Posted on 01/02/2006 3:54:03 PM PST by Swordmaker
Computer security experts were grappling with the threat of a newweakness in Microsoft’s Windows operating system that could put hundreds of millions of PCs at risk of infection by spyware or viruses.
The news marks the latest security setback for Microsoft, the world’s biggest software company, whose Windows operating system is a favourite target for hackers.
“The potential [security threat] is huge,” said Mikko Hyppönen, chief research officer at F-Secure, an antivirus company. “It’s probably bigger than for any other vulnerability we’ve seen. Any version of Windows is vulnerable right now.”
The flaw, which allows hackers to infect computers using programs maliciously inserted into seemingly innocuous image files, was first discovered last week. But the potential for damaging attacks increased dramatically at the weekend after a group of computer hackers published the source code they used to exploit it. Unlike most attacks, which require victims to download or execute a suspect file, the new vulnerability makes it possible for users to infect their computers with spyware or a virus simply by viewing a web page, e-mail or instant message that contains a contaminated image.
“We haven’t seen anything that bad yet, but multiple individuals and groups are exploiting this vulnerability,” Mr Hyppönen said. He said that every Windows system shipped since 1990 contained the flaw.
Microsoft said in a security bulletin on its website that it was aware that the vulnerability was being actively exploited. But by early yesterday, it had not yet released an official patch to correct the flaw. “We are working closely with our antivirus partners and aiding law enforcement in its investigation,” the company said. In the meantime, Microsoft said it was urging customers to be careful opening e-mail or following web links from untrusted sources.
Meanwhile, some security experts were urging system administrators to take the unusual step of installing an unofficial patch created at the weekend by Ilfak Guilfanov, a Russian computer programmer.
Concerns remain that without an official patch, many corporate information technology systems could remain vulnerable as employees trickle back to work after the holiday weekend.
“We’ve received many e-mails from people saying that no one in a corporate environment will find using an unofficial patch acceptable,” wrote Tom Liston, a researcher at the Internet Storm Center, an antivirus research group. Both ISC and F-Secure have endorsed the unofficial fix.
Microsoft routinely identifies or receives reports of security weaknesses but most such vulnerabilities are limited to a particular version of the Windows operating system or other piece of Microsoft software. In recent weeks, the company has been touting its progress in combating security threats.
The company could not be reached on Monday for comment.
I think you're taking CAT5 too literally. :-)
No. I posted it to inform Windows users that they better do somthing to prevent the invasion of their computers. I am merely responding to mis-information (FUD if you will) from ignorant (of Macs, that is) Windows users.
I am a very careful person (but I can't speak for my wife when I'm not home and she's got the pooter) but I keep finding viruses and trojans in Java. I finally just installed the program and deleted the entire Sun folder until I can find out what's causing the vulnerability. Any ideas?
BTW, my wife downloads a lot of these "cute" games which I'm guessing are java-based. I'm sure this is the culprit but wanted to make sure that there are no other factors involved here.
DOOMED!
What OS are you running? Whatever it is, you need to protect your computer from your wife's proclivities to download "cute" games. I suggest setting her up with a limited user account...
XP Home Edition Service Pack 2 (of course). I am going to go PRO but I haven't had the time or desire to back up my files. I once tried a PRO install over a Home install and it was horrible, so I want to do a clean install this time.
Teach your wife to scan her downloads with Antidote SuperLite. It's a free, on-demand virus scanner.
The patch from the highly-regarded Ilfak Guilfanov, mentioned in the article, is available at http://www.hexblog.com.
Per the geeks at F-Secure, "Ilfak Guilfanov has published a temporary fix which does not remove any functionality from the system (all pictures and thumbnails continue to work normally). The fix works by injecting itself to all processes loading USER32.DLL. It patches the Escape() function in GDI32.DLL, revoking WMF's SETABORT escape sequence that is the root of the problem. Now, we wouldn't normally blog about a security patch that is not coming from the original vendor. But Ilfak Guilfanov isn't just anybody. He's the main author of IDA (Interactive Disassembler Pro) and is arguably one of the best low-level Windows experts in the world. ...Ilfak recommends you to uninstall this fix and use the official patch from Microsoft as soon as it is available."
This would seem to be a superior and safer temporary patch than the registry hack that's also been recommended.
bump
It doesn't matter. The handwriting is on the wall. It's a logical conclusion.
Yes, it's called Norton Antivirus. Which is much cheaper than spending a crapload of cash for a Mac that's priced twice as much as it's worth and performs a fraction as well as what everyone else on the planet is using.
I am merely responding to mis-information (FUD if you will) from ignorant (of Macs, that is) Windows users.
It looks to me like all you did was make it clear that you paid too much for a POS computer that doesn't do squat. But that's just me.
Point is, operating systems are not the issue, whether Windows, OS X, or Linux. Because when exploits can be crafted by script kiddies (or automatons) in large variant numbers with minor differences in exploit code, then the job of routers, firewalls, IDS, and VA become more and more onerous. Or they simplu break or get raced.There comes a point when their job is *entirely* dependent upon (a) self-generating signature identifications and (b) ASIC-based firewalls or parallel processing platforms. In other words, the existing model of perimeter security models no longer works.
Consequently, the exposure of *all* operating systems becomes more problematic over time.
I don't know why you're arguing the point, every firewall and IDS vendor and security person I know accepts that evolution.
Back when I was running Norton as my full-time AV, I downloaded an infected zip file. Norton missed it. A manual scan with Antidote found it.
I now run AntiVir. I still double-check all downloads with Antidote.
Just a thought.
Thanks... that info will be invaluable to a lot of Windows XP users.
Please.....don't be so naive to think if there was no Microsoft these crabs wouldn't be infecting Macs. They are only looking to do damage to whoever is on top.
Thank you for volunteering your Mac ignorance to make my point for me.
It might be of interest to some on FreeRepublic that InfoWorld has just awarded Apple the InfoWorld 2006 Tech Awards for:
Best Workstation (Apple Macintosh Quad G5)
Best Operating System - Client (Macintosh OSX.4 Tiger)
Best Operating System - Server (Macintosh OSX.4 Server)
But that's just them... one of the top journals for IT professionals in the World.
Hm, ignorance is spending $1999 for a Mac when I can build a computer for $600 that will do everything a Mac does PLUS play games.
Macintosh: When you're through playing games.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.