RTP-area local music and culture

[grady <grady AT ibiblio.org>]

I think I have to disagree with Chris, not because I trust Guilfanov,
but because I trust the ISC/SANS people. Go here & read the "trustworthy
computing" entry (a couple of entries down on the front page):
http://isc.sans.org/

[note: the following pissy rant isn't directed at Todd. I suspect it
probably applies to some of you, however, given how many of my
customers, in a supposedly "managed" corporate computing environment,
have these problems.]

Of course, this is all kind of pointless if you're the kind of person
who doesn't have *current* antivirus software installed on your machine,
and a personal firewall app, and who doesn't run windows update on a
regular basis to get all the *other* patches for all the *other*
vulnerabilities, many of which have also had well-publicized exploits in
the wild. There have been worse exploits than this one, in fact; this
one at least requires you to actively fire up a browser/mailreader and
engage in risky internet usage. Previous exploits have required nothing
more than plugging the goddamn machine into the network & turning it on.

So if you don't have yr other patches up to date, along with current
antivirus DAT files & a working personal firewall, then you may as well
continue to not worry about this exploit as well. Your machine is
probably already full of trojans & is a part of the worldwide zombie
network, happily mailing out spam and engaging in DDOS attacks, which
might explain that mysterious "slowness" that you've been blaming on its
age, or on Bill Gates.

I'm not going to start an OS flamewar over this. I'm running Linux on
this machine but I've got Windows machines here at home, and I support
Windows for a living.

Macs are pretty and overpriced and infuriatingly annoying to me, in
their obfuscation of all underlying technical details, although OSX is
better for that than previous versions, and most Mac users in most
situations don't need to care about that. And they are also more secure,
if only because of their relatively small market-share. And did I
mention pretty? Now if I can only get someone to explain to me how to
adjust the bitrate and the tag format in OggDropX . . .

Linux is a lot of fun if you're the kind of person who likes to spend 3
hours trying to get your machine to print to your home printer, even
though it was working the week before, and you didn't knowingly change
anything. I happen to be that kind of person, I guess; Windows just
isn't challenging enough for me anymore. In fact, though it's hard for a
lot of nerds to admit, shit just *works* in Windows XP, by and large,
without a lot of hair-tearing-out. Except for that little thing about
the constant security holes.

Happy New Year!

Ross

Chris Calloway wrote:
>> >> but want to know if I should install the third-party non-Microsoft
>> >> patch now
> >
> > well, if you want to get your advice from a.m.c-h, then:
> >
> > ordinarily, i would say no. reasons why:
> >
> > a) i attempted to get the source code for the patch from guilfanov's
> > blog in order to inspect it and to attempt to recreate the
> > executable. the source was only *conveniently* available by running
> > the patch from what i can see. that's not the behavior of a *trusted*
> > security expert. this has also been questioned in the comments of
> > guilfanov's blog without answer from guilfanov.
> >
> > b) inspecting the patch file with an extractor did not reveal the
> > packaging of any source code in the patch executable as promised by
> > guilfanov.
> >
> > c) guilfanov did not provide the patch in a secure fashion. only
> > secondary sources have added pgp keys, and then only to their
> > repackaged msi. that's not the behavior of a *trusted* security
> > experts.
> >
> > d) the patch *didn't run* on a network isolated scratch machine when
> > i attempted it. it was not even recognized as an executable file by
> > the shell. that seems very strange. i have not inspected the psp
> > header of the executable to see why it isn't recognized. if i could
> > run it on an isolated machine, i'd run it under a debugger to see
> > what it was doing first.
> >
> > e) guilfanov in his blog said he had never created an msi before.
> > this doesn't sound like "arguably one of the best low-level Windows
> > experts in the world" to me.
> >
> > f) nobody is linking to advisories from established threat detection
> > centers. everybody commenting from on high are secondary sources of
> > threat information. is this a joke between isc, steve gibson,
> > f-secure, and others to see what kind of social engineering can be
> > perpetrated upon the fearful?
> >
> > g) guilfanov has sold buggy code in the past:
> > http://www.woodmann.com/crackz/Tutorials/Quine2.htm
> >
> > h) add to the above that guilfanov is apparently leaving it up to the
> > community to test his patch. when people scream about why hasn't ms
> > released a patch yet...
> >
> > i) guilfanov's vulnerability checker, released after his patch, was
> > rapidly shown to be thwarted by the most common anti-virus checkers.
> > this does not further inspire confidence.
> >
> > but there are attack vectors for this vulnerability other than the
> > wmf viewer unregistered by regsvr32 -u. xp *should* also require the
> > re-unregistration of shimgvw.dll upon each reboot. if you can get the
> > patch to actually run on your machine, maybe you want to consider it
> > in view of these caveats.
> >
> > note: there was massive misinformation circulating in the mefi
> > thread. jackflash was the only one to really get it right.
> >
> > 3
> >
> >
> >
> >