Exploit Released for Unpatched Windows Flaw

woodchuck writes "Washington Post reports that another Windows hole has been found and exploit code is now running lose that makes swiss cheese of current patches and security measures. From the article: "Security researchers have released instructions for exploiting a previously unknown security hole in Windows XP and Windows 2003 Web Server with all of the latest patches applied. Anti-virus company Symantec warned of the new exploit, which it said uses a vulnerability in the way Windows computers process certain image files (Windows Meta Files, or those ending in .wmf). Symantec said the exploit is designed to download and run a program from the Web that downloads several malicious files, including tools that attackers could use to control vulnerable computers via IRC.""

They call hackers researchers now?

So they're researchers now? I'm sorry, but I have to disagree, they are computer hackers.

Re:They call hackers researchers now?

They're not hackers, they are crackers. Or intruders. Or black hats. Or fucking idiots. But not hackers. Linus Torvalds is a hacker. Alan Cox is one, and RMS definitely. Maybe even ESR.

Thank you.

Re:They call hackers researchers now?

So, if you root his box, that makes you a nut cracker? Sweet!

Re:They call hackers researchers now?

You're fighting a lost battle there. The common understanding of the word 'hacker' now implies criminal behaviour.

The whole 'white hat' and 'black hat' thing never made it to the media, so all hackers are 'black hats' now.

Re:They call hackers researchers now?

You're fighting a lost battle there. The common understanding of the word 'hacker' now implies criminal behaviour.

The whole 'white hat' and 'black hat' thing never made it to the media, so all hackers are 'black hats' now.

He's not even fighting that battle, he's fighting the one before that. What he calls a "hacker" is not what you call a "white hat hacker". A hacker is an exceptionally gifted programmer, the term has nothing to do with security. People trying to break into computers are crackers, regardless of their intentions. So-called "white hats" are crackers.

That said, yeah, that battle is rather lost...

Re:They call hackers researchers now?

The exploit was published by HD Moore after reverse engineering some malware. HD Moore is absolutely a very prominent researcher and hacker. Secondly the person(s) who discovered the vulnerabilty and wrote the initial malware to exploit it are also hackers. Even by the historical definition. Intent has no bearing on the term. Skill does. And you can't tell me discoverying a 0day affecting any MS platform doesn't require skill. There are tens of thousands of researchers out there right now who can't.

Re:They call hackers researchers now?

The last scene was interesting from the point of view of a professional logician, because it contained a number of logical fallacies, that is invalid propositional constructions and syllogistic forms, of the type so often committed by my wife.

"All wood burns", states Sir Bedivere. Therefore he concludes, "all that burns is wood". This is, of course, pure bullshit.

Universal affirmatives can only be partially converted; all of Al McCogan is dead, but only some of the class of dead people are Al McCogan. Obvious, one would think.

However, my wife does not understand this necessary limitation of conversion of a proposition, so consequently she does not understand me. For how can a woman expect to appreciate a professor of logic if the simplest cloth-eared syllogism causes her to flounder.

For example, given the premise all fish live underwater and all mackerel are fish, my wife will conclude not that all mackerel live underwater, but that if she buys kippers it will not rain, or that trout live in trees or even that I do not love her any more.

This she calls "using her intuition". I call it "crap" and it gets me very irritated because it is not logical.

"There will be no supper tonight!", she will sometimes cry, upon my return home. "Why not?", I will ask ask; "Because I have been screwing the milkman all day!", she will say, quite oblivious of the howling error she has made.

"But", I will wearily point out, "even given that the activities of screwing the milkman and getting supper are mutually exclusive, now that the screwing is over, surely then, supper may now logically be got."

"You do not love me anymore!" she will now often postulate. "If you did you would give me one now and again, so I would not have to rely on that rancid Pakistani for my orgasms."

"I will give you one", I now scream, "after you have gotten my supper, not before." as you see, making her bang contingent on the arrival of my supper.

"Good, you turn me on when you're angry you ancient brute", forcing her sweetly throbbing tongue down my throat.

