Slashdot Mirror
German Government Advises Public To Stop Using IE
An anonymous reader writes "After McAfee's disclosure of an IE 0-day vulnerability this week that had been used in Operation Aurora, the hack and stealing of data from Google, Adobe and about 3 dozen other major companies, the German government has advised the public to switch to alternative browsers (untranslated statement). Given that the exploit has now been made public and the patch from Microsoft is still nowhere to be seen, how long will it be before other governments follow suit?"
This is just a personal anecdote, but take it as you will. About a week ago I noticed that Firefox kept crashing on some specific pages, so out of curiosity I decided to load one of them in IE - bad, bad idea. The page loaded a PDF and simply by visiting I was infected with one of the worst malware problems I ever had; task manager shut off, antivirus disabled, locked out of registry editor, windows was completely crippled. Mind you, this was a week ago. Fortunately I'm on a dual boot system and I was able to go into Linux to delete the malignant exe files, which gave me a foothold to manually recover from the rest of it. IE basically just handed these people control over my system, with no input on my part other than loading a news article which happened to have the PDF on it.
Use Internet Exploder for web browsing, Use Outlook or Outlook Distress for reading e-mail. nuff said...ank
Still hoping for Gentle Treatment...
As if IE was ever safe to use anyway... now when here was such a "public exploitation" they advise not to use it. It's ridiculous.
This could have happened to any browser. The Chinese searched high and low for a vulnerability, they would have found it regardless.
Of course, the fact that it was present across all versions of IE suggest some fundamental architecture flaws that Microsoft has yet to correct.
Ironically, in Belgium they have just had a (somewhat controversial) campaign, where a new all-Belgian browser "Paladin" (http://www.getpaladin.be/splash.php) was going to be launched, which appeared to be just fake, pointing to and arguing for the already super-safe IE8 browser :-)
Sig (appended to the end of comments I post, 120 chars)
Joe public needs to upgrade already, and I don't care if governments have to dumb it down to "IE steals yu0r megahurtz, and means you support TERRORISM", so long as the message gets though.
(Screw the corporations that got locked into IE. They can use IE as an intranet client, and use a real web browser for ... wel browsing.)
According the original article, DEP (enabled by default in IE8) and sandbox mode (Windows 7, Vista) all stop this zero day.
If that is the case, doesn't that in IE's favor, nor against? All browsers have vulnerabilities. All of them have zero-days. However, it seems that IE has some pretty good built-in protections that Firefox lacks.
It could happen to any browser to have the same security flaw in 3 different versions DESPITE claimed complete rewrites of the code.
MS apologists, you got to admire their dedication. The Iraqi minister of information used windows as well.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
"patch from Microsoft is still nowhere to be seen"
Isn't it just easier to upgrade to IE 8?
Check if you're in a glass house first.
Please help metamoderate.
to not goto dodgy fracking porn and wares sites
MS has a LONG HISTORY of being horrible WRT security. They still are. The China gov. will continue to use MS as a tool for stealing from the west because far too many gov.s worked with MS and pushed it in there.
Ah, the 'Good Old Days'!
Signed,
a Linux user.
It's a German federal agency, not the German government. And they warn users about IE every time there is a major unpatched security hole.
At work we use MSIE 7 on Vista. Although my employer is open to alternatives it must be strictly planned before making such a switch. Is it possible to switch to, say, Firefox, while still retaining update possibilities? All users are limited in rights, so no admin rights, which Firefox normally needs to be updated. Imho Mozilla needs to work harder to get companies to run their software.
Given that the exploit has now been made public and the patch from Microsoft is still nowhere to be seen, how long will it be before other governments follow suit?
Surely you mean file suit. IE is so widespread that it should be possible for it to be treated like a public utility and then sue Microsoft despite their "no warranty" EULA clause. Cory Doctorow, we need your input on this.
I'm not taking any advice from the government unless it comes from the Internet inventor himself!
I am surprised it took so long. I was expecting some guys from NSA, CIA and several visiting MS IE department and tell them "Guys, enough is enough, you are threatening our national security."
