This is becoming all too common on the Internet: you have something stolen so you go online to see if you can get a good deal and suddenly realize the seller is the same person who stole the thing from you in the first place.

Today’s news is interesting because the man looking to replace his camera thought it odd that the seller was in the same town. This highlights the rather old adage “innocent until proven guilty” with the emphasis on the fact that the dumber the crook, the less likely they will be able to duck and cover once confronted with some basic facts.

In the retail industry eBay is sometimes the first place you look when things go missing. It almost lets the criminals implicate themselves for you, rather than requiring any kind of messy investigation. In fact, you might say that people can be awfully careful, if not downright sneaky, about theft just about up to the point where they post their warez online. And suddenly they’re in a whole new world with little idea of how to keep up the ruse. I almost felt sorry for one guy who went to jail. He was virtually invisible in the real world but lit up like a christmas tree online and probably never realized the connection.

Paul Laudanski posted some sample rules on Bugtraq that will help Sunbelt Kerio and Snort filter for windows metafile headers:

alert ip any any -> any any (msg: “COMPANY-LOCAL WMF Exploit”; content:”01
00 09 00 00 03 52 1f 00 00 06 00 3d 00 00 00″; content:”00 26 06 0f 00 08
00 ff ff ff ff 01 00 00 00 03 00 00 00 00 00″; reference:
url,www.frsirt.com/exploits/20051228.ie_xp_pfv_metafile.pm.php;
sid:2005122802; classtype:attempted-user; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:”BLEEDING-EDGE EXPLOIT
WMF Escape Record Exploit”; flow:established,from_server; content:”01 00
09 00 00 03″; depth:500; content:”00 00″; distance:10; within:12;
content:”26 06 09 00″; within:5000; classtype:attempted-user;
reference:url,www.frsirt.com/english/advisories/2005/3086; sid:2002733;
rev:1;)

Nice work, especially now that “73 variants of malicious WMF files” are reported to be circulating.

Edited to add: Bleeding Snort actually says “Signatures have been submitted by Matt Lange, Frank Knobbe, and others for the new WMF bug”, so kudos should go their direction. Thanks guys! The actual sigs are being maintained here. Here’s the latest snapshot (Revision: 1.5, Fri Dec 30 14:40:46 2005 EST (7 hours, 27 minutes ago) by fknobbe:

#by mmlange
alert tcp any any -> $HOME_NET any (msg:”BLEEDING-EDGE CURRENT WMF Exploit”; flow:established; content:”|01 00 09 00 00 03 52 1f 00 00 06 00 3d 00 00 00|”; content:”|00 26 06 0f 00 08 00 ff ff ff ff 01 00 00 00 03 00 00 00 00 00|”; reference: url,www.frsirt.com/exploits/20051228.ie_xp_pfv_metafile.pm.php; classtype:attempted-user; sid:2002734; rev:1;)

# By Frank Knobbe, 2005-12-28. Additional work with Blake Harstein and Brandon Franklin.
#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:”EXPLOIT WMF Escape Record Exploit”; flow:established,from_server; content:”|00 09 00 00 03|”; depth:800; content:”|00 00|”; distance:10; within:12; pcre:”/\x26[\x00-\xff]\x09\x00/”; classtype:attempted-user; reference:url,www.frsirt.com/english/advisories/2005/3086; sid:2002733; rev:3;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:”EXPLOIT WMF Escape Record Exploit – Web Only”; flow:established,from_server; content:”HTTP”; depth:4; nocase; content:”|00 09 00 00 03|”; within:500; content:”|00 00|”; distance:10; within:12; pcre:”/\x26[\x00-\xff]\x09\x00/”; classtype:attempted-user; reference:url,www.frsirt.com/english/advisories/2005/3086; sid:2002741; rev:2;)

Well, after almost two days of the exploit Microsoft has come forward with Advisory 912840 that suggests several
things:

1. This is more than just a hole in fully patched XP and 2003 (9x and 2K have been added to the list). Not much of a surprise there.
2. The scope of the infection/attack is still vague, so there is no public advice yet on how to consistently close the hole. That’s something of a surprise, especially since Microsoft has announced that if you are part of their “One Care” program you are protected.

Note: the One Care reference is wmf1228. Yet another vulnerability database…wonder what happens if you get two distinct WMF exploits on Dec 28th? Do they go to wmf1228a and wmf1228b? And next year when another WMF explot is launched on the same day? Do they switch to wmf061228a? Seems like someone isn’t thinking too carefully about even the simple things, but I digress…

3. Microsoft really really wants you to contact the authorities, whether it be the FBI, Internet Fraud Complaint Center, or your local alternative.

So, I’m not sure I’m reading this announcement properly, but it raises an interesting question: Should a company be liable for damages from a defect if they have a fix but are not distributing it to anyone outside a subscription/maintenance program? Aside from all the details about fees and testing, etc. I am getting more and more curious why information about the patch (other than “if you use One Care and your light is green, then you are safe”) is not being released more quickly, since it obviously can’t be a good thing for Microsoft to delay and risk damage to all the non-One Care customers.

Edited to add: Some have suggested to me that the One Care fix is actually nothing more than an automated version of the suggestion on the Microsoft Alert:

Microsoft has tested the following workaround. While this workaround will not correct the underlying vulnerability, it will help block known attack vectors. When a workaround reduces functionality, it is identified in the following section.

Un-register the Windows Picture and Fax Viewer (Shimgvw.dll) on Windows XP Service Pack 1; Windows XP Service Pack 2; Windows Server 2003 and Windows Server 2003 Service Pack 1

Note The following steps require Administrative privileges.

To un-register Shimgvw.dll, follow these steps:

1. Click Start, click Run, type “regsvr32 -u %windir%\system32\shimgvw.dll” (without the quotation marks), and then click OK.
2. A dialog box appears to confirm that the un-registration process has succeeded. Click OK to close the dialog box.

Impact of Workaround: The Windows Picture and Fax Viewer will no longer be started when users click on a link to an image type that is associated with the Windows Picture and Fax Viewer.

Also, f-secure has said that they think this step is actually a really good idea, and that “leaving image editors out completely for the rest of the year might be a good idea.” I’ll defer to their expertise (and inside scoop) on the malware, but sometimes it is hard to tell whether they are serious or just have a really dry sense of humor.