Slashdot Mirror
No-Click Phishing On The Way
An anonymous reader writes "MessageLabs has discovered a pretty nasty - though fairly crude - phishing scam which doesn't even require recipients to click on a link in order to hand over personal data.
Simply opening the email is enough to activate a script which 'lies in wait for its victim' according to one report. The script rewrites the host files of the machine and directs users to a fake web page the next time they legitimately attempt to access an online banking page. ... However, this will only affect users who have Windows Scripting Host enabled and certain ActiveX controls, according to MessageLabs."
...doesn't execute HTML or scripts. Use it, be safe!
are people that are, for example, at work, and can't turn off Windows Scripting Host and certain ActiveX controls? Not open emails? Surely there should be a solution to this.
When anger rises, think of the consequences.
Confucius (551 BC - 479 BC)
No-click phising? That's infringing on Amazon's one-click patent!
The virus apparently also redirects visitors of AOL Support Forums to Ask Slashdot, which explains the recent postings.
for those who don't know what phishing is, see the definition
[Phishing] is the luring of sensitive information, such as passwords and other personal information, from a victim by masquerading as someone trustworthy with a real need for such information.
Marge, get me your address book, 4 beers, and my conversation hat.
but you have to manual make the suggested changes to your /etc/hosts file after getting root access and using your editor of choice.
not quite "no-click", but linux does support this feature.
[/humor]
that's why I never keep any personal info on a computer. in fact I have outlook filled with entirely made up crap. names like 'hootie McBoob' and such
I find it hard to believe that our gov't is willing to spend $200 Billion to bomb the living fuck out of a country for no good reason, but can't get their shit together enough to start arresting people for the avalanche of fraud online.
I don't respond to AC's.
I've set my mail display to always be text based. It's a lot easier to detect spam that way too as most of the onscreen stuff is usually garbage, or funnily "get a real mail client".
Rhymes that keep their secrets will unfold behind the clouds.There upon the rainbow is the answer to a neverending story
For making products so easy to use that even someone you don't know can use them for you.
Well, I was going to switch over from Linux to Windows, because I heard Bill Gates said that ``security is our top priority'', but now I think he must have been misquoted. Maybe I'll stick with Linux just a little longer, until Windows gets those last few little bugs ironed out.
See what I've been reading.
I ssh into my ISP and use pine to read email. Been doing it this way for over 10 years. Some people find this a bit quaint, but I don't have to worry about any worm/virus/phishing issues.
Just don't use ActiveX - biggest security risk ever. I sincerely hope no one here is using Outlook/Outlook Express.
Reread Subject.
this will only affect users who have Windows Scripting Host enabled and certain ActiveX controls
Or in other words, this will probably not affect non-Windows or non-Internet Explorer users.
Well we could see plenty of comments along those lines coming, but here's a further thought:
Hey banks: All of your users have plastic cards that you issued. Mandate two-factor authentication already and watch Phishing scams go bye bye.
Indy Media Watch-Proctologist of the Internet
I lub you, Mr. Macintosh.
Boobies never hurt anyone. - Sherry Glaser.
Overwriting your Hosts file is an obvious way to trick people, and Outlook is a prime target for this kind of hack, because it gives incoming email rediculous amounts of control over the rest of the computer.
Remind me to tell my mother to start using Thunderbird and Firefox and install a firewall.
ActiveX is insecure!
WSH is insecure!
Windows is insecure!
HTML mail can be used to exploit security flaws in user agents!
Film at 11!
Please correct me if I got my facts wrong.
with 1gig download Service Pack. It will be released in 1.5 years, and it is not backwards compatible. Aren't they nice?!
- Your stupidity got you into this mess, why can't it get you out? -Will Rogers
Will the innovation never end?
-Peter
to set the file attribute on the hosts file to read only. ugh.
This is what happenes when applications try to do more than what they are supposed to do. An email client is just supposed to read and send messages. All "dynamicness" and interactivity must be left to the appropriate programs. And this is exactly where *NIXes excell. You can't do a scripting exploit in 'mail' - Why? Because you can't do scripting. Let the current do-eveything software industry led by Microsft be a lesson to all programmers. Let's keep our programs simple. Let's continue the UNIX philosophy of one program for one task.
on my Linux machine you have to root it first to get even write access onto the hosts file :-D.
But given the circumstances that most windows machines root every user and most windows users dont even have a clue about the existence of a hosts file on their machines, this is evil, but interesting.
C:\WINDOWS\system32\drivers\etc>attrib hosts
A R C:\WINDOWS\system32\drivers\etc\hosts
I've got it set so only administrators can unset this flag.
This means
1) I'd have to run IE as administrator
2) the script would have to change the permissions before doctoring the script
First though it'd have to get past my spyware- and other-nasty- blockers
The only aparently safe way to use mail is in a Unix shell. I've got my doubts about webmail too. Its a bit too slow compared to on-line mailing, but it may contain other unwanted elements, depending on the mailer. I've never had a real problem with any worm using mutt, the Unix mailer.