Think about it, is there anything more dangerous than IE with its flawed model currently? I mean look, you don't need to hire some black hats to code custom code, you just look for zero day flaws. Other browsers sure have zero day flaws but thanks to their model, it is fixed (unless Apple doesn't care). The browser's model is broken clearly. In fact, it threatens whole globe economy and security. Nothing that serious happened yet but it will sure happen one day. Another side effect is, every day, people are more bound to web/internet for their actual work. So as time passes, things go way more serious.
Can you try imagining your daily work depends on some intranet tool which only works in pre IE 8 and besides numerous claims by MS, IE 8 simply can't make that tool work?
What would happen?
In fact, even if a tool has upgrade and released by vendor, you can't roll IE 8 to all the machines without testing it yourself in numerous scenarios. It is not like launching Windows Update and click all security updates blindly. Even on OS X, as 10.6 shipped, companies/DTP/Video guys have finally moved to 10.5.8. When 10.7 ships, they may move to 10.6. People can't trust to Apple for updates let alone blindly updating/patching their windows which is way more complex.
Having viruses and other types of malicious software running on the computer is so common that people don't care anymore. Seriously.. I see people working in the middle of a "adware popups up window, user closes it" kind of game and they don't even seem to bother. When is this going to change???
Security! Security! Security! *drenched in sweat* Security! Security! Security! Security! Security! Security! Security! Security! *even more sweat* Security! Security! Security! Security! *crazy eyes* SECURITY! SECURITY! SECURITY! *panting*
Now they just need to take the next step!
Don't use win!
The lead by example and switch to a KDE 3.5.10 distro on all their systems.
Friends don't let friends use gnome or KDE 4.x!
1311393600 - Back to Black
Firefox/Mozilla guys live in some imaginary World where you maintain/install/update thousands of desktops/laptops just like a home user, clicking "firefox.exe" installer.
IE on the other hand, has amazing administrator capabilities and when coupled with that enterprise "ms update services", it is unbeatable.
Firefox resists to ship a Microsoft Installer (MSI) and Apple Installer (PKG) for some mysterious reason let alone doing the stuff above. Near all those ".exe" shareware etc. stuff you see are in fact MSI packages packed into .exe file for convenience and prevent web server issues.
It got more unexplaniable since there is a complete open source MSI packager which is hosted at sourceforge ( http://wix.sourceforge.net/ ) and interesting thing is, InstallShield corp like guys would even donate their solutions to them with free automated setups. It is not some no name software, it is Firefox.
A Police officer, an Airline pilot, and an undersea welder are doing their jobs. One of them gets shot by Glock .45 acp. Take a guess who.
I mean, technically.... This could happen to any person. Does one of these jobs lend itself to having a higher risk of being shot?
In our company, we have resorted to implementing a fascist GPO to solve the problem. Actually, in the untrusted zone, IE can't:
- run javascript
- directly launch an associated application (like a PDF)
- run Flash
- run ActiveX
- change of the default home page
- install toolbars
- use any other search provider except Google
amongst others. It has become a sport to lock down IE as much as possible without removing it completely - this encourages using other browsers.
Annoying people so much that they switch browsers has actually been the best strategy so far to prevent IE security problems in a predominantly windows company.
Perhaps they did - and then MS said "we'd listen to you, but we gave loads of money to a lobbyist organisation who then gave it to the senator on your oversight committee, so bog off".
Anything more dangerous than IE? Yeah. Adobe Flash. One implementation, almost the same code, across every browser and on several platforms.
Oh, wait, wasn’t there just a 0day in that?
Also, that exploit is the other “Chinese” 0day, which targets Adobe Reader, rather than IE. Firefox would be just as vulnerable if the Adobe Reader plugin was installed, or if you subsequently opened that PDF in Adobe Reader (other PDF readers are, of course, not affected).
They didn’t find this vuln themselves. They bought it off the black market from a blackhat, like anyone else could have. They bought the Gh0st RAT (remote access trojan) tool as well, which isn’t particularly brilliant but clearly got the job done due to some very clever and determined targeting. Probably a budget of less than $30k-worth for this whole operation. Very cheap, considering some of the quality SIGINT they got.
