Slashdot Mirror
Trojan Exploits Unpatched IE Flaw
onebuttonmouse writes "The Register reports on a trojan spotted in the wild that takes advantage of the so-far unpatched IE vulnerability mentioned on Slashdot earlier this week. From the article: 'The release of a Trojan that exploits an unpatched IE hole has prompted speculation that Microsoft may release an emergency out-of-cycle security patch. Delf-DH downloads other malware onto infected machines changing settings in order to monitor user activity and redirect surfers onto porn sites. The attack relies on a flaw in the way IE handles requests to the window() object.'"
The fix for this is here
Thank god I still use Mosaic. Hey, if it ain't broke...
We heard about this same sort of thing hundreds of times. The editors really need to read the articles more carefully...
You have two hands and one brain, so always code twice as much as you think!
"elf-DH downloads other malware onto infected machines changing settings in order to monitor user activity and redirect surfers onto porn sites."
So it is basically automated pr0n! From now on, you won't have to use your left hand.
and redirect surfers onto porn sites
;-)
Sounds more like a feature to me
"reality has a well-known liberal bias" - Steven Colbert
...or enable inactive surfing
He who knows best knows how little he knows. - Thomas Jefferson
Average joe search for p0rn
He fins a site with virus that gets installed on his computer.
Virus finds the pr0n for him....
Both win!
You mean that IE isn't 100% dedicated to perfect security?
I don't see the point of these announcements. People who care about not getting hacked are using Firefox, Opera, Safari or Lynx at this point.
People who still use IE... well... they probably won't do much in response to this warning anyway.
What are you eating? isItVeg?.
A trojan to redirect my browser to porn sites. I do that well enough without the assistance. *grin*
Apparently this wild trojan uses IE to direct a very specific type of attack against /., which results in dupe stories being posted!
You can't handle the truth.
"The Register reports on a [[register article|trojan spotted in the wild]] that takes advantage of the so-far unpatched IE [[|Slashdot story|vulnerability]] mentioned on Slashdot earlier this week."
That should be done like this:
"The Register [[register article|reports]] on a [[a page with the trojan|trojan spotted in the wild]] that takes advantage of the so-far unpatched IE [[How to exploit?|vulnerability]] [[Slashdot story|mentioned on Slashdot]] earlier this week."
Anagram("United States of America") == "Dine out, taste a Mac, fries"
So, if I run IE under wine on linux I can get all the free pr0n delivered to my desktop. Nice. Click the big blue "E" for free e-pr0n
Except that using Lynx tells the authorities that you are a malicious h4x0r...apparently, using a "non-standard" browser will cause the SWAT team to descend on you in true Terry GilliamBrazil style.
Hole in IE?
Exploited?
Must be a slow news week.
-judging another only defines yourself
Maybe they're selling the fix through the new anti-virus software?
Stop! Dremel time!
Would this be the 6 month old exploit that MS didn't feel was important enough to take care of? Complete Crap..
But one week is nothing compared to other vulns. Look at this list of other currently unpatched holes in MS products: http://www.eeye.com/html/research/upcoming/index.h tml.
Some of them has been reported months ago and are still unfixed.
This is inadmissible for a multi-billion dollars company.
could anyone point me to where I might pickup this gem of a virus? I'm a little bored and was hoping to "research" the auto-pr0n capabilities. Reinstalling IE now...
-Lod
Anyone else find it ironic that the page has ads for Microsoft "secure" network tools and trojan blocking? There was one when I first vied the page. I did a reload and it showed a different one on the same theme.
When will Windows be ready for the desktop?
The Sky is blue!
Bears still crap in the woods!
Amazingly, the Pope is Catholic!
I'm beginning to suspect that all these IE vulnerabilities are a marketing ploy. Let's face it, there's got to be 100 articles a week on IE vulnerabilities, keeping IE in front of everybody, while Firefox & Opera get so little coverage (except for maybe on /.). Of course if this is true, then it just goes to prove how genuinely stupid and useless marketing people really are...
GetOuttaMySpace - The Anti-Social Network
Before everyone gets too worked up bashing IE, as in the previous few articles on this exploit, let's remember that this problem was freezing/crashing FireFox 1.5 also.
Although the security threat isn't existent in FireFox, the browser still fails on these pages.
