Clan x86

Technical (Development, Security, etc.) => General Security Information => Topic started by: iago on January 23, 2006, 09:14:33 PM

Title: WMF Attacks on British Parliament
Post by: iago on January 23, 2006, 09:14:33 PM
http://news.com.com/British+parliament+attacked+using+WMF+exploit/2100-7349_3-6029691.html?tag=nefd.top

Quote
The British Parliament was attacked late last year by hackers who tried to
exploit a recent serious Microsoft Windows flaw, security experts confirmed
on Friday.

MessageLabs, the e-mail-filtering provider for the U.K. government, told
ZDNet UK that targeted e-mails were sent to various individuals within
government departments in an attempt to take control of their computers. The
e-mails harbored an exploit for the Windows Meta File vulnerability.

The attack occurred over the Christmas period and came from China, said Mark
Toshack, manager of antivirus operations at MessageLabs, who added that the
e-mails were intercepted before they reached the government's systems.

"The attack definitely came from China--we know that because we log the IP
addresses. The U.K. Government was targeted but none (of the e-mails) got
through. No one was affected. They were attacked, but they (the government)
didn't know about it until we told them," Toshack said.

...
_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.

Title: Re: WMF Attacks on British Parliament
Post by: Sidoh on January 23, 2006, 09:22:00 PM
ROFL!!!  I'm so going to give Lihao shit tomorrow (he's the exchange student from China).
Title: Re: WMF Attacks on British Parliament
Post by: iago on January 23, 2006, 09:24:18 PM
Well, China is the source for most online attacks.  I think people there are computer-idiots (or something), so they get exploited and become open proxies that attacks go through. 
Title: Re: WMF Attacks on British Parliament
Post by: Sidoh on January 23, 2006, 09:42:15 PM
Quote from: iago on January 23, 2006, 09:24:18 PM
Well, China is the source for most online attacks.  I think people there are computer-idiots (or something), so they get exploited and become open proxies that attacks go through. 

It could be that they have a lot of technology relative to the rest of the world, too.  Think about their population and also how technologically advanced they are.  Lihao brought a camera that was 7 megapixels.  That's about up to par with today's top-of-the-line hobbiest (not professional; his is a hobbiest camera too) digital cameras on the market in the US.  He said he has had it for about two years now.

Given those two facts, you're a lot more likely to find an insecure node in a WAN in China than you are in the US or Canada.
Title: Re: WMF Attacks on British Parliament
Post by: Blaze on January 23, 2006, 10:07:18 PM
I think they setup those proxies, because they don't care.  :P
Title: Re: WMF Attacks on British Parliament
Post by: Sidoh on January 23, 2006, 10:18:14 PM
Quote from: Blaze on January 23, 2006, 10:07:18 PM
I think they setup those proxies, because they don't care.  :P

Or don't know how to care or that they should care.  I think my hypothesis is more correct.
Title: Re: WMF Attacks on British Parliament
Post by: Newby on January 23, 2006, 11:49:01 PM
Quote from: iago on January 23, 2006, 09:24:18 PM
Well, China is the source for most online attacks.  I think people there are computer-idiots (or something), so they get exploited and become open proxies that attacks go through. 

When I was @ M$ HQ, there was this poster with regions with most copies of illicit copies of Windows. China looked like a bright red dot.

So, since they can never patch their systems, they get infected easily. :)
Title: Re: WMF Attacks on British Parliament
Post by: Sidoh on January 23, 2006, 11:50:44 PM
Quote from: Newby on January 23, 2006, 11:49:01 PM
When I was @ M$ HQ, there was this poster with regions with most copies of illicit copies of Windows. China looked like a bright red dot.

So, since they can never patch their systems, they get infected easily. :)

That's pretty funny.  What'd you go to the Microsoft Headquarters for?
Title: Re: WMF Attacks on British Parliament
Post by: Warrior on January 24, 2006, 12:50:26 AM
Linux Missionary trip.
Title: Re: WMF Attacks on British Parliament
Post by: Ergot on January 24, 2006, 01:06:00 AM
Hahaha. Silly Chinese.
Title: Re: WMF Attacks on British Parliament
Post by: Blaze on January 24, 2006, 01:26:25 AM
Quote from: Warriorx86] link=topic=4620.msg51985#msg51985 date=1138081826]
Linux Missionary trip.
[/quote

Hah, my Engineering teacher said they based Vista off of Unix?  I'm not going to use it so *shrug*.
Title: Re: WMF Attacks on British Parliament
Post by: Sidoh on January 24, 2006, 02:40:05 AM
Quote from: Blaze on January 24, 2006, 01:26:25 AM
Hah, my Engineering teacher said they based Vista off of Unix?  I'm not going to use it so *shrug*.

False... we had an argument about that on IRC yesterday.  Newby didn't even go as far as to claim it was based on UNIX, but he did say there was a UNIX subsystem.  TehUser asked for documentation and Newby was unable to find anything supporting his claim directly.

