Windows 7, Vista zero-day flaw reported
Microsoft said on Tuesday that it is investigating reports of a zero-day vulnerability affecting Windows 7 and Vista.
The flaw in Windows 7 could allow an attack which would cause a critical system error, or "blue screen of death," according to researcher Laurent Gaffie.
Gaffie wrote in his blog that the flaw lies in a Server Message Block 2 (SMB2) driver.
"SRV2.SYS fails to handle malformed SMB headers for the NEGOTIATE PROTOCOL REQUEST functionality," wrote Gaffie in a blog post Monday.
Gaffie said he had contacted Microsoft. Comments on his blog by other users said that the flaw could lead not only to denial of service, but could also lead to remote code execution.
Microsoft said in a statement on Tuesday that it was investigating, but said it is "currently unaware of any attacks trying to use the claimed vulnerability or of customer impact."
Computer security publication "The H" wrote on Tuesday that its German sister publication had tested the proof-of-concept code, and that while the exploit had caused a reboot on Vista, the exploit had not worked on Windows 7.
Metasploit creator HD Moore said in a tweet on Tuesday that an SMB bug appeared to have been introduced into Vista SP1. Coder Josh Goebel said in a blog post that he had added the exploit code to Metasploit.
Tom Espiner of ZDNet UK reported from London. CNET News' Ina Fried contributed to this report.
Also, I turn off "server" service on my laptop to save memory, because Vista is too memory hungry, so I am not vulnerable here.
Most vulnerable is file servers, but Windows 2008 server should have very little deployment in colleges.
Also note that "blue screen of death" is much less sever than " remote code execution" if you follow computer security in addition to just reading CNET news.
BTW. This flaw kicks every MS fanboy that assured us that Vista/7 was bulletproof. Sorry, no software is nor will be.
If you ever read about those supposed hacks, you would have read that in each and every case, the rules of the hack were altered so the OSX could be hacked. Usually by turning off the firewall, and the hacker going to a malware site they'd already had planned.
If you change the rules by unlocking and opening up the front door with a sign ENTER HERE, doesn't really make it a hack now, does it.
Anyways you should have read what Miller recently said about the security of Snow Leopard and 7. He said 7 is more secure than SL. Just google or bing it!
Windows was hacked too , and so were other Linux based operatng systems
So it doesn't really proove anythng other than the fact that
hackers can hack into any human made piece of software
also
All these so called hacks or vulerabilities have never lead to any widespread damage
Intact there has yet to be a major outbreak of any kind on the mac platform
A few Trojans here and there but nothng like say a confiicker or a iloveyou virus
And most mac users don't even bother with securty related software too
So until the mac platform has say atleast 5-6 real security related threats
There's nothng to worry about !
Wndws users OTOH needto suffer av software and constant updates/maintanence
Pretty sad really !!!
Saying that Windows users suffer from AV software and updates - We don't suffer from AV software, it's just we're smart enough to use it. And saying we suffer from updates is a bit hypocritical, seeing as on the Apple site, one of the "advantages" of having a Mac were the constant updates.
We're not the sad ones. People paying 3x more for a computer or laptop because of the logo are.
http://blogs.zdnet.com/security/?p=758
http://www.internetnews.com/security/article.php/3586416
You see, A/V software is reactive, not proactive.
Folks who claim they are "smart enough" to use A/V software often do not realize two rather important problems that A/V software presents:
1) If your A/V app doesn't have a signature for it, it will often go undetected. Often the signatures come out long after the threat becomes present and virulent.
2) At least half the A/V packages out there will miss a given emerging virus threat, mis-identify it as safe, or worse - even months after the fact in some cases.
Also, a rootkit will render all but a small handful of A/V solutions completely ineffective, and a "Blue Pill" hypervisor-like bit of malware will be completely invisible in most cases.
Long story short, you don't know if you are infected or not either. Now if you have a transparent proxy that keeps tabs on outbound traffic, and you have an idea of which port numbers tie to which common malware types, keep up on the latest security news, etc... then maybe you have an idea. Otherwise you're just as clueless and blind as someone who uses no A/V software. Likely worse actually, since you have an even larger false sense of security than the guy who runs no A/V solution; at least someone who runs none knows the possibility is always there.