Now before I get flamed, let it be known that I think IE is a disaster and it's lack of standards compliance is one of the main things holding back proper advancment in web technologies, but we don't want to go and be unfair when our browser crashes too!
Big ones, small ones, some as big as yer 'ead!
Give 'em a twist, a flick o' the wrist...
What the article doesn't tell, is that sometimes, the virus redirects to goatse.
GAHHHH!!!!
Heheh. Just kidding.
The exploit never worked for me anyway, so I don't think I have anything to worry about ;)
One could make updating IE a full time job. It's rather annoying that you have to worry about this type of thing while browsing the internet.
[%] Cingular Ringtones
It's not a dupe, we just see so many of these kinds of stories that it SEEMS like a dupe.
"Live Free or Die." Don't like it? Then keep out of the USA
crumpetts and tea are compiled with the GB version ;-)
401 - Attention span not found
Oh right. OSX is perfectly safe and invunerable... so long as you patched a few unpatched critical security holes yesterday, and weren't previously infected...
p atches/2100-1002_3-5976718.html
http://news.com.com/Apple+releases+OS+X+security+
Apparently, Microsoft is preparing an emergency patch for this.
Some hacker kid got caught by his mom with the pr0n and had to write a virus to blame it on. I would condem his evil actions but I'm more upset I did not think of it first.
The perversity of the Universe tends towards a maximum. - O'Toole's Corollary
You know, if it were any other company than Microsoft, people wouldn't put up with such a thing. Microsoft selling anti-malware software would be like a car company forgetting to put brakes on their cars, and then charging for the fix! But a car company wouldn't be allowed to do that; they'd instead have to do a recall and fix the problem at their own expense. Why is Microsoft allowed to get away with it?!
"[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz
So, the vulnerability is 6 months old, and it never got fixed as a minor risk. It got escalated to a highly critical risk (by almost all security bulletin systems) over 1 week ago, when a proof of concept came out showing that a malicious site could cause take control of PC remotely. Now there is even malicious trojans out on the net exploiting this hole in IE.
So in 1 week, what did MS do? The promoted their new Live product of course. Microsoft released a security advisory stating that no patch exists to fix the problem, but you can visit the Windows Live Safety Center and get the trojan removed by Microsoft. So instead of using some resources to fix the problem, they instead devoted resources to their "anti-virus" software, and promote it as the workaround. Well, one wonders, if this causes them to get significant visibility and traffic to their new product, why bother even fixing the original problem?
"redirect surfers onto porn sites."
This doesn't sound like such a bad trojan afterall.
Amen.
Showing religious people how wrong they really are with constructive methods that helps our society grow would be better.
But i must agree that just blaspheming is funnier, more satisfactory, and will achieve as much as the method described above, since people is blind and stupid.
WTF am I doing replying to an AC at 5 A.M on a Friday night?
That's something i didn't understand. Why would you put copy protection on a CD nobody would copy?
;-)
On certain things sony has released, i would put burning and massive destruction protection
WTF am I doing replying to an AC at 5 A.M on a Friday night?
i really don't know of anyone still using IE besides the retards who run the technology in public areas that assume that anything besides microsoft's standard software setup is incompatible and compltely unusable.
"This is inadmissible for a multi-billion dollars company."
Strike that. This is inadmissible for a multi-billion dollar company who claims security is priority one.
see here. I'm tired of open source zealots who don't even understand that the software they used is not secure.
Vote for Pedro
In Microsoft Internet Explorer, porn finds YOU!
Rather laugh with the sinners than cry with the saints anyway, so there. BTW, why in the hell does anybody still use IE ?
Thanks slashdot, you've now reported this non-story 3 times.
... instead of maybe reporting every 5th problem.
How about we start reporting every little problem with non-MS products 3 times each
It's time for a little balance here!
George Bush + Linux = "I will not let information get in the way of the fight against Windows"
I think I have seen something like this before.
Somebody did the whole 'Jedi hand wavey thing on me'..."This is not the exploit you are lookin for."
Today's show is brought to you by the number 09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0: 25
maybe my english understanding is a little low today, or those vodka shots made effects, but i don't really understand your post ... please clarify ...
... well, the actual question would be why is people still using windows, but, then again, people still beleive that there is a supreme perfect being ... so, it's not suprising that most of the world still uses IE ...
About IE
WTF am I doing replying to an AC at 5 A.M on a Friday night?