A Very Dangerous Worm in Windows Metafile Images (WMF)

Windows XP runs executable code inside WMF files labelled with .jpg or .gif extentions, without saying anything.

Surely the NSA has their own bit of real estate within all those Windows boxes that will tip them off if any malicious 3rd party tries to do such a thing. Wouldn't you feel safer knowing that the spooks have it all under control?

Ken Muldrew snipped-for-privacy@ucalgazry.ca (remove all letters after y in the alphabet)

"Richard Henry" schreef in bericht news: snipped-for-privacy@individual.net...

Yes, but the alternative, Linux, stinks even more. Typical Linux distributions come with more CD's than windows. Linux bloatware.

The extensions not matching headers is nothing to be worried about. In the old days, where you had uncompressed bitmaps and simple compressed gifs, life was easy. *.BMP and *.GIF and that was that. Now we have so many different graphical file formats, that it is a neccesity to store many different formats under one extension. Same with movie files. Under *.AVI you will find many different formats.

JL talks from his arse. He thinks he knows enough about software to be able to make a judgement. He can barely control a 1x16 character display on his outdated 68000 stuff.

Linux is going to take over the world, is the repeating message we hear for years and years now. The internet was going to melt yesterday. Yeah, sure.

After a little experimentation, I'm confused about that. It's not really surprising, but in Windows XP it looks like the warnings we get when opening EXE files are a sham to help a user feel secure.

Oh well.

I personally have been infinitely more satisifed since I upgraded to 'hammer 2006, version 3.4.' Why, when patched and upgraded, and scanned for viruses and bugs, it does nearly everything the old hammer ever did. And it only cost me an arm an a leg. Of course, it's only compatible with 'nail,' versions 2005 2.4 sp7 and later, but who uses those old nails anyhow?

Grins, James Arthur

Bemelman WHO?

...Jim Thompson

-- | James E.Thompson, P.E. | mens | | Analog Innovations, Inc. | et | | Analog/Mixed-Signal ASIC's and Discrete Systems | manus | | Phoenix, Arizona Voice:(480)460-2350 | | | E-mail Address at Website Fax:(480)460-2142 | Brass Rat | |

The real issue is that .wmf files may contain executable code and may be disguised as .jpg or even .bmp. My humble opinion is that image files should be *data*, and data should never be executed. Windows has no i/d space separation, executes data on purpose all the time, and accidentally much of the time. There have been hundreds of stack overflow vulnerabilities alone, spread over decades, incredibly sloppy design and coding.

It works, it sells, it makes heaps of money, and it doesn't crash. I suppose that's a working definition of "outdated" and I don't care. We mostly do the hard number crunching in an FPGA anyhow, where the math per buck and math per watt are immensely better.

I have written a few compilers, three RTOS's, hundreds of engineering apps, scores of simulators, and well over a million lines of realtime code. But it's all old-fashioned, non-object-oriented, non-dot-Net, flat, simple stuff.

Tell us something about your software.

John

Bemelman's "soft" ware is brown and squishy ;-)

...Jim Thompson

Does your hammer have the LCD impact histogram option? Is it password protected? USB?

I was at Home Depot the other day, and saw a battery-powered tape measure.

John

I bought 5 of them, 2 for my sons, 2 for my sons-in-law, 1 for me ;-)

Co-o-o-ol gadget!

...Jim Thompson

-- | James E.Thompson, P.E. | mens | | Analog Innovations, Inc. | et | | Analog/Mixed-Signal ASIC's and Discrete Systems | manus | | Phoenix, Arizona Voice:(480)460-2350 | | | E-mail Address at Website Fax:(480)460-2142 | Brass Rat | |

"Jim Thompson" schreef in bericht news: snipped-for-privacy@4ax.com...

Yes, you know everything about 'brown and squishy', because you are made of it, you miserable piece of s*it that you are.

JL is an idiot. He doesn't know a f*ck about software, yet he thinks he knows how windows should have been written. Okay, he does not need to know a f*ck about software, for the lame software he writes for his orthogonal 68000. Nothing wrong with that, since it works, but to get that up and running has little to do with software engineering, it is similar to flashing led stuff.

Today's software as seen on PC's is impossible to write *without* an object oriented approach, but what would he know about that. The retard even refuses to use a little bit of plain C, which can be the first step to OO, once you get the hang of it. He is either afraid of it, or thinks he is too old to grasp it. But without the OO he complains so much about, he would still have to make his PCB layouts using crepe tape and scizzors.

My god, you guy *are* old retards indeed. You don't just behave like old farts, but you actually *are* old farts in every aspect. There is no hope for you both. I rest my case.

I am sure that bill is not responsible for this one. In fact, I doubt that bill has much to do with the design of MS products these days.

If you can dig up a copy of Warp 4 (Ebay, friend, ?), the upgrade drops to about Cdn$190. I have been running OS/2 since 1997 and switched to eCS last year. In all that time I've never had a malware problem. I've even had a few crashes over the years and had to re-boot never re-install. Drivers can be a problem but the situation is improving. The only ones I'm lacking at present is a photo quality one for my Canon printer and one for my Epson scanner but I see that one for the Epson has just been released.

Much of that is stuff I don't have or use so I can't help but there is very active development work happening on Svista. Whether it would help you, I can't say. At present I'm very much into music related stuff like moving our LPs and Cassettes of to digital. I'm happy to say that it's all being done with free software and some APL2 scripts I wrote.

What's available in DOS programs to do those jobs? I have some legacy programs I use a lot and they run better under OS/2-eCS than they ever did under DOS.

I have W2K on this machine as well as eCS. I even use it on rare (and getting rarer) occasions but never to get on the internet.

Ted

OK here in Moz 1.7 (Mozilla/5.0 (OS/2; U; Warp 4.5; en-US; rv:1.7) Gecko/20040617)

Ted

Unfair; that's because they come with all the applications, too! If you want compact, there are linux distrubutions that boot off a business-card sized CD.

Even the large mainstream distributions typically install from a small CD image. You can then select what applications you want and they download automatically.

Although, if you had written it in C++ instead of machine code it would only have been 1000 lines! :)

No.

- YD.

You mean Linux is the OS of the future - and always will be?

Ted

VMS was a superior OS, written in, as I recall, Bliss and assembly. It used an event flags synchronizing mechanism, rather then the async Windows paradigm, to organize multitasking. It was so good that Bill hired one of its authors (there were *two*) to write the NT kernel. But unfortunately it had to be Win3 compatible, thunks and all, but it was a huge improvement over the garbage that Microsoft wrote, the

The best Microsoft code was DOS, because they bought it and IBM debugged it.

I ran a dozen users on RSTS/E, a PDP-11 timeshare OS that would run for months at a time, solid between powerfails. It was coded in assembly. Unix was coded in plain C.

No, I've done a little C, I just think it's ugly. I don't do ugly.

PCB cad is one of the absolutely unmitigated blessings of the computer age, but it preceded OOP by many years.

Hope? I can't imagine what you mean. I use new tools when they make sense, and stick with old ones when they don't. Given that there's too much around for one person to learn, it makes sense to me to learn the things that are truly useful, like DSP in FPGAs, or fiberoptics, or GigaLogic tricks, and ignore things that are merely fads, like Perl and C++ and abstraction for its own sake.

Tell us about your software.

John