Sign in to follow this  
Cactus521

Extremely Critical Flaw' in Windows Discovered, Already Exploited

Recommended Posts

I'm not very computer smart, so what does this mean? What can I do to protect my computer?Jeff

Share this post


Link to post
Share on other sites
Help AVSIM continue to serve you!
Please donate today!

As always, play it smart and don't download pirated music and movies.Don't download anything from sites you don't know and trust, and keep your Windows and virus scanners up to date.

Share this post


Link to post
Share on other sites

You know, if a company built a defective bridge they'd get sued. Why doesn't microsoft get sued to pay all the overtime and cleanup costs on stuff like this?

Share this post


Link to post
Share on other sites

>You know, if a company built a defective bridge they'd get>sued. Why doesn't microsoft get sued to pay all the overtime>and cleanup costs on stuff like this?Because bridge buiders usually don't have people out there trying to find or cause a weakness in the hopes of making the bridge collapse so they can make money. Unfortunately there are far too many people in this world bent on making money in an illegal fashion via the internet and blaming MS for this problem isn't the sollution.Cheers,JohnBoeing 727/737 & Lockheed C-130/L-100 Mechanichttp://www.sstsim.com/images/team/JR.jpg

Share this post


Link to post
Share on other sites

How cold hearted does one need to be to spend so much time just scanning through code looking for anyway to ruin others lives in as wide-spread a method as possible?----------------------------------------------------------------John MorganReal World: KGEG, UND Aerospace Spokane Satillite, Private ASEL 141.2 hrs, 314 landings, 46 inst. apprs.Virtual: MSFS 2004"There is a feeling about an airport that no other piece of ground can have. No matter what the name of the country on whose land it lies, an airport is a place you can see and touch that leads to a reality that can only be thought and felt." - The Bridge Across Forever: A Love Story by Richard Bach

Share this post


Link to post
Share on other sites

Regarding Jeroen's comment"As always, play it smart and don't download pirated music and movies.Don't download anything from sites you don't know and trust, and keep your Windows and virus scanners up to date."While ignoring Jeroen's advice is a recipe for disaster, I'm seeing a larger trend in our hardware/software support department. Over eighty percent of the malware/spyware tickets that have come through my help desk have been the result of mistyped url's. Given a new exploit like this, the first to take advantage of it seems to be these types of sites. Such sites are grabbing up all the popular misspellings of web sites (i.e. avssim.com instead of avsim.com). Hit the site, and at today's high speed web connections, you've become the victim of what we refer to as a "drive by download".So in addition to Jeroen's advice and more importantly--watch what you type when entering url's. If you're a hopeless case and misspell url's often, consider switching to another browser like Firefox or Mozilla--some of these browsers are better protected against malware/spyware exploits than IE. I think this issue in this latest threat may be universal to all browsers, but many exploits seem to only work under IE.-John

Share this post


Link to post
Share on other sites

Of course FF and Mozilla have their own leaks and holes which are being exploited (though as of yet at a smaller scale because of the lesser benefits such exploits can bring to their creators).A hole in a file format will hit anyone using that format files. The only way to avoid it is not allowing WMF files to enter your system (or to be opened) without explicit consent.It may even be OS independent if the exploit was written cleverly enough (which most aren't).

Share this post


Link to post
Share on other sites

Why doesn't microsoft get sued to pay all the overtime and cleanup costs on stuff like this?It's not Microsoft alone, and WE are the ones who open the computers up to risks.The systems which existed before the internet required positive verification of every user. That was the primary security measure, and continues to be the primary security measure today.If you can deny access to the network most security issues never surface.Microsoft can design an operating system which has no exploitable security holes. That operating system would not be able to connect to the internet.The reason Microsoft Windows, Internet Explorer and Outlook are the target of many of these attacks and viruses is because they are so common around the world.If the majority of the world's computers used Lunix - the viruses and such would seccessfully attack Lunix systems. If the majority were Mac's - that would be the target.Like John's company, the worldwide organization I work for spends a lot of time and money on adware, malware, viruses, etc. We have made two recommendations to the top management.Stop users from installing any software on their computers and to block websites which use this technology.Both have been shot down. The first on the company policy of believing in the positive intentions of our people. The second because some of the biggest, most popular news and sports information sites use these tools to increase their revenue.The company has made a concious choice that the cost of cleanup and risk of damage is less than creating an advisarial relationship with our employees.I may not agree, but it does guarantee a certain job security.

Share this post


Link to post
Share on other sites

The policy you proposed (effectively shutting down all internet access except sites previously certified by you yourself, and banning all software except that installed by you yourself) would cause too great a loss of productivity (the time period between users requiring access to something and them actually getting it would be too great) as well as costing those managers responsible for making that decision on the board level their access to their eBay auctions and games sits (the latter is the direct reason they shot down the proposal, the former the one that a well thinking person would make).I've worked in an environment where such a policy was in place more than once.The people in the trenches always find ways around it.In 2 cases the project had used part of its budget to purchase computers outside the company infrastructure and connect those to their own LAN with their own internet connection (and gateways to the corporate LAN hijacked onto a server for example).In others productivity was so low (IT departments barred from doing R&D, downloading fixes to software, APIs and tools, etc.) that project management complained to upper company management and got the firewall shot full of holes.In all cases a severe weakness was introduced in the company network because a whole chunk of the LAN was effectively placed outside positive control of the security team.

