Exploit Released for Unpatched Windows Flaw 386
woodchuck writes "Washington Post reports that another Windows hole has been found and exploit code is now running lose that makes swiss cheese of current patches and security measures.
From the article: "Security researchers have released instructions for exploiting a previously unknown security hole in Windows XP and Windows 2003 Web Server with all of the latest patches applied. Anti-virus company Symantec warned of the new exploit, which it said uses a vulnerability in the way Windows computers process certain image files (Windows Meta Files, or those ending in .wmf). Symantec said the exploit is designed to download and run a program from the Web that downloads several malicious files, including tools that attackers could use to control vulnerable computers via IRC.""
Easy workaround to avoid the exploit (Score:5, Informative)
REGSVR32
Sunbelt has more detail here [blogspot.com].
Re:Easy workaround to avoid the exploit (Score:3, Informative)
If you can remove ALL associations to the fileformat (at least until the extent is known) this would be beneficial.
Users of webbrowsers (all) must be careful when saving image files of type WMF.
Once saved on your computer the associated image viewer is used to display the file.
Take care with IM and email attachments as well, because this is another possible vector.
Breaks thumbnails and Windows Picture Viewer (Score:3, Interesting)
Anyway, losing thumbnails and that program is IMHO a very minor price to pay for not having your machine rooted. So just make sure and warn others before you tell them to use this temporary workaround.
I wonder how long we will have to wait for MS to fix this one? Oh well, more money for me if they don't.
Re:Breaks thumbnails and Windows Picture Viewer (Score:3, Funny)
I'll take my chances, they still gotta get me to open a stupid
Re:Breaks thumbnails and Windows Picture Viewer (Score:4, Informative)
Re:Easy workaround to avoid the exploit (Score:4, Informative)
Re:Easy workaround to avoid the exploit (Score:2)
You probbaly have some kind of image viewing app (usually bundled with digital camers). Otherwise try a free one, eg Irfanview. Install and it will take the jpeg association and display them, allow you to move, rename, and do basic image editing as well.
Re:Easy workaround to avoid the exploit (Score:2)
Re:Easy workaround to avoid the exploit (Score:2, Informative)
Great advice.
Small price to pay (Score:2)
Small price to pay for security. I'd rather give up thumbnails (they slow down explorer anyway) and avoid being r00ted by the latest internet worm.
Microsoft has released a security note (Score:2)
how long? (Score:2, Insightful)
Upside. (Score:5, Funny)
With Vista you'll be able to get this from the comfort of an RSS feed!
Fix from article (Score:5, Informative)
----
According to iDefense, Windows users can disable the rendering of WMF files using the following hack:
1. Click on the Start button on the taskbar.
2. Click on Run...
3. Type "regsvr32
4. Click ok when the change dialog appears.
iDefense notes that this workaround may interfere with certain thumbnail images loading correctly, though I have used the hack on my machine and haven't had any problems yet. The company notes that once Microsoft issues a patch, the WMF feature may be enabled again by entering the command "regsvr32 shimgvw.dll" in step three above.
----
I'm not sure if you need to type this every reboot, or just once. Since it requires re-enabling, I'm hoping it's just once.
Re:Fix from article (Score:4, Informative)
regsvr32 registers a COM/ActiveX "server" by modifying Windows registry entries. So, in theory, you need only run it once.
It is possible, however, that if you later install other software, the installer may re-register the DLL in question, in which case you'd want to manually unregister it again.
(Hmm. I suppose it's only coincidence that this novel approach [thedailywtf.com] to registering appeared on thedailywtf yesterday...)
Re:Fix from article (Score:2)
Broke thumbnail feature - big deal (Score:2)
Broadband Reports' Security Forum Thread... (Score:5, Informative)
Re:Broadband Reports' Security Forum Thread... (Score:3, Interesting)
I downloaded the wmf file to my desktop, but accidentally double clicked it when I was trying to submit it to trendmicro
I closed the connection with TCP View [sysinternals.com], but it took out explorer.exe with it.
This is much worse than potential spyware, this exploit is silent and can easily be used to drop keyloggers, or in my case, it opened up a shell back to the guy i was chatting with.
