-
Windows 7 crasher in the wild
Posted on November 13th, 2009 at 17:20 5 commentsSANS Internet Storm Center reports that a guy by the name of Laurent Gaffie has posted a code sample that crashes Windows 7. The press has picked it up and branded it a “0day attack” which is literally true, but there’s much less there than meets the eye.
At least at this point, the 0day can only freeze Windows 7. It can’t take over anything. But that makes it annoying, and potentially amusing to the kind of cretin who gets a kick out of freezing Windows 7 machines.
A link to a server running this code could easily be embedded in a web page or email, pointing out to a server on the internet - this exploit is not isolated to corporate networks doing file sharing.
So if someone tells you that the sky is falling on Windows 7, you have my permission to yawn a bit.
If somebody figures out a way to exploit the hole in SMB that this 0day uses, we’ll have a whole new ballgame. But for now it’s merely annoying.
5 responses to “Windows 7 crasher in the wild”
-
Woody,
Could you talk about “crashes” more? I know one site that crashes when I go there via Firefox. I had thought it was the site’s fault. -
Maghullyback November 15th, 2009 at 16:14
Woody,
What’s your advice security-wise and privacy-wise regarding Java? I tried to play chess at Yahoo Games, but nothing happened. It said I needed to download and install Java. So I went to the Java website and installed version 17. Back at Yahoo chess, it then told me to unblock pop-ups in Internet Options, which I did. Everything worked fine, and I destroyed my opponent (though he was hardly Bobby Fischer). All good stuff. But is this a security risk, playing online chess with messages scrolling across the screen sent by other people watching the game? I use Vista, IE8, and Kaspersky Internet Security. Kaspersky seems to have all sorts of firewalls and “secure connection” things going on. Would these help when connected to the Yahoo chess servers?
I’ve got a feeling you’re going to say “IE+Java+onlinechess-popups=Laptop Armageddon”. Do I need to tweak the Java privacy settings? Where ARE the fuggin Java privacy settings?! I’d rather not have them phoning home, but is that the price we have to pay for using their “free” software? And what would they phone home with, exactly? Kaspersky’s data collection “service” is unbelievable; they seemingly collect just about everything about you and your computer. Luckily, us Europeans have to opt in to this data theft, while the rest of the world gets automatically fleeced. Does Java mine your data in this way? Who else does? Any advice about this stuff would be greatly appreciated.
Khop khun Woody.
(did I get that right? I mean THANKS) -
Maghullyback -
Some people go to great lengths tweaking Java. I don’t. But the main thing to remember is that it HAS to be updated quite frequently. Normally, Java will do that for you, but you should also make sure you have Secunia Personal Security Inspector on the job. It’s free, and it works great.
I haven’t heard of any data farming from Java, and would be surprised if it somehow slipped in somewhere down the road. There’s no security risk that I know about with messages scrolling across your screen while playing chess. Instant Messaging software does it all the time.
Personally, I use Windows 7 and Microsoft Security Essentials. That’s it. No Kaspersky. No Comodo. No ZoneAlarm. No McAfee. No Norton, for heaven’s sake. No AVG. No nothing. Just Win7 and MSE. Of course I use Firefox instead of Internet Explorer. (Yes, I know that “studies” have shown that Firefox is less secure than IE – to which I say “humbug.” ActiveX alone is reason enough to shun IE.)
-
Woody, read the following ZDNet Blog:
http://blogs.zdnet.com/security/?p=4938&tag=nl.e550 -
EP -
Yep, I saw that. They’re a little slow on the uptake, eh?
Leave a reply
-


