That explains why my computer was running slower after reading about that brave/stupid teen... hmmm
Posted on 01/02/2006 3:54:03 PM PST by Swordmaker
Computer security experts were grappling with the threat of a newweakness in Microsoft’s Windows operating system that could put hundreds of millions of PCs at risk of infection by spyware or viruses.
The news marks the latest security setback for Microsoft, the world’s biggest software company, whose Windows operating system is a favourite target for hackers.
“The potential [security threat] is huge,” said Mikko Hyppönen, chief research officer at F-Secure, an antivirus company. “It’s probably bigger than for any other vulnerability we’ve seen. Any version of Windows is vulnerable right now.”
The flaw, which allows hackers to infect computers using programs maliciously inserted into seemingly innocuous image files, was first discovered last week. But the potential for damaging attacks increased dramatically at the weekend after a group of computer hackers published the source code they used to exploit it. Unlike most attacks, which require victims to download or execute a suspect file, the new vulnerability makes it possible for users to infect their computers with spyware or a virus simply by viewing a web page, e-mail or instant message that contains a contaminated image.
“We haven’t seen anything that bad yet, but multiple individuals and groups are exploiting this vulnerability,” Mr Hyppönen said. He said that every Windows system shipped since 1990 contained the flaw.
Microsoft said in a security bulletin on its website that it was aware that the vulnerability was being actively exploited. But by early yesterday, it had not yet released an official patch to correct the flaw. “We are working closely with our antivirus partners and aiding law enforcement in its investigation,” the company said. In the meantime, Microsoft said it was urging customers to be careful opening e-mail or following web links from untrusted sources.
Meanwhile, some security experts were urging system administrators to take the unusual step of installing an unofficial patch created at the weekend by Ilfak Guilfanov, a Russian computer programmer.
Concerns remain that without an official patch, many corporate information technology systems could remain vulnerable as employees trickle back to work after the holiday weekend.
“We’ve received many e-mails from people saying that no one in a corporate environment will find using an unofficial patch acceptable,” wrote Tom Liston, a researcher at the Internet Storm Center, an antivirus research group. Both ISC and F-Secure have endorsed the unofficial fix.
Microsoft routinely identifies or receives reports of security weaknesses but most such vulnerabilities are limited to a particular version of the Windows operating system or other piece of Microsoft software. In recent weeks, the company has been touting its progress in combating security threats.
The company could not be reached on Monday for comment.
Thanks for that. I'm researching it now....
Sounds like a great Law Enforcement tool.
Insert the virus in some kiddie pork and get it circulating.
Then after a few months you can start picking up the perverts as the virus reports back the location of the infected machines.
"Virus attacks every Mac ever made, hundreds affected."
MSIE users may be infected automatically. Firefox, Mozilla and Opera users will be prompted for action (open with application, save to hard drive).
F-Secure:
"In our tests (under XP SP2) older versions of Firefox (1.0.4) defaulted to open WMF files with "Windows Picture and Fax Viewer", which is vulnerable. Newer versions (1.5) defaulted to open them with Windows Media Player, which is not vulnerable...but then again, Windows Media Player is not able to show WMF files at all so this might be a bug in Firefox. Opera 8.51 defaults to open WMF files with "Windows Picture and Fax Viewer" too. However, all versions of Firefox and Opera prompt the user first."
I've tested Firefox 1.5 and Mozilla 1.7.12. With both browsers, the above is the case. In my case, Paint Shop Pro is resgistered to handle WMF files. When encountering a WMF file (which I created myself) embeded in a HTML file (I tried both the IMG and EMBED tags), these browsers prompted for action.
Opera 8.5 displayed the IMG tagWMF file as an empty box with the word "Image" inside. The EMBEDED tag WMF file was displayed as an empty box with the words "Plug-in content" inside.
LOL
susie
Yep...and then Macs will be the target.
I just love these Mac folks who think that the answer to all ills a Mac.
Get a clue.
Nah... you can't manipulate a Mac.
Also, I only go to a few sites good sites like this one.
.
Cute. Here Let me re-state it correctly for you:
"No Vruses attack every OSX Mac ever made, 20,000,000 not infected!"
otoh, is this alert just a bit overblown?
If Metasploit and the other packet crafting tools were directed at Macs with as much vigor as at Windows, Macs would have a huge increase in vulnerabilities.
Anything connected to the Internet and accepting/processing unknown packets is theoretically exploitable. And it will get worse (or a million-dollar product solution for someone), because tools such as Metasploit make it possible to undermine the fundamental design of ALL firewalls, intrusion detection, and AV products.
These packet crafters make it (relative) child's play to change signatures quickly, thus evading conventional security measures (e.g., signature detection). Think of it this way: one attack has a hexadecimal payload, the next gen is in binary; and the one after that is decimal. Or a handful of uneeded bytes discarded or rearranged, again to avoid the detection measures.
OS X doesn't provide any inherent protection against these types of attacks or methods. I like the Mac, but it really is security through obscurity.
That explains why my computer was running slower after reading about that brave/stupid teen... hmmm
And that changes the situation today exactly how? The independent clause, "nobody targets them" is irrelevant. As you said, "MACs don't have viruses".
Some might say, "Well, if enough people starting using Macs, somebody COULD write Mac viruses." So what? Today, and for the forseeable future, "Macs don't have viruses".
I. STAND. BY. MY. TAGLINE.
If everyone switched to a Mac, you would have the problem....you see, it's not worth a hackers time to destroy the 25 or 30 macs out there...they have a need to cause great damage....
Soooooooooo, When a pic displays on the monitor like the ones we see on our FR pages, that could give us the vulnerability...???
Why do these threads always degenerate into Mac versus PC quibbling.....who gives a crap. If you want virus proof tech buy WebTV, I spend days repairing computers for friends that click on every popup and email......I have a Windows 2000 system running Firefox, ZA and AVG that has never been infected in 4 constant years of use.....to each their own.
If you're using MSIE, it would appear the answer is "yes".
See my post #44 for more.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.