Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Windows .ANI Problem Surfaced Two Years Ago

Posted by Zonk on Fri Apr 06, 2007 04:22 PM
from the about-twenty-times-longer-than-firefly's-run dept.
Microsoft Operating Systems Security Software Windows
An anonymous reader writes "There's a new twist to the tale of Windows .ANI exploit, that's been in the news all week (including when a spam campaign used the teaser of nude Britney Spears pictures to lure people to malicious sites). InformationWeek reports the Windows .ANI bug at issue first surfaced — and was patched — two years ago, in early 2005. 'If they had simply looked for other references for the same piece of code when they originally dealt with it a few years ago, they would have found this and patched it in 2005,' says Craig Schmugar of McAfee. 'It would have saved a whole lot of people a lot of time, money and effort.' Microsoft claims this .ANI vulnerability is different from the old, but beyond that they're not talking."
+ -
story

Related Stories

[+] Windows Vulnerability in Animated Cursor Handling 338 comments
MoreDruid writes "Secunia reports a vulnerability in Windows Animated Cursor Handling. According to the linked article, the rating is "extremely critical". Microsoft has put up their own advisory on the subject, confirming this is a vulnerability that affects Windows 2000, XP, 2003 and Vista. The exploit has already been used in the wild. From the Secunia page: The vulnerability is caused due to an unspecified error in the handling of animated cursors and can e.g. be exploited by tricking a user into visiting a malicious website using Internet Explorer or opening a malicious e-mail message. Successful exploitation allows execution of arbitrary code."
[+] IT: WoW Players Targeted By Windows Flaw Exploit 130 comments
grimwell writes "The BBC is carrying the story that the ANI flaw is being used to target World of Warcraft players, as hackers search for account details. 'Analysis of that malicious software showed that it lay dormant on a victims machine until they ran World of Warcraft (WoW) at which point it captured login data and sent it to the hacking group ... Research by security firm Symantec suggests that the raw value of a WoW account is now higher than a credit card and its associated verification data.'" Doubtless, any compromised accounts would quickly see their equipment sold, and the resulting gold transferred to another account. This gold would then be sold for US currency to Real Money Traders like the company IGE.
[+] IT: MS Mulling Changes to Thwart .ANI-type Attacks 99 comments
Scada Moosh writes "ZDNet has a story about the lessons Microsoft learned from the recent animated cursor (.ani) attacks and some of the broad changes being made to flag this type of vulnerability ahead of time. The changes include a possible addition to the list of banned API function calls, more aggressive checks for buffer overruns and enhancements to existing fuzz testing tools. '[Michael] Howard said Microsoft will "rethink the heuristics" used by the /GS compiler to flag certain issues. "Changing the compiler is a long-term task. In the short-term, we have a new compiler pragma that forces the compiler to be much more aggressive, and we will start using this pragma on new code," he added. Two other Windows Vista security mechanisms -- ASLR and SafeSEH -- were also in place to catch code failures but, in the case of the .ani bug, Howard said the attackers were able to wrap vulnerable code in an exception handler to find ways around those mitigations.'"
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

Windows .ANI Problem Surfaced Two Years Ago 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • How is that a lure? (Score:5, Funny)

    by kypper (446750) on Friday April 06 2007, @04:26PM (#18640145)
    when a spam campaign used the teaser of nude Britney Spears pictures to lure people to malicious sites

    Talk about an anti-virus.
    If all attempts to hijack my machine involved using her as a lure, I'd uninstall AVP in a heartbeat; you couldn't pay me to see her nude.

  • Strange... (Score:4, Funny)

    by creimer (824291) on Friday April 06 2007, @04:31PM (#18640209) Homepage
    The last time I saw an ANSI bug was during my days as a BBS Sysop years ago!

    • The last time I saw an ANSI bug was during my days as a BBS Sysop years ago!

      Actually, the ANSI sequence 'viruses' (which were done by remapping keyboard keys to macro sequences which then executed commands) are just another form of terminal sequence attack that was quite popular a few years back when many people were still using terminal-oriented mail readers like pine, elm and mutt. These were the good ol' days when ISPs passed out shell accounts for reading mail and such. It forced Linux distros to shor

  • InformationWeek reports the Windows .ANI bug at issue first surfaced -- and was patched -- two years ago, in early 2005....
    Microsoft claims this .ANI vulnerability is different from the old, but beyond that they're not talking."

    So now we can say that Windows actually had twice as many ANI bugs as we originally thought and Microsoft admitted so themselves.

