Slashdot Mirror
New URL Spoofing Bug in Pre-SP2 IE
An anonymous reader writes "According to Netcraft a new security flaw has been found in Microsoft Internet Explorer which makes it possible to spoof a URL with just some simple HTML code, by enclosing two URLs and a table within a single href tag. The user will be sent to one site, but the status bar will show a fake URL. The bug apparently affects IE and Outlook Express up to but not including SP2. Firefox and Konqueror seem unaffected."
Comment removed based on user account deletion
This exploit also affects Safari 1.2.3 on Panther.
Patch available here
Bug in outdated software.
Why is this news?
I just know I saw this somewhere about an hour or two ago, and I'm pretty sure I saw it here on /., but I don't remember where. Oh well...
Old/10 (It's like walking with the dinosaurs! And Jesus is riding them! And the Dell Dude got arrested too! whoamg!)
'Yes, firefox is indeed greater than women. Can women block pops up for you? No. Can Firefox show you naked women? Yes.'
How big is NS4's market share? .5% maybe? IE? 90%+? It's also incredibly easy to do, can't be disabled by turning off JavaScript and there's no patch unless you're an XP user in which case you have to upgrade the whole OS.
Worryingly, Safari is also fooled by the bug - the status bar shows http://www.microsoft.com/ before you click on the link, but the address bar in the resulting window correctly shows http://www.google.com/.
"The flaw affects versions of IE up to 6.0.2800.1106 - which includes systems that haven't yet installed Windows XP SP2, but are current on all other critical updates from Windows Update - as well as the Safari browser for Macs."
Is it just me, or is that a typo? My version of Safari (1.2.3 v125.9) seems to handle their sample malformed tag just fine, displaying www.google.com as it should. Can anyone confirm or deny whether Safari is affected by this problem?
As usual on Slashot, truth takes a back seat to MS bashing
Actually, more bugs are being found in Firefox than in IE right now. BUT, the firefox source is available, so people can look through it for bugs, AND Mozilla is giving away money for people who find security bugs, AND startup securty companies are trying to make a name for themselves by finding securtiy holes in Firefox.
I still say definately switch away from IE, but realize that other browsers have security holes too.
What does this mean for Windows 2000 users?
Doesnt work for me. IE6 with Windows XP SP2. The status bar shows "www.google.com" and that's where it sends me.
Whoever said this affects all versions of IE clearly jumped the gun and needs to re-evaluate. When will the apology and retraction be issued? Will it make the front page on Slashdot?
http://graha.ms/iesploit.html
Doesn't seem like anything that couldn't be done with javascript.
Windows 2000 is still supported and there is no available fix for it other than installing a new browser. Some applications still require you to use IE, though.
Sure one can argue that one should not use IE, but this is not a terribly good reason or interesting news. It should be quite apparent to IE users however that if they haven't yet installed SP2 you need to do so right away. Running without it is just stupid.
New URL Spoofing Bug in Pre-SP2 IE
Pre-SP2, you know, versions prior to SP2?
You said this Slashdot story was inaccurate. When will the apology and retraction be issued? Will it make this comment thread?
Just tested it with Opera 7.54 for Linux ... if you mouseover the actual text, "google.com" shows in the status bar, but if you position your cursor just exactly so that it's kinda over the URL, but not over any of the text, then you can get "microsoft.com" to show.
... can't you just use Javascript to rewrite the status bar anyway?
But I'm kind of confused as to why this is a big deal
Dlugar
Computer Go: Writing Software to Play the Ancient Game of Go
IIRC, IE is the only browser that the US-CERT has issued a statement not to use due to security concerns.
What really worries me is how many U.S. Government agencies and defence contractors still use IE as their standard browser.
It doesn't need to be done with Javascript. A lot of people disable Javascript to make themselves safer. Mozilla/Firefox of course lets you disable Javascript that changes the status bar text.
Firefox and Konqueror seem unaffected."
That's good to know! In other news, Oracle is unaffeced, as is the price of tea in China!
..it appears that a bug was found in Linux 0.1.
And while we're at it, I've heard that a new bug was found in Apache 1.0!
I don't respond to AC's.
But your best bet would be to either update or switch to an unaffected browser.
What's worse? IE being vulnerable to spoofed URLs because of malformed HTML, or Firefox crashing because of the same thing?
Gnash Gnash Gnash
FF, reformating the world, one windows box at a time.
