Slashdot Mirror
Code Used To Attack Google Now Public
itwbennett writes "The IE attack code used in last month's attack on Google and 33 other companies was submitted for analysis Thursday on the Wepawet malware analysis Web site. One day after being made publicly available, it had been included in at least one hacking tool and could be seen in online attacks, according to Dave Marcus, director of security research and communications at McAfee. Marcus noted that the attack is very reliable on IE 6 running on Windows XP, and could possibly be modified to work on newer versions of IE."
The attack is very reliable on Internet Explorer 6 running on Windows XP ...
That's apparently what happened at Google late last year, when hackers were able to get into the company's internal systems
Google has employees running XP/IE6???
The only way I run IE6 nowadays is in a VM and basically just to test websites we're developing on local/trusted hosts. I wouldn't dare accessing anything with IE6 (especially with reputable sites being hacked and all).
All the legacy IE6 users I've met tend to be government, non-technical corporates or extremely pro-Microsoft shops that bet the farm on IE6 and wrote everything in IE6/ActiveX fashion.
This is a shocker!
If you can't mod them join them.
Seems like running IE4 on windows 95 has paid off....finally! Now if only active desktop worked properly...
That admin has a hot rack.
Help stamp out iliturcy.
http://praetorianprefect.com/archives/2010/01/the-aurora-ie-exploit-in-action/
Yawn, another unpatched MS browser exploit.
I hear there are several more for sale...
I'm not a network engineer or very astute when it comes to security, but I have to wonder why we (America) have our electrical grid online (accessible from say Hainan China) or really any sensitive area online and accessible from the internet, the benefits versus the liabilities seem way out of proportion.
The fact that a bit of code can compromise governments is a strong indicator that no one really knows what they are doing in said government, and also begs the question why isn't Microsoft held liable for these issues? Why do we even use Windows for Government systems?
Hackers are cutting edge people, the government seems to be dwelling in 1990's tatics and security.
"If any question why we died, Tell them because our fathers lied."
Who else suspects that Google is stepping up internal use of Chrome?
Next time somebody tells you that their organisation can't switch from Internet Explorer 6 because of legacy intranet applications, point out that virtually all of Europe switched from their own centuries-old currency to the Euro in less time than it's taking to get rid of Internet Explorer 6.
The following links to an example of using this vulnerability in Metasploit to compromise a user's PC, in essence what happened to users at Google and some 30 other companies via bad actors assumed to be Chinese Nationals: http://praetorianprefect.com/archives/2010/01/the-aurora-ie-exploit-in-action/
While it is writen to say could possibly be modified to work with newer versions of IE, I find that a little unlikely considering the more recent track record of IE's beefing of security. Unfortunately the people writing these articles tend to have bias towards IE as a whole and not just against the mess that IE6 was.
For those who seek perfection there can be no rest on this side of the grave.
Can you give us some of those "good reasons"?
Try it... about 3 of the web pages in the world will actually display... Two of them are probably in Ugandan.
~/ssh slashdot.org ssh: connect to host slashdot.org port 22: too many beers
Anyone else find it amusing that Google has its very own web browser yet IE6 is apparently still widely deployed on their desktops?
I can not believe that Google, with all of its vast resources and years online, that a few email accounts getting hacked all of sudden set them off to pull out of China. They are pretending to the press as if this is something special or new on the internet that China is doing, or that these couple of "attacks" from China are too much. Google has got to be just hammered by Chinese attackers, and they make it sound like no other gmail account has ever been hacked. I bet they get thousands of illegally hacked email accounts a day for all kinds of people, from all over the World, by all kinds of means. Hell, I blocked Chinese ISP blocks and cut down on my little server being attacked and spam by about half.
So, what in particular is suddenly special about this one in relation to China?
Living in Chile
It doesn't matter which browser you're using ...
If you're logged in as Administrator or a user with administrative user rights/access, while surfing the web, checking your email, etc. --> you're vulnerable.
Until users change their behavior and start using least-privilege accounts while surfing the web, it's wrong to blame the browser.
Microsoft even says it in their security advisory kb 979352: An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less affected than users who operate with administrative user rights.
And this applies to any OS: Linux, Windows, Mac OS, etc.
Rootkit - contrary to what its name may imply, a rootkit does not grant a user administrator privileges, as it requires prior admin access to execute and tamper with system files and processes.
As long as after work you keep your skills up on modern tech, taking the customer's money to do the stupid thing is a wise course. Advising them, giving the chance, telling them that it's stupid is the moral choice but if not asked there's no shame in doing what you can with what you've got.
Actually there's an opportunity here - but I'm not going to enumerate it because then you'll be competing with me.
Help stamp out iliturcy.
YES. Finally.
Kill IE6. Kill it with fire.
every time i shoot at funny, all i hear is whoosh
Comment removed based on user account deletion
This is such a dumb American attitude, I hope your Company can work without its intellectual property and computer systems. I assume you dont have insurance as well!
Everyone knows girls need longer.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
So you are the one that has sales demanding we support old browsers.
Right men, we got its location, capture is imminent.
Anyone want to set up a poll what do with him?
It better have a cowboyNeal option.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
Making a country secure is easy.
Everyone mandatory implanted ID that can't be removed or altered without dying, say a chip implanted in the brain that extends barbs.
Tracking posts everywhere. All travel recorded and logged.
1 computer system, can only be activated with ID. No 3rd party software let alone your own stuff, every access is recorded and logged for 10 years minimum.
Should I go on? It is easy to implement and will eliminate all security problems. Feel free to take these ideas for when you run for election.
Security is easy, freedom and security ain't. To be honest, I prefer my government to be a bit slow and inefficient. The alternative is far more scarier.
People are so upset about that illegal immigrant who got shot on the tube when he tried to run. I would be far more worried if that guy had NEVER been able to make it into the country or if they had shot the right guy with a sniper efficiently. The whole mess shows there is still freedom. Freedom to get shot for sure, but also the freedom for journalists to still find leaks.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
...to code.google.com.
Under capitalism man exploits man. Under communism it's the other way around.
Seems like they shouldn't care about GIMPs name, or OOo's lack of the dirty corners of Office.
They don't, it's all about the business case. Most graphic designers coming out of school nowadays are accustomed to Adobe's suite of tools (Photoshop/Illustrator, etc.), and to a company dropping $4000-5000 on a Mac+CS4 is nothing compared to the hours of lost productivity that a designer would spend getting up to speed and working around GIMP.
OOo on the other hand and older versions of MS Office stop being attractive when you try to send editable word documents to clients. Once one of your big clients switches over to Office 2007 you pretty much have to as well.
The only way for OOo to get a strong hold in the small/medium business world, is if they achieve very high compatibility with MS Office, which (knowing Microsoft) will be a very hard thing to do.
Just my 2 cents.
If you can't mod them join them.
Development is programmable; Discovery is not programmable. (Fuller)
Microsofts greatest innovation is to steal it. Haaaaaaaaaaaaaaa Haaaaaaaaaaaa Haaaaa And their totally SHIT browseR/s.... I have more security if I pull down my pants and hang my bare arse out of a tree at night in the park. LOSERS. I hate microsoft - I hate microsoft - I hate microsoft.... Traaaa Laaaaaa Laaa Laaaaaaaaaa
.
Voting up, Voting down - If I really gave a fuck about your approval or not, I'd come and ask you.