"Fuck supper!" I now invariably conclude, throwing logic somewhat joyously to the four winds. And so we thrash about on our milk-stained floor, until we sink back exhausted onto the cartons of yougurt. ...I seem to have strayed somewhat from my original brief. But in a nutshell, sex is more fun than logic. One cannot prove this. But it is in the same sense that Mt. Everest is or that Al McCogan isn't.

Good night.

(from the Soundtrack, of the Trailer, of the Film, of Monty Python and the Holy Grail)

Re:They call hackers researchers now?

I knew a very smart and experienced admin from Slovenia. He was trying to tell me about script-kiddies. He asked me what the word was for "the froth of piss". I told him we didn't have such a word in English. Well, that was his ideas of script kiddies.

SO, to re-cap:

• Crackers are hackers
• hackers aren't nessearily (or usually) crackers.
• Script-kiddies are the froth of piss.

Re:They call hackers researchers now?

They're not hackers, they are crackers.

UUuummm no. Ever since the 1980's underground scene the word cracker has refered to a person who breaks the protection on copywritten software. It was that way for years until that ruddy faced blowhard "ESR" decided to start using the term "cracker" as a synonym for "computer criminal."

Talk about hypocrisy. ESR gets all pissed about the media misusing the word hacker so he turns around and starts misusing the word cracker. And because of his position as editor of "The Jargon File" he has influenced the web culture (newbies at least) that the word cracker is synonymous with cybercriminal even though anyone who was in the pirate scene back in the eighties can tell you that a cracker was by the following DEFINITION:

"Software cracking is the modification of software to remove encoded copy prevention. Distribution of cracked software (warez) is generally an illegal (or more recently, criminal) act of copyright infringement. Software cracking is most often done by software reverse engineering."

Easy workaround to avoid the exploit

Unregister the dll that provides WMF viewing. Click Start, Run, and enter this:

    REGSVR32 /U SHIMGVW.DLL

Sunbelt has more detail here [blogspot.com].

Re:Breaks thumbnails and Windows Picture Viewer

I'd read this [securityfocus.com] before you take your chances, because it appears as though the exploit will work when the .wmf is disguised as a .jpg (or other extensions)

Re:Easy workaround to avoid the exploit

Just my own experience... After issuing the reg command I was unable to view thumbnails in explorer of jpegs taken by my camera. I was also quite unable to open any of them until I issued the command to register the dll again ( regsvr32 shimgvw.dll ).

how long?

before MS starts using less-quick security patches as the reason to move from XP to vista?

The Fix

The important line filtered from the article, the fix:

"regsvr32 /u shimgvw.dll"

Upside.

With Vista you'll be able to get this from the comfort of an RSS feed!

Fix from article

Here is the fix, from the linked article in case you DNRTFA:

----
According to iDefense, Windows users can disable the rendering of WMF files using the following hack:

1. Click on the Start button on the taskbar.
2. Click on Run...
3. Type "regsvr32 /u shimgvw.dll" to disable.
4. Click ok when the change dialog appears.

iDefense notes that this workaround may interfere with certain thumbnail images loading correctly, though I have used the hack on my machine and haven't had any problems yet. The company notes that once Microsoft issues a patch, the WMF feature may be enabled again by entering the command "regsvr32 shimgvw.dll" in step three above.
----

I'm not sure if you need to type this every reboot, or just once. Since it requires re-enabling, I'm hoping it's just once.

Re:Fix from article

I'm not sure if you need to type this every reboot, or just once. Since it requires re-enabling, I'm hoping it's just once.

regsvr32 registers a COM/ActiveX "server" by modifying Windows registry entries. So, in theory, you need only run it once.

It is possible, however, that if you later install other software, the installer may re-register the DLL in question, in which case you'd want to manually unregister it again.

(Hmm. I suppose it's only coincidence that this novel approach [thedailywtf.com] to registering appeared on thedailywtf yesterday...)

Amazing

I read the article and realized it's the same trojan I got like 1 week ago. The first thing I did was a good old format. When stuff get messed, there is nothing better than a good old format. Now realizing they say they don't have a fix yet, I assume I did the right thing quickly.

Broadband Reports' Security Forum Thread...