Very recently some joker in France sent me a worm that prevented me from reporting the abuse. The solution was simple: Delete the worm, restart mutt and mail it to abuse@wanadoo.fr. (Personal note: Wanadoo sounds like wanabee, they are little known among 'my crowd' and somewhat of a worry. This is not intended as put down to the French!) So the moral here is simply if you use Unix, call it *BSD or Linux, you may not be 100% safe, but certainly safer than using Outlook which should be called "Lookout".
Zero click exploits seem hardly new to me. Aren't most exploits, atleast in the past, done without the victim being imeadiately aware? This is from the computer-litterate camp.
Hey banks: All of your users have plastic cards that you issued. Mandate two-factor authentication already and watch Phishing scams go bye bye.
You obviously have no idea how these scams work. Mostly, they trick the unsuspecting user into giving out their PIN number, and name and home address. As soon as you give out your PIN, all your "two-factor" authentication is useless.
Why?? Here is why. Your bank card is absolutely trivial to duplicate.
All a theif needs is a card from the same bank (easy to obtain by simply creating an account), and a 50 dollar stripe reader/writer. They read the card, find out the format, and where the card number is stored (your account number is not on the stripe - it is associated with the card number in the bank's minaframe - this lets them easily replace your card if it is lost or stolen.),
Since they know your name and where you live, they can then just stake you out, until you go to an atm or restaurant or store with an improperly configured machine, that prints your whole card number on the slip, and not just the last few digits. They then wait for you to throw a slip away in a public trash can, and pick it up later.This is why you should NEVER throw away a debit slip in public - and if possible, shred it. (Or, at least do what I do - throw them in the kitchen trash with all the rotting meat and apples - the moisture, worms and bacteria will eat the slips up in no time.)
Did you read the article? It says " the most recent versions of Outlook, where such features are switched off as standard, will be protected." This has been the same with many recent exploits. They only affect old versions of ms software, but it immediately gets spun here to say that no one should be using the current, safe versions. It's similar to the recent status bar spoofing issue posted here which affected firefox rc1 and opera and pre-sp2 IE, but not sp2 IE, and was of course disscussed as being a "hole in IE".
I'd rather be lucky than good.
I can't seem to delete it (or f!cking Windows Messenger), but I don't use 'em. They have the stink of evil and stupidity on them.
Kierthos
Mr. Hu is not a ninja.
If you want to gather a bunch of personal data and cover your butt at the same time start an ad company and release your virus, er demographics data gathering software and just claim it's business.
Shop smart, Shop S-Mart.
Windows Script Host (WSH) is a Windows administration tool.
WSH creates an environment for hosting scripts. That is, when a script arrives at your computer, WSH plays the part of the host -- it makes objects and services available for the script and provides a set of guidelines within which the script is executed. Among other things, Windows Script Host manages security and invokes the appropriate script engine.
WSH is language-independent for WSH-compliant scripting engines. It brings simple, powerful, and flexible scripting to the Windows platform, allowing you to run scripts from both the Windows desktop and the command prompt.
Windows Script Host is ideal for noninteractive scripting needs, such as logon scripting, administrative scripting, and machine automation. WSH Objects and Services
Windows Script Host provides several objects for direct manipulation of script execution, as well as helper functions for other actions. Using these objects and services, you can accomplish tasks such as the following:
* Print messages to the screen
* Run basic functions such as CreateObject and GetObject
* Map network drives
* Connect to printers
* Retrieve and modify environment variables
* Modify registry keys
Where Is WSH?
Windows Script Host is built into Microsoft Windows 98, 2000, and Millennium Editions. If you are running Windows 95, you can download Windows Script Host 5.6 from the Microsoft Windows Script Technologies Web site (http://msdn.microsoft.com/scripting).
Note You can also go to the web site listed above to upgrade your current engines. The version of WSH in Windows 98, 2000, and Millennium Editions is either version 1.0 or 2.0. You must upgrade to version 5.6 to get the new features.
IMHO, it shouldn't even have the "feature". You don't need ActiveX in emails.
... posting on slashdot is IT related though nice MR admin!!
Some of us don't have the choice (at work).
At least I can install firefox, but mail clients that aren't OE are a big no-no.
In 8-N-1 ASCII, of course.
However, this will only affect users who have Windows Scripting Host enabled and certain ActiveX controls, according to MessageLabs.
That's like saying, "this will only affect users who have not yet switched to Linux or MacOS."
I would say that a good 98% of installations have WSHost enabled. Those that are SP2 or up to date might have the latest MS patch that I believe sets a kill bit on the Internet Explorer side of WSHost scripting under all circumstances.
This is also not really anything new. Spy and adware companies have been manipulating hosts files now for at least a year, no doubt phishers have done exactly the same thing, this is just the first reported time of it happening.
One thing you have to keep in mind is that severay so-called security experts are very bright individuals but succumb to what some call: media-whoring. This is a specific instance of a "media-whoring" by Message Labs. Let me explain my proof of this: they use ASP and IIS as opposed to something like PHP and Apache.
They are obviously not very concerned about legitimate security. There's a website that keeps track of the media fanatics: http://www.vmyths.com/
The site is run by a guy who has over a decade of solid security experience. He knows when there is something legit to worry about, and he knows when something is hype.
