Slashdot Mirror
Microsoft To Ship Emergency IE Patch
Grotendo writes "Microsoft plans to release an emergency patch for Internet Explorer very soon to counter targeted attacks and the publication of exploit code for a 'browse and you're owned' vulnerability in its flagship Web browser. The out-of-band update will be released once the company is satisfied that it has been properly tested against all affected versions of Windows. This could happen as early as this weekend." Microsoft has downplayed the seriousness of the IE zero-day, and insisted that it affects only IE6 even as security researchers close in on exploits for IE7 and IE8. Microsoft has had no comment about the firestorm that Google unleashed by directly accusing the Chinese of cyber espionage. ShadowServer has up a sobering post on the massive extent of the problem of "groups that can be referred to as the Advanced Persistent Threat."
I'm uploading the IE6 No More code to my website now. There's a point where users of outdated software need to be told there's four major cost-free options, including a much updated version of IE if they want to stick with IE. I'm almost thinking we should move from a warning to a service-denying error if this goes much further.
I think microsoft have commented on the firestorm... wonder why Ballmer wanted to make it out as no big deal?
targeted attacks and the publication of exploit code for a 'browse and you're owned' vulnerability in its flagship Web browser
IE 6 hasn't been Microsoft's flagship browser for 4 years.
Hikery.net - The best hiking site ever. Made by yours truly.
Microsoft is not "countering the targeted attacks".
Unless of course the German and France CERT teams recommendation to ditch IE is considered one.
It uninstalls all versions of Internet Explorer and installs Firefox with Adblock pre-installed.
Bravo Microsoft!
And that is running Windows Update and it isn't that good at doing that....
Tsukasa: All I really want, is to be left alone...
Make it painfully clear to IE6 users what they're doing.
My version, which is more educational for them.
Microsoft only has to say that IE6 is vulnerable and IE7-8 can't be exploited using same attack. The net will do the rest.
Oh good I was wondering when this would come out.....oh wait I don't use IE nor does anyone with half a brain.
This is MS Marketing to make the Germans accept IE again.
NO, WE WON'T GO BACK TO THAT SH*T !!
Now we can all be pirates !
Do you find yourself mysteriously waking up in a back alley more than once a week?
Do you find empty HTML pages littering your desktop and you have no idea where they came from?
Do you discover new directories on your computer?
Get the IE Patch!
It comes in 4 strengths so you can be gradually weaned from the habit.
Week 1. IE 6 Patch. Internet cravings are pretty intense the first week so the IE 6 Patch is there to help you learn how to just say "NO".
Week 2. IE 7 Patch. It's easier to avoid launching IE. You still need to check Amazon or e-Bay from time to time but the edge has been honed down a bit.
Week 3. IE 8 Patch. You find it a lot easier to avoid clicking on the 'e' although you still lapse when you aren't thinking.
Week 4. Firefox. You've mastered the addiction. You're free to browse the Internet worry free. Even looking at the 'e' makes you nauseous.
Congratulations on taking the first step to breaking the IE addiction.
[John]
Shit better not happen!
Funny - that site's little code examples don't include Opera as one of the modern browser options. What's the author got against the big o?
Also.. adjust the code so it pulls all its data from your local server; there's no need for that site to know who your visitors are, and there's no need for your page to load any more slowly due to external connections than is absolutely necessary.
Nothing wrong with attempting retries, at least as long as you limit the number of attempts.
Sorry, I stopped reading after 'MicroSoft'...
I'm so glad I upgraded from XP to Windows 7; with multi-core optimisations and improved app performance, I'm compromised faster than ever before!
This comes in handy to define the worst job a human can get!
.. not that maintaining IE8 would be much better but I can bet they pay u more!
Fixing major flaws in a 10 y.o. completely flawed browser...
You could call it: "Senior Ancient Flaws Engineer" or whatever!..
Ten points, m'lad, for Non Sequitur of the Day!!!
The world's burning. Moped Jesus spotted on I50. Details at 11.
Uhhh... yes the do (as of a few days ago): http://gmailblog.blogspot.com/2010/01/default-https-access-for-gmail.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+OfficialGmailBlog+(Gmail+Blog)
This post cannot be rebroadcast without the express written constent of Major League Baseball.
And what's going to happen to all those "IE only" web sites the government, public schools and other agencies like to use?
"If any question why we died, Tell them because our fathers lied."
.. what a one-sided crock.
If you were under attack from a foreign entity wouldn't you fight back with everything you had? Chicken, meet egg.
The US has been attacking China for years and vice versa. Let's be honest here. If either let their guard down there'd be more of a victim than a search engine and advertising company.
Instead of releasing more trash - recall IE. Problem solved.
Hope is the currency of fools
I think you might gotten trolled. But I'm not entirely sure. But yes, GMail is now SSL by default.
