Slashdot Mirror
New Attack Fells Internet Explorer
alphadogg writes "Attack code has been identified that could be used to break into a PC running older versions of Microsoft's Internet Explorer browser. The code was posted Friday to the Bugtraq mailing list by an unidentified hacker. According to security vendor Symantec, the code does not always work properly, but it could be used to install unauthorized software on a victim's computer."
As soon as I go to the bug trak web site , my anti virus scanner goes off like crazy.
cd pub
more beer
Yes, old, unpatched browser versions can be exploited. Is this a joke?
Microsoft Windows has once again trounced all comers in security, with a recent survey showing 59% of all Windows machines on the Internet being infected with malware and under the control of botnets. Malware rose 15% just from August to September this year.
Windows users continued to be stupidly complacent Typhoid Marys, telling Mac and Linux users that they were every bit as susceptible to viruses and Trojans, despite the Windows:Mac:Linux virus proportions in the wild continuing at approximately 100%:0%:0% for the fifteenth year in a row, and pumping out gigabytes of spam and denial-of-service attacks from their thoroughly 0wn3d computing cesspits.
“The truth is out,” said Steve Ballmer, taking care not to wash his hands when preparing the food for his Windows 7 House Party. “Mac and Linux users are just too pussy for viruses. Gotta keep your immune system up! What are you, some sort of faggot? Too artsy or nerdy for MANLY food?”
The time on the digital clock behind him changed at random as he foamed slightly at the mouth. “Windows — we’re NUMBER ONE! And here you were saying Windows was a load of ‘number two.’”
http://rocknerd.co.uk
Specifically versions 6 & 7, says the article.
"According to security vendor Symantec, the code does not always work properly, but it could be used to install unauthorized software on a victim's computer."
So, are they referring to IE or the attack code?
If I'm interpreting this correctly, it would appear to be a buffer overflow attack against the "style" element. Seeing that IE6-7 are the only current browsers that handle CSS behaviors (basically javascript in CSS) I'm going to make an educated guess and say it stems from the validation (and execution of) Javascript in CSS.
Where genius and insanity become confused true wisdom is found
Slackware 3.0, Redhat 2 and OSX 10.1 all still have exploits.
I know most of us would like to pretend IE doesn't exist, but they haven't even heard of IE 8?
The only people still using internet exploder are people who don't care about security. They have ignored more than enough warnings and deserve what they get.
The rest of the world is already using firefox, opera, or whatever the OS X browser is called.
There is another story about JS loading with IE7 & IE8. According to 4 of my testers (and a test I did after using the same environment), it seems that we can't login to our site so dep using Internet Explorer 7 and 8, on Win XP (and maybe Vista, not tested). After validating the form, we are back to login page, without any error, but like we are unauthenticated. On the other hand, Firefox does its great job.
is a definitive software engineering treatise on the history of IE security exploits.
It is certainly true that there is a kind of economic network effect going here. For many years we saw so many web sites that only worked properly with IE because IE was so dominant. The same factor naturally attracts black hats looking for systems to exploit. Once we factor that out, what can we learn from how IE was conceived and maintained?
Did clumsy code-reuse and maintenance play a significant role? That is did they stretch existing code to do things it hadn't been designed to do because it was close enough to pass the demo test on time? That's a decision we all face; we'd all *like* to rewrite things better when we take a look at them, but in the real world we've got to ship good enough code on a deadline to justify our salary. I think MS might be particularly vulnerable to the "killer demo" imperative. They are a business that is dependent on organizations choosing entire MS product stacks because they *anticipate* something they're going to need in the future will be dependent on something else in that stack.
Did "business strategy" considerations confuse priorities for system requirements? E.g., The decision to make IE a fundamental part of the OS allowed MS to gain control of (destroy) the browser market while evading anti-trust regulation. Did that result in undesirable coupling of IE to the underlying system? Did the desire to leverage browser market dominance to give other MS products a competitive advantage create confusion in requirements or priorities?
Were there cultural attitudes that made security and quality secondary? E.g. Did MS value having shiny new features soon before doing a quality implementation? Did their success at achieving effective control of the browser market cause them to under-invest in maintenance because they had no competition worth worrying about?
