Widespread Attacks Exploit Newly-Patched IE Bug 141
itwbennett writes "The first widespread attack to leverage the Internet Explorer flaw that Microsoft patched in an emergency update Thursday morning has surfaced. By midday Thursday Symantec had spotted hundreds of Web sites that hosted the attack code. The attack installs a Trojan horse program that is able to bypass some security products and then give hackers access to the system, said Joshua Talbot, a security intelligence manager with Symantec. Once it has infected a PC, the Trojan sends a notification e-mail to the attackers, using a US-based, free e-mail service that Symantec declined to name."
Relatedly, reader N!NJA was among several to point out that Microsoft has apparently been aware of this flaw since September.
kind of makes you wonder (Score:5, Interesting)
in TFA: The flaw was in the Microsoft Security Response Center's (MSRC) queue to be fixed in the the next batch of patches due in February but the targeted zero-day attacks against U.S.
Kinda makes you wonder just how many of these critical security bugs IE currently has in their queue to be fixed "sometime in the near future"?
And at the same time you have to wonder just how nasty some of the others are that haven't made the cut yet, just waiting to become the next "zero day we own your computer, again"? We see how big of an issue this is, and MS was clearly in no hurry to fix it, so you'd have to assume that there are at least a few more of these that they know about and aren't fixing yet.
Re:kind of makes you wonder (Score:5, Insightful)
Re:kind of makes you wonder (Score:5, Insightful)
Or even admit that there actually is a flaw. Microsoft were told about this months ago and there's no reason to believe that the first person to find a flaw with be a "white hat".
Re: (Score:3, Interesting)
either thing sounds quite bad for Microsoft. The first means their queue security is inadequate and that's a really big pr
Re:kind of makes you wonder (Score:4, Interesting)
Re: (Score:2)
No evidence, apart from behaviour. Read the section on Nanchang Internet cafes in the wikipedia article [wikipedia.org] on Red Flag Linux. Also see this article [rfa.org] which implies it probably wasn't limited to that city and that the order came from high up. All Internet Cafes have been required to run Red Flag Linux, whether they previ
Re: (Score:2)
NSA, CIA, FBI liked the holes too, masking their online intel gathering/planting/tracking under the cover of semi pro script kiddies.
It takes time for the next gen of long term useful holes to be found, examined and rolled out in the field. Would MS hold off on a patch for many ongoing investigations?
MS is one big honeypot, everybody uses it, everybody gets in.
From UFO hunters, to the feds, to Communist party members.
As for sec
Re: (Score:3, Interesting)
That is the main problem with closed source software; in the event of a security hole, you as a customer / company are left to the mercy / arrogance of your software vendor to patch the flaw. Until he does, you can do nothing but become increasingly concerned...
0day? Fixed tomorrow!
You can patch only what you know how to patch.
In 2008 there were between 6 and 10 million lines of code in the Linux kernel alone. Linux Kernel Surpasses 10 Million Lines of Code [slashdot.org]
In 2003 OpenOffice.org had 9 million lines of c
Re: (Score:1)
The other problem is that as a company, you can't just make a patch and send it off like you can with open source. You have to QA the thing first. Plus, I'd bet some companies have procedures and sign-offs that need to happen. Basically, red tape.
Re: (Score:2, Interesting)
Isn't this just an argument for Microsoft's removal of FTP server updates and no "out of band" patching, and to only release "scheduled patching" (All this as I recall back at a time when Microsoft said they were going to enhance security from these changes)
Since that time shit has rolled downhill.
Does the Secunia warning on IE get ignored because of Microsoft's enhanced security policies? Or is it because removing IE's activeX breaks WGA?
Personally I'd love to see tools for XP which allow removal and inst
Re: (Score:2)
Re: (Score:2)
You sure can. But at the same time, lots of other developers/power users/hackers/whatever may be willing to take the patch and provide feedback on it.
Re: (Score:2)
I was being a tad sarcastic. Im not now.