Opera is on the Wii, DS and of course many a mobile phone whose own browser sucks, but often with a fake user_agent string.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
Wow, so that's... 4 days after full disclosure that they announce their response.
"Could be here as soon as this weekend", which is still more than a week from the exploit being published. That's swell.
Anyone else grateful MSFT doesn't run the fire department?
I just updated to 9.3 after having shut off the reader auto update! However after reading the specifics of how reader before version 9.3 was compromised it is rather telling that the attack vector was a call to a WMP that left open space. It left buffers open but not in the Reader section of the malloc. This would indicate that there might just be another un-patched hole in external program calls to Windows Media Player or perhaps in WMP itself. It would not surprise me if the Reader exploit was actually another WMP exploit involving bad memory allocation practices from Microsoft!
ie = internet exploiter -- I think a can of cat food has more security than anything MS produces ....
Browser independence, is what you should have done/insisted on in the first place, which would have resulted in push back on M$ non inter-operable crap.
I wonder if this is why there has been a sudden, dramatic increase in the number of my company's clients who have users getting infected with malware in recent days.
At least two governments officially stating to avoid IE, others in fear, every single web developer on the country hating you, Google getting hacked, and every security expert on the planet laughing at you?
Wow. Just wow.
May I extrapolate from that, what it would take, to get a real Bugzilla for IE and make it follow recent standards?
My guess: Inter-dimensional time war with Lovecraft’s the old ones, lead by Cthulhu, fighting the Shrike and its army, armed with gamma ray bursts and black holes, using giant stars as ammunition.
On the other hand: That would be awesome!
Any sufficiently advanced intelligence is indistinguishable from stupidity.
Has been stated and rebutted literally millions of times, the problem with M$ crap is not that it is popular, it is that it is criminally defectively by design, and because of Backward Compatibility, and secret api's shared only with valued customers they absolutely can never fix it. Anyone tells you about OS secrets is selling snake oil.
1. There are 3,500 Windoze api calls, POSIX < 200, Linux ~ 250, new functionality over 10 years,
2. Windoze will execute any crap base on ".ext" so it will just execute ".exe" files, no question, no request permission,
3. COM automation, the keys to the system,
I operate a number of linux boxes, connected directly to the net, and after a while I realised that firewalls were a waste of time and too much a blunt instrument, and that I could trim and lock down most services better on an ad hoc basis. eg TCP wrappers and some, 6 IPTABLES rules. The only thing, recently, is attempted SSH brute force attacks and the suggested, and contorted response to them, which was SysAdmin gone mad. SSH can be patched to restore the retry-delay and back-off algorithms which are used for normal logins, and to tar-pit the attacker, and in my experience this works real well, the botnets go, and dont return.
Way to go, citizens. March on!
1. Tabs are Tabs,
2. You only need a sandbox if you have open wounds, IE6 or are Immune Compromised that ie: Windoze* IE*,
3. You don't need NoScript,
4. ACID is a database test, and has nothing to do with HTML compliance, your ass and ignorance is showing!
5. We do care about HTML compliance and a commitment to inter-operate properly since it reduces complexity and simplifies testing, both of which cost a lot of money.
Isn't it time you moved out of your mother's basement?
I thought that was a really slick marketing twist on someone's part.
It should RUN for 10 years on stable HARDWARE.
Only a complete M$ dummy would pull that naive crap, there are SunOS 4 systems still running reliably in server rooms.
I just despair at your credulousness and stupidity.
www.mozilla.com
I am the unwilling control for my Origin.
Sane people don't use IE 6 anymore, that browser needs to die!
Your mom is my girl friend
They look totally different to the popup-style messages on compromised websites saying "Your Anti Virus is out of date! Download our version!" or "You have been infected by Win32.BullRubbish.exe.foobar! Upgrade to New Anticrap UberVirusWare 2011!"
You're training them to download stuff from the web, from sites they don't regularly visit / don't trust, because a popup told them to.
Well done.
Finally had enough. Come see us over at https://soylentnews.org/
Isn't "browse and we own you" the brunt of the IE EULA, anyway ?
What a depressingly stupid machine.
"It uninstalls all versions of Internet Explorer and installs Firefox with Adblock pre-installed." - by rehtonAesoohC (954490) on Tuesday January 19, @03:33PM (#30824104)
HOSTS files are a superior solution vs. Adblock, & here is how + why:
10 POINTS IN FAVOR OF HOSTS FILES vs. ADBLOCK:
----
1.) HOSTS files eat no CPU cycles like browser addons do no less!
2.) HOSTS files are a solution (for security) which also globally extends to EVERY WEBBOUND APP YOU HAVE
3.) HOSTS files are also NOT severely LIMITED TO 1 BROWSER FAMILY ONLY... browser addons, are.