Also, read Broadband Reports' security forum thread [broadbandreports.com] for discussions and what people observed.

Post to Broadband Reports' Thread...

http://www.dslreports.com/speak/print/default;1512 1004 [dslreports.com]

There's an excerpt of our chat in that post too.

Just checking...

... there has not yet been a real, severe, in-the-wild exploit (like Sasser) since XP SP2, right? I hate to admit it as much as the next guy, but MS has been pretty tight for a while--unless there's something I've missed. Have I?

Re:Just checking...

no, 5 years to stop the flood of wormable remote exploits isn't "pretty tight"

Not Previously Unknown

This is hardly a "prevously unknown security hole." In fact, MS released a patch for it two weeks ago.

The exploit's new, but the vulnerability has been known for a while and is only still around because the patch doesn't work.

Re:Not Previously Unknown

It's completely new. The WMF patch released before does not protect against this exploit.

http://www.securityfocus.com/bid/16074 [securityfocus.com]

Re:Not Previously Unknown

MS has released a patch for it...

so that explains why fully patched systems are still vulnerable, yes?

I guess you are really not doing your research. Read the Sunbelt article:
http://sunbeltblog.blogspot.com/2005/12/new-exploi t-blows-by-fully-patched.html [blogspot.com]

particular where it says: "We saw a new nasty exploit yesterday around 5:00 PM. This is a totally new exploit and is not the same one posted by FrSIRT back on 11/30/05."

The previous one they referred to is here:
http://www.frsirt.com/exploits/20051130.MS05-053.c .php [frsirt.com]

Microsoft Windows Metafile (WMF) "mtNoObjects" Header Remote Exploit (MS05-053)
Date : 30/11/2005

Advisory ID : FrSIRT/ADV-2005-2348
Rated as : Critical
Note : Proof of concept exploit (DoS) /*
* Author: Winny Thomas
* Pune, INDIA
*
* The crafted metafile (WMF) from this code when viewed in explorer crashes it.
* The issue is seen when the field 'mtNoObjects' in the Metafile header is set to 0x0000.
* The code was tested on Windows 2000 server SP4. The issue does not occur with the
* hotfix for GDI (MS05-053) installed.

This is the one that has been patched by Microsoft.

I guess you thought it's just not possible for there to be more than one hole per rendering engine, right?

In other news...

Microsoft said in it's late night response on new years day that a patch is being made, the flaw is not critical since no-one actually uses WMF and the rest who do use them never should surf to porn and warez sites anyway. A patch will be available in Windows Shoehorn.

Scary.

Surfing for porn with IE on Windows is like having unprotected anal sex with everybody on the internet.

Re:Scary.

"Update, 12:30 p.m. ET: Several security groups are reporting that it is extremely easy to get whacked by this vulnerability/exploit just by visiting one of a growing number of malicious Web sites that are now employing this attack. F-Secure's blog post on this indicates that -- because the vulnerability lies in the way Windows parses WMF image files -- Firefox and Opera users also can get infected -- although they at least have to agree to download and run a file first"

That's what they say in the article but the only thing I did was to open a .wmf movie in Firefox. I did not click/agree/install anything else.
The thing just auto-installed it-self from that point.

How/Why does thi skeep happening

Can someone explain to me exactly how an image viewer
program running on my client computer can be
made to execute code? Honestly, I don't really understand
these exploits that supposedly take advantage of
a client buffer overflow (or some such thing) to execute
code on my local machine. What makes the instruction pointer in
the code that is reading (in this case) the wmf file suddenly
jump to code that is in the data segment? (Presumably embedded in
the wmf file itself).

Re:How/Why does thi skeep happening

It is a carefully crafted buffer overflow in the stack causing a return address to be overwritten. A subroutine return instruction then jumps to the exploit code, instead of the parent routine. This an old trick to implement dynamic jump tables, exploited for malicious purposes.

Re:How/Why does thi skeep happening

On x86 processors (and probably most others), the stack pushes backward in memory. Each function call pushes the return address onto the stack. Because the stack pushes backwards, a buffer overflow will overwrite the previously pushed values that follow it in memory. So when the overflowed function returns, it'll return to the new address that has been written by the overflowed buffer.

