Trustworthy Computing

Some won't by SavoWood · 2006-01-02 02:43 · Score: 5, Insightful

As it says in the article, some people in the corporate world won't do it if the patch didn't come from MS. It's sad, really. If I had an exploitable machine around, I would trust their patch.

--
Plant a tree in a developing country.

Re:Some won't by NoMercy · 2006-01-02 03:25 · Score: 3, Informative

They recomend both deregistering and applying the 3rd party patch, if some 3rd party application loads the DLL directly, unregistering it won't help.

I'm a trusting person, and if ISC, and Fsecure's lab both recomend it, I don't mind applying it, I'd trust there code more than MS's :)
Re:Some won't by SillyNickName4me · 2006-01-02 03:33 · Score: 3, Informative

If you'd have followed your own suggestion, you'd know that for as far as the current IM worm goes, the workaround works perfectly fine.

What is more, re-registering the dll by some bit of software is a possibility, but for this to happen without action from the user, there needs to be another vulnerability that allows running the code to do this (or another way to access this specific vulnerability). If there is another vulnerability then the hotfix won't make you safe, The hotfix does work and provide some extra protection but only for the cases where this specific vulnerability can be exploited through a different path (that does not use shimgvw.dll).
Re:Some won't by Professor_UNIX · 2006-01-02 05:30 · Score: 2, Insightful

As it says in the article, some people in the corporate world won't do it if the patch didn't come from MS. It's sad, really. If I had an exploitable machine around, I would trust their patch.
But you're probably coming at it from a different mindset. If you're used to open source software you probably regularly trust patches from people who you otherwise wouldn't know simply because they released the patch as open source. You probably figure SOMEONE out there must know how to read the thing to determine if it's malicious and would throw up a red flag if they found something.
With Windows users they're not used to that level of trust, even when it involves a patch that includes source code. How many Windows desktops do you know of that have Visual Studio on them to compile this patch from scratch to verify the binary version isn't malicious? Coming from a UNIX world, not having a compiler on your system just seems weird, but Windows users are trained to trust in their binary patches and cross their fingers.
Re:Some won't by kimvette · 2006-01-02 06:52 · Score: 2, Informative

If all you need to do is compile a project the Visual Studio express edition ought to be good enough. It's free but doesn't come with all of the extras that Visual Studio Architect comes with.

It can be downloaded from http://msdn.microsoft.com/vstudio/express/default. aspx

--
The Christian Right is Neither (Christian nor right). See: Matthew 23, Matthew 25, Ezekiel 16:48-50
Re:Some won't by HermanAB · 2006-01-02 08:24 · Score: 2, Informative

The old job preservation argument - Need to be able to blame Microsoft.

As for me, I test all patches - the ones from MS too - before deployment. I don't blame Microsoft, I take responsibility for what I do.

--
Oh well, what the hell...

Over/Under by chrisgeleven · 2006-01-02 02:45 · Score: 3, Insightful

What is the over/under for Microsoft getting a patch out for this?

If there is a time to deviate from their monthly patch cycle, this is it. The patch should have been out days ago, yet we are still waiting.

And Microsoft wonders why no one takes their security promises seriously.

Re:Over/Under by Malor · 2006-01-02 03:41 · Score: 5, Interesting

It's probably a hard problem to patch. From what I've gathered, this is a feature of WMFs, not a bug. They were designed before people even knew what the Internet was. WMFs, apparently, have the ability to specify code to be run on a failure to render. So the bad guys give you a bad WMF file, cleverly renamed as JPG, and stick it in an ad banner. You browse a site (with any browser), Windows fails to render the WMF (which it will recognize even if the filename says JPG), runs the specified failure code, and you're hacked. That fast.

Changing code that's this deeply buried in Windows is risky. The interpreter for WMF is one of the remnants of code left over from single-user computers, and they'll have to test changes very thoroughly. They're GOING to break things with this patch, because they're removing a designed-in feature. They're probably working feverishly to figure out how to minimize the damage, but some damage is inevitable. And the problem could be far worse than it appears; that DLL could be riddled with problems. It may not have been audited in many years.

This is yet another example of how you can't retrofit security; the first Windows versions were designed when security wasn't even an issue, when the Internet was barely a twinkle in Al Gore's eye. There's a mountain of code that was written just to work, not to worry about being handed malicious data. If a user passed bad values to a system call and it crashed, oh well. It was their fault for doing it. It's not like they had anything to gain from it, after all. They owned the computer. Why on earth would the computer need to protect itself from its owner?

With the advent of the Net, Microsoft decided to both stay backward-compatible and extend what they had onto the Internet. And their focus for many years was on new features, not security. Essentially every security person at the time warned them -- stridently -- against the choices they were making. It was obviously going to be a trainwreck. This is just the latest in that ongoing collision between a single-user operating system and exposure to every computer in the world.

This particular exploit is BY FAR the worst one yet...even very competent administrators, doing everything exactly as they should, can get nailed by this one. As bad as this is, though, it's not like they're going to stop here.

Trying to retrofit security onto the Win3.1/Win95 model is like trying to use scotch tape to make cheesecloth waterproof. No matter how much tape you use, even if it's a lot more tape than cloth, it will ALWAYS leak. It might hold water for a bit, but leaks will constantly spring up. They've added tremendous functionality in the NT/2k/XP kernels which can limit what users can do and limit the possible scope of compromises, but many many programs (especially games) require administrator privs just to run. So most people run as Administrator even though they shouldn't. And that makes hacks like this one very easy and *extremely* damaging.

Hopefully Microsoft will get a patch out fast.... they certainly must understand how overwhelmingly bad this problem is. The fact that they're reacting slowly is likely an indication that it's hard to fix.
Re:Over/Under by Dachannien · 2006-01-02 04:03 · Score: 2, Informative

This shouldn't be difficult to fix. They just have to change the code for gdi32.dll not to register the callback function (or not to call it, perhaps). If it breaks some WMF files, then the WMF files were technically broken anyway, since the callback only gets called when the renderer has to abort for some reason (like detecting an error in the file).

This could have been a 0-day fix, quite honestly.
Re:Over/Under by mce · 2006-01-02 04:03 · Score: 4, Interesting

One wonders how long MicroSoft themselves have known about this one. Despite them being "The Incompetent Company", they do have a lot of very competent software people working for them. I'd be willing to bet some money that some of those have identified this particular flaw some time ago already but that, after looking at the consequences of fixing it properly, the company decided to hope that nobody would notice until they finally get around to publicly breaking backward compatibility.
With stuff like this in their closet, one surely can understand at least to some extent why they advocate closed source. The feature in question is likely well documented, and thus reasonably "open", but the idea of what might happen if crackers get access to all the non-safe zombie code that dates from their pre-history truly must horrify them.

--
Linux user since early January 1992.
Re:Over/Under by mwvdlee · 2006-01-02 04:11 · Score: 2, Insightful

In theory they could have the render-failure code run in a sandbox environment.

--
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
Re:Over/Under by arminw · 2006-01-02 04:59 · Score: 2, Interesting

.......but many many programs (especially games) require administrator privs just to run......

That in a nutshell is the biggest problem with Windows. It is still suffering from its roots as a single user computer system in the world before networking. *NIX systems, such as Linux and OSX are more secure mostly because of they do not require administrator status to run application programs. MS will have to FORCE developers to change this by making two users on every system -- one the admin and another the user, one or more ordinary users with limited privileges. Programs that ask for higher privs, would just die with a nasty message from the OS.

The other change would be to get rid of the registry which is used to ensure that malware runs when the system is booted, among other functions. If in VISTA, ordinary programs, games or anything other than system utilities and installers STILL require the user to be an admin, there certianly is no reason to upgrade in the hopes of finally getting a system at least as secure from malware as OSX. In combination with this MS should then spend some serious money to educate their customers not to EVER give their admin password unless they KNOW they are installing some new software. An internet greeting card, picture or e-mail should not EVER allow the introduction of new, executeable code onto a computer without the explicit permission of the educated user.

--
All theory is gray
Re:Over/Under by 0WaitState · 2006-01-02 06:19 · Score: 2, Informative

Malor said:

This is yet another example of how you can't retrofit security; the first Windows versions were designed when security wasn't even an issue, when the Internet was barely a twinkle in Al Gore's eye.

Uh, no. The internet was already alive and well and quite mainstream in academe in the early 80s, when Microsoft still thrashing around with early versions of MS-DOS, and networked PCs were well-known by the late 80s. Even before that almost every PC came with a modem.

So, no, sorry, Microsoft does not get a pass for allegedly having developed windows in some misty time of yore when "security wasn't even an issue". Security was an issue on MS-DOS, for modem-using consumers, academic networks of shared PCs, and especially for corporate deployments.