When is it ever the right thing to release a security patch with no QA or testing? You use an interesting word may, as in
Are you suggesting to leave security QA to chance? Hoping someone will take a look at it? How are you going to make sure your patch really fixes the problem?
-Foredecker
Re: (Score:2)
No, not at all! Re-reading my comment, it may sound like I was suggesting that it's okay to release something without testing it - that's not what I meant.
Don't open source people release patches to other developers for testing? I'd imagine that a lot of open source developers don't have the resources to fully QA everything themselves. That's all I was saying.
Re: (Score:2)
My original point was that open-source teams - at least those who develop more popular products - may be able to develop, test, and deploy patches faster, because there may be a wider group of people who are willing test patches and provide feedback, and they may be able to do it without the same kind of red tape that you may encounter at a large company when there are product managers, QA teams, and paperwork involved.
Re: (Score:1)
That is not really true. You, as a outsider, will need some time to understand the code and what is causing the error before you can fix it. That will take time and you can bet (for everything, but the smallest pieces of software) that it won't be "Fixed tomorrow".
I suppose you could find someone who knows the code and throw money at him to fix it, but I suspect you could do the same with Microsoft, if you cared enough about the problem (but proberly quite a bit more expensive).
I expect to be modded down fo
Re: (Score:3, Insightful)
How about this: with a commercial software vendor - heck, lets just use Microsoft - you have a vendor that has the funds and qualified staff to fix problems quickly; Seucrity and regular bugs alike. You likely have a support contract that requires this. Things are found and fixed quickly and reliably. There are people whos job it is to respond to email and answer the telephone. Heck, they will even fly out to your site if they need to. If you are in a moderately big city there is likely support people alrea
Re: (Score:3, Insightful)
"Kinda makes you wonder" if it's another slow news day. I mean, how many people did NOT see this coming? Even Joe Sixpack probably had this figured out - assuming that he even watches the evening news. Wait - maybe I'm getting senile. Joe stopped watching the news when he figured out how to schedule his programming around ESPN, More Gore Television, and Hot Chicks After Hours.
Phhht. Maybe this IS news to part of the world?
Re:kind of makes you wonder (Score:4, Insightful)
I'm the last guy you can accuse of being a Microsoft fanboy, but let's be fair on at least one aspect: it is helpful if the patches do their job (closing the hole) without breaking functionality (especially with enterprise software, where Microsoft counts its biggest customers).
I agree perfectly that it is a fundamental flaw in proprietary software to have potentially exploitable vulns that only, say, Microsoft and maybe the script kiddies know about. I further agree that failing to disclose them prevents users from implementing some sort of work-around (depending on severity, blocking certain script actions at the proxy, implementing certain GPO actions to mitigate damage, etc). OTOH, most of Microsoft's customer base wouldn't even know what a work-around is (aside from just using a different browser, which is probably not what you'll see Microsoft recommending).
The nasty stuff is lurking in there, certainly. Whether the bad guys know about it and can actually use it is another matter. I personally subscribe to the philosophy of full disclosure - it is better that everyone using the product know about flaws in it, if only to protect themselves. OTOH, I can see and appreciate (though not quite agree to) the opposite tack of limiting fields of research for the bad guys, as evidenced by the bad guys' habit (among others) of sifting through patches to find the flaws... where I part ways is in knowing that the patch-sifting is only one of many tools in which to find vulns. Whether it is the most popular method or not, I do not know.
Re: (Score:2)
Unfortunately you're right, from a manager's point of view. Security, for them, is nice to have, but it must not get in the way of a smooth workflow. It's not "how secure is my system" but rather "how much does it cost if there's a leak and how likely is it to happen". It does simply not matter to them that they're insecure, as long as the data loss vs. its likelyness to occur comes out on top of the cost (be it direct, i.e. having to buy something, or indirect, i.e. hampering workflow and productivity), se
Re: (Score:2)
Nope. It makes them hire some "external consultant", who will get a shitload of money to tell them what you told them a billion times already, they will look at it, assess the probability to happen again and file it accordingly.
