A picture worth a thousand worms

Star Tribune ^ | October 7, 2004 | Steve Alexander

[BillCompton]

Picture this: Just viewing a photograph on the Internet could allow a hacker to take over your computer.

Such a thing hasn't happened, but computer security experts say this scenario is not only possible, but likely.

Hackers have found a security flaw in several types of Microsoft software that allows them to infect JPEG images with malicious code that opens a back door to computers. The flaw is in Microsoft's Internet Explorer, its Windows XP operating system and some of its other programs.

The scope of the vulnerability is dizzying: Just using Internet Explorer to view an infected JPEG image on a Web page would be enough to let a remote hacker take over the computer and run any program imaginable, experts say.

"JPEGs are everywhere," said David Perry, global director of education for Trend Micro, a computer security firm in Cupertino, Calif. "There are trillions of pictures on the Web."

Microsoft has acknowledged the problem and three weeks ago ...

[LTCJ]

briefly converted both systems to Linux/Win2000.
Unfortunately, the wife objected, so we're back to scanning and patching.

Sorry to hear that, bh. Having made the transition myself, can you tell me what her specific objections were?

We had a few teething pains tuning the setup to everyones' liking (4 users) but are now using Linux as a matter of routine with but a few complaints. We do maintain an XP partion that I have to boot to once a week but ALL our browsing is now done thru Linux. My maintenance time is much below what it was for Windows and I haven't had to worry about spy/malware at all.

[backhoe]

Let's see... it went from the specific to the general- both of us had trouble seeing the tiny icons and typefaces, and before I could locate info on resizing, lightning zapped the modem and the new modem wasn't recognized by Linux- so there went online help, except for booting to Win2000.

She has the usual ton of work that comes home, all in Win2000, digital cmaeras, PDA- it was just too aggrivating to learn what I needed to make all the bloody stuff work. And get her to try to learn it, too.

I've got a hardware firewall and the usual anti-virus and spyware stuff, and since June the system(s) have been OK.

I might add that while this was going on, the backup PC died, so the "good" PC became the backup after I built a new one- necessitating migrating a drive and the usual hardware hassles associated with this. I just got tired of screwing around with it. Mandrake 9, for whatever that's worth.

[ASA Vet]

Is my Comodore 64 vulnerable? Should I switch back to my Vic 20?

[LTCJ]

Yeah, modems - especially winmodems - can be a problem. We're on cable so that's been transparent for us.

The only reason I reboot once a week is to use MSOffice for a work issue. I'm planning on getting Crossover Office at some point so I can run Office under Linux but my schedule's too tight to mess with it right now.

I've been using SuSE linux and have been very pleased with the hardware compatability. Installation was actually easier than XP for this version. I bought previous versions but am currently using the FTP installation directly from their site - for free. Worth every penny 8^)

But the big issue for me has been the security/update/malware one. It's a breath of fresh air since all this MSmess started heating up this summer. I'd be pulling my hair out if I still had to be running scans and haunting security sites as offen as I did before.

[backhoe]

I'd be pulling my hair out if I still had to be running scans and haunting security sites as offen as I did before.

Good point.