I suppose the best way to know is years and years of experience. If you read a lot of the security mailing lists, you'd be under the impression that the world was about to revert back to the stone age with the security threats.
But the reality is, a huge amount of idiots exist that love to overhype the security risks when it comes to viruses and worms like "I Love You" and "Sasser". Most of us know when there is going to be a big problem, but there are a huge number of others that like to spread false info.
There are others, like Mikko Hypponen of F-Secure that don't sell media hype, they sensationalize the truth. Yes, there have been instances of zombie-net owners selling their networks to spammers, but I have yet to actually see the sales, and I've been running a honeypot for well over a year now and track nearly a dozen different botnet herders.
For the most part, it looks like botnetting is still used for two things, Americans (north and south america) for File Sharing/FXPing, and Germans for DDoSing. The Russians who have been spamming have been using IE exploits and web controls, not so much IRC connections. Thus, they cannot be truly considered "botnets".
would it be so difficult ... to set the file attribute on the hosts file to read only.
a) Why should Joe Newbie Windowsbuyer be expected to KNOW that he needs to change the permissions on the host file from the install defaults?
b) If he can do it, he can UNdo it, and so can the bad guy's script.
c) How many OTHER holes would he have to fix? Thousands? Tens of thousands? (Remember, he only has to miss ONE.)
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
With the amount of crapware out there and the amount of guides and articles written about this subject you would think people would still be a bit more secure. Unfortunately it does not seem to be the case.
This guide explains how to keep your damn computer from being stupidly compromised:
Simple and easy ways to keep your computer safe and secure on the Internet
Also heres a tutorial for switch from IE to firefox:
Switching from Internet Explorer to Firefox
All major financial institutions use HTTPS to log in to their online banking systems. Wouldn't a redirected HOSTS file set off some alarm bells when a user tries to access a fake site?
Or maybe it's just that nobody will think to look for the little lock on the bottom of their browser...
-R
Is this exploit so blatant and so obvious that not even the Microsoft faithful will defend IE and Outlook, not to mention ActiveX or Windows Script Hosting.
There's not a lot wrong with Windows Script Hosting, as long as no other shite on your system lets somebody else run scripts without your permission.
But you get it because IE is used as the rendering engine, thereby ensuring that any security problems in one application are shared amongst as many others as possible.
As an alternative, whenever you need to access sensitive data from work, you can inspect your hosts files manually, immediately prior to visiting the desired website, to ensure that no URL spoofing is going on.
Of course, this is dangerous if somehow, an ActiveX control spoofs the URL that you're visiting during the middle of one of your sessions. But I'm guessing that's not too likely.
Windows experts: is there a way to lock down the hosts file to prevent modification via an untrusted control or program?
Why are WSH and ActiveX even an options for Outlook? Bad ideas, poorly implemented, and not secure.
A firewall can not protect you from yourself. Turn off what you do not need. Do not use the firewall to do your work.
the tea timer and host file blocking has helped me keep problem users from installing crapware, etc. that would change the hosts file...
...if you're required to go through an HTTP proxy anyway? (Like most corporate environments)
Maybe the next generation of home ADSL routers would have one in their firmware and tout it as a "security feature"?
and there's not a lot wrong with an unstable SUV that's easy to flip over and kill the passengers as long as those SUVs aren't driven in an "unsafe" manner...
did you ever think that requiring "no other shite (sic) on your system (that) lets somebody else run scripts without permission" is what's "wrong" in "not a lot wrong"? it's like "it's in perfect condition, except for a scratch." well, that scratch is what makes it not perfect... duh.
This works with most reasonable email clients and notably Outlook Express (without implying OE is a reasonable email client choice).
I have to use Outlook Express but my little workaround renders all email virus attacks benign to all but really stupid users.
Just because you use pine or OS X or linux does not mean you can sit back and smirk at people who use Windows / Outbreak Express. The primary defence against phishing is critical thinking skills, not technology. Do not be conned into a false sense of security. Phishing is simply a technological incarnation of a kind of scam that has gone on well before the internet. Always keep your critical thinking skills in gear, as that is where real protection from phishing is gained.
And before you flame, I do acknowledge that said non-majority systems like OS X, pine, etc do help protect you from some of the technological vectors used to facilitate phishing, like HTML tricks to obscure the real destination of a link or the URL bar in MSIE. But once again, phishing is not a technological phenomenon. It is a social phenomenon and has social solutions. Patching the security holes will do very little to stop phishing on the whole.
thank god we have a mod system that keeps such ungodly facts down, not messing up our jihad
Gotta have it for updates, to contact the mothership, to update tax tables. You can sign up for the CD updates, but they just don't work right.
On top of this, QB isn't a standalone proggie, it's just a bunch of scripts that run in an IE window, no other browsers invited. Just totally sucks.
Tunnels - Luxury!
Why I don't even have a spade. At Christmas time I didn't even get a lump of coal. I got a pickaxe so as to go get my own coal, which I had to ignight by rubbing together the dried-up bones of my own hacked-off legs. I use that small ember and a swatch of rag to send smoke signals.
