Slashdot Mirror
New Phishing Flaw in Internet Explorer
JimmyM writes "Secunia reports on a new vulnerability in Internet Explorer. From the piece: 'This can be exploited to spoof the address bar in a browser window showing web content from a malicious web site.' According to several (german) media outlets this is already being exploited by phishing sites. Secunia has a test you can try to see if you are vulnerable."
I know IE is supposed to still be the most popular web browser there is, but my site shows firefox is in much higher use (roughly 96%). But I guess that since over 97% of hits to my site have been from slashdot that isn't so unusual, I was suprised to see that 98% of visitors used windows.
Why are people still using IE, even the most uneducated users must have heard of alternative browsers by now. I am not specifically advocating any particular browser, I use firefox, but I have heard great reports about opera. Geez these days I would use lynx over IE (and quite often do). We hear about new vulnerabilities in IE all the time IE users get a clue.
GeekServ Unix Consulting Services (http://www.geekserv.com)
1. Look up in top left hand corner of browser.
/ms troll
2. If icon is a blue 'e' then you're vulnerable.
That is all.
When the posters fear their moderators, there is tyranny; when the moderators fears the posters, there is liberty.
I just tested it in IE7b2 and got the correct results, showing the Secunia URL and not Google's.
FC Closer
I tested this attack in Internet Explorer 6 on Ubuntu 5.10 running the current Wine deb from winehq.
|/usr/games/fortune
Warning. Your Slashdot login information may have been compromised by a sly fox. To ensure greater security please reply to this comment with your current UID and password and the new password you want. I'll be sure to forward it off to CmdrTaco as soon as I see a response.
Thanks,
Internet Security Sheriff
-"...bad old ideas look confusingly fresh when they are packaged as technology" - Jaron Lanier (Digital Maoism on Edge.o
...phishing is still going to be a serious problem... although the bar is important for users it shouldn't be the only source that they look for to see if a site is authentic, it should be based on all the factors which can give some inclination that the site is either legitimate or not and we need to create a culture where people look with caution on websites. See the register article on this topic with an interesting article on how people deal with these website http://www.theregister.co.uk/2006/03/31/phishing_s tudy/... worryingly the amount of time spent on a computer doesn't seem to have any effect on how much at risk people are.
this should also serve as a reminder that people who get fooled with this aren't just stupid fools who don't know what a computer is.
*''I can't believe it's not a hyperlink.''
I have to use Explorer at work. A defect tracking system and a time tracking system at work both refuse connections from anything that doesn't identify itself as Explorer, and one of them (I can't remember which) doesn't work if you set up Firefox to pretend to be Explorer.
So, I use Avant -- a wrapper around Explorer that gives multiple tabs and can block ads & pop-ups. It seem invulnerable to this bug, incidentally. Supposedly Netscape 7 can use Explorer for certain websites and the Mozilla rendering engine for others, but I couldn't figure out how to get to work exactly how I wanted, so I punted. I've been pretty happy with Avant since then, but I prefer Firefox for home.
If it's for-profit but free, you're not the customer -- you're the product (e.g., the Slashdot Beta's "audience").
According to the advisory linked in the article:
But I'm running IE6 on XP SP2 fully patched and I'm not vulnerable to their test. Since this involves macromedia flash, I'm assuming this is mixed with a bug in flash or else something else besides IE alone is causing this bug.
I'm shocked, I tell you, I'm shocked!
The world's burning. Moped Jesus spotted on I50. Details at 11.
Judging from my own quick go on the test as well as the /. comments, the advisory that this affects 6.x versions is wrong. It would be more useful if there was information on which 6.x versions it affects - is this an issue intoduced in a recent patch, or is it pre-whatever versions only? (And an undetermined number of IE7 versions)
Is this related to the flash player version?
More data needed!
fortune -o
I tried it first, and it failed, then I tried it again, and it worked. Turns out if you don't keep focus in the window, the flaw doesn't happen.
Just for your info, I'm using:
IE Version 6.0.2900.2180.xpsp_sp2_gdr.060220-1746
and my Windows XP is fully patched.
So it's probably a related issue, or something else, but your browser is definitely just as vulnerable to the flaw as mine.
I am unamerican, and proud of it!
When I run IE, the icon in the top left is an arrow pointing left...does that mean I'm ok and Paypal really does need me to confirm my account details several times a day?
This doesn't work in Firefox. I hate it when people only design their pages for IE!!
This message will self-destruct in 5, 4, 3...
