Slashdot Mirror
IE Flaw Gives Hackers Access To User Files
snydeq writes "Microsoft warned that a flaw in IE gives attackers access to files stored on a PC under certain conditions. 'Our investigation so far has shown that if a user is using a version of Internet Explorer that is not running in Protected Mode an attacker may be able to access files with an already known filename and location,' Microsoft said in a security advisory. The vulnerability requires that an attacker knows the name of the file they want to access, according to the company."
Had Microsoft not needed something to drive a stake through Netscape's heart, it wouldn't have needed to concoct it's own Frankenstein's monster of confused and misbegotten priorities.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
When you go to my website I know what the cookie name is and I know the default file system location for that cookie. This one seems pretty bad.
I wonder how many people have a "passwords.txt" file in their Documents. ;-)
an attacker may be able to access files with an already known filename and location
One more reason not to keep your files in "My Documents". That part is easily guessed; "2009 Income Tax Returns" would be easy to guess as well.
"Protected Mode prevents exploitation of this vulnerability and is running by default for versions of Internet Explorer on Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008," it said.
Does XP have a protected mode? That's the version of Windows most people use IINM. Is this a ploy to get people to upgrade from XP?
Microsoft hasn't seen any attacks that exploit the flaw and has yet to decide whether to repair the flaw through its monthly security patch release cycle or an urgent, out-of-cycle update.
Has yet to decide whether to repair it? Hmmm... Ok, they're trying to decide when to. How about doing what every other browser company does and give us the patch NOW?
Free Martian Whores!
Hmm.. the most obvious predictable file names are conveniently the most dangerous for someone to have access to.
Core Security Advisory FTW
This is just fucking stupid. WHY DO PEOPLE AND BUSINESSES STILL USE IE?
We KNOW it's full of holes. Not just small ones, but literally, gaping goatse-sized holes. This is a perfect example, to go along with the hundreds of other problems we know of.
There are so many alternatives today! We are living in a time of plenty when it comes to browsers. I mean, we have Opera that runs just about everywhere. We have Firefox if you want extensibility. If you prefer the feel of the old Netscape Communicator suite, there's Seamonkey. If you want a fast browsing experience, use Chrome or Safari or Konqueror.
Legacy ActiveX controls just aren't enough of an excuse these days. If you're still using that piece of shit "technology", then you need to get your network off of the public Internet. You and your network are nothing but a disaster waiting to happen.
"The vulnerability requires that an attacker knows the name of the file they want to access, according to the company."
Good thing no one knows to look for: "%USERPROFILE%\My Documents\Quicken\qdata.qdf"
Modifying hosts.txt could be one of the biggest issues with this one. And yet, it's just another flaw much like there are hundreds of others in any browser.
Have you heard about SoylentNews?
There is nothing to see here folks, move on. The bug kicks in only under certain circumstances. The circumstances are apparently running a Windows system with Internet Explorer as the default browser. Come on, how many slashdotters do that?
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
If they grab the windows search index file then they'd have a map to everything else?
get \ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb (vista)
or \All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Windows.edb (xp)
and http://www.simplecarver.com/tool.php?toolname=Windows Search Index Extractor
I run IE in Firefox mode, so I think I'm protected. ;)
Unfortunately, the thread asking for Webkit in Steam at http://forums.steampowered.com/forums/showthread.php?t=861863 demonstrates how clueless the average gamer is about standards etc.
Some choice quotations:
"ie is fine"
"I'd rather not have steam bloated with redundant tech right now."
"Also W3C != Web Standards, and IE aren't the only ones not complying with the "standards", Firefox didn't comply with all W3C published recommendations either.(Don't know if that's still the case) [...] Microsoft is a business, and they don't want to take the blame because of a third parties inabillity to properly design websites. That is their design goal, and as the W3C isn't enforcable, as it's not considered a standard"
"It works, it is secure and it isn't that slow"
"IE is fine, and so was Windows 98."
"there is nothing wrong with the day-to-day performance of Trident."
That part is easily guessed; "2009 Income Tax Returns" would be easy to guess as well.
Oh shit ... hackers can find out how broke I really am!!
"Protected mode" is a marketing term meaning IE takes advantage of Vista's new permissions model. It means it's a low-privilege process and has most of its file system access effectively jailed or redirected.
Long-winded article here, but I'm guessing the hack doesn't work in "Protected Mode" because the browser itself doesn't have much file system access.
DATABASE WOW WOW
Because there isn't an easily found, well known file that is a handy index of all of the files on your system:
\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb
http://en.wikipedia.org/wiki/Windows_Search
You mean like...
