Forum Home
Press F1
Thread ID: 65029	2006-01-05 00:50:00	Uncle Billy Loves You!	SurferJoe46 (51)	Press F1

Post ID	Timestamp	Content	User
418338	2006-01-05 00:50:00	Uh huh . . yes he does! Let me submit the following c/p from another new article of Good Morning, Silicon Valley with credits on the bottom . (If you don't subscribe to this you cannot open the link to the url, so I c/p'd the article here and also the credits which is what they ask anyone to do) Microsoft's decision to wait until "Patch Tuesday" (Jan . 10) to release a fix for the Windows Meta File vulnerability that has spawned dozens of attacks since its discovery last week has prompted some security experts to do the unthinkable: urge businesses to install a non-Microsoft patch . "This is a very unusual situation -- we've never done this before . We trust (security software developer Ilfak Guilfanov), and we know his patch works," Mikko Hypponen, director of antivirus research at F-Secure, told News . com . "We've confirmed the binary does what the source code said it does . We've installed the patch on 500 F-Secure computers, and have recommended all of our customers do the same . The businesses who have installed the patch have said it's highly successful . " That the security community would advocate the use of an independent third-party patch is a remarkable comment on the critical nature of the WMF vulnerability and Microsoft's handling of it, which has inspired no small degree of incredulity in the security community . To wit, this post from the Internet Storm Center's Handler's Diary: While all of the rest of us were sleeping, it appears that the propeller-heads working on Billy Wonka's Official Microsoft Research and Development Team have been hard at work creating a crystal ball capable of foretelling the future . The only problem: it appears that they made it from rose-colored crystal . In their rosy vision of the future, over the next seven days, nothing bad is going to happen . The fact that there are point-n-click toolz to build malicious WMFs chock full o' whatever badness the kiddiez can cook up doesn't exist in that future . The merry, lil' Redmond Oompa Loompas are chanting "Our patch isn't ready / you have to wait / so keep antivirus / up-to-date" which makes perfectly accurate, current AV signatures appear on every Windows computer - even those with no antivirus software . . . . Imagine! You have tons and tons of work to do! Even now, the Oompa Loompas are hard at work out in Redmond, simultaneously regression-testing and translating Microsoft's WMF patch into Swahili and Urdu . And, somehow, as if by magic, all of this work will wind down at precisely the right moment so that the WMF patch doesn't have to be released "out of cycle . " How convenient! Especially if you're wanting to avoid all of that nasty "Microsoft Releases Emergency Patch" publicity . Good Morning Silicon Valley is written and edited with the able assistance of John Murrell .	SurferJoe46 (51)
418339	2006-01-05 02:20:00	Just a bit more to add to the above . A flaw in Microsoft's Windows Meta File has spawned dozens of attacks since its discovery last week, security experts warned Tuesday . The attacks so far have been wide-ranging, the experts said, citing everything from an MSN Messenger worm to spam that attempts to lure people to click on malicious Web sites . The vulnerability can be easily exploited in Windows XP with Service Pack 1 and 2, as well as Windows Server 2003, security experts said . Older versions of the operating system, including Windows 2000 and Windows ME, are also at risk, though in those cases the flaw is more difficult to exploit, said Mikko Hypponen, chief research officer at F-Secure . "Right now, the situation is bad, but it could be much worse . The potential for problems is bigger than we have ever seen," Hypponen said . "We estimate 99 percent of computers worldwide are vulnerable to this attack . " The Windows Meta File flaw uses images to execute arbitrary code, according to a security advisory issued by the Internet Storm Center . It can be exploited just by the user viewing a malicious image . Microsoft plans to release a fix for the WMF vulnerability as part of its monthly security update cycle on Jan . 10, according to the company's security advisory . "We have seen dozens of different attacks using this vulnerability since Dec . 27," Hypponen said . "One exploits image files and tries to get users to click on them; another is an MSN Messenger worm that will send the worm to people on your buddy list, and we have seen several spam attacks . " He added that some of the spam attacks have been targeted to select groups, such as one that purports to come from the U . S . Department of State . The malicious e-mail tries to lure the user to open a map attachment and will then download a Trojan horse . The exploit will open a backdoor on the user's system and allow sensitive files to be viewed . The WMF flaw has already resulted in attacks such as the Exploit-WMF Trojan, which made the rounds last week . Although Microsoft has not yet released a patch, security vendors such as F-Secure and the Internet Storm Center are noting Ilfak Guilfanov, a Russian security engineer, has released an unofficial fix that has been found to work . "Ilfak Guilfanov has published a temporary fix which does not remove any