Don't think that managers learn from experience.
Re:kind of makes you wonder (Score:4, Interesting)
I like to think that the code for IE is so horribly mangled that it takes a solid month to get the thing to build (including compile errors, stupid typo bugs, compile time, compiling for all the different windows configs, etc)
It makes me feel nicer that it could just be a shitty project, rather than just shitty people.
Re:kind of makes you wonder (Score:4, Funny)
There is no reason why they can't live together in unison.
Re: (Score:2)
Sorry to pop your fantasy bubble, but IE, Windows, Office, Visual Studio and pretty much everyting else we ship build every day. That includes all the flavors: release, checked (debug), 32-bit, 64- bit, Itanium (yes, we still build that), and several languages. The build pretty quickly to - usually just a few hours. This is from 100% source to a fully installable product.
With few exceptions, the code base is very 'clean'. That's true for most our products as well. For example, we have what we call 'MQ'
Re: (Score:2)
So then, what is the justification for such bugs "laying" around for so long? Perhaps you are doing something. What then? You are a black box to 99% of the people out there, some indication of activity on the issue would probably be appreciated.
All we can see is: bug gets noticed, and - maybe - it gets fixed in a few weeks, a month, maybe longer.
Can you really fault us for having this opinion, if you look from our perspective?
Re: (Score:2)
Im not on the IE team so I cant speak to specifics. But here is what I know. Finding and fixing security bugs is the highest priority on every developers plate. When we learn about one in code we own things stop, we triage it, and we come up with a plan to fix it.
Often that plan is executed pretty quickly (sometimes even days...). Other times it takes longer. The reason is that almost none of these issues are easy to fix. Many of them must be done carefully so as not to break things or cause other security
Re: (Score:2)
Thanks for the good post. I've not looked at any of it yet, but I will. I appreciate you responding thusly and not just "freaking out" as any other slashdotter would do.
Regarding the freeshell page - that's not really intended for anyone's use than mine. At one time or another, a link would have been added by me to serve as a bookmark I could get from anywhere.
The slashdot comment that fired you up, was intended to be funny. I had no idea someone who actually had a clue would stumble across it. I am no code
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re:kind of makes you wonder (Score:5, Insightful)
I'm a software developer. I have a list of things I need to fix, some things are higher priority. We set a date, and work as many patches as we can toward that date, into a single release or patch. Makes it easier to test when you bundle several things together, and can test 5 patches with a single test case instead of individually. That makes the cycle more efficient.
Now, a large company would have more patches, and more would be high priority. So they fix what they can, that makes sense. Open the bug list, sort by priority, own one (or get assigned one). To the developer, this is just one of several (hundred?) problems on the list. Management has to increase the priority based on input from triage.
The entire world might know a defect is a security vulnerability, but if it's not made clear to the triage guy, it will sit as "possible denial of service" medium or medium-well priority until the known vectors are taken care of.
Thinking about it this way makes Microsoft's blunders understandable. Not forgivable of course. My customer sends me a bug report and says "gwah, you're exposing my entire database to everyone fix it now or face a lawsuit!!!!eleventy". I say, let's take a look, we find out that yes you can see the entire data set - after you enter your credentials and only while on your company's network, and you just sent a mail to your competitor with your credentials in it. Change your password, WONTFIX. In other words, MS has to have good info in order to decide how to prioritize.
At the same time, they have to keep their customers and shareholders happy, so while the triage guy says "this is the worst bug ever in the history of everything and it needs to be fixed yesterday" the company itself says to the employee "sure, but follow all processes and have it reviewed and put it in the next patch cycle and we'll test all of them next week and prepare for a release next week."
Then to its customers and shareholders it says "A small, hard-to-exploit exploit has been found and even though ASLR and DEP and sandboxing are in place, someone might after a million failures be able to exploit this exploit so we've decided to be proactive and fix this exploit. We haven't heard of anyone exploiting this exploit, but we didn't really ask any of our friends in the malicious software industry - but that was just because we didn't want to tip our hand. Your security is, after all, very important to us. Exploit."