Besides, this particular 0day targets XP. As it stands it is non-functional in Windows Vista or 7, due to the ASLR changes. (It could be modified to extend that, as all versions have the bug, but that work hasn’t been done yet and the particular exploit may not reach 100% reliability.)
MS will probably issue an out-of-cycle patch. It’s Adobe you should be angry at.
You might want to switch to Foxit PDF Reader
http://www.foxitsoftware.com/pdf/reader/
Smaller, faster, safer.
> Something like this has been in at least limited operation for a couple of years.
Oh, really?
Wouldn't the US spy services know of this? Isn't it working like intended?
The Chinese might be in the business of cheap tin-foil hat production...
For anyoned concerned about this, instead of a tin-foil hat, what about a Red Hat?
IE6 will never die. I wish it would, to be honest; I agree that I hate IE6 with a passion as a web developer and wish it would go the way of the dinosaur.
:( Especially when I realize there are so many people still using IE6 in that company that have opened themselves up to huge security breaches just by browsing the web.
However, here's a little anecdote of why IE6 will never die:
Company that uses a COTS product that runs ONLY on IE6 and fails to work on any other browser, refuses to upgrade from IE6. 2020 will likely roll around, and they will still be using IE6. This COTS product is irreplaceable and they use it for their core business.
Now, you may think the previous anecdote is laughable and never happens. I can tell you personally, that it is true.
It makes me a sad panda
Perhaps it will take some huge widespread event (like Operation Aurora) to change the minds of companies that rely on web products that only work in IE6, but I am not so sure. The risks have to outweigh the benefits.
Germany actually has a dedicated federal office just for information security. They gave this recommendation; in German it is called "Bundesamt für Sicherheit in der Informationstechnik". They also give out recommendations on how to secure private and corporate networks which are quite useful.
Security Tracker, best tool I know of to track security vulnerabilities.
Adobe says their tool wasn't abused on this case. What makes you think I don't say same thing to Adobe? In fact, just 3 days ago, I suggested Adobe to fire entire Mac department. A "browser" is the platform to access to web, plugins can always be abandoned but browser is more like the "kernel". I don't want to panic anyone but even if they use Firefox, disable access to IE, as long as IE shared dlls used for HTML rendering in various tools (e.g. "what's new today"), they are still vulnerable.
While I won't touch Safari for my ordinary browsing, whenever Apple releases a Safari security update, I backup my stuff and rush to update for that exact same reason. System's default/core browser is a very big deal, way more big deal than anything else.
The "Bundesamt für Sicherheit in der Informationstechnik" (BSI), engl. Federal Bureau for Security in Information Technology, is not a governmental, but a state institution. It is not strictly driven by the government. And it is controlled by the parliament. Even though it works in the domain of the ministry of the interior. So no minister was involved in the "do not use IE" speech.
BTW: IE has not the biggest market share in Germany.
That is what my large system administrator friends are doing for years and some of them are really sick and tired of doing it over and over. Some administrators won't really care to package "your" application or download from 3rd party (must be insane). Even 5 user home networks using OS X/Remote Desktop are starting to get bugged about no OS X PKG.
One more thing: MSI has advantages like package verification, signing and _repair_. It is what RPM is to a Redhat OS or DEB to Debian. Ignoring it is really childish and no, it isn't really "anti MS" thing they are doing. Anti MS thing would be rejecting to release their browser to Windows. If they can do it, it is all fine with me.
Achtung Leute:
IE ist Verboten!!
Soll sehr gut sein! Ausgezeichnet!!
Stop using Windoze or anything created by M$, since it is clear the US government is ever going to hold them responsible for anything. It is all a crock of shit.
And if you have to, run it in a VM, set up so you can re-image the C: drive at any time.
If US law worked, vide SCO v IBM, M$ would have been sued into bankruptcy years ago.
Did it occur to you, that maybe the reason for their “non-reaction” is that either ;)
A) They are the ones who chose for those holes to be in there in the first place?
B) MS and those TLAs got so many revolving doors that they are practically one?
C) Somethingsomething... PROFIT?
Any sufficiently advanced intelligence is indistinguishable from stupidity.
