Computer Tips -Tech Info

Category: Security

  • WMF Exploit Unofficial patch additional download locations

    The unofficial WMF exploit patch now has multiple locations to download from. They’ve apparently run into some bandwidth problems at the main site. Sunbeltblog has an alternate download location, Sans is hosting a download here (direct download link)

  • WMF exploit vs. Windows 98 again…

    If you’ve visited here in the last few days, you’ll have noticed that I’ve been trying to test the WMF exploit against a Windows 98 Virtual machine since January 1st. I initially started out with a default install, which didn’t work, (for the exploit), then added irfanview (didn’t work), tried the exploit as a jpg, gif, htm, doc file extension, (didn’t work) and then this morning saw that I’m not the only one that’s been testing this….

    (more…)

  • MS seeing WMF with rose colored glasses?

    Ok – so at least I wasn’t the only one to see Microsoft’s update to the security bulletin as downplaying the threat….

    Of course, I don’t expect them to say…. “OH NO>>>> THE INTERNET WILL BE CRASHING AND BURNING…” But acknowledging that it is a very serious threat and there are few ways (outside of the unofficial patch) to be certain that you’re protected in some manner, shape, form would be nice.

  • WMF exploit testing on Windows 98

    I had hoped to get in another test of Windows 98 with yet another WMF viewer (tried Kodak imaging, and irfanview). So far I haven’t seen a way that the WMF exploits can work on Windows 98 SE. I’m running out of time before I have to run to some computer service appointments and maybe will be able to pick up again this afternoon/evening. Larry Seltzer had a post this morning that earlier versions of Windows might not be as vulnerable because they had no default WMF viewer, but with a default WMF viewer they may be susceptible. I’m still looking for a WMF viewer that makes the exploit possible on Windows 98 SE.

    (more…)

  • Blackberry Security Hole

    There’s another security warning out related to specially crafted image files. This time it’s targetted at the blackberry, which is a small portable email/pda device. Basically a corrupted TIFF may lead the user to be unable to view other image attachments. The US-CERT advisory seems to indicate that remote code execution could be possible, although there is no comment to this issue from the makers, Research in Motion.

    (more…)

  • WMF patch from Microsoft expected January 10th

    The Microsoft security bulletin on the WMF vulnerability has been updated to indicate that Microsoft expects to release an update for the issue in their regular patch release on January 10th. The first couple paragraphs strike me as a bit defensive. Explaining about their immediate mobilization of Incident Response and immediate work on a patch, in addition to the explanation of extensive testing of the patch in 23 languages….

    (more…)

  • Metasploit

    I had hoped to do an article on metasploit in the not too distant future, but not as early as tonight…. However, I’ve made a couple of references to it in previous posts which, well, it would be nice if I’d already given a bit of information about metasploit in general. For starters, metasploit is considered a “framework” for exploit modules and payload modules. Much like real weapons, knives, guns…. there are good uses and there are bad uses. It can be used by a network/security auditor to check for vulnerable systems. It could also be used by a cracker to exploit systems remotely. There’s a fine line.

    (more…)

  • Virtual machine as a safe browsing environment

    I mentioned this in my summary yesterday morning as a possible workaround until there are patches for the WMF vulnerability that’s been big news the last week. I notice that incidents.org has mentioned it too as a possibility today. VMware has released VMPLayer as a free way of running premade virtual machines.

    (more…)

  • Windows 98 and the WMF exploit

    I’ve seen breathless headlines that say “Windows PCs face ‘huge’ virus threat; Affects every MICROSOFT OS shipped since 1990…” and really would like to try to clarify (again) what the situation is. Yes, the bug or vulnerability that’s currently being exploited exists as far back as Windows 3.0, but as far as I can tell there is not an active, current exploit that is taking advantage of this flaw in earlier versions of windows. Currently the exploit only seems to affect Windows 2000, XP, and Vista.

    (more…)