In short: there are more than we'll ever know.
Re: (Score:2)
Re: (Score:1)
Bundling (Score:1)
Why is bundling multiple changes/patches better? Seems like if you did it one at a time, if something broke, you would be pretty confident the new code was doing it. With multiple simultaneous changes, if something broke, you would have to sort out *which* of the new changes was responsible first, or also contemplate if the random combination of any of the changes was responsible, which greatly ups the number of potential problems to look at.
Re: (Score:2)
Re: (Score:2)
Because some problems interact. For instance because they affect the same code modules and fixing them one by one would actually be require more work overall - possibly involving additional throwaway temporary work. This could even delay getting them both fixed compared to fixing them in one go.
Re: (Score:1)
Re: (Score:2, Funny)
The attack installs a Trojan horse program that is able to bypass some security products
I don't see why you're so worried, this obviously refers to the equestrian unit.
Re: (Score:3, Interesting)
Re: (Score:3, Informative)
threat? (Score:5, Insightful)
Microsoft has apparently been aware of this flaw since September.
Further evidence that the only "threat" as far as MS is concerned is the threat of a damaged public perception. Although I suppose that's an improvement in itself.
Re: (Score:1)
I just laugh. I haven't had to reformat the drive even once since I obscured IE.
Re:threat? (Score:5, Informative)
I just laugh. I haven't had to reformat the drive even once since I obscured IE.
If you use windows without IE you are still very much at risk from the many other windows holes. You will cracked sooner or later and you may not even notice.
Re: (Score:1, Insightful)
If you use windows without IE you are still very much at risk from the many other windows holes. You will cracked sooner or later and you may not even notice.
How would you possibly know he will be cracked? If he doesn't click on and run malicious code he won't be "cracked". You do realize that Windows has had a firewall on by default for many years now, right? Today, the biggest source of vulnerabilities are applications. Since he has already taken Internet Explorer out of the equation by not using it, these vulnerabilities are in things like Firefox, Flash, Office, Acrobat Reader, etc. The attacks based on those vulnerabi
Re: (Score:3, Interesting)
So you are saying that any windows machine that doesn't run IE is safe-ish? Because it's not, there are countless flaws in other Microsoft code any one of which could cause a major security problem. If you don't start with a good design you have NOTHING.
You don't really trust a software firewall written by Microsoft do you? If you want a firewall use a proper ( i.e. not software ) one.
(i.e. not software) (Score:2)
Re: (Score:2)
What useful firewall are you referring to that isn't implemented in software? Or by "(i.e. not software)" were you referring to anything implemented on an appliance?
Ok, they are all implemented in software on some device or other. I was using the naive definition of a 'software firewall' which I take to mean one running on the user system it's meant to protect.
A better firewall would be one running on a device between the two user system and the internet like a Cisco device or a OpenBSD or Linux machine.
Re: (Score:1)
The question is what you're expecting a firewall to do.
What the Windows Firewall does by default (in a Public network) is prevent any incoming traffic to open TCP or UDP ports. This works very well and there are few edge cases where a separately hosted Firewall would provide a significant advantage.
What it does not do is prevent any kind of outgoing traffic - you can configure this through policies in a corporate network, to prevent unapproved applications from accessing the network (which also works well),
Re: (Score:2)
I think he's expecting it to be on a device other than the one easily compromised. One bit of malware placed on there by the user and the software firewall is completely pointless. Something in between the problem machine and the net at least stops you from spamming the world. In most large corporate environments you will always get somebody that thinks it's a good idea to put something that contains malware on a machine. It's always better to assum
Re: (Score:3, Insightful)
80% of home Windows computers have been compromised [eff.org] by one or more viruses.
IE market share is below 40% [w3schools.com]
You do the math.
Interestingly, even though most of those apps you mentioned as sources of vulnerabilities exist on other platforms, the rates of infection of anything other than Windows remains at zero or close to it. I'd say that points to a platform problem, not an application one.