Stuff that matters.
just another reason NOT to use M$ crap... go firefox & thunderbird
iF yOu WAnT to C YOUr iP agaIn gAThEr tWO MilLIon dOLLArS IN Non - cONsEcuTivE TweNtY's AnD AWaiT FuRThER iNstrUctIoN
Don't tell me what I need or don't need in my software. It's off by default and if you don't want it, you don't have to do anything. But it's not for you to decide what I should or should not be able to do with my software. Other people may have different needs or use software in a different environment from you and this moralizing attitude that you can decide for everyone what their software should be able to do is frightening.
I'd rather be lucky than good.
How would they enforce such a restriction? Outlook Express doesn't have features that basically will you to use it, like Outlook has. Unless you're somehow using Exchange and their calendar system...
Personally, I'd rather continue using mutt than have anything to do with HTML email. I wish some graphical mail client would have a feature where all HTML email is converted to text before being presented (of course this would be configurable, and there would be a "View as HTML" option)
Email is a text medium, and always will be.
--
Me spell chucker work grate. Need grandma chicken.
Just be sure your ISP keeps their installation of pine up-to-date. I've seen all too many installations of pine that haven't been updated since sometime in the 90s.
Granted, I doubt pine is a big target for phishing scams, but nonetheless...
DNA just wants to be free...
However, this will only affect users who have Windows Scripting Host enabled and certain ActiveX controls, according to MessageLabs.
If only Microsoft would back out of this insistence on making the browser a completely general web applications framework with the ability to provide full access to local resources.
Microsoft: split the HTML rendering engine out of the web client components, and get rid of the "security zones" hacks. You've been trying to come up with a design that lets you do this safely for over seven years now, and never succeeded in holding off attackers for more than a few weeks at the most... it's time to admit that even all the brilliant people at Microsoft (and you have some bloody amazing blokes over there) won't be able to make it work. Please consider that you may have been mistaken.
Last year I bought a new laptop. When I was setting up my apps, I decided to ditch Eudora and look for a better mail client.
I tried out Pegasus Mail, Fox Mail, Mozilla mail, the Thunderbird standalone and PocoMail. PocoMail was the only one that wasn't free, and it was the one I chose in the end.
A number of reasons led to my choice:
1 - Built in spam engine (Bayesian filtering added in 3.1) and the best auto-junkmail filter of the apps I tested, includes learning filters
2 - UI totally configurable
3 - Ease of use. Everything was intuitive; layouts, menu items being where you would think they were, etc.
4 - Internal HTML viewer: it doesn't use embedded IE and thus IE exploits go out the window
5 - Doesn't execute JavaScript or VBScript: only supports PocoScript and only then if you tell it to. NOTE: also not affected by the latest JPG vulerability.
6 - Integrated automatically with both Panda Antivirus and later, Norton without me doing anything special.
I've used it for a little more than a year now and love it. It was worth the $40 I paid for it, and Poco has updates frequently. If you're looking for a new mail client, I would recommend taking a look at it.
More info.
R(k)
Why is this attack lumped together with phishing attacks? It sounds to me like this attack involves a hole that lets the attacker run arbitrary code with the user's permissions, which could just as easily be used to install a keylogger.
The shareholder is always right.
Momma says ActiveX is the devil!
This is another example of Microsoft's flawed security model -- which, no doubt, has its origin in the supremely arrogant and short-sighted idea that ultimately it should be Microsoft, and not the user, who has the last say on what happens to a computer.
No regular user should ever need write access to the hostsfile. That's the way Linux works by default. If you do need to modify it, you probably are root anyway.
To allow ordinary users to edit the hostsfile is stupid, but to allow some random person on the far end of a long piece of wire to edit it is bloody suicidal. Yet this is exactly what is happening here -- the user is effectively executing dangerous, unknown programs at their own privilege level {which is likely administrator}.
And what is the attraction of online banking anyway? There are precisely two reasons why I ever visit a bank. One is to deposit cash or cheques through the hole-in-the-wall, and the other is to withdraw cash through the hole-in-the-wall. Unless there has been an improvement in Windows software of late, that allows you to print pound notes out of your own printer, but I don't think so. I know how much I'm getting paid and how much my direct debits are for, so that tells me how much I can withdraw each month; multiply by 12, divide by 52 and round down to the nearest whole *10 and I get a weekly entitlement. As long as I don't withdraw more than that, I know I'm fine {and anyway I can always check my balance at the HITW next time I go there}.
Je fume. Tu fumes. Nous fûmes!
Me spell chucker work grate. Need grandma chicken.
Shouldn't that be "Me spill chucker work grate. Knead grandma chicken."?
"They redundantly repeated themselves over and over again incessantly without end ad infinitum" -- ibid.
When I was younger, I used to write little batch files that would mess up my friends autoexec.bat file. I would give them a game on a disk, and then tell them to play the game they had to type go (go.bat). The batch file would then backup their autoexec.bat file and replace it with my tampered version. Then when they rebooted their computer, blammo.