--

Remain calm! All is well!
Re:Over/Under by Malor · 2006-01-02 07:18 · Score: 2, Insightful

Dude, how old are you? I was *there* at the time. Nobody thought about security in networks back then. Hardly anyone thought about security, period. Regular Windows barely even DID networking... they added that later in Windows for Workgroups. (heh, and it still barely did networking :)) Networks were weird and unusual. They were isolated, not tied together, and everyone just assumed you could trust anyone you could run a LAN cable to.

Modems existed, sure, but a FAST modem at the time was 19200 baud. People didn't use that to network. Before the Internet arrived, people used modems to call BBSes. When the Internet arrived in my town, it didn't offer SLIP or PPP... you dialed in and ran programs at the Unix shell prompt. There WAS NO LONG DISTANCE NETWORKING, except on the part of a few eggheads in academia. The concept of a worldwide network was something out of science fiction. In 1990, people would have given the ideas of a global network just ten years later and an invasion from Mars about equal credence.... ie, nearly none.

I assume you're too young to remember, but Microsoft had a huge revelation awhile after Netscape had that first monster IPO. "Wow! This internet thing.... it matters!" And THEN they started revamping all their single-user stuff to go on the Net.

In hindsight, it's very easy to see that they should have started really thinking about this in 1993 or 94, when the Net was first really making headway.... people liked it. A lot. Not figuring it out until 95 was pretty darn boneheaded on their part. And then in their rush to get on the Net and take it over, they made a lot of really, really stupid mistakes. And we're still paying for them.

But fer chrissake, the design of WMF... Microsoft is supposed to magically realize that the long-distance network between about five thousand academics is going to *take over the entire world*? When they were designing WMF, they had probably never even *heard of* ARPANET.

So yes, they DO get a pass on this. Their really serious errors were in trying to push '95 and '98 onto the Net, and writing all that functionality into Office that didn't need to be there. They didn't feel they had time to do it right, so they did it quick to grab the market. From 95 on.... the blame is entirely theirs. It was obvious what would happen.

But in 1991? You're high if you think security was much of an issue back then. DOS had *NO* security. None whatsoever. Neither did 3.1, 95 or 98. (well, 95 and 98 had a tiny bit of security, but it was a thin veneer). And everyone got along just fine, at the time. The only time security was needed was when you were in a corporate environment. Nobody talked from one computer to another, it was all from the workstations to the servers.

The only people that needed security at the time, in other words, were big businesses, and they ran Netware. Other than that, if you wanted to secure your data, you locked your computer up.

Extrapolating from that mindset to 'talking to every computer in the world', in advance, would be nearly impossible. Even having BEEN there, it's hard to wrap my head around how different things were back then.
Re:Over/Under by angulion · 2006-01-02 08:39 · Score: 3, Insightful

There's a mountain of code that was written just to work, not to worry about being handed malicious data. If a user passed bad values to a system call and it crashed, oh well. It was their fault for doing it. It's not like they had anything to gain from it, after all. They owned the computer. Why on earth would the computer need to protect itself from its owner?

It is new, it is called DRM.
Re:Over/Under by 0WaitState · 2006-01-02 08:46 · Score: 4, Informative

Dude, I think I'm older than you--I remember when my job first gave me a 2400 baud modem, and at the time thinking ruefully of all the time I had wasted with 300 baud modems. I still have a Codex 2264 modem (It's the size of a shoebox, has a three prong plug and a fan, and seems to be immortal).
As to your contention that microsoft gets a pass because nobody thought of security back "then", I'll take "then" to be the 10 years immediately prior to the release of Windows 3.0. Multi-user PCs were a well-known concept to every student who's done work in the general-population 'computer lab'. Remember Banyan, Appletalk, Netware (you mentioned it)? They may not have been Microsoft products, but they were ubiquitous. Unix workstations (Apollo, Sun, Microvax, etc.) were in very common use among engineers and product designers, and they all were networked. (of course, most unixes and VMS versions were very hackable, but that was part of the fun)
What's more, there were thousands of anti-mal-ware software products for MS-DOS, some samples here. The virus vector was BBS downloads and floppy disks rather than open port attacks or browser overruns, but the concept of attacking PCs was already well known. So, no, Microsoft does not "get a pass" for a security problem that nobody could have predicted (sarcasm). They made conscious choices to de-emphasize and ignore security in order to maintain market share at all costs. The economics proved them correct, so far, but they still should carry the blame for those choices.

--

Remain calm! All is well!
Re:Over/Under by eakthecat · 2006-01-02 09:01 · Score: 2, Informative

No.

It was designed to be easily uninstall-able (listed in Add/Remove Programs, not leave cruft behind, etc). Furthermore, the authors of the patch recommend that you uninstall their patch before installing the official fix (assuming Microsoft ever gets it out the door).

--
Solitary, Poor, Nasty, Brutish and Not Quite As Tall As I'd Like To Be.
Re:Over/Under by mce · 2006-01-02 14:40 · Score: 2, Insightful

That of someone with a 3-digit /. UID obviously... :-)
More to the point: I was there too (I got on the net - the real one, that is, not just BBs-es - in 1988). IMHO, both grandparent posters were right.
The net was very real back then, and multi-user machines were in common use in engineering (I used graphical DomainOS Apollo workstations for my master's thesis, while we mostly still had an experimental and barely usable X11R2 floating about on some of the non-Apollo workstations). But security was indeed very lax in those days. We pulled some amazing pranks on each other back then and didn't really see the true potential impact of what we could do. It was just "having fun amongst the good guys at each other's expense". The bad guys were the ones that wrote viruses for MS-DOS. But since everyone knew that MS-DOS was a toy for kids, it really didn't matter. Once the kid's clever enough to write viruses would grow up a bit and go to college, they'd surely repent. And since they were that clever around computers, they'd be eagerly welcomed "on the job" as soon as they had a CS degree of their own.
Hell, the only security X had was xhost. Get past that, something horribly trivial (especially if open remote access to X is the default as it used to be), and you can do anything you want with people's machines and easily captured passwords. We didn't even need buffer overflows or callback-based image formats to get anything nasty done back then... :-)
My first real understanding of what was about to happen came "only" in 1991 when I spent a year in the Belgian Navy (conscripted) and when one day I had to pull the plug on the network of an entire Navy school due to some stupid but harmless virus that was spreading through the network. Up to that point' I'd never seen standard PC's and any sort of network in ome combination. So that day I really did "see some of the light".
But even so I didn't really get it yet. Back then I thought I'd done a very good job: stopped the spread, got the network cleaned, and defined some rules about not bringing "aboard" untrusted floppies that weren't needed for the job. Now I know what a fool I was: I'd been on the real Internet for several years; I'd just seen "live" what a network could do when combined with MicroSoft toyware; but since that particular school was not on the Internet (after all, they were not using UNIX :-), I imagined that things would be and remain under control if only people would implement a few rules about bringing in floppy disks form home. Real computer users didn't use PCs anyway... Silly me!

--
Linux user since early January 1992.
Re:Over/Under by cpu_fusion · 2006-01-02 15:12 · Score: 2, Insightful

I completely agree. Anyone with a basic understanding of computer security would be able to see this was a wide open gaping hole. And according to the news sites I've seen, it's been in Windows for 15 years.

ANY DECENT AUDIT of such an "important" piece of code should have seen this with big flashing red signs. Registering a callback in a DATA DOCUMENT is patently stupid.

I agree with you that the real question is: who has known about this and for how long?

Because of how easy it is to get someone to view one of these files, how silent and universally easy the callback is (doesn't even need a stack or heap overflow!!!), how easily it can evade intrusion detection signatures, how rediculously easy it would be for an expoloiter to erase their tracks after breaking in -- it is downright scandalous.

Microsoft, organized crime, the NSA, North Korea, the zit-faced kid across the street could have used this bug to: spy on competitors, spy on the government, spy on YOU. And you'd never know. And only now after 15 years is it getting fixed, because HACKERS revealed it.

This should be the pearl harbor for data security. This should be on every tech blog. There should be congressional hearings. People should be talking under oath about this.
Re:Over/Under by 0WaitState · 2006-01-02 18:22 · Score: 2, Insightful

Ah, the fun with "melt"--I think every first-time Apollo user got hit with that one.

Just to make my points more briefly, by MS-Dos 3.0 it was well known that one needed a virus scanner/disk cleaner. And the internet worm of 1988 was devastating. I still assert that by the end of the 80s O/S vendors had no excuse for ignoring security concerns. Unixes slowly got better (took Sun until about 1995 to clean up the easy SunOS hacks), but the Microsoft platforms didn't. VMS could be locked down, though often wasn't.

--

Remain calm! All is well!

Shame by Jonnty · 2006-01-02 02:45 · Score: 5, Funny

It'd be nice to have a computer that I can use the patch on.. Maybe I can Wine it?

--
Any grammatical or spelling errors above are for comic effect, and do not signify imperfection in the writer.

