JPEG Exploit on the loose

[KeyserSoze]

Based on the recently discovered vulnerability in Windows and IE, it's already been created:
Slashdot Link

Just an FYI Post.





KeyserSoze

 

[jtusa]

Yet another reason for Firefox.

 

[Evadman]

Thanks, and welcome to last week.

 

[MercenaryForHire]

Already patched.

- M4H

 

[Viper GTS]

Originally posted by: Evadman
Thanks, and welcome to last week.

Last week it was just "this is possible" - MS typically warns ahead of time to give people a week or two lead on the virus writers that will inevitably pounce on it.

This is the first sighting in the wild, and is VERY significant.

Viper GTS

 

[KeyserSoze]

Originally posted by: Evadman
Thanks, and welcome to last week.

You're very welcome. I'm sorry, on a board of mostly Computer Professionals, I thought this might be news. Yes, the vulnerability is a few weeks old....but an actual exploit isn't.




KeyserSoze

 

[Evadman]

Originally posted by: Viper GTS

Originally posted by: Evadman
Thanks, and welcome to last week.

Last week it was just "this is possible" - MS typically warns ahead of time to give people a week or two lead on the virus writers that will inevitably pounce on it.

This is the first sighting in the wild, and is VERY significant.

Viper GTS

I was under the impression that proof of concept was posted last monday

 

[her209]

Originally posted by: jtusa4
Yet another reason for Firefox.

Ignorant post. Its a Windows vulnerability, not IE.

 

[CraigRT]

frickin' retardedness.
but yeah i have patched up whatever thus far.

 

[Iron Woode]

I tested out the nasty ah heck on my PC.

Norton attacked it right away and called it Bloodhound.Exploit.13

Anyone else notice that this virus showed up on a Transsexual newsgroup?

 

[Zim Hosein]

Originally posted by: Iron Woode
I tested out the nasty ah heck on my PC.

Norton attacked it right away and called it Bloodhound.Exploit.13

Anyone else notice that this virus showed up on a Transsexual newsgroup?

:Q

 

[dman]

No :camera:'s please.

Sigh. F-ing MS and their craptastic OS. I remember a time when viewing JPG's was safe.

 

[Koing]

Thanks for the heads up. Didn't catch it when it was announced or whatever the other week.

Funny I got an email apprently from 'Citibank' from 'paypal' with a link and a jpg of some sort today. I deleted the ah heck right away though.

Koing

 

[Iron Woode]

Originally posted by: Zim Hosein

Originally posted by: Iron Woode
I tested out the nasty ah heck on my PC.

Norton attacked it right away and called it Bloodhound.Exploit.13

Anyone else notice that this virus showed up on a Transsexual newsgroup?

:Q

Here is the first message header:

Path: news.easynews.com!core-easynews!newsfeed2.easynews.com!newsfeed1.easynews.com!easynews.com!easynews!
cyclone1.gnilink.net!gnilink.net!wn14feed!worldnet.att.net!204.71.34.3!newsfeed.cwix.com!newsfeed.icl.net!newsfeed.wirehub.nl!news.cambrium.nl!news.cambrium.nl
!news2.euro.net!62.253.162.219.MISMATCH!news-in.ntli.net!newsrout1-win.ntli.net!ntli.net!newspeer1-win.ntli.net!newsfe3-win.ntli.net.POSTED!53ab2750!not-for-mail
From: Power-Poster@power-post.org (Power-Post 2000)
Sender: Power-Poster@power-post.org
Newsgroups: alt.binaries.multimedia.erotica.transsexuals,alt.binaries.pictures.erotica.transexual,alt.binaries.pictures.erotica.transexual.action,alt.binaries.pictures.erotica.transsexual
Subject: (Shemale-loves it up the ass.jpg (1/1)] [1/1] - Shemale loves it up the ass
X-Newsposter: NNTP POWER-POST 2000 (Build 24c) - net-toys.8k.com
Lines: 96
Message-ID: <A_J5d.105$24.101@newsfe3-win.ntli.net>
Date: Mon, 27 Sep 2004 01:25:52 GMT
NNTP-Posting-Host: 82.1.163.241
X-Trace: newsfe3-win.ntli.net 1096248352 82.1.163.241 (Mon, 27 Sep 2004 02:25:52 BST)
NNTP-Posting-Date: Mon, 27 Sep 2004 02:25:52 BST
Organization: NTL
Xref: core-easynews alt.binaries.multimedia.erotica.transsexuals:1756301 alt.binaries.pictures.erotica.transexual:393069 alt.binaries.pictures.erotica.transexual.action:2666691 alt.binaries.pictures.erotica.transsexual:207823
X-Received-Date: Sun, 26 Sep 2004 19:19:51 MST (news.easynews.com)

 

[NikPreviousAcct]

This is a very old exploit. I used to have this nifty little program that built a script into the image of my choosing. I was stealing the passwords of people I hated for years because they were dumb enough to open an email from me.. :laugh:

 

[TipsyMcStagger]

I can't seem to find the update to patch this... im on sp2
could it be possible im already patched, how do i check?

 

[Iron Woode]

Originally posted by: TipsyMcStagger
I can't seem to find the update to patch this... im on sp2
could it be possible im already patched, how do i check?

On MS website under GDI+ it states the SP2 is patched.

 

[Viper GTS]

Originally posted by: Nik
This is a very old exploit. I used to have this nifty little program that built a script into the image of my choosing. I was stealing the passwords of people I hated for years because they were dumb enough to open an email from me.. :laugh:

I very seriously doubt it was the same exploit.

Viper GTS

 

[NikPreviousAcct]

Same concept. When I was doing it, the execution allowed the virus to do things like change the client's host file (what I was doing) and edit other system files. It was fun.

 

[KeyserSoze]

Originally posted by: Nik
Same concept. When I was doing it, the execution allowed the virus to do things like change the client's host file (what I was doing) and edit other system files. It was fun.

Remind me to stay on your GOOD side.





KeyserSoze

 

[NikPreviousAcct]

Originally posted by: KeyserSoze

Originally posted by: Nik
Same concept. When I was doing it, the execution allowed the virus to do things like change the client's host file (what I was doing) and edit other system files. It was fun.

Remind me to stay on your GOOD side.





KeyserSoze

haha - have the proggy set the host file to redirect the URL when they check their email (webmail) to your home IP and then setup an HTTP server on your end to emulate the login page. When they put their user/pass into the boxes and click login, the page on your end saves the user/pass to a file on your PC and then forwards them to the correct IP. With some languages, you can pass the user/pass variables along with that redirection so that when they get redirected, they go right into their own legitimate inbox.

They won't even know that anything's happened.

 

[luv2liv]

i hate win SP2. screwed up a lot of how things b displayed when surfing. so i uninstalled it immediately!
any way to prevent this without SP2?

 

[NikPreviousAcct]

Install Linux.

 

[Gurck]

Originally posted by: KeyserSoze

Originally posted by: Evadman
Thanks, and welcome to last week.

You're very welcome. I'm sorry, on a board of mostly Computer Professionals, I thought this might be news. Yes, the vulnerability is a few weeks old....but an actual exploit isn't.




KeyserSoze

Mostly 15 year olds, you mean. And you responded to a good example.

 

[yhelothar]

Good thing I don't go on transsexual groups