Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×

Zero-Day Team Launches with Emergency IE Patch 157

Posted by Zonk from the heroes-of-the-buggy dept.
Holy Mother of Thor writes to mention an eWeek article about a third-party patch for Internet Explorer. A dark horse security group formed after the WMF attacks in late 2005, the ZERT (Zero Day Emergency Response Team) has released a patch to attempt to slow the malware attacks on Windows. From the article: "'It is clear that we are dealing with an underground group of people who are writing exploits for profits. They are waiting for Patch Tuesday to pass, then it becomes Exploit Wednesday. We're seeing these zero-days in the wild, timed precisely to guarantee at least an entire month to spread,' Stewart said in an interview with eWEEK. Stewart, who is volunteering his reverse-engineering skills and time to ZERT in his private capacity, wrote an early version of the VML (Vector Markup Language) patch the group released Sept. 22 and worked closely with others to fine-tune the update to minimize potential glitches."
This discussion has been archived. No new comments can be posted.

Zero-Day Team Launches with Emergency IE Patch More

Zero-Day Team Launches with Emergency IE Patch

Comments Filter:
  • Third-party security vendor discovered in malware distribution scam!

    • Re: (Score:1, Insightful)

      by techpawn ( 969834 )
      Ahh. Example of no good deed goes unpunished. I might not install them on my machiene, but, if someone wants to clean up the mess after Tuseday's party. I say go for it.

  • Spyware Thursday (Score:3, Insightful)

    by Yahma ( 1004476 ) on Friday September 22, 2006 @10:22AM (#16160518) Journal
    So we now have Patch Tuesday, Exploit Wednesday, and now what? Spyware Thursday..?

    The majority of exploits could be stopped if Windows users switched to Firefox. However, getting Joe User to switch from IE to firefox is difficult, especially when he percieves no problems with IE. The majority of exploits in the wild today hide themselves from the user, and turn their machine into a Zombie node without their knowledge. Because Joe User doesnt know anything is wrong with his computer, he keeps using his unpatched IE and helps spread the exploit even further.

    Yahma

    Try http://www.blastproxy.com/ [blastproxy.com] for a fast, free and anonymous proxy to bypass firewalls at work & school
    Try http://www.mortgagetricks.info/ [mortgagetricks.info] for free tips, tricks and advice on how to get a low mortgage rate.

    • The majority of exploits could be stopped if Windows users switched to Firefox.

      This would also have the added effect of reducing the number of Slashdot posts villifying IE.

      • Re: (Score:1, Funny)

        by Anonymous Coward
        Useless posts yeah, they just rock.

    • Re: (Score:3, Insightful)

      by iPodUser ( 879598 )
      In my experience, it is not hard to convince "Joe User" to switch browsers. All I have to do is say: "ooh look tabbed browsing." If that fails, use "ooh look! Themes!" and they capitulate.
      However, you correctly identified what the real problem is: Uneducated users. Once someone gives them a good talking to, they usually see the light. It's just hard (impossible) to reach all of the uninitiated noobs out there.

      • One word: AdBlock. (Score:5, Informative)

        by Kadin2048 ( 468275 ) <.ten.yxox. .ta. .nidak.todhsals.> on Friday September 22, 2006 @10:44AM (#16160639) Homepage Journal
        I've also found a "killer feature" to be AdBlock.

        Okay, so it's not really a 'feature' of Firefox per se. But it's one of those things that even relatively ignorant users can grasp and realize the value of, and once you start using, there's really no going back. And it's so easy to install on FF, you can kind of sell it as a package deal.

        Set your mom/dad/grandmother/coworker up with Firefox+AdBlock+Filterset.G, and between the tabs and the lack of advertising, you'll probably have gotten a convert for life.

        The only problem is that in many cases it's not quite practical to throw away IE completely; there are too many online banks and other systems which count on it's braindead idiosyncrasies.
        • And they'll have no choice, because you can't download IE for OS X anymore from Microsoft.

          Of course, I'd try to lessen the shock by installing Firefox for OS X for them.
        • Just firefox ALONE makes most people I've shown it happy. Adblock is a boon but the first time adblock blocks something they want to see they'll throw it out. Firefox blocks popups, they'll be happy. Firefox blocks adware, they'll be happy. That's all you have to show them.
          • How do they know they need it if they can't see it? Must admit I've never hit this problem, but maybe it's for the reason I just outlined.

