Slashdot Mirror
Zero-Day IE Exploit Takes Control of PCs
anethema writes "A remote IE exploit with implementations is currently in the wild. From the article: 'Exploit code for a critical flaw in fully patched versions of Microsoft Corp.'s Internet Explorer browser has been released on the Internet, putting millions of Web surfers at risk of computer hijack attacks.' Aparently all you have to do is browse the page to be affected. There is no patch, but since it is a JavaScript exploit, you can work around it by disabling JavaScript."
I use Firefox.
Remember when web browsers were just for viewing HTML pages, and not as a platform agnostic instant-rollout applications platform?
Yeah, me neither.
From eWeek: The group that published the exploit said Microsoft has been aware of the Javascript Window() vulnerability for several months but was mistakenly treating it as a low-priority denial-of-service flaw.
Because anything that allows a malicious user to exploit your system and hijack isn't a flaw... it's a feature!
GetOuttaMySpace - The Anti-Social Network
Microsoft's total time of 0wnerzship continues to decrease.
Its important for MS to keep ahead in this area.
WhiteWolf666 an exBush supporter. All you new-school,compassionate,save the children Republicans can rot in hell
Seriously. I know that IE's market share is still huge, but for the life of me I can't understand why.
The smartest man in the whole, wide world really don't know that much. - Mose Allison
Ah, the Firefox of Opera - who is that, Pavarotti?
I use netcat.
-- MartinG To mail me: echo kewyjlcxyzvjfxbqwh | tr bcefhjklqvwxyz
No, the reason I'm saying it is that this being Slashdot we'll get the usual set of arguments about browser and OS supremacy. Again. It's like Groundhog Day!
Shucks, everything has security flaws. Yeah, some more than others. To be honest, I found it more of a shock that Lynx has a security flaw. If you can't trust Lynx to be secure, then really nothing is secure. Except unplugging your computer and putting it back in the box, perhaps.
Never email donotemail@WeAreSpammers.com
Now that you've read the comments, your Windows box belongs to OSTG. Please stand by while we load Linux.........
This sig isn't original enough, it's time to come up with something witty...
Well, there might be no customer impact at this time, but seeing as the exploit is published now, can I ask you again in about 5 minutes?
Drag n' Drop DVD Recommendations
The sun has risen this morning, and the Earth is rotating around its axis.
Nothing to see here - move along.
Make even shorter URLs - 8LN.org
I don't browse the web.
Be a real patriot: Question authority. Think for yourself. Formulate your own conclusions.
/evil on
/evil off
That'd be SO funny
Someday, an IE exploit is going to come along that wipes your HD. Then we'll see sparks fly.
WhiteWolf666 an exBush supporter. All you new-school,compassionate,save the children Republicans can rot in hell
This exploit exploits a vulnerability on a already found denial-of-service attack which Microsoft classified six months ago as "low-priority"...
The original article and the Slashdot headline are wrong. It's not a "zero-day exploit." The article itself says, "The group that published the exploit said Microsoft has been aware of the Javascript Window() vulnerability for several months but was mistakenly treating it as a low-priority denial-of-service flaw." A zero-day exploit is one that is discovered or revealed the day software becomes available, be it brand-new software, an update, a patch, or a service pack.
Wordnik, a dictionary project which aims to collect
Now, mod me whatever you want, but the info you provide should be FACTS.
Fact: A critical security flaw has been found in IE, and the SANS ISC is recommending that people use one of the "other browsers".
Howzat?
The opinion above is fiction. Any similarity to real opinions, including facts and logic, is purely coincidental.
So you'd deliberately and maliciously cause problems, just to prove you were on some imaginary moral high ground?
Will DOS Firefox. Not as bad as an exploit but they have issues to fix as well.
users do, but they're much further down the food chain
Except that regular users comprimise a greater number of Internet users. So if Joe Average uses IE, more people are going to be affected by this flaw.
we'll get the usual set of arguments about browser and OS supremacy.
If something has fewer security problems, isn't it "superior" in that respect?
If you can't trust Lynx to be secure, then really nothing is secure.
Right. Because if something has one flaw, then you might as well not even bother trying, because everything has flaws. I mean, just because IE has had double-or-triple-digit flaws, clearly this one flaw in lynx makes all arguments against IE moot.
What an inane comment.
Oh, wait... it just seems that way. Carry on...
What, no link?
Here you can test an exploit on IE: http://www.computerterrorism.com/research/ie/poc.h tm
--
http://tvilda.stilius.net/
Just when I'm considering using more AJAX stuff on my web site, along comes another in a long line of Javascript vulnerabilities. Maybe it's not time to do AJAX. Or to make it lock out IE browsers.
The next Cmdr Taco duplicate will be ready soon, but subscribers can beat the rush and see it early!
IE? I don't have that; I use Windows.
[an error occurred while processing this sig]
The holidays are a time for giving.
Now that you've RTFA, and you are now looking at the comments page, the staff of Slashdot and EWeek would like to thank you for visiting our web pages and giving us full control of your windows PCs.
Happy Holidays!
- Donny was a good bowler, and a good man.
Take off the tin foil hat. The amount of work it would take to write such an exploit would be huge and would only get a tiny fraction of the market. There's no profit in it, there's no notoriety for it.
Why rob a bank? Because that's where the money is.
Why write viri for Windows/IE? Because that's where the users are.
-Rick
"Most people in the U.S. wouldn't know they live in a tyrannical state if it walked up and grabbed their junk." - MyFirs
I am pretty sure MS anti-spyware will stop this from launching
He who knows best knows how little he knows. - Thomas Jefferson
Yes, for most it may be extremely easy. But in case you haven't had to do it for some time:
...Shamelessly stolen from here.
