Slashdot Mirror
Two Unofficial IE Patches Block Attacks
Pentrex writes "eWeek reports that two well-respected Internet security companies (eEye and Determina) have released unofficial patches to correct the vulnerability being exploited to load spyware, bots and Trojan downloaders on Windows machines. Microsoft isn't sanctioning the third-party patches, which include source code for review. As always, the advice is to weigh the risks before opting for an unofficial hotfix."
Why doesn't Microsoft just tell people to switch to Ubuntu and use Firefox? It would save them a hassle and a lot of work.
There's two other patches out there that work pretty damn well:
1 and 2.
The question is, would people patch if they had to pay for them?
0xB315AA8D852DCD3F3DCA578FD2E0BF88
As always, the advice is to weigh the risks before opting for an unofficial hotfix.
Is this not something that smart admins/companies so even with official patches and fixes? To me, the fact that the source was released shows that these people are quite serious about being taken seriously. I suppose that is better than MS assurances that they extensively tested the fix before release.
I don't even understand how they manage to *write* third-party patches. I mean, it must be hard as hell to do without the IE source code. I think they write a separate DLL which acts as an intermediary to the flawed insecure library or something, but it sounds like an enormous pain-in-the-ass process. Or do these companies have access to MS code through Shared Source program or something?
Yep, the more I watch the ills that befall the Microsoft-bound, the more I'm happy with my decision to go Linux-only a few years back.
My bicyles
Of course, I'll probably be retired before they're out.
-- Tigger warning: This post may contain tiggers! --
Certainly you should weigh the risks with any patch but since an "official" patch would come from the originators of the flaw (and numerous others) why should it be considered any better than an "unofficial" patch? At least these patches can be scrutinized by the outside world for problems. A MS patch will be forever hidden. The perils of closed source!
Given the fact that the average IE user would not even be aware of the flaw, how would he even know such third party patches even exist?
Most of them are going to be patched only when MS releases the patch, AND they have selected to be updated automatically.
Its a horrible situation.
http://en.wikipedia.org/wiki/Internet_troll
"The term troll is highly subjective. Some readers may characterize a post as trolling, while others may regard the same post as a legitimate contribution to the discussion, even if controversial."
While you may not percieve what I said as funny. I was sincere in what I said... Well not about the use Ubuntu part.
I guess the only valid reason for Microsoft to continue the development of IE is for:
1. Branding purposes.
2. And so that they can claim Windows is a totally integrated package.
If third parties can regularly patch your bugs before you do, without access to the source, after giving you a generous head start... Well, I guess that could mean a lot of things. They're definitely lazy, to say the least.
Are there likely to be any conflicts or issues when Microsoft issues official patches that overwrite or only partially overwrite changes the patch made?
"I don't even understand how they manage to *write* third-party patches."
Ask the people who do this. I'm certain they managed fine without source code.
Who exactly is going to be using these patches? Think about it for a moment, since when did security savvy computer users, let alone experts, use IE?? True they may fire it up to go to a specific site or two that requires it or works better with it, but for general surfing? I don't think so. Anyone with the good sense God gave the common radish is using Mozilla, Firefox, Opera, or in the case of Macs Safari.
I can see a use for these patches in a corporate environment where (for whatever reason) IE is a necessary evil, but even then you're running the risk of getting smacked (if not sacked) by management if the patches break something.
These patches are realy useful for one thing, showing up Microsoft and making them look like incompetent boobs whose code is such a mess they can't fix it. Given the delays on Vista I'd say this perception is pretty accurate.
Lee
Muslim community leaders warn of backlash from tomorrow morning's terrorist attack.
because their Security division is too busy criticizing Apple's security problems rather than writing IE patches (or writing secure code in the first place).
I have installed the eEye patch and it does fix the IE ActiveScript hole temporarily, however it is recommended to disable Active Scripting anyways. Now, it is still undetermined how serious this threat actually is, or if it's a big marketing opportunity for eEye's products. I'll assume the former until further notice. The number #1 solution is to simply not use IE.