C:\users\%username%\AppData\Local\Microsoft\Outlook\outlook.pst?
hmmm...??? like that?
A computer once beat me at chess, but it was no match for me at kick boxing. Emo Philips
If things keep going like this regarding Microsoft and clever words, pretty soon this will be on Slashdot:
"Microsoft has announced that it is investigating a vulnerability in IE where an attacker can gain access to customer's computer if they are connected to Internet. But as all versions of Windows do not have internet access by default, most users are not vulnerable"
.
Well to be fair, they are somewhat correct. While I don't like the clunky browsing withing steam or the in-game overlay, switching over to other engine would be a lot of work and testing to Valve and could create even more problems to users. And that's all while the browser component is a side thing.
For example IE and it's embedded component is supported on all versions of Windows. If Steam were to integrate their own browsing engine, they would have to make sure it works for 100% of users and they would have to maintain it. IE works in all situations as long as it already works for the user (which is pretty much every case) and the component gets updated along when user updates IE.
While I myself care a lot about standards, I don't see why an average gamer would do so. It already works well enough and is stable, so there's little to gain over the amount of added work it would put on Valve. I'm not even sure if any browser engine including Webkit can draw on DirectX surface anyway - they would have to the draw window contents to bitmap -> transfer to texture -> draw on DX surface anyway.
Nobody knows where i keep THIS file.
>Nobody ships with all of the W3C published recommendations. That's just stupid. You can't hit a moving target like that.
No no no no... red herring... you've been misled.
A browser does NOT need to support all W3C recommendations.
This is true for all browsers, even for IE.
What all browsers are EXPECTED to do is - "if" they support a recommendation - that they do what the recommendation SPECIFIES.
In other words, you choose to a CSS attribute CORRECT.. or do it NOT AT ALL. IE would randomly do something *undefined* instead of nothing.
Web developers literally spent YEARS reverse-engineering the exact behavior of Microsoft's undocumented standard. Had Microsoft not done anything at all with certain elements, the behavior would be quickly understood.
I'll give you an example: IE 6 and 7 would recognize many attributes for CSS padding and margins. IE would certainly do something with these attributes... but what they did was the OPPOSITE of the specs in some cases. Not only that, but the inheritance rules were not consistent. You literally had to write 2X the CSS code if you wanted your web-standards code to work on IE6.
This worked well for Microsoft - they essentially killed all progress on the web for a DECADE. Companies who locked themselves into IE6-based intranets did not care because there was no FireFox and no basis for Microsoft to put out new browser technology. MS wanted people to give up on HTML and just write everything in .NET. This is a holdover from the Microsoft "Blackbird" project, which seriously wanted to replace web HTML with compiled binary Microsoft-patented markup. Bill Gate's emails in the trial said he didn't want their bugs fixed if they were only causing problems in non-Microsoft browsers.
When a browser does not support an effect, you can easily workaround it. For example, if I couldn't assign a yellow background to an link, I could easily change course and wrap the A in a DIV and assign the style there instead. But what if the link color ceased to be yellow whenever that DIV was positioned with absolute instead of relative? What if the link disappeared whenever the DIV was inside a BODY tag which had a CSS background attribute?
It's the *random* nature of MSIE bugs (and the arrogance of not fixing them) that made web developers the most vocal critics of Microsoft.
if FireFox versions have issues with following the standard wrong, that gets fixed but it also is published what versions had that bug. So it's easy to design around without self-doubting your markup and CSS. You still can't go to the Microsoft website and get a solid definition of their CSS Box Model bugs.
So, what percentage of W3 that gets implemented is not ever an issue; it's the quality and the truthfulness of the implementation.
The problem is they call me to tell them how to disable it, after spending 20 minutes getting frustrated because they have no idea which of those dozen scripts is the right one. Now surely it can't be that hard to scan the page, look for the *.flv or *.mp4 and give the user an easy "play video" button, followed by an "advanced button" sitting beside it if there are scripts besides the video?
Sadly I am not a coder but what I am thinking of would NOT lower security, nor take away features from the user, simply give the less advanced user a less advanced option to make their usage a little easier. The geeks would simply have to press a single button in options to keep the advanced (read regular) menu, while the less tech savvy would have a single button that says "play video" and a single button that says "advanced" where it would pop up the regular menu when pressed. Because I have seen pages with video where the Noscript list of blocked items nearly extends off the page, and having to click those one at a time until you trip over the right one is frustrating. I just think it needs to be a little easier for the average Joe to use, that's all.
ACs don't waste your time replying, your posts are never seen by me.