functionality from the system," F-Secure noted in its daily security blog . "All pictures and thumbnails continue to work normally . " Security companies also are advising computer users to unregister the related "shimgvw . dll" portion of the Windows platform . Unregistering the dll, however, may also disable certain Windows functions and has not been thoroughly tested, according to a security advisory issued by Secunia . Despite the potential for a large number of computer users to be affected by exploits related to this vulnerability, Hypponen said the chances of a widespread outbreak from a virus, as people return to work from the long holiday, are unlikely . "We are still far away from a massive virus," he said . "Most people get attacked by this if they (search for something on the Internet) and get a million results . They may click on a link that goes to a malicious Web site or one that has been hacked, and then get infected . "	Pancake (6359)
418340	2006-01-05 02:58:00	And from ComputerWorld NZ . . . ( . co . nz/news . nsf/news/B4714903757E6CBECC2570EB001286D4" target="_blank">computerworld . co . nz) Users of the Windows OS should install an unofficial security patch now, without waiting for Microsoft to make its move, advise security researchers at The SANS Institute's Internet Storm Center (ISC) . Their recommendation follows a new wave of attacks on a flaw in the way versions of Windows from 98 through XP handle malicious files in the WMF (Windows Metafile) format . One such attack arrives in an email message entitled "happy new year," bearing a malicious file attachment called "HappyNewYear . jpg" that is really a disguised WMF file, security research companies including iDefense and F-Secure say . Even though the file is labelled as a JPEG, Windows recognises the content as a WMF and attempts to execute the code it contains . Microsoft advised on 28 December that to exploit a WMF vulnerability by email, "customers would have to be persuaded to click on a link within a malicious email or open an attachment that exploited the vulnerability . " However, simply viewing the folder that contains the affected file, or even allowing the file to be indexed by desktop search utilities such as the Google Desktop, can trigger its payload, F-Secure's Chief Research Officer Mikko Hypponen writes in the company's blog . In addition, source code for a new exploit was widely available on the internet by Saturday, allowing the creation of new attacks with varied payloads . The file "HappyNewYear . jpg," for example, attempts to download the Bifrose backdoor, researchers say . These factors exacerbate the problem, according to Ken Dunham, director of the rapid response team at iDefense . "Risk has gone up significantly in the past 24 hours for any network still not protected against the WMF exploit," Dunham warns . Alarmed by the magnitude of the threat, staff at the ISC worked over the weekend to validate and improve an unofficial patch developed by Ilfak Guilfanov to fix the WMF problem, according to an entry in the Handler's Diary, a running commentary on major IT security problems on the ISC web site . "We have very carefully scrutinised this patch . It does only what is advertised, it is reversible, and, in our opinion, it is both safe and effective," Tom Liston writes in the diary . "You cannot wait for the official MS patch, you cannot block this one at the border, and you cannot leave your systems unprotected," Liston writes . In the diary, ISC provides a link to the version of the patch it has examined, including a version designed for unattended installation on corporate systems . While ISC recognises that corporate users will find it unacceptable to install an unofficial patch, "Acceptable or not, folks, you have to trust someone in this situation," Liston writes . Due to public holidays in Europe, Microsoft representatives could not immediately be reached for comment . F-Secure's Hypponen highlighted Guilfanov's patch in the F-Secure company's blog on Saturday night, and then on Sunday echoed the ISC's advice to install the patch . Not all computers are vulnerable to the WMF threat: those running non-Windows operating systems are not affected . According to iDefense's Dunham, Windows machines running Windows Data Execution Prevention (DEP) software are at least safe from the WMF attacks seen so far . However, Microsoft said that software DEP offered no protection from the threat, although hardware DEP may help .	bob_doe_nz (92)
418341	2006-01-05 03:09:00	For more information and an unofficial patch for XP SP1 and 2 and Windows 2000, see here isc.sans.org Install the unofficial patch at your own risk however and dont forget to uninstall it before installing the official patch when it is released. It creates an entry called Windows WMF Metafiles Vulnerability Hotfix 1.4 in Add/Remove Programs. I have installed it (XP SP2) and it works on my setup.	Pancake (6359)
418342	2006-01-05 10:45:00	Gotta love the Christmas holidays, where people around the world always seem to have nothing better to do with their time than make sure the rest of us spend the holiday season sitting front of our PCs trying to protect our data ;)	Chilling_Silence (9)
418343	2006-01-05 22:05:00	yep	stu161204 (123)
418344	2006-01-06 01:54:00	The microsoft patch is now available from the update site.	Pancake (6359)
1