I would have it execute gwbasic programs that would continiously loop "your computer is screwed", or that would just bleep out sounds from the PC speaker. I even wrote a program that would pretend to format your floppy drive (a continous loop that constantly tried to load a file from A:>)
People were so clueless they actually thought they had a virus. After people started using 2000 and XP I kinda figured that this sort of simple fake hack was over, but then I forgot about the hosts file. I think I'm goona change my grandma's computer so that google.ca resolves to playboy.com :)
Another simple fake hack is to erase the boot.ini file. It makes your uncle think his hard drive is mangled.
Ah windows, it's the one constant I can always rely on.
doesn't this flaw have more to do with what email client you are using than activex and windows scripting host?
it would be helpful to say which email clients to avoid (probably outlook express I take it?)
did you forget to take your meds?
The last line of defense for a lot of people was checking the actual URL of a link and seeing that it wasn't really "ebay.com" or "citibank.com," and it sounds like this flaw provides a way to defeat even that test. So this is pretty serious, it would seem, which is why it's surprising that the article is so sparse on details. Wouldn't it be good to know:
1) What e-mail applications are vulnerable (can I get this through web-based mail)?
2) What can be disabled to prevent this? Scripting? Active-X?
3) Is a patch on the way?
That article is pretty crummy.
would it be so difficult to set the file attribute on the hosts file to read only. ugh.
The C library function _chmod can be used to un-read protect a file so protecting the hosts file that way is useless.
So I primarily use my software to filter out such HTML-based exploits in additon to certain system configurations to make such attacks 'almost impossible'.
*yawn*
Other people may have different needs or use software in a different environment from you and this moralizing attitude that you can decide for everyone what their software should be able to do is frightening.
Name one. If you're passing activeX around in email, it could probably be done better some actual way. In the meantime, we all have to deal with the results of malicious activeX email.
Incidentally, my moralizing attitude is that you shouldn't be dumping benzene upstream of me. Is that also not for me to decide?
"We returned the General to El Salvador, or maybe Guatemala, it's difficult to tell from 10,000 feet"
Didn't Amazon patent no-click phishing? Oh wait, that was 1-click phishing. Sorry!
Proxy servers tend to munge up way too much software so all but one company I have ever worked for just nat everything and do not use proxy servers.
Got Code?
Lets say I wanted to allow scripting on a UNIX machine. I can in Mozilla you know, at least for javascript in e-mail.
The difference is on my UNIX machine, no matter *what* I have enabled in my mail client (and it sure isn't scripting) I'm running the code as a non-root account, and it doesn't get to change things like my hosts.
The bigger problem is that the mail program has full administrative control over the machine instead of just being a user-land app.
This is a long-standing problem with the Microsoft process model dating back to when they were a single user OS. The fact that all software expects to be able to manipulate the registry, change system dll's, and put its crap in the one-true place for such things seems to make the exploits worse.
Cheers
Lost at C:>. Found at C.
Anyone smart enough to make the file read-only is probably smart enough to not run IE with administrative privilages except when absolutely necessary, e.g. Windows Update.
Yes, Joe Home User probably won't do a thing, but business users can and should configure their systems to close such holes. There's no reason Joe File Clerk or Joe Bank Teller needs to run with administrative privilages.
Outlook 2002 added it with SP1. See Q307594 for details.
In outlook 2003 its even easier, just check the option for it.
And in XPSP2, Outlook express now reads mail in plain text (Q883257).
Because your Windows account has non admin privileges, of course. A low privilege user can't overwrite the hosts files, or screw around with the HKLM registry. And personally, my own mail client doesn't even try to support HTML or script-like thingies. Too difficult, too weird, unnecessary, dangerous.
No offense, but you'd be surprised how many reports and calls are made due to pranks like this are made to tech support people. I hate to say this, but your 'fake hack' actually hurts thousands, even millions. If you wrote something like this as a kid and distributed it from floppy disk to computer, imagine what kind of varients of this are running around the internet right now.
Let me get this straight. We have an article on phishing by a guy named Will "Sturgeon"... hmmm something sounds fishy to me. :)
Who in his right mind would still use windows nowadays? Can't get enough viruses, adware, spyware, pop-ups, or what? Man, even my 7 year old niece and my 68 year old grandmother are using Linux. They are anything but computer literate and both love it.
You know, I don't have many problems with one program:one task thinking, except that using that thinking, new user expansion will be stunted. The more you isolate programs, the less likely you are to gain a user base. That may be the very thing that some Linux enthusiasts are going for: exlusivity. I wouldn't see the point in that, and it seems many people are ruining that by trying to spread the word about Firefox. One reason Firefox can pick up users so fast is because it combines many different useful features into one program. I'm not sure about you, but I've tried a lot of extensions, too. The point of each extension is exactly the opposite of what you're talking about. It adds functionality to an already functioning browser.
You could break the whole thing down infinitely, and by your definition, Firefox does too much. Whether or not you use Firefox, the point is that one program and one task may have been good enough for your grandmother, but who wants to write software for your grandmother? Nobody. Simple programs abound, but they don't innovate.