(btw - I knew it was a trojan when i downloaded it)
Re:Broadband Reports' Security Forum Thread... (Score:2)
Post to Broadband Reports' Thread... (Score:4, Interesting)
There's an excerpt of our chat in that post too.
In other news... (Score:4, Funny)
Scary. (Score:5, Funny)
Essential part of Windows experience (Score:3, Insightful)
Re:Scary. (Score:5, Informative)
That's what they say in the article but the only thing I did was to open a
The thing just auto-installed it-self from that point.
Re:Scary. (Score:2)
Re:Scary. (Score:2)
That still isn't a FF issue.
How/Why does thi skeep happening (Score:3, Interesting)
program running on my client computer can be
made to execute code? Honestly, I don't really understand
these exploits that supposedly take advantage of
a client buffer overflow (or some such thing) to execute
code on my local machine. What makes the instruction pointer in
the code that is reading (in this case) the wmf file suddenly
jump to code that is in the data segment? (Presumably embedded in
the wmf file itself).
Re:How/Why does thi skeep happening (Score:5, Insightful)
Re:How/Why does thi skeep happening (Score:5, Informative)
Good stack overflow exploit code is pretty reusable for exploiting newly discovered stack overflows with little modification, which makes these exploits appear so quickly after a new vulnerability is discovered. There's also something called a heap overflow, but using it to run executable code is quite a bit harder and must be tailered to each specific vulnerability.
Re:How/Why does thi skeep happening (Score:3, Informative)
Re:How/Why does this keep happening (Score:2)
Bleeding snort rules here: (Score:2)
Genius Idiots. (Score:5, Insightful)
In other words, whatever asshat took advantage of this loophole did so because he thought he could make a buck. If his goal was simply to bring Windows to its knees, cause havoc, or make a political/economic statement of some sort, he would have chosen something else. Wiping out My Documents of all the infected machines, for example.
Whoever did this is obviously deluded. While some money will of course ultimately flow from this nonsense to the "see no evil" people who are the beneficiaries of spamvertisements, spyvertisements and so forth, the actual exploiter basically has little to know chance of getting it (even if he is in Russia, as I'd suspect is a good bet) as his affiliate commission links will be tracked, as will wherever the hell that credit card box for SpySherriff was pointing to and so forth.
So we have somebody smart enough (and make no mistake, it takes some smarts) to either discover or be in a small clique of people discovering a quite obscure loophole (it must be obscure, given just how old the affected .dll is), but have ABSOLUTELY NO FUCKING CLUE how to go about exploiting it other than in the most juvenile and unlikely way to fail imaginable. Furthermore, even though it is likely to fail, the guy has shown himself to basically be a psychopath, with little to no concern about the hundreds of thousands of hours (read: PEOPLE-LIFE-EQUIVALENTS) that will be spent agonizing over and fixing this.
Whoever that person is, they are human filth. But, there's a lot of human filth out there. The sad thing is that this person obviously has potential to do so much more but simply pisses it away intead. Pathetic.
Smitfraud-C (Score:2)
The tool to remove that crapware is called smitrem, available here: http://noahdfear.geekstogo.com/ [geekstogo.com]
Watch out for Google Desktop (Score:5, Informative)
From F-secure's blog [f-secure.com]:
steps ahead (again) (Score:3, Funny)
10) find big remote vulnerability in product
20) perfect the exploit
30) have fun with it for months
40) find another big hole in same product
50) perfect exploit for hole
60) alert vendor about original hole
70) have fun with new hole
80) goto 40
Already being used by scumware sites? (Score:2, Insightful)
Additional Resources (Score:3, Informative)
Also, take a look at this movie from websense: http://www.websensesecuritylabs.com/images/alerts
Nasty! (Score:5, Informative)
I traced it to an ad within an ad within an ad that sources a WMF file in an iframe. If you want to see this thing in action then use VMWare to load the following link: h**p://iframeurl.biz/dl/xpladv470.wmf. After all is said and done, you'll have trojan.byteverify, trojan.dropper, trojan.bookmarker, download.trojan, w32.conycspa.G@mm, backdoor.shellbot, backdoor.trojan, w32.looksky.A@mm, among others. I also had some new DLLs that were particularly hard to get rid of - msupdate32.dll, msctl32.dll, uytpu.dll, qrlmq.dll - all in the system32 directory.