  • Wouldn't that be (Score:5, Funny)

    by eviloverlordx (99809) on Friday April 06 2007, @04:35PM (#18640257)
    an .ANL exploit?
  • This has been written about multiple times in multiple places. Not to mention this was already referenced in the article from the Slashdot posting a few days ago. Keep it moving...

  • This ANI exploit is different! (Score:5, Funny)

    by andrewd18 (989408) on Friday April 06 2007, @04:41PM (#18640329)

    Microsoft claims this .ANI vulnerability is different from the old, but beyond that they're not talking.

    Of course this .ANI exploit is different... the one that came out in 2005 didn't affect Vista!

  • Incompetent Liars (Score:5, Insightful)

    by Jeremy_Bee (1064620) on Friday April 06 2007, @04:54PM (#18640491)
    The thing that bugs me the most about these kinds of issues is the reporting of them in the media.

    If you read the slashdot summary (or even the whole first page of the article), you get the impression that some people think the bug is pretty much the same thing as the 2005 one and that Microsoft disagrees. The story is structured like a "He said, she said," kind of thing and no one is painted as right or wrong. If you *do* manage to make it to the second page of the article however, you find out that several very respected security professionals and security companies present detailed compelling evidence to the effect that Microsoft is both incompetent and disingenuous in their opinion on this bug.

    It is the same bug (essentially) reported in 2005, and it should have been caught in a matter of hours or even minutes after the 2005 bug was initially reported to them. This by reason of Microsoft's own self-stated bug hunting and code modification procedures.

    The conclusion is absolutely inescapable that Microsoft completely failed to follow their own basic rules of coding and security auditing here. They also are lying or at the very least splitting hairs about it being a "separate issue," and they seem to be deliberately trying to pull the wool over peoples eyes about it. Yet this story has been reported around the web as a kind of "maybe McAfee is right, or maybe Microsoft is right," thing for the most part??? Why?

    On top of all of that, this is yet another (of about three instances I have found so far), where it's clear that Vista is not "all new code" as MS likes to maintain it is. It seems like this bug occurred because the same old *.ani code from the previous versions of MS Windows was included in Vista with literally no oversight and no checking.

    Why do people buy products from these people again?
    And why do they always seem get the benefit of the doubt in the media?

    • Re: (Score:3, Insightful)

      by Watson Ladd (955755)
      To answer the first question: API lock-in. A lot of strange hardware is windows-only, and the same with a lot of software. Microsoft might have horrible API's, but people use them to appeal to the Windows market, and so increase its size. Look at COM vs. Objective-C. The answer to the second question is because of the fear of a libel suit. You said the bug occurred because Microsoft didn't check it. Far more likely is they checked it incompetently. The difference is the difference between libel and truth. A
      • Do you have an honest belief that what you have stated is true?
        If so there is no slander or libel. (A court ordered apology and forced publication of a correction in the same media that the initial comment was made may still be required, however).
        -nB

    • Re: (Score:3, Interesting)

      by garobat (804835)

      On top of all of that, this is yet another (of about three instances I have found so far), where it's clear that Vista is not "all new code" as MS likes to maintain it is. It seems like this bug occurred because the same old *.ani code from the previous versions of MS Windows was included in Vista with literally no oversight and no checking.

      Well, considering the mount of dialog boxes kept unchanged from XP and all, it seems pretty obvious that Vista is not "all new code". And what would be the point, as

    • Re: (Score:2, Offtopic)

      by mypalmike (454265)
      I'm not using Vista, and I'm writing this on my Debian box. But this is ridiculous.

      It is the same bug (essentially) reported in 2005, and it should have been caught in a matter of hours or even minutes after the 2005 bug was initially reported to them.

      Do you write code? It sounds like some copy-and-paste code had a bug in it, and they didn't catch both places. They probably should have caught it, but they didn't. If they are incompetent merely because they have code that is exploitable by stack overflow
      • Or perhaps the issue was fixed in a branch, but for some reason never got committed to the main trunk(s).

      • Re: (Score:2, Insightful)

        by Tanuki64 (989726)

        Do you write code? It sounds like some copy-and-paste code had a bug in it, and they didn't catch both places.
        I do write code. And copy-and-paste code is always a sure sign of an incompetent coder.

        • Re:Incompetent Liars (Score:5, Insightful)

          by Bodrius (191265) on Friday April 06 2007, @09:37PM (#18642769) Homepage
          Really? I write code for a living too, and a categorical statement of the form "doing X is ALWAYS a sign of an incompetent coder"... always seems to me, at best, a sign of an unexperienced coder. Either that, or an extremely lucky one.

