RE: Is The .WMF Exploit A ConsPiracy Gone Bad?

[Don Kennedy <zoverlords () yahoo com>]

The Pod Cast was by Steve Gibson and can be heard here:
   
  http://media.grc.com/sn/SN-022-lq.mp3
   
  Curious, if after you listen to how explicit this works, how you will feel then?

Todd Towles <toddtowles () brookshires com> wrote:
  
Don wrote: 
> 4. This ("Back Door") can/could be invoked via Email, HTML 
> email, or via an email attachment, or even an IMAGE in a IM 
> session, such as for example in Yahoo Messenger, where one is 
> allowed to have a PHOTO of yourself ("A Drive-By Method of 
> Installation") so when it was said in the Pod Cast that there 
> would be a requirement to VISIT a web site this is not true. 

Don't forget HTML based Chat seesion, however your statement makes it
sound like Microsoft is trying to hide the many other vectors. This
isn't true. They have confirmed what many of us already knew and what
you said above in the Security Advisory itself right before the patch
was released on Thursday. I don't seen this PodCast, you speak of...but
it was either before they released the new "attack vector" information
or the person was misinformed.

> If the proper investigation is done about this, IMHO, I t! 
> hink it can EASILY be proven that Federal Agencies have in 
> fact USED this method ("A few MORE current and in-place back 
> doors will be publicly admitted too as well") with and 
> without the required paperwork, and that Microsoft actually 
> provided instructions as to the use of these back doors to 
> said agencies. 

Proof? Otherwise, I think you might be troll...

> It CANNOT be accidental the the WRONG VALUE invokes code, 
> which has NO way to communicate ("Easily") with the source 
> that launched it, accidentally ("Note: while it also is being 
> listed in Microsoft Documentation as LEGACY code") is carried 
> even to Windows Vista. Even if somehow like in DNA, this was 
> a one-in-ten-billion accident, it does NOT explain why this 
> documented LEGACY code was carried over to Windows Vista, and 
> MORE importantly this: 

Because some printer programmer were messy and were using it for
postscript stuff, already explained on this list one. I am sure
Microsoft has a lot of code that could be removed at the risk of
breaking stuff...which is what they try not to do.

> That WHEN Microsoft REMOVED this FUNCTIONALITY COMPLETELY 
> from the Operating System, no Microsoft Product or 
> application, no 3rd party code or application, no major 
> client's or customers were impacted in ANY! way! 

Not true, some printer drivers did not function...it was a small
percentage, but it did happen. This was first seen using Ilfak's patch
and then with the Microsoft patch. There have been several patches that
didn't "break" anything..the Universal PnP patch for example.

> If the INTENT of the SETABORTPROC parameter using the Escape 
> procedure WAS to help with Printer failure logic? Where's the 
> PAPER JAM? 

See above..


  


                
---------------------------------
Yahoo! Photos – Showcase holiday pictures in hardcover
 Photo Books. You design it and we’ll bind it!

_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.