        • Re: (Score:2, Informative)

          by bannoy ( 870766 )
          The only problem is that in many cases it's not quite practical to throw away IE completely;
          IE Tab: https://addons.mozilla.org/firefox/1419/ [mozilla.org]

      • Re:Spyware Thursday (Score:4, Insightful)

        by tacocat ( 527354 ) <tallison1@@@twmi...rr...com> on Friday September 22, 2006 @10:56AM (#16160729)

        Never seen that happen. They don't want the "good talking to". They just want their stuff to work the way they are used to seeing it.

        Changing from MSIE to Firefox means you have to re-learn how to navigate around the browser. My wife went from Linux/Firefox to Apple/Safari and after a month she's bothered to figure out how to save bookmarks. She doesn't care about tabbed browsing settings or anything else. I think she's fairly typical in that she uses

        I cite this as one example of many.

        Not everyone is in love with their computer.

        The conversion of my family hasn't been because of a good talking to. It's been because I simply won't allow a Windows machine in the house. They've learned how to use Linux and Apple nicely enough and in some cases prefer to do their school work on Linux/Apple.

    • Re: (Score:2)

      by Aladrin ( 926209 )
      You make a good point, but take it a step further... The same people that can't be bothered to switch from IE to Firefox or Opera won't bother to patch IE with a third-party patch, either, even if they knew it existed! And even as an experienced computer user, I would not install a third party patch to IE without being insanely sure of the integrity of this group.
    • well, honestly, remove the IE icon from the desktop, put the firefox icon where the IE icon goes, and most users i know wouldn't know the differance.

      if they do, direct them to the themes download section or to the useless extentions. that'll get em to switch.
    • Right. Joe Sixpack won't stop using MSIE until his computer is so infested it takes 5 minutes to log in and his four-year-old daughter is getting innundated with pr0n popup ads, then after finding out what it costs to fully clean a machine (or wipe and reinstall, potentially losing data), only THEN will he listen and start using firefox.
    • What the fuck does a web proxy and mortage 'trick's have to do with the story? Put that shit in your sig.

    • Re: (Score:2)

      by Gilmoure ( 18428 )
      Here at work, we're stuck with IE due to the fact that a lot of the web apps we use are IE 6/MS JVM only. Until the CTO wants to address this, fecking web programmers will keep turning out these shit sites. We look at the help desk stats and almost half the calls are IE related. The rest are mostly Outlook freak outs. Truely the Budweiser of software.

      Oh well, at least on the Mac side, Firefox is the approved browser here. Windows users hate it when we tell them that yes, Firefox is supported, if you use a M
    • "However, getting Joe User to switch from IE to firefox is difficult, especially when he percieves no problems with IE."

      Not really... Months ago, I removed all the IE shortcuts from my g/f's machine and changed the Firefox desktop icon to the one with that big blue "e"... she didn't notice it until last week. Once I got done catching Hell for it and explained to her why I did it, she decided that it worked well enough anyway. I changed the icons back, and she's been using FF ever since. It's not that she'

    • Maybe this "dark horse" patching group should instead concentrate on releasing their own exploits that DISABLE Joe Bloggs' computer, that would soon galvanise him into action. As you pointed out, the blackhat stuff installs itself stealthily and the user could be none the wiser. But he'll soon do something if instead of getting his desktop he gets a message telling him his computer is insecure and he cannot use it until he takes these steps. It could even download & install Firefox for him.

  • time better spent elsewhere (Score:3, Insightful)

    by Anonymous Coward on Friday September 22, 2006 @10:22AM (#16160523)
    Their time would be better spent on improving Free Software instead of trying to plug holes of closed-source software. Microsoft does not appreciate help like this.

    • Re: (Score:2, Insightful)

      by mdpye ( 687533 )

      Their time would be better spent on improving Free Software instead of trying to plug holes of closed-source software. Microsoft does not appreciate help like this.

      They don't expect MS to appreciate this, if anything they probably want to embarrass them. They are trying to help the customers who have been abandoned by MS. Of course the value of that is also debatable, but if you RTFA they are concerned about the effects such exploits have on the general Internet populance in terms of SPAM, worm traffic,

    • i don't imagine they're trying to get on microsoft's good side. i would think that they're basically trying to annoy them, as in "hey! we're a little team of upstarts and we fixed the hole faster than the big guys!".
  • Don't use Internet Explorer.

    I've had to use IE at a training site this week and it's amazing how cumbersome and clunky it is to use since I've become used to using Firefox. Simple things like being able to scroll down a page before it completely loads, right-clicking and opening a new tab (not window) and just overall speed.