Most people i know have no clue about disabling javascript - but they are also the sort that wouldn't thing to look in the status bar.
Do you really think he uses IE?
Just tried it myself on Safari v125.9 on 10.3.5; unfortunately the spoof worked.
Hovering over the actual link showed microsoft.com in the status bar, but clicking it did indeed go to google.
However, I can click outside the link on the same line (thanks to the table spanning the entire width of the article box), and it'll go to microsoft.com as indicated in the status bar when howevering over the line.
Actually, I have to say that installing SP2 was not a good idea, atleast in my experience. I installed it on one of my computer systems, and it didn't boot. This was just last week, so don't say I probably installed it before it was safe. I had to spend all day installing everything again and of course spend atleast 2 hours of that just getting the damn Windows Updates to make my fresh install current. I will never install SP2 again. Though, I do use firefox, and have been very happy with it because since I've started using it, I've had like no problems with the windows operating system at all.
I need a sig.
Last january, Microsoft Advised to Type in URLs Rather than Click. You have been warned early, consider yourself lucky !
<table>t .com</td></tr></table></a>
<tr><td>
<a href="http://www.google.com/">http://www.microsof
Before you mod me funny, think, perhaps I was insightfully funny?
SP2 for what? IE 6? I'm already on SP4 for my Win 2K boxes. Or do we have to all buy XP and apply SP2 for us to brwose safely?
How come Slashdot never gets Slashdotted?
I agree. I have visited this site for over 4 years now and this place has continued to go downhill. It's not just the double headlines, but trolling people with reasonable counter opinions. I think this site started out as a good idea and has done nothing since then but fall apart. Maybe they will turn control over to real objective minds with real-world IT experience.
Too bad the original goatse.cx is down, that could be fun. "Hey Jim, check that financial report!"... At least we have mirrors...
When my father installed SP2 at work (even though I told him not to) His whole system crashed, and had to get an entriely new harddrive, and he had to BUY windows XP again, they wouldn't refund him! Since installing firefox, 0 spyware, 0 adware, 0 viruses, 100% satisfaction.
One of the reasons why I have 'Friendly URLs' on in IE. Anybody know if this still works with Friendly URLs on?
I'm using IE SP2 so thats why I'm asking...
For a shortcut for Google I see 'Shortcut to http://www.google.com/' rather than just 'http://www.google.com/ '
(I know when the status is changed as it will not have 'Shortcut to')
Am I posting this on slashdot?, 'cause the latest from cowboyneal says Linus joined microsoft?
uhh people have been messing with URL's and the Status Bar for ages... nothing new, move along...
I have a lot of users who despite gentle prodding, still use/need Mac IE of the classic and OSX variants. Is this susceptibility there as well?
hmm IE 6.1 on XP HE SP 1a... alleged exploit example on netcraft doesn't work in IE. I generally use firefox anyway. *shrugs* must be some automagic fix eminating from my slackware boxen, or one of the many things i've done with this boxen.
Man, that's like 3, 2-page papers!!! Better use 1.75" spacing and 1.25" margins and 14 point type.
Yeah, right.
With my SP2 system I naviagated to http://graha.ms/iesploit.html/ and hovered over the link. This is what I discovered:
If you place the mouse on the link it shows the link will take you to google as it should, but if you place the mouse just outside the link (I guess on the table border) it says microsoft. The kicker is, that when it says Microsoft, clicking the link will not do anything.
http://brandonbloom.name
Safari goes to the wrong URL too.
Just tried the demo and ended up at Google rather than where the link looked like it should go.
Damn!
I wonder how much easier browser developers' lives would have been if MS and Netscape had decided early on that invalid HTML, such as these links, would not be rendered.
A guy can dream can't he?
Konkeror on KDE 3.3.1 draws a transparent table (the one faked on the link) around the link, being both (the link and a small space outside the text link) clickable, but with different destinations. The resulting window (either google or microsoft) has no spoofed url.
Your head a splode
this is what porn sites have been doing for years, for those who want the secret here it comes
u rn false" onmouseover="top.status='http://google.com';return true" onmouseout="top.status='';return true">click here</a>
<a href="http://google.com" onclick="self.location='http://microsoft.com';ret
works on all browsers with JS capabilities by default (even webTV)
jerks who submit stories like this seem to be the only ones doing the exploiting
Why report the bug if it's been fixed?
CowboyNeal is a big dork who can't stand the fact that Microsoft rulez him.