These are the kinds of things I'd like to know. It's almost past the point where any individual security flaw in IE is interesting to me, because there have been so many and will be so many more. It's time for a really first rate summing up by somebody who knows what he's talking about.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
Which butthurt Google Chrome Frame developer found out about this?
Someone should write some code to use this vulnerability to install and run the IE8 update program.
This is a huge problem. Many U.S. Government agencies have yet to move off of IE6. Especially the military. Mostly due to IT management contracts that require the gov't to pay for every little upgrade action. For a simple upgrade, one agency gets tagged per profile per month by the company that runs their IT. That same company has a policy of being 2 versions behind current. Meaning, it is actual policy to be running IE6, Office 2003, and XP/Server 2003. The approval process is so overtaken with red tape and time that most give up trying to get upgrades. One agency just recently removed NETSCAPE from their builds. NETSCAPE!
All it takes is a hostile government to set up a few magnet sites, get banner ads deployed, and bam, your U.S. Government has rampant infections. Is it any wonder we read, from time to time, about gov't employees being prohibited from going to certain sites?
Politics is the art of looking for trouble, finding it everywhere, diagnosing it incorrectly and applying the wrong fix.
So, isn't the responsible thing to do to notify Microsoft, and given them adequate time to produce a patch?
By posting the exploit to a public list, this guy is basically handing the bad guys a weapon. That's criminal. But because it's a Microsoft product, the Slashdot folks just eat that up -- Hey, fuck'em, they're running Wind0ze!!!111
Presumably you run it with no extensions, then?
but all their code security auditors were working on the Chrome plugin :-p^
The Cloud - because you don't care if your apps and data are up in the air.
You upgraded the stable IE6 to BETA IE8?...(I mean IE7).
Not quite. There's no JavaScript in the CSS, nor is there a buffer overflow.
I think most worms these days will check the version and refuse to run until you provide an update for them to infect.
Presumably you run it with no extensions, then?
No, it's much more secure with NoScript.
$ make available
Wrong URL.
$ make available
...a simple redirection to a page explaining that they are using a non-standards compliant virus sink with links to getfirefox.com and articles backing up the claim would be much more effective in the long run. In fact, if there weren't so many web designers with root flaws in their logic akin to yours, it would benefit in the short run. About the third or fourth time the user had to choose to use a standards compliant web browser or stop visiting the site(s) they want to visit, they would get the message.
It sounds like a repetitive Ayn Rand novel with all the intellectual web designers going on a new strike every time less buggy browser versions come out.
Some users, like office workers, are not in control of the computers they use and cannot switch away from what they were given. Sometimes they were set up with particular versions of software to suit other programs. The "Banner" system some universities use, for instance, requires MSIE7 and a particular old version of Sun's Java runtime. Certain sections of Banner don't work properly with non-MSIE browsers like Firefox. I understand this is an extremely costly system and switching away is considerably complicated. I'm not endorsing these choices or claiming any of these choices is wise, but it is there.
The article also says the status of MSIE8 is not mentioned by the researchers: "Neither company [Symantec and Vupen] was able to confirm that the attack worked on Microsoft's latest browser, IE 8.". What part of what article were you referring to?
Digital Citizen
"According to security vendor Symantec, the code does not always work properly, but it could be used to install unauthorized software on a victim's computer."
Does this mean it's on a level playing field with old versions of IE? It does not always work properly, and can install unauthroized software on a victim's computer?
This is my first comment on slashdot, and I'm quite annoyed by "windows" security is bad.
Each sw has problems, and will continue to have problems.
IMHO, you can measure security by one aspect only today: response time.
One could argue that the pure number of problems is also relevant, but this numbers are irrelevant as one vendor would not disclose all problems, where another one may disclose all. Also priorities may differ (critical bug for one company may not be so big to another). So in the end you would end up with relatively higher number of problems for the other vendor, but if they take 5 days to fix the issue, where the first one takes 15 days, I'd pick the one with faster response time any time.
So, we would probably see how long will it take for Microsoft to fix the issue.
But for me, one of the HUGE problems with patching is that each time you install something (on Tuesday:)) you have to reboot your PC (I can remember only few occasions where I did not have to reboot), where for instance you would reboot Linux only if kernel is updated (at least in my experience).