There are 10 types of people in the world; those who can read binary, and those who can't.
I mean, it's written by the guy who wrote the patch!!! How much of a better post can there be???
I had our IT department test and deploy the silent installation this morning. We're a web-based software company and there's been zero reported impact to our development staff as 6pm EST.
While it's clearly not the best solution, it does work and provides a much needed layer for the vast majority of corporations who simply cannot and will not disable active script.
Microsoft releases one patch day a month because their corporate customers, the lion's share of their market, demand it. And they demand it because "release a million little patches as soon as that individual patch is done" is unworkable in a corporate environment. You can plan around one big patch a month -- the magic word is "scheduled downtime". It is less bad for some customers to be periodically marginally more vulnerable for a period of two weeks or so then to be continusouly vulnerable to unscheduled downtime due to patching. "Publish early and often" works well with an enthusiast running one machine but when you've got an IT department overseeing a cast of thousands spread over 14 time zones things get a little more dicey.
Help poke pirates in the eyepatch, arr.
Anybody who has the ability to weigh risks is already using firefox.
Do you have ESP?
Of course, Microsoft and other vendors always get their patches correct the first time.
Seriously... anyone?
the patch fixes the affected DLL in memory by overwriting a byte that is stored in RAM for MSHTML.DLL this begs a freaking question, should a modern OS even allow some application to modify behaviour of another application in memory, especially behaviour of a system level application, an OS DLL? I believe the patch needs to be installed from an administrator account, but even then, this doesn't mean that it is good design decision, to allow an arbitrary application to overwrite in memory code of another application. Of-course if that wasn't possible this specific patch couldn't exist, but still, the OS allows questionable application behaviour to say the least.
You can't handle the truth.
Does anyone remember the previous third-party patch to IE? This is from December of '03.
The Online Slang Dictionary
...to let others clean up the messes it has made.
...than the code written by the Windows Vista team.
It would be interesting to see microsfts official patch when it becomes availible and attempt to see how close it is to these unofficial patches.
Maybe the code would be completley different but would it achieve its goal by going about the same ways as the unofficial patch? Or would it be patched on a level deeper then we could access. I guess the most interesting part would be that a third party without access to the source code could actualy come together with a solution before microsoft. What would be more interesting is seeing how close those solutions match match each other. Sort of a test to how these third party programers can predict the neccesity or orders of different code they only have limited access to.
For x86 assembler, Intel is a good source of information: http://www.intel.com/design/Pentium4/documentation .htm#manuals. You'll want to check out volumes 2A and 2B at a minimum for reference material.
I would be surprised if Alexander used the Visual Studio debugger; more likely he used SoftICE or one of the Windows debuggers (NTSD/CDB/KD/WinDbg). SoftICE is a commercial product sold by Compuware and provides both user-mode and kernel-mode debugging. A version of the NTSD debugger comes with Windows, but is less useful than the one that comes with Debugging Tools for Windows. NTSD and CDB provide user-mode debugging, the only difference between the applications being that NTSD opens a new console window and CDB does not. KD is the kernel debugger. WinDbg provides the same functionality as NTSD/CDB/KD but with a (spartan) Windows interface.
Does no one remember this whole MS mess just a series of patches on DOS anyway? What risk when you've already gone this far?
Wowzorz. Newer operating systems are not "bug fixes" for older ones. Believe it or not, Windows XP has a few more features over 3.1...
DATABASE WOW WOW
Just a little Grammar Tip: "affect" and "effect" can both be nouns or transitive verbs.
Maybe Computers will never be as intelligent as Humans.
For sure they won't ever become so stupid. [VR-1988]
"There is NO such thing as patching binary."
Haven't you ever used a decompiler or a hex editor???
Time is an illusion. Lunchtime doubly so. - Douglas Adams
It is kinda sad when a multi-billion dollar company needs unofficial companies/people to make up for their inadaquecies... Oops, almost forgot about anti spyware, anti virus, system rescue, etc products...