Re:Shame by Grey+Ninja · 2006-01-02 03:21 · Score: 2, Funny

Yeah, when I heard about that WMF security vulnerability, I was up half the night trying to get it working in Wine, so that I could have the genuine Windows experience. But to no avail. It just didn't work. Maybe this patch will fix that?
Re:Shame by julesh · 2006-01-02 03:36 · Score: 2, Interesting

It'd be nice to have a computer that I can use the patch on.. Maybe I can Wine it?

That's an interesting question -- is wine vulnerable to this flaw? As I understand it, it is essentially a design fault in the way WMF files work (i.e., the entire process of using a WMF file was never designed to be secure in the first place, so it is able to do stuff like set up callbacks into the application's address space).

Sometimes I think they do it on purpose by User+956 · 2006-01-02 02:45 · Score: 5, Insightful

Sometimes, I really start to think that security is so poor in commercial operating systems, because they want to use protection from all these exploits as the bait to get us into the "trusted computing" cage.

Trusted computing is a farce, because the one thing that *isn't* trusted, is the user.

--
The theory of relativity doesn't work right in Arkansas.

Re:What's wrong with... by chrisgeleven · 2006-01-02 02:47 · Score: 2, Informative

Yeah because 98% of PC users know how to disable the offending DLL. Heck, 98% of PC users don't even know what a DLL is.

SPI Aren't meant for this type of filtering... by PPGMD · 2006-01-02 02:48 · Score: 2, Interesting

SPI firewalls aren't meant for application filtering, on my company servers I just blocked WMF files at the Exchange server, and set our ISA Servers to block WMF from websites also. Company policy already blocks the various IM clients.

I imagine that I could push out the deregistering fix, and associating WMF with Notepad, but that seems a little extreme because our attack vector has become limited, and our anti-virus is now updated with the newest signatures that detect this exploit.

Re:SPI Aren't meant for this type of filtering... by grenthal · 2006-01-02 02:57 · Score: 5, Informative

FTFA

* Should I just block all .WMF images?

This may help, but it is not sufficient. WMF files are recognized by a special header and the extension is not needed. The files could arrive using any extension, or embeded in Word or other documents.

It goes without saying by ZerocarboN · 2006-01-02 02:49 · Score: 5, Interesting

FTA:
You cannot wait for the official MS patch, you cannot block this one at the border, and you cannot leave your systems unprotected.

This has always been the case with Windows, if I'm not mistaken.

Shows how much MS cares for its customers. by Anonymous Coward · 2006-01-02 02:49 · Score: 5, Insightful

How many late nights, allnighters, and missed holidays have you experienced, thanks to things like ILOVEYOU and Slammer? How many times have you had to clean up the mess created by Microsoft's shitty, unsecure software?

Clearly Microsoft wasn't interested in calling people in over the holidays to whip up a patch for this critical vulnerability-- something that you could go in a couple hours early tomorrow and roll out to the PCs in your organization. They're going to let you suffer. And why should they care? They've already got the money of the company you work for. People are going to return from their holiday vacations tomorrow, load the wrong web page in IE, and get pwned. And you'll be left to clean up the mess. Again. Better pack an extra sandwich with your lunch tomorrow, because you probably won't be getting out at 5.

Re:Shows how much MS cares for its customers. by A+beautiful+mind · 2006-01-02 03:04 · Score: 2, Funny

Yeah, but not everyone can be you, Linus...

--
It takes a man to suffer ignorance and smile
Be yourself no matter what they say

Programmers? by Claire-plus-plus · 2006-01-02 02:51 · Score: 4, Insightful

Windows have produced a datatype that allows people to place executable code into image files? How can they call themselves programmers. Seriously whoever engineered the WMF format should be ashamed.

--
99 bottles of beer in 175 characte

Re:Programmers? by iBod · 2006-01-02 03:26 · Score: 2, Interesting

Agree with you there C++, but this kind of sloppy design/coding would not be possible with a an architecture that implemented memory protection at the hardware level.

IBM mainframes were able to designate the usage of 'pages' or 'frames' of memory by using 4-bit 'storage keys' in the mid 1960s!

You requested the storage in a specific key (in your own address space) and any program accessing that storage with a different key. The ability to change storage key was strictly controlled by OS privilleges and any program violating that rule would immediately die with a 'storage protection' exception.

The guys at Intel in the late 1970s didn't consider things like that - if they ever knew about them - as they were mostly IC designers, not proper computer architects.

I think the Motorola 68000 series was following in the footsteps of the IBM S/3x0 mainframe CPU architecture but never quite got there.
Re:Programmers? by julesh · 2006-01-02 03:43 · Score: 4, Interesting

If this *were* a stack overflow, you'd have a good point.

However, the WMF format allows you to embed a code in it that basically says "when you've finished drawing this, call the function at this address to execute it". The reason that this exists is that WMF was not originally intended to be a file format. It was intended to allow Windows applications to record the steps necessary to draw an object, so they could do it again later (presumably using less processing at that point because everything's precalculated).
Re:Programmers? by Lagged2Death · 2006-01-02 04:18 · Score: 3, Informative

There is not an 'EXEC' segement type in the metadata specification itself, if you will.

In the internet age, it's hard to believe, but in fact, yes, there is. This isn't a buffer overflow exploit; this is actually the way metafiles were intended to work. AC makes the same point a bit more rudely.
Re:Programmers? by iBod · 2006-01-02 04:44 · Score: 4, Insightful

Obviously you know nothing about CPU architecture. Like the designers of the x86 series, you think you have to invent the wheel from scratch, when so many better wheel-designers have already done the job for you.

An 'arbitrary jump' is fine inside your own address-space, so long as you jump to storage you own, AND you have requested, AND have the 'key' to, AND is marked 'executable' in your current key/ring.

Jeeze! The mainframe guys had this figured out decades ago.

Don't trust the coder first - trust the computer architect first!
Re:Programmers? by clem.dickey · 2006-01-02 06:57 · Score: 2, Insightful

But IIRC, IBM's S/360 key-controlled storage did not distinguish "read" from "execute." The storage keys were originally used to separate users in a single address space, since S/360 had only one address space.

I don't think you could guard against execution (separately from read, on a S/360 successor) until IBM introduced data spaces. Execution is limited to data space 0, and if you don't let a program write to that space you are OK. But even now, though the architecture *can* separate read/write space from execution space, do mainframe OSes take advantage of that?

I deployed it by rylin · 2006-01-02 02:52 · Score: 4, Informative

Today was supposed to be my fifth vacation day this christmas.
I've had two; and decided to come in to the office today to make sure we were patched up against the exploit.

Yes, I took the plunge.
The patch is now deployed in our small office (30 windows PCs atm); and so far so good.
Would I have felt safer if the sourcecode was released? Perhaps.

That said, I'd rather take the ISC's word on the fix than have a guaranteed hell within a couple of days.
The dedication of the people involved with ISC, as well as that of Mr. Guilfanov brightened my start of the new year.

Kudos, people.

Re:I deployed it by tsvk · 2006-01-02 03:11 · Score: 4, Informative

Would I have felt safer if the sourcecode was released? Perhaps.

But the source code is released, too . The installation package should have copied it into the "WindowsMetafileFix" folder under the "Program Files" folder.

Haha! by Trip+Ericson · 2006-01-02 02:54 · Score: 3, Funny

Saturday's word was "transferbangle." Today's word is "volunerability." I wonder what tomorrow's word will be!

Is it just me by goombah99 · 2006-01-02 02:55 · Score: 2, Insightful

or Is the original healline post for this thread written in gibberish enhanced by misappropriation of terms and conflation of concepts? How is trusting the unofficial patch conceptually related to "trustworthy computing" and why should packet spanning make it invulenrable to filtering?

--
Some drink at the fountain of knowledge. Others just gargle.

Re:Is it just me by BushCheney08 · 2006-01-02 03:04 · Score: 3, Insightful

It's a thing called sarcasm. MS are the ones pushing "trustworthy computing" but are showing that at a time like this, they can't be trusted to do the right thing.

--
Be a real patriot: Question authority. Think for yourself. Formulate your own conclusions.
Re:Is it just me by abirdman · 2006-01-02 03:13 · Score: 3, Interesting

You are absolutely correct, sir. This aricle has absolutely nothing to do with "trustworthy computing," (aside from the use of the word "trust"). It is perhaps interesting that the headline was enough to persuade me to read the summary, and click the link to the story. Maybe, in some strange way, they're demonstrating how the exploit works.

--
Everything I've ever learned the hard way was based on a statistically invalid sample.
Re:Is it just me by Tim+C · 2006-01-02 07:04 · Score: 2, Insightful

And what's the right thing? Rushing out an untested patch as fast as possible that either doesn't fix things or even makes them worse? Or is it taking your time to make sure that you get it right and don't end up making an even bigger mess of things?

