New IE Malware Captures Passwords Ahead Of SSL

Ken Treis writes "SANS Internet Storm Center is reporting on a new strain of IE Malware. This one targets bank customers, which in itself is nothing new. But the catch is in the way it does it: it installs a Browser Help Object (BHO) that can capture login information before it is encrypted, and 'watches for HTTPS (secure) access to URLs of several dozen banking and financial sites in multiple countries.'."

Comments

That's a BOGUS PHONE NUMBER! RTFDetails

[abb3w]

And the phone number's bososity is both noted at the end of the complete write up linked to at the end of the article, and something which Google would tell you, if you thought to look.

Netscape is to blame

[bonch]

You complain about "lack of competition," but neglect to mention that Netscape fucking sucked by version 4. What's the point of bitching about competition if there wasn't actually any good competition? IE won out because it was the better browser.

Re:Because it isn't so clear cut

[Moraelin]

And the next thing you know, you also have to answer stuff like:

- Look, that nifty web-based backgammon game no longer works since you installed that Mozilla crap. (It used ActiveX, so no wonder.)

- Look, the site I uploaded my digital photos to no longer works. (It used client-side VB Script.)

- Look, the forum I was talking to my friends on shows awfully wrong, and some bits are even missing. (It was designed for IE only.)

- Look, that other little game on a site doesn't work any more either. (It was an applet written for MS's quirky Java implementation.)

- Look, my browser just crashes on that other site I used to visit. (Both Opera and Mozilla do occasionally crash. Much as if you listen to the /. crowd it's only MS that writes buggy crap ever.)

- Look, I can't even do online banking any more. (Another site made just for IE.)

- Look, this other site is completely broken and no longer reacts to my clicking on links. (At least the Firefox 0.8 I use at work is idiotic enough to think that some popups I've clicked a link for, are still "unwanted".)

And so on. Basically giving someone Mozilla or Opera as a 100% replacement for IE, is like giving them a truck as a 100% replacement for their auto. It just isn't that.

We geeks love to put up with crappy browsers, software/hardware incompatibilities, and recompiling 10 libraries just to make something work. Feels macho.

Joe Average doesn't. He doesn't really care about "MS is evil" or technicalities "look, Opera has these 10 annoying features that you'll probably disable anyway, so it's technically better than IE." (E.g., gestures.) The browser is for him like the TV set: just a window to see the web through. If the new "superior" TV set can't show the stations Joe wants to see, Joe will go back to the old "inferior" one. Same for IE.

Just in case you folks were wondering why do those "idiot" users go back to IE. Maybe because they're not the idiots there. Maybe because it actually works. Just some wild ideas for when you're bored, I guess.

too bad.

[twitter]

On previous installations of various Linux distros, the first step I've taken is to download the various patches and updates. Same procedure with Windows.

Too bad you don't just use a net install to begin with. It's very different from Windoze, which always comes from an old CD.

I'm typing this using Firefox 0.9 under XP. I don't particularly like Windows, but there are other people who need to use this machine.

Too bad for you and them. You could be running something nice like KDE 3.2.