Slashdot Mirror
Zero-Day Team Launches with Emergency IE Patch
Holy Mother of Thor writes to mention an eWeek article about a third-party patch for Internet Explorer. A dark horse security group formed after the WMF attacks in late 2005, the ZERT (Zero Day Emergency Response Team) has released a patch to attempt to slow the malware attacks on Windows. From the article: "'It is clear that we are dealing with an underground group of people who are writing exploits for profits. They are waiting for Patch Tuesday to pass, then it becomes Exploit Wednesday. We're seeing these zero-days in the wild, timed precisely to guarantee at least an entire month to spread,' Stewart said in an interview with eWEEK. Stewart, who is volunteering his reverse-engineering skills and time to ZERT in his private capacity, wrote an early version of the VML (Vector Markup Language) patch the group released Sept. 22 and worked closely with others to fine-tune the update to minimize potential glitches."
but it didn't have anything to do with DRM
Summation 2
Attacking the attacks on attacks by attackers who attack with attacks!?
Third-party security vendor discovered in malware distribution scam!
The majority of exploits could be stopped if Windows users switched to Firefox. However, getting Joe User to switch from IE to firefox is difficult, especially when he percieves no problems with IE. The majority of exploits in the wild today hide themselves from the user, and turn their machine into a Zombie node without their knowledge. Because Joe User doesnt know anything is wrong with his computer, he keeps using his unpatched IE and helps spread the exploit even further.
Yahma
Try http://www.blastproxy.com/ for a fast, free and anonymous proxy to bypass firewalls at work & school
Try http://www.mortgagetricks.info/ for free tips, tricks and advice on how to get a low mortgage rate.
where customers do the work the major companies suck at, these guys need to file for more patents. We all know that nothing innovates better customer service and support than a bunch of fat lazy execs with a patent revenue stream!
Their time would be better spent on improving Free Software instead of trying to plug holes of closed-source software. Microsoft does not appreciate help like this.
Don't use Internet Explorer.
I've had to use IE at a training site this week and it's amazing how cumbersome and clunky it is to use since I've become used to using Firefox. Simple things like being able to scroll down a page before it completely loads, right-clicking and opening a new tab (not window) and just overall speed.
The use of Firefox, and other browsers, really needs to be pushed to slow and/or prevent these exploits from compromising peoples systems. It's an easy solution and doesn't require anything more than downloading an executible.
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
I'm just amazed that it took this long for it to become big news that this kind of thing is going on.
Honestly I'm suprised it took this long for something like this to happen. You patch once a month on a specific day.. obviously they are going to time their attacks for when they will inflict the most damage.
This is neat. Kudos to these guys, and I'm glad they're doing what they're doing.
But it isn't a long-term solution; it still depends on human-speed recognition of the exploit and development of a patch.
What we need is the spread of viruses/worms/trojans whose payload is the removal of malware. Internet antibodies, as it were. The ultimate goal ought to be an antibody - or, to coin a term, an ant.iBody (ant.eBody?) - software that heuristically determines what is malware and what is legitimate software, preventing the former while allowing the latter and propagates itself across the network.
Of course, deploying something like that would break all sorts of computer security laws...but it's not like that stops anything else.
Reality has a conservative bias: it conserves mass, energy, momentum...
How about instead of making stupid comments you suggest a solution.
Not a "use firefox" solution but perhaps a real solution, which addresses the issue at hand. Perhaps this high holy geek attitude is one of the factors that directly contributes to infection. Yes, firfox is great, i use it myself, i have given it to a few friends, but i don't see it as a fix to IE holes.
The fix is the same as it has alwasy been, USER EDUCATION!
MAKE USERES PARANOID!!!!!!!
How often have you ever been infected by visiting cnn.com, how often have you ever been infected visiting a reputable porn site, how often has slashdot ever tried to root your box when you viewed it.
The truth is, people think the internet is like the wild west, and thier illegeal or immoral activity will have no consequences. Sorry guy, it doesn't work that way.
Sorry, I can't spell today.