4.) HOSTS files also can speed up (all apps that are webbound) any app you have that goes to the internet.
5.) HOSTS files are EASILY user controlled, obtained (for reliable + regularly updated ones -> http://en.wikipedia.org/wiki/Hosts_file (mvps.org's is a GREAT choice there)) & edited too + via any text editor (which every system has).
6.) HOSTS files aren't as vulnerable to "bugs" either like programs/libs/extensions of that nature are (OR, even DNS servers).
7.) HOSTS files are also EASILY secured well, via write-protection "read-only" attributes set on them, or more radically, via ACL's even
8.) HOSTS files allow you to bypass DNS Server requests logs (via hardcoding your favorite sites into a HOSTS file to avoid not only the TIME taken roundtrip to an external DNS server, but also for avoiding those logs OR a DNS server that has been compromised (see Dan Kaminsky online, on that note)).
9.) HOSTS files will allow you to get to sites you like, via hardcoding your favs into a HOSTS file, FAR faster than DNS servers can by FAR.
10.) HOSTS files also allow you to not worry about a DNS server being compromised, or downed (if either occurs, you STILL get to sites you hardcode in a HOSTS file anyhow in EITHER case).
----
I think that about does it, for that...
APK
P.S.=> However, the NICEST part here is, IS that HOSTS files and ANY BROWSER ADDONS (for any webbrowser also, mind you) work TOGETHER just fine, & for the concept of "layered security" (which is the overall "best of all possible worlds" here)... apk
"Whether you like it or not, Opera is *massive* in Europe and has a far greater market share than you'd like to believe." - by A Friendly Troll (1017492) on Tuesday January 19, @05:28PM (#30825616)
Per my subject-line above: Well, I BELIEVE YOU, & here are the reasons as to why:
====
A.) For SPEED (& even in javascript for the LONGEST time, until FF's new engines took its place (until Opera 10.50 @ least, because that's gotten a decent "boost" in that area -> http://tech.slashdot.org/article.pl?sid=09/12/22/1911216 (not that it matters though, speeding up javascript is like asking to get infected by malscripted sites &/or adbanners faster imo @ least - that of a "POV" of PC security, mostly)):
http://www.howtocreate.co.uk/browserSpeed.html
and
http://crave.cnet.co.uk/cnetuk/crave/software/0,39029471,49302491,00.htm
AND
http://nontroppo.org/timer/kestrel_tests/
(Opera "rocked the planet" in those cases... bigtime (& ESPECIALLY ON THE MOST USED PLATFORM THERE IS, BAR-NONE, FOR PC-COMPUTING: Windows!))
----
AND, for SECURITY also (less vulnerabilities present over time than IE or FF, per SECUNIA.COM stats):
INTERNET EXPLORER 8.x VULNERABILITIES STATS:(01/21/2010)
http://secunia.com/advisories/product/21625/?task=advisories
(UNPATCHED = 4-8 / 50% (though 1 of them, the "Critical 'Out-of-Band' Cumulative Update IS patched, as of about 1 hr. ago (go get it those of you that use MS OS' that is...)))
---
FIREFOX 3.x VULNERABILITIES STATS:(01/21/2010)
(UNPATCHED = 0-6 / 0% (on this note, as you can see? FF had MORE advisories, over time as I noted, but... they've done a GREAT JOB in stopping that much (now, the same has to be said for their browser addons too, but that too, improves over time as well usually))
Most Critical Unpatched
There are no unpatched Secunia advisories affecting this product, when all vendor patches are applied..
----
OPERA 10.x VULNERABILITIES STATS:(01/21/2010)
http://secunia.com/advisories/product/26745/?task=statistics
(UNPATCHED = 0-3 / 0% )
Most Critical Unpatched
There are no unpatched Secunia advisories affecting this product, when all vendor patches are applied..
====
Opera ROCKS, period (or, do the stats above make me a liar? I think not...) &, it's been able to pass the "ACID TESTS" for compliance to web-based standards since version 6.x iirc, & it was (iirc) actually the FIRST BROWSER (not development kit) to do so, but when counting dev kits, it was 2nd... correct me if I am "off" here on this last point though, guys, & thanks.
APK
P.S.=> Again though, I tend to believe you (& Opera has a BIG "share-of-market" on MOBILE DEVICES as well, which others seem to overlook QUITE A BIT too)... Once more, imo @ least? Well - Opera's great!
I.E.-> It took me away from being a FireFox user primarily in fact, because of it (& FF + IE have copied Opera's features RAMPANTLY over time (e.g.-> Tabbed Browsing anyone? As far as ADDONS also?? Heh, a LOT of what FF has in browser addons, Opera already has natively (minus the CPU usage + speed hits & security vulnerabilities that webbrowser addons introduce (more than potentially too, ala Greasemonkey having that before (as only 1 single example)))... apk