This has actually never happened to me. I am religious about keeping Windows and my antivirus software up-to-date. It was a good learning experience to see it all in action.
And, by the way, I was not browsing for porn. I was doing a google search for a old Macintosh program named Cache Killer. One of the links listed was "Download Cache Killer Pro v5.0 crack / keygen / serial / patch
Re:Nasty! (Score:2)
Re:Nasty! (Score:3, Informative)
Bad news: the file offered for download is dsi_ckp5.exe which is not likely to run on your Mac.
The site is infested with the usual warez crop of pr0n & gambling camp followers. I went there using Safari on a Mac, and collected a cookie from fuck-access.com, and exhibitionist.ws, which will both be valid for 15 years
The file extension is not critical (Score:5, Informative)
A few people on this thread don't seem to be familiar with the WMF format [wikipedia.org] or GDI [wikipedia.org]. This format provides for a set of commands which are supposed to be graphics only. (I guess they got carried away in this case.) As the viewer is basically a scripting engine, the exploiters would certainly try to target it for vulnerabilities. I don't have a copy of the dangerous file, so I don't know whether this particular exploit is a buffer overflow or something else.
this may sound bad but (Score:4, Funny)
wmf? (Score:2)
Interpretation vortex (Score:2)
For a second - just for a second - I thought this might be an extremely clever play on words, making fun both of Windows ("Win") by referring to it as "Lose" (as the exploit code would be running on Windows and controlling it, so you could (in a slightly ungrammatical way, but whatever) say the code is running Win, or indeed Lose) and combining this with a witty rejoinder at all the individuals who write "lose" instead of "loose" (and vice vers
Does it affect LUAs? (Score:2, Interesting)
AH, I miss the 90's (Score:4, Interesting)
Oh and those wonderfull windows exploits, works, spyware, wild tangent, trojan horses, worms and blue screens. And then, linux. What I never thought I could afford happened. I had a unix at home. It looked just like the real thing. Root easily accesible from your user account to make it workable to split your accounts. Didn't you hate it when in windows if you wanted to install any software no matter how trivial you had to logout and login as admin to do it and the only way to get some work done was to always get admin privileges on every machine?
Nowadays when someone gives me the root password on a unix like machine I always demand a pay raise. It probably means they expect me to fix it in the weekend.
Thank you MS for making me stick with linux. The energy bill had me y contemplating scrapping my dual P3 linux desktop and only keep my P4 gaming rig. Windows 2003 is actually pretty stable, now all they got to do is clear the goddamn fucking security holes.
Geez, just a few articles ago people were actually talking about how MS was changing and bam we get the mother of all exploits. The only thing worse would be a worm. This is so easily exploitable. Just make an account on forum that allows those awfull avatar images and bam.
I can't believe the slashdot reader reaction either, first bunch of posts are some insane ramblings about hackers/crackers and the rest have some insane fix that even the most moronic idiot can see is a total failure.
Yes fucktards who suggest that whole unregister crap, because of the way MS has setup its OS many a windows program comes with its own copy of the dll it uses EVEN if it is a copy of a Windows OS dll. To avoid versioning problems it is easier to include it then hope the user OS has the right version.
Do a dupe check your dll's in the main windows directories and where you install your programs some times. What do you think the chances are they will all be patched? It is a well known problem and in fact one of the reasons the whole dynamic linking idea was so attractive.
Windows Major Foul-Up (Score:3, Informative)
The problem with the WMF (Windows Metafile) file format turns out to be one of those careless things Microsoft did years ago with little or no consideration for the security consequences.
Almost all exploits you read about are buffer overflows of some kind, but not this one. WMF files are allowed to register a callback function, meaning that they are allowed to execute code, and this is what is being exploited in the WMF bug.
