Attacks Against Unpatched Microsoft Bug Multiply 122
Posted
by
kdawson
from the how-not-to-excel dept.
from the how-not-to-excel dept.
CWmike writes "Attacks exploiting the latest Microsoft vulnerability are quickly ramping up in quantity and intensity, several security companies warned today as they rang alarms about the developing threat. Symantec, Sunbelt Software, and SANS' Internet Storm Center bumped up their warnings yesterday after Microsoft announced that attackers were exploiting a bug in an ActiveX control used by IE to display Excel spreadsheets. There is no patch for the vulnerability; Microsoft didn't release one in today's Patch Tuesday. A temporary fix that sets the 'kill bits' of the ActiveX control is available, but experts believe it's likely most users won't take advantage of the protection. Symantec raised its ThreatCon ranking to the second of four steps. "We're seeing it exploited, but currently on a limited scale," said Symantec's Ben Greenbaum. Sunbelt also bumped up its ranking, to high." Firefox users can't be too complacent; Secunia is warning of a 0-day in version 3.5.
kill bits (Score:5, Informative)
A temporary fix that sets the 'kill bits' of the ActiveX control is available, but experts believe it's likely most users won't take advantage of the protection.
Well, Computer World (and CWmike in particular), perhaps more users would take advantage of the protection if you would provide them a link telling them how when you first mention it [microsoft.com] rather than wait until the end of the article where they may not associate it as being the aforementioned solution.
My solution for ActiveX (no, not installing Linux) (Score:5, Informative)
I use the IE security settings. Yes. It works. The only real problem with it, is that they are a bit convoluted for ActiveX. I had to slow down and think before I got what I wanted, which is essentially to have any web site that wants to run ActiveX prompt me, and then I can choose to accept (but virtually never do).
Notice to web developers: If your site requires ActiveX, and it's not an absolutely essential service from a company that I can yell at, I will go someplace else. IIRC, I have one online financial service that fits that category.
Otherwise, I DON'T NEED ACTIVEX. NOBODY REALLY DOES. ANYTHING WORTH DOING CAN BE DONE WITHOUT IT.
And yes, that's shouting. It needs to be shouted loud enough for these people to hear it. It needs to be shouted again, and again. ActiveX belongs with IE6. Actually, it should have been killed off many revs before that. It should have been shot down by somebody who countered the suggestion at the very first meeting where it was discussed. Maybe somebody had the flu that day.
Re:server side scanning (Score:5, Informative)
You have a good point, but are you sure web sites are actually legally entitled to inspect what people are paying them to put on their servers?
If so, probably just a case of lazy and/or clueless administrators.
They have (Score:5, Informative)
If you go read the notice, you find out that Vista and Server 2008 aren't affected. Reason is that IE has a sandbox mode on those OSes (Windows 7 too) for things like that. However, it relies on changes to the OS so it hasn't been backported to XP and I don't know that it could be easily.
So yes, they have sandboxed ActiveX, but it applies to newer versions of Windows only.
Re:Ohh noes.... (Score:5, Informative)
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Excel.Sheet.8\BrowserFlags",00000008,"REG_DWORD"
I didn't put it in place for this vulnerability though, just because a lot of people use macros and don't know how to save as.
Re:Ohh noes.... (Score:2, Informative)
Re:Ohh noes.... (Score:4, Informative)
You are totally correct in saying that Office Web components won't be affected, I was just replying to the previous poster. Still anyone worth their weight as an admin wouldn't install Office Web components on anything.
Exploit (FX3.5) (Score:3, Informative)
Apparently, it should crash and open up calc.exe. On my machine (win7 RC1) it crashes bringing up the error report thingy.
No calc.exe for me.
Does this mean I'm "safe"?
Re:server side scanning (Score:3, Informative)
I agree that if there is a company that always has faulty products, that people would stop buying products from them. But nobody has stopped using windows (In this case the problem is IE, activex yada yada) because it generally works in most cases, for what people want it for.
I used to do tech support in a call center. The company I worked for made networking hardware, so the internet service that packaged our products the most, hired us to also do tech support for the customers with our products. Literally, my boss, his boss, as far up the chain at this company I could see, were a bunch of geeks ( we used to have prizes for good performances, that included the WoW expansion). What did they all use? What was working for our customers when it came to our products? What did our quality control guys, and the guys who lay out the plans for these products test them on? Windows.
Some of our Networking hardware would work on linux, Sometimes we would write drivers for linux, but when I would go and speak to the guys that had to write the software, they hated the linux part. (Of cause the major bullet point here is that not everyone believes Linux to be as practical as you do.)
So it's a double edged sword, if linux becomes popular, that would be cool! But once it becomes popular, any vulnerability, will be exploited.
Re:Active X again? (Score:4, Informative)
Whores only exist to lure married men from their wives, right? Kill 'em all, right? Just like ActiveX controls, whores have a purpose... not necessarily in line with their intended nature. What should we do with them?
I think I see the part you're missing that would explain to you why some (including me) think ActiveX is fundamentally flawed.
In terms of security, I think we can agree that the Internet including the Web is rightly regarded as a hostile network. We can also probably agree that good security is done in overlapping layers in order to minimize single points of failure. That's important for many reasons, not the least of which is that a glaring, single point of failure increases both the severity of exploits and the ease with which they may be carried out.
The problem with ActiveX is the lack of sandboxing. A control has the full privileges of the user running the browser. With XP machines that user tends to be an Administrator, compounding the problem. Trusting this environment to reliably and securely handle remote code on a hostile network is just begging for trouble. The idea is fundamentally flawed and tinkering with it may mitigate the problem but will not fix it. It needs to be abandoned and replaced.
Java is more suitable for this kind of task. That is, the needed sandboxing capabilities are an integral part of its design, which is not the case with the Windows DLL-type ActiveX controls. If you really want a Microsoft solution, Silverlight can run applications (both remotely and downloaded for local off-line use) and has its own sandbox. Even Flash apps are a better idea than ActiveX, which is saying something considering Flash's security history.
A solution with a good sandbox combined with running as an unprivileged user is a hell of an improvement. This means that an attacker who wants to own the machine has multiple hurdles. The more this is the case, the more difficult it is for an automated script to pull off a successful exploit. The fact that the malware is fully automated and can rapidly spread is part of why there are so many botnets and other problems. Think of it as something like a captcha: the more a successful exploit requires a determined human being, the fewer massive botnets there are. Fewer botnets mean less spam and fewer DDoS attacks and the like. Nowhere does the low-hanging fruit of ActiveX (and similarly flawed ideas) fit into that picture.
Re:Active X again? (Score:3, Informative)
Re:server side scanning (Score:3, Informative)
I use the CLI in XP quite often, sometimes it's just a lot easier and faster and more versatile than the gui option.
And now there's Powershell for XP, that's the new and improved CLI if I'm not mistaken, haven't used it yet though.