Slashdot Mirror
Domain: greymagic.com
Stories and comments across the archive that link to greymagic.com.
Comments · 39
-
Re:Opera?
There's actually very many security holes found in Opera compared to its very low user base. Do a search, and count. You'd be surprised.
Yes, they're usually good at fixing those brought to their attention, but we know nothing about the security problems not brought to their attention. This is an inherent problem with closed source.
Also, not everyone agrees that their security handling is the best.
I remember the jpeg security bug which bit everyone, and everyone fixed. Even Microsoft treated it as critical and severe, but Opera? It was branded a "cosmetic" bug in the release notes of the next release, and no notification of the security hole, urging customers to upgrade.
Some also seem to think that their security model is flawed (in addition to not understanding vulnerability reports).
But back to the point -- with closed source, you just can't know what else lurks under the hood, or whether they actually fix problems, or just the symptoms. That a previously reported bug has reappeared in later versions might indicate the latter -- once what's in front changes, the inside becomes vulnerable again.
Even if you disagree with all of the opinions of Opera having more than their share of security issues and a less than desirable way of treating them, saying that Opera is secure because all known security holes have been patched is just plain wrong. If that was the case, software that no-one has tested would be 100% safe, because there's no known holes. In reality, there's always more holes that no-one have detected, and how many are found tends to be proportional to the amount of scrutiny the application gets. With Opera, that's far less scrutiny than Firefox and IE, so one should expect far fewer found bugs too. Not far fewer bugs. Based on customer base, Opera has more found security bugs than both Firefox and IE, which doesn't bode well for the number of undiscovered ones. -
Re:Sounds like . .
Whatever you say.
But I, for one, will not pay for a browser that doesn't provide me with any features that can't be had for free in Firefox. I would probably buy a copy though, if it provided something significant that cannot be had in any of the other, cheaper, browsers.
If Opera was (in my eyes) a truly better product, it's be a no-brainer. But the only advantages I've heard of are few and marginal. Of course, if Firefox was worse, I'd probably be using Opera.
And that's why I don't use Opera. And why, for me, it's not worth the money. I suspect there are a lot of people that feel the same way. -
Re:For those of you annoyed by things like this...
Offtopic, I know, but I didn't start it!
A serious security flaw was discoverd in versions of Opera prior to 7.53, probably cross-platform. Allows read access to filesystem (including mail, cookies, etc) read more here -
Re:Few teething problems, but good overall
Those plugin browsers are really uncool. IMNSHO, as a web developer of sorts, when somebody mentions CruftyBrowser, ShadyBrowser, or whatever other IE type extensions as a substitute for Mozilla and friends is what it would be like hearing someone bragging to his friends that he can borrow your truck and return it with no gas, after doing so.
Besides, isn't it just a little curious that not one of these freeware IE extension programs have any source code out there?
You have the same security problems (and potential additional security risks by the extension itself, ala the Googlebar hack), same lack of standards compliance, you're still chalking up hits for Internet Explorer (yes, the user agent stays the same if you use these), and depending on which one you use, about as much screen cruft as IE and Mosaic combined
Show some compassion, and some support for the coming of true 5th generation internet. Friends don't let friends drive on the information superhighway with MSHTML in their system. -
Re:Perhaps It Belongs in the OS
That's one of the best reasons to use something like Yahoo instead of a separate email client.
But if you're running Internet Explorer, you're still not safe, look at this -
Yahoo is ignoring it, I guess that means SBC too!!Posted this recently to SBC, waiting for a response from them:
according to published information, Yahoo is not responding to the report of a flaw in e-mail filtering software for Yahoo Inc. Web-based e-mail services that could result in the theft of login and password information; the disclosure of message contents in the user's mailbox and contact file; and the exploitation of the user's machine by an outside agent.
What is SBC doing to resolve this serious vulnerability that your customers are exposed to as a result of this serious flaw on yahoo's part.
We, your customers, never had the opportunity to choose whether expose ourselves to yahoo, their advertising and this vulnerability.