Good stack overflow exploit code is pretty reusable for exploiting newly discovered stack overflows with little modification, which makes these exploits appear so quickly after a new vulnerability is discovered. There's also something called a heap overflow, but using it to run executable code is quite a bit harder and must be tailered to each specific vulnerability.

Bleeding snort rules here:

http://www.bleedingsnort.com/cgi-bin/viewcvs.cgi/s igs/CURRENT_EVENTS/CURRENT_WMF_Exploit [bleedingsnort.com]

Stop the dupes!

Why doesn't somebody just *pin* a story (maybe the 1996 one) with the security issues with MS and/or IE and leave it there...

Then we don't need to read about it all over again every 20 days ;-)

I remember the days...

I remember the days when only exe and com files were what you had to guard. The day word files became dangerous I thought - why did they put all the functionality in them? Idiots. At least image files and plain text files were safe.

I was eating crow shortly thereafter.
I miss the old days.

Genius Idiots.

The people who took advantage of this loophole did so with a clear economic motive. This is because the loophole is used basically to a) install spysherriff, a bogus anti-spyware program and try to get the user to pay for it with a credit card b) install surfsidekick and other idiot spyware programs c) install a spam sender, in order to make a few more billionths of a cent.

In other words, whatever asshat took advantage of this loophole did so because he thought he could make a buck. If his goal was simply to bring Windows to its knees, cause havoc, or make a political/economic statement of some sort, he would have chosen something else. Wiping out My Documents of all the infected machines, for example.

Whoever did this is obviously deluded. While some money will of course ultimately flow from this nonsense to the "see no evil" people who are the beneficiaries of spamvertisements, spyvertisements and so forth, the actual exploiter basically has little to know chance of getting it (even if he is in Russia, as I'd suspect is a good bet) as his affiliate commission links will be tracked, as will wherever the hell that credit card box for SpySherriff was pointing to and so forth.

So we have somebody smart enough (and make no mistake, it takes some smarts) to either discover or be in a small clique of people discovering a quite obscure loophole (it must be obscure, given just how old the affected .dll is), but have ABSOLUTELY NO FUCKING CLUE how to go about exploiting it other than in the most juvenile and unlikely way to fail imaginable. Furthermore, even though it is likely to fail, the guy has shown himself to basically be a psychopath, with little to no concern about the hundreds of thousands of hours (read: PEOPLE-LIFE-EQUIVALENTS) that will be spent agonizing over and fixing this.

Whoever that person is, they are human filth. But, there's a lot of human filth out there. The sad thing is that this person obviously has potential to do so much more but simply pisses it away intead. Pathetic.

Holy cats

For as much funding and resources as MS has: when are we going to hear of an exploit identified by MS before someone else gets to it first?

For cripes' sakes. Don't these people bug-test their own code? I know I do.

Smitfraud-C

Isn't this just another incarnation of the Smitfraud extortion by the nice New Zealand company SpyAxe?

The tool to remove that crapware is called smitrem, available here: http://noahdfear.geekstogo.com/ [geekstogo.com]

WMF

People actually use that image file format? I've never used that file format in my life (and never even heard of it before), so no exploits for me! :-D

Watch out for Google Desktop

From F-secure's blog [f-secure.com]:

Do note that it's really easy to get burned by this exploit if you're analysing it under Windows. All you need to do is to access an infected web site with IE or view a folder with infected files with the Windows Explorer.

You can get burned even while working in a DOS box! This happened on one of our test machines where we simply used the WGET command-line tool to download a malicious WMF file. That's it, it was enough to download the file. So how on earth did it have a chance to execute?

The test machine had Google Desktop installed. It seems that Google Desktop creates an index of the metadata of all images too, and it issues an API call to the vulnerable Windows component SHIMGVW.DLL to extract this info. This is enough to invoke the exploit and infect the machine. This all happens in realtime as Google Desktop contains a file system filter and will index new files in realtime.

steps ahead (again)

Once again, as noted previously here [slashdot.org] and here [slashdot.org]:

10) find big remote vulnerability in product
20) perfect the exploit
30) have fun with it for months
40) find another big hole in same product
50) perfect exploit for hole
60) alert vendor about original hole
70) have fun with new hole
80) goto 40

Already being used by scumware sites?