    The use of Firefox, and other browsers, really needs to be pushed to slow and/or prevent these exploits from compromising peoples systems. It's an easy solution and doesn't require any

    • Re:An even simpler solution (Score:5, Informative)

      by robpoe ( 578975 ) on Friday September 22, 2006 @10:30AM (#16160562)
      Wish that were the case ..

      I manage several networks .. and on those networks we tried limited rollouts of Firefox ..

      1. Proxy settings. All the users at one site HAVE to go through a proxy server. It's a transparent server, but offers us logging (required by law) and it helps with the overloaded internet connection Set the proxy settings in Firefox, and a user need only go Tools | Options | General | Connection Settings to turn them off. No way to disable the menu, without going in and re-writing the XUL code. IE? Easy, shove a .reg file to the machine to disable access to that tab. Easy to bypass, yes. For a geek. But for a general user, not quite so easy for them.

      2. IE Only Sites. There's nothing more than I'd love than to put Firefox and remove IE from people's desktop. In fact, I do at every chance I get. But telling someone that if they come across a site that FF doesn't work with - the site isn't worth it for them, and it turns out their BANKING or STOCK site doesn't work ... well your credibility just got shot down.

      • Re: (Score:3, Interesting)

        by ericlondaits ( 32714 )

        IE Only Sites. There's nothing more than I'd love than to put Firefox and remove IE from people's desktop. In fact, I do at every chance I get. But telling someone that if they come across a site that FF doesn't work with - the site isn't worth it for them, and it turns out their BANKING or STOCK site doesn't work ... well your credibility just got shot down.

        Worst part is, the sites I had problems with so far while using Firefox were all based on Flash. It seems that IE and FF handle screen coordinates di

      • Re:An even simpler solution (Score:5, Informative)

        by Daemonstar ( 84116 ) on Friday September 22, 2006 @10:46AM (#16160650)
        Comments: 1) Make all outbound port 80 requests be routed via the transparent proxy; there shouldn't be any settings in each workstation's browser. This forces everything through the proxy, no matter what. Add other ports (i.e. 8080, etc.) as appropriate. 2) If Firefox doesn't work with some sites, then install the IE View and IE Tab extensions. You can change the rendering engine for the page in Firefox. Yes, it does use IE, but, that way, your users can view most sites in Firefox without switching applications (99% of the time, anyway). You will still have to keep IE patched.
        • Last I heard (months ago), they were broken, and they could make ALL your tabs IE, or all not... but no way to mix'n'match. I'll have to check them out again now that they're fixed.
          • You can have mixed tabs. You can even set certain cites to always open in an IE tab. My girlfriend has to log into a web based CRM at home and it doesn't quite work right with Firefox. She uses IE tab and sets that one site to open only in IE and it works like a charm.

      • Re: (Score:2, Interesting)

        by nithinsujir ( 592733 )
        "But telling someone that if they come across a site that FF doesn't work with - the site isn't worth it for them, and it turns out their BANKING or STOCK site doesn't work ... well your credibility just got shot down." I disagree. It just means their BANKING site doesn't pay much importance to security and so it isn't worth it in the long run.

      • Re: (Score:3, Interesting)

        by jd142 ( 129673 )
        Easy, shove a .reg file to the machine to disable access to that tab. Easy to bypass, yes. For a geek. But for a general user, not quite so easy for them.

        GPO. Then they can't bypass it because the setting will be re-applied.

        Also, you can edit one of firefox files that's just plain text to hide those menu settings. It's been awhile since I've done it, but if you do a search for firefox and kiosk you should find the instructions.

      • Re:An even simpler solution (Score:4, Informative)

        by savala ( 874118 ) on Friday September 22, 2006 @10:52AM (#16160695)
        No way to disable the menu, without going in and re-writing the XUL code. IE? Easy, shove a .reg file to the machine to disable access to that tab. Easy to bypass, yes. For a geek. But for a general user, not quite so easy for them.

        If the .reg file is an adequate solution for IE, then a userChrome.css file that simply sets the relevant preference panel to display: none, and a user.js file to reset the proxy settings at each startup (in case the user knows how to find about:config) should be equally adequate.

        Just went to look it up. They of course didn't bother to tag the groupbox with an id ("grandmothers don't need easily modifiable chrome!" - meh, give me SeaMonkey any day of the week), but you can hide the "connection settings" button with the following rule: #catProxiesButton { display: none !important; }

      • Re: (Score:2)

        by Qzukk ( 229616 )
        and it turns out their BANKING or STOCK site doesn't work

        There are plenty of bank and stock sites out there, and most work fine. Ask them if they'd date someone who wouldn't accept their phonecalls until they switched cellphone providers and joined their "friends plan". If they say they wouldn't, ask them why they accept the same from their bank.
        • But maybe he would, if the person he was dating provided the phone at no cost, the plan at no cost, noted that he could talk to other women on it while they were dating, could use it to pick up other women after they broke up, and that some other particularly attractive women wouldn't accept calls without the change, either.