--
It's official. Most of you are morons.
Re:Is it just me by darkonc · 2006-01-02 09:33 · Score: 2, Insightful

The point about "trustworthy computing" is that you are giving over control of your computer to some other semi-random person who can then force your computer to do, or not do, whatever they want it to.
It all comes down to the question: Who do you trust? A company like Microsoft that has made billions of dollars with sometimes shady and even outright illegal business practices, or a bunch of diehard security enthusiasts who just hate to see their (and other people's) computers hacked?
No matter how you answer the question, it's likely to be an obvious answer.
For you.

--
Sometimes boldness is in fashion. Sometimes only the brave will be bold.

Re:What's wrong with... by forsetti · 2006-01-02 02:56 · Score: 3, Informative

Reading the article, the ISC (and a few others) say that you *should* disable the DLL. There are two ways, with caveats, listed:
*Unregister the DLL : some apps may actually reregister the DLL.
*Rename/Delete: make sure XP File Protection is off, otherwise it will be replaced. Also, some apps may behave badly.

So, disabling the DLL is a *good* idea -- but may not be a complete solution by itself.

--
10b||~10b -- aah, what a question!

Shame on Hemos by slavemowgli · 2006-01-02 02:57 · Score: 5, Insightful

No flamebait intended, but that's a typical sensationalist misleading Slashdot headline. Noone's advocating "trusted computing" or similar initiatives here; all they do is saying "here's an unofficial fix, and we'd like to recommend even though it *is* unofficial, considering the seriousness of the vulnerability and also considering it was written by a reputable windows expert, namely Ilfak Guilfanov (author of IDA Pro)".

And for that matter, there's no mention of "the Snort rules will hog your router's CPU", either - that's total rubbish, probably made up by the article submitter. And it slipped, too, since the Slashdot "editors" never care to actually edit stories before they publish them.

Shame on you, Hemos!

--
quidquid latine dictum sit altum videtur.

Re:Shame on Hemos by Saint+Aardvark · 2006-01-02 03:27 · Score: 5, Informative

There should've been a link to this:
There is one important note in regards to ALL published signatures including this one. All these signatures will fail to detect the exploits when the http_inspect preprocessor is enabled with default settings. By default, the flow_depth of the preprocessor is 300 which is too short to cover the whole exploit. Should the exploit be transmitted on port 80 and http_inspect is enabled, no alert will occur. Note that it will still alert on any ports (using the all port sig below) that are not configured in http_inspect (ie FTP).
One solution is to add the statement "flow_depth 0" to the http_inspect preprocessor (actually the appropriate http_inspect_server line in the config). This will tell the preprocessor not to truncate the reassembled pseudo-packet, but it will have an adverse impact on performance. On busy networks, this will lead to 100% CPU utilization of the Snort process and major packet drops.
And you should've checked before saying it was all made up.

--
Carousel is a lie!

Re:What's wrong with... by Claire-plus-plus · 2006-01-02 02:57 · Score: 4, Insightful

Of course they don't know what a DLL is. Windows has been marketed as a consumer OS, it was designed to be used by people without a clue. By default you can't even see the DLLs. People shouldn't need to have IT qualifications to use a computer, it should be secure enough for them to use it. What you are suggesting (to use a car metaphor and probably get flamed for it) is that people should need to strip and reassemble an engine to get a drivers liscence.

--
99 bottles of beer in 175 characte

Talking of 'Trustworthy Computing' by peterpi · 2006-01-02 02:57 · Score: 3, Funny

I love the way the story starts 'Anonymous Coward writes', with an email address link to the author.

Trusted Computing? I think not! by Anonymous Coward · 2006-01-02 02:57 · Score: 2, Interesting

I wouldn't call what they are offering as trusted computing. They are not
the manufacturers of the OS, so whatever they are offering is NOT trusted computing.

Since it's a typical binary patch you have to trust them that this
patch won't hose your system or make you pwned by these or other folks.

As a long time Linux user, I find this situation appalling. If I were stuck
using a Windows box I would be pissed off by this. Look, when I want to upgrade
my box, I just do a apt-get update; followed by either apt-get dist-upgrade
or use synaptic. I know my sources (I select them myself), I know that the reality
checks exist (gpg keys, outside sources verifying the software, etc.). I know
I'm not getting hosed when I install software from my usual Debian repositories.

Do any of you windows folks know these security folks? Do you have any
reality checks that you can apply against this binary patch? What control do
you think you have of your operating system?

I guess if you haven't been a Linux user for a long time you might not understand
the depth of how bad your security model is when you're stuck with windows.

--Johnny

Re:"the snort rule will peg the CPU on your router by PenguinOpus · 2006-01-02 02:59 · Score: 5, Informative

I believe this is because _any_ image is vulnerable to infection. Because Microsoft checks the header for every image file and treats it as WMF if the header matches, all jpegs, gifs, and pngs are potential vectors for the disease. A router that has to inspect _every_ image that is surfed by users behind it will immediately turn into a bottleneck.

A couple of the other comments here seem to miss this very important point:

It's not just files with ".wmf" at the end. Any image file will get unwrapped by Microsoft code and the callback will get executed. Woof.

o.O by xx_toran_xx · 2006-01-02 03:00 · Score: 4, Funny

They want you to trust that the unofficial patch for the Windows Metafile Volunerability that is currently being exploited by an IM worm.

OK, tell me how that sentence is supposed to make sense. Come on :|.

--
Arrrrrrr

Well the truth is.... by ciroknight · 2006-01-02 03:13 · Score: 5, Insightful

..that if we all were running "trustworthy" computers, this problem would be much, much worse than it is now. Imagine that now instead of having a patch that's already been made by someone else while we sit and wait for Microsoft to get off their asses, we now have to wait on Microsoft, who still hasn't shown up.

Instead of having *some* machines patched, we'd have none. This late after the exploit has been released, and a zero-day attack has happened, we'd see no respite.

If you try to argue that Trustworthy computers wouldn't allow this to be exploited, what if the trustworthy compontent itself was exploited? As the Xbox and soon the Xbox 360 have shown, the more complex the hardware, the more complicated the bugs are. Microsoft's betting that the hardware complexity can outgrow the programmer's abilities to crack it, but if there's any truth in the world, it's that if it can be engineered, it can be destroyed. So imagine if this virus was actually signed by Microsoft through the exploit. How would this look for their company? How can you save face from a disaster like that?

No, trusted computers aren't the answer, just more secure computers, with better code. And the fact of the matter is, the more eyes that are on the code, the better it is, and that's why Open Source will always succeed. No amount of cryptography will help you if there's a hole in your crypto system.

--
"Victory means exit strategy, and it's important for the President to explain to us what the exit strategy is." G.W.Bush

Re:Well the truth is.... by frankie · 2006-01-02 03:52 · Score: 2, Insightful

what if the trustworthy compontent itself was exploited?
There's no "if" about it. The vulnerable component is a genuine Microsoft DLL, shipped as part of Windows, intended to render an official Windows file format. If you were running a "Trusted"(tm) PC, this DLL would 0WNZ0R you with no way out.
Re:Well the truth is.... by ultranova · 2006-01-02 04:10 · Score: 4, Insightful

There's no "if" about it. The vulnerable component is a genuine Microsoft DLL, shipped as part of Windows, intended to render an official Windows file format. If you were running a "Trusted"(tm) PC, this DLL would 0WNZ0R you with no way out.

You have it backwards. If you were running a DRM'd PC, this DLL would allow you to retake your own computer.

Remember, security flaws are only bad when security is protecting you. DRM protects Disney against you, so any hole in a DRM'd computers security makes it more, not less, valuable to its owner.

Maybe, in ten years time when only DRM'd computers are legal to buy, and attempt to install anything but Windows Whatever into them is a crime punishable by death, we will yet end up praising Microsofts total incompetence with anything resembling security.

--
Forget magic. Any technology distinguishable from divine power is insufficiently advanced.
Re:Well the truth is.... by ciroknight · 2006-01-02 04:35 · Score: 4, Insightful

Huh? I am not aware of any current implementations of "trustworthy computing" that would prevent you applying this sort of patch. The TPM chip and the like simply let you prove things about the configuration of your computer to other computers (and lock data to a particular machine) - by all means, go wild, do whatever you want to your own computer. Just don't expect to then be able to lie about it to others. If you then rely on others for various things who refuse to trust you because you're loading patch DLLs into every process then you may have a problem yes, but this is only temporary and the benign applications of such a technology (death to game cheaters!) IMHO outweigh the very slight theoretical risks.

So let's say I'm JoeISP. Hi JoeISP you might say, I'd laugh and go about my business. Some nasty cruel internet underdwellers would go about writing their programs as they do today, and start delivering their payloads to people over my network. I can't really stop them from doing this; there's simply too much data that goes through my network to look at every packet and assure that the content isn't executable or worse, a virus. I can take some countermeasures, but not to many. Nope, it's the end users who have to be trusted.

So over there is Miss Jane. She loves the internet, and her newly bought Laptop from Dell with a pretty new TPM chip in it. She's a customer as JoeISP, and I love her for it, she pays me a pretty penny a month she could be getting for free if her neighbor would share his wireless access point, but sadly for Jane, her computer doesn't detect that his WAP has a TPM chip, and her operating system says to her that even if the network weren't protected by WPA2, she still wouldn't be allowed to connect to it because it isn't a Trusted connection. She shrugs it off.

