of one to six, where one was a successfull patch and six was a system rebuild because of a completely disfunctional patch and the numbers inbetween represented various degrees of patch failure (recommended method was to wait at least one month after the patch came out before applying it, in the hopes that large institutions would pick up any faults in M$ patches so that the patches could be patched prior to your own gamble).

An example of a M$ patches that broke functionality is the windows 98 patch for write caching to the hard disk drive the patch didn't fix write caching it just disabled it (and they never did bother to fix it properly).

Re:What's wrong with...

[arminw]

.....I think people SHOULD be required to know basic engine mechanics to drive a car. .....

People learning how to drive a car USED to have to know more about the inner workings and people who use early computer USED to need to know about the arcane aspects of computers. Nowadays, both cars and computers are commodity technologies, the inner workings of which have become too complex for most users to have to or want to understand. That aside from the cost issue, this is why small airplanes are not as numerous as they could be. People will use a technology if some aspect makes it easier to do something than it was before. E-mail is simpler, faster and more convenient than post office mail. If it were not, then it would not be used. If, in order to to get on the Information Highway, an expensive course and a stiff exam were required, the disadvantages of that would keep most using the post office or phone. All /. geeks would still be paying many times the price of the mass produced hardware we enjoy today.

It seems that most reader here on /. look down their noses on the clueless, unwashed mass of computer users out there because even basic knowledge about the workings of computers is absent. The fact is that OSX is much safer, easier to network and a lot nicer to look at than malware infested Windows. Such a user could install OSX 10.4 on a two year old Mac without a hitch and be connected to the net without help from an "expert". Doing that with a Windows box does require such an expert. Finding and installing a driver for the video was a hassle also. I hope that with VISTA, MS will finally come up with an OS that is at least as good and secure as OSX is today.

$20 app blocks all WMF vectors

[CFrankBernard]

Users of PivX PreEmpt have been protected from all vectors of WMF exploits (and others) since December 7th. You can buy a 3-pack for $60 at pivx.com

Re:"the snort rule will peg the CPU on your router

[NuclearDog]

The reason for this there is an http module in snort which only captures the first 300 bytes of the request for (what I assume to be) speed reasons.

In order to detect this exploit, you have to disable this module. Not too bad unless your IDS is watching thousands upon thousands of requests in which case in order to check the full requests, it can easily take a lot of CPU power.

Last I heard the recommended action was to run one instance of snort with all our normal rules and this module enable, and one with only the wmf rule and the module disabled.

ND

Re:What's wrong with.. - A LOT!!

[HermanAB]

I unregistered and renamed the shimgvw DLL and turned Windoze Restore off, so it can't be re-registered. However, the real culprit gdi32 DLL is too important to be deregistered and some applications call that one directly.

Re:What's wrong with...

[HermanAB]

An ACL to block all WMF files? That is a start, but a WMF file need not use a .wmf extension. It is identified the UNIX way, with a magic number, so it could just as well be called .jpg or .wtf...

useless for game cheats and other purposes

[JimmytheGeek]

I will grant that this will stop "many" types of cheats. It will still be useless because the cheaters will adopt the remainder. proxy aimbots and the like.

You seem to be ignoring - willfully or not - that the fundamental model of trusting MS is broken. Making that model more severe by forcing trust compounds the brokenness. It Has Been Shown that MS will be late with patches. It Has Been Shown that they are not proficient at security and will remain so until the market penalties are severe. What is the point of requiring official binaries when the binaries are going to be broken for weeks at a time? The net WILL be flooded with spam by those who RELIED on the official binaries. You have it so amazingly backward I wonder if you previewed the post.

MS blew it. They have added to their terrible reputation and I'm just not interested anymore.

There's also an outlook to your position I find frankly weird: that there is an official source of goodness. The "right" and correct version of the dll to run at this time is clearly the unofficial patch. The right version of a file to run in the future is going to be the one that reduces your chances of being 0wn3d, not the one with the pedigree. THis is "duh" territory.

Win98 is vulnerable, and probably older too

[r00t]

Microsoft says Windows 98 is vulnerable. They say nothing about older releases, which are unsupported now.

The WMF feature was part of Windows 3.0 back in 1990. What do you think?

Fortunately for such users, a 720 kB floppy or Netware network is probably required for infection. Modern exploits are going to rely on modern OS features too. Windows 3.0 isn't about to run a Windows XP rootkit that probably expects TCP/IP and the existance of an Administrator account.

This is probably the biggest vulnerability ever in terms of the sheer number of vulnerable machines.

Re:Win98 is vulnerable, and probably older too

[Reziac]

Yeah, I read All About It and did wonder why the test applet said "not vulnerable" for this box. Do you know if there's a benign proof-of-concept anywhere, that one could use for a more definitive test?

