Full Disclosure mailing list archives
Re: Someone wasted a nice bug on spyware...
From: H D Moore <fdlist () digitaloffense net>
Date: Wed, 28 Dec 2005 22:56:17 -0600
On Wednesday 28 December 2005 19:16, Nick FitzGerald wrote:
The fact it was used for installing spyware (and may have been so for near on two weeks now) simply shows you where the money is these days.
Its a sad state of affairs when $19.95 crapware scams make more money than cleaning out a few bank/egold/epoker accounts. Since WMF/EMF is basically raw access to the GDI API, expect to see quite a few of these bugs. For the curious: - http://msdn.microsoft.com/library/en-us/gdi/metafile_250z.asp For anyone using the Metasploit module (aka crappy wrapper around the original file), keep in mind that for the exploit to work, you need to request a path from the attacking system path ending in .wmf (or .tiff, or .emf, or ...). The exploit has been tested against non-english versions of Windows as well (Polish, Spanish, a few others) and works just fine as long as DEP is turned off. -HD _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Someone wasted a nice bug on spyware... H D Moore (Dec 27)
- Re: Someone wasted a nice bug on spyware... Jerome Athias (Dec 28)
- Re: Someone wasted a nice bug on spyware... Morning Wood (Dec 28)
- Re: Someone wasted a nice bug on spyware... Nick FitzGerald (Dec 28)
- Re: Someone wasted a nice bug on spyware... H D Moore (Dec 28)
- <Possible follow-ups>
- RE: Someone wasted a nice bug on spyware... Eric Sites (Dec 27)
- RE: Someone wasted a nice bug on spyware... Paul (Dec 27)
- Re: Someone wasted a nice bug on spyware... Tomasz Kokowski (Dec 28)
- Re: Someone wasted a nice bug on spyware... ad () heapoverflow com (Dec 28)
- RE: Someone wasted a nice bug on spyware... Paul (Dec 27)
- Re: Someone wasted a nice bug on spyware... Patrick Dickey (Dec 28)
- RE: Re: Someone wasted a nice bug on spyware... Peter Ferrie (Dec 28)
- Re: Re: Someone wasted a nice bug on spyware... fok yo (Dec 29)
- RE: Re: Someone wasted a nice bug on spyware... Peter Ferrie (Dec 28)
- Re: Someone wasted a nice bug on spyware... Jerome Athias (Dec 28)