Slashdot Mirror
BBC Site Used as IE Attack Lure
capt turnpike writes "The hits just keep coming... according to eWEEK.com, someone is using actual excerpts of BBC news stories to 'launch drive-by downloads of bots, spyware, back doors and other Trojan downloaders.' One example is a story blurb masking the download and installation of a keylogger -- with no user interaction. And it doesn't even tell you it loves you."
So... they used BBC news as bait... WOW! It's not like they took over the BBC site and used it.
"The hits keep coming in..." Yeah, 1 every hour. The media wants to make this the most critical vulnerability that ever existed. What a joke.
I mean, a known bug is exploited and it's using quoted text from the BBC site.
If they do it again tomorrow with text from nytimes.com would that be another story?
The opposite of progress is congress
I'm getting pretty fed up with these idiots who jump on the bandwagon everytime a vulnerability rears its ugly head. I hope there's a special purgatory for those people (say one where they have to rebuild infected systems for about 5000 years!).
Not Amused.
Wow, saying a link is something that it's not to lure victims! What a novel idea!
*chokes*
(Times like this I'm glad that I use linux ... Until, of course, the next zero-day firefox hole, at which point I'll switch to konqueror or..).
OS Software is like love: The best way to make it grow is to give it away.
If we can't convince the government to crackdown on this scumware in the interest of security and privacy, maybe we can get them to do it in the interest of intellectual property.
An IE vulnerability! That's news!
If they do it with BBC news again, it could still be another story.
According to This article, using bogus URL's to trick people is still the most effective social engineering trick in the book. Of course, that may not apply to those in the Slashdot community :p
The difference between stupidity and genius is that genius has its limits.
You'd have to be crazy to click on them while reading that article.
MY name is James Taylor and I clicked on your link and then the web went down all by itself!
It was taking over by a hostile native american terrorist organization called apache running on Gentoo gnu/linux. Damit hacker! I need to call the FBI over and sue you for this.
http://saveie6.com/
Read all about it! lol, no I'm not a virus!
Now if someone used actual excerpts of Slashdot news stories, should we expect the dupe a week later or will it get pass the bayesian filter because of misspelled words?
Not really sure why this is even news. After a computer security competition last weekend, I had the chance to talk to professional security auditors, i.e. hackers. The reason I bring it up is that at one point, one of them said that "he had a web page he would like everyone to visit...with firefox." Needless to say, this scared the shit out of me. After pressing for more info of browser related exploits, he said that IE7 is suprisingly solid security-wise. Same goes for Vista, at least the parts of it that are finished (no more ldap). I shudder at the thought of IE pushers trying to convince people to switch away from firefox because it's not secure enough. I don't know, food for thought.
So, what harm is there in bundling the browser with the OS shipped on 90% of the retail PCs in the world? What harm is there in integrating the browser into the core of the operating system?
...let's stop by your bank and credit card accounts on the way to an organized crime hangout and/or third-world country! Fun!
Apparently, if you bundle a half-ass product where only lip service was paid to security, the cost is greater than anyone realizes. IE was crammed in there with the sole purpose of crushing Netscape and dominating the Internet market. It was rushed, with slipshod quality and security only as an afterthough -- and that only by the PR department.
"Where do you want to go today?" seems to have found an answer...
-Charles
Learning HOW to think is more important than learning WHAT to think.
I used to get eWeek until I realized that the only people that get eWeek are losers who wish they were CEO's with unlimited power. Then I also realized that eWeek was a fertile ground for hacking real (conceited) CEO's computers. I suspect that's what is happening here. Go hackers!
7h3$3 4r3n'7 7h3 Ðr01Ð$ ¥0 4r3 £00|{1n9 f0r. M0v3 4£0n9. --OB1
Hackers Thank God for Microsoft Marketing Policy.
The policy may be designed to make life easier on sysadmins (or, at least, their managers), but it also makes life easier on hackers. I mean, if I had a zero day exploit, I'd start using it on patch day. That way I'd probably have a full month to exploit it before Microsoft released their scheduled patch.
Scheduled monthly patches are fine for non-critical issues, but when you have zero-day drive-by exploits like this, you've got to have a policy that puts user security ahead of marketing hype. Waiting until you have a full-fledged epidemic is not the way to secure your user's future.
OS Software is like love: The best way to make it grow is to give it away.
Are any of the links on this page bad ones?
h +against+dollar&sourceid=mozilla-search&start=0&st art=0&ie=utf-8&oe=utf-8
http://www.google.com/search?q=+Yuan+hits+new+hig
That is, I googled some phrase from the article, in an attempt to get it.
Don't look at that unless you have the hotfix or mozilla, I guess.
http://www.thebricktestament.com/the_law/when_to_
I thought it meant vulnerabilities that where unknown to security professionals... lots of people know about it now. Zero day sounds cool, but it looses it's meaning when lame tech articles abuse it as a buzz word.
http://en.wikipedia.org/wiki/Zero_day
Okay how can someone do all of those things to your computer just by visiting a webpage? Seriously? I use Linux and Mac and have not touched windows for years, so maybe I am a little out of the loop here. Someone can just mess up your PC for visiting a website? Is it really that simple? Ben.
Seems to me that browsing the web with IE is bad idea to begin with. The Mozilla suite/Firefox/Netscape (take your pick) solves this problem, assuming you're up to date with OS and Mozilla patches.
Why don't PC makers push Firefox as the default browser? So many of these problems would go away.
I wonder if this attack will succeed when using IE on WINE/Crossover office?
Ahh, the good ol' days of NetWare 4.11. No spyware, no problems.
The BBC would like to apologise for the following programme.
Slashdot Burying Stories About Slashdot Media Owned
You download and install the patch from here:
http://www.mozilla.com/firefox/
...but how about the common courtesy of a reach-around?