The page loaded a PDF and simply by visiting I was infected with one of the worst malware problems I ever had; task manager shut off, antivirus disabled, locked out of registry editor, windows was completely crippled
I guess my question would be, why were you running Windows as an admin account that would even let you, as a user, have permissions to do any of this stuff. I mean, you can tout Linux as much as you want, but in this case, the real culprit is your shoddy use of Windows security tools. I mean, would you run FireFox as root in Linux? Don't think so. So why did you do it to IE?
This is my sig.
No worries, I made a redirect.
Space game using normal deck of cards: http://BattleCards.org
My company just moved to a new support system built upon Flash and used by thousands internally. It's a huge mess!
I've been livid but to no avail of course. Who the fuck designs a support system in flash?
If you mod me down, I *will* introduce you to my sister!
Jawohl, Mein Herr!
Und was ist neu?
If you mod me down, I *will* introduce you to my sister!
You know your product's reputation is in trouble when a government advises the public to dump it.
Dude, that was the case back ten years ago, too. Facts and technical data don't play a role in situations where Microsoft products get deployed.
You know you have a cult-like following when governments, research universities and a handful of computer magazines advise the public to dump your product and it still retains market share. Having EULAs that prohibit benchmarking doesn't hurt either. Nor does it hurt to have insiders paid for by the victim's own budget.
How long must this go on? Put a dollar value on the damage and then put out warrants for Microsoft executives and interns, past and present.
Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.
if so i have no pity for you
Such as this one: http://secunia.com/advisories/product/25800/
Or this one: http://secunia.com/advisories/product/21625/
Mozilla is working on an MSI package. There's a bug in bugzilla for that. Vote for it and/or help with coding testing.
I'm not talking about AD. I know why they don't include support AD GPOs. It would make FireFox a Windows specific app. But I must ask, considering every OS has its own variant of an LDAP server, why is there no support for managing FireFox from an LDAP schema?
Show me the browser that isn't exploitable, or show me the browser thats been as popular for as long that is more secure.
Go ahead, I'll wait ...
I'm not saying IE is great, but the this sort of response is retarded and lead by fanboys who are too stupid to realize that all code has problems and exploits, its retarded to imply something else is better with no valid reason to assume so.
Good job Germany, you jumped on the FUD bandwagon.
Yes, I realize I'm going to be fanboy modded into oblivion, go ahead, you need something in your life to make you feel useful.
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
The problem is not that MS products are flawed, it's that they hold so much marketshare... When you are 99.9% certain that any given corporation you want to attack will be running windows, ie and msoffice you can divert a lot of resources to finding holes in those products. If your target could be running one of several things, planning an attack would be much harder.
Aside from this, because most large organizations are locked in to MS, they simply have no choice... Attack after attack, flaw after flaw, MS don't have to care because they know that regardless of how bad their software is, the majority of their customers won't be able to move away. In fact, they are more likely to buy new versions in the hope that they will solve the security problems.
If we had a competitive market, anyone with such a poor reputation would be forced to fix things or face going bankrupt. And anyone looking to attack, would have to investigate multiple platforms and do some research on which of these their intended victim was using.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
The problem at least as far as PDF readers go, is that most users don't realise PDF is a standard and that there are multiple implementations... They think Adobe make the only pdf reader available.
I would never install acrobat reader, the default pdf readers in macos and linux work much better, far less bloated, and there are plenty of alternatives available for other platforms too.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
There is a previously unknown security issue in Internet Explorer. The vulnerability allows attackers to inject and execute malicious code "into" Windows computers. The attack on Google and other US-based companies that was publicized last week probably used this vulnerability.
The affected versions of Internet Explorer are 6, 7, and 8, on Windows XP, Vista, and Windows 7. Microsoft released a security advisory that describes possibilities for risk mitigation and is already working on a patch that would fix the vulnerability. The BSI expects that this vulnerability will soon be used on the internet for attacks.
Executing Internet Explorer in "safe mode" and turning off "Acitve Scripting" [sic] makes attacks more difficult, but can't prevent them completely. Therefore, the BSI recommends that you use a different browser until Microsoft produces a patch.