Stewart said in an interview with eWEEK. Stewart, who is volunteering his reverse-engineering skills and time to ZERT in his private capacity, wrote an early version of the VML (Vector Markup Language) patch the group released Sept. 22 and worked closely with others to fine-tune the update to minimize potential glitches."
Very noble of him to volunteer, but we all know what happens in the movies to the character who mistakenly sacrifices themselves to defend the bad guy. At this moment, chairs are flying and the heavy weights at M$ are screaming things like, "This guy is making us look bad! Steve smash!" A much cooler arch villain grins a maniacally at his underling and contemplates co-opting as much of the work as possible before dropping both of them into a pool of red hot magma.
What will the real world fate be for poor Stew? DMCA suit? C&D for trade secret or patent infringement? Who knows! But none of it will really make windoze a place that's safe for your work.
Friends don't help friends install M$ junk.
I think they should have been a LOT more religious about writing secure code back when they claimed to be focusing on security and such. I haven't noticed any slowdown in the frequency on new exploits and no real increase in the delivery of patches. But if they haven't found religion in writing secure code, I think it's about time they did.
These guys are doing no one a favor in the long run. Better to let MS hang and die quickly. As for the users, well, the old adage about a fool and his money applies to fools and their PCs/data as well: They will either adapt or suffer the consequences.
I've also found a "killer feature" to be AdBlock.
Okay, so it's not really a 'feature' of Firefox per se. But it's one of those things that even relatively ignorant users can grasp and realize the value of, and once you start using, there's really no going back. And it's so easy to install on FF, you can kind of sell it as a package deal.
Set your mom/dad/grandmother/coworker up with Firefox+AdBlock+Filterset.G, and between the tabs and the lack of advertising, you'll probably have gotten a convert for life.
The only problem is that in many cases it's not quite practical to throw away IE completely; there are too many online banks and other systems which count on it's braindead idiosyncrasies.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
Let's be honest here. Why the hell did someone come up with the concept of "patch Tuesday" in the first place? It was a no brainer that OF COURSE exploits would be launched right the day afterwards if you can predict the patchday. Actually, an analysis of our malware early warn "radar" tells that the exploits are launched pretty much in sync with the advent of the patch.
What did MS think when coming up with the idea of "patch Tuesday"? Sure, it's something you can adjust to as an admin, knowing exactly when the next patch is coming gives you a good idea how to time your update cycles. But does it really? Or is it rather more useful for those who plan to attack the system, using the very predictable update cycle as a key to time their milestones to?
Malware and defense against it is a game of knowledge. The more you know about your enemy, the more efficient you can be. And we're currently facing the problem that the attackers know everything, the defenders almost nothing.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
*scene takes place in Interview room, a panel of HR and tech types; applicant being interviewed
We're not that interested in your l33t h4x0r skillz. How good are you at time travel?
A demonstration? Sure. No, you dont have to take your clothes off now, that's only in Terminator; it's just a movie. Put them back on now. I said put them back on. I know it's cold in here. And the physical takes place when you're actually hired. Next please.
WARNING: Smartphones have side effects--most of them undocumented.
Now it appears to me that this is an open source solution to a proprietary problem. Isn't this what the OSS crowd has said all along - that the OSS side gets patches out in a much more timely manner? Also, does anybody know what license is being attached to these patches?
He who would be a man, must be a nonconformist. -- Emerson
But they dont want to. There are thousands and thousands of sites that have hacked up code to step around the bugs in IE. They all will break if they lost back ward compatibility to these harebrained hacks that depend on the bugs in IE. MSFT considers it a big loss of face if more sites work in FF than in IE. If they fix all their bugs and holes in IE, more sites will work in Opera and FF than in IE. That is a big no no. That is why they tread cautiously making sure they fix the hole, just that hole, and nothing but that hole, and fix it just enough, so that most of the other hacks can continue to work. That is why they are so slow in responding. That is why the fix has to be fixed and fixed again.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
The L word will pop up here--Liability.