          I'll just assume your case is the latter :-)

          Sure, copy-and-paste duplication should be avoided where possible, along with gotos, reinventing the wheel, long complicated functions, lack of type safety, etc.
          Also, all code should really be a perfect and pristine example of elegance and modularity. Bug-free is even better!

          Reality bites, though.

          Unless we're talking of brand-new projects of a small size, I find it really hard to believe that comminiting to 0% copy-and-paste-code is a practical proposition.

          For a non-trivial product with some legacy, copy-and-paste is often the best among various non-optimal choices.

          - Do you really want to tightly couple these two unrelated components because you want to use those 5 lines of code?
          - Can you afford to carry over all of the dependencies on that library or class?
          - Or can you afford the refactoring to avoid those dependencies? How many new components (which were not changing before) do you need to retest now that you pulled the code out?
          - Can you afford to lose that development and testing time on other features that you need for RTM?

              That's not to mention the almost-guaranteed design time discussing where that re-usable code should move to in the first place... and do we need to change it to make it more generic? Do we need to ship all the refactored components with no functionality change? etc. etc.

          I agree with the sentiment: Copy-and-paste duplication sucks, and should be avoided wherever possible.

          But honestly, if you can ALWAYS say that avoiding copy-and-paste at all costs is the right decision for your product, for your team, and for yourself... I don't know whether to envy you, or to fear you.

          • Here here! I know, I just copied and pasted an entire application's code. I then did modifications to the code. Why? Because even though I would have loved to have spent the next 6 month rewriting the application from scratch, a different department needed 98% identical functionality; and my boss was not going to authorize 1040 hours of work to maintain best case scenario coding practices when we could roll the copied code out in 24 hours of work. And to keep from doing a copy and paste, we would have
            • It seems you missed the point of the comment, so I'll just cut short to the argument we seem to agree on.
              Which incidentally, was the whole point of the comment.

              But honestly, if you can ALWAYS say that avoiding copy-and-paste at all costs is the right decision for your product, for your team, and for yourself... I don't know whether to envy you, or to fear you.

              Code duplication has risks. You learn about the risks in almost each book about software engineering. Is it always the right decision to avoid it

        • it didn't sound like copy-paste to me. The first bug( found Dec 2004 ) was a failure to validate one of the parameters of an Animated Mouse function and the invalid value of "0" could be exploited. What I read in the recent story is that the current bug is due to another parameter of the same function going unchecked and/or accepting invalid data. They used the term "header" in the story but I think they must have ment parameter since that was publicly stated as the problem with the 2004 instance of the bug

    • Re: (Score:3, Insightful)

      by bendodge (998616)

      Why do people buy products from these people again?

      Because (overall) it just works, and has incredibly good hardware support.

      It also is aesthetically pleasing. While there has been lots of effort put into making things like KDE look good, the individual shiny buttons and bars don't agree with a universal theme. Windows development is centralized, so the everything fits together visually.

      I personally prefer the look of Windows XP to any OS (note I haven't used Vista), just because the gradients, buttons, and esp the fonts all fit together smoothly.

      • It also is aesthetically pleasing. While there has been lots of effort put into making things like KDE look good, the individual shiny buttons and bars don't agree with a universal theme. Windows development is centralized, so the everything fits together visually. I personally prefer the look of Windows XP to any OS (note I haven't used Vista), just because the gradients, buttons, and esp the fonts all fit together smoothly.

        Sadly, the uniform look&feel of Windows has been slowly becoming worse in rec

        • Please stop by and fix my wireless connection that fails because "the cache couldn't be emptied."
          No hurry, though, as the Mac right next to it is able to seamlessly connec
          Please stop by and fix my wireless connection that fails because I updated to OS X 10.4.9 (from 10.4.5 -- apparently the updated drivers aren't working?).
          No hurry, though, as the Kubuntu Linux laptop I'm typing on is able to seamlessly connect.

    • Re: (Score:2, Insightful)

      by ceroklis (1083863)
      Microsoft has access to the source code, the "experts" don't. They have simply no basis for these claims. Their conclusions are based on their ideas on how code is supposed to be written, not on knowledge of the actual structure of the code in question. Ever tried to debug old spaghetti code that was written ten years ago, never properly documented and that nobody in the organization understand anymore? Maybe it is more complicated than they think. That's why I wouldn't trust them more than Microsoft on the
      • Uh, it IS the exact same bug, you put too much data into a certain data structure type within the ani type files and you hit a buffer overflow. The only change with this iteration is that they patched how the code is called to handle that structure for the first occourance of the structure in the file, in otherwords they applied a bandaid by not allowing the corrupt data structure to get to the vulnerable code, but they failed to realize that if you put a second occourance of the data structure in the file

    • Re: (Score:3, Interesting)

      by UnknowingFool (672806)
      This sounds familiar. One of my friends who once worked for MS showed me a bug in the screen saver. It was first identified in NT4. It was fixed in Win2K. But when XP came out, the bug was back. It wasn't one that would allow for attack; it was just one of those annoying ones, but it was astonishing that it still existed.