At least on the *nix side of things, the very structure of it is built with safety in mind (it wasn't always this way, mind), and not just some afterthought that contributes to bloat and more flaws.;)
And yes, that includes me too. :)
@ddesy:
There are hundreds of flaws in Vista; that's old news. However, reliably exploiting these vulnerabilities is another story. There's a reason (at least two reasons, actually) why we have seen no Vista-targeted exploits since 2007. Just for the record, the notorious Conficker and Gumblar exploit vulnerabilities that exist on Windows Vista. However, neither of them work on Vista because of ASLR and DEP, neither of which are effectively implemented on OS X Leopard (and Snow Leopard adds only ASLR, not DEP).
@Penguinisto:
'You see, A/V software is reactive, not proactive.
'Folks who claim they are "smart enough" to use A/V software often do not realize two rather important problems that A/V software presents:
'1) If your A/V app doesn't have a signature for it, it will often go undetected. Often the signatures come out long after the threat becomes present and virulent.
'2) At least half the A/V packages out there will miss a given emerging virus threat, mis-identify it as safe, or worse - even months after the fact in some cases.
'Also, a rootkit will render all but a small handful of A/V solutions completely ineffective, and a "Blue Pill" hypervisor-like bit of malware will be completely invisible in most cases.'
>>>>Actually, modern AV products are both reactive AND proactive. In response to point #1, you're only partially right. Indeed, a threat will often go "undetected," but what you don't realize is the difference between "detection" and "protection." These days, "detection" generally describes one of two things: either post-mortem "detection" of an infection during an on-demand/scheduled scan; or "detection" of spyware, backdoors, and/or rootkits packed into a downloaded software installer or data file (e.g. Word document, PowerPoint slideshow).
However, modern AV products also include some form of Web "protection," designed to block drive-by downloads by means of rulesets, rather than heuristics and black-and-white signatures. I can tell you offhand that three of the most widely-used products, including Norton, McAfee, and AVG, all have Web protection. One example I will break down for you is McAfee's ScriptScan. It sits between your browser and Windows Script Host, admitting ordinary items like Google ads, YouTube videos, and Flash games unrestrictedly. However, whenever a script tries to create, copy, or modify any file on your system, or open the registry, McAfee jumps in and blocks it without querying the user. All you see is a single alert to INFORM you that the attack was blocked.
It is because of technologies such as these, as well as sandboxing and "techy" tweaks like those at Invincible Windows, that the numbers of XP machines infected with the Conficker worm numbered somewhere between 3 and 15 million, rather than 750 million. Get the picture?
'Long story short, you don't know if you are infected or not either. Now if you have a transparent proxy that keeps tabs on outbound traffic, and you have an idea of which port numbers tie to which common malware types, keep up on the latest security news, etc... then maybe you have an idea. Otherwise you're just as clueless and blind as someone who uses no A/V software. Likely worse actually, since you have an even larger false sense of security than the guy who runs no A/V solution; at least someone who runs none knows the possibility is always there.'
>>>>I can't really disagree with this. In most cases, anyone who is infected with Mebroot, Conficker, Gumblar, etc. will not know they are infected. That's why there are free, "transparent proxies" like Trend's RUBotted, as well as tools like GMER and HJT, between which most infections (excluding bona fide viruses, which are pretty rare) can be located fairly quickly.
Well, at least this one only affects users in the same LAN... as far as we know for now.
"Computer security publication "The H" wrote on Tuesday that its German sister publication had tested the proof-of-concept code, and that while the exploit had caused a reboot on Vista, the exploit had not worked on Windows 7. "
Good point to make. The flaw was there, and nobody has been able to exploit it even after specifically targeting it.
Care to try again?
...as far as you know. ;)
Care to try again yourself?
And? It is probably pretty trivial to get it to run on Win7. Proof of concept is just that. It provides a starting point.
You can be sure that by now a number of people have working code. They may not be so nice as to tell you, but you will find out the hard way...
That's why even proof of concept, even if it is not working due to some relatively minor oversight, is taken seriously by security experts.
And the finder of the exploit insists on his blog that it works with Win7. It may be in some specific situations only, but it still is a vulnerability.
Windows Vista is vulnerable, we were able to cause a blue screen with no effort at all.
Anything based on the Vista Kernel is also vulnerable, i.e. Windows Server 2008 (also able to crash within seconds)
Windows 7 is not vulnerable. We attempted the perscribed script, altered for a range of target memory locations and several configurations on the target. I watched in wireshark while SMB refused thousands of attempts.
We applied these same tests to Windows Server 2008 R2 (also based on Windows 7 core) also with no ill affects.