So, Jane goes about checking her email when she sees a really funny picture her aunt sent her. Oh boy that's funny she said, and she saves the picture on her desktop so she can look at it later, or maybe even send it to a friend! But what's this? Her computer suddenly locks up tighter than a steel drum and a little popup tells her that "Windows Trusted Computing has detected unauthorized code in memory, and will not allow it to be executed." But she wants to save the image! She dismisses the popup, and saves it again, same message.

She is disheartened and goes to Trusted Go^W Microsoft Search to find an answer. Turns out, lots of people have been having this same exact problem, and nobody knows why. Some guy with a pocket protector and glasses tell them to reboot their computers, go into their BIOS and turn off TPM protection, and she does.

Now when she gets back on the Internet (this of course, assuming that she can, more on this in a minute), she saves the picture and poof, she's now got the exploit running on her machine. Her virus protector (assuming she has one) goes haywire! Of course, Windows File Protection make certain that she can't easily select the file and delete it, after all, it is a running executable now. (Or, even if WFP *did* allow it, most viruses these days are smart enough to break virus protectors in a way that they can't remove the virus on their own, even if their data files are up to date).

She's smarter than your average bear, however, and is able to go to another computer and get back on the internet. She finds a patch for the bug, and a clean up tool that allows her to remove the code from the image. "Goodie" she thinks.

She goes back to the other machine, fixes the DLL, turns back on TPM, and goes to get on the internet.

My ISP (remember me, JoeISP?) instantly alerts an error. Someone has connected to our network with TPM on, but has modified their files! Our policy is not to let those people on our network at all, since that's what Microsoft told us to do. So we block her MAC and continue about our day. She calls in later, furious that she can't get the Internet to work in her house anymore. Any attempts to quell her ar

--
"Victory means exit strategy, and it's important for the President to explain to us what the exit strategy is." G.W.Bush

Get the joke, will travel... by Pac · 2006-01-02 03:14 · Score: 4, Informative

So we have to explain the joke again:
The title comes from the original note in the Handler's Diary. You see, it creates a mental tension between "Trustworth Computing", the lack of an official patch and ISC's "Please, trust us". It makes some readers smile.

Corporate? Try college. by mendaliv · 2006-01-02 03:18 · Score: 4, Insightful

Think users are bad in the corporate sector? Wait until everyone gets back to the college dorms after winter break with their completely unpatched computers. And all the people who have new computers that they got over the holidays. It wouldn't matter if Microsoft had patched it last week, I guarantee that the student users who need it won't have it.

Speaking as a poor sap who has to fix these computers, I have one thing to say: "Thanks for the easy money". And a heads up to all you dorm technicians, get ready to start burning virus CDs.

Re:What's wrong with... by Cobralisk · 2006-01-02 03:21 · Score: 2, Interesting

They don't have to.

1. Write a 1 line .bat file that does the deed for the cluefully challenged.
2. Package and publish as a Hotfix and push to Windows Update.
3. ???
4. Profit!

"98%" of PC Users don't know how a patch works any more than they know how to disable a DLL. I'm sure they don't even know how scheduling works. Shockingly, the inner workings of a computer are as mysterious to the average user as a woman's body is to a slashdot reader. We should all just give up on them, because we don't need Joe Sixpack to drive the tech economy so we can actually afford to have computers and affordable bandwidth. Just tell them to put it back in the box, return it to BestBuy, and tell the clerk they're too fucking stupid to own a computer. The GP post suggested a method that apparently works for disabling the vulnerability. This information is useful to the slashgeeks who will end up servicing the computers of friends, family, and co-workers one way or another. A quick heads-up now on this saves a few hours later when after some porn surfing (it just popped up and it wouldn't let me close it) or email attachment (I didn't open it) you end up removing the worm and all the damage it did anyway.

--
Waiting for ad.doubleclick.net...

Re:"the snort rule will peg the CPU on your router by Anonymous Coward · 2006-01-02 03:21 · Score: 2, Informative

It's not just files with ".wmf" at the end. Any image file will get unwrapped by Microsoft code and the callback will get executed.

Yes. You see, when the HTTP 1.1 protocol was being developed, they made it a solid rule - you MUST NOT GUESS the content-type when it's supplied.

Anybody want to hazard a guess as to what Internet Explorer and everything that uses its rendering engine does? Yep, that's right, it ignores the standard and guesses.

That means that instead of having to check <1% of images going through your firewall/proxy (WMFs and unlabelled content), you have to check 100% of them. Heck of a job, Billy-boy!

Re:What's wrong with... by MikaelC · 2006-01-02 03:22 · Score: 4, Interesting

It may not be enough.

From http://www.viruslist.com/en/weblog?discuss=1768925 30&return=1:

"... Going back to the wmf vulnerability itself, we see number of sites mention that shimgvw.dll is the vulnerable file. This doesn't seem correct as it's possible to exploit a system on which shimgvw.dll has been unregistered and deleted. The vulnerability seems to be in gdi32.dll... "

This Is Incomprehensible! by TexVex · 2006-01-02 03:30 · Score: 4, Funny

Anonymous Coward writes

Writes? Wouldn't a high school English teacher send this back with a little markup and a big fat red "F" on it?

"This is a first: the Internet Storm Center is recommending trustworthy computing.

I think this is the one valid sentence in this whole summary!

They want you to trust that the unofficial patch for the Windows Metafile Volunerability that is currently being exploited by an IM worm.

Obviously one instance of "that" is an extra. But which? Remove one, it means one thing; remove the other, it means something different.

No patch from Microsoft at this time,

Fragment (consider revising).

and the exploit is arranged in such a manner that it cannot be detected by most intrusion detection systems

Flowers and furniture are arranged. Music is arranged. Why the hell is the bolded phrase even in there? Try "the exploit cannot be detected by most modern intrusion detection systems" on for size. That edit gets rid of the passive voice and that meaningless phrase all at once!

(the snort rule will peg the CPU on your router)

I guess somebody's snorting something. What the hell does this mean?

nor filtered by packet-inspecting firewalls (it spans two or more ethernet frames).

Ooh, somebody just loves the parentheses! Why not kill them and insert ", since" after "firewalls"?

Not really a whole lot of choice about this one.

Fragment (consider revising).

I don't know who's more of an idiot -- the submitter or the "editor" who accepted this turd of an article summary.

--
Fun with Anagarams! LADS HOST, SHALT DOS. HAS DOLTS. AD SLOTHS, HATS SOLD. ASS HO, LTD.

Re:Holidays! by SillyNickName4me · 2006-01-02 03:38 · Score: 3, Interesting

Sure, people needs lives (e.g., vacation, time off, etc.).

And so do those who work as network administrator etc..

I can tell you that many a company that takes internal security seriously has had people working on this over the last weekend to make sure they are as safe as can be when everyone starts working today.

MS could have had a few employees working on this during the hollidays, get it properly fixed, and have an update installed with windows update.. as it is, they got a few thousand people working on implementing workarounds and unofficial fixes instead. Lots of extra work that has to be undone when the official fix is there.

Re:TFA conclusion is BS by finkployd · 2006-01-02 03:47 · Score: 3, Insightful

Don't open e-mail from senders you don't recognize.

What would this accompolish? Since around 1999 or 2000, the vast majority of viruses and trojans have grabbed all the email addresses in someone inbox, address book, etc. and sent themselves out using a random return address from this list. There is a good bet that any virus/trojan you get will have a known return address in it, however it is just as good a bet that it will not be the address of the person infected.

Geeze, here it is 2006 and people still think that the return address in unsigned email means ANYTHING.

And if you are in a coporate setting and the Network Admin hasn't blocked IM, you've already got bigger problems to worry about.

It really seems sad that the norm is to block reasonable communication tools (I use IM almost exclusively for work related communication) simply because corporate America is infatuated with Microsoft despite the massive security headaches they cause.

Off topic, I'm really getting annoyed with Microsoft admins where I work constantly complaining about IE problems. I'm starting to ask these people how many times they had to put their hand on a hot stove when they were children before they decided it was a bad idea. Is pattern recognition a skill that we as a society just no longer have?

Finkployd

So is there a patch ? by smoker2 · 2006-01-02 03:50 · Score: 3, Interesting

or not ?

according to Microsoft

If you are a Windows OneCare user and your current status is green, you are already protected from known malware that tries to attack this possible vulnerability.

That sounds like they must have some kind of patch out there, or are they hoping to get more users "hooked" on OneCare ?

Otherwise, this statement doesn't make sense :

Upon completion of this investigation, Microsoft will take appropriate action to help protect our customers. This will include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs.

Maybe I'm being picky, but I think all their customers have a quite urgent need, right now !

Written from the sublime security of Fedora Core, thanks.

