Slashdot Mirror
IE Vulnerable to Cross-Browser Spyware Attack
An anonymous reader writes "The Register reports that Firefox can be used to infect IE on Windows. By visiting a malicious site with Firefox, a user can infect their install of Internet Explorer. Other alternative browers may expose the same vulnerability. The article quotes the CTO of ScanSafe as saying that '[j]ust switching away from IE does not give adequate projection. Now that Firefox and other alternative browsers have a toehold in the market the hacking community will get busy exploiting the vulnerabilities that exist in any complex browser.'" VitalSecurity's report points out that this vulnerability can (only) affect Windows users who use Sun's Java Runtime Environment.
It will be interesting to see if there is the usual 24 hour turnaround on a fix for this from the Mozilla Foundation. Lord knows Microsoft probably won't lift a finger to fix it.
FoundNews.com - get paid to blog.,
The article title/summary focuses more on how IE is to blame rather than the real root of the problem, which appears to be Java. I realize this is Slashdot and its Microsoft, but come on.
from the if-you-must-run-windows-remove-ie dept.
f ault.aspx
Really? The microsoft website oftens blocks browsers other than IE from downloading updates and whatnot.
You CAN'T just remove IE. You need it. Just try to update office on firefox for example:
http://office.microsoft.com/en-us/officeupdate/de
That's the point isn't it, though. Crappy software is installed.. spyware comes as an infection. When will we acknowledge that these spyware writers are writing viruses which infect and damage people's systems through backdoor hacking techniques?
Why are the authors not prosecuted?
I have been a user for about 10 years. This ends Feb 2014. The site's been ruined. I'm off. Dice, FU
It's important to identify that this is not a Sun JRE thing, but a user error thing!
Any time a website asks you to trust them to install something on your computer, you should probably say no. If you say yes, you are going to get owned 99% of the time.
Actually, the title of tfa should be "Firefox vulnerability could provide access to IE". The problem is Firefox or Java, not IE.
If an exploit asks you to run it, does it still count as a security exploit? It's not taking advantage of anything other than the users own stupidity/ignorance if they get infected by it. Similar to those email viruses you have to oepn the atached zip, enter the password and then run the exe to get infected by.
Fly me to the moon Let me sing among those stars Let me see what spring is like On jupiter and mars
To me this sounds like a Java exploit and not something you can pin on either IE, Firefox or any other browser. It would be pretty lame to demand that Firefox should protect IE from a Java exploit, yes?
HTTP/1.1 400
... and unfortunately, the system default is to have Java enabled, and the user default is to answer "Yes" to any dialog boxes popping up while browsing the web.
Beware: In C++, your friends can see your privates!
No way, RTFA.
Firefox warns the hell out of you about allowing a signed, but unverifiable applet from installing itself. Look at the screenshot, there's three separate big warning images.
If the web browser lets you download and install software, even if it warns you that doing so might be dangerous, the author contends this is a bug. That's silly. That's the *point* of a web browser. To download content from the internet.
The security warning explicitly states, "The security certificate was issued by a company that is not trusted".
I mean, what do people expect? A little hobgoblin to pop out of their computer and whack them in the head with a mallet if they try to click 'yes'?
It's simple: I demand prosecution for torture.
you're assuming that people read these warnings. i think it's fair to say that a goodly number of users are in fact not really reading them. maybe the little hobgoblin wouldn't be such a bad idea after all... :>
ed
This is infecting the machine using a signed applet. Hello? I can do anything I want to your pc if you allow a signed applet to run. This not news. I can install a trojan, key logger, back door, whatever. Infecting IE is the least of someones problems if they allow signed applets from untrusted sources to run.
the user default is to answer "Yes" to any dialog boxes popping up while browsing the web.
That's true, and is why I don't believe that any OS or browser is going to save us from malware. Until the average user learns safe computing practices, they're going to continue installing stuff they later wish they hadn't; in time even if they do stop running as admin, they'll get used to typing in their admin (or root) username and password.
It's official. Most of you are morons.
As other people have noted, you still have to say "yes, bone me". But people don't expect a Java applet (since it's normally firewalled) to be dangerous, so they're more likely to say "yes".
If allowing an unrestricted Java applet to run is just as dangerous as installing and running an application, then the dialog box should reflect that. If Firefox is going to make you manually approve sites that you're going to allow XPI installs from, and *then* run a countdown in the warning dialog, they need to be at least as thorough about any other operation that takes you outside the sandbox.
... and after you click "Yes" to the warning, you have granted the Java code permission to modify anything on your hard drive. So, the fact that it modifies IE is really incidental. It could just as easily modify Firefox, Mozilla, OpenOffice.org, Thunderbird, emacs, gcc, and any other application it wants to.
A better title for this article would have been "Every application vulnerable to attack due to bug in either Firefox and/or Sun's JRE".
Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.
The user has seen enough web dialogs to know that when you see one, you click yes. If you try to read them all you'll go mad, if you click no that cool game bob told you about doesn't work. So you click yes on everything.
I am trolling
No this is not really a Java issue either. This is a social engineering issue.
The JRE pops up it's "Warning" dialog, like its supposed to . It displays to the user that it cannot verify who signed this, that the cert is out of date etc, like its supposed to . It displays a warning reccomending that you NOT say yes and install the applet, like its supposed to . So when you ignore all of that and say yes, you deserve to get infected. I mean, what do you want, another dialog asking "Are you sure?".
I mean 3 big yellow exclaimation marks? I've never seen that even in the most unstable of development environments.
Oh and BTW, if you say yes to a Java applet in this instance, it runs as a local application without a security manager. This is not a 'hole' it is what it is supposed to do. When you say yes, that's what you're saying 'yes' to.
