Slashdot Mirror
Criminals Attacking Myspace, Facebook IE Plugins
An anonymous reader writes "According to the Washington Post's Security Fix blog, cyber criminals are populating the Internet with Web sites designed to exploit several recently-discovered security holes in a half-dozen widely used ActiveX plug-ins for IE 6 and 7, most notably the one offered by Facebook and MySpace to help users upload photos. The sites, advertised via links in email and instant message spam, also 'probe for other vulnerable IE plug-ins, including two recently discovered from Yahoo! and one for QuickTime (this one attacks a vulnerability Apple patched just last month). The sites also throw in an exploit against a six-month-old IE flaw.' The article notes that the SANS Internet Storm Center has released a GUI tool to help users safely deactivate the vulnerable plug-ins in the Windows registry."
Haven't they gotten rid of activeX(ploit) by now? I can't recall the last time I saw it being used for anything useful. It's nice that IE7 is somewhat standards compliant, and that IE8 will be even moreso, but if they can't fix/remove activeX, I think that they will really lose a lot more users to the more secure browsers.
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
I know little about Windows programming but ActiveX seems to be the source for many of the problems with IE and Windows security.
Why is it still used so much by commercial actors like Facebook, or not secured by MS?
Bikers.....The only people that understand why a dog hangs his head out a car window.
I run as a limited user . I was attacked .
Instead of getting crap installed, an error in my security log about an Active X control not having required permissions to install
So I must ask, How many are vulnerable merely because they foolishly surf as Owner/ Administrator?
You might that this make no difference, but here, you would be wrong.
I apologize to any *individual* who may have been hit hard by these 'sploits. But if they're forcing better security on those sites, and hitting IE hard, I say Good For The "Criminals"!
I find it incredible how much you can't do as an XP limited account. My parent's WiFi link is defective, and the only way to get it back is to have it go through the 'Repair' process. Limited accounts aren't allowed to do this. Merely for curiosity's sake: can limited accounts in Vista do the Repair function?
If you can do it in a limited account, and the repair function actually turns off the network, and on again, it's a ddos in the making...
To check twice as hard for security flaws.
"Thanks for all the money you paid to us. We've used it to buy off ISO among other things" -Microsoft
ActiveX is a way to extend the browser, to make the web site better for -at least Windows- users (and overcome some of the limitations of good old fashioned HTML/HTTP). Truth is that even standards compliant web sites leave something to be desired when compared with native desktop applications. ActiveX gets the bum rap because it is the entry point (a generic API). The real culprits are third party programmers.
After 15+ years of Internet explosion, you'd expect that we would be doing better in security, and that we wouldn't miss desktop apps. There is a dire need for better web apps that blend better with the local system.
In fact, while many of us might look forward to Web 2.0 using Ajax/JSON et al, there is a bit of a growing movement in non-standards based environments: Flash and Silverlight are emerging as full fledged OS-like environments inside the browser. Instead of re-inventing the OS using the browser with an interpreted (slow) language (like Netscape, and Java -client- tried to do), you have Adobe and MS coming up with a graphics friendly and programming flexible alternatives within their own ActiveX controls (which are blazing fast because the core is in C++, and the content is pre-compiled). As much as Flash is maligned, I wouldn't be surprised if in 10 years it takes over the Internet, and the browser is little more than a tool to deliver flash content.
Your right limited users does really break some programs. ,they have much to learn . /admin access Period, except to install it
The writer of the program simply didn't divulge what must have access,or they simply don't know .
\Many users of XP don't understand or want to understand user/ File permissions
If the writer of a program requires owner admin access to run their programs
Good programmers don't usually need to have owner
DoS == Denial of Service
Fixed that for you.
That's kind of the idea there, buddy. Bringing network interfaces up and down is definitely an administrative task. If XP were a real operating system, it'd have some way to temporarily become administrator during a session. Even "run as Administrator" with the proper password doesn't work for tons of programs, QQ and Alibaba Trade Manager being the offenders I'm pissed off with currently.
Shutting down free speech with violence isn't fighting fascism. It IS fascism!
I can disable/enable networking in Ubuntu without using gksu.
How many? About 100% of home Windows users and 99% of business Windows users. Most people have no idea that Windows can be locked down and not the foggiest notion of how to do it, sine they have never heard of MS Technet and Common Criteria Certification.
Excuse me, but please get off my Pennisetum Clandestinum, eh!
That's why we can get paid so much as a PC Technician.
Most of the people who use Myspace, Facebook also play games that need admin to run and some just error out when try to run them as limited user and that some has to do with there copy prevention systems, on line play systems that are used to prevent cheating, built in game auto updating and so on.
That seems like a lame reason to not allow that functionality. I mean, if you allow a limited account to visit websites, they could just keep clicking reload over and over again on the router configuration page. There's another possible DoS attack.
Moreover, they get pissed right the hell off when they try to go and do something and find "that goddamned security thing won't let me fuck up my computer"...
/.'r also thinks that extra security "just gets in the way" too... but that position is based on hating Microsoft, not anything to do with logic or rationality).
I've had any number of people bitch when they try to install their screen saver, or some other PoS bit of crapware doohickey their neice's best-friend got from an pseudo-anonymous myspace poster.
One of such user was my boss, who despised the notion of operating system security as being "crap that makes it hard (or impossible) to do whatever the hell you want to do to/on your computer whenever you want to do it." A condition that becomes very difficult when you're trying to explain to Jane/Joe user why they can't have permission to install screen-saver-du-jure and they complain to your boss who share's their perspective...
(Also, if you were talking about Vista, the average
-AC
Les Miserables Volume 1 now up with my reading of
Your statement is incorrect. Newer versions of IE (IE7) does indeed have ActiveX enabled in the Internet zone. It does have a feature called ActiveX opt-in, which requires the user to accept a prompt before running controls installed by most stand-alone applications. However, ActiveX controls that are installed through IE (Such as the Myspace and Facebook controls mentioned in this article) are automatically opted-in during the install process. So IE7 would provide no additional protection in this case.
I tried to run my parents in limited user mode, but it only caused problems. You really can't do anything as a limited user. Vista has improved on this a lot with UAC. Users run as limited users, but if something requires administrative access they can temporarily raise the application's permissions (Cancel or Allow).
I suppose on a desktop-oriented distribution like Ubuntu that may be O.K., but you should be very suspicious when you can do things that affect hardware without having to type in a root password, run sudo, or have some kind of "authenticated session". I wouldn't personally use Ubuntu on servers for those reasons.