The BSI will announce the fix of the vulnerability via its warning and information service "Burger-CERT." The BSI informs and warns citizens and small and middle-class companies about viruses, worms, and security vulnerabilities in applications using the Burger-CERT. The experts at the BSI analyze the current state of affairs regarding security on the internet 24/7 and send warnings and security advice via email.
My friend lives in an apartment complex where the main office set up for its residents to use has IE 6 on it. It's locked down and no one can update it. I talked to the manager about it and she said it's corporate's job. Wonderful. For at least a "computer lab" for regular people, I think it would be necessary to update IE to the latest version. Or at least offer an alternative browser.
I almost died the other day when I saw my public library computers all using IE 6, and people were surfing the Internet with it.
I want to say "I hate IE 6", but I think I don't like IE 7 either. In the public school system here, all the systems use IE 7 and it's slow as hell. I was trying to give a presentation the other day and every time I had to click a link on a website to show people something on a website, it would take forever to load. Of course, I blame some of this also on the terribly configured computers, but I'm pretty sure Firefox/Chrome would have loaded everything instantly.
In other words, I hate IE 6 the most. IE 7 still sucks. IE 8 is the only version of IE I would allow myself to use if I absolutely had to use it.
PDF is how they get IE to do it. It's still IE doing it.
Just like it's using your ethernet connection to infect your computer, but it isn't your Ethernet stack doing it.
For anyoned concerned about this, instead of a tin-foil hat, what about a Red Hat?
so clever!
At least provide a good command line program to update Firefox. What's that? You say updater[.exe] works via command line on Linux, Mac, and Windows by use of .mar files? No, it does not work on all of them, and further, there is no quiet/silent switch for updater, so it opens an "updating % complete" window. This isn't a problem for Windows, where the System user can write stuff to the login screen, but if you use ssh or ARD to run Firefox's updater on a bunch of Macs, unless someone happens to be logged in (anyone, as long as the screen isn't at the login), you'll get a permission denied error. I've never bothered to test it on Linux because apt or yum always has the latest version anyway.
.mar file for the sysadmin (configurable to a local source), and it would be suddenly scriptable for all platforms. But noooooo, they have to be speeeecial. Almost makes me want to start packaging a Windows version of Ice Weasel.
They could remove the GUI from updater[.exe] and make it download the latest
Because you have access to the Firefox source, you can "patch out" a vulnerability as soon as it is discovered. Maybe Mozilla doesn't have a patch, or won't for several weeks. In such a case, you can #ifdef 0 the vulnerable code, recompile, and use the crippled version until Mozilla issues a fix.
With proprietary code, your only option is to not use the application entirely. In Microsoft's case, that could mean (because IE is integrated into the OS) you have to leave your computer off until they have a fix. Much less convenient that merely compiling out the problematic code.
In short, the security options belong to the entity possessing the source code.
The society for a thought-free internet welcomes you.
Actually, web developers are the fundamental root cause of the web becoming less secure.
Used to be you could run in the high security zone, click a link, go to the next page. Well, except for online shopping, cookies had to be enabled. Now, on several sites those links are JavaScript this and JavaScript that. Click a JavaScript infested link with JavaScript disabled--nothing happens. So now JavaScript has to be enabled--gotta lower that browser security.
Used to be that a web page having graphics was GIF or JPEG or even PNG. Now, it's all video crap so a page can be one big SWF at the homepage with not even a no-flash link. Want to access the page, need to install the plug-in with all its security risks.
Truth is, MSIE 7 will not even allow a PDF to open in the High security zone. Adobe Reader won't even get launched.
Guys, if you want to do all this Web 2.0 crap that is all well and good, but you really also need a low-bandwidth Web 1.0 alaternative for those who still value browsing securely.
I love it when idiots rant about issues they have no real clue about. They think they are so clever that they end up looking stupid.
Firefox does not have an MSI ..... big deal. Neither do most of the software built for the Windows platform.
Is that a problem??? Only for incompetent idiots.
How many enterprise COTS tools that automate the installation software without human intervention are in the market?? HINT: You don't have enough fingers to count.
