Slashdot Mirror
Latest Version of MyDoom Exploits New IE Flaw
techentin writes " CNN Money is reporting a new and improved MyDoom variant which is spread by a hyperlink in email. Clicking the link connects the user to an infected machine, which exploits a recently discovered buffer overflow in Internet Explorer. McAfee has a more detailed description. Is this yet another good reason for running Firefox?" CNET also has a story.
Give Firefox such a big present for their 1.0 release.
It's pretty neat how far FireFox is beginning to spread. CNN carried this story on TV just a half-hour ago. They mentioned that FireFox was becoming the most popular alternative to IE. My coworkers (who's job includes watching CNN) came by and asked me why this FireFox thing is better. I told them about tabbed browsing, popup blocking, lack of security issues, and other niceties.
:-)
One of the coworkers downloaded FireFox right away. I actually expected him to take a little while to wean off of IE. After I showed him FireFox's features, however, he set FireFox to his default browser and deleted his IE shortcuts! I think we're definitely making headway.
Javascript + Nintendo DSi = DSiCade
A bug in IE? I won't believe it till I see i--
Microsoft today announced that it was going to leave IE users to fix their own patches...
Can they start teaching in school that using IE is like having un-protected sex with 15 donkeys? or would Microsoft complain?
This comment does not represent the views or opinions of the user.
People still use IE?
ok so they accidently leave one bug in their browser and everybody jumps all over them. big deal!
users could pull their heads out of their asses and stop clicking on links in SPAM.
How do we know the link to the story isn't just a trick to get us infected?
Technology, the cause of and solution to all of life's problems.
A patch has just been released:
http://www.mozilla.org/products/firefox/
Let's not be hasty. True, I love Firefox, but IE is a giant honey pot out there for malicious attackers. If too many people switch, they'll start targeting Firefox. As much as I hate to admit it, they WILL find flaws to target.
After seeing this posted i checked my pattern files on the mail server.
Happy to see that ClamAV had the pattern files through a cron job 5+hours ago.
here at our company, we were hit w/ this virus a few days ago.. of course since IE is our standard browser.. well you get the picture.. anyway, the virus uses a few vulns.. one is the link spoofer and the spoofed link (in an email from the infected box which pulls any email addy it can to trick you) is a link to the infected box.. which then uses the noted vulnerabilty and the process repeats... so basically
You mean like how Apache is #1 for vulnerabilities because it's the most popular web server?
Man, if only there were some browser we could use instead of IE...
Oh well.
"It is seldom that liberty of any kind is lost all at once." -David Hume
SP2 not vulnerable... Upgrade or perish.
This isn't about this particular worm, but recently made it though my spam filters and IDS:
.rtf ending.
----
Re: my bill
From: [from address, probably spoofed]
To: [My adress]
Requested file.
+++ Attachment: No Virus found
+++ [Name of antivirus software] - [website of antivirus software]
bill.zip
-----
The zip contained a pif file with a
Particularly scary social engineering, since it claims to be from an anti-virus company that I'm actually familiar with.
Irene KHAAAAAAN!
A seemingly infinite number of flaws in a finite piece of code, this is quite an achievement.
I've been running Linux on my main desktop for years, and recently I've really been considering switching to Windows. After all, it's got some cool apps, and while I wouldn't call it "feature complete", I say they've done a good job of implementing many of the best features of Linux and OSX. However it's articles like this that convince me it's still a bit early to switch to Windows.
All told they've made some real inroads in servers, and the desktop experience is improving with each release (the current unstable branch -- AKA "XP" -- has implemented the theme concept long popular in KDE and Gnome!) however I think it's still premature to declare Windows ready for prime time on the desktop.
"Would it kill you to put down the toilet seat?" -- Maya Angelou
Beware of bugs in the above code; I have only proved it correct, not tried it. -Donald E. Knuth
>>Is this yet another good reason for running Firefox?
Or Windows XP SP2, which is not vulnerable.
What kind of imbecil runs XP but not SP2?
Woopsie! Slashdot forgot to mention the fact that this vulnerability has no effect on XP machines patched with SP2. Way to go Slashdot!
Tech, life, family, faith: Give me a visit
telling us to stop clicking on hyperlinks?