Actually, this is a common point of confusion with windows XP. There are two tricky aspects to it. 1st, the read-only bit on directories is "special" and doesn't actually make the directory read only. 2nd, and this is really confusing, in XP's folder property sheet, the read-only checkbox is a tri-state checkbox that refers to the files within the folder, but the XP theme makes the "indeterminate" state look like its checked.
See Q326549 for more info.
I wish some graphical mail client would have a feature where all HTML email is converted to text before being presented
You mean this one?
If you're a zombie and you know it, bite your friend!
I'd say Microsoft has already harmed trust in the web and there are not enough reports about it. More than 80% of the world's spam is sent from broken Windows boxes. That in itself is a awefull but it's nothing to compare to the downfall of e-commerce that looms. New surveys are already showing that people are already getting skittish. When these automated scams start taking their victims, that skittishness is going to knock the bottom out of Microsoft or online retail, online banking and every other business that depends on taking money over the web. People are going to have their passwords stolen and their accounts abused and then they will tell their friends and that will be that for everyone. Between the misconception that PC==M$ and the barage of BS from Redmond about everyone else's software sucking as much as theirs, the trust will be gone for a long time.
By the way, that vmyths site itself looks like an email harvester for spammers or worse. I would never give them an email address or use the screen saver offered. I don't trust their flash. Their copy contains no useful or technical information and even looks like spam to me. Check out this deathless prose:
Still waiting for JPEGs to kill the Internet, part 2 We stand at 41+ days since Microsoft released a patch to fix a JPEG vulnerability. Based on what the experts predicted in September, you should be sprinkling lime over your loved ones by now.
It takes time for the Microsoft security dissaster to have it's effect but it's coming. People are not collecting these accounts and passwords for fun and bragging rights, they are doing it for money.
Friends don't help friends install M$ junk.
Recent versions of Outlook (2000 SP1 and beyond) and Outlook Express (IE SP1 and beyond) display emails in the restricted sites zone. Neither ActiveX nor Javascript are allowed to execute in the restricted sites zone.
This also doesn't affect anyone using SP2 either.
Move along, another already patched Microsoft vulnerability.
Make a new username such as ConfigEdit and assign ownership/read/write permissions to that user. Make sure that administrator and other users are not owners and have only read access to the hosts file. Email programs hopefully don't try to re-assign file ownership.
...is actually good for something useful after all!!!
So what exactly is your problem with WSH (or Outlook, for that matter)? Yes, if the user goes out of his way to enable .vbs attachments in Outlook, and then is stupid enough to execute them, he's screwed. Same as with .exe or any other executable type. Which is exactly why these types are blocked by default.
The primary defence against phishing is critical thinking skills, not technology.
Sure, but it'd be awfully nice if the technology we use didn't automatically give away my personal information before I even get a chance to employ said critical thinking skills.
There are enough gullible people in this world that social engineering-type scams will likely always be with us. Still, you could vastly decrease the number of security problems on the net if you could wipe the twin scourges Internet Explorer and Outlook from the face of the Earth.
It should also be noted that this exploit is only possible if the user is running as a member of the Administrators group, since that portion of the file system is only writable by Adminstrators and System.
Running as Administrator in Windows is just as stupid as running as root on linux.
Uh, that's amusing, but wrong. Pine was the first mail program to use IMAP. Both Pine and IMAP were created at the University of Washington.
"Don't tell me what I need or don't need in my software."
Then what the hell are you doing using Microsoft software?
- It's not the Macs I hate. It's Digg users. -
Not sure why they use a plural "recent versions" in that. Only Outlook 2003 will block executables and scripts by default.
Outlook XP won't block these scripts by default. It's only a couple years out, and I don't consider it to be OLD software. Expecting people to buy new versions of office every year (Office XP = 2002, and then Office 2003 a year later?) to protect themselves is silly.
I don't excuse people for opening attachments, though, not completely. It's been years of "Don't open files you don't trust" bombardment across the board now that most people should frigging know better. But no, they don't, and people will keep opening these attachments over and over and over again.
- It's not the Macs I hate. It's Digg users. -
With all the tech issues, browser hijackings, and virus scares, I've been learning Linux as a replacement. Wine seems to be supporting most of what I need, and I can't take much more of these insecurities... It's becoming rediculous. Simply going to a page can completely hijack a browser via scripts that download and run .cab or .exe files, and the vast majority of computer users have no idea how to remove or prevent this type of "Espionage." Remember when it was safe to browse the web with a windows based machine? Ah, Memories...
slimy, but actually kind of clever.
It's not wasting time, I'm educating myself.
Unfortunately some people are forced to use certain products such as Outlook as part of their company standard.
My problem? It's not my problem as I don't use WSH or Outlook anymore. Microsoft has a problem and instead of fixing it they reluctantly disable the defective part and allow it to be turned right back on again.
Q. If WSH and other executibles are turned off by default in Outlook or at the system level, why have them at all?
If they can be made secure, then having them on is no problem. If not, they aren't reliably available and can be abused. Having WSH and other disabled dangerous services on the system at all makes turning them right back on again that much easier.