Just wait until Linux becomes popular! (Score:2)
Re: (Score:2, Interesting)
I've seen many compromised Linux machines sending out spam. Especially prevalent in Germany, where 1&1 and similar mass hosters provide hosted very cheap rental of Linux servers.
Of course, the issues are the same as those of compromised Windows systems:
* Not up to date on security patches
* Admin doesn't know what he's doing
* Using insecure legacy versions of software
Claim EPIC FAIL (Score:2)
You forgot to list one: designed from the ground up with insecurity in mind
Oh wait. That's right. Only one of the OSes mentioned meets that criterea.
You have offered no evidence that a Linux machine was compromised. It is impossible to tell based on the fact that SPAM is coming from that direction. A poorly configured mail server allowing SMTP relaying does not const
Re:threat? (Score:5, Informative)
IE market share is below 40% [w3schools.com]
Anyone who uses w3schools's browser stats as a reference for general browser usage needs to get knocked on the head a few times. That is a perfect example of biased results due to the nature of the sample.
A better number is about 62% [wikipedia.org].
Re:threat? (Score:4, Insightful)
If you use windows without IE you are still very much at risk from the many other windows holes. You will cracked sooner or later and you may not even notice.
Even more disturbing, some people may notice and not think much of it. What is the most obvious evidence you can imagine of being 0wned? I talked to a guy once who was telling me of PC troubles (he knew I was a "techie" guy) and said he occasionally would notice the mouse would move, click, etc without his input. I quickly asked him if he did any kind of commerce, banking, online bill-paying stuff, and he said "yes". I told him to go home and unplug his modem/cat5/whatever and to format the computer asap.
It wasn't clear what exactly he thought the problem was, but I recall thinking he was surprised when I told him that there was a person on the other end of the wire moving the mouse, using his PC for who-knows-what. And even then he didn't seem to have a sense of urgency about fixing it. You can't fix stupid, as they say.
Re: (Score:2)
Re: (Score:1, Insightful)
You will cracked sooner or later and you may not even notice.
And how is the average user going to notice they got rooted on Linux? Nice try at FUD though. Wouldn't expect anything but the best anti-ms hate around here..
Re: (Score:2)
Ironically your malware is clearly now, like your IE, better hidden.
Re:threat? (Score:5, Insightful)
What's unfortunate here is there's still a lot of people out there that don't understand why some security researchers publish security bugs they find. It's issues like this where "We reported this to you FOUR MONTHS AGO and you haven't fixed it yet. We're going public with it tomorrow." Oh noes! Everyone's computer getting owned, it's all your fault, you should keep security bugs QUIET so we have time to fix them!.
Ya, right, whatever. They don't want the researchers to keep the bugs quiet so they "have time to fix them". Clearly four months is more than enough time to fix anything important. So, just how many more of these critical security bugs are we continuing to keep under wraps until someone exploits them before getting around to fixing? The logical conclusion is the researchers should give companies like MS a flat 30 days notice, and then go public immediately after that. At least we'd be getting the bugs patched 35 days after discovery, instead of 130 days. Either way, the amount of exposure we experience is the same, they're going to drag their feet until someone lights a fire under them. The only one this "irresponsible disclosure" hurts is the publisher. In the end, it helps the users, because the publishers now have a concrete deadline to avoid losing face, rather than "lets hope no one else discovers this before spring".
We don't need them gambling with our security, and that's exactly what they're pushing with their cries for "responsible disclosure".
Re: (Score:2)
Not to defend Microsoft's consistent failure to address security issues, but 4 months is not an unusual release time for a non-critical bug. It needs to be tested, it needs to be reviewed if it changes or breaks any other tools that rely on a sloppy API or tricky "feature", and it needs to pass regression testing. When you're running core servers, worldwide, and stand to lose millions of dollars if you accidentally break something critical, you'd better test it well. And for we who install patches, we expec
Re: (Score:1)
It needs to be tested, it needs to be reviewed if it changes or breaks any other tools that rely on a sloppy API or tricky "feature", and it needs to pass regression testing. When you're running core servers, worldwide, and stand to lose millions of dollars if you accidentally break something critical, you'd better test it well.