Coincidentally I was browsing an ad-heavy lyrics site in another tab (Firefox, of course) and was prompted for an action to handle "track5.wmf" ... Geez, they don't waste any time, do they?

Additional Resources

Internet Storm Center Coverage - Alert moved to yellow as of this morning. http://isc.sans.org/diary.php?rss&storyid=975 [sans.org]
Also, take a look at this movie from websense: http://www.websensesecuritylabs.com/images/alerts/ wmf-movie.wmv [websensesecuritylabs.com] it shows step-by-step what happens to a clean machine as it gets exploited by this new menace.

Take a preemptive strike.

Users of PivX PreEmpt (formerly called Qwik-fix) have been protected against WMF vulnerabilities since December 7th. PivX is the company which maintained the infamous 'still unpatched IE vulnerabilities' webpage a few years ago.

Actual cause of exploit - poor spelling

There is an exposed method in the .dll that has gone unnoticed for years:
ExploitCodeRunningLose()

It has been confounded with a private method,
ExploitCodeRunningLoose()

Lesson: coders should lern2spel.

Nasty!

This thing is nasty! I was browsing the internet this afternoon and got it. I have a fully patched copy of Windows XP SP2 with Symantec Antivirus Corporate 9.0. Neither stopped it. I spent about 6 hours running virus scans, Ad-Aware, and Spy-Bot in safe mode. This didn't even come close to detecting everything. I had to manually remove files based on searches by creation date. Interestingly, none of the three tools picked up any of the DLLs mentioned in the next paragraph.

I traced it to an ad within an ad within an ad that sources a WMF file in an iframe. If you want to see this thing in action then use VMWare to load the following link: h**p://iframeurl.biz/dl/xpladv470.wmf. After all is said and done, you'll have trojan.byteverify, trojan.dropper, trojan.bookmarker, download.trojan, w32.conycspa.G@mm, backdoor.shellbot, backdoor.trojan, w32.looksky.A@mm, among others. I also had some new DLLs that were particularly hard to get rid of - msupdate32.dll, msctl32.dll, uytpu.dll, qrlmq.dll - all in the system32 directory.

This has actually never happened to me. I am religious about keeping Windows and my antivirus software up-to-date. It was a good learning experience to see it all in action.

And, by the way, I was not browsing for porn. I was doing a google search for a old Macintosh program named Cache Killer. One of the links listed was "Download Cache Killer Pro v5.0 crack / keygen / serial / patch ...". I clicked on this and ... WHAM! Here's the Google search - http://www.google.com/search?q=cache+killer&hl=en& lr=&start=0&sa=N [google.com]. It's the last link on the page - h**p://www.crackz.ws/down/25335/Cache.Killer.Pro.v 5.0_crack_serial_keygen.html. This is the page that contains the ad within an ad within an ad. Beware!!!

The file extension is not critical

I want to point out that the file extension is not used exclusively for file type detection, and the magic string at the beginning of the file will trigger the use of the WMF processing. A ".tiff" extension will also work in a similar manner. (Likely there are several good candidates.)

A few people on this thread don't seem to be familiar with the WMF format [wikipedia.org] or GDI [wikipedia.org]. This format provides for a set of commands which are supposed to be graphics only. (I guess they got carried away in this case.) As the viewer is basically a scripting engine, the exploiters would certainly try to target it for vulnerabilities. I don't have a copy of the dangerous file, so I don't know whether this particular exploit is a buffer overflow or something else.

this may sound bad but

Hell bring it on. I opened my own shop about 4 months ago and can clean most anything off a machine. Its 95% of my buisness so far and im tired of being poor. This week alone Ive cleaned 8 xp home boxes all still sp1 with no antispy or antivirus still running. Only one of the machines needed parts. It had a winlogon popup running that killed windows update and automatic update (senslogn key was missing). I think the real proplem with the current state of affairs is not that the exploits are produced and released but that microsoft builds to fast and to often. They need to can vista and put more R&D into fast fixes. If they want discreet disclosure of exploits they should offer $$ for it. Just tell them and get a check :)..... nah never happen they will just build the new big security hole called a OS.

wmf?

