Windows 0-Day Exploited In Ongoing Attacks 114
An anonymous reader writes: Microsoft is warning users about a new Windows zero-day vulnerability that is being actively exploited in the wild and is primarily a risk to users on servers and workstations that open documents with embedded OLE objects. The vulnerability is currently being exploited via PowerPoint files. These specially crafted files contain a malicious OLE (Object Linking and Embedding) object. This is not the first time a vulnerability in OLE has been exploited by cybercriminals, however most previous OLE vulnerabilities have been limited to specific older versions of the Windows operating system. What makes this vulnerability dangerous is that it affects the latest fully patched versions of Windows.
Only for root users (Score:3)
UAC will display a warning, this exploit only touches users who run as admin.
I don't think any still supported version of Windows defaults to admin.
Re:Only for root users (Score:5, Insightful)
Re:Only for root users (Score:5, Insightful)
Yes, but in a well managed environment users won't get a UAC prompt because they won't be local admins, if the folks you've trusted enough to grant local admin to are still dumb enough to click ok to a UAC prompt when opening an Office file then there's literally no security system that will help you.
Re: (Score:3)
MS Windows is no longer the problem. Losers who treat it like MSDOS and write software are the problem.
Re: (Score:2)
Only one of the two is actually fixable.
Re: Only for root users (Score:2)
If it's in-house software then it can be fixed - no excuses. If people don't fix problems they know about and can fix then they get what they deserve.
Show me somebody who has a huge investment into a physical machine controlled by some proprietary software where the vendor has gone out of business and there's no source available and then I'll have a bit of sympathy, but even then put it on a VM on its own VLAN - these are not extremely difficult problems.
Re: (Score:1)
Re: Only for root users (Score:2)
Re: (Score:2)
LUA Buglight from MS helps a ton in that regard, it's been around since Vista Beta and with it you should be able to find exactly what calls require elevation.
Re: (Score:2)
So what do you suggest when that is all of them? Apart from of course trying various methods to convince the developer to learn how to do his job properly?
Re: (Score:2)
If you can find the registry keys to tweak and files and folders to manually change perms on than sometimes that problem can be mitigated.
Really, the problem is that software development gives little priority to security.
Re:Only for root users (Score:4, Informative)
No, you just use the Application Compatibility Toolkit which allows you to run an application with the exact level of permissions it requires to get things done regardless of the permissions assigned to the current user. Does your application need to be able to write to it's own program folder, but you want to prevent everything else from doing that, too? Application Compatibility Toolkit [microsoft.com].
Is it easy to use? No, but it does work very well. The tools exist to get what you need done regardless of your environment. Granting users admin rights when they don't need them is just lazy.
Also for developers (Score:2)
Sometimes it's better to go after the root cause of the problem and get the developers that have been left behind to understand that it's the 21st century and their desktop software is likely to be running in a multi-user, networked, multi-core, 64 bit environment. There are far too many that can't even get ONE of
Re: (Score:2)
Have not looked at the vuln yet but does it necessarily pop a UAC given its OLE, i assume this is some kind of memory overwrite. So might be possible to step all over the users data without calling any privileged operations.
Re: (Score:2)
well managed environment
Number one target for this will be grandpa forwarding that patriotic slideshow with God Bless America playing as it pages through sunsets and crying eagles and a root kit on the 4th slide.
Re: (Score:1)
In every well managed environment you always have that one executive that is above best practices.
Re: (Score:2)
BINGO!
Re: (Score:2)
Even power users get the UAC prompt for certain things. But if they don't have local admin, the point is still moot.
Re: (Score:2)
if the folks you've trusted enough to grant local admin to are still dumb enough to click ok to a UAC prompt when opening an Office file then there's literally no security system that will help you
It's like my grandpa used to say "Kid, you can't make an idiot not be an idiot--and also never fuck a hooker who's coughing."
Re: (Score:2)
Switch to MS-DOS?
Re: (Score:2)
Well, if the solution is to run as admin so you don't get those pesky notices .... then the outcome is going to be not unlike your nick, and entirely self inflicted.
Because, you will be fisted by the first exploit to come along.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Set up sudo correctly and it will.
Re: (Score:1)
Re: (Score:2)
People accept these when it's expected. When a UAC prompt comes up when opening a PowerPoint presentation downloaded off the internet I think even most casual users will wake up and cancel the request... unless it's my sister-in-law. She'll install anything.