This entire line of reasoning is merely another call for open source software. Browser makers should not be in a position where they are somehow personally responsible for complex, demonstrably unstable business installations. If the code is open, then the business clients who stack complicated houses of cards on the software (be it browser, OS, or wherever) can take their own responsibility for their non-standard decisions, and the software vendors can focus on meeting generic standards and keeping securit
Re: (Score:2)
Great point! What could be less critical than a bug that lets the Chinese own your data!
Re: (Score:2)
You've got it backwards. What is _more_ critical? A bug that prevents Microsoft from booting on new OEM systems? A bug that fails to reset IE as your default web browser? A bug that breaks the MS update tools and blocks other updates? A bug that causes 2003 servers to crash on Jan 1., 2010?
I don't know the full set of bugs recently patched, but a fast look at Windows Update shows a whole stack of "Windows Defender" updates, and other security updates, that were doubtless already in the queue.
Re: (Score:2)
Re: (Score:2)
I read what you wrote. I took you seriously. The IE vulnerability was fairly minor at the time Microsoft was notified, as I understand the timeline: there were far more active and dangerous vulnerabilities already in the pipeline. Compared to the plethora of _other_ IE flaws, it was understandably dealt with at a low priority level.
This one has merely gotten more attention due to the Chinese/Google situation, but make no mistake, it's not that big a deal compared to the other huge security flaws going on. I
Re: (Score:2)
Microsoft's reasoning is this:
Most security flaws are found by white-hats, who report the flaw to the vendor and keep their mouth shut until the vendor releases a patch - and even then, the details of exactly how to exploit it are usually not disclosed right away. However, as soon as the patch is released, the black-hats (who had previously been unaware that the flaw existed) now begin analyzing the patch itself, to see what it changes - and they soon figure out how to exploit the flaw in unpatched systems
This clearly needs 10 more stories (Score:1, Flamebait)
No doubt there'll be more stories about this. Was the patch larger than it needed to be? Does the patch break applications (it already breaks ones that exploited! It must break more!). Is Microsoft's failure to patch speedily yet another indication that Obama's administration is failing to meet its promises?
Stay tuned as Slashdot mi
Re: (Score:2)
Absolutely! :-P
Re:This clearly needs 10 more stories (Score:4, Insightful)
This has been covered ad nauseum here. Do we really need an update every 10 hours? A bug was exploited, it is now patched. Anyone who falls victim to it now deserves to do.
Thats not entirely fair. It's not practical for many people to update all systems within a day or two. Most organizations don't move that fast.
Re: (Score:1, Insightful)
"Anyone who falls victim to it now" is a typical Microsoft client. The IE security flaw in Windows has been arguably patched for years already anyway -- it's called Firefox.
Right now we're in NASCAR effect - this is the slowmo replay of the latest pileup that has included major governments saying stop using the browser. You think it stopped being notable after the original tire blew? Rub a lamp. There's at least a full week's worth of commentary about the individual cars wrapping into balls on the guardrail
Re: (Score:2)
This current exploit doesn't even work if people had IE8 with default settings.
Re: (Score:2)
Stop trying to change the subject. This issue is about a bug in IE 6 which DOES NOT run in a sandbox. See #4 in the grandparent post. In addition it is normally run on systems where the user is forced to run in administrative mode due to other stupid MS practices.
Finally the icing on the cake is that many people are forced to use IE 6 because they must use applications that are written to MS's prior non-standard ideas of how HTML should be interpreted.
It is a lose-lose-lose-lose scenario that MS forced upon
Re: (Score:2)
As of yet there is no exploit that will work with a default install of IE7+ and there probably never will be now as it would be a waste of time.