Beyond that, another problem that Microsoft has is sticking to the data-as-executible concept. Yes, data and programs are just strings of bits, though treating them with equal privilidges is a bad idea.
Windows uses data-as-executible everywhere -- making trivially changed things like file extentions important. Windows in general and many Windows applications specifically wouldn't know what to do with one file or the other without file extentions...allowing not only users to be fooled but applications as well. Manually making exceptions for each defective implementation of this only works if the systems never change...yet they are being changed constantly and reintroduce this defect over and over again.
A firewall can not protect you from yourself. Turn off what you do not need. Do not use the firewall to do your work.
Score another point for Pocomail. Knowing my wife isn't using Outlook or OE is well worth paying the license fee for Poco.
http://shit.slashdot.org/article.pl?sid=04/11/03/1 829252
can't this also be accomplished with
something like google's desktop search?
an app running in the background, intercepting
requests for bank urls?
It says this is a "no-click" phishing scam, but I always have to click to get an email to display. Does it only affect you if you are using telekinetic powers to control your email program or am I missing something altogether?
This is what these fucking scams do.
What good is a person's PIN number without their card? It's useless. These guys use the scam to get your info and PIN, so that they can either go to your house and get the card info from your trash, or they can go to the bank and use your info to trick them into re-issueing your card, and pick it up.
Get a clue - identity theft had over 10 million victims in the US alone last year. Everyone is at risk.
SHRED YOUR SHIT.
It's not like there's a checkbox in Outlook saying "allow .vbs attachments". To do this you'd have to edit the registry. Seems pretty reasonable to me.
If WSH and other executibles are turned off by default in Outlook or at the system level, why have them at all?
I'm not sure what you're asking here. How do you imagine using a computer if you can't execute any executables?
Having WSH and other disabled dangerous services on the system at all makes turning them right back on again that much easier.
So what you're saying is that since .vbs files can be abused, they should be permanently disabled? By this logic, you'd have to disable .exe and .bat files as well.
I didn't see the parent say anything about RECENT - he/she just said I hope no one here is using Outlook/Outlook Express.
Your rush to judgement led you to infer the author meant RECENT - when in fact they may have meant any version.
...or has windows security made the whole damn internet AOL circa de 1997.
It used to be that if someone wanted a user name and password they IM'ed AOL members one by one. With the advent of activex, they can now do it en masse. Thanks Bill.
How do I keep track of people who are fingering
Of course that doesn't happen in every case. The problems Microsoft should fix are fairly broad, though -- and some of them were mentioned in the parts of my previous comments you left out this time.
Is ActiveX a bad idea: Yes. Implemented poorly: YES. (They won't remove it since it's both a lockin tool and a marketing idea...it does nothing for the customer that couldn't be done more safely with other methods.)
Is WSH a bad idea: No. Implemented poorly: Yes. (If not, it would not be abused. Since it has to be turned off to secure a system...it's not very valuable. Other scripting languages on other systems don't have these problems.)
Are any executibles a bad idea: No. If implemented poorly: Yes. If integrated poorly: Yes. If easily confused with different data or executibles: Yes. If easily re-enabled and abused: Yes.
Look at the various exploits that Windows and Windows applications have suffered with over the years -- specifically Outlook and IE -- and you'll find examples of each of these.
A firewall can not protect you from yourself. Turn off what you do not need. Do not use the firewall to do your work.
I believe the grandparent meant "would it be so difficult for MicroSoft to set the file attribute on the hosts file to read only".
Yep. They're two sides to the same issue, really:
With respect to each and every one of the huge number of configuration security bugs that Microsoft ships as its default configuration: Is it the job of millions of customers, many non-experts, to separately change their configuration to turn off the bugs (that they CAN turn off)? Or is it the job of the experts at Microsoft to do this once for everybody?
If it's the latter, aren't they failing in their minimal responsibilities with respect to producing a consumer product? If they are failing, when will the bulk of the consumers realize it and switch to a product that is more robust?
IMHO this is finally starting to happen. And once we're past the tipping point MicroSoft will be in the position of trying to sweep back the avalanche.
But perhaps that is wishful thinking.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Do you mean ActiveX in general? Or ActiveX support in IE?
Saying that ActiveX in general is a bad idea is like saying DLLs are bad. An ActiveX object is nothing more than a component packaged in a DLL that can be used in a somewhat language-neutral way.
ActiveX support in IE could have been better, I'll grant you that.
Is WSH a bad idea: No. Implemented poorly: Yes. (If not, it would not be abused. Since it has to be turned off to secure a system...it's not very valuable. Other scripting languages on other systems don't have these problems.)
I don't understand this. Can you safely run a Perl script from an untrusted source? Do you have to disable Perl in order to secure a system? Why do you think the answers to these questions are different when you replace Perl with WSH?
"And what is the attraction of online banking anyway? There are precisely two reasons why I ever visit a bank. One is to deposit cash or cheques through the hole-in-the-wall, and the other is to withdraw cash through the hole-in-the-wall."
And one can pay bills using online banking - no more rushing around at lunch time...