... and watch the laugh until they pee on themselves.
http://www.metasploit.com/redmine/projects/framework/repository/revisions/8136/entry/modules/exploits/windows/browser/ie_aurora.rb
Came out yesterday. Oh and it works for IE 7 and 8 (just not 100% reliably, but that can be modified). This is definitely in the wild now.
Having viruses and other types of malicious software running on the computer is so common that people don't care anymore. Seriously.. I see people working in the middle of a "adware popups up window, user closes it" kind of game and they don't even seem to bother. When is this going to change???
When people stop seeing "Joe Average" as the target demographic for everything, and mock any product that requires a little common sense and thought to use. When even people here stop complaining about things not being intuitive, or that they need to learn something to use it and other bullshit. Basically.. When ignorance stops being an acceptable state. So in other words.. Probably never.
It is difficult to get a man to understand something when his job depends on not understanding it.
http://blogoscoped.com/archive/2008-09-07-n33.html (September 2008)
It doesn't get any more "official" than this here. Yesterday, Saturday at around 20:07, Germany's oldest and perhaps biggest prime time news "Tagesschau" announced the following under the headline "Warning against internet browser":
"The Federal Office for Information Security warned internet users of the new browser Chrome. The application by the company Google should not be used for surfing the internet, as a spokesperson for the office told the "Berliner Zeitung"...
The BSI (a government agency and a subdivision of the Ministry of the Interior) issued a warning that people should use different browsers until the hole has been fixed.
Not quite the same, but still nice.
Well, MS's patch model for IE is basically a cumulative update every 2 months as part of a Patch Tuesday.
To whom it may concern (the person this skimming, bigmouth, & unjustifiable arrogant little 'noob' (in Bitztream), is "talking down to" here mainly I'd strongly wager)?
Take a read of the URL I post below next (because it puts BitZtream in his place, & so much so? HE RAN LIKE A TOTAL "BEYOTCH" right afterwards):
"Please tell me you aren't a programmer, you clearly don't get it." - by BitZtream (692029) on Saturday January 16, @02:05PM (#30792206)
http://tech.slashdot.org/comments.pl?sid=1512306&cid=30785704
I think that "little ditty" ought to "set YOU straight" about "shooting your mouth off" before you have read everything a person stated around here, don't you think?
Funny how you out & out RAN after I put that information out also, eh??
APK
P.S.=> You know, I wouldn't have done this to you, but I saw your ARROGANT REPLY here (and your erroneous skimming-a-thread reply to me on the same lines & tone from you too), so... you had it coming!
Now, the person who you are giving a hard time now here can just point you to that URL I just posted above, where you RAN, lol, after SHOOTING YOUR MOUTH OFF THE SAME WAY TO ME, only to have found you skimmed & overlooked I covered everything you noted & more (with simple, easy-to-understand math examples too no less, if you'd read it all that is)...
Nope - YOU had this coming! Especially after shooting your mouth off & trying to tell ME how MULTITHREADED PROGRAMMING WORKS (how/what/when/where/why to use it, or not) & I've been doing it quite possibly longer than you've ever been coding in total time yourself, is my guess here on this account.
So, please - FIRST: Learn patience with others, & realize, that MAYBE others haven't seen ALL you have, & one day? Those you attempt to "cut down" may very well become your superior in coding, OR, on the job period as a peer (if they're given time, & allowed to learn more etc. et al)...
SECONDLY: Tone down on the arrogance, because until you've a few "proofs of excellence" under your belt that anyone can see/verify easily enough? You do NOT have "what it takes" to attempt to "condescend", or to attempt to belittle others (because you NEVER KNOW WHO'S WATCHING, per the URL above I posted no less)... apk
the USA spy agency also knew about the recent attempted christmas day bombing too.
If there is no MSI packaging, no central administration capability, commercial demand won't exist since they will simply use MS IE with Administration Kit&Policy.
Even Skype, a really consumer oriented voice solution has a MSI package for business users. Guess the reason for that?
I guess this is one of my most replied posts, it seems people really have hard time understanding why some "large, stupid" companies stay with IE solution. It is chicken and egg, basic as that.