Now if people were taught not to do that the same way their are taught not to run arbitrary files sent to them via e-mail, this wouldn't be a problem. (That's sarcasm BTW)
In the end, the problem is the goof behind the keyboard that is willing to say 'Yes' to run applications they don't know about and that the JRE itself warns them at least 3 times in 3 ways not to run.
How do you defend against that?
Never by hatred has hatred been appeased, only by kindness - the Buddha
I'd say it really has very little to do with Java, it's nothing more than ActiveX controls do in IE all the time. If a user clicks "yes" in a security warning dialog box, then the code can do whatever it wants. It's not a bug, it's working how it's designed. The "bug" that they claim is that the computer will let a user do something dumb.
Since you asked...
Create a dialog box with all the warnings. Give it an OK and a Cancel button. Closing it or clicking Cancel always causes the applet not to run.
Give is a checkbox, that says "Allow this potentially dangerous applet to run without security restrictions." Leave it unchecked.
Clicking OK while it's unchecked also causes the applet not to run.
Now the user can't accidently click yes, as two clicks are needed to unlock the applet. You can't accidently make the user install the applet by typing "Y" when the dialog suddenly pops up.
That's how all these "do something insecure" dialogs should be. I should have to explicitly check off "OK" and then hit the "Accept" button. That includes Firefox's XPI install system, which the site mentioned also tries to exploit.
I thought Java Applets run in a sandbox and can't modify local files.
They can't, unless the user clicks "I allow this applet to modify files on my harddrive. Warning, this is unsafe, only do this with applets coming from a source you trust."
This isn't a java exploit anymore than a downloaded executable is an OS exploit.
Being bitter is drinking poison and hoping someone else will die
A nice intelligent choice with WinNT was the "Press Alt-Ctl-Delete" to login.
Since applications shouldn't be able to hijack that combination it adds additionaly security.
You can have a lot of fun with micking login boxes. Back when I was in uni we'd screw around with each others laptops. I got a terminal window on a friends machine and aliaed the su command to a perl script which would prompt for a password, send the password to my webserver, tell the user it was wrong, and then unalis the command so the next try would go to the real su.
Easy to do, but you'd have to be very on top of things to spot it.
It's been a long time since I worked with Java code, but I recall that once the user tells Java he "trusts" the code, (signed or unsigned), he opens himself up to a number of risks, including accessing the local filesystem and making network connections to hosts other than the host from which the applet was downloaded. This would, of course, include HTTP calls, probably using the installed default browser. I don't know about executing local programs.
So, while this may have been an exploitation of MSIE, the fact remains that it would never have occurred had the user not agreed to trust the applet. This is why it's important for developers and sites to sign their code, but more importantly, it shows the importance of embedding into end-users' brains: "Never, never, never click 'yes' when the application tells you the code is untrusted."
"Who controls the past controls the future. Who controls the present controls the past." -- George Orwell
So you are telling me that someone found a way to get into a system with java, and - once there, found that it was actually more effective to try to break IE than the browser actually being used? Doesn't that sort of blow the popularity vs. intrinsic insecurity argument out of the water? I mean, the user is running firefox, right? The argument of what they are likely to use (and therefore be affected by) has pretty much been resolved at that point.
This sounds like a FUD factory somewhere is trying to come up with vulnerabilities against Firefox. Interesting that the best they can come up with so far is an exploit of IE. "Hey, wait, guys, we can make this one run with another browser! Let's run with that!"
The Giant DUH! Award goes to VitalSecurity.org, quite possibly the dumbest security company ever.
At the end of his blog, the author says that the purpose of his article is NOT to point out the social-engineering aspects of this exploit, but to point out that "most spyware installs occur when someone clicks "yes" to something they shouldn't have."
DUH!!!! What a total maroon.
Let's review. The user is presented with a dialog box that warns them, 3 times, that this thing can't be trusted, but they click 'Yes' anyway.
This is not a Firefox exploit. It is not an IE or Java exploit. It is a USER STUPIDITY exploit.
However, I do see the problem MS faced. If they made system hooks too restrictive, it would realy hurts third party programmers that needed a system service to start up without a user login. So, ofcourse MS picked the most lucrative path, instead of the most secure ; )
If Tyranny and Oppression come to this land,
it will be in the guise of fighting a foreign enemy. -James Madison
You can't fix a behavioural problem with a technological solution.
Not trying to nitpick, but this is incorrect. It comes out on slashdot on awful lot (particluarly in relation to spam). It is better said as: "You cannot fix every behavioural problem with a technological solution."
Using another car example, switching the car off while the lights are on makes the car beep. This, in my experience, has largely solved the problem of leaving the lights on and getting a flat battery.
I am not certain if this has had the same effect in the wider population, but it is an example of where a behavioural problem of mine has been fixed by technology.
meh
Oh pu-leaze.... If MS had made the system hooks restricted, programmers would have been climbing the walls over how MS locked everyone out of the OS and slashdotters doing the same "MS sucks and this is why *nix rules". Complain about one or the other, but MS got it right on this decision.
And just to keep on topic, I wish everyone would get off this "IE sucks" trip. IE is part of the OS now... this crap doesn't infect IE anymore, it infects Windows. Now, lets change all these little rants I see all over this post. User goes to a webpage. Firefox gets to a Java applet and passes control to the JRE. JRE asks 3 times if they want to continue, and the user clicks "Yes" (because that is what they have been trained to do) and Windows gets infected. This isn't a software exploit. This is a user (ie. idiot) exploit that was not anticipated by Sun. If Sun would change their warning dialog to make someone put a checkmark in a box to accept instead of just clicking "Yes", this wouldn't happen. But again, not Sun's fault, but something that could easily be fixed by them.
User logging on... 300 baud... 300 BAUD?!? (Click!) NO CARRIER