I hear Windows Vista is going to fix all of these previously unknown problems...stay tuned for the exciting conclusion in 2006.

Interpretation vortex

From the summary: "...and exploit code is now running lose..."

For a second - just for a second - I thought this might be an extremely clever play on words, making fun both of Windows ("Win") by referring to it as "Lose" (as the exploit code would be running on Windows and controlling it, so you could (in a slightly ungrammatical way, but whatever) say the code is running Win, or indeed Lose) and combining this with a witty rejoinder at all the individuals who write "lose" instead of "loose" (and vice versa), emphasising what losers they are.

Then I remembered that this is Slashdot.

Sigh.

Does it affect LUAs?

Anyone know if you can get hit with this if you are running a limited user account?

Surprise!

I suppose that an exploit for a windows flaw should count as #11 MS surprise (specially in the unpatched part) in this list [microsoft-watch.com], no?

Er... wait, where is the surprise in this?

MS's Advice...

http://www.microsoft.com/technet/security/advisory /912840.mspx [microsoft.com]
"Microsoft encourages users to exercise caution when they open e-mail and links in e-mail from untrusted sources."

well... not really helpfull, but when MS has a patch, it should be linked on this page

sneaky thing - Mozilla 1.7.12 affected

bugger, I wish I'd read /. before browsing porno this afternoon.

despite it saying you must agree to something, my XP SP2 laptop got hit by this this afternoon - no 'downloads', just happened to browse to a porno page that wanted to auto-start a download of:
http://85.255.115.171/bt/7/wmf/wmf_dcode.wmf [85.255.115.171]

I clicked no, I didn't want to run or save the file... but a few minutes later, up came the spyware. First time this box has been infected. This was on Mozilla 1.7.12

Firefox and the .wmf trojan...

Friend of mine sent me a link to some topless video of whatever movie star he thought was hot. Being only mildly retarded but not completely so I fired up Firefox and disabled Javascript before I opened the link. I was asked by Firefox if I wanted to open or save a file called "xxxxxx.wmf" and I canceled the operation at that point.

Score one for Firefox.

Registry key for confirmation?

I want to confirm on all systems at work that the WMF viewer has been unregistered with "regsvr32 /u shimgvw.dll". This command modifies the registry in some way to disable the .dll. Would anyone know what specific registry key is changed? I can easily check registry settings on all the work machines, and I'd like to to make sure that the fix above worked for each system. Thanks in advance.

AH, I miss the 90's

Those wild days when the sky was the limit and the internet was called the information superhighway and you could run an succesfull company with half the workers playing on the consoles drinking beer.

Oh and those wonderfull windows exploits, works, spyware, wild tangent, trojan horses, worms and blue screens. And then, linux. What I never thought I could afford happened. I had a unix at home. It looked just like the real thing. Root easily accesible from your user account to make it workable to split your accounts. Didn't you hate it when in windows if you wanted to install any software no matter how trivial you had to logout and login as admin to do it and the only way to get some work done was to always get admin privileges on every machine?

Nowadays when someone gives me the root password on a unix like machine I always demand a pay raise. It probably means they expect me to fix it in the weekend.

Thank you MS for making me stick with linux. The energy bill had me y contemplating scrapping my dual P3 linux desktop and only keep my P4 gaming rig. Windows 2003 is actually pretty stable, now all they got to do is clear the goddamn fucking security holes.

Geez, just a few articles ago people were actually talking about how MS was changing and bam we get the mother of all exploits. The only thing worse would be a worm. This is so easily exploitable. Just make an account on forum that allows those awfull avatar images and bam.

I can't believe the slashdot reader reaction either, first bunch of posts are some insane ramblings about hackers/crackers and the rest have some insane fix that even the most moronic idiot can see is a total failure.

Yes fucktards who suggest that whole unregister crap, because of the way MS has setup its OS many a windows program comes with its own copy of the dll it uses EVEN if it is a copy of a Windows OS dll. To avoid versioning problems it is easier to include it then hope the user OS has the right version.