          But even then, the analogy is flawed. A better question would be:

          Would you divorce your wife if she decided that you had to switch from Sprint to Cingular, it wouldn't cost you anything

      • Re: (Score:3, Informative)

        by Dr_Barnowl ( 709838 )
        Well, as you point out, one solution is to patch the code for yourself. If IE *didn't* have the feature of being able to selectively disable UI elements, what do you think your chances of successfully badger Microsoft to implement it would be? An academic question, but one worth thinking about. A less academic thing to think about is the risk of IE infecting your machines, and the extra work required to negate this risk, and to repair damage when it occurs.

        My second suggestion would be to set up a transpare

      • Re: (Score:2, Informative)

        by pixelpusher220 ( 529617 )
        Did you try Googling for your problem?

        'lock firefox proxy settings'

        The first hit is this link [ilias.ca]:

        Granted it's Mac, but it shows you that Firefox can indeed lock it's proxy settings. And without really delving into the article it looks as if it would be very difficult to override by 'non' geeks.


      • Re: (Score:2, Interesting)

        by pixelpusher220 ( 529617 )
        and the second point:

        Firefox plug-in IE View [mozilla.org]

        Description: Lets you load pages in IE with a single right-click, or mark certain sites to *always* load in IE. Useful for incompatible pages, or cross-browser testing.

        I like the idea that you can tell users, if it doesn't seem to look right, try this...and then have them default the few non-compatible sites to use IE. Trains them that IE is 'different' and Firefox is more standard.
      • the site isn't worth it for them, and it turns out their BANKING or STOCK site doesn't work

        Unless they are upper management... Then why are they looking at their Banking or Stock sites at work?!

        As for upper management... Well... They'll just get IE Tab plug in for Firefox.

      • Re: (Score:3, Insightful)

        by mrdaveb ( 239909 )
        It's a transparent server

        Well it clearly isn't a transparent proxy if you have to configure it at the client end.

        Anyway, if the proxy is compulsory surely you should block all direct web traffic so that it actually is compulsory!

      • Re: (Score:2)

        by jafac ( 1449 )
        I'm pretty much the only hardcore Windows guy in a mostly Linux shop. Personally, I'm not a big fan of Microsoft or their business practices, or their technology. But my Linux co-workers are often AMAZED at the stuff I can do using Group Policy to lock down and configure an entire network of desktops.

        Yeah, I wish we could put Open Office and Firefox on all our Windows desktops too. But you can't centrally manage security and configuration of those like you can with MS Office and IE. (Yeah, my customer i

        • Re: (Score:2)

          by robpoe ( 578975 )
          Exactly.

          I posted an Ask Slashdot question .. about deploying OOO across a corporate network. The things I needed (such as setting OOO to use .DOC by default, not showing the NAG screen for every user, etc) are stored in XML or TEXT files. Sure, I could do some stupid kludgy thing and modify them for every user who logs in but jeez -- who has the freaking time..

          People who write OSS are going to have to learn something extremely valuable. And learn it from Novell. You can fight Microsoft. You will lose.

      • Re:An even simpler solution (Score:4, Informative)

        by Phroggy ( 441 ) * <slashdot3@ p h roggy.com> on Friday September 22, 2006 @12:42PM (#16161566) Homepage
        1. Proxy settings. All the users at one site HAVE to go through a proxy server. It's a transparent server, but...

        What you're describing is not a transparent proxy server. It's just a normal proxy server, that has to be configured in the browser. A transparent proxy server is where your firewall hijacks all outbound traffic on port 80 and reroutes it to the proxy server's IP without the browser knowing about it. This would solve your problem.

        Another option you may want to look into (it won't help with the issue of users being able to turn it off, but it might make configuration easier) is Web Proxy Automatic Detection (WPAD). Start by making a Proxy Automatic Configuration (PAC) file, which is just a bit of JavaScript code that tells the browser what proxy server to use. For example:

        function FindProxyForURL(url, host) { // Don't use a proxy when connecting to local servers
            if(isInNet(host, "192.168.1.0", "255.255.255.0")) return "DIRECT";
            return "PROXY proxyserver.example.com:3128";
        }

        Put this file on an internal web server. Name the file "wpad.dat", and configure the server to give the MIME type as application/x-ns-proxy-autoconfig, for example:

        <Files wpad.dat>
                        ForceType application/x-ns-proxy-autoconfig
        </Files>

        Now, configure your internal DNS server to add a host "wpad" at whatever domain you're using internally to point to your web server, so that http://wpad/wpad.dat [wpad] will return the PAC file you've created.