95% of IE bugs come for table management (too much nested table and it comes up with unknown error, padding and margin, css incompliances, etc etc)
And still 87% of population uses IE 5/6. So like my roommate told me, developpers know FX is better, but we still have to be compliant with IE. Hopefully with the ad coming this may change (though with the predictions of 10% of market be end of 2005 we might design for IE for still the next decade?).
Table being disabled here, At least we cannot do it on Slashdot... and have goatse spam of a new nature.
Of Code And Men
Comment removed based on user account deletion
You might as well say that links themselves are a security risk, since a link that says "Microsoft Web Site" but really goes to goatse.cx is a dangerous spoof.
what ever happend to Gopher sites and browsers?
Was originally:
Big. Farking. Deal. :)
Haven't these dorks heard about javascript's onMouseOver? Just go to fark.com and hover over the links.
Neither works in FF, however!
Spoofing bugs are not good, and there's a lot that should be done to fix spoofing, but it's the cross-zone exploits that we really need to worry about. See, 95% of the real security holes in IE come from "security zones". And .NET is just going to embed this design flaw deeper in Windows.
I'll accept screwed up tables if they'll just back out the damn Windows-Explorer integration.
I'm running RC 1 and I see microsoft but it goes to google. But if you look at the source the HTML code is wrong anyhow. Why would you close the anchor tag outside of the table if you put the starting anchor tag in the table. Someone correct me if i'm wrong, please.
So, does this mean IE is dying? I'm confused.
I like big butts and I cannot lie.
Change the html froma href="http://www.google.com/">http://www.microsoft .com</td></tr></table></a> a href="http://www.google.com/">http://www.microsoft .com</a></td></tr></table></a> ;
<a href="http://www.microsoft.com/"><table><tr><td><
to
<a href="http://www.microsoft.com/"><table><tr><td><
(sorry, Extrans mode is breaking the last </a> for some reason there)
and you will notice the status bar says microsoft.com, and clicking it goes to microsoft.com, but middle click for a new tab, and you get google, not what the status bar says!
Morphing Software
That's nothing. *My* father installed SP2 against my recommendation, and the next day a burglar broke into his house and stole most of the silverware!
Since installing firefox, nobody has broken into his house again.
No sig
Acutally, this originally posted by Benjamin Tobias Franz to bugtraq on Oct 28th:
0 04 -10-27/2004-11-02/2
http://www.securityfocus.com/archive/1/379764/2
Thus the credit goes to Benjamin, not Netcraft.
What? Old versions of software have bugs? Even Microsoft programs? Whoa! This is like, the biggest news since, that story about what your Linux distro says about you.
From the article, "The flaw is possible because Internet Explorer has difficulty processing improperly formed HTML". If browsers had been pickier from the start, and refused to try to render improper HTML, perhaps we wouldn't see this sort of bug so often. Of course, now everyone expects to be able to view sites no matter how bad the code, so a 'correct' browser wouldn't be popular. Maybe browsers should start flagging improper HTML as a security risk; might actually get some people's attention.
Ok, hate microsoft, etc etc... but this is ridiculous. you see, previous versions of mozzila (whitch I use) have bugs too, and security flaws. report them too!
MS, W are both antithetical to security.
Why are we ever talking about this? It has already been patched.
BeauHD. Worst editor since kdawson.
When I first read "url spoofing", I immediatly thought that this was about spoofing the address displayed in the address bar. This is at least what I have always considered as url spoofing. I figure that "link spoofing" is something that is more descriptive, but knowing the slashdot community this is gonna be bashed quickly. Anyone have a definition of "url spoofing" if this even exist?
Netscape 7.2 is basically Mozilla 1.7(.1?) with AOL addons and ads.
"Actually, I have to say that installing SP2 was not a good idea, atleast in my experience. I installed it on one of my computer systems, and it didn't boot."
Yeah, same here. I installed SP2 on two computers at work last week: one works fine, the other wouldn't even boot after installing. The only choice was to uninstall SP2 and stick with SP1.
It's absolutely retarded for a company to release security fixes for a bloody _WEB BROWSER_ that require you to upgrade the entire operating system.
<a o ft .com</td></tr></table></a>
href="http://www.google.com/">http://www.micros
displaying http://www.microsoft.com in the browser, but sending the user to Google.
Is it the <table> that does it or the nested <a> tags?
If you must moderate, please moderate as irrelevent, not something bad, because I'm sure someone will find this interest
IE's ability to parse anything meant it survived the problems which caused both Opera and Firefox to crash has also made this nastiness possible...