I would appreciate some assurance that this severe vulnerability is being fixed.
see: E-Week article
and:Source report of vulnerability -
Re:Works only in IE5, though
Not so!
http://www.greymagic.com/security/advisories/gm005 -mc/inject.asp e.g. the test case, 'injects' my IE6 on fully patched Win2k.
-
Re:phew...
only works in IE5 though...
Well, that is what the article says, but the proof of concept page also works in IE 6.0 (6.0.2800.1106)
As it happens, provoked by receiving he Netsky virus embedded in an html email in Outlook that attempted to launch via an iframe, I happened to download Spybot Search and Destroy.
Using Spybot Search & Destroy, I found out about another Grey Magic discovered vulnerability, Executing arbitrary commands without Active Scripting or ActiveX. I also discovered that I'd apparently had an Alexa phone-home browser extension installed as a "Browser Helper Object" in IE, god knows for how long.
I've been using Mozilla FireWhatever for quite sometime, eschewing Internet Explorer except for those sites that don't work with IE or for testing my own sites in IE. But clearly, even a careful user with an up-to-date copy of IE and a firewall, isn't safe, principally because rather than concentrate on security and getting what they already have working securely, Microsoft prefers to pile on ever-accumulating layers of non-essential crap like HTML-TIME
I've no idea why someone thought that HTML-TIME, ostensibly for adding "timing and media synchronization support" to HTMl, required the ability to arbitrarily re-write pages. But clearly it's nothing that's desirable in an email.
My course is clear at this point: after repeated attempts, Microsoft still can't get it right, still cannot write a browser that's anywhere near secure. Crap like "HTML + TIME" is NOT worth the risks it brings with it -- especially when the risks are borne by the end-user in order to make life easier for (generally commercial) web site developers. Boycott IE, and boycott sites that only work in IE -- even if -- especially if, they use Microsoft extensions like "HTML + TIME". -
Re:phew...
only works in IE5 though...
Well, that is what the article says, but the proof of concept page also works in IE 6.0 (6.0.2800.1106)
As it happens, provoked by receiving he Netsky virus embedded in an html email in Outlook that attempted to launch via an iframe, I happened to download Spybot Search and Destroy.
Using Spybot Search & Destroy, I found out about another Grey Magic discovered vulnerability, Executing arbitrary commands without Active Scripting or ActiveX. I also discovered that I'd apparently had an Alexa phone-home browser extension installed as a "Browser Helper Object" in IE, god knows for how long.
I've been using Mozilla FireWhatever for quite sometime, eschewing Internet Explorer except for those sites that don't work with IE or for testing my own sites in IE. But clearly, even a careful user with an up-to-date copy of IE and a firewall, isn't safe, principally because rather than concentrate on security and getting what they already have working securely, Microsoft prefers to pile on ever-accumulating layers of non-essential crap like HTML-TIME
I've no idea why someone thought that HTML-TIME, ostensibly for adding "timing and media synchronization support" to HTMl, required the ability to arbitrarily re-write pages. But clearly it's nothing that's desirable in an email.
My course is clear at this point: after repeated attempts, Microsoft still can't get it right, still cannot write a browser that's anywhere near secure. Crap like "HTML + TIME" is NOT worth the risks it brings with it -- especially when the risks are borne by the end-user in order to make life easier for (generally commercial) web site developers. Boycott IE, and boycott sites that only work in IE -- even if -- especially if, they use Microsoft extensions like "HTML + TIME". -
Re:alternatives
as you can see from their demo page it's not limited to yahoo.
people are always picking on the big guys. -
More details for those interested
Tried submitting this a couple of times since yesterday but the submission system seems to have picked up a few bugs of its own where it says "Thanks for the submission" but nothing shows up in the queue. Here are the details...
