Zero-Day IE Exploit Takes Control of PCs

anethema writes "A remote IE exploit with implementations is currently in the wild. From the article: 'Exploit code for a critical flaw in fully patched versions of Microsoft Corp.'s Internet Explorer browser has been released on the Internet, putting millions of Web surfers at risk of computer hijack attacks.' Aparently all you have to do is browse the page to be affected. There is no patch, but since it is a JavaScript exploit, you can work around it by disabling JavaScript."

Comments

Firefox

[jsmucker]

Easy fix...Firefox http://www.mozilla.org/products/firefox/

Zero-day? No.

[MoNickels]

The original article and the Slashdot headline are wrong. It's not a "zero-day exploit." The article itself says, "The group that published the exploit said Microsoft has been aware of the Javascript Window() vulnerability for several months but was mistakenly treating it as a low-priority denial-of-service flaw." A zero-day exploit is one that is discovered or revealed the day software becomes available, be it brand-new software, an update, a patch, or a service pack.

Re:Zero-day? No.

[Anonymous Coward]

It is a 0day exploit. The vuln was previously released months back, but at the time it was thought to DoS(not a remote exploit). But information released today shows that this vuln can be exploited remotely. So it is 0day.

BTW the POC is here
http://www.computerterrorism.com/research/ie/poc.h tm

Start the slashdotting....

Re:Zero-day? No.

[Anonymous Coward]

urm no, that's the definition for "zero day" in the warez scene.

In the security world any exploit for a vulnerability which is unknown to the community (be that a commercial or a foss community) is a zero day exploit. Admins have zero days to patch their systems.

Be that as it is, it's still not a zero day exploit, but that's because the vulnerability was known, not because it's existing software.

Re:Zero-day? No.

[Anonymous Coward]

No.

A zero-day exploit is one that takes advantage of a security vulnerability on the same day that the vulnerability becomes generally known. Ordinarily, after someone detects that a software program contains a potential exposure to exploitation by a hacker, that person or company can notify the software company and sometimes the world at large so that action can be taken to repair the exposure or defend against its exploitation. Given time, the software company can repair and distribute a fix to users. Even if potential hackers also learn of the vulnerability, it may take them some time to exploit it; meanwhile, the fix can hopefully become available first.

Re:Zero-day? No.

[Anonymous Coward]

The parent's statement is mostly false. The "zero-day" in "zero-day" exploit refers to a software bug of which the vendor and the networked public at large are unaware. It has nothing to do with the date of release of the software. However, the parent is correct in stating that the exploit is not zero-day because it is described as "known".

Re:I'm glad to see that

[xtracto]

It is Total Cost of 0wnership =-)

This code

[paranode]

Will DOS Firefox. Not as bad as an exploit but they have issues to fix as well.

Re:Link to a copy?

[tomasvilda]

Here you can test an exploit on IE: http://www.computerterrorism.com/research/ie/poc.h tm -- http://tvilda.stilius.net/

Re:This is why...

[nyc_paladin]

And use the NoScript extension https://addons.mozilla.org/extensions/moreinfo.php ?application=firefox&id=722

Re:I hope this gets into a doubleclick ad

[Xarius]

I know he's considered as a bit of a prick, but ESR explains exactly why this would be one of the worst things that could happen here.

Make of it what you will.

How to disable JavaScript

[Rinnt]

Yes, for most it may be extremely easy. But in case you haven't had to do it for some time:

To disable JavaScript in IE, click Tools, Internet Options and choose the Security tab. Click the Internet icon, click the Default Level button, and move the slider to High.

...Shamelessly stolen from here.

Re:Is there a tenor in the house?

[Killjoy_NL]

Could have been written by a dutch guy since of=or in dutch :)

Re:I don't care

[meringuoid]

Take off the tin foil hat. The amount of work it would take to write such an exploit would be huge and would only get a tiny fraction of the market. There's no profit in it, there's no notoriety for it.

Would a worm do all that, or a clueless script kiddie? Probably not. As you say, there are too few dual-boot systems around. Bear in mind however that the Linux partition is still at risk from a malicious kiddie letting rip with fdisk.