Vista is not based on UNIX.  Tell your engineering teacher he's wrong! :)
Title: Re: WMF Attacks on British Parliament
Post by: iago on January 24, 2006, 08:53:55 AM
Quote from: Newby on January 23, 2006, 11:49:01 PM
When I was @ M$ HQ, there was this poster with regions with most copies of illicit copies of Windows. China looked like a bright red dot.

So, since they can never patch their systems, they get infected easily. :)

You can still download security patches with illegal copies of Windows. 


Quote from: Sidoh on January 24, 2006, 02:40:05 AM
False... we had an argument about that on IRC yesterday.  Newby didn't even go as far as to claim it was based on UNIX, but he did say there was a UNIX subsystem.  TehUser asked for documentation and Newby was unable to find anything supporting his claim directly.

Vista is not based on UNIX.  Tell your engineering teacher he's wrong! :)
It has a lot of UNIX-style elements, I'm told. 

In any case, TehUser was on IRC?  I thought he went away this week :-/
Title: Re: WMF Attacks on British Parliament
Post by: Blaze on January 24, 2006, 03:40:26 PM
By based, I'm sure he didn't mean code wise, he probably ment based on how they do things... but I don't know much about this so I'll drop the argument. :P

Yes, my other versions of windows are less then legit and they're up to date on everything.
Title: Re: WMF Attacks on British Parliament
Post by: deadly7 on January 24, 2006, 06:54:21 PM
Well, I read on the M$ website that Vista will incorporate a lot of things Linux does, of course those were rumors released like, last spring.
Title: Re: WMF Attacks on British Parliament
Post by: Sidoh on January 24, 2006, 11:02:41 PM
Quote from: Blaze on January 24, 2006, 03:40:26 PM
By based, I'm sure he didn't mean code wise, he probably ment based on how they do things... but I don't know much about this so I'll drop the argument. :P

Yes, my other versions of windows are less then legit and they're up to date on everything.

No, he said that Vista would have a UNIX subsystem, as in reverse compatability with UNIX applications.  From the evidence I've seen, there's no such intention...
Title: Re: WMF Attacks on British Parliament
Post by: Blaze on January 24, 2006, 11:41:21 PM
Quote from: Sidoh on January 24, 2006, 11:02:41 PM
Quote from: Blaze on January 24, 2006, 03:40:26 PM
By based, I'm sure he didn't mean code wise, he probably ment based on how they do things... but I don't know much about this so I'll drop the argument. :P

Yes, my other versions of windows are less then legit and they're up to date on everything.

No, he said that Vista would have a UNIX subsystem, as in reverse compatability with UNIX applications.  From the evidence I've seen, there's no such intention...

That's definitely not what he said. :)
Title: Re: WMF Attacks on British Parliament
Post by: Sidoh on January 24, 2006, 11:56:33 PM
Quote from: Blaze on January 24, 2006, 11:41:21 PM
That's definitely not what he said. :)

You were not present during the argument.  It was ergot, TehUser, newby and I.  We extended the conversation later, which is probably what you remember.

I sepcifically remember the word subsystem.
Title: Re: WMF Attacks on British Parliament
Post by: iago on January 25, 2006, 09:38:10 AM
QuoteBill Hilf, the head of Microsoft's Linux lab, is planning to talk up during his LinuxWorld session on Wednesday the elements of Microsoft's Services for Unix subsystem that the company is integrating into R2. Hilf tipped his hand during a Q&A with Slashdot readers posted to the Slashdot Web site on Monday.
ADVERTISEMENT

"I can confirm that the next-generation of several components of Services for Unix are being integrated into Windows Server 2003 R2. The Network File System (NFS) client, NFS Server, User/Name Mapping, Telnet Server & Client, Password Sync and NIS Server components of Services for Unix are all present in the Windows Server 2003 R2 builds," said Hilf, in response to one of the Slashdot questioners. "In addition, a revamped POSIX subsystem, the 'Subsystem for Unix-based Applications' or 'SUA' is also available as an optional install in R2.
Source (http://www.microsoft-watch.com/article2/0,2180,1845380,00.asp)


QuoteUtilities and SDK for Subsystem for UNIX-Based Applications is an add-on to the Subsystem for UNIX-Based Applications (referred to as SUA, hence forth) component that shipped with Microsoft Windows Server 2003 R2.

This consists of the following components:

- Base Utilities
- SVR-5 Utilities
- Base SDK
- GNU SDK
- GNU Utilities
- UNIX Perl
- Visual Studio Debugger Add-in
Source (http://www.ntcompatible.com/Utilities_and_Software_Development_Kit_SDK_for_Subsystem_for_UNIX-based_Applications_s61763.html)


They have what they call a "UNIX Subsystem" for Windows 2003 (really, it just seems like it's POSIX compliance, but whatever, Microsoft can spin that however they want).  It seems pretty likely that they'd have it for Windows Retirement (err, Vista) too.