I can only assume that the verified crash of windows 7 was attempted on Windows 7 RC (the beta version), not Windows 7 RTM (the release version). Some other sites have verified that they were able to crash the RC, and not the RTM.
The RC of Windows 7 is not final, should not be considered stable, and is by no means a real test of OS security.
I am fairly disappointed at most news sites for not fact checking their sources, not performing real testing, and relying on anecdotal evidence while spreading "New zero day vulnerability in Windows 7" news all over the internet.
Now they are doing a lot with moving that compatibility to a virtual machine or compatabilty mode, and that should let them finally move on to WinFS or similar, but there are limitations in what they can realistically do without alienating their existing customers.
Apple didn't "force anyone".. remember the Classic environment.
"Apple didn't "force anyone".. remember the Classic environment."
Which doesn't work in Snow Leopard, nor does any PPC-based applications. Yes, they did abandon earlier OS verions completely and as a smaller market, they could do so with a minimum of disruption.
http://blogs.zdnet.com/security/?p=758
With just 4.67% of CRAP user and 20.25 threat per month, CRAPple should go back to drawing board and look at DOS 3.1 to get some encouragement to write better code.
@Ballmerisanape:
"Apple didn't "force anyone".. remember the Classic environment."
Which doesn't work in Snow Leopard, nor does any PPC-based applications.
-------------------------------------------------------------------------------
Sigh. Ever heard of Rosetta? Installed by default? No, but Snow Leopard will happily download it for you if you need and want it.
I really wish you would stop with all the lies about stuff you obviously have no idea about.
Care to try again?
They absolutely do MY JOB the same. Since you have no idea what that is, your comment is misplaced and irrelevant. Care to try again?
@WinNoMo CRAPple is less popular than PC and it 20.25 avg flaws per month and Vista 1.67 flaws
http://blogs.zdnet.com/security/?p=758
With just 4.67% of CRAP user and 20.25 threat per month, CRAPple should go back to drawing board and look at DOS 3.1 to get some encouragement to write better code.
Really? Mine does all the jobs that I need it to do, and if I find one that it cannot, I can fire up a Parallels instance and keep the new app nice and sandboxed.
'course, unless you run all of your Windows apps in VMs, you really cannot say the same thing, can you? ;)
Invalid assumption. OS/390, OpenVMS and IBM i (OS/400) have far more applications than Windows, e.g. all Visa and MasterCard transactions run on S/390 (zSeries) machines. That doesn't mean that Windows is useless, since it garners less developers.
For a long time, Macintosh had the dominant spot on Desktop Publishing, which was next to impossible on DOS. Later on Silicon Graphics and Sun workstations dominated the crowd in CGI and finite-element analysis.
Today, neither Mac nor SGI or Sun dominate any of these fields. Alas, iPhone commands the landscape in mobile applications, easily surpassing Windows Mobile and Symbian, even though both had years on the market.
Reasoning: Platforms dominate until the apps written for them are eclipsed by "paradigm shifts" in the way people work with computers.
One could say that Chrome OS would dominate the landscape in the post Facebook era.
But then again, only time will tell.
of course!! they aren't using windows at all. they "run" linux.
and even though 7 wasn't effected by this yet, it will be since its nothing but a visual upgrade... a theme pack if you will.
IMaybe you should practice what you preach...
It is in SMB2 handling, which is supported in both Vista and Win7. And Win2008 Server.
How about reading the actual post to Full Disclosure? Oh, I forgot, you don't even know what "Full Disclosure" is, right?
An yes they aware it exist but works but they did not say which systems were vulnerable.
Considering the concept so far have not work on Windows seven I am going take a wild guest and say that they will have a fixed out before anyone does make it work on windows 7, that of cause presuming that same bug cause the same problem.
Dippy Chips are ignorance food. They make you think you're superior because you like the same stuff billions of others do. They also help you understand the difference between "their' and "there", a major accomplishment for most dippy chippers.
If you crave Hippy Chips you're most likely a Mac user. If you crave Dippy Chips you're most likely a W---- user.
@ vaman... how many children have YOU saved today? Run home to mommy, your CrackerJack box is empty and you got no prize.
Not that I support the OS flaming wars, or your statement in general, but that was hilarious!
...so Microsoft is lying? Say it isn't so!
""Microsoft said on Tuesday that it is investigating reports of a zero-day vulnerability affecting Windows 7 and Vista."