Do a dupe check your dll's in the main windows directories and where you install your programs some times. What do you think the chances are they will all be patched? It is a well known problem and in fact one of the reasons the whole dynamic linking idea was so attractive.

AdBlock

Will Adblocking *.wmf stop a malicious site from infecting me?

What are FOSS devs doing about a future threat?

As a Linux user, I do worry that Linux distro's could end up as bad as windows in say 10/15 years time. I realise that as linux users we do things differently, like run regular user accounts etc. bla, bla, bla; but it would be interesting to find out how the FOSS development community take into account the potential threat of a community of crackers targeting unix systems.....mmmmmmmm......

come on!

lets see here this will take M$ about 2 weeks to fix AFTER half their users become affected by it

And here's how a Windows 0-day works over Wi-Fi

Beating the rogue access point (AP) dead horse a bit here, and spelling it out for those who don't "get it".

Badguy creates hostile "website" with Windows exploit. Badguy goes to local airport terminal or Starbucks and pretends to be a legitimate wireless hotspot using Airsnarf [shmoo.com] or similar rogue AP utility. Badguy FORCES any user who joins wireless network to browse the hostile website that has the Windows exploit. User gets owned. Lather, rinse, repeat.

You can do this to your neighbor, too, if they have an open access point. FYI.

The point is that it does NOT require coincidental surfing of hostile websites to gather and exploit targets with a Windows 0-day these days. The rich and elite road warriors carrying all their financial and corporate data with them are prime targets. Attackers with rogue AP setups can make easy money from hotspot users by FORCING them to browse a hostile "website" with a rogue AP "splash page".

Particularly vulnerable, are hotspot users that have the Windows operating system installed and use IE as their default browser.

Sincerely,

Beetle

Windows Major Foul-Up

Larry Seltzer has a concise column [eweek.com] about this exploit, where he doesn't exactly pull the punches on Microsoft. The most interesting piece of information there is this:

The problem with the WMF (Windows Metafile) file format turns out to be one of those careless things Microsoft did years ago with little or no consideration for the security consequences.

Almost all exploits you read about are buffer overflows of some kind, but not this one. WMF files are allowed to register a callback function, meaning that they are allowed to execute code, and this is what is being exploited in the WMF bug.

I find this mind-boggling to the point of absurdity. Regardless of any supposed benefit gained by this, allowing a data file to execute arbitrary code upon it being viewed is simply begging for an exploit like this. No matter whan spin Microsoft will try to put on this one, it makes them look bad. Extremely bad.

Re:Virus company

From what I read about this earlier (sorry, don't have the link), this exploit was already in the wild and was being used before any of the security companies learned of it. So no, the AV companies did not "let this one loose".

Re:so what else is new?

Actually it's security and they are trying. Go ahead and mod me down as flamebait but nothing is more ironic than "experts", who cannot spell security, ridicule another organisation for failing to be more secure.

Re:Other platforms?

No, it's a buffer overload in Windows Picture and Fax Viewer.

No kernel problem, but Winows only

It's a Windows only format, or at least seems to be. I don't find any references of ports to other platforms. It's an old format for doing vector graphics in Windows 3.1.

Re:I'd feign surprise if I felt it was worth it...

Your argument basically is that:

• computer systems should not be released until they pass some theoretical threshold of security
• and if the above is not done, then the authors of said systems shall be held (financially? criminally?) liable.

In other words, you have just basically killed off free (both as in beer and as in speech) software as we know it.

Not to mention about the fact that we're talking about an exploit in an older DLL that has gone unnoticed for years. Exactly how many years until your theoretical notion of "reasonably" safe is met? If you dont think (OS of your choice) has similar weaknesses, you are deluding yourself. And so what if it 'affects only one user, not the whole system?' To that user, that IS his world.

Re:But ...

No, you just have to visit a porn site with Internet Exploder to get automatically infected by this worm. It doesn't require any user action, apart from clicking links in normal browsing.

