Slashdot Mirror
Windows 0-Day Exploited In Ongoing Attacks
An anonymous reader writes: Microsoft is warning users about a new Windows zero-day vulnerability that is being actively exploited in the wild and is primarily a risk to users on servers and workstations that open documents with embedded OLE objects. The vulnerability is currently being exploited via PowerPoint files. These specially crafted files contain a malicious OLE (Object Linking and Embedding) object. This is not the first time a vulnerability in OLE has been exploited by cybercriminals, however most previous OLE vulnerabilities have been limited to specific older versions of the Windows operating system. What makes this vulnerability dangerous is that it affects the latest fully patched versions of Windows.
UAC will display a warning, this exploit only touches users who run as admin.
I don't think any still supported version of Windows defaults to admin.
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
Linux is not good, damn full of bugs, heartbleed, shellsock and now THIS!!! Crap, wait, I must have made some mistake ;)
....Don't ever change you magnificant bastard.
Yeah, you defflinitely have "allow" it. But most people don't read half the messages excel or powerpoint throw at them. Just accept, accept, open, enable, install, install. Why do we even make botnets... I'm sure the users would do it on their own if they were prompted.
Just download this handy powerpoint slideshow and I think you'll find it explains how this attacks works in perfect detail...
Computers suck. Gotta love how an office document can compromise your system. Can we just use txt files and get away from Executable documents
Really? Who installs PowerPoint on the server? Cause you are gonna be all like, hold up let me unrack this server and connect a projector to it...right.
...yours
Thank you Dave Raggett
+1
Why do we need multiple rendering engines? There should be one to rule them all. It seems that even large companies like microsoft can't fix all issues, and microsoft has to maintain multiple rendering engines, like Trident or the Office rendering engine. If microsoft would use trident for office documents, too, and all plug-ins were made in js (or NaCL if you like binary), Office could profit by the huge efforts Microsoft (and Google) puts into securing Browsers.
If you're a security remediation specialist for the I.T. department, Windows is job security as these problems will never go away.
If you leave one hole in Windows unpatched, soon there will be more.
Who the fsck embeds OLE objects in PowerPoint.
I have enough trouble getting text to display.
... and if the one rendering engine was used, the moment an exploit becomes available, all systems are vulnerable. Haven't we learned about the dangers of monocultures yet?
Yes, tones of people do that already, it's called TeX or LaTeX. It probably takes about as long to learn as Word does anyway. The huge benefit of using LaTeX is that its fairly backward/forward compatible, unlike Word. Want a text based visio replacement? Try dot. Powerpoint? Don't know, don't care, make a multipade LaTeX document and just page up/down the output pdf/dvi. I don't really care much for powerpoint. Get started with LaTeX now.
Why UNIX?
The problem is MS never had a small tutorial during windows installation or during the first boot showing users how to create a Standard User account and have an administrative account for elevating your rights for doing administrative stuff.
The actual problem is that unlike Linux, doing this doesn't help you do a lot of the "administrative stuff" you need to do in Windows.
In Linux, a normal user with sudo permission can run "sudo su -" and everything run from that terminal will have admin privileges. You can do the same thing in Windows with "RunAs" either from a command prompt or from the Start Menu with Shift+RightClick. The problems then start. First, you have to figure out what command to enter to do something that is normally only done with the GUI. Then, you have to remember that everything is being done as the admin user, so any changes don't get put into the normal user's profile. This causes problems for some programs that don't have the "install for all users" functionality set up correctly.
In addition, there are some things that stupidly require elevated privileges but affect only the current account (like Control Panel->System->Advanced System Settings->Performance), which are thus impossible to change if your account isn't a member of "Administrators". There are also some things that even "Administrators" don't have permission to do, but "Administrator" does. And, there are some things that can't be done because you can't actually become the account that you need to be in order to do them (like "TrustedInstaller").
We're working on it. We got rid of monocles, except in very isolated instances, so monocultures are next, alphabetically.
Sleep your way to a whiter smile...date a dentist!
... almost every doc I open is opened in a locked state, Windows tosses up a message asking if I want to unlock it to make changes, or even to print it, I believe. That's a great way to train your users to click "OK" to every message they see.
Never let a lack of data get in the way of a good rant.
The problem is MS never had a small tutorial during windows installation or during the first boot showing users how to create a Standard User account and have an administrative account for elevating your rights for doing administrative stuff. But now, with windows 8 during the install, you can create any type account you like, but again, no tutorial.
The problem is one of history for Windows.
Windows was originally a place where every user was an Administrator. This encouraged developers to not pay attention to APIs used, so then applications came to be reliant on running only under users that were Administrators. Even Microsoft Office did that for a long time.
Then Microsoft split users up and now there was a special Administrator account and group. Except users wanted to continue using all the software they had from before that split. The solution? Make all users administrators. Developers kept designing software that required administrative access - even Microsoft Office.
Then came Windows Vista and UAC. Microsoft Office got fixed up; but many developers did not listen to years of warning. So then UAC started prompting the hell out of everyone. Windows 7 came along and most developers had fixed their software so UAC could be scaled back in its prompting some (really, that's the only difference between Win7 and Vista - the default threshold setting for UAC - in this matter).
Of course no where along the road did Microsoft make it easy to switch between users. Sure, there's "Run As..." but it's (a) not well known, (b) a PITA to use, and (c) doesn't solve every use case. UAC doesn't quite either. In neither case do either work like the priviledge escalation in Linux/Unix with "su" and "sudo" and their graphical equivalents. So everyone still must have the administrative access to do certain tasks.
And of course people are still trained that their user needs to be the Admin user for the system.
So there's still work to be done on Windows to bring a real "su"/"sudo" experience to Windows; but overall it's still very much a user issue since they're all trained to and expect that their Windows user will have admin rights whether they really need them or not.
Truth is like the sun. You can shut it out for a time, but it ain't goin' away. - Elvis Presley (source: imdb.com)
PowerPoint - nothing else even comes close. As engineers we don't care about it, but there are just as many people who live and die by the PowerPoint presentation (literally in some cases, as the US military leadership is sadly all about the PPT these days).
SmartArt is freaking magic for some people. It's exactly the sort of automation that LaTeX would be great at, but presented visually, not as "yet another programming language for those geeks." Like VI or EMACS, PowerPoint will always be with us: it's that central to a culture.
Socialism: a lie told by totalitarians and believed by fools.
Well, we mostly use Libreoffice at work. Are we vulnerable if we open a powerpoint file in Impress?
Writing a program that demands admin rights when it does not need them (eg. to put a lock file in the root of the system drive instead of elsewhere for a purely arbitrary reason) is even lazier.
Sometimes it's better to go after the root cause of the problem and get the developers that have been left behind to understand that it's the 21st century and their desktop software is likely to be running in a multi-user, networked, multi-core, 64 bit environment. There are far too many that can't even get ONE of those things in the list right which is a major part of why so many MS Windows systems are drowning in a malware swamp. We need to get away from the "we've always done it this way" culture of being acceptable when the way it's "always been done" only makes sense on single user systems with no network connection.