There's mischief and malarkies but no queers or yids or darkies within this bastard's carnival, this vicious cabaret.
Though another poster claims Safari isn't affected by this, I was able to replicate the vuln in Safari 1.2.3 (v125.9). So it appears that the other posters are incorrect. Firefox is unaffected, Internet Explorer show 'http://www.microsoft.com' when the cursor has changed to the link finger but shows 'http://www.google.com' when the cursor is over the link text. Opera for Mac displays the same oddities as IE. OmniWeb for Mac also does this, however, the space in which is displays the spoofed address is only about a pixel wide. Strangely, lynx didn't seem to have much to say :)
"previous versions of mozzila (whitch I use) have bugs too, and security flaws. report them too!"
But, unlike IE, upgrading Mozzilla to fix the bugs doesn't require you to _UPGRADE YOUR ENTIRE OPERATING SYSTEM_. You see, Mozilla is written by sane people, who don't think it's a sensible idea to wire a web browser deep into the operating system.
Is something like this discovered by accident, or is some poor person sitting at a desk coding weird html all day to see what happens?
I think we are looking at this from the wrong perspective. This is not another flaw in Internet Explorer. The flaw in IE is the design from the ground up. This is just another in the long list of completely related flaws in the browser. They need to just give up on patching and rewrite the damn thing, and use Gecko as the engine ;)
Pre SP2...so if a user fails to update, it is MS's fault...so all those linux errata pages concerning root vulnerabilities, ssh, KDE, Gnome, are OK???
...
Grow up Slashdot editors!!!!
1) STOP THE FUD!
2) Try placing the same blame on exploits to linux for each flaw it has.
3) Show me that the majority of the linux users can rewrite their source code, before using the opensource argument (we all know they can't, and recfging the kernal, or compiling it again is not the same as rewriting it to fix the freaking flaw!)
4) Stop acting like politicians, spouting bullshit bashing instead of actualy saying something useful, or constructive.
5) Go whine in the corner again about the evil FOR PROFIT corp (MS). Then ask yourselves, if all the code was free, who the fuck would want to work in IT, since they couldn't make a living writing the code, setting up the networks, because it was all free...(this isn't the 23rd century StarTrek universe, people actualy have to PAY for the basic needs...). We won't even get into the mess the massive proprieteary code written for free, would cause in compatibility
According to the article, Safari is affected. The Safari on my system (1.2.3 (v125.9)) is not, and that's up to date.
Did anybody see the interesting example Netcraft gave for their webserver search?
http://www.w3.org/TR/html401/struct/links.html#ede f-A
...
According to the HTML4 ref @ w3, putting a table inside of an anchor-tag is illegal. Only inline tags may reside there, and a table is a block-level tag.
Since ths means the browser's behavior is undefined, I hope they come up w/ a better fix
Why aren't you encrypting your e-mail?
If I can trick you into visiting download.trojan.here.com because you think you are going to www.microsoft.com, that's all I need.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Tinyurl has lots of good examples of how the astute user can still be burnt. If the status bar shows "microsoft.com/whatever/whenever" but the actual site has the usual garbage, the user will not be clued in. Indeed, the user may not even be able to see the root of the site through the three thousand character url which so many legitimate sites generate.
Your example is trivial and misses the potential of the exploit:
You might as well say that links themselves are a security risk, since a link that says "Microsoft Web Site" but really goes to goatse.cx is a dangerous spoof.
How about a link that says "citibank.com" in an email and on your status bar that tells the recipient that they should log in to check for suspicious activity? The user goes to the bogus site, which may have valid certs and make the little lock appear and looks just like the citbank site. The user then gives the sender their citibank name and password without thinking twice about the random character url they are confronted with because it's what they are used to seeing. The sender then cleans out the user's account.
A status bar that works is an important part of preventing that kind of fraud.
Friends don't help friends install M$ junk.
That, and financial sites that are supposed to be secure, but will only work with IE. The reason? JavaScript bugs that are easily fixed, but not high on their priorities.
All I want is a kind word, a warm bed and unlimited power.
What if this affected the domain Slashdot displays after every link? Lets find out: .com
http://www.microsoft
Apparently not, but strange nonetheless.
Using the current version of Windows and IE, with XP SP2 and fully patched IE, this thing does not work. Proving once again how much effort went into designing XP SP2 to guard against new, unknown bugs and exploits.
