“What exactly is going wrong with the WMF vulnerability? Turns out this is not really a bug, it’s just bad design. Design from another era,” Mikko writes for F-Secure. “When Windows Metafiles were designed in late 1980s, a feature was included that allowed the image files to contain actual code. This code would be executed via a callback in special situations. This was not a bug; this was something which was needed at the time. The feature now in the limelight is known as the Escape() function and especially the SetAbortProc subfunction.”
Mikko explains, “This function was designed to be called by Windows if a print job needed to be canceled during spooling.”
This really means two things:
1) There are probably other vulnerable functions in WMF files in addition to SetAbortProc
2) This bug seems to affect all versions of Windows, starting from Windows 3.0 – shipped in 1990!
“The WMF vulnerability” probably affects more computers than any other security vulnerability, ever,” Mikko writes.
In an article from F-Secure on Friday, Stefan writes, “The amount of trojans using the zero-day WMF exploit is increasing rapidly… Perhaps leaving image editors out completely for the rest of the year might be a good idea.”
Full article here.
[Thanks to MacDailyNews reader “Wingsy” who not only sent us the links, but wrote the headline, too!]
Was it Bill Gates, Steve Ballmer, or both who said the following? “Secure? F-Secure, let’s just get their money!”
Macintosh. Because life’s too short.
Advertisements:
Get Free Shipping on Top-Rated iPod and Mac Accessories
The New iPod with Video. The ultimate music & video experience on the go. From $299. Free shipping.
Connect iPod to your television set with the iPod AV Cable. Just $19.00.
The New iMac G5. Built-in camera and remote control. From $1299. Free shipping.
Apple USB Modem. Easily connect to the Internet using your dial-up service. $49.00.
Related articles:
Microsoft Windows’ Zero-Day WMF flaw threats widespread; Macintosh unaffected – December 29, 2005
Mac tips for former Windows users – December 28, 2005
Switching from Microsoft Windows to Apple Macintosh – December 04, 2005
Apple’s Mac OS X, Safari web browser show market share gains – December 03, 2005
Want to switch to Mac? Mossberg answers common questions – November 10, 2005
Why people are switching from Microsoft’s Windows to Apple’s Mac OS X – November 09, 2005
Windows PC retailers face tough holiday season, meanwhile Apple stores are packed as Mac sales surge – November 09, 2005
Analyst estimates over a million Windows to Mac switchers during 2005’s first three quarters – November 07, 2005
Windows sufferers: It’s not your fault, but it is your problem – switch to Mac – November 07, 2005
Tech writer: Windows PCs highly vulnerable to zombie hijacking; get an Apple Mac instead – November 06, 2005
Windows switchers, now’s your chance: Apple Mac mini with Mac OS X Tiger for $379 – November 03, 2005
Computer columnist: anti-virus software purely optional for Apple Macs, not so for Windows – November 01, 2005
Microsoft apologists and why Apple’s Mac OS X has zero viruses – October 24, 2005
Mossberg: Switching from Windows to Mac – software not an expensive proposition – September 30, 2005
Windows to Mac switchers: recommendations and Total Cost of Ownership analysis – September 29, 2005
Switching from Windows to Mac is easy and liberating – September 14, 2005
Mossberg offers resources for Windows users interested in switching to Apple Mac – August 18, 2005
Windows users’ questions and concerns answered about Windows to Mac switch – July 27, 2005
Get your Outlook info off your PC and onto your Mac – March 05, 2003
The best way to transfer Windows Outlook folders to Mac OS X – January 22, 2003
Security company Sophos: Apple Mac the best route for security for the masses – December 06, 2005
Microsoft Windows virus spreads rapidly; Apple Macintosh unaffected – November 28, 2005
Computer columnist: anti-virus software purely optional for Apple Macs, not so for Windows – November 01, 2005
Microsoft apologists and why Apple’s Mac OS X has zero viruses – October 24, 2005
NY Times’ Pogue: Apple’s iMac G5 with sleek, virus-free, spyware-free OS earns place in living room – October 19, 2005
$500 bounty offered for proof of first Apple Mac OS X virus – September 27, 2005
Symantec: 10,866 new Microsoft Windows virus and worm variants in first half 2005 – September 19, 2005
How to avoid viruses and malware? Dump your Windows PC and get an Apple Macintosh – August 22, 2005
Do Apple Mac OS X users need antivirus software? – August 22, 2005
ZDNet: How many Mac OS X users affected by the last 100 viruses? None, zero, not one, not ever – August 18, 2005
Hackers already targeting viruses for Microsoft’s Windows Vista – August 04, 2005
16-percent of computer users are unaffected by viruses, malware because they use Apple Macs – June 15, 2005
Intel CEO Otellini: If you want security now, buy a Macintosh instead of a Wintel PC – May 25, 2005
There are no viruses for Apple’s Mac OS X – May 13, 2005
Apple touts Mac OS X security advantages over Windows – April 13, 2005
97,467 Microsoft Windows viruses vs. zero for Apple Mac’s OS X – April 05, 2005
Apple’s Mac OS X is virus-free – March 18, 2005
Cybersecurity advisor Clarke questions why anybody would buy from Microsoft – February 18, 2005
Security test: Windows XP system easily compromised while Apple’s Mac OS X stands safe and secure – November 30, 2004
Microsoft: The safest way to run Windows is on your Mac – October 08, 2004
Information Security Investigator says switch from Windows to Mac OS X for security – September 24, 2004
New York Times: Mac OS X ‘much more secure than Windows XP’ – September 18, 2003
Defending Windows over Mac a sign of mental illness – December 20, 2003
Well this just proves that if you’re in graphic arts you need Macintosh.
In fact, if you want to see any pictures at all, use Macintosh…
I’m actually starting to pity Windows users.