Share this post


Link to post
Share on other sites

>>If the majority of the world's computers used Lunix - the>viruses and such would seccessfully attack Lunix systems. If>the majority were Mac's - that would be the target.It's easy to prove that this is not a true statement. If I can point to a market where Microsoft does not a majority, and if Microsoft STILL has more vulnerabilities than the application that does have the majority, then that proves that your statement is false.In other words, if I could find an alternate universe where Microsoft had lost the OS wars to Apple, and 99% of computers were Apple computers and 1% were Microsoft, and in that alternate universe, Microsoft Windows was still more vulnerable than MacOS, that would prove your statement was false.Do you agree to the terms of my test?

Share this post


Link to post
Share on other sites

I am replying to this exchange:>If the majority of the world's computers used Lunix - the>viruses and such would seccessfully attack Lunix systems. If>the majority were Mac's - that would be the target."It's easy to prove that this is not a true statement. If I can point to a market where Microsoft does not a majority, and if Microsoft STILL has more vulnerabilities than the application that does have the majority, then that proves that your statement is false."______________________I think the flaw caused by overflowing of the buffer would be exploited in Linux just as easily as Windows if Linux were the O/S of choice. Buffer Overflow "exploits" take advantage of a processor design flaw, not an O/S design flaw. The only fault of the O/S is it doesn't have code to check for the exploit in many cases, and I suspect Linux is equally deficient. But why should the O/S do that? The processor should simply not allow this type of exploit--period.The latest processors from AMD and Intel attempt to address the issue and contain hard coding which, when combined with Win XP SP 2, supposedly prevents against this type of exploit. I have no idea whether it really does.As for the Mac OS, to this point in time, the Mac runs on an entirely different processor, which may be immune to this type of exploit. It is probably vulnerable to others. But just as I can't hire COBOL programmers that easily any more, given today's reliance on other platforms and languages, there aren't as many "script kiddies" churning out these attacks for the Mac world.However, Motorola based systems aren't immune to virus attacks. The Atari ST of old fell victim to many attacks, in part due to its greater use as a gaming platform than the Macs of its day. Windows and DOS of old are by no means the only O/S's that have been targeted, and I am afraid they won't be the last.-John

Share this post


Link to post
Share on other sites

>Buffer Overflow "exploits" take advantage of a>processor design flaw, not an O/S design flaw.You are referring to the fact that data and code are both contained in the same address space. That isn't a processor flaw - it might be thought of as an architecture flaw. Nonetheless, this distinction is irrelevant. It is possible to write correct programs that do not allow buffer overflows. That is Microsoft's responsibility and Microsoft does not live up to its responsibility.The issue on the table, is that a poster made the following contention: Microsoft products are NOT more vulnerable than other products - Microsoft products are just more common and are therefore attacked more and it SEEMS like they are more vulnerable.That is a commonly held, false belief. I can prove that it is false. To do so, I would need to find an exception, a would need to find a situation where Microsoft's products are not more common, and yet still succumb to more vulnerabilities.Before I do that, I just want to make sure that people understand what we're talking about and where the goal posts are.BTW, a have a bachelor's in computer science and a masters in software engineering. I currently work as a programmer and I've held lots of information technology jobs including administering servers. I know what vulnerabilities are, I know how hacking is done, I promise you, I know what I'm talking about here. Many (not all) of Microsoft's products are just poorly written. The problem isn't that they are popular, the problem is that they have holes in them.

Share this post


Link to post
Share on other sites

"BTW, a have a bachelor's in computer science and a masters in software engineering. I currently work as a programmer and I've held lots of information technology jobs including administering servers. I know what vulnerabilities are, I know how hacking is done, I promise you, I know what I'm talking about here. Many (not all) of Microsoft's products are just poorly written. The problem isn't that they are popular, the problem is that they have holes in them."I also know what I am talking about here, but I've learned never to argue with someone who has to note their credentials to back up a point. I never obtained my MCSE, but they still report to me. Wonder why? :)-John Edit: And I should note, you're asking to prove something you know full well is unprovable. Unless the tables were reversed, and Linux were King and Microsoft second fiddle, there's no way of knowing the holes in the former unless you have the same armies of script kiddies attacking that O/S. I suspect they can be found, but I won't waste my time and testosterone trying to prove it :)

Share this post


Link to post
Share on other sites

"I also know what I am talking about here, but I've learned never to argue with someone who has to note their credentials to back up a point. I never obtained my MCSE, but they still report to me. Wonder why?" :-lol John, you never cease to amaze me. :)

Share this post


Link to post
Share on other sites

":-lol John, you never cease to amaze me. :)"I suppose I could have thought of something better, but it's my lack of credentials that did the talkin' :)-John

Share this post


Link to post
Share on other sites
Guest
This topic is now closed to further replies.
Sign in to follow this