        Finally, to cover all the bases, make it explicit in your DHCP server. Set this global option in dhcpd.conf:

        option wpad code 252 = text;

        Then add this within your subnet declaration:

        option wpad "http://wpad/wpad.dat\n";

        Internet Explorer breaks without the trailing \n. I'm not sure if it has to be \n, or if some other character would work better, but this seems to work just fine.

        Sounds complicated! But just remember, you only have to do this once. Internet Explorer and Firefox will both respect it automatically, out of the box, with no client-side configuration at all. One caveat: Mac OS X does not currently support WPAD; I'm hoping Apple fixes this in 10.5 "Leopard" next spring, but I haven't seen anything official about it. In the mean time, Mac clients have to set the URL of the PAC file manually. WPAD works in Firefox on Mac, but see bug 327381 if you're running it on a laptop (I don't know if that bug applies to Windows as well).

      • Re:An even simpler solution (Score:4, Informative)

        by Shawn is an Asshole ( 845769 ) on Friday September 22, 2006 @01:08PM (#16161743)
        Set the proxy settings in Firefox, and a user need only go Tools | Options | General | Connection Settings to turn them off. No way to disable the menu, without going in and re-writing the XUL code.

        It's actually pretty easy to disable anything in Firefox/Mozilla.

        1. Open Firefox and set the options you want to preconfigure/lock such as the proxy settings.

        2. Look in Firefox's config directory for a file called "prefs.js". Under Linux this is in "~/.mozilla/*.default/". Under Windows, this is in "Application Settings\Mozilla\*.default\". On OS X it's in "Library/Mozilla/Firefox/*.default/".

        3. Copy the file to lock.js and open it in a text editor.

        4. Leave the first line as is (the # line). For any option you want to lock, set "user_pref" to "lockPref". For example:


        # this line is required. don't remove
        lockPref("network.proxy.ftp", "proxy.somemachine.org");
        lockPref("network.proxy.ftp_port", 3128);
        lockPref("network.proxy.http", "proxy.somemachine.org");
        lockPref("network.proxy.http_port", 3128);
        lockPref("network.proxy.ssl", "proxy.somemachine.org");
        lockPref("network.proxy.ssl_port", 3128);


        5. Download moz-byteshift.pl [knaff.lu] and run it like this:


        moz-byteshift.pl -s13 < lock.js > mozilla.cfg


        6. Copy the mozilla.cfg file to the root of the Firefox install directory. This is "/usr/lib/firefox/" on most Linux distros, and "c:\windows\Program Files\Mozilla Firefox\" on Windows. On OS X it's in the "Firefox.app" directory.

        7. Inside of the Firefox install directory, open the file "greprefs/all.js" and add this line to thee bottom:


        pref("general.config.filename", "mozilla.cfg");


        The user can no longer change the proxy settings, or any other setting you choose to lock.

        This works everywhere and options are identical across platforms (except when they include file paths). The only place I haven't had it work is Ubuntu, which apparently does something to break the feature. The method they provide to provide the functionality does not appear to work (I spent a few days googling and trying everything before just disabling the built-in and installing the official build).

        Deploying is easy. All you have to do is copy the greprefs/all.js and mozilla.cfg files to the clients. With WPKG this is trivial. Just make sure only the administrator can write to all.js and mozilla.cfg, also make sure that all users can read the file.

        Here, I'll even help you out with WPKG. Just save "mozilla.cfg" and "greprefs/all.js" as a self-extracting file with 7-Zip:


        <?xml version="1.0" encoding="UTF-8"?>
        <packages>
        <package id="firefox_restrictions" name="Firefox restrictions" revision="20060922" reboot="false" priority="1">
        <depends package-id="firefox" />
        <check type="file" condition="exists" path="%PROGRAMFILES%\mozilla.cfg" />
        <install cmd='%SOFTWARE%\firefox_restrictions\firefox_restr ictions.exe -o"%PROGRAMFILES%\Mozilla Firefox\" -y' />
        </package>
        </packages>


        Any time you need to push new updates out, just change the revision to the current date.

      • Re: (Score:2)

        by pe1chl ( 90186 )
        No way to disable the menu, without going in and re-writing the XUL code.