If you are using Firefox, then what you say is true, since FF requires the user to confirm that he really wants to run the malicious program, so the user actually has to click a confirmation button. The infection is not automatic on FF.

Re:Say it isn't so!!

Say it isn't so!! (Score:1, Redundant) by Foofoobar (318279) Alter Relationship on Wednesday December 28, @07:56PM (#14355427) Windows Exploit? Isn't that redundant?

Wow...sometimes, Slashdot ratings really DO match the content in posts!

Layers upon layers

Isn't modding a post about the redundancy of windows exploits as redundant in itself also redundant?

Re:Why does /. report so much on Windows flaws?

Please indicate a recent worm on an FOSS operating system.

Re:PATCH!!

Umm, numbnutz, there is no patch there. Just an advisory.

Re:Why does /. report so much on Windows flaws?

You must be new around here...

Re:A security hole? In WINDOWS?

"hey look at me, I can hurl weak insults anonymously"

Dork.

Microsoft Corporation

... let this one loose. It is a problem with windows, and it was disclosed by a responsible hacker. If you want to protect the general population still using MS software, this is the only option. Microsoft isn't about to make a secure platform on their own, so until the next big mistake hits the news they wont do anything about it.

If anything, we need earlier reporting so the public can realize just how little microsoft cares about security.

Hmm

I would say about 80% of the comments on this site tend to be pretty evenhanded in their treatment of windows security. If you actually read comments on stories about windows flaws, you would see that the people that get modded up are those that say "really, this isn't that serious, this is just Anti-MS stuff." You don't see people saying "OSS RULES MS SUCKS" getting modded up. Sure, people making jokes get +5 funny, but so do the people making jokes on the firefox articles about firefox vulnerabilities. Jokes get modded up not necessarily because they're true, but because they identify with a common recurring theme.

The fact is, the impression that slashdot is anti-MS and pro-linux is wrong. We just like to know about vulnerabilities in an operating system that 90% of computer users have installed on their systems, and utilize every day. Not many people care about vulnerabilities in gqview for gnome (to take a random app for example). There are just so many apps that are not core to the system. Now, if there was a vulnerability in PHP or Apache that had an exploit in the wild, then that would make the news I'm sure.

Honestly, I think someone should go through all the windows vulnerability stories and count the number of anti-ms, pro-ms, and the smart people posts (i.e., those who realize that simply bashing an OS because of a discovered security flaw is silly, because all Operating Systems have flaws). In the end I think you would see that the majority of people on slashdot do not see Microsoft Windows as the Ultimate Evil. I could be wrong of course. I'm not exactly an authority on the subject. I haven't gone through counting the number of posts.

BTW where on slashdot does it say it's geared towards linux users?

Re:pr0n sites are FAST!

I clicked on the link and was prompted by firefox if I wanted to open the file in xine or save it to disk. What should I do? If I open it in xine, will crossover office install the malicious code and then I will be infected by M$ sploits? I'm at a loss. Should I open it in xine or save it to my home directory and view it later?

Watch out, it's a hoax!

Installing that patch took almost an hour, and when my computer restarted the internet is missing from the desktop! And I can't find bonzi buddy anywhere, I think my Windows got formatted!

Re:PATCH!! NOT!

It's not even a patch, but an advisory! Furthermore, Microsoft's "advice" is to "keep your antivirus software up-to-date, and download Microsoft's AntiSpyware Beta"

Great. An <duh>obvious</duh> recommendation, and an invitation to load more junk (beta!) Microsoft ware.

Re:Why does /. report so much on Windows flaws?

Because it is us Linux advocates who get called in to fix all the Windoze machines. Fixing MS Crapware is actually a major part of my revenue...

Re:The fix was released months ago

Problem is, that patch breaks more of my programs and utilities I like to use than Windows XP SP2 did. How can I fix this? Someone told me I needed Wine, but I fail to see how getting drunk will solve anything!

Re:Is Windows 2000 vulnerable?

Since the vulnerability is apparently in GDI32.DLL, I'd guess that every version of Windows going back to Windows 95 is vulnerable, since metafiles have been around since Windows 3 (I think?) and GDI32.DLL was introduced with the 32-bit Windows API.