Slashdot Mirror
Nasty Data-Stealing Bug Haunts Internet Explorer 8
Trailrunner7 writes "There's an unpatched vulnerability in Internet Explorer 8 that enables simple data-stealing attacks by Web-based attackers and could lead to an attacker hijacking a user's authenticated session on a third-party site. The flaw, which a researcher said may have been known since 2008, lies in the way IE8 handles CSS. The vulnerability can be exploited through an attack scenario known as cross-domain theft, and researcher Chris Evans originally brought the problem to light in a blog post in December. At the time, all of the major browsers were vulnerable to the attack, but since then, Firefox, Chrome, Safari and Opera all have implemented a simple defense mechanism. The upshot of this is that if a victim has visited a given Web site, authenticated himself to the site, and then visits a site controlled by an attacker, the attacker would have the ability to hijack the user's session and extract supposedly confidential data. This attack works on the latest, fully patched release of IE8."
how about ie9?
IE as well know, unpatched security vulnerabilities? Thats so surprising!
People still use MSIE?
Eh, more like 15, but who's counting?
I just upgraded to IE 8 yesterday to verify a support issue.
Steve Hawking goes into a little more depth in his new book and Greene actually says String theory supports it too.
We're on our way to a Unified Theory all thanks to IE and Microsoft.
RIP America
July 4, 1776 - September 11, 2001
Can't remember the last time I fired up IE (I do have IE8 installed).
Kudos to FF team. Thank god I don't work on webapps anymore.
Fuck systemd. Fuck Redhat. Fuck Soylent, too. Wait, scratch the last one.
It's a strange thing. It seems the only reason IE exists it to repeated punch microsofts reputation in the face. I'm surprised one executive hasn't gotten so fed up and fired the "IE team" or replaced them with monkeys. I watch Channel 9 and there are some seriously smart people working at this company and yet this one program has done more to harm the company's reputation like no other.
did you forget to take your meds?
To be fair, it's an honest enough mistake. It just seems like it's been 30 years, what with all the waiting and the retro styling for all those years.
IE's world-wide market share is currently around 80% to 85% of all web users.
Alternate browsers have very poor support for properly rendering the text of most Asian languages, while IE has exceptionally good support, so the use of alternate browsers in places like Japan, China, Thailand, Taiwan and the Koreas is virtually unheard of. These markets, which are already far larger than the American or European markets, are still growing.
Don't let the W3Schools stats confuse you. Those are for a small subset of the comparatively small American market, and thus aren't indicative of the global trends.
why fix it?
if you're using internet explorer, you deserve every bug you get. If you're in one of those companies that mandates IE or something, company data theft is their fault and their loss. If you're reading slashdot, chances are you know that entering your personal data on one of those computers is probably a bad idea because besides internet explorer, they also more than likely have company monitoring software installed.
"People don't want to learn linux" hasn't been a valid excuse since '03.
No matter what browser you use you should expect a bug like this. Thinking your browser is secure because it has patched a flaw that Internet Explorer has not is a colossal oversight.
We always hear about "sites controlled by an attacker", any one have a daily updating list of compromised sites?
6.8SPC TR of 550, l xwind at 6, drift rt at 26" drops 77". AT has 503 ft-lbs at 1403 fps. FT 0.86
and it's barely above 50% on weekdays. That'll end soon too.
The disparity in years is just IE misinterpreting the dimension of time, like the box model bug.
Q: What does the "B." in Benoit B. Mandelbrot stand for? A: Benoit B. Mandelbrot
Hey! It's 30... if you did the math on a Windows PC...
You have the right to remain sentient. If you give up the right to remain sentient, you will be elected to public office
God's ten commandments aren't adhered to ... well at least a major subset of them. How can you expect the rest of the population to listen to administrators when they suggest "don't use IE"?
to code or not to code, that is the question.
We have Firefox, Chrome, Safari, Opera and people are still using IE. It sure makes one pause for a moment.
>15 years from our perspective is actually 30 by IE's perspective.
The there are those that feel it should be measured in dog years
Here's a nice pdf archived by wikimedia that shows where the problem is: AOL/NCSA Online Safety Study (2004).
I can't believe I'd never seen this before today.
Help stamp out iliturcy.
Data theft is easy to detect, just look for missing data. These sound like data spying/eavesdropping attacks, that is, where the attacker is able to monitor all your data without your knowledge. Nowadays it seems that "theft" has come to mean "something I don't like".
Actually I use all of the above save Safari. [Me and Apple related stuff don't get along. I can even crash current Macs just using them normally. Well, normally for me.] Each browser has its virtues and its warts. And in my setting, all of them usually run as a virtual appliance since all of them could, hell probably have, 0-days and currently unpublicized vulnerabilities. Fact of life, deal with it. Since I normally 'power-off' the VA rather than save it, any crack ain't going very far. I've been doing this since VMWare started releasing betas way back around the turn of the millenium. [Its why I virtualized my browsers and servers in the first place. Security and ease of recovery. Consolidation once computers became powerful enough was just a side benefit.]
Here IE is only used on Microsoft sites and in beta-testing. Otherwise, it's usually FF since I have it customized my way. A ton of security extensions, especially Reverse DNS, and my current favorite shadow theme. Opera is just sweet and doesn't get the attention it deserves.
Just my $.02
"[I]t is a wise man who admits the limits of his knowledge or skill, and that pretending either causes harm." --Terry Go
Eh, more like 15, but who's counting?
Internet Explorer is not one browser, but a legion of browsers.
Versions of IE still in use (not counting minor, but still mutually incompatible and in use, versions, or old Mac IE):
IE 4: 13 years
IE 5: 11 years
IE 6: 9 years
IE 7: 4 years
IE 8: 1 year
============
IE: 29 years
30 years sounds like a good estimate.
Going for shiny instead of fixing bugs? Have the KDE4 team been taking notes or something?
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
IE's box model was never a bug. The W3C changed their definition of how widths of certain elements worked vs how they worked in HTML 3.2 and prior, and both IE and netscape (both major browsers at the time) implemented it for backwards compatibility. The W3C finally (sort of) fixed their "mistake" in CSS3 where they have a specific property to say how the box model works, although they still didn't make that default as they should have to allow full backwards compatibility and change the definition. Poor planning on their part.