Slashdot Mirror
New Outlook Bug Doesn't Require Users To Interact With Emails To Be Compromised (softpedia.com)
An anonymous reader writes: A new bug in Outlook allows attackers only to send you an email, and without clicking or downloading attachments, a user's computer can be compromised. The bug [PDF] is because Outlook allows Flash objects to be previewed without a sandbox. Flash files are demon spawns and attackers can put exploits in malicious files, which when previewed or viewed inside an Outlook application will automatically execute their payload.
How much better would the world be without Microcrap and Flash?
Pity, they are like a plague. Like Zombies. We don't seem to able to get rid of them.
So, business as usual than.
I'm going to come back tomorrow just to read about how miserable Outlook is. So excited!
Thank you, /., this is why I endure.
"I got to see a tiny version of all the ads for V1agra every morning, so it was worth 100 hours of loss for the company. My pager went off when I was on the beach, but that feature is important" said the imaginary IT manager that lives in the brains of people who implement shit like this.
The Melissa mail worm seems to be forgotten, but there's a new generation of coders now that weren't even in school when that occurred.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
Years ago we were warned to turn off Outlook previews, for exactly this reason. Also, my copy of Outlook doesn't download or render attachments (or even images) unless told to, for every individual email. As far as I know, that is the default behaviour. The danger is that you can whitelist senders so that their attachments are downloaded without confirmation, and spammers often use commonly used email addresses as the originator.
The summary is incorrect as well. FTA: "The only condition is that the user views or previews the email in which the attacker has embedded a malicious Flash file." So you still need to click. The only exception is if your Outlook is set to always download attachments, show a preview, and if the malicious email is the last one to arrive, since the mail will then be shown in the preview window upon opening Outlook.
Lastly, Flash needs to die
If construction was anything like programming, an incorrectly fitted lock would bring down the entire building...
Providing access to people's computers and ensuring miserable but steady cleanup work for admins, relatives and acquaintances who "know computers" since time immemorial. Thank you, Microsoft and Adobe, for keeping the computer people fed over the holidays.
Why doesn't the summary mention that this was fixed by an update released on patch tuesday dec 8?
Sounds about right.
Given the scale of stuff being exploited in email. I am surprised at how Outlook handles Flash in emails.
... for using webmail.
I ditched PC-based email clients years ago and never looked back.
Plenty of good, reliable web-based options out there...
* It's yet another flash bug, Outlook is just the host instead of IE or whatever. If you still have Flash on your system you should just assume you are pwned already and post your bank account, credit card details and nude photos straight to 4chan to shorten the painful process
* It is not even zero-day, like many Flash bugs are, because it's already patched/fixed (by MS on the Outlook side by the looks of it)
* It only affects you if you have preview window on, _and_ the malicious email happens to be the first one in the mailbox when Outlook is started
* If you still remember when internet connection speeds were measured in baud and you had to whistle for your email, you will use email in the way $deity intended and get the headers first so (at least some of) the crap never even hits your system, making this even less likely
Still, the real patch MS should issue is the one that kills Flash, at least as an embedded object, forever, it is just a serial security hole that Adobe are incapable of maintaining properly.
and yet Thunderbird is end of life?
What idiot posted that story yesterday? HAHAHAH
Lastly, Flash needs to die
Just curious... why are people on a coding site declaring "Flash needs to die" instead of something like, Flash needs to be completely deconstructed and rewritten by the open source community using the most conservative style of programming, a system that forces a multi-person review of commits, hit with the best enumeration tools we have, so that arbitrary code execution is not possible? Which might be possible because processor speed has improved since it was first designed and the assembly level hacks that made it possible areno longer necessary? And when we are done, the worst thing that could ever happen is that someone might display goatse.cx inside a Flash window?
Instead of busting into the kitchen, grabbing pans off the wall and showing the chef how steak should be done, we sit at the table banging our forks and knives, shouting, "Down with meat!"
It's easy to make fun of Outlook, where with maliciously crafted embedded binary OLE blobs you can trigger exploits in many versions of Microsoft products. The faults lie in the products themselves not the Blob. But Flash self contained and lives inside a little rectangle. It is cross platform, amply documented and widely used today. Why must it die? So that generations of beloved Internet content can be 'destroyed' overnight? It almost smells like book-burning.
<blink>down the rabbit hole</blink>
because adobe
It doesn't allow external objects, like Flash, to be run by default, so you'd still be safe.
Stating the obvious here, but if I uninstalled all versions/instances of Flash from my Win 7 x64 system I should be pretty safe from at least this one, or should I? Note at the bottom: Now the only flash player that I have right now is the pepper flash version installed by/with Chrome. Oh, and just in case, this is my workstation - hence running Windows... mandated by company. I have couple of VMs to work in Linux/FreeBSD etc. but the main business desktop needs to be Windows.
Isn't it known to be insecure like since 2000?
Yet another example of why Flash should be uninstalled at the OS level. For example, on Windows this means removing the Flash ActiveX control. If you ever encounter a web page that needs Flash (they're becoming less and less common), just open it in Chrome, which you have configured to use Flash as click-to play.
The only reason that I use Outlook is that I want to be compromised.
I'm an American. I love this country and the freedoms that we used to have.
There's a scary thought. The developers working on Outlook today have never even heard of Anna Kournikova, much less had the pleasure of receiving thousands of emails about her from Outlook users.
That's actually a valid and important point. Flash files are executable code. How many dozens of significant vulnerabilities have been caused Outlook running macros, Flash, Javascript, and other types of executables embedded in emails? Outlook has at least three or four programming languages it can run from emails.
That's entirely unnecessary. Many people, including myself, have always used email clients that just read email - they don't, and can't, execute anything. If security is important to you, it makes sense to consider whether your email reader really needs to be able run code found within emails, whether your web browser needs to also be your desktop shell, as "a fundamental part of the Windows operating system", etc. There many are huge classes of vulnerabilities that can't happen if you choose software that simply does it's job, without hundreds of tangential features bolted on unnecessarily.
n/t
See subject: Heck w/ Outlook the program (part of MS-Office) or even outlook express - I'm concerned w/ the online model!
* I'd be willing to bet it probably does - stupid IE plays video MINUS EVEN ASKING YOU - which is WHY I like Opera (it has a by site or global preference you can setup to play ONLY ON DEMAND (i.e. when YOU click on video to activate it only)).
APK
P.S.=> Thanks for the answer - I didn't get to read the article well & am "tied up" doing plumbing + insulation and sheetrock/mud/tape work... apk
My Outlook 2003 isn't affected, yay!
thegodmovie.com - watch it
Outlook drives behavior toward that stupid preview pane, because Microsoft got cocky and assumed they had fixed the sandbox. You can't even configure the UI to not open the preview pane on new folders. You have to go into the folder, let the preview pane open, then go over to the tab where you can turn it off for just that one folder. As you are doing so, Outlook tells you that you're perfectly safe and should leave it open.
Idiots.
Apparently Outlook renders HTML-mail. That's unfortunately a common bug found in mail clients today. That's nearly as bad as some mail clients incorrectly encoding your mail as HTML.
Wow, that lead sentence is a train wreck, even by Slashdot standards:
"A new bug in Outlook allows attackers only to send you an email, and without clicking or downloading attachments, a user's computer can be compromised."
There's so much wrong that it's hard to know where to start, but as an example, are we claiming that the attackers had no choice but to send the attack email? (Would that be a defense in court?)
I'm pretty sure that what was meant is something like this:
"A newly-discovered bug in Outlook allows attackers to compromise a computer by merely sending an email, even if the victim doesn't click a link or download an attachment."