Re:I trust the patch, the source is included by Myen · 2006-01-02 03:51 · Score: 2, Informative

How?

The patch came as an EXE (InnoSetup), and to get at the source you need to install it... At which point an executable has already been run, *and* a DLL has been dropped to %systemroot%\system32 and schedule to load for any subsequent apps that load user32.dll (according to the description anyway).

I've managed to read the source after installing it... but if it was bad, I'd've already been hosed by that point.

Intel architects by kybred · 2006-01-02 03:56 · Score: 2

The guys at Intel in the late 1970s didn't consider things like that - if they ever knew about them - as they were mostly IC designers, not proper computer architects.

You are mistaken. If you look at the 8086 (and 8088) design you'll see the segment registers which could be used to separate data from code memory. I believe the current x86 processors still retain these registers. Of course, using memory segments was a pain and the OS designers (probably pressured by application developers) stopped using them in preference to the flat memory model.

To say the Intel designers didn't know about HW protection is incorrect.

Re:Trust not the issue... by julesh · 2006-01-02 04:00 · Score: 2, Informative

Personally, I don't see the problem with temporarily unregistering the affected DLL...

Because the flaw isn't in the image previewer used by the shell, it's in GDI32 which is a core OS component and can't be unregistered. Unregestering the image previewer will prevent a lot of attack vectors, sure, but there are probably others.

No it's much worse. by goombah99 · 2006-01-02 04:15 · Score: 2, Informative

What's evil about this one is not that someone couldlure you to a rigged speical website but that they can reach out and get you. For example, they can just take out a banner add from double click and have this rigged jpeg displayed on tens of millions of computers. Or they could post it as a picture on FLikkr and hope it gets into the rotation for a picture of the day. get it into google images. Post it on a bulliten board that allows thumbnail jpegs. Lots of ways to get the code onto trusted web sites.

--
Some drink at the fountain of knowledge. Others just gargle.

Win98 patch? by GreatDrok · 2006-01-02 04:16 · Score: 3, Insightful

I wonder if anyone is going to be able to patch Win98 against this? There are still a lot of machines and this vulnerability could make them essentially useless and force an upgrade. While we would all love for them to upgrade to Linux or OS X it is more likely that they will shell out for WinXP and MS will benefit from a windfall of sales as a result of their inept programming. If someone produced a workable patch this would at least allow people to keep using their computers without pouring more money down the MS bottomless pit.

--
"I have the attention span of a strobe lit goldfish, please get to the point quickly!"

Your TPM software might refuse to run by Lonewolf666 · 2006-01-02 04:23 · Score: 4, Insightful

In some DRM scenarios, the TPM chip is also used to prove to your software that the OS has not been modified. Unless you have the skills to hack that software, your bought and paid for TPM programs may refuse to work any longer.

A much tougher case would be the "rely on others" programs where you have to prove to an external instance that your system has not been hacked. Take the "death to game cheaters" implementations as an example:
Want to fix your vulnerable Windows with a non-official patch?
World Of Warcraft II won't let you play anymore ;)

I also don't believe this is temporary. Except in the sense that TPM might be (hopefully!) a colossal failure in the market. And considering the current vulnerability, this looks like more than a slight theoretical risk to me.

--
C - the footgun of programming languages

Re:Pushing the patch via Zenworks/SMS/Tivoli??? by pyrros · 2006-01-02 04:29 · Score: 4, Informative

The fix can be applied in the automatic mode using the following command line:

wmffix_hexblog13.exe /VERYSILENT /SUPPRESSMSGBOXES

These switches do not suppress dialog boxes about installation errors.
The /LOG="file" switch can be added to the command line to create a log file.

[from http://www.hexblog.com/2005/12/wmf_vuln.html ]

There's a MSI version in the works as well.

Re:WTF... Cannot parse by Yahweh+Doesn't+Exist · 2006-01-02 04:33 · Score: 2, Informative

>I think I know English pretty well, and...

fixed.

Re:Why do folks still use Windows? by Fortran+IV · 2006-01-02 04:36 · Score: 4, Insightful

What is the calculation that Windows users -- esp. businesses -- make that allows them to keep on using Windows?

I usually stay out of the Windows/Linux/Mac arguments, but I'm afraid you just don't understand my world.

I work for a very small company, probably typical of thousands of other very small companies. Our company is too small to afford a full-time IT staff; I'm the entire IT department, and it's a very small part of my job. I'm the IT guru because I'm the only one there who knows a DLL from a dungheap.

I have formal training in computers, but so long ago that the field was still called EDP and time-sharing was a big deal. I've spent years learning what I know about Windows and Windows networks, in my spare time. It would take me years more to reach a similar level of expertise with a brand-new OS. And until I reached that level, we'd be more vulnerable than with Windows.

My company has about a dozen computers, including a single domain server with no backup server. We have about $60,000 invested in software (other than OS's) that will only run under Windows. We have no hardware to set up a test server, no money (or time) to spend on unsuccessful experiments.

The only person in our company who has ever used Linux is our 21-year-old secretary. We have one Unix machine, which I despise, because its desktop GUI is primitive and its command interface makes MS-DOS look well-designed and intuitive.

I rarely get to spend more than two or three hours a week on network maintenance, security monitoring, and research combined. If I hadn't automated them I wouldn't have time to do file backups some weeks. I have no time to spend trying to research the seventeen hundred different distros of Linux available, or whether Wine will support our COM+-dependent network applications--or whether the WMF exploit still applies if we run Windows applications on Linux.

We can't afford to have a regular support contract with a local computer-specialist firm. That's assuming we could even find someone in town we can trust--the overpriced morons who did our last batch of installations gave us a two-NIC server with only one NIC enabled (so no firewall), and set up user workstations with the Administrator password left blank!

I loathe Microsoft, and have since I first saw Windows 3.11. But what possible reason do I have for trusting the claims of Red Hat or Debian more? What research I can do is hardly reassuring. Remember Saturday's story here: researchers found 812 flaws in the Windows operating system, 2,328 problems in various versions of the Unix/Linux operating systems (Mac included)?

Somehow the Windows folks keep on choosing to use Windows...

I didn't choose Windows; I inherited it and have no resources to replace it. My company didn't really choose Windows; it was forced on us by the marketplace. Be realistic! My wife just bought an Apple, and the first thing she installed on it was the OS-X version of MS Office, necessary for compatibility with her company.

Maybe in another ten years Linux will be enough of a force that applications will be written for cross-compatibility, but little companies like mine can't wait that long. We have to use what we can, right now.

--
I figure by 2030 or so my 6-digit UID will be something to brag about.

I do trust Microsoft... by eyepeepackets · 2006-01-02 04:42 · Score: 2, Funny

...to do what they do best. Which is why I use a different OS and suggest others do so as well.

What does Microsoft do best? Why, get the money out of the pockets of suckers, of course.

Suckers.

Cheers!

--
Everything in the Universe sucks: It's the law!

Trustworthy Computing != Trusted Computing by hanssprudel · 2006-01-02 05:00 · Score: 4, Informative

There seems to be a lot of confusion in this thread regarding these two terms. It isn't that surprising, since they are both purposely misleading, but still.

"Trustworthy computing" is Microsoft's bullshit name for their so-called initiative to start taking security seriously. It was under this banner that Bill sent all his coders to secure coding seminars so they could learn what a buffer overflow is. The article is ironic in its title: that Microsoft have failed to find such a glaring issue as a native image format that purposely allows images to execute arbitrary code, and that they have not offered a patch even now when exploits are in the wild since almost a week, shows how trustworthy they really are.

"Trusted computing", on the other hand, is the bullshit name for a nefarious scheme involving hardware and software whereby control over PCs should be taken out of the hands of their owners, and given to the software and hardware vendors. This is sometimes claimed to be about security, but is actually motivated by DRM and DRM only (the name is short for "Trusted Client Computing" and comes from the ability of DRM vendors to trust that your computer, the client, will obey their directions).

The people pushing "trusted computing" are actually not so much Microsoft as Intel and IBM: Microsoft completely support the concept of trying to put the freely programmable computer back in the bottle, but they have had their own ideas about implementation (their version was first called "Palladium", but when they realized that it is bad to have a recognizable name for something customers actually don't want it was renamed "Next Generation Secure Computing Base" and after that it was renamed to nothing at all so they can be snuck into the coming versions of Windows without people noticing.) // oskar

can't remove the callback feature by r00t · 2006-01-02 05:08 · Score: 4, Informative

The WMF file is really a list of Windows drawing functions to call, along with their parameters.

Guess what else uses this.

There are in-memory and on-disk WMF files. Some are used by apps for repainting the screen. Some are used by apps for printing; Windows printing is based on the WMF. You want error handling with printing, right?

Now, I'm not saying how to fix this unless Microsoft shares some cold hard cash with me, but there are reasonable solutions. It's just not as simple as patching out the feature.

