Slashdot Mirror
Trojan Exploits Unpatched IE Flaw
onebuttonmouse writes "The Register reports on a trojan spotted in the wild that takes advantage of the so-far unpatched IE vulnerability mentioned on Slashdot earlier this week. From the article: 'The release of a Trojan that exploits an unpatched IE hole has prompted speculation that Microsoft may release an emergency out-of-cycle security patch. Delf-DH downloads other malware onto infected machines changing settings in order to monitor user activity and redirect surfers onto porn sites. The attack relies on a flaw in the way IE handles requests to the window() object.'"
The fix for this is here
We heard about this same sort of thing hundreds of times. The editors really need to read the articles more carefully...
You have two hands and one brain, so always code twice as much as you think!
"elf-DH downloads other malware onto infected machines changing settings in order to monitor user activity and redirect surfers onto porn sites."
So it is basically automated pr0n! From now on, you won't have to use your left hand.
and redirect surfers onto porn sites
;-)
Sounds more like a feature to me
"reality has a well-known liberal bias" - Steven Colbert
Average joe search for p0rn
He fins a site with virus that gets installed on his computer.
Virus finds the pr0n for him....
Both win!
Disable what? Enable what? IE should be secure, I shouldn't need to work around it.
Guy asked me for a quarter for a cup of coffee. So I bit him.
Apparently this wild trojan uses IE to direct a very specific type of attack against /., which results in dupe stories being posted!
You can't handle the truth.
I was trying to say that Microsoft should never offer this as a patch - it's not a patch, it's just turning off functionality, akin to fixing a leaky pipe by disconnecting the water. (Though as a temporary fix, it works)
Guy asked me for a quarter for a cup of coffee. So I bit him.
"The Register reports on a [[register article|trojan spotted in the wild]] that takes advantage of the so-far unpatched IE [[|Slashdot story|vulnerability]] mentioned on Slashdot earlier this week."
That should be done like this:
"The Register [[register article|reports]] on a [[a page with the trojan|trojan spotted in the wild]] that takes advantage of the so-far unpatched IE [[How to exploit?|vulnerability]] [[Slashdot story|mentioned on Slashdot]] earlier this week."
Anagram("United States of America") == "Dine out, taste a Mac, fries"
So, if I run IE under wine on linux I can get all the free pr0n delivered to my desktop. Nice. Click the big blue "E" for free e-pr0n
Their reply would be: you really don't need the water anyway.
He who knows best knows how little he knows. - Thomas Jefferson
But one week is nothing compared to other vulns. Look at this list of other currently unpatched holes in MS products: http://www.eeye.com/html/research/upcoming/index.h tml.
Some of them has been reported months ago and are still unfixed.
This is inadmissible for a multi-billion dollars company.
Oh gods... if it ain't broke, it ain't Mosaic.
I have seen the future, and it is inconvenient.
The Sky is blue!
Bears still crap in the woods!
Amazingly, the Pope is Catholic!
Before everyone gets too worked up bashing IE, as in the previous few articles on this exploit, let's remember that this problem was freezing/crashing FireFox 1.5 also.
Although the security threat isn't existent in FireFox, the browser still fails on these pages.
Now before I get flamed, let it be known that I think IE is a disaster and it's lack of standards compliance is one of the main things holding back proper advancment in web technologies, but we don't want to go and be unfair when our browser crashes too!
Big ones, small ones, some as big as yer 'ead!
Give 'em a twist, a flick o' the wrist...
And yet when someone suggests a firefox extension as a fix for something, that's all well and good.
I am trolling