Yahoo, Hotmail Users Vulnerable to XSS PC Attack
Both Yahoo Web e-mail and Microsoft Hotmail are vulnerable to an Internet Explorer cross-site scripting (XSS) attack that lets malicious users run local code, according to Israel's GreyMagic security consultants (proof of concept). Possible consequences range from theft of login and password to a remote takeover of the compromised machine. Reports indicate that Microsoft has patched the hole but Yahoo has yet to solve the problem. The vulnerability presumably affects Windows PC-based versions of Internet Explorer only. Some people might want to read this developerWorks article on how to prevent cross-site scripting and protect oneself, mentioned last month on Slashdot. More coverage at InternetNews and The Register.
-
More details for those interested
Tried submitting this a couple of times since yesterday but the submission system seems to have picked up a few bugs of its own where it says "Thanks for the submission" but nothing shows up in the queue. Here are the details...
Yahoo, Hotmail Users Vulnerable to XSS PC Attack
Both Yahoo Web e-mail and Microsoft Hotmail are vulnerable to an Internet Explorer cross-site scripting (XSS) attack that lets malicious users run local code, according to Israel's GreyMagic security consultants (proof of concept). Possible consequences range from theft of login and password to a remote takeover of the compromised machine. Reports indicate that Microsoft has patched the hole but Yahoo has yet to solve the problem. The vulnerability presumably affects Windows PC-based versions of Internet Explorer only. Some people might want to read this developerWorks article on how to prevent cross-site scripting and protect oneself, mentioned last month on Slashdot. More coverage at InternetNews and The Register.
-
Re:What major changes?
I use Opera a lot and usually find that it is faster than IE (ive never seen IE beat Opera for speed) and I find that Opera is a lot more usable since I like to use keyboard shortcuts (love the Ctrl+Shift+Enter to open a background tab) . And I was trying to get some statistics on how Opera is faster and found this and then this I have no idea what the first one means. The second one is not technical enough. Wonder if this means Opera renders slower but due to caching and other tricks becomes faster?
I also tried opening a huge html (Lot of random text with html tags at bottom and top) files right now, sure enough Opera did it faster ??? -
Microsoft's endemic security failure.The endemic failure of Microsoft toward the security of it's own products, services and customers is reason enough to bring the use of Windows2003 server in mission-critical tasks into question.
For example, Microsoft was notified of the issues, concerning only Microsoft implementation of its JVM, on September 2nd 2002 and after SEVEN MONTHS on April 9th 2003, Microsoft have issued an update to fix the problem.
Such a delay with such a serious vulnerability is so abysmal that it borders on the absurd.
Quality and security are measures which only mean something when compared relatively to another.
There is no absolutely secure, therefore you must expect, that once a vulnerability is made known to the vendor, the vendor should do their utmost to close the Window of Exposure ( http://www.counterpane.com/window.html ) as soon as possible.
For example, with the lastest SAMBA vulnerability, once notified, the SAMBA developer owned up to the mistake and the SAMBA project released a patch within 48 hours. Within aother 24hrs, redhat had already backported the patch into their distributions RPMs. Similarly any major security issues in Mozilla and Netscape browser are also fixed and updateable within a couple of days
Meanwhile, there are currently 13 KNOWN unpatched vulnerabilities in Microsoft's Internet Explorer ( http://www.pivx.com/larholm/unpatched/ ).
Some DANGEROUSLY EXPLOITABLE had not been fixed in over a year ( http://security.greymagic.com/adv/gm002-ie/ ). That Microsoft has not rewritten the scripting system embedded with IE so that it is sandboxed by default is bad enough, but to have such major unpatched vulnerabilities exposed for months is abysmal.
Other inherent vulnerabilities, such as the Shatter attack ( http://security.tombom.co.uk/moreshatter.html ), Microsoft has known about since 1994!
Even if the API/call flaw is inherently unfixable, that is plenty of time for Microsoft to implement a safer methord/systemcall/API, adapt it's own applications to use the safer methord and depreciate the unsafe API.
It also appears that Microsoft 's own implementation of SMB is vulnerable and Microsoft has known about it for over eight years ( http://developers.slashdot.org/comments.pl?sid=599 60&cid=5681769 ), but Microsoft either choose not to, or cannot fix the problem themselves.