    • Re: (Score:3, Interesting)

      by Foolhardy (664051)
      There is a certain class of security vulnerability where malformed data passed to a library in the same process can cause code execution. From the library's point of view, since the library is in the same process as the caller, they're both at the same trust level, so calling a function does not cross a security boundary and no secure validity checking need be performed. The worst that could happen is that an app causes a library to execute code in its own process, a non-issue. The only parties involved are
      • The new stuff is the extensive DRM, especially including the so-called "Trusted Computing" tools, and the remains of the attempts in insert WinFS, which turned out to be pretty unusable and wound up thrown out.

  • Out of interest.... (Score:5, Funny)

    by Anonymous Coward on Friday April 06 2007, @05:16PM (#18640757)
    How many other people clicked on the "teaser of nude Britney Spears pictures" link in the Slashdot story and were bitterly disappointed?

  • Denial about an unfixed security problem? Time for the "insecurity" tag.

  • useless (Score:3, Insightful)

    by digital bath (650895) on Friday April 06 2007, @07:16PM (#18641837) Homepage
    this is useless without pictures
  • Does anyone have a link to any information that actually explains how thi exploit works? I've been reading about it for over a week, but can't find any susbtantial information Just warning that it can hit you from web page content or html e-mail reading. But what that has to do with animated cursors is not at all clear. I've never yet seen an html page that could change my user selected cursor, so how is it that this exploit actually affects the user's computer?

    • Re: (Score:3, Informative)

      by jwgoerlich (661687)

      Does anyone have a link to any information that actually explains how thi exploit works?

      Here you go: Analysis of ANI "anih" Header Stack Overflow Vulnerability [mnin.org]

      Basically, an animated cursor is just one way to exploit a problem with Windows' GDI (graphical device interface) implementation. Windows runs this as part of the user's session and it is, in part, in kernel mode. Just like Jon Ellch and David Maynor showed with the Apple wireless driver exploit, if you can get access to the kernel, you can do pret

      • Thanks. This was very helpful, and also makes it very clear that this is much more serous than something that just deals with animated cursors. In fact, I'm at a loss to understand why the community is attaching the aminated cursor reference to it.
      • Interesting, thanks. Or not that interesting - just another buffer overflow exploit in code that doesn't validate it's input fully.

        Observations: If DEP/the NX/XD bit was actually turned on on Vista or XP by default, this would have no effect.
        Bit dissappointing that Firefox falls for this too. I REALLY DON'T WANT Firefox to support animated cursors....

        • If DEP/the NX/XD bit was actually turned on on Vista or XP by default, this would have no effect.

          Would it? I am not so sure. DEP protects against execution from the stack. Instead, this exploit uses jmp (jump) to make calls against user32.dll. This is a different animal than what DEP is designed to catch.

          J Wolfgang Goerlich

      • Re: (Score:3, Interesting)

        by mgiuca (1040724)

        Basically, an animated cursor is just one way to exploit a problem with Windows' GDI (graphical device interface) implementation. Windows runs this as part of the user's session and it is, in part, in kernel mode.

        This is why I've been saying this problem has NOT been caused by a mere "bug in the code". Bugs happen to everyone, and it's not about blaming people. It's an accident.

        But this issue has not been caused by a mere bug. It's been caused by a catastrophic design flaw in Windows itself (which I persona

      • Re: (Score:3, Informative)

        by cnettel (836611)
        The analysis you link to does not mention the kernel. It's true that some GDI is in kernel land, but a surprising amount of resource access, like this, is not. The exploit, in its current form, is firmly in the userland part, and constrained by the security tokens of the thread and process. That's often bad enough, though.

    • Netcraft says for the asus.com website that it was running Windows Server 2003 but other foregin ASUS sites were running a mix of Linux/BSD.


      Aha!

      I had always wondered why the non-US ASUS sites were so good but the "actual" .com was so buggy and annoying.
    • I do. When a known bug surfaces that affects a lot of people, it's basic security practice to check for other projects that use this chunk of code. In a well-built source control system, it's pretty obvious. With programmers who don't know or try to read how things work doing cut&paste programming, it's uncontrolled and unmanageable.

      Guess what company famous for stealing software, lying about its security, famous for hiding "features" that deliberately break interoperability doesn't want to expose its c

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2010 Geeknet, Inc.