To disable JavaScript in IE, click Tools, Internet Options and choose the Security tab. Click the Internet icon, click the Default Level button, and move the slider to High.
Isn't Google's master plan to take over the world dependent upon people using AJAX? If IE has a critical flaw using javascript, and everyone has to turn it off, then nobody will be able to use Google's new products and... Hey wait a minute.
Best. Comment. Ever. Enjoy!
Would a worm do all that, or a clueless script kiddie? Probably not. As you say, there are too few dual-boot systems around. Bear in mind however that the Linux partition is still at risk from a malicious kiddie letting rip with fdisk.
But would a hacker do it? Yes, I think so. Especially if he'd just been directly challenged to do so by someone who thinks the wall between Windows and Linux in a dual-boot system is so impenetrable...
Real Daleks don't climb stairs - they level the building.
Since this exploit is critical in IE, and DoS's both Safari and Firefox, does anyone know if this bug also affects Opera 8.5?
Some think the Internet is a bad thing. I just think that AOL is a bad thing.
To be honest, I found it more of a shock that Lynx has a security flaw.
Why? I haven't looked at Lynx recently, but Lynx used to be a very insecure
browser - Lynx code had lots & lots of Buffer Overflows.
Sony's CD copy protection installs in your Windows machine a rootkit that renders invisible any file whose name starts with '$sys$'. :-(
The *nix joke "word^Wother" (also written "word^H^H^H^H") meant: i wrote "word", but repented and erased it (with one control-w or N control-h keys) and substituted it for "other".
The newly made Sony/Windows joke "$sys$word other" means: "word" becomes invisible and, just as in the unix case, I am saying "other" (when I really mean the harsher "word").
Funny thing is, it's not as funny when I explain it.
It's better to be the foot on the boot than the face on the pavement. ~~ tkx Kadin2048
Google for Portable Firefox and give it a try. Works just fine for me on all the school computers, without the hassles of getting the Microsoftophiles upset.
In my network, we use group policies to enforce all computers browse the Internet at the high level. What happens when a user needs JS? Well they send the admin a email, and if the site is legit, we add to the global trusted sites...
/shrug felt good to say at least.
Block all, only allow what is legitimate.
A security principal we should be using... Whitelists are much better then black lists.
This vuln will only affect my network if one of the trusted sites gets infected, but that is a much reduced risk from the phishin emails etc with links to bad sites... I.e., like anything is only as secure as how the administrator configured it.
Now for home users.. Microsoft WHAT THE HELL ARE YOU THINKING
Fact: this bug was reported six months ago, but it is only now that someone has publicly shown how to use it to run arbitrary code.
Who knows how long other people have been exploiting this bug - potentially in ways not involving Javascript as well?
Same on IE. Didn't seem to do anything on opera.
Not sure if crashing the browser can really be called an 'exploit'. Slashdot headline writers on crack again...
Sadly yes, it will use IE extensions to display the html (and associated) code. It is a hardcoded call to IE, not the default browser.
Much like following the HotMail link in MSN Messenger will launch a new IE window, despite having FF set as the default browser.
Um, you must be one hell of a Firefox fanatic to completely ignore the fact there have been serious published and previously unpatched (but now patched) vulnerabilities in Firefox before. Why the hell was this modded insightful? Now it may be true that Mozilla fixes vulnerabilities faster than the IE team, but this is an outright lie.
"Because the first choice is ridiculously, brain-dead easy. That's why."
You are implying that the person breaking the law has an average level of intellegence. Haven't you seen "Maximum Exposure", "Real Police Videos", or any of the other caught on tape shows. They prove one thing, most criminals are dumb. True, there are a few gems in the rough, but by and large, the criminal element of society is not the brightest bulb in the box.
"Where's the notoriety in this? Oooh. I hacked a windows box. I'm so l33t."
Try, I hacked 3.4 million Windows boxes. I'm so l33t. I now have a bot network that can cripple massive pipes. Spam emails to millions of people per hour. Shut down major media outlets. Decimate online services (sales/games/gambling). Run distributed key cracking engines, etc.
Compared to: I hacked 20 debian boxes. I can flex my online epeen and spam an IRC channel!
CNN doesn't care about 20 nuebs who left their systems unsecured. CNN doesn't even care about Windows vulnerbilities. CNN cares about the monitary impact. So CNN will report on the person who creates a huge botnet and attacks high profile online organizations with it.
-Rick
"Most people in the U.S. wouldn't know they live in a tyrannical state if it walked up and grabbed their junk." - MyFirs
Relevant links:- May/008466.html- 11-2005h tm
http://lists.seifried.org/pipermail/security/2005
http://www.computerterrorism.com/research/ie/ct21
http://www.computerterrorism.com/research/ie/poc.
Older versions of Norton AV leaked memory like crazy, but only when you ran a scan. The realtime protection was fine. You did need to reboot after a scan, however. Newer versions are either fixed or not so bad that I notice.
Socialism: a lie told by totalitarians and believed by fools.
Have you people not got the facts? Browsing the web using Microsoft Windows - and especially when using the excellent Microsoft Internet Explorer is proven to much more secure than using those namby-pamby, tree-hugging, communist hippy programs you can get, like that Linux thing and Firefox. I mean, no-one uses those things anyway, do they? I always make sure that I am fully patched, and that my anti-spyware and anti-virus programs and up to date. Every morning I check through my root-kit and trojan scanner reports, right after my defrag has finished. I know for a fact that this so-called exploit hasn't affected me in th [NO CARRIER]