Microsoft is clearly not closing the vulnerabilities they are aware that exist in their products and services.
A year after after Bill Gate's Email promoting securtiy over functionality, Microsoft by choice, remains neither secure or trustworthy.
Microsoft's attitude towards the security of it's products, service and customers is abysmal.
From Jason Coombs' A response to Bruce Schneier on MS patch management and Sapphire ( http://www.securityfocus.com/archive/1/315158 )Microsoft Baseline Security Analyzer (MBSA) and Microsoft's version of HFNetChk both failed to detect the presence of the well-known vulnerability in SQL Server exploited by Sapphire, which is one of the reasons so many admins (both inside and outside MS) had failed to install the necessary hotfix. MBSA and HFNetChk are Microsoft's official patch status verification tools meant to be used by all owners of Windows server boxes
-
Did Schmidt resign due to Microsoft's failure?The endemic failure of Microsoft toward the security of it's own products, services and customers is reason enough to bring Howard Schmidt's leadership in the area of cyber-security into question.
For example, Microsoft was notified of the issues, concerning only Microsoft implementation of its JVM, on September 2nd 2002 and after SEVEN MONTHS on April 9th 2003, Microsoft have issued an update to fix the problem.
Such a delay with such a serious vulnerability is so abysmal that it borders on the absurd.
Quality and security are measures which only mean something when compared relatively to another.
There is no absolutely secure, therefore you must expect, that once a vulnerability is made known to the vendor, the vendor should do their utmost to close the Window of Exposure ( http://www.counterpane.com/window.html ) as soon as possible.
For example, with the lastest SAMBA vulnerability, once notified, the SAMBA developer owned up to the mistake and the SAMBA project released a patch within 48 hours. Within aother 24hrs, redhat had already backported the patch into their distributions RPMs. Similarly any major security issues in Mozilla and Netscape browser are also fixed and updateable within a couple of days
Meanwhile, there are currently 13 KNOWN unpatched vulnerabilities in Microsoft's Internet Explorer ( http://www.pivx.com/larholm/unpatched/ ).
Some DANGEROUSLY EXPLOITABLE have not been fixed in over a year ( http://security.greymagic.com/adv/gm002-ie/ ). That Microsoft has not rewritten the scripting system embedded with IE so that it is sandboxed by default is bad enough, but to have such major unpatched vulnerabilities exposed for months is abysmal.
Other inherent vulnerabilities, such as the Shatter attack ( http://security.tombom.co.uk/moreshatter.html ), Microsoft has known about since 1994!
Even if the API/call flaw is inherently unfixable, that is plenty of time for Microsoft to implement a safer methord/systemcall/API, adapt it's own applications to use the safer methord and depreciate the unsafe API.
It also appears that Microsoft 's own implementation of SMB is vulnerable and Microsoft has known about it for over eight years ( http://developers.slashdot.org/comments.pl?sid=599 60&cid=5681769 ), but Microsoft either choose not to, or cannot fix the problem themselves.
Microsoft is clearly not closing the vulnerabilities they are aware that exist in their products and services.
A year after after Bill Gate's Email promoting securtiy over functionality, Microsoft by choice, remains neither secure or trustworthy.
Microsoft's attitude towards the security of it's products, service and customers is abysmal.
From Jason Coombs' A response to Bruce Schneier on MS patch management and Sapphire ( http://www.securityfocus.com/archive/1/315158 )Microsoft Baseline Security Analyzer (MBSA) and Microsoft's version of HFNetChk both failed to detect the presence of the well-known vulnerability in SQL Server exploited by Sapphire, which is one of the reasons so many admins (both inside and outside MS) had failed to install the necessary hotfix. MBSA and HFNetChk are Microsoft's official patch status verification tools meant to be used by all owners of Windows server boxes
-
Re:Quick Turnaround
Who's the idiot? The discoverers DID comply, they notified Opera last Friday and published the exploits only yesterday.