        This is not true. There certainly is a lot of room for improvement in the Firefox configuration settings management, but what you write can be accomplished by using a locked preferences file.
        (assuming that your users cannot write in the Program Files directory and you install Firefox using some automatic installation system)

      • 2. IE Only Sites. There's nothing more than I'd love than to put Firefox and remove IE from people's desktop. In fact, I do at every chance I get. But telling someone that if they come across a site that FF doesn't work with - the site isn't worth it for them, and it turns out their BANKING or STOCK site doesn't work ... well your credibility just got shot down.

        There is a way to work around that. Here's what I do.

        Install the "IE Tab [mozilla.org]" extension. Extensions are fairly easy to deploy with WPKG, but I'm not g

    • Re: (Score:2)

      by Tim C ( 15259 )
      Simple things like being able to scroll down a page before it completely loads

      One thing that does irritate me about FF is that it won't fill-in username and password fields until the page has completely finished loading (at least not in my Windows/1.5.0.7 install). That's a pain when the site is slow, or includes a slow-to-download third part resource (I'm looking at you, google analytics...) - do I start typing now, and risk FF filling in stuff along side it, or just wait?

      No, it's not a big problem, but it

  • Who didn't see this coming (Score:4, Interesting)

    by George Beech ( 870844 ) on Friday September 22, 2006 @10:25AM (#16160540)
    I mean really, it just seems logical if they are only going to patch once a month, then the bad guys will go after every hole that wasn't patched the day after updates are released.

    I'm just amazed that it took this long for it to become big news that this kind of thing is going on.

    • Re: (Score:2)

      by joe 155 ( 937621 )
      Indeed, but I think that they could stretch it further, it would depend on their motives. If all I want is profit (which is what the article says is going on) then they could start rolling out the new spyware/malware etc. on tuesday itself - there just wouldn't be enough time for them to write a fix and test it, so they're still safe. And that's even if they find it the day it comes out

      If they're doing it for prestige then it could be good for them to start releasing about 10 holes (and make MS know abo

  • Suprised (Score:3, Interesting)

    by joshetc ( 955226 ) on Friday September 22, 2006 @10:26AM (#16160543)
    Honestly I'm suprised it took this long for something like this to happen. You patch once a month on a specific day.. obviously they are going to time their attacks for when they will inflict the most damage.
    • No shit. God forbid they should actually patch their stuff when they have a patch available. Last I checked, security wasn't supposed to happen at intervals, it is continually evolving.
    • My recollection is that most of my clever geek friends actually laughed when they first heard about Patch Tuesday. Within a fraction of a second of hearing the news, it was easy to predict that malware releases would be timed to exploit the month lag for patching institutionalized by Patch Tuesday. I would be greatly surprised if there weren't some comments to this effect in the Slashdot archive the day the Patch Tuesday strategy was announced and columns in the IT rags within a few days. It had already

  • Alternative: Unregister vgx.dll (Score:5, Interesting)

    by Noksagt ( 69097 ) on Friday September 22, 2006 @10:32AM (#16160576) Homepage
    The latest Security Now! [grc.com] episode had information on this exploit. Those who have policies in which they can't install third party patches do have an alternative:
    regsvr32 -u "%CommonProgramFiles%\Microsoft Shared\VGX\vgx.dll"
    When MS comes out with a patch,
    regsvr32 "%CommonProgramFiles%\Microsoft Shared\VGX\vgx.dll"
    will re-register it.

  • Why must the internet be neutropenic? (Score:3, Interesting)

    by Control Group ( 105494 ) on Friday September 22, 2006 @10:33AM (#16160578) Homepage
    This is neat. Kudos to these guys, and I'm glad they're doing what they're doing.

    But it isn't a long-term solution; it still depends on human-speed recognition of the exploit and development of a patch.

    What we need is the spread of viruses/worms/trojans whose payload is the removal of malware. Internet antibodies, as it were. The ultimate goal ought to be an antibody - or, to coin a term, an ant.iBody (ant.eBody?) - software that heuristically determines what is malware and what is legitimate software, preventing the former while allowing the latter and propagates itself across the network.