I find this mind-boggling to the point of absurdity. Regardless of any supposed benefit gained by this, allowing a data file to execute arbitrary code upon it being viewed is simply begging for an exploit like this. No matter whan spin Microsoft will try to put on this one, it makes them look bad. Extremely bad.
Re:They call hackers researchers now? (Score:5, Informative)
Thank you.
Re:They call hackers researchers now? (Score:3, Funny)
Re:They call hackers researchers now? (Score:4, Funny)
Re:They call hackers researchers now? (Score:5, Insightful)
The whole 'white hat' and 'black hat' thing never made it to the media, so all hackers are 'black hats' now.
Re: (Score:2)
Re:They call hackers researchers now? (Score:4, Insightful)
You're fighting a lost battle there. The common understanding of the word 'hacker' now implies criminal behaviour.
The whole 'white hat' and 'black hat' thing never made it to the media, so all hackers are 'black hats' now.
He's not even fighting that battle, he's fighting the one before that. What he calls a "hacker" is not what you call a "white hat hacker". A hacker is an exceptionally gifted programmer, the term has nothing to do with security. People trying to break into computers are crackers, regardless of their intentions. So-called "white hats" are crackers.
That said, yeah, that battle is rather lost...
Re:They call hackers researchers now? (Score:3, Insightful)
Re:They call hackers researchers now? (Score:5, Informative)
Re:They call hackers researchers now? (Score:3, Interesting)
Crackers are hackers*. You cant crack someone's system without being very skilled in toying with technology (ie a hacker).
However, hackers aren't nessearily (or usually) crackers.
*This excludes script kiddies et al, since they dont crack someone's system really. they just run someone elses' crack
Re:They call hackers researchers now? (Score:4, Funny)
SO, to re-cap:
Re:They call hackers researchers now? (Score:4, Funny)
"All wood burns", states Sir Bedivere. Therefore he concludes, "all that burns is wood". This is, of course, pure bullshit.
Universal affirmatives can only be partially converted; all of Al McCogan is dead, but only some of the class of dead people are Al McCogan. Obvious, one would think.
However, my wife does not understand this necessary limitation of conversion of a proposition, so consequently she does not understand me. For how can a woman expect to appreciate a professor of logic if the simplest cloth-eared syllogism causes her to flounder.
For example, given the premise all fish live underwater and all mackerel are fish, my wife will conclude not that all mackerel live underwater, but that if she buys kippers it will not rain, or that trout live in trees or even that I do not love her any more.
This she calls "using her intuition". I call it "crap" and it gets me very irritated because it is not logical.
"There will be no supper tonight!", she will sometimes cry, upon my return home. "Why not?", I will ask ask; "Because I have been screwing the milkman all day!", she will say, quite oblivious of the howling error she has made.
"But", I will wearily point out, "even given that the activities of screwing the milkman and getting supper are mutually exclusive, now that the screwing is over, surely then, supper may now logically be got."
"You do not love me anymore!" she will now often postulate. "If you did you would give me one now and again, so I would not have to rely on that rancid Pakistani for my orgasms."
"I will give you one", I now scream, "after you have gotten my supper, not before." as you see, making her bang contingent on the arrival of my supper.
"Good, you turn me on when you're angry you ancient brute", forcing her sweetly throbbing tongue down my throat.
"Fuck supper!" I now invariably conclude, throwing logic somewhat joyously to the four winds. And so we thrash about on our milk-stained floor, until we sink back exhausted onto the cartons of yougurt.
Good night.
(from the Soundtrack, of the Trailer, of the Film, of Monty Python and the Holy Grail)
Re:They call hackers researchers now? (Score:5, Informative)
UUuummm no. Ever since the 1980's underground scene the word cracker has refered to a person who breaks the protection on copywritten software. It was that way for years until that ruddy faced blowhard "ESR" decided to start using the term "cracker" as a synonym for "computer criminal."
Talk about hypocrisy. ESR gets all pissed about the media misusing the word hacker so he turns around and starts misusing the word cracker. And because of his position as editor of "The Jargon File" he has influenced the web culture (newbies at least) that the word cracker is synonymous with cybercriminal even though anyone who was in the pirate scene back in the eighties can tell you that a cracker was by the following DEFINITION:
"Software cracking is the modification of software to remove encoded copy prevention. Distribution of cracked software (warez) is generally an illegal (or more recently, criminal) act of copyright infringement. Software cracking is most often done by software reverse engineering."