Re: (Score:2)
IE 6 was first sold 8 years ago, not 10. And since when is an obsolete legacy system something that you can go out and buy off the shelf for installation in new systems? According to Wikipedia IE 6 is the most used IE version, likely mostly due to the unpopularity of Vista and the long and tortured development cycle for that product.
As far as Pheonix and Firebird, sure they have flaws, however use share is less than 1%, completely unlike the 20+% of IE 6.
Of course MS is encouraging people to upgrade. Howeve
Re: (Score:1)
In the article you linked to about the firefox exploit they state:
Do note that Heisse tried to confirm the vulnerability and only managed a crash on Vista and can't seem to make it work on Windows 7 RC1
So this exploit did not lead to the system being compromised and your comparison is dishonest at best.
Re: (Score:3, Insightful)
The problem is that M$ gets the timeline wrong so often. It should be:
1. Find bug
2. Patch bug
Not:
1. Find bug
2. Ignore bug for n months
3. News released about exploit
compromising customers installations
causing international incident.
4. Release self serving announcement
that other systems are not affected
5. More exploits appear
affecting larger numbers of customers
6. Patch bug
Until this irresponsible behavior stops there should ba a lot more stories. These guys need to have the li
Re: (Score:3, Insightful)
This has been covered ad nauseum here. Do we really need an update every 10 hours?
Yes. Micro$oft bad!
Well, they are.
A bug was exploited, it is now patched. Anyone who falls victim to it now deserves to do.
Windows users dumb.
That doesn't follow. Fooled because they don't know better or don't get the choice maybe, but dumb isn't the right word.
Stay tuned as Slashdot milks this story for another week!
Stories like this are raw meat for the Linux Hammer Legion members.
Stories like this clearly show Microsoft for what they are - A company that doesn't care about the online safety of their customers data. They are a monopoly with the normal monopoly mentality that customers are there to serve them.
Exactly how does it work. (Score:1, Interesting)
Do they get returned an FTP / HTTP view of the computer folder by folder. Do you get kicked into a telnet terminal / ssh terminal maybe even a NFS terminal.
Correct me if I'm wrong (but I do have a CCNA cert) Why not block the access ports that get opened, unless it's port 80 and then filter the traffic.
Yes it's microsofts problem to roll out a patch and fix the bug but it se
Re:Exactly how does it work. (Score:5, Informative)
Once Windows is compromised (by a sophisticated worm, not something that places advertisements in IE), there is very little a user can do that the worm cannot prevent or bypass.
The Windows settings assistant may nod and smile, and say the port is closed, while the worm is using it in the background. You might see that if you look at the router's logs, but inside Windows the worm can control what you see or do.
Re: (Score:2)
IP-over-DNS, or IP-over-ICMP. Your router shouldn't be blocking port 53 *to your ISP's resolver*. Your router probably won't block ICMP. If you run a VLAN, you'll still want to do DNS, and at that point IP-over-DNS can provide a tunnel for an attacker into your "protected" network.
Virus kits mean that complex tricks become commonplace. It's common for a virus to go stealth now, because there's library code to root a machine. It's common for viruses to use a suite of anti-anti-virus tools, because the
Re: (Score:2, Interesting)
Correct me if I'm wrong (but I do have a CCNA cert) Why not block the access ports that get opened, unless it's port 80 and then filter the traffic.
Ah, CCNA. ;D
Most users, if they have a router at all, have a SOHO router with minimal firewalling ability, just NAT/PAT.
The simplest worm I could think of that would drink your milkshake would just dial home via SSL port 443. Client-initiated connection, redialed as needed: what on earth could your fancy firewall do about that? :3
Moral of story: Don't get rooted. :(
Re:Exactly how does it work. (Score:4, Funny)
That's just plain wrong
I wonder if responsibility is ever assigned (Score:2, Interesting)
So someone or a project team writes some code. The code is later found to be used as part of an exploit that further harms the reputation of the company. Does anyone ever go back and say "hey, you wrote this crappy code! You're fired!"?