    Of course, deploying something like that would break all sorts of computer security laws...but it's not like that stops anything else.
    • You have to think though, if someone did start sending a spred of "internet ant.iBody"'s, how would the average Joe know what was good and what was bad? I wouldn't trust any of them but people will say "oh its trying to help" and end up downloading god knows what and then bother me cause they get a penis popup every time they start IE.
      • But these people already don't care what ends up on their machine. I seriously doubt that the consequences of Joe Sixpack being made more complacent about computer security (if that's even possible) outweigh the benefits of having Joe Sixpack's complacency used to help clean up the problem.
        • I think in most cases they do care, but just have no idea what to care about.
          The machie is dog slow? They don't realise it's a bot, they just assume that the machine is old.
          -nB
    • I suppose it wouldn't be that hard to buy some 0 days and code a worm that exploits them to virally install some security suite or at least kill the tcp stack of infected machines. But you would need a covert ops team of a few people and some money to buy the sploits. Who's going to fund this? Besides, it woudln't take long for the bad guys to smell the coffe and become even more secretive about their sploits - I believe they are traded regularly ATM but who knows what might happen if such a scenario were t
      • As secondary effects go, though, hampering lines of communication between malware writers by compromising trust isn't so bad.

        Even if the development of fixes to exploits isn't accelerated, and the heuristic approach fails, having hordes of zombie boxes that are zombies specifically for the purpose of distributing malware fixes has got to be faster than trusting people to consciously patch their own computers.

        The beauty of it is, of course, that the very people least likely to notice, care about, remove, or
    • What we need is the spread of viruses/worms/trojans whose payload is the removal of malware...Of course, deploying something like that would break all sorts of computer security laws.

      Perhaps the way to do this is to do the one thing the black hats are not doing: Get the user's consent to install. Use the same IE exploits, but with consent.

      I like the idea of reputable, popular sites offering immunization anitbodies to malware viruses as part of the IE browsing experience. Some people will go ahead and instal

  • Poor Stew. (Score:5, Funny)

    by twitter ( 104583 ) on Friday September 22, 2006 @10:40AM (#16160615) Homepage Journal

    Stewart said in an interview with eWEEK. Stewart, who is volunteering his reverse-engineering skills and time to ZERT in his private capacity, wrote an early version of the VML (Vector Markup Language) patch the group released Sept. 22 and worked closely with others to fine-tune the update to minimize potential glitches."

    Very noble of him to volunteer, but we all know what happens in the movies to the character who mistakenly sacrifices themselves to defend the bad guy. At this moment, chairs are flying and the heavy weights at M$ are screaming things like, "This guy is making us look bad! Steve smash!" A much cooler arch villain grins a maniacally at his underling and contemplates co-opting as much of the work as possible before dropping both of them into a pool of red hot magma.

    What will the real world fate be for poor Stew? DMCA suit? C&D for trade secret or patent infringement? Who knows! But none of it will really make windoze a place that's safe for your work.

    • Re: (Score:2)

      by httptech ( 5553 )
      As long as they don't call me Stew... I really dislike that.

      -Joe
      • But it's gotta be better than Wart, right?

      • Re: (Score:2)

        by twitter ( 104583 )

        As long as they don't call me Stew... I really dislike that.

        Sorry, cuts of meat simmering all day on the stove just seemed appropriate. It was not supposed to be insulting. Good luck.

    • Re: (Score:3, Funny)

      by uufnord ( 999299 )
      I want to point this out:

      Other volunteers involved with the ZERT initiative include
      * Halvar Flake, CEO and head of research at Sabre Security;
      * Ilfak Guilfanov, author of the IDA Pro binary analysis tool;
      * Paul Vixie, founder of the ISC (Internet Software Consortium);
      * Roger Thompson, chief technology officer of Exploit Prevention Labs;
      * Florian Weimer, a German computer expert specializing in Linux and DNS (Domain Name System) security..

      These guys are top-notch. I can't give enough praise to show

  • The Church of Microsoft (Score:3, Interesting)

    by erroneus ( 253617 ) on Friday September 22, 2006 @10:40AM (#16160616) Homepage
    I think they should have been a LOT more religious about writing secure code back when they claimed to be focusing on security and such. I haven't noticed any slowdown in the frequency on new exploits and no real increase in the delivery of patches. But if they haven't found religion in writing secure code, I think it's about time they did.
  • Let's be honest here. Why the hell did someone come up with the concept of "patch Tuesday" in the first place? It was a no brainer that OF COURSE exploits would be launched right the day afterwards if you can predict the patchday. Actually, an analysis of our malware early warn "radar" tells that the exploits are launched pretty much in sync with the advent of the patch.

    What did MS think when coming up with the idea of "patch Tuesday"? Sure, it's something you can adjust to as an admin, knowing exactly when

    • Re: (Score:2)

      by 0racle ( 667029 )
      Why the hell did someone come up with the concept of "patch Tuesday" in the first place?
      Because some people manage networks professionally instead of systems in their parents basement.
      • I've been in that biz myself. Of course it's convenient to know ahead of time when you're gonna roll out a patch. But critical problems need to be addressed NOW. Not in a month. Yes, it's a hassle to get a patch "overnighted" because it was dumped on your table at 4 in the afternoon, but it's still less hassle than getting the net clean again after the worm chewed through it.