-
Re:Opera
Ironic that you should be so emphatic about Opera on the same day that five new vulnerabilities are discovered in it.
Long live Mozilla \o/
-
Bzzt, Wrong, Try AgainWinXP, IE6, SP1, Baseline Security Advisor showing no issues.
http://security.greymagic.com/misc/globalDgArg/ - I can display arbitrary files from my hard drive in the javascript dialog. Other exploits don't seem to work.
http://sec.greymagic.com/adv/gm012-ie/vobjcache.a
s p - Clipboard exploit works, others fail.These are two near the top of the list that work, while they aren't remote code exploits they illustrate continuing security problems.
-
Bzzt, Wrong, Try AgainWinXP, IE6, SP1, Baseline Security Advisor showing no issues.
http://security.greymagic.com/misc/globalDgArg/ - I can display arbitrary files from my hard drive in the javascript dialog. Other exploits don't seem to work.
http://sec.greymagic.com/adv/gm012-ie/vobjcache.a
s p - Clipboard exploit works, others fail.These are two near the top of the list that work, while they aren't remote code exploits they illustrate continuing security problems.
-
IE testedIf you think you're safe sticking with IE, you should try taking the Anonymizer.com Snoop Test.
I did. With IE. Here is what happened:
1. Your IP address
It picked up my IP address. Fair enough. I'm not running through an anonymous proxy.
2. Hidden tracking files (cookies)
It couldn't list any of my cookies.
3. Exposed Clipboard
This was a little scary. It picked up what was in my clipboard and displayed it.
4. Hack and Exploit Vulnerability
Sophos immediately popped up a message telling me it had detected 'Troj/Codebase-A' in my temporary internet files. A window appeared with some HTML telling me that file:///c:/winnt/win.ini had moved. But nothing else.
I couldn't open the click here links, the links below that didn't work and MSN wasn't giving out my contacts.
5. Browser and Operating System
Big deal. It got them from the HTTP_USERAGENT. I'm not totally paranoid - I don't mind people knowing what browser I use.
6. Geographical location
Middlesex, England, GBR. Well, 2 out of 3 isn't bad but not exactly something to get worried about. Wonder why it thought Middlesex though?
7. Your network
This took the piss. It's just a traceroute from them to the IP address that they determined in the first test. It's not much of a big deal.
I run Internet Explorer 5.50.4919.2200. Sure, I don't doubt that IE has it's problems - but the stuff that Anonymiser is shreaking about is generally not that big a deal and flagged only so they can sell their products.
(mind you the clipboard one was a little spooky)
-
And while where at it...
Perhaps it's the same exploits mentioned in the linked Slashdot article, and in that case pardon my ignorance. If not, I haven't seen these nine security holes talked about at too many places. Why I don't know. They are certainly vicious.
However, I am getting a little tired at all the MS bashing on Slashdot. It has been said before, but do we really need to have a story posted each time an Outlook/Explorer security breach, no matter how insignificant, is made public? -
Re:Record Time Repeat
Great to see this getting modded up - it's like going to Microsoft and explaining that you really welcome the new license changes, and that the many hidden features are a real boon to your productivity.
-
Let's see..
Microsoft Internet Explorer: 17 unpatched vulnerabilities.
Netscape/Mozilla: 1 patched vulnerability.
Opera: 1 unpatched vulnerability.
See http://sec.greymagic.com/adv/ -
Let's see..
Microsoft Internet Explorer: 17 unpatched vulnerabilities.
Netscape/Mozilla: 1 patched vulnerability.
Opera: 1 unpatched vulnerability.
See http://sec.greymagic.com/adv/ -
Re:But...
-
Re:The funny thing here is...Why don't you post the URL to the people who discovered the hole?
http://sec.greymagic.com/adv/gm001-op/
You could also quote this from their report:
Opera was informed on 15 May 2002 and confirmed our findings. A day later, in the evening of 16 May 2002, Opera informed us that the vulnerability was fixed and committed to Opera's own version control system.
On 27 May 2002, Opera released version 6.03, which addressed this issue.