They are investigating reports. Does it say anywhere in that line that there are such flaws existing? I think you may need to brush up on your reading skills before making such assumptions.
I could say that I'm currently investigating reports of Sasquatch camping out in your living room. If you deny it... does that mean you're lying?
See, that's the deal- you can't make assumptions like that. It's a report and not confirmed. Once MSFT confirms it, THEN you can crow all you like, but before that, you're just... well, jumping to conclusions.
The author of the exploit says otherwise.
Vista, Win 7, 2008 Server.
Either way, hows that spinning wheel of death working out for ya? Best 26$ service pack you ever bought? :)
Because more people will read the article.
No OS is perfect by any means.
Were do you see things about the Internet???
Think about LAN instead.
"Windows 7 isn't affected by it"
Except that it is, according to the author of the exploit. And even if it is only under specific circumstances, it is still bad.
You failed Security 101.
Dan if we all admitted that there would not be fan boys/girls commenting on this blog and life would be boring and dull. An we all agree all the time.
I've used it to reset the admin password on my MacBook once after doing an upgrade hosed the OS (yeah, it can happen even on a Mac....) and the admin account got locked out entirely. I was rather surprised how easy it was and that there is no defense for it, but then again for physical access to a machine, there rarely is much you can do to prevent it.
Windows with Bitlocker seems to be about the best for physical access to a system, but even that can be hacked with time.
The solution is the same for all Operating systems. Just encrypt your drive.
Bitlocker can use either TPM hardware for encryption or completely software key based using an key on an external USB drive if you want.
Its a pain in the rump as I have to deal with it daily when hard drives fail or an end user does something silly like delete the Bitlocker partition on their system. Heh.
I actually have three usb drives (and corresponding CDs) like that, one for each system: Linux, Mac, Windows.
I repair computers and i don't bother getting passwords from my customers, I simply pop in the CD and reset the password.
You could probably write new article every day to cover new vulnerabilities in the Mac, Windows, and Linux OSs.. lf you look hard enough.. you will find a hole. It's good that people are finding these though.. before they are exploited.
From the machines I've seen, the file in question is a different size and version on each "effected" os, so it looks like a Vista only bug to me.
Title: "Windows 7, Vista zero-day flaw reported"
Claim: " and that while the exploit had caused a reboot on Vista, the exploit had not worked on Windows 7"
It would appear the title is misleading. Vista, not Win7 was affected. That may change, but at this time, there is evidence demonstrating that it doesn't affect Win7 as was suggested by the title.
SMB is an internal network resource sharing method and unless you have access to the internal LAN, it really means nothing. It's easy to screen out as well. Gaining internal access to the network has been and will always continue to be the tricky part. Once you're in, there's all sorts of things you can do that are a heck of a lot easier than this.
The likelihood of this happening since it requires internal access is pretty low however. It's also easy to screen out at the router.
Macs make great front end computers. They are basically Unix boxes with a bit of bloat code strapped on for the UI (not as bloated as Windows). TCO is very low. They are almost as easy to maintain as a Linux box.
To be honest the Windows HPC Server clusters are actually pretty good. They don't have a lot of traction in the academic HPC market for a number of reasons, some dealing with scale on the largest machines, but more often than not its explained by organizational biases. It will be interesting to see how it plays out over the next couple cycles but I wouldn't be surprised to see more Windows HPC in corporate HPC environments.
Microsoft will need to significantly outperform Linux or Unix before they can take any part of the market.
Now you try again.
- by September 8, 2009 1:23 PM PDT
- So you're calling Mac users crap ? tsk-tsk. Not very nice of you. You must be very a frustrated man ! Maybe you should get away from that Windows-box and get a life, maybe ? Hmm ? ...
- Like this Reply to this comment
-
-
- by shinkukage09 September 8, 2009 6:40 PM PDT
- But they ARE crap. CRApple. Besides, like many others, you haven't realized yet that it's a proven fact that Windows is more secure.
- Like this
-
Showing 1 of 2 pages (109 Comments)But no, you'll say, it's got so many more viruses! Know why? Because most of the people who use a computer...run some Windows OS or another. Be it 98, 2000, ME, XP, Vista, or 7. Windows holds the most computer users, Thus it's going to get more viruses because more people are going to target Windows. Now, if you were to switch Mac and Windows in the past to where Mac's would have the most users, the Mac would have the most viruses. It's basic common sense. That which has the most people, will be the most targeted.