        • Re: (Score:2)

          by 0racle ( 667029 )
          Critical problems are not held back until patch Tuesday. However they are not released until at least some tests have been run on them, and no admin with even a single brain cell would install a patch just because someone said it's critical without testing it on their own environment.

          There will alawys be a time difference between a problem being found, a patch being released and finally that patch being applied. Having a single day where most patches will be released allows large sites to properly schedule

          • Re: (Score:2)

            by pe1chl ( 90186 )
            Critical problems are not held back until patch Tuesday. However they are not released until at least some tests have been run on them

            If you examine the monthly load of patches, you will find that it regularly occurs that critical or important patches are released on patch tuesday that have been compiled weeks or even more than a month before.

            Now, you would think that would give them some time to test. However, the results of those tests are not used to determine if a patch is going to be released the next

    • Re: (Score:2, Insightful)

      by kingofwaldos ( 645744 )
      I agree. MS delaying patches is dumb. If large corporations want a schedule for their updates, by all means, they should make one -- of their own. If MS released updates when they were finished and ready, large shops could still schedule their updates however they wanted. If they felt a patch warranted updating early, they could deploy. Why depend on Microsoft to decide that for you?
    • Probably that security expert that now works for mozilla...hey lets only patch boxes on tuesdays...yea great idea..
  • *scene takes place in Interview room, a panel of HR and tech types; applicant being interviewed

    We're not that interested in your l33t h4x0r skillz. How good are you at time travel?

    A demonstration? Sure. No, you dont have to take your clothes off now, that's only in Terminator; it's just a movie. Put them back on now. I said put them back on. I know it's cold in here. And the physical takes place when you're actually hired. Next please.
     
  • The source code for all of ZERT's unofficial fixes will be released along with the testing methodologies used during the patch preparation.

    Now it appears to me that this is an open source solution to a proprietary problem. Isn't this what the OSS crowd has said all along - that the OSS side gets patches out in a much more timely manner? Also, does anybody know what license is being attached to these patches?

  • MS can do it as fast as these little twerps (Score:3, Insightful)

    by 140Mandak262Jamuna ( 970587 ) on Friday September 22, 2006 @11:12AM (#16160863) Journal
    Of course MSFT can find the bug as fast or faster than these thirdparty do gooders. And if the aim is to stop the exploit they can do that too as fast. Did you notice how fast they fixed the WMP DRM breaking exploit? They can do these things if they want to. Infact they can even make IE as exploit proof as FF if they want to.

    But they dont want to. There are thousands and thousands of sites that have hacked up code to step around the bugs in IE. They all will break if they lost back ward compatibility to these harebrained hacks that depend on the bugs in IE. MSFT considers it a big loss of face if more sites work in FF than in IE. If they fix all their bugs and holes in IE, more sites will work in Opera and FF than in IE. That is a big no no. That is why they tread cautiously making sure they fix the hole, just that hole, and nothing but that hole, and fix it just enough, so that most of the other hacks can continue to work. That is why they are so slow in responding. That is why the fix has to be fixed and fixed again.

  • At work I let my IT department deal with it. Serves them right for being a Windows shop. At home I don't use Windows. This really isn't anything that matters to me.
  • There are good reasons for Microsoft to be careful with its patching, since it's so easy to break things. What if they adopted a strategy for, rather than patching out vulnerabilities, but instead filtering them out? Like an antivirus program, you'd scan media content for attacks and then disallow them if attacks are found. This strategy could result in an update cycle measured in days, or even hours, rather than weeks.

  • The patch can be downloaded..... (Score:4, Funny)

    by 8127972 ( 73495 ) on Friday September 22, 2006 @12:07PM (#16161297)
    .... from any of the following links:

    www.getfirefox.com
    www.opera.com
  • So what.

    There's a better solution to all these problems. Properly implemented QoS on ISPs and Servers so that the extra bandwidth usage generated by this crap doesn't prevent those of us running secure systems (Windows on a tight-ship, Linux or OS X) don't get hosed by the unwashed masses.

    The vast majority of malware traffic isn't 0-day; it's ancient stuff running on older unpatched systems. As long as they don't bump us off the interwebs, I don't see why I should care.

    Patching & Cleanup are a poor solu

Slashdot Top Deals

"Ninety percent of baseball is half mental." -- Yogi Berra

Close