It almost seems there are more vulnerabilities (both patched and unpatched) than there are lines in the Windows source code. I know there will be no end to the finger pointing where developers decry the problem of deadlines while management points to the lack of skilled c
Re: (Score:1, Insightful)
Why should they ? They have a monopoly on the desktop, and unless it affects their profit line, there is no reason for them to fix anything.
A US-based, free e-mail service (Score:3, Insightful)
[...] the Trojan sends a notification e-mail to the attackers, using a US-based, free e-mail service that Symantec declined to name.
Hotmail, perhaps? No?
Re: (Score:2)
Re: (Score:1, Funny)
Juno
No I don't. Juno who might?
Re: (Score:1)
Wouldn't the obvious thing to do is shut the email account down and watch for people trying to log into it?
Re: (Score:3, Insightful)
That would certainly trace them all the way to the anonymous proxy in a country with laws that don't require them to give up the logs.
Re: (Score:2)
Hotmail, perhaps? No?
I assumed that, but gmail may be more appropiate, given the nature of the first exploit to hit the news
Update your Acrobat Reader. (Score:3, Interesting)
It is rather telling that the same type of buffer trouble is showing up in other peoples software. I am just wondering if the flood "Gates" are about to open and we will wind up seeing multiple trouble with things like WMP, Silverlight ...there was already the same update happening for RealPlayer [real.com]
Just maybe there is a system xml call that is easily exploited in all versions of Windows....I can just see it now some lazy MS exec using old legacy system xml that is written using the gets and puts function. I would not put it past Microsoft to use old garbage code without even checking the old source then including the pre-compiled executable
Re:Update your Acrobat Reader. (Score:4, Insightful)
Maybe, just maybe, they should throw out most XML use. It's expandability and flexibility have caused repeated security and performance issues, and it's being used consistently instead of far simpler and more robust configuration technologies.
Re: (Score:1, Insightful)
Yeah, using XML has been a total plague... Apple uses it everywhere in OS X, and I'm sure we all remember the endless number of exploits endured by the poor bastards who use Macs since OS X shipped in 2001.
Oh, wait... there haven't been any exploits on OS X.
There must be something else at work here... like Apple employing more competent people to write code than Microsoft and Adobe.
And do I care? (Score:2)
Cough, no, because I am running a Linux system with a variety of browsers (epiphany, galeon, Firefox, Chromium) and I simply do not run MS software (and to read the ongoing saga, lucky me), why does /. even bother to track these items? We know the MS users are brain-dead (they hover under a belief that the software doesn't have bugs or is secure and that will protect them -- how wrong they are.).
I have no misconceptions that Linux based software is any more secure -- but I rest in confidence that epiphany,
Re: (Score:2)
You do realize that you read the story and then went on to post in it, right?
Time to Bury IE (Score:2)
For God's sake and all of our digital information, it is time for a revolution.
IE has failed so many times with so many bad consequences it is time to simply outlaw the use of IE.
How many car crashes due to any number of causes before they yank ALL those car models and force the manufacturer to replace the brakes.
Get rid of MS Internet Explorer, once & for ALL. If Microsoft were an honest company they would have stopped IE and started including FireFox a long time ago. At least then, everyone can exam
Stuff works optimally with IE6! (Score:2)
But the intertubes will cease to function properly. Are you trying to starve children in Massachussets? Don't you know that lots of out of work website designers need to use a website that works optimally with IE version 6 [detma.org]??!!!
Re: (Score:2, Informative)
MSFT has no reasonable excuses (Score:1, Interesting)
3 billion dollars in profit a quarter. Just think about that. That is 120k software developers paid 100k a year. That's how many more people they could have fixing any bug you have. It may be unreasonable to ask a public company to not make a profit, but it is quite reasonable, that, even with the mythical man month, they could hire 5k more developers and testers and fix this BS. This was the size of the Windows 2000 team, when I was there that year.
I knew IE 6 was going to be bad though - people from the Q
Can someone please post an URL... (Score:2)