Re:can't remove the callback feature by r00t · 2006-01-02 09:58 · Score: 3, Insightful

It doesn't look all that obsolete in Microsoft's documentation.

CERT may think the function is obsolete, but that doesn't mean
that apps no longer depend on it. Stuff breaks if you go ripping
pieces out of an ABI. Somebody's critical business app might
even depend on the function.

Wiki by r00t · 2006-01-02 05:14 · Score: 3, Interesting

Some wikis probably don't check file content.

Wikipedia tries to block stuff like this, but I don't think it is all that reliable. They just use the UNIX file command to see if a file matches the file extension.

WMF files start with 0x01 0x00, are are unrecognized by the file command.

JPEG starts with 0xff, so that won't do. Well, there are other formats to try.

Its not a DLL -its Windows, and its a feature by steve_l · 2006-01-02 05:26 · Score: 4, Informative

F-Secure has more on it: http://www.f-secure.com/weblog/#00000761

Windows Metafiles are a file representation of drawing commands. They are more flexible than bitmaps and get used quite a lot in things like for caching images of every OLE object embedded inside a MS word or powerpoint document. There just happens to be one operation to set a callback when a printing aborts which can be saved to a WMF file, which, when followed by something to abort the rendering, lets you jump to the nominated location.

This back door is built into windows from version 3.0 onwards. Any app that displays WMF images from untrusted sources (lotus notes, maybe msword, even google desktop search) is vulnerable. This is potentially code red for the desktop.

I have the patch on all my systems, the author works for IDA, the debugger tool, and is well respected. I dont care whether IT central will push it out or not; I think they ought to before the back to work/school event causes major worm attacks using it. It will be pretty embarrassing for microsoft though -a third-party emergency fix for windows, in the same year that Vista, "Windows Secured" is due to ship.

Re:Its not a DLL -its Windows, and its a feature by Wolfrider · 2006-01-02 09:21 · Score: 3, Informative

Is it just me, or is the Slashdot "unofficial patch" link at the top absolutely useless?

After banging around the SANS site for a good 15 minutes, I *finally* found WHERE YOU CAN DOWNLOAD THE PATCH from:

http://isc.sans.org/diary.php?storyid=999
http://isc.sans.org/diary.php?storyid=1004

--
.
== WolfriderV6 == I'm willing to admit that *I just might* be wrong... Are you??

Re:TFA conclusion is BS by jonadab · 2006-01-02 05:30 · Score: 3, Interesting

> Geeze, here it is 2006 and people still think that the return address in unsigned
> email means ANYTHING.

Well, yeah. I had to explain to two coworkers just last week that the scary messages they were getting weren't really from eBay, and they were quite surprised. (So I told them that if they were concerned that they might need to check their eBay accounts, to use the bookmarks they usually use to go there, because they would know that those really go to eBay. The link in this message only says it goes to eBay, and really it goes someplace else, to another site. Such gasps of outrage and astonishment as I then heard, you'd have thought I was telling them that their husbands lied about the business trip and were really with in Las Vegas with girlfriends.)

This is at least partly because of the way mailreaders present the data. Instead of showing the headers as part of the message (which is, essentially, how they're transmitted), most mail readers parse the headers and present certain pieces of data from them (the From address, for instance) separately from the message, as metadata. Well, yeah, it *is* metadata in a sense, but the way it's presented makes it appear, to the casual user, as if it's something the mailreader knows about the message, rather than something the message claims about itself. Other critical headers, such as Receives:, are not shown at all (unless the user specifically goes looking for them in a "Show All Headers" or "View Message Source" option or somesuch.

There are, of course, good solid usability reasons why these things are the way they are, but it doesn't take a doctor of psychology to tell you what people are going to think as a result.

Personally I'd like to see the information parsed out of the headers, especially the sender information, labelled just a little differently, e.g., "Claims to be From:". I'm not sure that would entirely solve the problem, but it might help a little. I'm also deeply annoyed that our ISP's mail server accepts HTML messages for delivery (if we had our own mail server in house it sure wouldn't), and that all the decent, deployable, user-friendly mail clients I can find happily render and display HTML mail. Even recent versions of Pegasus cannot, as near as I can determine, be configured to show the source or treat the HTML as an attachment.

--
Cut that out, or I will ship you to Norilsk in a box.

I Compiled it myself by steve_l · 2006-01-02 05:42 · Score: 2, Informative

I built my own release.

The code is only 200 lines, and is primarily patching logic with a switch in there. The biggest risk is that it patches the wrong place and doesnt provide protection, the next that it doesnt uninstall. Those are hard to test.

there is always choice by Heembo · 2006-01-02 06:01 · Score: 2, Insightful

it cannot be detected by most intrusion detection systems (the snort rule will peg the CPU on your router) nor filtered by packet-inspecting firewalls (it spans two or more ethernet frames).

You *can* run 2 instances of snort in-line to get around this CPU-pegging issue.

Not really a whole lot of choice about this one.

There is always choice - have you considered a defense-in-depth multi-layered approach? I'm taking the following steps
1. unregister the ms pic and fax viewer dll
2. make WMF file extension default to an erroneous app like notepad
3. turn DEP up a notch
4. turn off downloads in IE if you must use it (set default security settings to HIGH)
5. block all WMF files at the perimiter
6. keep antivirus up to date and consider frequent manual updates and scans of key machines

These things in combo with being vigilant over the next few days should keep you and your corporate networks safe. There are even MSI versions of the patch for mass distribution.

--
Horns are really just a broken halo.

Re:there is always choice by Sedennial · 2006-01-02 06:11 · Score: 3, Informative

Did you miss the fact that blocking .wmf files/extensions means nothing for XP users? Because XP took a page from the 'magic bytes' of Unix and recognizes .wmf files from the image header, it can (and will) in some circumstances render them regardless of the extension. So naming it .bbb will bypass your perimeter filters completely.

Deploying to many machines is hard by ilfak · 2006-01-02 06:03 · Score: 5, Informative

I'm the author of the hotfix and one could expect me to say 'yes, please go ahead and install it on your corporate network with thousands of machines'.

But I won't say that.

First of all deploying any software on a large network is a serious task. It should be carefully planned and performed with the correct (read: responsible) approach.

The hotfix must be tested on as many machines as possible. Possible negative consequences must be determined and decided upon if they are acceptable or not.

In short, more rigorous testing is required.

-------
Ilfak Guilfanov, the author of the hotfix

Re:Deploying to many machines is hard by plopez · 2006-01-02 10:22 · Score: 4, Insightful

What you have said should be SOP for any fix on any large network. Even vendors can get it wrong, so testing is always important.

--
putting the 'B' in LGBTQ+

Re:Why do folks still use Windows? by Just+Some+Guy · 2006-01-02 06:05 · Score: 2, Insightful

My company has about a dozen computers, including a single domain server with no backup server. We have about $60,000 invested in software (other than OS's) that will only run under Windows.

I rarely get to spend more than two or three hours a week on network maintenance, security monitoring, and research combined.

OK, so you're not a full-time IT guy. That's cool. But if you can't manage 12 machines and only $60K worth of vendor lock-in, then you absolutely, positively need some outside help. It's not an issue of whether you can afford it; at this point, I'd say you have to.

But what possible reason do I have for trusting the claims of Red Hat or Debian more? What research I can do is hardly reassuring. Remember Saturday's story [...]?

I did, but I don't think you did, because it was thoroughly debunked within the first 10 replies.

Let me put that another way. The article you're reading right now is full of stories about people going in on the holidays to patch their Windows systems. How many stories did you hear about Unix admins rushing in this weekend? All of last month? All of last year? So far this millennium? The latest unpatch{ed,able} Windows exploit is set to cause more work for the people who have to manage affected systems than the rest of us have had in the last five years.

But you can choose to believe whomever you want. As for me, I'm enjoying my four-day weekend and relaxing by reading about stuff that doesn't affect me. Hope your new year goes this well!

--
Dewey, what part of this looks like authorities should be involved?

Ahhhh! by gQuigs · 2006-01-02 06:16 · Score: 3, Funny

I've removed:
ActiveX for streaming video
AOL ART Image Format Support
Intel Indeo codecs
Media Center
MIDI audio support
Movie Maker
Old CDPlayer and Sound Recorder
Speech Support
Windows Media Player
Windows Media Player 6.4
Client for Netware Networks
FrontPage Extensions
Internet Connection Wizard
Internet Explorer
Internet Explorer Core
IP Conferencing
MSN Explorer
Netmeeting
Outlook Express
Vector Graphics Rendering (VML)
Windows Messenger
Desktop Cleanup Wizard
Framework
Help
Out of Box Experience (OOBE)
Shell Media Handler
Tour
Web View
Zip Folders
Fax Services
Imapi
Indexing Service
System Restore
(nliteos.com)
AND I AM STILL VULNERABLE!???