Look for the pretty little padlock icon on your browser.
if anything is redirected to an IP address that you don't know, then you can be pretty sure that it is wrong to have this in the hosts file.
I use my hosts file to redirect annoying advertising URL's to local host (which is always 127.0.0.1)
If you have any other IP address in hosts there that is not a local network address (which is a 127.x.x.x or 10.x.x.x and maybe some others)
I suggest that you google for hosts and see what it is. Or view your own on your local system.
If you have a local network you also use the hosts file to direct your computer to other computers on the network. If you are using DHCP you don't do this.
Quite right FinalCut. I wasn't referring to this specific vulnerability - I was referring to O/OE in general.
> Don't tell me what I need or don't need in my
> software.... it's not for you to decide what I
> should or should not be able to do with my
> software
It's not your software. It's Microsoft's software, you're just allowed to use it (for a fee).
So, you'd believe that having, say, bash or perl or python installed on a Linux system is inherently insecure, because if, say, your mail client were to allow a script to be executed through a design flaw in the mail client, it would be able to compromise the system? Have you perhaps considered that blaming the scripting language for this is just plain stupid?
Exactly. I wrote a large set of macros for Excel 97 a few years ago as a summer job, and supported by email when I was back at uni. This often involved sending patches direct to the (2) users. A winzip self-extracting .exe was perfect - until the mail gateway was rconfigured to block all executables (and .zip files) and even the IT department on that site couldn't do anything about it (e.g. whitelisting). In the end the solution was to rename patch.exe as patch.bmp, which wasn't even scanned by the gateway virus checker, and instruct the user to rename and run. I didn't want to use a vulnerability to bypass overzealous security, but posting floppies was too slow. Of course that's the last thing you want to do for ordinary users.
a way to change the default location of the host file, so any phanges affect a fake host file?
an use a mail washer / monitor and delete the spam on the mail server...
There's no such thing as a safe Microsoft app. At least I'm not aware of one.
The article only mentions Outlook, not Outlook Express - the last time I checked on WinXP SP2 OE still had lots of nasty things enabled that need to not be enabled. Outlook 2003 [which I use in my office] is secure by default to the point that it's annoying. But at the same time, it does provide somewhat of a safety net for myself and other employees throughout the company.
Bingo.
For personal use, I use pine for mail and tin for newsgroups. But @work, it's use exchange or face the hassle of not having the company calendar/scheduling/address book available. Exchange :(
I'm not a zealot about html mail, since as a markup language it is there to aid expression and communication, but html is just text, and sensible practices such as not allowing one's mail client to follow every link in sight should be sufficient to make it safe.
ActiveX, however, opens up a can of worms every time it's invoked and has no honest or useful place in email.
If, perchance you are referring to the need to interface with MS Exchange, Evolution now does that quite well. Though I should say, recent versions of Evo have unfortunately become quite heavy resource hogs...
I have no comparisons to make with OE, however. Does anyone else?
I sincerely hope no one here is using Outlook/Outlook Express.
Until recently, I was using Outlook Express with no problems.
All that was required was that I turn everything off -- JavaScript, ActiveX, everything.
(I don't need all of that crap enabled just to read email (or to surf the web, for that matter).)
Unfortunately, I can't turn off either HTML or images.
This means that with the new JPEG exploit, I can no longer use OE, as MS no longer supports my MS-Windows95 version of OE.
I guess that it's finally time for me to switch over to some other mail reader.
It states in the first sentence, first paragraph, "A phishing scam has been detected..."
It was NOT "broken by trained personnel".
The implications should be fairly linear at this point.
That your workaround was even possible shows how bad the extentions issue is for Windows; even a 'virus detector' took the extention as the truth -- not the contents of the file itself!
Unfortunately, this extentions-centric way of doing things has been used on *nix desktops too. You'd think that the hard lessons of Windows would not have to be relearned elsewhere...bah!
A firewall can not protect you from yourself. Turn off what you do not need. Do not use the firewall to do your work.
ActiveX in general; it is treated often as a system process or library loaded from a 'trusted' external source; injected on to the local machine. IE is just the main vector for it appearing, not the only one. DLLs are not injected across networks (minus through other known exploits).
WSH; is a bad implementation because it by default has hooks into too many areas of the system that haven't been vetted. That's why it keeps being used in viruses. Any scripting language that allows external scripts to be executed *should* be properly locked down to the user level or even sandboxed (Java, CLR) if sent from a remote source. It shouldn't be trusted automatically.
If that makes the Windows version of Perl a bad implementation too, so be it, though I don't know of any cases where Perl was used as part of a system exploit.
A firewall can not protect you from yourself. Turn off what you do not need. Do not use the firewall to do your work.
It is like a error warning for cars: "Driving a car without brakes can cause damages."
Question to all: Who is using Outlook earlier than 2000 and Outlook Express earlier than 6? Computer is security relevant. If the system is to old, you have to upgrade. If the upgrade is to expensive, have a look to cheaper operating systems like Mac OS or something like that.
I know, a lot of users are insecure. But be sure: there is noch patent on upgrading. Or...?
Sheep
Need your help: http://www.make-my-son-happy.us.tp/