Opera has been extremely responsive and quick to understand and patch this vulnerability. They have shown that they truly do take security seriously.
The hole was fixed very quickly after it was discovered. Your comment is a bit out of place, unless you are really trying to say "all software in existence is lacking on the security front". -
One thing I'd like to know...
What's the status of this vulnerability?
Basically, it allows reading any given local file and browsing through the local folder tree in Mozilla -- the site mentions 1.0RC1 was tested and affected, it hasn't been updated since then.
It was discovered on the 30th of March, Netscape was informed on the 24th of April, and hadn't acknowledged the security researchers' notification within six days, so it was made public. (Cue flame war about MS's security woes...)
Pretty nasty... anyone with the new build care to test it? -
Re:The difference is...
Congrats on running Mozilla.. However that doesn't mean you are Bug Free
Actually, I use both Mozilla and IE, but these stories that are being posted on Slashdot are just silly. You are mad if they do patch. You are mad if they don't patch. Make up your mind Slashdotters! -
Netscape not secure
-
Re:Yep - definitely
Regardless of which browser anyone chooses to use, I'd hope they're more dilligent about updgrading and/or patching than the people in this article were. All browsers have weaknesses and vulnerabilities, both known and unknown.
A good point, especially as NS6/Mozilla had a very similar security hole themselves, which is why it was FORBIDDEN on the FreeBSD ports tree until they put in an unofficial patch (they're very good at that - icecast, for example, is currently in the same situation and pine has a series of warnings when you try to compile). If you read bugtraq, like I do, you'd also have seen a buffer overflow in the IRC component.
It's very hard to be totally secure, and it's not really fair to denigrate Microsoft when a patch has available for months (viz CodeRed/Nimda), or RedHat when people are still using 5.2. -
Re:Yep - definitely
Well, since you switched to Mozilla from IE, you might want to read this.
-
Re:Less buggy browser?
http://sec.greymagic.com/adv/
Open IE Advisories: 7 (and one appendix, whatever...)
Patched IE Advisories: 1
Open Mozilla Advisories: 0
Patched Mozilla Advisories: 1
I believe he said LESS buggy. -
GreyMagic posts four vulnerabilitiesAnd on the same day as the Post article, GreyMagic posts four security alerts on Office Web Components in IE:
Scripting for the scriptless with OWC in IE.
Reading local files with OWC in IE.
-
GreyMagic posts four vulnerabilitiesAnd on the same day as the Post article, GreyMagic posts four security alerts on Office Web Components in IE:
Scripting for the scriptless with OWC in IE.
Reading local files with OWC in IE.
-
GreyMagic posts four vulnerabilitiesAnd on the same day as the Post article, GreyMagic posts four security alerts on Office Web Components in IE:
Scripting for the scriptless with OWC in IE.
Reading local files with OWC in IE.
-
GreyMagic posts four vulnerabilitiesAnd on the same day as the Post article, GreyMagic posts four security alerts on Office Web Components in IE:
Scripting for the scriptless with OWC in IE.
Reading local files with OWC in IE.
-
Re:Pop up download
That won't necessarily help you. Check out http://security.greymagic.com/adv/gm001-ie for a load of what can be done to Windows IE...
*YES* with Java turned *OFF*
*YES* with scripting turned *OFF*
*YES* with Active-X turned *OFF*
This particular exploit also applies to Outlook Express and Outlook. Scarey.
I'm not repeating myself; I'm an X Window user; I'm an ex-Windows user. -
new windows feature!!
Bill Gates new security consciounsce Microsoft has developed a new feature that allows you to let others run your local executables remotely...yet again!
Click here [greymagic.com] to see this added functionality in action! Just type in the path to a local executable, and watch the fun!
Also check out this M$ "fix" -
New Microsoft WIndows feature!
Bill Gates new security consciounsce Microsoft has developed a new feature that allows you to let others run your local executables remotely...yet again!
Click here to see this added functionality in action! Just type in the path to a local executable, and watch the fun!