These patches might include the source code, but it's the source for the code that modifies mshtml.dll (or whatever). It is NOT the source for the updated mshtml.dll.
Heck, I've patched libraries with sed and edited binaries with Emacs. It's certainly possible, although I did have root priveleges to do it, and this predates SSH. It even predates ddd and X-Windows!
slashdot would be packed with cries of "who would actually run this?!" "wtf, no source? no thanks".
It would actually be more like:
- Yes, but does it run on Linux?
- I, for one, welcome our undocumented overlords.
- In Soviet Russia sources release You.
- In North Korea, only old people patch IE vulnerabilities.
Defining Statistics and Social Research
-Eric
SJW: Someone who has run out of real oppression, and has to fake it.
And how do you propose that warez groups released patched "no-cd" versions of game executables?
B inary_software
Do you think they hack the developer's intranet and steal the source code?
Read up: http://en.wikipedia.org/wiki/Reverse_Engineering#
Registered Linux user #421033
I certainly won't get unofficial patches if I'm not even using IE. I mean, I download the official patches just in case, but I'd have to be pretty desperate to install an unofficial patch.
I wonder how this makes Microsoft feel, and imagine the embarassment from having 3rd parties release hot fixes (work arounds, or patches) before your release cycle.
It's like the security community is slapping them in the face and saying that their current model of using patch cycles is not good enough for threats on todays internet.
In my opinion this makes Microsoft look very bad, this is that I know of the second time a patch has been released for an MS product before an official fix release.
And they even produce sourcecode for community scrutiny/review.
To eEye and others making these patches for MS products, thanks guys for making sure my parents don't get inundated by malware.
I am Bennett Haselton! I am Bennett Haselton!
Others have mentioned the normal reason, that being the issue with patches being reverse-engineered in order to generate an exploit. Of course, that doesn't apply in a situation such as this, where we ALREADY HAVE AN EXPLOIT.
;)
Work in a large enough company and you'll find the real reason: politics.
If Microsoft sticks to their once-a-month patch schedule, and your network gets hosed before the patch comes out, you can use the excuse "but there wasn't a patch available!". Everyone calms down, knowing that there simply isn't anything that could have been done.
If Microsoft releases patches immediately, and you don't patch THAT SECOND, your arse is on the line. If you wait until your monthly outage window (or whatever), and something nasty happens in the meantime, you're the bad guy. No matter what SLA you've set up, no matter what testing routine has been agreed upon, no matter what the business will and won't let you do: IT'S YOUR FAULT.
IT departments, and buyers, used to scream at Microsoft because of this. Microsoft switched to a regular, infrequent patch release schedule as a result. It's stupid, it's childish, and it's the way many (if not most) large corporations run.
True story: Zobot whacked us, hard. We knew about it, we had the patch, but weren't able to test and deploy in time. Regular maintenance windows, etc. The cost in terms of downtime was enormous. EVERYONE pointed at IT, saying we should patch ASAP from now on.
A few weeks later, a similar patch was released, with similarly dangerous implications. Tried to rush a patch cycle in that night, and were flat out refused. We even pointed to Zobot, and the clear written requests from management TELLING US TO PATCH ASAP next time. Still, they refused, as we didn't want to inconvenience users. Fortunately, no one brought an infected laptop in during the next week or two.
Needless to say, I'm overjoyed to not have to maintain Windows machines anymore
Endless arguments over trivial contradictions in books written by ignorant savages to explain thunder in the dark.
Now that truely is interesting!
It reaks of conspiracy theory, but is it so far fetched?
Thanks for the link, I'll have to read that.
I am Bennett Haselton! I am Bennett Haselton!
...like my mother? She uses Firefox for everything she can. Unfortunately, she still has to use IE-in-a-tab every now and then.
Don't thank God, thank a doctor!
I'd have to be pretty desperate to install an unofficial patch.
After almost 10 years without a fix for the cross-zone attack problem, desperation is only rational.