Re: (Score:3)
Re: (Score:2)
Sorry, but for Windows users what you say is already in the "knowledgeable power-user" class, i.e. most users will get caught by this. On Linux, you would maybe get 50% "WTF?"s, or maybe even a bit more if the sudo warning message is intact, but forget that being any working protection on Windows.
Re: (Score:3)
... and you don't need privilege escalation if you want to write an X keylogger. You only need to be abled to execute code as the user you want to track.
Re: (Score:2)
Hence my estimate that even 50% of Linux users would get caught....
Re: Only for root users (Score:4, Insightful)
I think even most casual users will wake up and cancel the request
This actually makes me laugh :P Sadly, a casual user is not as logical as you think.
Re: (Score:3)
As Windows slowly gets where Unix already was 30 years ago, the problem in cases like this is less with Windows and more with Windows-users.
Still, OLE was a pretty bad idea from day 1.
Re: (Score:2)
So, you prefer functionality over security, _BUT_ you do not want to see the user blamed. I take it you think that you are pretty incompetent?
Re: (Score:2)
"UAC will display a warning, this exploit only touches users who run as admin."
I run as admin on my Windows7 machine and I get UAC prompts.
Next.
Damn linux (Score:5, Funny)
Re:Damn linux (Score:4, Insightful)
It's mildly funny that Server 2003 doesn't have this bug, and also was the last Windows Server that still used some Unix/BSD code.
(No, I'm not claiming a causal relationship...)
Re: (Score:2)
Re: (Score:2)
It's mildly funny that Server 2003 doesn't have this bug, and also was the last Windows Server that still used some Unix/BSD code.
(No, I'm not claiming a causal relationship...)
Which makes me think that WinXP was also not affected as it was closely related to Windows Server 2003. However, it's no longer supported so...
Favorite Version of Windows? (Score:2)
...yours
Oh Microsoft Windows... (Score:4, Funny)
Definitely Users (Score:3)
Re:Definitely Users (Score:5, Interesting)
It's a problem of false negatives. I've never been confronted with a UAC warning for which it was appropriate to say no. Never.
When 100% of past warnings were unnecessary people don't pay attention to warnings anymore. This isn't a problem with human behavior, this is a problem with the warnings. Warnings need to have a memorably high rate of indicating actual danger -- five or ten percent is enough. One in a million is not enough.
Windows is like the crazy guy on the corner who says "the end is near!" Yeah, sure, maybe this time he's right, but we've heard that false message too many times to even bother listening to it.
Re: (Score:1)
Re:Definitely Users (Score:5, Funny)
Well, then you should take a look at the attached powerpoint presentation! It gives an in-depth analysis of exactly why you should be careful when answering "Yes" to UAC prompts.
Re: (Score:1)
99.99999% of Windows users will do exactly this. It is a UAC/Windows problem.
Re: (Score:1)
I've never been confronted with a UAC warning for which it was appropriate to say no. Never.
If you configure UAC to the highest level you can prevent some explorer mishaps by a tired, drunken administrator.
MS Office doesn't help (Score:2)
Don't worry, I have a slideshow explaining this! (Score:5, Funny)
Just download this handy powerpoint slideshow [example.com] and I think you'll find it explains how this attacks works in perfect detail...
PowerPoint on a Server? (Score:1)
Re: (Score:3)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
If your process involves generating Office, documents, it's generally the easiest way. The server automation tools for generation of Office documents are basically scripts and wrappers around.... Office. So if you want to generate some report that spits out an Excel file at the end, you can bet it was generated in Excel the first time around because the repo
Re: (Score:3)
If your process involves generating Office, documents, it's generally the easiest way. The server automation tools for generation of Office documents are basically scripts and wrappers around.... Office. So if you want to generate some report that spits out an Excel file at the end, you can bet it was generated in Excel the first time around because the reporting tool actually called Excel to fill in the fields.
This may have been correct 5 to 10 years ago, but you should never do this in a modern installa
Re: (Score:2)
i dunno.. you ever heard of citrix?
Citrix is an application server. Powerpoint installed on a server that isn't an application server is a potential security vulnerability.
Re: PowerPoint on a Server? (Score:2)
Sharepoint addon for searching and indexing Office files.
I'm sure there are others this is just what I thought up in 30 seconds.
Windows = Job Security (Score:5, Insightful)
Re: (Score:2, Insightful)
Do you know any OS that is free of bugs and security risks, including users?
Re: (Score:1)
VMS is really, really close to perfect.
Re: (Score:2)
Broken Windows syndrome, IT version: (Score:1)
If you leave one hole in Windows unpatched, soon there will be more.
