Slashdot Mirror
Zero-Day IE Exploit Takes Control of PCs
anethema writes "A remote IE exploit with implementations is currently in the wild. From the article: 'Exploit code for a critical flaw in fully patched versions of Microsoft Corp.'s Internet Explorer browser has been released on the Internet, putting millions of Web surfers at risk of computer hijack attacks.' Aparently all you have to do is browse the page to be affected. There is no patch, but since it is a JavaScript exploit, you can work around it by disabling JavaScript."
I use Firefox.
Remember when web browsers were just for viewing HTML pages, and not as a platform agnostic instant-rollout applications platform?
Yeah, me neither.
Seriously. I know that IE's market share is still huge, but for the life of me I can't understand why.
The smartest man in the whole, wide world really don't know that much. - Mose Allison
/evil on
/evil off
That'd be SO funny
Someday, an IE exploit is going to come along that wipes your HD. Then we'll see sparks fly.
WhiteWolf666 an exBush supporter. All you new-school,compassionate,save the children Republicans can rot in hell
Now, mod me whatever you want, but the info you provide should be FACTS.
Fact: A critical security flaw has been found in IE, and the SANS ISC is recommending that people use one of the "other browsers".
Howzat?
The opinion above is fiction. Any similarity to real opinions, including facts and logic, is purely coincidental.
So you'd deliberately and maliciously cause problems, just to prove you were on some imaginary moral high ground?
users do, but they're much further down the food chain
Except that regular users comprimise a greater number of Internet users. So if Joe Average uses IE, more people are going to be affected by this flaw.
we'll get the usual set of arguments about browser and OS supremacy.
If something has fewer security problems, isn't it "superior" in that respect?
If you can't trust Lynx to be secure, then really nothing is secure.
Right. Because if something has one flaw, then you might as well not even bother trying, because everything has flaws. I mean, just because IE has had double-or-triple-digit flaws, clearly this one flaw in lynx makes all arguments against IE moot.
What an inane comment.
Just when I'm considering using more AJAX stuff on my web site, along comes another in a long line of Javascript vulnerabilities. Maybe it's not time to do AJAX. Or to make it lock out IE browsers.
The next Cmdr Taco duplicate will be ready soon, but subscribers can beat the rush and see it early!
Take off the tin foil hat. The amount of work it would take to write such an exploit would be huge and would only get a tiny fraction of the market. There's no profit in it, there's no notoriety for it.
Why rob a bank? Because that's where the money is.
Why write viri for Windows/IE? Because that's where the users are.
-Rick
"Most people in the U.S. wouldn't know they live in a tyrannical state if it walked up and grabbed their junk." - MyFirs
In my network, we use group policies to enforce all computers browse the Internet at the high level. What happens when a user needs JS? Well they send the admin a email, and if the site is legit, we add to the global trusted sites...
/shrug felt good to say at least.
Block all, only allow what is legitimate.
A security principal we should be using... Whitelists are much better then black lists.
This vuln will only affect my network if one of the trusted sites gets infected, but that is a much reduced risk from the phishin emails etc with links to bad sites... I.e., like anything is only as secure as how the administrator configured it.
Now for home users.. Microsoft WHAT THE HELL ARE YOU THINKING
Fact: this bug was reported six months ago, but it is only now that someone has publicly shown how to use it to run arbitrary code.
Who knows how long other people have been exploiting this bug - potentially in ways not involving Javascript as well?
So please remind me again why I can't set javascript policy on a site by site basis in firefox?
You know, javascript on for some sites, off as the default.
"Because the first choice is ridiculously, brain-dead easy. That's why."
You are implying that the person breaking the law has an average level of intellegence. Haven't you seen "Maximum Exposure", "Real Police Videos", or any of the other caught on tape shows. They prove one thing, most criminals are dumb. True, there are a few gems in the rough, but by and large, the criminal element of society is not the brightest bulb in the box.
"Where's the notoriety in this? Oooh. I hacked a windows box. I'm so l33t."
Try, I hacked 3.4 million Windows boxes. I'm so l33t. I now have a bot network that can cripple massive pipes. Spam emails to millions of people per hour. Shut down major media outlets. Decimate online services (sales/games/gambling). Run distributed key cracking engines, etc.
Compared to: I hacked 20 debian boxes. I can flex my online epeen and spam an IRC channel!
CNN doesn't care about 20 nuebs who left their systems unsecured. CNN doesn't even care about Windows vulnerbilities. CNN cares about the monitary impact. So CNN will report on the person who creates a huge botnet and attacks high profile online organizations with it.
-Rick
"Most people in the U.S. wouldn't know they live in a tyrannical state if it walked up and grabbed their junk." - MyFirs
It won't exactly DOS Firefox - it just takes gecko an inordinantly long time (1-2 minutes) to render the 200,000 unicode characters on screen in this specific instance. The mozilla devs have already traced down the cause and are working on a fix. (Bug 317334 for those interested.)