That is what happened this past winter in our shop when the WMF fiasco occurred: An in-the-wild exploit, MS says "yeah, but it's not *that* bad, we'll get it to you next time", and the World says "you must be kidding, we'll do it ourselves."
I run a small, corporate network. But it *is* corporate. When I went to the Boss to explain things, we wanted to deploy the third-party patch. But we kept running into the concept of Liability--the "what ifs" of something going wrong, and we did it to ourselves by applying something outside of the supported vendor. In the end, we lined up the third-party patch and were ready to quickly deploy it system-wide. In the WMF case, MS backed down and released an out-of-cycle official patch, which we then distrubuted.
The concept of the World doing the Right Thing by creating these patches is wonderful--it is an obvious and long overdue response. But I am not a lawyer--and I would have to think real lawyers who answer to corporations with thousands of boxes are going to pipe up over this.
At work I let my IT department deal with it. Serves them right for being a Windows shop. At home I don't use Windows. This really isn't anything that matters to me.
putting the 'B' in LGBTQ+
There are good reasons for Microsoft to be careful with its patching, since it's so easy to break things. What if they adopted a strategy for, rather than patching out vulnerabilities, but instead filtering them out? Like an antivirus program, you'd scan media content for attacks and then disallow them if attacks are found. This strategy could result in an update cycle measured in days, or even hours, rather than weeks.
And they'll have no choice, because you can't download IE for OS X anymore from Microsoft.
Of course, I'd try to lessen the shock by installing Firefox for OS X for them.
"I am the king of the Romans, and am superior to rules of grammar!"
-Sigismund, Holy Roman Emperor (1368-1437)
So why didn't this Malware Wednesday effect show up immediately, and why is it still not employed universally? Malware seems to emerge, in general, every week, every day. It took almost two full years for the Malware Wednesday response to emerge into a recognizable pattern. I suspect that this should indicate something interesting about the malware community. But what?
Perhaps communications between different groups and individuals that share code and ideas in the underground community isn't very efficient, due to the mistrust and need to shield identity. Perhaps these groups don't spend much time reading Slashdot or IT journals where pundits probably decried the silliness of Patch Tuesday and predicted the Malware Wednesday phenomenon. Perhaps they were too busy sitting on the beach drinking rum from hollowed out pineapple shells with those little umbrellas in it, and only recently got around to thinking about the problem. Perhaps the techniques they employed were effective enough.
However, there are problems with all of those theories. Here's a theory that seems to have greater explanatory power: Releasing patches immediately following a Patch Tuesday probably didn't show much of an advantage to the malware authors in terms that matter to them, (a) how long will the exploit remain effective, and (b) how many systems can be infected via this exploit and remain under botmaster control for an extended period of time.
- Microsoft hasn't really shown an ability to consistently patch defects within a single month of discovery.
- The systems which are most likely to remain under botmaster control (once control has been usurped by exploitation of a defect) for the longest period of time also tend to remain unpatched for a long period of time.
Systems which are patched frequently or re-imaged following an intrusion are of declining interest to the profit-motivated organized crime organizations which are driving much of the evolution of malware in the past few years. Such system remain interesting to malware authors seeking underground fame for infecting large numbers of systems, but the people who would in the past have been be trying to infect "m0R3 s1st3mS th4n 3V4R, d00dz!!!" are attracted and tamed somewhat by the money.If they are going to work for the underground economy, and get paid to write malware, they need to write malware that focuses on the profit making goals of the underground group. That means more people writing more dangerous code that attracts less attention because it can be controlled more carefully and seldom causes global outbreaks on the scale of MS Blaster. Instead, lots of little releases all the time. Rapid spread techniques might be used as a smoke screen now and then while harvesting data for espionage purposes (either corporate or national) but are probably used much less often by those seeking to quietly build up botnets for spamming, hosting phishing sites, scanning for identity information which can be aggregated and used or sold, and so forth.
Just a thought, not fully formed. I'm kinda groggy this morning.
If you mod me down, I shall become more powerful than you could possibly imagine.
.... from any of the following links:
www.getfirefox.com
www.opera.com
This is my opinion. To make sure you don't steal it, it's covered by the DMCA.