Tho this box has been completely impervious to every nasty that's ever come down the pipe -- nothing has ever managed to sneak in by any route. I do practice Progressive Paranoia about what gets used or not (firewall yes, IE no, etc.) -- Occurs to me to wonder if CorelDraw might have replaced the vulnerable function with an updated version that lacks the hole. Can't think of anything else on this box that might have touched WMF functions (CorelDraw seems to have something going on at a lower level than other graphic apps, as it's the only one I've seen that apparently talks directly to the video driver for some stuff).

Back when I had a WFWG box (which wasn't retired til 2001) I did occasionally see one thing or another make a foolish attempt to run, become terminally confused, and die without installing. No software firewalls back in its day, and apparently not needed either. Sometimes braindead has its advantages. :)

I do remember back in the DOS era there was much discussion of the theoretical possibility for hiding malware in the comment field of various graphic formats, but it was never seen in the wild -- likely because there was no consensus among users as to what apps handled graphics, thus no expectation of what might execute such malware. Now, of course, the average malware writer can count on Win32 of some species, and even the most halfassed coding has about a 50-50 chance of hitting a compatible system.

Re:What's wrong with...

[SillyNickName4me]

If you read back, I stated that I assume MS and ISC explicitly included the path. This made me doubt that it always defaults to the system32 directory. If there is a guarantee that it always defaults to that then there is no problem obviously, but that I don't know.

Internet Storm Center asks us to trust?

[RTFManuscript]

Trusted computing, Trustworthy computing, yada yada, back to the headline here, Unless you can recall the last three times the Internet Storm Center explicitly asked for your trust and then abused it?! you might want to grab this temporary patch and thank Ilfak Guilfanov for writing it and SANS for vetting and distributing quickly and efficiently. "We have very carefully scrutinized this patch. It does only what is advertised, it is reversible, and, in our opinion, it is both safe and effective." ...yeah, we've ALL heard that from the ISC alot, NOT.

Re:Internet Storm Center asks us to trust?

[LordSnooty]

Your post is so laden with apparent sarcasm that I don't know what point you're making. Should we trust the ISC or not? What are these three incidents you mention? Or are you just being silly?

So...what "proper" steps secured you from this?

[JimmytheGeek]

I'm calling bullshit. You can't have set up your windows systems securely and still be able to use them. It's one of those easy proofs. If the user can load a .wmf, the user's computer is not secure. If you haven't spent the holiday working on it, it's because you've made the decision not to care.

Re:So...what "proper" steps secured you from this?

[jacksonj04]

It took about 8 seconds to unregister the DLL from all systems on the network (Go active directory!) and limit applications ability to load it.

Re:So...what "proper" steps secured you from this?

[HiThere]

Welllll... my "proper" steps are not allowing my MSWind machine to access the internet. Internet access is only via Linux and Mac...with Linux being preferred. (Now I'll grant you that most people can't exercise this level of control, but don't say that someone can't have taken "proper" steps . Instead ask how they did it.)

Re:What's wrong with...

[r00t]

No, an ACL to block usage of that DLL.

Removing the DLL works poorly, because Windows will helpfully restore it for you.

Unregistering the DLL works poorly, because Lotus Notes and other programs will reregister it for you.

Setting an ACL on the DLL to mark it "everybody - no access" should work great.

you completely miss the point

[r00t]

You say "Because it looked good on your developer's resumes.", but there is no real evidence of having any developers. Just the opposite: if there were any developers, they'd be taking care of the computers. What, you think this is a dotcom?

This could be a struggling real estate business. The poster could be a realtor. If a real IT professional is hired, the place goes bankrupt.

Got it now?

Alternately, this could be: the vet's office, a small independent hotel, an eye doctor's office, a mom-and-pop restuarant, a car dealer, a large hair salon, a childcare center, a christmas tree farm...

Whatever it is, hiring somebody extra might break the budget.

Re:What's wrong with...

[forsetti]

Except SYSTEM may bypass Everyone-Deny ...

Address space layout randomization

[theelemur]

Yet another bandaid, but it will make automating exploits much much harder.

wehntrust is free for home use: http://wehntrust.com/ (be sure to read the faq under "support")

Also demonstrated at blackhat: Ozone HIPS: Unbreakable Windows

Here's the faq: http://www.securityarchitects.com/faqs.html

If you want to see to believe, grab some archived malware at http://www.offensivecomputing.net/ (free login to use the archives), make some windows VMs and take snapshots/archive them, attack them with the threat du jour with and without a hips installed. Note results.

Enjoy.

Re:What's wrong with...

[r00t]

The question then becomes: will Windows auto-restore notice the permissions?

(or do you suggest people are logging in as a SYSTEM account?)

Re:What's wrong with...

[dkf]

By default you can't even see the DLLs.

