Slashdot Mirror
New IE Malware Captures Passwords Ahead Of SSL
Ken Treis writes "SANS Internet Storm Center is reporting on a new strain of IE Malware. This one targets bank customers, which in itself is nothing new. But the catch is in the way it does it: it installs a Browser Help Object (BHO) that can capture login information before it is encrypted, and 'watches for HTTPS (secure) access to URLs of several dozen banking and financial sites in multiple countries.'."
Cue the "Gee I'm glad I use FireFox on Linux" posts.
"They redundantly repeated themselves over and over again incessantly without end ad infinitum" -- ibid.
I'm simply stunned...where I work security is #1 and availability is #2. Judging by their output...it must be very different working at MS.
Blar.
Is why I transmit all of my passwords in plain text... not very secure, but a lot less obvious then all of these complicated 'security' or 'encryption' methods.
Help Brendan pay off his student loans
This is why I do all my online banking using Gopher.
This isn't Malware, this is advertising for Apple. THIS is why I buy Macintoshes.
What's a browser? Is that like Internet Explorer? But why do I need another one when I already have Internet Explorer? Don't I have to use Internet Explorer to connect to the internet?
By reading this you acknowledge that you have read it.
You know you really have something going for you when a single application in your product line helps defines it own genre of exploits:
Alito: A vote for Alito is a punch in the eye to put that bitch back in her place!
From the article:
It is actually a 27648 byte Win32 executable that has been compressed using the Open Source executable compressor UPX.
Cue the FUD saying "look I told you Open Source was inherently less secure!"
Download my free songs!
"Why would you fsck with SSL..."
Because there are no files to check, just packets?
"Derp de derp."
less chance your inheritance is going to disappear from her bank account.
Or if there is currently little or no inheritance... have her use IE in the hopes that some how her bank account will get extra funds due to the exploit thus creating or increasing your possible inheritance.
Help Brendan pay off his student loans
(Score: -1, Redundant)
sulli
RTFJ.
When will us Linux users finally get to experience all of these exploits and viruses? It looks like Windows users have all the fun. :-)
I'm not a religious person... but I will now attempt to pray...
God, it's me, Anonymous Coward, I beg you, have the l33t hax0rs of the world unite to develop exploits and hacks against Linux and Firefox so that open source zealots can no longer scream about how secure their software is. Any competent person or deity (ie you) knows that there are potential exploits in both, but most have not been found because most do not look as hard as is done with Windows.
If you do this for me... I promise to sell my soul to your minions in Redmond and banish any Linux or Open Source related product from my home from now until eternity.
Amen
Unfortunatly this describes 90% of people out there. The only way I can think of to overcome that kind of pervasive ignorace is a public service campaign like the anti-drug campaigns.
[joke]
"This is your computer.. this is your computer on Internet Explorer"
-or-
"Friends don't let Friends use Internet Explorer"
-or-
"Just say No to Internet Explorer"
[/joke]
Seriously, there needs to be a TV campaign or even public service banners on high traffic sites like google or CNN.
After last week's CERT advisory, there should only be a handful of them left.
a) Threaten to never support her computer again
b) Hide the IE shortcuts
c) Change the IE homepage to say, in big letters, "YOU'RE NOT SUPPOSED TO BE USING THIS NOW GET OUT AND START FIREFOX"
d) If you have Zonealarm on her computer, set it so IE has no Internet access
e) Use IE's Content Advisor to block all Web sites
f) I could go on and on
Does another exploit change the .gif name to .exe or attempt to unzip the .gif file? If not, why does IE allow .gif's to be installed?!
Clearly this is a programming error. IE only allows destructive executables to be installed without permission, rather than harmless image files. Rest assured that the programmers who let this "feature" slip through will be dealt with.
" The question should be, "What fancy-ass special feature does Firefox NOT have."
That question inhibits Firefox's widespread adoption.
"Derp de derp."
Gates says MS is getting faster fixing security holes.
I have verified this. Microsoft technical support now tells me to reboot my machine instantly, rather than asking what the problem is first.
what about the "too fuckin cumbersome to install a plugin on" line ? because it sure fits firefox nicely
My passwords are just little black dots when I type them.
------ How can making people laugh lead to bad karma?
We'll just add the following Javascript into websites:
//
var userAgent = navigator.userAgent;
var MSIEIndex = userAgent.indexOf("MSIE");
if (userAgent.indexOf("Win") != -1 &&
userAgent.indexOf("MSIE") != -1 &&
userAgent.substring((MSIEIndex + 5),(MSIEIndex + 8)) >= 5.5)
window.location.replace("IE_BAD.htm");
and let those still using IE suffer.
---
IMHO, of course.
May the SOURCE be with you.
I really must stop watching Comedy Central.
I don't want knowledge. I want certainty. - Law, David Bowie
California is one weird place!
GTRacer
- Needs a new fence
Defending IP by destroying access to it? That makes sense, RIAA/MPAA. Go to the corner until you can play nice!
I do not think it means what you think it means. OpenBSD has a negligible security record. Apache has a negligible security record. IE's security record is about as gligible as it can get without torch-bearing masses tearing down Microsoft's doors in search of the Developers! Developers! Developers!
Dewey, what part of this looks like authorities should be involved?
they are right up the street from me
i can handle it in a few minutes