Probably that security expert that now works for mozilla...hey lets only patch boxes on tuesdays...yea great idea..
Got Code?
I just downloaded the ZERT IE Patch and it is an install for FireFox!!!
So what.
There's a better solution to all these problems. Properly implemented QoS on ISPs and Servers so that the extra bandwidth usage generated by this crap doesn't prevent those of us running secure systems (Windows on a tight-ship, Linux or OS X) don't get hosed by the unwashed masses.
The vast majority of malware traffic isn't 0-day; it's ancient stuff running on older unpatched systems. As long as they don't bump us off the interwebs, I don't see why I should care.
Patching & Cleanup are a poor solution. Once your system is infected, you're screwed. Windows security these days is more in need of triage, not repair.
WhiteWolf666 an exBush supporter. All you new-school,compassionate,save the children Republicans can rot in hell
Yes , what is this IE everyone is talking about ?
"There is no superior technology or anything that would help to make Firefox inherently more secure"
Unlike IEXP Firefox is not welded to the OS. It runs in user space and under Linux is locked down to the users home directory. Of course the root cause of 'buffer overflows' ans stack attacks is the defective design of the wintel memory manager.
"The Mozilla guys may offer more frequent patches (which would increase security, but reduce reliability..)"
It might only appear that way because the patches are not bundled in one monthly collection. Can you provide an example of a Firefox patch that reduced reliability.
was Re:Spyware Thursday
davecb5620@gmail.com
As of the XP kernel they aren't linked at all anymore. Go try WinFLP if you don't believe me; installing that (which IS an XP kernel, just without all the crap to go with it) gives you the option of IE or not.
"You can either have software quality or you can have pointer arithmetic, but you cannot have both at the same time."
Various hospitals have implemented dozens of "IE only" solutions for specific real-world problems. The users of these solutions have zero ability to influence the technology decisions of the hospitals, and no choice but to use IE in order to do the work required for these hospitals to function.
It's too late now to say "shoulda used firefox" - the workers in this position have no option in the near future.
Last I heard (months ago), they were broken, and they could make ALL your tabs IE, or all not... but no way to mix'n'match. I'll have to check them out again now that they're fixed.
"I will trust Google to 'do no evil' until the founders no longer run it." Hello Alphabet.
And you are 100% wrong in your assertion.
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
..the above post up.
PLEASE STOP MODERATING.
There is absolutely nothing "interesting" or "insightful" about the post above. In fact, I would say by modding this post so high, the collective intelligence of everyone who has read it (and doesn't know any better) has been decreased considerably.
The author has bought into, and is dutifully spreading one of the biggest myths about Internet Explorer - that it somehow carries more rights and privileges to the OS than the user who is using it. The author also claims that firefox offers some sort of (magic?!) protection that keeps exploit code from accessing the OS. Both of these assertions are false.
If you would like to make Slashdot a better place, please click on "preferences" on the bar next to your username at the top. Then click on "homepage" and un-check the box that says "Willing to moderate".
Thank you, and have a nice day.
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
My stated assertion was that MSIE is an integral part of the Windows OS, which means that there is an inherently unsecurable set of portals to the outside world, the browser, that is insufficiently isolated from the OS. So that exploitations of vulnerabilities in the browser can lead to such nasty infections as keyboard loggers, rootkits, and zombie processes (rather than being isolated to just messing up the browser session).
And you are 100% wrong in your assertion. [toadlife]
Good. Now then, M. Toadlife, demonstrate to me that my assertion is wrong by telling me and anyone else who reads your words how to cleanly remove IE from WinXP. Tell me how to do this in the same clean way I can remove MS Office or MS FrontPage. Or Firefox. That is, without destroying any of the other functionality like the help system, or destabilizing the OS.
Take your time. I'll wait around a while, because I'd just love it if you could show me how I'm wrong. If I can reclaim the ram, disk space, and cycles that MSIE is wasting on my machine, I'd do it in a heartbeat.