And this brings another problem - sometimes I can't reboot the system so I postpone installation of patches by many weeks so I make my system susceptible to attack..
There :)
(A)bort, (R)etry, (F)lail
I'm thinking +5 Epic Flail.
Thanks to products like VMware, Virtual Box and Boot Camp, Mac and Linux users can be just as vulnerable as Windows users to viruses, bots and malware. Even though it's in its own virtual environment, if you have something like FUSE running within it to make your host filesystems available, anything infecting the guest OS can access files on the host. Make sure the VM software runs as a non-privileged user to mitigate these problems.
If you're on an IT managed PC at work, where you're not allowed to install software, get a thumb drive, go to PortableApps.com, download Firefox Portable Edition or Google Chrome Portable, install it (not in the Windows Installer sense) to your thumb drive and use it for web browsing on the Internet. Only use IE for web browsing on your corporate intranet or if you really, really, really, really, really have to for a site on the Internet that you trust.
It's a very dark ride.
Javascript. It is a bad thing. Let's all grow a collective brain, realize it's not worth the trouble, and let's all stop using it.
Symantec is idiots.
From TFA:
"To minimize the chances of being affected by this issue, Internet Explorer users should ensure their antivirus definitions are up to date, disable JavaScript and only visit Web sites they trust until fixes are available from Microsoft," Symantec said.
Or...perhaps to minimize the chances of being affected by this issue, Internet Explorer users could STOP USING IE! Or at least upgrade to IE8, because that's all, like, officially released and stuff.
I mean, I realize that Symantec is an antivirus company and all, but this is just stupid to a ridiculous degree.
Let q be a radix > 1. I am in ur base-q, killing 10 d00ds.
Seriously, who's the idiot who keeps modding up this crackpot conspiracist? It's well known that this a troll account; it shouldn't have anything but a -1 karma.
So 40% of market is IE6 and IE7, lets move em to IE8...print article on exploit...but this is not new, people know turning off JavaScript fixes it. Doesn't matter, print the article, we need the revenue... How convenient that they "did not know" if the exploit will work on IE8, of course it will, if it works at all, see last line. Come on already, this is so obviously FUD (especially in the FEAR department). And if their PC + OS will not run IE8, even better more revenue when they buy Windows 7 or Vista plus. really, Really, REALLY, why do I feel like I am in a South Park episode? Probably because this is MORE FUD! Most telling statement in article, "...the code does not always work properly, but it could be used to..."
Is your Internet Throttled? Install DD-Wrt, OpenWRT or Tomato to learn the truth! Google: 1Gbps/1Gbps: 5 Communities
Please somebody use something like this attack to upgrade all the IE6s left! Thank you.
People don't tend to reply on Slashdot with "Yeah man ... what he said". We have a mod system to discourage that.
... really" is a forever empty promise, you either continue to endure the abuse or you change your behavior .
I never said that the problem can easily be solved with nobody making sacrifices. When you are the battered wives of the high tech world and you finally wake up to the fact that you chose the wrong relationships; when you realize that the relationships are never going to be loving and mutually beneficial, and finally accept that "things are going to be different this time; I'm going to change
Taking the kids to the shelter sucks, but your lives won't get better without sacrifice. The sacrifice will be much less if you all work together toward a common goal, and it would help if one or more people in a position of power take a stand on your behalf.
I left my abusive relationship with Billmer years ago, and I wish you well should you choose to make the same decision. I have never met a battered wife who, years later, didn't say that the best choice they ever made was "biting the bullet" and making the sacrifice that ultimately resulted in them being happy, joyous, and free.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
I'm gonna use this to force Google Chrome Frame to install.
At what price learning? At what cost wisdom? The price is a man's peace of mind, and the cost is his life.
that 12 y.o. car, if it's a typical unibody, has probably lost 50% of its structural strength due to corrosion, & will fold up like paper in a good crash, just like iXploder;-)
Now how to use this to install FireFox and upgrade IE on unsuspecting IE6/7 users?
Mitigating Factors: Internet Explorer 8 is not affected and Protected Mode in Internet Explorer 7 in Windows Vista limits the impact of the vulnerability.