Microsoft should feel lucky that their crappy browser is being anal probed. by finding exploits like this they are forced to "improve" it. Improve might be a big word but imagine if there were exploits but no viruses/trojans/whatever, you would think that M$ would fix these exploited holes?
How can McAfee have a simple checkbox that turns on- bo-config.gif
buffer overflow protection:
http://vil.nai.com/vil/images/vse80i
I mean if my program has a buffer and I want
to overflow it have can they stop it. The screenshot mentions APIs so make it just knows about the Win32 APIs.
The *real* ironic twist to the story is that newer versions of McAfee VirusScan that Dell has been shipping requires Internet Explorer to be installed... and uses it to run the control center windows.
Now how's that for secure?
I may never, ever figure out the mentality of that decision.
until someone discovered a bug that redirects to a pwn3d auto-update site, click a button wait a few kb download and voila... Yeah that might not happen, but don't think it is out of the range of possibility...
There are a few design flaws in IE that make it a uniquely dangerous program to use to access the internet. These mistakes have, as yet, not been made by the Mozilla team. Perhaps we have learned a few things...
The largest problem (mostly the cause of spyware rather than viruses though) is the issue of ActiveX scripting. Because ActiveX controls are trusted on the basis of vendor signature, and because someone can force an old version to be downloaded and installed, it means that no security patch can protect you against a malicious site scripting against a bug in an ActiveX control signed by a trusted vendor. No security patch can be writte to do this without breaking *every* ActiveX control in the internet.
The second issue is that of security zones. This allows an attacker to exploit any flaws that come with the enforcement of such zones. This is an issue for viruses and spyware alike.
Now, it is possible that a new as yet unimagined sort of attack will eventually be possible against some type of functionality in Mozilla. At least one type has (XUL files spoofing interfaces), but if these become a problem, it is open source, and so you or anyone else can pay for somone to make a version with a different structure. If enough people switch, the process begins over again. But each time, I think we are safer.
LedgerSMB: Open source Accounting/ERP
For those who don't RTFA, XP SP2 doesn't appear to be vulnerable.
"Users who have installed Windows XP Service Pack 2 are immune to the programs that use the vulnerability, including the two new variants of the MyDoom virus."
Don't sell your friend a dream. Set his expectations realistically. No software is bulletproof. No software lacks security issues.
Hmmm.... I can think of one:
how about:
#include
int main(){
printf("Hello World!\n");
}
I dare you to find a security hole or other issue in that one! Probably better to say "it is unlikely that any nontrivial software will be without security holes or considerations."
I run Qmail, and it certainly has its security considerations (no holes though). Security issues with Qmail are admin issues, not programming vulnerabilities.
LedgerSMB: Open source Accounting/ERP
you're trusting your include to provide the expected behaviour from printf
you're trusting your compiler and linker to provide you with the expected behaviour from compiling and linking your source code
you're trusting the kernel to not modify the behaviour of the syscalls required to print
you're trusting the CPU to execute the instructions you think it executes
Reflections on Trusting Trust
Ken Thompson
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
An exploit affecting IE?! That's something you don't hear everyday.
Oh, wait...
Every time you post an article on Slashdot, I kill a server. Think of the servers!
IE is embedded everywhere in Windows, even when you bring up an HTML dialog box. Add/Remove Programs? DHTML. System Restore? DHTML.
:)
Windows Update? Active-fucking-X. So unless you move http://*.microsoft.com/ into trusted zone (ramped up to medium security), you cannot get security updates without enabling ActiveX download and scripting.
Even in WinXPSP2, there is still that trusted zone that gives unlimited rights. Like download unsigned activeX controls without prompting. There is nobody I'd give that right to, not even myself. Yet they have it.
Plus all the MSN content pushes AX at you. At least Expedia are not that daft; you can shop there with Firefox. But check out a pure MS site
like the channel9 developer site; ActiveX, windows everywhere. No attempt made to evangelise to the rest of us
No software is bulletproof.
You've never played Hatris for NES, Pipe Dream for NES, Faceball 2000 for Game Boy or Super NES, or Yoshi's Cookie for Super NES. All were published by a Japanese company called BPS, for Bullet Proof Software.
need i say more?
We are the Borg. Lower your trust levels and apply our patches. We will add your financial and technological distinctiveness to our own. Your culture will adapt to service us.