Basicly zero day exploits launch by underground group to exploits vulnerability in corporate computers. They knew that the administrator will update their pc. So, to attack the computers, they must attack before the computer being patch.
From my reading, this underground group will work hardly to find to vulnerabilities. And some of the vulnerability comes from previous patch. Patches sometimes create new vulnerabilities because they fix the problem appear not the concept why it is appear.
Because windows used by many average end user and it has many holes, this is the best target for the underground group
On the other hand, to launch DDoS attack or to mount new zombie, they don't have to work hard because they are thousandzzzz of pc not patch although ms release hundreds patch during that period of time. Because average end user not the 'nerds' or 'geeks' type. They don't really care if their pc runs as zombie. As long as, their works (typing and printing) can be done. Not to mention, that many user may not realize that their Windows need to be update!!!
At the same time, the are also many pc run with ungenuine version of windows, this the perfect target operating systems.
And once again, your stated assertion is wrong. An exploit in IE carries no more danger to the user than an exploit in FireFox. There have been plenty of exploitable remote code execution flaws in FireFox that if exploited could easily lead to the installation of key loggers, and other nasties. There have also been tons of flaws in other components such and flash and java that are completely browser independent. It all comes down to the rights of the user browsing the web. Exploit code that hits IE cannot install key loggers if the user does not have the right to install a key logger. The same goes with other browsers and programs. This seems to be an area that you don't comprehend. IE and the libraries it uses are userland programs that carry the rights of the user using them, and nothing more.
Way to change the subject. I never said anything about removing IE from the OS - because it is not necessary. You start by claiming that IE grants malware root access to the system while in the same situation other browsers don't (false), and then change the subject to the fact that the core libraries that IE make use of can't be removed from the system without breaking the help and support center. Do you make it a habit of browsing the web from the help and support center or something?
As far as resources, there are no "cpu cycles being wasted" by IE's core libraries being on your system, as they are only loaded into memory when they are needed. If you use an alternate browser like FireFox, then they will almost never be loaded - unless you like to browse the web from the help and support center or the mmc console.
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
Gee, at this point I don't know what to say. I guess it's time to bow out of the conversation with an apology.
I'm so sorry that this conversation has gone the way it has; I apologize to anyone who reads this since it is contributing more to the FUD that seems to always surround any perceived criticism of Microsoft than it adds to the universe of rational discourse. There has ended up being more heat and smoke than light here. Sorry about that.
M. Toadlife, I truly regret that reality doesn't match the virtual image of it that you are attempting to project. Your world appears to be a much simpler and safer world, and I'm pretty sure I would enjoy living in it, if it only it existed outside of the mind of the beholder.
This is the kind of thread that could go on and on and on. But that would be a waste of bandwidth. Enough has been laid out here that people with some prior knowledge of the subject and the slashdot milieu can easily predict where it would go and form their own opinions. For anyone else, well, try this:
It seems you have a few misconceptions about me.
I hate IE. I don't use it for many reasons - security being one of them. I've been a firefox user since 0.7 beta. I'm just not ignorant about how operating systems and their various security subsystems work.
You sir, are.
Good day.
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
You may find that this "OS" which is a stripped version of XP has no IE, has FireFox, and is perfectly stable. It also doesn't phone home for updates etc. Worth a look for "testing" anyway...
Build it, Drive it, Improve it! Hybridz.org
Interesting how many of these 0-day exploits appear just after Patch Tuesday, it's almost like the Bad Guys are exploiting Microsoft's scheduled updates. The ZERT patch probably works in most configurations. However there are some issues reported and it's best to wait for an official solution. 1. Unregistering the vulnerable DLL 2. Keeping AV protection updated 3. Avoidance -- Stay away from dangerous or untrusted sites and email 4. Use other complementary browsers where you can But that is only a PARTIAL fix according to Microsoft. I think it much better to use the unofficial patch...if you can get it to work. I can't so I just won't use IE. I'm not applying Microsoft's partial fix and then using IE. That would be stupid. I don't use IE often anyhow so it won't be a big deal for me to avoid it until there is a full patch.