Printable View
Claria anyone??? lolQuote:
Originally posted here by rcgreen
They prolly don't wanna put out a patch too soon.
It might break a lotta Adware. </snicker>.
:cool:
Cant find the mag but I read in Wired recently that one of the brainstormers/founders of Claria also founded Symantec....hrm, isnt Symantec touting themselves as a SECURITY company?!! lol Loved that one. :rolleyes:
Quote:
Originally posted here by rcgreen
I have a hint for those who might want to know why Windows
(which all the accredited experts have proven to be more
secure that linux) keeps tripping up on this stuff. Think
compartmentalization.
BTW, this is not a vulnerability. (you listening catch?)
The OS is only doing what was designed to do.
Your only fix is to deliberately break the OS
by disabling the dll that provides you with all this
rich functionality.
LMAO.
I think you don't really read what catch says, and instead inject your own thoughts into his comments. He has never said there are not vulnerabilities to Windows. He has said that there is not a single vulnerability that allows you to override the security policy of the system. This exploit does not give you anything but the ability to run code without the user being prompted. If you want to avoid a system being completely compromised, don't run IE or Firefox, or whatever as administrator, or with administrative privileges... Opening an infected .wmf file with only user permissions doesn't really do that much damage to the underlying OS.
If the user is locked down from installing software, or if IE is properly locked down using the IEAK this is a non issue. A proper security policy keeps this from being an issue. Users surfing the web should not be able to install software, should not be administrators, and should only have NTFS permissions to their own files. This should in no way compromise the security of the box itself, unless you are foolish enough to run as administrator all of the time. Which it seems like a lot of people on here do exactly that.
We didn't do anything with this at my work except double check to make sure that we were filtering .wmf on all of our mailgateways(WMF was already a restricted file type), and then make sure to put .wmf into our AV extension blocks.
Also. If you unregister the shimgvw.dll it only breaks the microsoft picture and fax viewer. If you open pictures with software such as firefox, macromedia fireworks, or camera software such as the Fuji finepix viewer pictures open and work perfectly. Even the MS Office 2003 Photo Manager continues to work.
This is a truism that means nothing, because the system is designed to allow thisQuote:
He has said that there is not a single vulnerability that allows you to override the security policy of the system.
to happen. Windows wasn't designed to be an OS for end users, but to be a platform for adware.
They can't patch it, because it would cripple all those web designers who want access to
your hard drive. No, it's not a vulnerability at all. It is performing its intended function,
to fill your desktop with ads.
Quite true, but since the system doesn't ship that way by default, and most home usersQuote:
If the user is locked down from installing software, or if IE is properly locked down using the IEAK this is a non issue. A proper security policy keeps this from being an issue. Users surfing the web should not be able to install software, should not be administrators, and should only have NTFS permissions to their own files.
do not have professional system administrator to set up and maintain their systems,
and since M'soft tries to give us the impression that this is a plug'nplay world, and
your computer will work right out of the box....
Who is responsible for this, and who is going to pay to fix it?
Joe user, as usual.
:cool:
Uh, FYI,
SANS Infocon back to yellow!
Handler's Diary December 31st 2005
* New exploit released for the WMF vulnerability - YELLOW (NEW)
Happy New Year.Quote:
...
The exploit generates files:
* with a random size;
* no .wmf extension, (.jpg), but could be any other image extension actually;
* a random piece of junk in front of the bad call; carefully crafted to be larger than the MTU on an ethernet network;
* a number of possible calls to run the exploit are listed in the source;
* a random trailer
From a number of scans we did through virustotal, we can safely conclude there is currently no anti-virus signature working for it. Similarly it is very unlikely any of the current IDS signatures work for it.
Judging from the source code, it will likely be difficult to develop very effective signatures due to the structures of the WMF files. ...
I have never heard anything so ridiculous in all my life......Quote:
This is a truism that means nothing, because the system is designed to allow this
to happen. Windows wasn't designed to be an OS for end users, but to be a platform for adware.
They can't patch it, because it would cripple all those web designers who want access to
your hard drive. No, it's not a vulnerability at all. It is performing its intended function,
to fill your desktop with ads.
You never came across as dumb before but you excelled yourself with this post....
Placed firmly on moron list.....
:rolleyes:
Are you going to swear that they don't take the desires of web designersQuote:
I have never heard anything so ridiculous in all my life
(and advertisers) to heart when they design this stuff? Sure they designed it this way.
They just didn't think that anyone would use the feature for "malicious" purposes.
They were over-optimistic and naive and greedy. Many of the exploits of the
last ten years are based on this same thinking. Some feature that "seemed
like a good idea at the time" gets turned to evil purposes.
I've been here long enough. It's new year's eve, and I have a rightQuote:
Placed firmly on moron list
to be as much of a troll as anyone else on this forum.
Now I gotta go watch Hitchiker's Guide. Happy new year and
don't let the virus bite.
:cool:
Reality check please?
Windows has evolved? it can hardly be described as "new"............... I can recall using 14.4k and 28.8k dial-up connections....................no "adware" in those days?
My argument would be that it is the Internet that has changed, not the operating systems?
Just my thoughts :)
This thing is now being sent out in spam.
Source: http://www.isc.sans.org/diary.phpQuote:
When the HappyNewYear.jpg hits the hard drive and is accessed (file opened, folder viewed, file indexed by Google Desktop), it executes and downloads a Bifrose backdoor (detected by us as Backdoor.Win32.Bifrose.kt) from www[dot]ritztours.com.
Is anyone else still running win98? I have two win98 computers
and neither of them has the shimgvw.dll. I was threatening my wife that
if her box got infected, I was going to reformat and put Slackware on it.
I guess she has escaped that fate for now.
:cool:
Of course, both first and second editions.............good for legacy apps and old games. It works fine for older, casual users..........I also have 3 instances of Win ME that run just fine.Quote:
Is anyone else still running win98?
I also have DOS 3.0, Windows 2.03 onwards..........................
I run '86s, 286s, 386s, 486s................PI, PII, PIII.............etc
They all work
:D