I don’t understand the point. I read MDN daily and they, among others in the technology field-both Windows & Mac fans-are quick to point out the shortcomings of this shotty Mac want-to-be. What I don’t understand is why these people consider Macs garbage. It makes no sense. I switched to Macs about 3 years ago and will NEVER go back to the M$ doldrums of life. My happiness index, productivity, and general sense of life has improved so dramatically since switching that it pains me to watch other people use Windows and claim to enjoy it. It’s like watching people repeatedly stick a sharpened pencil into their foreheads and think it’s great. Or better yet, they’re like drug addicts. They have no idea how badly they’re hurting themselves (and us) by continually using Windows. Their ignorance is blinding them. Have any of you found a generic way to prove to these people that they’re sick and need to see how good life is on the other side?
I’m so sick of my parents’ computer problems that I’m willingly giving them my 14″ Powerbook with an iSight camera in a few days. I just spent the past few hours whiping the HDD and prepping it for them. I got them a 60 day .mac trial so they can use iChat with me and we can video conference. My mom wishes to “see” us more often and if I need to take a $3000 hit just to show them there’s a better and more simple way to see her kids then so be it. (On the other hand, this now gives me a good excuse to have to get a good MacTel Powerbook when they’re out sometime this year.)
MW: see as in “Please God let 2006 be the year that more people see the light and cure their Windows problems by ditching that useless POS.”
It was the bad design of Windows that convinced me to try a Mac in the first place (and the rest has been an enjoyable Mac using history). At the time it had nothing to do with viruses, but looking back it’s amazing how much of this crap I just accepted as a PC user. Windows users are just conditioned to put up with poor design and the vulnerabilities that come with it. Sad really.
I actually pity them less with every emerging threat. If someone told you your car could explode if you turned left after turning right twice would you still use it? Until they actually request a good OS they deserve all the trouble they get!
Ha HA Ha! “text-only computing”!!! You just made my day.
I LOVE my Mac, it just works. I don’t want (or need) to know how it works, just like I don’t know how my car works, but I know how to drive it. I know how to use my Mac to make me lots of money, and apart from religiously backing up (because everything fails eventually) I don’t need to do anything else. Turn on at 9am, off at 5pm and that’s it.
You gotta love Apple, they make tools that don’t need babysitting.
Jim,
“My happiness index, productivity, and general sense of life has improved so dramatically since switching that it pains me to watch other people use Windows and claim to enjoy it. It’s like watching people repeatedly stick a sharpened pencil into their foreheads and think it’s great. Or better yet, they’re like drug addicts. They have no idea how badly they’re hurting themselves (and us) by continually using Windows. Their ignorance is blinding them. Have any of you found a generic way to prove to these people that they’re sick and need to see how good life is on the other side?”
Have you read the article below, yet?
Defending Windows over Mac a sign of mental illness – By SteveJack, MacDailyNews
Stop using image editors for a year (I take it he means till Vista comes out) is far from being any kind of light statement! Even if Mac is synonym with professional editing, if there was no one using Photoshop on Windows, Adobe wouldn’t be making it. I’m not entirly shure how bad this flaw is but if not only it’s a good reason to never again use windows for image printing and it probably existed since Win 3.0, this just might be the largest srew-up in computer history, making the recent Sony rootkit fiasco seem like a simple mistake.
Fred –
I did read the article. It’s a great read. I just wish there was a more simple (and less expensive) way to show those we care about that what they’re doing is just plain wrong–the jerks we don’t like can keep using Windows and we can keep reveling in their misfortune. I’ve thus far spent in excess of $5,000 between each of my immediate family members (and myself) buying Macs and related items because they were at the time suffering from their mental illness. Now my sister is a convert and loves it. My parents are next with my brother to follow shortly. It’s becoming very expensive but sometimes seeing happiness is worth any expense.
WMF? WTF!
That´s why Microsoft brought out the Xbox – they want everyone to do their internet surfing via that instead of a Dell.
That was bad news from a Finnish company called F-Secure.
” width=”19″ height=”19″ alt=”LOL” style=”border:0;” />
Windows is not the aswer! It is the question and the answer is NO!
text-only computing!!!
LOL
xanga.com/theredera
M
effwerd
You’re right, I do feel sorry for them as well (to a point). Its just that they are so used to the abuse, they really don’t see any other alternative. They think that their computing ways are the only ones.
Something else that was said once long ago, it may be they are just plain ashamed to admit they made the mistake and feel they have to continue to justify what they chose.
They made their computing bed, so let them lay in it!
Windows is a testiment to the human condition.
“I chose pile of trash, now it’s my pile of trash, I’ll live in this trash forever and it’s the best pile of trash in the universe and there is no convincing me otherwise. Plus I might even kick your ass if you try to convince me otherwise you non-pile of trash user zelot!”
Life is definitly too short to fight with a Windows OS.
Thank you Steve Jobs and Apple for making the computer a pleasure to use.
MW: friends
Ah, that’s nothing. Check out this vulnerability:
http://news.ft.com/cms/s/0d644d5e-7bb3-11da-ab8e-0000779e2340.html
I’m glad my winbox ain’t even connected to the internet, it’s pretty much is just another xbox.
OzzysCross101 recomends Windows users switch (or switch back) to Macs.
I’m not talking to you, Santa. Just because you can’t fit the plasma TV down the chimney does not mean you get to keep it.
Designed obsolescence, I’ve heard of it.
Designed detriment, only Microsoft could conceive, sustain it, perfect it, and promote it.
F-Secure, eh?
I guess that’s what happened to Microsoft. In some meeting, in some board room, someone said, “Fuck security!”
lol
I would prefer to attempt pissing standing up than use a buffoon PC (pissy)
Love the MDN take.