MS *is* serious about security - after all these years they finally got the message.
shdoclc.dll is the mshtml rendering engine.
Benefits of having the rendering engine be a part of the OS:
Any application can hook into the rendering engine and use it for HTML rendering. LOTS of applications embed the shdoclc control into their main panels and use it for navigation, etc. It's trivial to do this, and it means it's a lot less work for people to do.
Downsides:
Any vaunerabilities that are discovered in the engine, will effect all the apps that call it.
Internet Explorer is a "front" for the engine. So is MyIE2 (with some other features thrown in there.)
Integration isn't as bad as you think it is.
I can second that, our whole miltary here in Cherry Point, NC uses IE ....except for me who installed firefox, just recentally after having to reload a computer from spy/malware i just started showing them firefox, alot of them after have come up to me go I love firefox where can i get it for my home machine?
Loading Please Wait....
Or they were aware of it and didn't make it public...
Will this allow you to go to blocked sites with n2h2 bess blocking software, like at schools or libarys?
The latest version of IE6 on win2k is not affected. Updates for win2k are still being produced, whats your problem?
Only the State obtains its revenue by coercion. - Murray Rothbard
Yep. I am a big firefox evangelist for windows, but SP2 is the Firefox killer in many ways.
That said, there are lots of 98 and 2K installations. There are lots of XP people sick of spyware or are curious about tabs, handy extensions, etc. Or at just worried about security. Computers arent these things in our living room anymore, they are our central digital hub. They have our work, photos, taxes, etc on them. Using IE is like driving drunk. Lots of XP users are slowly coming to realize this.
The really great part about this is that microsoft's incompetence will help the responsbile online community promote real HTML standards. No more "you need this to view that" nonsense. With pages working on mutliple browsers we can edge into better mobile browsers, lower cost to entry, break the digital divide, promote other OS's, etc and show Microsoft that from now on there will be a front to fights its Embrace, Extend, and Extinguish business plan.
'firefox source is available, so people can look through it for bugs
and just how many regular users in the owrld can read and write the fucking code?!?!?!?!?!
that argument is so fucking old and tired it is pathetic!!
STFU with the bashing, stop acting like all users are CIS Masters (most can't understand what the difference is between left and right clicks). try acting like adults for a change slashdot! Stop the childish bashing, stop the lies, acknowledge the flaws in your favorite OS (linux) and get it through your damned heads, that the majority of the worlds users are not made up of IT-nerds, most are not able to read and correct code, so it is the FAULT OF THE LINUX CODERS IF THERE IS A LINUX BUG! (same criteria as you give MS)
>> Or do we have to all buy XP and apply SP2 for us to brwose safely?
Just download Browse Safe 1.0
"Lisa, I want to buy your rock." -Homer Simpson
Netcraft Confirms! IE is dying!
Couldn't this exploit be duplicated on any browser with JavaScript enabled by using the Javascript code window.status = "theURLYouWantToShow" attached to the element for that link? I haven't written JS in a while, but I remember it was certainly possible to change the statusbar text on mouseover..
Actually, more bugs are being found in Firefox than in IE right now. BUT, the firefox source is available, so people can look through it for bugs ...
Firefox source has been available for how long? People have been looking through it for how long? And the result is more bugs in Firefox than in IE?
Is there something fundamentally wrong with the arguement? Is no one really looking through the code for bugs?
This type of bug has been known for some time, MS patched it but Firefox didn't. Why is that?
It's news because firms are still on hardware and/or software certified to work with a legacy app, and home users with small budgets run outdated hardware and/or software because they can't afford an upgrade. Because Microsoft has begun the end-of-life process for Microsoft Internet Explorer on versions of the Microsoft Windows operating system prior to Microsoft Windows XP, this bug may prove unfixable in all versions of IE that are designed to work on Microsoft Windows 98SE, Microsoft Windows ME, Microsoft Windows NT 4.x, and Microsoft Windows 2000 operating systems.
Ironically, this exploit doesn't work on my old work mac using os 8.6, and Internet Explorer 5.0. I guess sometimes simplicity is the easiest security?
REMEMBER! I was drunk when I posted this...
I put a test page up. There are two spoof tests on the page. The latest version of Firefox is not affected by either of them if you left click the link. However, if you middle click the first spoof test, Firefox takes you to the wrong site.
If Tyranny and Oppression come to this land,
it will be in the guise of fighting a foreign enemy. -James Madison
Looking at these numbers, migration to alternative browsers may have peaked before the release of SP2.