Perhaps I should switch to linux :) |scroll lock||scroll lock| (KVM)

Re:"the snort rule will peg the CPU on your router by CommanderData · 2006-01-02 06:31 · Score: 2, Interesting

The AC is correct, Internet Explorer will look at up to 256 bytes of each data stream returned (images, html, etc) and attempt to "guess" the MIME type.

An interesting fix for this problem- Rather than having your hardware router/firewall sniff all the packets, you could write a pluggable MIME filter registered to ALL image types on your PC (Google it for more info- I've done a lot of research on MIME filters and Asynchronous Pluggable Protocols for IE, but I'm too lazy to dig it all up right now). If the MIME filter examines the returned image data stream and sees evidence of the WMF exploit, trash the stream and substitute your own image (maybe a jpeg of a skull and crossbones). If registered as a permanent MIME filter it would have the benefit of blocking the exploit in anything that uses IE as a rendering engine- which includes many e-mail applications (Outlook!), and some IM apps.

I looked at doing this myself, but dropped it assuming MS would have created a fix by now. Maybe I should start working on it again....

--
Urge to post... fading... fading... RISING!... fading... fading... gone.

In case you haven't heard this... by hullabalucination · 2006-01-02 06:39 · Score: 2, Interesting

...several thousand times already: Thanks for the patch!

There is an official fix available! by Admiral+Burrito · 2006-01-02 06:49 · Score: 2, Funny

In an interview with an anonymous MiroScoft employee, it has been reported that MS has found a working fix!

"We've all turned off our computers, and are sitting on our hands. This has effectively blocked all intrusion attempts."

When asked when the fix would be distributed, he replied:

"Once the threat has passed, it will be safe for us to turn our computers back on and email everyone with instructions for turning their computers off and sitting on their hands. Until that time comes, we're asking everyone to be patient."

Suspend your disbelief? by jefu · 2006-01-02 07:07 · Score: 2, Interesting

Should I believe this statement?

The checkpoint page you point to just lists this as a vulnerability and gives a password protected link to "FULL ADVISORY and SOLUTION" (caps theirs). Since I don't have a checkpoint login, I have no clue as to what they are saying. I therefore have no reason whatever to believe that they have anything to offer.

What did they do wrong by badriram · 2006-01-02 07:21 · Score: 2, Insightful

I do not want a patch that is untested, and could cause even more hell. You really think, they could have created a patch, and tested it well to be deployed on 200+ million machines connected to Windows update, and not have any bad effects on other apps.
If you look at the patches realeased by others, they also say it might break applications, and you might have problems with it etc. I do not think MS has that option while creating a patch.
Microsoft accpeted there was a flaw, posted information about it, told you about workarounds. If you want to be protected just turn on DEP on all applications. Want to do it on multiple machines, use scripts to edit boot.ini and add /NoExecute=OptOut to the options, and kick in a restart. Atleast that is a better thing to do than trust a random untested patch.

Re:What did they do wrong by PhYrE2k2 · 2006-01-03 10:32 · Score: 2, Interesting

A patch posted a couple weeks ago stopped IE from loading gif images from select sites. They show up as invalid (X) images. Strange isn't it? A 'security' patch should never break functionality.

-M

--

when you see the word 'Linux', drink!

Re:Holidays! by kimvette · 2006-01-02 07:22 · Score: 2, Interesting

{
I think the problem is the timing: Holiays.
}

If they can force, er, "encourage" microserfs to pull 60 to 100 hour workweeks away from their families for months at a time to squeeze more features into Winbloat Vista and Microsoft Office, certainly they can ask one or two developers and QA folks to implement a security patch and roll it out quickly as at least a BETA release?

reason 8,181,842 I quit running Windows.

--
The Christian Right is Neither (Christian nor right). See: Matthew 23, Matthew 25, Ezekiel 16:48-50

Re:Why do folks still use Windows? by Anonymous Coward · 2006-01-02 08:40 · Score: 2, Insightful

Q: Why do folks still use Windows?

Short answer: It easily runs everything I want it to. The Linux user experience is significantly worse than Windows.

When I had to pick an OS, I did research and picked one that I felt was secure enough for my needs. Windows didn't make my cut.

What are you doing to make Windows insecure? Downloading unmarked executables from newsgroups and executing them? Running Outlook and double-clicking on every attachment you receive? Running without a firewall?

Let me rephrase your quote:

When I had to pick an OS, I did research and picked one that I felt was compatible enough for my needs. Linux didn't make my cut.

The last time I tried Linux (and I have, I really have), it didn't support all my hardware out of the box. Hardware support should simply work instead of having to recompile my kernel 36 times trying to figure out the correct settings (there were none, I had unsupported hardware). How ancient is that? And then I hated the distribution wars - the infighting over which was the "best way" to do something - the way that distro X does things completely differently from distro Y to the extent that they're binary and logically incompatible to the detrement of the user - and you end up hating both distros as neither of them uses a solution that makes sense for the user.

Then there's the sheer hypocracy of KDE - instead of supporting Microsoft, it's supporting Trolltech, but nobody seems to understand that ought to be just as much of an ethical problem. Trolltech are no better than Microsoft when it comes to trying to leverage a monopoly. The pond may be smaller, but if Linux ever takes off, Trolltech gets a free ride. Except that Linux will never take off while Trolltech are stunting commercial growth and charging $4000 per seat for commercial development licences - Microsoft couldn't have a more unlikely ally in supressing Linux.

And as far as a free OS, I found FreeBSD to be significantly better than Linux as it's logically organized and the maintainers are mature adults compared to the screaming teenagers of the Linux world.

Although neither Linux or FreeBSD run the games or applications that I want to play. If they reliably (and with no messing around) ran the very latest games (eg: World Of Warcraft), tax and financial software (eg: Taxcut and MS Money) - with full support for my graphics card, sound card and printer - I'd take another look. I did once manage to get Unreal Tournament 2003 running under Linux (which was the game I was into at the time) with full 3D acceleration, but the sound was delayed about 2 seconds so it was unplayable.

But given that I no longer use my computer for the sole purpose of messing with my computer, I'm sick of that shit not working. 15 years ago it would have been a fun challenge to "stick it to the man" and "rebel" against Microsoft, but I no longer care. I want as little maintainability as possible - I simply want to be able to read email, yell at people on /., play games and do some serious stuff once in a while. So I run Windows XP on my desktop (instead of Linux or FreeBSD, although my other computer is an Apple Powerbook running OS X). I sit behind a hardware firewall, have autoupdates turned on, run a memory-resident virus scanner and antispyware scanner, use Firefox and Thunderbird - and I've never, ever had a security problem.

Re:Why do folks still use Windows? by HermanAB · 2006-01-02 09:10 · Score: 2, Interesting

What you are saying is that fixing broken Windows takes up so much of your time, that you can't afford to look at an alternative. Stand still and think about it for a moment.

The fact is that you can install almost any shrink wrapped Linux distribution, do a default installation and have almost zero support issues for the next year. Honestly, I almost never patch my Linux servers and only upgrade them every 3 years.

In a small business situation, any Linux box is as reliable as a refrigerator. Just leave it alone and it will keep working for a long, long time.

Think of that ancient UNIX machine you talked about - how much effort do you invest in maintaining it? Pretty much zero huh? After all, you don't even know how it works. Now imagine if all your computers were that reliable...

--
Oh well, what the hell...

useless for game cheats and other purposes by JimmytheGeek · 2006-01-02 09:25 · Score: 2, Interesting

I will grant that this will stop "many" types of cheats. It will still be useless because the cheaters will adopt the remainder. proxy aimbots and the like.

You seem to be ignoring - willfully or not - that the fundamental model of trusting MS is broken. Making that model more severe by forcing trust compounds the brokenness. It Has Been Shown that MS will be late with patches. It Has Been Shown that they are not proficient at security and will remain so until the market penalties are severe. What is the point of requiring official binaries when the binaries are going to be broken for weeks at a time? The net WILL be flooded with spam by those who RELIED on the official binaries. You have it so amazingly backward I wonder if you previewed the post.

MS blew it. They have added to their terrible reputation and I'm just not interested anymore.

There's also an outlook to your position I find frankly weird: that there is an official source of goodness. The "right" and correct version of the dll to run at this time is clearly the unofficial patch. The right version of a file to run in the future is going to be the one that reduces your chances of being 0wn3d, not the one with the pedigree. THis is "duh" territory.

Re:So...what "proper" steps secured you from this? by jacksonj04 · 2006-01-02 09:39 · Score: 2, Interesting

It took about 8 seconds to unregister the DLL from all systems on the network (Go active directory!) and limit applications ability to load it.

--
How many people can read hex if only you and dead people can read hex?

Re:Non NT-based Windows? by quiddity · 2006-01-02 11:03 · Score: 2, Interesting

the unofficial patch fixes the vulnerability through shimgvw.dll, which us win98 users dont have. but the actual problem is in GDI32.dll which is required for windows to function. so basically we're SOL atm.
info

--
.
. hmmm

101 of 465 comments (clear)