A little examination of WinXP SP2 indicates that that's not the case; MS have at least reversed that daft decision. (Otherwise I'd agree with the gist of what you are saying.)

Re:What's wrong with...

[forsetti]

Actually, I'm concerned that services (like MS Fax, an AV product, a filesystem indexer) running as SYSTEM may reregister the DLL, and then either the same service or another use it. Once the DLL is registered and loaded, I don't think the Filesystem ACL will do any good. Too bad there are no "in-memory" execution ACLs!

Out of curiousity, as I can't tell from the Linux box I type this at: does Everyone-Deny block "Administrator" ?

Re:Wine vulnerable?

[Jonnty]

Lucky, then, you can 'format' the 'C drive' in under a second.

Re:What's wrong with...

[r00t]

Sure, Everyone-Deny blocks the Administrator.

In in-memory ACL shouldn't be needed. The filesystem one should be checked whenever an app, uh, connects to the DLL. If this were not true then users could view each other's DLLs.

interesting video on Trustworthy Computing

[ghee22]

http://www.lafkon.net/tc/trusted-computing.torrent

So... How long before...

[Medieval_Thinker]

Someone releases a wmf exploit which is designed to install the hexblog wmf fix? It seems logical enough.

Can't change IE security level

[Keith McClary]

turn off downloads in IE if you must use it (set default security settings to HIGH)

I tried this using the straightforward, widely recommended procedure, but when I try it again it is still on MEDIUM, even after reboot. This is a year-old XP laptop.

I've done a bit of searching but can't find any mention of this problem.

I suppose I should just tell my wife not to use her machine until further notice.

Re:Can't change IE security level

[Heembo]

Is the machine fully patch up with all software and security updates? Try the Fedora patch? :)

Re:Can't change IE security level

[Heembo]

Try this on your wifes machine: Disable image-loading in IE. http://support.microsoft.com/kb/153790

Re:Can't change IE security level

[Keith McClary]

Thanks, it seems I did have it set to high, but there is no indication what your current level is, just the option to reset to the default medium, which I misunderstood.

She couldn't log in to her favourite site so I had to set it back to medium.

I suppose I could become a W guru and figure out how to fine tune all those settings.

Or slip a Knoppix CD in her drive.

Re:Can't change IE security level

[Heembo]

Knoppix or the Fedora patch is most preferred. But it sounds to be that your wife has MAC USER written all over!

microsoft software depends on FREE software

[kipple]

Last night I spent four hours trying to clean a friends' computer who had opened an e-mail carelessly. One hour was for bitching him and making him feel very sorry.
The last three hours were spent trying to fix the problem, using free antivirus scanners, online free antivirus checks, free spyware removal, patches and fixes given away for free on the internet.
See a pattern here? No commercial antivirus was able to detect the problem. I had to install (and then remove, anyway) software that was built and given away for free to fix it.

Windows XP was "genuine", but this won't help solve the problem. I'm still asking myself why pay for an operating system with such problems, but more than that why should we give money to a corporation that is bashing GNU/Linux and free software as a cancer and still depends on it to fix its own troubles.

Oh, yes, I suggested him a Mac. At least he will pay for something more usable. Otherwise, he'd have to pay me to install and set up a linux box. Unfortunately, there's no free lunch any more :)

Re:Wine vulnerable?

[Jonnty]

Hmm. But how much of the time are you actually using IE? I think if you happened to see a site saying 'viwed best with IE,' and was not trusted, with the current situation, would not do so. Or at least do it in a seperate user account.

Re:What's wrong with...

[forsetti]

I'm more worried about a service reregistering the DLL on startup, then other services or user-space apps using the (now vulnerable) service.

I remember using the 'Net on a Z80

[crovira]

which was hooked up to a 300 baud BellNorthern modem (that puppy CO$T big time but the university could afford it.)

It wasn't being used as much more than a glass teletype and emails were the only distribution method (this was way before the web) but it was still possible to trash someone's computer with a virus.

Microsoft definitely does not get a pass on this.

The problems and the solutions existed before Microsoft ever ripped off Dartmouth for their BASIC interpreter.

Microsoft has always been just bad. Bad for everything. Bad for every body.

Wake up!

Bill Gates took $100,000,000,000 out of YOUR pockets with illegal, anti-trust double dealing. Flat out theft of YOUR money.

And you're wondering why you're stuck with crap? God! How naive.

Re:I remember using the 'Net on a Z80

[Malor]

It's worth pointing out that Microsoft's only major competitor on the desktop, Apple, offered an OS that was equally insecure. It, too, had no concept of security whatsoever.