I tried to open the test page in Konqueror and it crashed. I wish I was joking :(
I am trolling
The concept is simple. See the button bar (tab bar on Firefox) up top? Now look down -- see the Status bar down below? In between there is the screen real estate that content should be allowed to touch. Under no circumstances should anything outside of that area be touchable by the browser or any task/thread/job spawned by the browser. Period. The URL bar, button bar, toolbar, and statusbar should be inviolate. Javascript (or ANY script) should be unable to display text in the status bar, thus making it impossible to lie about link location.
Extensions, which are installed explicitly thru a separate procedure, would be the only way to put something in the status bar.
Change the little lock symbol to take up more room in the status bar. Make it list the URL the certificate is issued to next to the lock. If that doesn't match the URL you're on, change the URL bar background to ORANGE (not yellow) and make the lock flash or something. Yes, I know, you clicked "accept this certificate" but it is still a hacked-up cert and needs some cursory attention.
* * *
For those twits that are going to whine "but I don't use the status bar" or "I've rearranged my button/menu/tool bar up top so it isn't that way" this is a trivial issue to work around. This was just a quick way to describe the working screen area for most people.
Learning HOW to think is more important than learning WHAT to think.
If people would pay attention to whether the connection is a secure SSL connection, wouldn't that alleviate most of the problem? As I understand it the browser would show "secure" if the site has a valid SSL cert signed by one of the root certification authorities installed in your browser that was registered to the domain of the site you were looking at. I suppose it's possible that a phisher could get a valid SSL cert for their phishing domain, but isn't that pretty unlikely?
Of course, training people to pay attention to whether it's an secure connection before giving important private information is a different issue, but it seems like you might be able to make some progress through education and adding features to the browser to make it a bit more obvious. You could make the secure icon more obvious, and you might even be able to get more clever and guess which pages are bank pages and ask "are you sure" when people try to send info unencrypted to those pages.
Meanwhile, my bank and some of my credit cards have a login prompt on the front page that is not https. Sure, it starts an SSL connection after you hit login, but, at that point, if you've been spoofed it would already be too late.
"You call it a new way of thinking; I call it regression to ignorance!" -- Operation Ivy
i just modified the code and tested it it will work with https.. It shows
https://www.google.com/ in the address bar BUT does not use ssl you do not get the lock in IE.. and also if you try and use it with a domain other than the one the link is on it causes a full redirect and you get the right adress in the bar same happens if you try it on a site that is using ssl
'...if only "Jumping to a Conclusion" was an event in the Olympics.'
The other day I sent out an email to everyone in our company warning them of a new phishing scheme with a copy of the email attached. Within 10 minutes I had not one, but TWO replies to me with people's account/password info.
So not only did they miss the entire message, they also couldn't even give their information to the right person. I wanted to just cry... I honestly think phishers deserve some peoples information.
http://teasphere.wordpress.com - A little spot of tea
Dr. Evil, blah2glorb
I would suggest This Firefox Plugin. Works like a dream - you can with a right click open any currently open tab in a new tab, rendered with IE instead of FireFox. You can also set specific websites (update.microsoft.com, etc) to automitically open with IE instead of FireFox. Best part for a web developer - they each have seperate caches, so I can have multiple logins to the same sites for testing purposes :)
Note that this exploit also works if you're using the IE Tab add-on for Firefox. I know that IE Tab basically runs IE in a Firefox window; but, I was surprised that the address bar was corruptible.
The article said this is a moderate security risk. This is bad. At first they were asking for private information in e-mail. Then they were coping web sites and linking to them. I've already had to train myself to be wary of e-mail. Now I've started looking at URLs. But if they can fake the URL too, how in the world is anyone supposed to know which sites are authentic?
The spam is bad enough, but I'm frequently clicking the 'report phishing' link these days. You only have to make a mistake once.
when in an internal memo, Bill Gates said "We must lead the industry to a whole new level of Trustworthiness in computing."
Remind me, again... how many major OS releases and services packs and IE versions have been released since then?
"How to Do Nothing," kids activities, back in print!
I'm running IE on my new MacBook via Boot Camp. But since Macs don't get viruses, I'm safe, right?
sudo eat my shorts
People don't think that way. Yes, an ounce of prevention is worth a pound of cure, but most people put off fixing things like that. Just like "One of these days I'll paint the kitchen", or the inevitable promise to eventually "clean out the garage", people might eventually plan on "figuring out that darn computer thing better", but as everyone knows, first there's the game on, then they have gardening to do, or walking the dog, or anything other than doing that, always promising to do it next week. Sort of like me and this paper due in an hour...