Wait one cotton pickin' minute (Score:2)
I have enough trouble getting text to display.
Re:Wait one cotton pickin' minute (Score:5, Insightful)
Visio charts, Project Gantt charts, Excel charts... it's actually a very useful technology, especially if you're pulling data from a live source (eg. query data into Excel, which generates charts). Much easier than querying the data in Excel, updating the graph, exporting (or copying) the graph as PNG then updating the PowerPoint.
Re: (Score:2)
People who want to pw0n yer boxen! :-)
Re: (Score:3)
The problem is MS never had a small tutorial during windows installation or during the first boot showing users how to create a Standard User account and have an administrative account for elevating your rights for doing administrative stuff.
The actual problem is that unlike Linux, doing this doesn't help you do a lot of the "administrative stuff" you need to do in Windows.
In Linux, a normal user with sudo permission can run "sudo su -" and everything run from that terminal will have admin privileges. You can do the same thing in Windows with "RunAs" either from a command prompt or from the Start Menu with Shift+RightClick. The problems then start. First, you have to figure out what command to enter to do something that is normally only done
Re:hum (Score:4, Informative)
The problem is MS never had a small tutorial during windows installation or during the first boot showing users how to create a Standard User account and have an administrative account for elevating your rights for doing administrative stuff. But now, with windows 8 during the install, you can create any type account you like, but again, no tutorial.
The problem is one of history for Windows.
Windows was originally a place where every user was an Administrator. This encouraged developers to not pay attention to APIs used, so then applications came to be reliant on running only under users that were Administrators. Even Microsoft Office did that for a long time.
Then Microsoft split users up and now there was a special Administrator account and group. Except users wanted to continue using all the software they had from before that split. The solution? Make all users administrators. Developers kept designing software that required administrative access - even Microsoft Office.
Then came Windows Vista and UAC. Microsoft Office got fixed up; but many developers did not listen to years of warning. So then UAC started prompting the hell out of everyone. Windows 7 came along and most developers had fixed their software so UAC could be scaled back in its prompting some (really, that's the only difference between Win7 and Vista - the default threshold setting for UAC - in this matter).
Of course no where along the road did Microsoft make it easy to switch between users. Sure, there's "Run As..." but it's (a) not well known, (b) a PITA to use, and (c) doesn't solve every use case. UAC doesn't quite either. In neither case do either work like the priviledge escalation in Linux/Unix with "su" and "sudo" and their graphical equivalents. So everyone still must have the administrative access to do certain tasks.
And of course people are still trained that their user needs to be the Admin user for the system.
So there's still work to be done on Windows to bring a real "su"/"sudo" experience to Windows; but overall it's still very much a user issue since they're all trained to and expect that their Windows user will have admin rights whether they really need them or not.
Libreoffice? (Score:3, Interesting)
Re: Yikes (Score:1)
Computers suck. Gotta love how an office document can compromise your system. Can we just use txt files and get away from Executable documents
Re: (Score:2)
+1
Why do we need multiple rendering engines? There should be one to rule them all. It seems that even large companies like microsoft can't fix all issues, and microsoft has to maintain multiple rendering engines, like Trident or the Office rendering engine. If microsoft would use trident for office documents, too, and all plug-ins were made in js (or NaCL if you like binary), Office could profit by the huge efforts Microsoft (and Google) puts into securing Browsers.
Re: Yikes (Score:5, Insightful)
... and if the one rendering engine was used, the moment an exploit becomes available, all systems are vulnerable. Haven't we learned about the dangers of monocultures yet?
Re: (Score:1)
We're working on it. We got rid of monocles, except in very isolated instances, so monocultures are next, alphabetically.
Re: (Score:1)
Yes, tones of people do that already, it's called TeX or LaTeX. It probably takes about as long to learn as Word does anyway. The huge benefit of using LaTeX is that its fairly backward/forward compatible, unlike Word. Want a text based visio replacement? Try dot. Powerpoint? Don't know, don't care, make a multipade LaTeX document and just page up/down the output pdf/dvi. I don't really care much for powerpoint. Get started with LaTeX [usenix.org.uk] now.
Re: (Score:2)
PowerPoint - nothing else even comes close. As engineers we don't care about it, but there are just as many people who live and die by the PowerPoint presentation (literally in some cases, as the US military leadership is sadly all about the PPT these days).
SmartArt is freaking magic for some people. It's exactly the sort of automation that LaTeX would be great at, but presented visually, not as "yet another programming language for those geeks." Like VI or EMACS, PowerPoint will always be with us: it's