If Microsoft HAD insisted on good security, they'd have had their lunches eaten by Apple, because it would have slowed down their operating system so much. When the word got out that the Mac ran eight times as fast as the PC, everyone would have switched, and Microsoft would have died. There would have been about fifty smug Microsoft users, luxuriating in their security, while the insecure but very fast Apple OS ate the entire market. Eventually, when the problems started to crop up, people would have longed for the nice secure Microsoft OS, but in vain, becaues they would have been driven out of business years prior.

Again, it's like blaming Henry Ford for not foreseeing smog, and failing to put a catalytic converter on the Model T.... even though that would have made his cars too expensive and limited his success in the market. 386s and 486s simply don't have time to run much OS code... it has to be simple and fast, to let the user have as much of the slow CPU as possible. If they'd tried to design for multiuser, the overhead would have cost too much.

Remember that my comments are strictly about pre-1995 code. By 1995, machines were fast enough to run security code without slowing the system down that badly. Microsoft continued to choose features over security, every single time. That sucked. A lot.

Blasting them (and possibly suing them) for their choices post-95 is perfectly reasonable. But blaming them for not writing for multiuser in 1991 is just stupid.

Exhibit A: Desqview/X, which tried to do some of the things you're claiming Microsoft should have done. Desqview/X bombed.

ActiveX was a incredibly BAD idea.

[crovira]

Basically, it exposed the entire system (because it had no idea of root and user accounts) to any two part malware.

One part delivered the .exe from somewhere somehow (any method could do since the 'payload' would be made to lie dormant) and the other part could be something which could pass underected through the filters since it was purposefully flawed but not malformed.

Making ActiveX components from VB ensured that the payload would run correctly when activated. It might be self destructive or it might be spyware. Either way, you're screwed.

Microsoft Security Advisory (912840)

[DASCOM2000]

On Tuesday, December 27, 2005, Microsoft became aware of public reports of malicious attacks on some customers involving a previously unknown security vulnerability in the Windows Meta File (WMF) code area in the Windows platform. http://www.microsoft.com/technet/security/advisory /912840.mspx
all Microsoft's security updates must pass a series of quality tests, including testing by third parties, to assure customers that they can be deployed effectively in all languages and for all versions of the Windows platform with minimum down time
Microsoft encourages users to exercise caution when they open e-mail and links in e-mail from untrusted sources.
An attacker who successfully exploited this vulnerability could only gain the same user rights as the local user
Advisory Status: Issue Confirmed, Security Update Planned

That is incorrect. autorun.inf

[danielsfca2]

There is no version of MS anything that will read the disk upon insertion. You have to click the drive in moderm windows versions, or poll the drive with 'dir' or some other function in older versions. Mac on the other hand reads the disk immediately (usually to check for the file system type) which does represent a bigger hole with floppies than with windows based machines.

You are completely mistaken, unless you are defining "disk" as "only floppy disks, specifically excluding CD, DVD, removable USB media, Zip drives, LS-120, etc." Why you would do that baffles me, since floppy disks are as dead as Betamax these days.

Mac OS 9 and X DO mount all drives when they are connected or when a removable disk is inserted. MOUNT.
Mac OS 9 and X DO NOT execute anything from any disk upon insertion, EVER. They mount the disk.

Windows 95 and up have a "feature," on by default unless you edit the registry or use TweakUI or a similar utility, or hunt through various obscure Windows dialogs, which upon connecting of hard drives, or insertion of removable discs besides floppies:

A: Mount the filesystem.
B: Check for the existence of autorun.inf in the drive root;
C: Assign any icon given in autorun.inf to the drive in Explorer;
D: Execute any programs, from the disc or elsewhere, requested by autorun.inf.

Google for "autorun.inf" if you want more details on how to use this.
This is probably what the behavior the grandparent was referring to.

Floppies are probably only excluded from autorun.inf because the cheap bargain-basement 3.5" floppy drives in all Windows PCs since the beginning of time are incapable of notifying the OS when a disk has been inserted. The OS would have to poll constantly to automatically mount the disk. These drives also do not have a motor to eject the disc when the OS is finished with it. Contrast this with the floppy drives in every floppy-bearing Mac since the beginning--they had both software eject AND OS notification of disk insertion.

A less likely explanation for why MS didn't enable this behavior for floppies might have (surprisingly) been security--in 1995, a CD was something you bought from a large company, which wouldn't let a virus get onto it, while a floppy was what you constantly used to transport all your data. A smart virus, any fool can see, would have exploited the autorun.inf to infect any floppies you used, and the first time the drive was accessed they would execute. Obviously now things are different, but it is still much harder for a virus to infect Write-once media, especially since most burned CDs are burned by a user's choice of burning software. USB keys, however, would be a good attack vector, especially for a deliberate malware-spreader. I use autorun.inf on my USB key to apply a custom icon (a photo of my USB key). Makes for easy recognition in "My Computer" when on someone else's machine with 5 other drives on it.