main

WMF Exploits Sold By Russian Hackers

malebolgia   on 03 February 2006 - 16:41 · 15 comments & 2318 views

Advertisement (Why?)
 The Windows Metafile (WMF) bug that caused users -- and Microsoft -- so much grief in December and January spread like it did because Russian hackers sold an exploit to anyone who had the cash, a security researcher said Friday.

The bug in Windows' rendering of WMF images was serious enough that Microsoft issued an out-of-cycle patch for the problem in early January, in part because scores of different exploits lurked on thousands of Web sites, including many compromised legitimate sites. At one point, Microsoft was even accused of purposefully creating the vulnerability as a "back door" into Windows.

News source: InformationWeek




Post a comment · Send to friend Comments · There are 15 additional comments
(1 reply) #1 itaniumx86 on 03 Feb 2006 - 16:49
i thought the exploit was available for every1 to study it or to use it anyway...
bunch of greedy russians
#1.1 Martin Blank on 03 Feb 2006 - 21:41
As of Dec 27 or so, when it became more or less public knowledge courtesy of a semi-anonymous post on a public mailing list, this was true. However, forensics have discovered that the exploit was in active use at least since the first week of December. For a minimum of three to four weeks, it was in circulation in the hacking underground, and was in use to drop exploits on computers.
(1 reply) #2 idbuythatforadollar on 03 Feb 2006 - 16:59
Bollocks it 'spread like it did because Russian hackers sold an exploit to anyone who had the cash'.

Half the 0-day exploits out there are released free of charge to security mailing lists like full disclosure.
#2.1 Martin Blank on 03 Feb 2006 - 21:43
There are plenty out there that are never released, but instead are quietly sold and traded amongst a group whose interest is not publicity, but profit.
#3 Rudy on 03 Feb 2006 - 17:55
smart guy
(6 replies) #4 brianshapiro on 03 Feb 2006 - 18:59
how many of you here were affected by the exploit?
#4.1 Rudy on 03 Feb 2006 - 19:19
i wasnt but i know a few people who were
#4.2 Angry_Badger on 03 Feb 2006 - 20:06
Yeah I work in tech support and beleive me loads of people were affected by this exploit
#4.3 sphbecker on 03 Feb 2006 - 21:21
I don't know of anyone one who was effected. As a percentage I think it was very small, but that is no comfort to those who were infected.
#4.4 osirisX on 03 Feb 2006 - 21:46
I wasn't affected.
#4.5 BuzZBladE on 05 Feb 2006 - 21:22
i went to $insert crack site here$ for a cd crack for an old game i was reinstalling. and firefox kept asking if i wanted to download .WMF instead of the zipped crack and i told it no, like normal cuz they usually have activex spyware. then i went back cause they updated the game and i needed the crack for the newer version, but instead of fox i used IE and it didnt ask, it just automatically downloaded and ran the WMF file. first it installed a file onto C: with 5 exe files inside it and ran it. then it copied to system32 and put in registry entires to run on the next reboot, and then disabled taskmanager. i disconnected immeditalty from the net and cleaned it up and was back on in just a few minutes.
#4.6 skooter on 07 Feb 2006 - 07:09
I still have "YOUR COMPUTER MAY CONTAIN SPYWARE" plastered on my desktop and I can't get rid of it because the wallpaper is locked.

Fscking thing made me spend a good 4 hours cleaning up after it and my computer is still not running like normal.
#5 linuxbox on 03 Feb 2006 - 21:52
it is not like kama sutra virus
(1 reply) #6 toadeater on 03 Feb 2006 - 23:23
These "Russian hackers" didn't go by the name of Starforce, did they?
#6.1 Nasapion on 05 Feb 2006 - 23:11
lol

Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!

Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.

Advertisement (Why?)