Slashdot Mirror
New IE Bug Hides Real Site Address
Norman at Davis writes "ZDNet is running a story on a new security flaw in Microsoft's Internet Explorer which could let hackers use a technique to display a false Web address on a fake site according to an advisory from the Danish security company Secunia. The Danes report that 'the vulnerability is caused due to an input validation error, which can be exploited by including the "%01" URL encoded representation after the username and right before the "@" character in an URL.' PC World reports that 'Microsoft says it is investigating reports of the vulnerability. When that inquiry is complete, the company will take whatever steps it deems necessary, such as issuing a new patch, a spokesperson says.' And for good measure, here's what Google news is covering on it right now."
In case anyone is wondering, this doesn't appear to affect IE on mac. When I click the test exploit link on http://www.zapthedingbat.com/security/ex01/vun1.ht m it simply turns into http://www.microsoft.com%01@zapthedingbat.com/secu rity/ex01/vun2.htm
More importantly why aren't banking sites suggesting users use Moz? Some could argue that if they knew this in advance they are liable for being negligent, like leaving the vault door open.
It would only be fair to see a link to Moz and Opera on banking sites and suggesting people use these browsers for maximum privacy and security.
It would be possible (trivial?) to put a feature in our favourite open source browser to give a security warning when you visit such a URL. Just something that tells you about the possibility that you're at a site different to the one you think you're at. It would just need to ensure that the actual domain is made obvious. eg.
You would just need to search for 'www.' or one of the TLDs in the part of the URL before the @ sign.
Why is anything anything?
Ahem. Mozilla *is* strict, plain and simple, but only if you use the proper doctype definition. If you don't you probably don't care about "strict" rendering anyway.
I don't use Opera, but I suspect the same is true. If it isn't, then why would you want a browser that intentionally misrenders pages for which the author did not clearly state a doctype? Aren't you just hurting yourself?
ideal:
doctype def == strict or "standards" rendering
no doctype == loose
This way you get to see most sites on the web, and those authors who have taken the care to craft their pages properly get their pages rendered in the fashion in which they intended.
*everything* is Orwellian to cats.
It's not a mozilla/ie issue, it's a social issue. Mozilla is likely to have its share of egregious security holes (but probably not as many). Even if patches are released within hours of the discovery of a bug, the likelihood that joe user will install the patch is slim. We can all hoot and holler-- install Mozilla! but if Mozilla gained majority market share, people would still fail to take the time to patch their systems, and it's inevitable that moz security bugs will be discovered too.
So long, and thanks for all the Phish
Does IE know its being tricked, or does it know the real site and just display the wrong one?
:/
I'm wondering if some shady types could use this exploit to get your cookies for any site of their choosing.. that just might be a slight problem
Are you sure? I tested Mozilla using this page and it worked correctly. I tested the same page using IE and the url came up "www.microsoft.com".
Yes, I know you're a troll. But I figured anybody who might be fooled by your outstanding writing should be able to click on a link and test their own browsers.
Also, I should note that Opera actually gave me a pop-up warning that I was sending a username to the site - the username www.microsoft.com - and after I agreed to do that I got a page with the correct url. Has anybody else tested this on other browsers?
I really hate signatures, but go to my website.
Have you tried using the Mozilla Zip file version, as opposed to the installer version? Essentially, install goes like:
I used it to put Moz on the Windows Ex-Privacy machines at my uni with just my user account. Naturally, you can't change the "System Access Preferences" or whatever it's called since it'd be completely assinine for anyone but Administrator to let the user choose what browser they prefer to use....
Anti-Trust Penalties my ass.
--
Given enough personal experience, all stereotypes are shallow.
Create a local document:
Note that thanks to Slashdot the code is munged. Remember to remove the extra-Slashdot-added spaces.
Open this up in Internet Explorer and you'll see the text, with the "%01" character helpfully encoded into the string for you. Copy this string into another document:
Note that in this example, the encoded "%01" has been stripped out by Slashdot. Your copy & pasted string will include this character (It may appear as an empty "Box" symbol)
Save & open the file in Internet Explorer. Surprise!
But wait! There's more! If the user hovers over the link they'll see a funny looking URL in the status bar. We can fix that, though. Edit your file and add the "%00" to that URL E.g.
Again, the encoded "%01" has been stripped by Slashdot. Ensure that you add the "%00" after the encoded "%01" or this won't work. Now save the file again, and re-open it in IE. Now where does that link go?
Feeling lucky, punk?