This type of bug is very minor. I never trust what the status bar says on mouse-over of a link. With a little bit of javascript, it's easy to have it say whatever you want. Many sites already employ this. All it does is annoy me.
The bottom line is, once you land on the site, what does it say in the address bar and the status bar then?
One other thing, be careful of misleading domains that replace "1" with an "l" or vice versa.
eTrade SUCKS
The a href for userinfo's have .exe's in them and if you click the link on IE the second a href tag will open the executable.
http://saveie6.com/
I'm using a slower computer (Pentium 200 MHz), and when I hover the link, "http://www.google.com/" appears on the status bar for a split-second, before being replaced with "http://www.microsoft.com/". It appears that IE is tracing down the document structure tree and setting the status bar twice.
Incorrect agreement between demonstrative and noun. YOU FAIL IT!!!!!!!!!!!!!
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
.Not sucks
Speaking of tricking others, someone can very well use this spoofing bug in conjunction with the Gmail cookie problem.
>Actually, more bugs are being found in Firefox
> than in IE right now. BUT, the firefox source
> is available, so people can look through it for
> bugs,
Whoops. You've just shot down the whole OSS theory. FireFox should never have more bugs being found than IE, BECAUSE people have spent so many hours looking at it (which, even though it's been publically available for months, even years, nobody has). The REALITY is that open-source or not, it's still prone to the same old bugs, and the software life cycle continues as normal. How do you guarantee that anyone looks at it? Just because you can doesn't imply that you do.
The primary issue in pre-XPSP2 IE is that when you click on the link, the URL bar says http://microsoft.com while the site is really http://google.com. Changing the status bar's text has not been seen as a major security issue historically, and Mozilla/Firefox lets you prevent web sites from changing the status bar.
In any case, the URL bar should be authoritative for where you are, which is the issue in pre-XPSP2 IE.
Oh, shoot! I retract that.
I re-read the article and saw that it's a status bar issue after all.
I don't trust the status bar, and I don't see how this is really a big security issue. Besides, phishers are already using e-mail messages with embedded images that have http://citibank.com in the image but link to http://10.83.94.2:893, for instance.
So, I wouldn't hold my breath on Microsoft fixing this issue as larger issues out there already exist. But, I do agree that any security issue should be resolved, regardless of how minor.
Come to think of it, phishers can possibly use the image trick combined with this vulnerability to make the status bar say http://citibank.com, where this vulnerability can become quite serious.
Perhaps we should encourage users to check the URL bar of sites that they are in?
Stop repeating ythings you've simply read on a web frorum written by some clueless monkey. Read up on it and you'll, maybe even TRY a little yourself and you'll see IE isn't really deeply integrated. Plus it is useful for it to be interated (as APple reazlies with WebCore)
BTW, I wish Mozilla WAS wirtten by sane people, because htey apparently don't believe in patches, only full point upgrades for security fixes.
I really don't understand why we still have URL spoofing bugs. Here's the idea:
The browser sends you to a page - The right page. If the browser is going to load a particular URL, then it KNOWS the URL it's going to load - so why doesn't it just display the same URL it connects to? These spoofing vulnerabilities make little sense. If it's stored in a buffer somewhere, copy it safely with length checking to another buffer and display it safely; it can't be that hard.
I don't understand! How could anyone have discovered this flaw in IE?
It would have required someone actually RUNNING IE - and here we all thought no one was so STUPID anymore!
This is a true paradox - maybe the story is made up (fabricated)?
Why would anyone still be running IE anyway!
Who the hell modded that up?
Assume I was drunk when I posted this.
didn't know anybody was still using ie...
All the torrents you could want.
This is really a non-story. There are 50 different ways to spoof this, mostly javascript I'll admit, but you could also open multiple links from a url on the page, and inconvenience and confuse even the most experienced user so much that their only option would be to shut the whole thing down.
Use something like Maxthon as a wrapper for IE and you'll all be much safer. Notice the comparative, you cannot be absolutely safe.
I just got the exploit to work on 10.3.5 and Safari 1.2.5
I have no access to Konquerer, is this a KHTML engine problem, or a Safari-only one?
Rule of the open mind
People who are resistant to change cannot resist change for the worst.
*blink*
Now, here in Australia at least:
Malware + Military Bases = Bad News
Don't you think?
"What we imagine is order is merely the prevailing form of chaos"