But would a hacker do it? Yes, I think so. Especially if he'd just been directly challenged to do so by someone who thinks the wall between Windows and Linux in a dual-boot system is so impenetrable...

Duh! (+1, informative)

[hummassa]

Sony's CD copy protection installs in your Windows machine a rootkit that renders invisible any file whose name starts with '$sys$'.
The *nix joke "word^Wother" (also written "word^H^H^H^H") meant: i wrote "word", but repented and erased it (with one control-w or N control-h keys) and substituted it for "other".
The newly made Sony/Windows joke "$sys$word other" means: "word" becomes invisible and, just as in the unix case, I am saying "other" (when I really mean the harsher "word").
Funny thing is, it's not as funny when I explain it. :-(

Re:Duh! (+1, informative)

[Omega697]

What he meant was that there were 4 ^W's and when you erase 4 words you wind up with the nonsensical statement in his post.

Re:Duh! (+1, informative)

[Anonymous Coward]

Way to over-explain the joke that everyone already got, chuckles. He was just pointing out that there were only 4 ^W characters instead of the 5 that would be required for the statement to make sense.

Re:Duh! (+1, informative)

[mazarin5]

Oh, I got it.

The "^W" control character deletes the preceding word, not character. This distinguishes from "^H", which deletes only the preceding character, thus they aren't interchangable.

If you notice, I quoted you with the four words preceding "^W^W^W^W" deleted, as if the "^W"s had actually had an effect on the sentence. That made your sentence incomplete, and therefore nonsense.

Therefore "Huh?".

Granted, it wasn't worthy of Mark Twain, but it was meant to be humorous.

Re:Opera affected too?

[porneL]

Not affected. I've tested <body onload="window();"> and nothing happens besides JS console logging "Statement on line 1: The Object does not implement [[Call]]".

Re:Link to a copy?

[Trip Ericson]

Google for Portable Firefox and give it a try. Works just fine for me on all the school computers, without the hassles of getting the Microsoftophiles upset.

Re:lazy story submitters

[tpgp]

Here you go

Re:Link to a copy?

[Tony Hoyle]

Same on IE. Didn't seem to do anything on opera.

Not sure if crashing the browser can really be called an 'exploit'. Slashdot headline writers on crack again...

Re:HTML in Outlook Affected?

[GuanoTO]

Sadly yes, it will use IE extensions to display the html (and associated) code. It is a hardcoded call to IE, not the default browser.

Much like following the HotMail link in MSN Messenger will launch a new IE window, despite having FF set as the default browser.

Re:If a problem like this was found in Firefox...

[Maian]

Um, you must be one hell of a Firefox fanatic to completely ignore the fact there have been serious published and previously unpatched (but now patched) vulnerabilities in Firefox before. Why the hell was this modded insightful? Now it may be true that Mozilla fixes vulnerabilities faster than the IE team, but this is an outright lie.

Re:Ouch.

[springbox]

I may be a nerd, but I like to think of my page design [andreweckford.com] as "clean" and "fast-loading", thank you very much.

Import a CSS on every page and you can get a nicer looking layout with little cost. "Small in size" and "fast loading" does not necessarily mean "default color scheme."

Re:Give it 5

[Anonymous Coward]

This is the code for Google Analytics. http://www.google.com/analytics/ There's nothing to see here.

Links

[Sheepdot]

Relevant links:
http://lists.seifried.org/pipermail/security/2005- May/008466.html
http://www.computerterrorism.com/research/ie/ct21- 11-2005
http://www.computerterrorism.com/research/ie/poc.h tm

Re:Link to a copy?

[Anonymous Coward]

Firefox 1.0.7
Windows XP SP2
Extensions: IETab, Web Developer Toolbar

Nothing visible happened. No slowdown occurred. No programs were launched. The Javascript console logged an error: "Error: runpoc is not defined".

Re:This is why...

[zachdms]

Check out DropMyRights - should be exactly what you want.

Re:Advice for not getting this virus

[lgw]

Older versions of Norton AV leaked memory like crazy, but only when you ran a scan. The realtime protection was fine. You did need to reboot after a scan, however. Newer versions are either fixed or not so bad that I notice.