Re:They call hackers researchers now? (Score:3, Insightful)
So, yes, let's come up with some third term! But remember, it must sound cool, otherwise the media is not going to adopt it. Although I feel that this is already in the making. I guess that in some years, everybody who would have been called a hacker by today's media is going to be called cyber terrorist by then. Just im
Re:They call hackers researchers now? (Score:2)
He dropped out of college and programmed what he did with no training (before he started to buy programmers).
A hacker is an untrained person that has professional skills that profess in a certain area that should have taken them years, education, and experience to receive. They could also be enthusiastic about a diversion (music, sports, computing).
It could be music, sports, computers, driving, etc...
There are plenty of sport hacks and musician hacks. You hear it alot in music es
Re:They call hackers researchers now? (Score:2)
No, Bill Gates is not a hacker, and has never been one, because the definition of hacker is not having professional skills although somebody is untrained, it means having exceptional skills, no matter whether trained or not!
Re:They call hackers researchers now? (Score:2)
Don't be an idiot and "correct" someone when you're wrong.
Re:They call hackers researchers now? (Score:2)
Security experts instead might very well be hackers, because they are skilled. But security experts are not malevolent! Crackers who break into other's systems to enrich themself or simply to cause other people damage are idiots, and shall not be called hackers (which are benevolent people!). Period.
Re:They call hackers researchers now? (Score:2)
Re:They call hackers researchers now? (Score:2)
Ok, then thell me where exactly I redefine hackers?? When the term hacker was first used, it did not have the connotation of being malevolent, trying to harm other people. It was used for individuals who were extremely skilled in some area, or came up with ideas others weren't thinking about.
It was only later when the media started to pay attention to computer related threats. Assholes as thes
Re:They call hackers researchers now? (Score:2)
That's why I am against overloading terms with meanings which are quite opposite to each other.
Re:They call hackers researchers now? (Score:2)
b : to cut or shape by or as if by crude or ruthless strokes
c : ANNOY, VEX -- often used with off
Re:They call hackers researchers now? (Score:2, Insightful)
You crack things by breaking them, or part of them. This can be copy protection or security software or DRM. You can even crack into hardware you aren't supposed to be able to open. The metaphor is 'cracking them open' like a coconut.
You hack something by modifying it in a clever way, or using it in a clever way without modifications. The metaphor of 'carving with axes' doesn't really work here.
A hack can be a crack, and crack can be a hack. Witness the X-Box ones that let you run unsigned programs vi
Re:Virus company (Score:3, Interesting)
Microsoft Corporation (Score:2)
If anything, we need earlier reporting so the public can realize just how little microsoft cares about security.
Re:Not Previously Unknown (Score:3, Informative)
Re:Not Previously Unknown (Score:5, Informative)
http://www.securityfocus.com/bid/16074 [securityfocus.com]
Re:Not Previously Unknown (Score:4, Informative)
so that explains why fully patched systems are still vulnerable, yes?
I guess you are really not doing your research. Read the Sunbelt article:
http://sunbeltblog.blogspot.com/2005/12/new-explo
particular where it says: "We saw a new nasty exploit yesterday around 5:00 PM. This is a totally new exploit and is not the same one posted by FrSIRT back on 11/30/05."
The previous one they referred to is here:
http://www.frsirt.com/exploits/20051130.MS05-053.
Microsoft Windows Metafile (WMF) "mtNoObjects" Header Remote Exploit (MS05-053)
Date : 30/11/2005
Advisory ID : FrSIRT/ADV-2005-2348
Rated as : Critical
Note : Proof of concept exploit (DoS)
* Author: Winny Thomas
* Pune, INDIA
*
* The crafted metafile (WMF) from this code when viewed in explorer crashes it.
* The issue is seen when the field 'mtNoObjects' in the Metafile header is set to 0x0000.
* The code was tested on Windows 2000 server SP4. The issue does not occur with the
* hotfix for GDI (MS05-053) installed.
This is the one that has been patched by Microsoft.
I guess you thought it's just not possible for there to be more than one hole per rendering engine, right?
Re:Amazing (Score:2, Interesting)
Re:so what else is new? (Score:3, Informative)
Kye-U also has released a filter for proxomitron that will block wmf file downloads:
[HTTP headers]
In = FALSE
Out = TRUE
Key = "URL-Killer: Kill WMF Connection [Kye-U] (Out)"
URL = "(^*=(^http://./ [.]^([a-z]+{2,4})(^/))))*.wmf(*)\1$TS T(\1=(^/))"
Match = "*&($CONFIRM(.WMF FILE EXTENSION FOUND\n\nAllow connection to the URL below?\n\n\u\n\1)|$SET(1=URL with
Replace = "\1"
[Patte
Re:so what else is new? (Score:2)
""Kye-U also has released a filter for proxomitron that will block wmf file downloads[....]"
Careful, The folks at the Internet Storm Center [sans.org] are warning that Windows often ignores the file extension and reads the 'magic bits' at the beginning of the file to decide how to process it. This means that someone could rename a .wmf to .jpg, for example, in order to get it past that filter.
The best workaround currently available is to un-register the shimgvw.dll as suggested above.
Re:so what else is new? (Score:2)
Re:so what else is new? (Score:2)
Re:Other platforms? (Score:3, Interesting)
No kernel problem, but Winows only (Score:4, Interesting)
Re:No kernel problem, but Winows only (Score:3, Interesting)
(Illustrator CS2 on OS X opens the things just fine.)
Re:No kernel problem, but Winows only (Score:2)
Re:No kernel problem, but Winows only (Score:2)
I don't think libwmf is vulnerable though.
About the WMF format (Score:3, Informative)
The WMF format is simply a stream of GDI commands. GDI (Graphics Device Interface) is the Windows API and abstraction layer for graphics, allowing the same set of drawing functions to be targetted at a variety of different "device contexts" such as printers and the screen.
A WMF file is (traditionally) created by obtaining a device context on a file and drawing to it using the GDI API functions, which "records" the sequence of commands to disk ready to be replayed later to recreate the image. These days, of
Re:Just checking... (Score:3, Insightful)
If even only one unpatched security flaw exists, an OS should never be called "pretty tight". This flaw has always been there, even if it has only been exploited just now...
Re:Just checking... (Score:3)
Re:Just checking... (Score:5, Insightful)
Re:I'd feign surprise if I felt it was worth it... (Score:4, Informative)
- computer systems should not be released until they pass some theoretical threshold of security
- and if the above is not done, then the authors of said systems shall be held (financially? criminally?) liable.
In other words, you have just basically killed off free (both as in beer and as in speech) software as we know it.Not to mention about the fact that we're talking about an exploit in an older DLL that has gone unnoticed for years. Exactly how many years until your theoretical notion of "reasonably" safe is met? If you dont think (OS of your choice) has similar weaknesses, you are deluding yourself. And so what if it 'affects only one user, not the whole system?' To that user, that IS his world.
Re:I'd feign surprise if I felt it was worth it... (Score:2)
"Your argument basically is that:"
Sounds reasonable, except that the threshold should be measurable. This is relatively easily achieved, even in very complex applications, if responsible coding practices and code management are used. I refuse to work for companies that do less than that, and avoid recommending any software that wasn't developed using that method. Which, of course, is why I've only suppor
Re:But ... (Score:5, Informative)
If you are using Firefox, then what you say is true, since FF requires the user to confirm that he really wants to run the malicious program, so the user actually has to click a confirmation button. The infection is not automatic on FF.
Re:Say it isn't so!! (Score:4, Funny)
Wow...sometimes, Slashdot ratings really DO match the content in posts!
Re:Why does /. report so much on Windows flaws? (Score:2, Interesting)
Re:Why does /. report so much on Windows flaws? (Score:3, Interesting)
Hmm (Score:2, Insightful)
Re:PATCH!! (Score:3, Informative)
Hmmm, I think I remember them (Score:2)
Re:WMF (Score:2)