Nasty Data-Stealing Bug Haunts Internet Explorer 8

Trailrunner7 writes "There's an unpatched vulnerability in Internet Explorer 8 that enables simple data-stealing attacks by Web-based attackers and could lead to an attacker hijacking a user's authenticated session on a third-party site. The flaw, which a researcher said may have been known since 2008, lies in the way IE8 handles CSS. The vulnerability can be exploited through an attack scenario known as cross-domain theft, and researcher Chris Evans originally brought the problem to light in a blog post in December. At the time, all of the major browsers were vulnerable to the attack, but since then, Firefox, Chrome, Safari and Opera all have implemented a simple defense mechanism. The upshot of this is that if a victim has visited a given Web site, authenticated himself to the site, and then visits a site controlled by an attacker, the attacker would have the ability to hijack the user's session and extract supposedly confidential data. This attack works on the latest, fully patched release of IE8."

Comments

What?

[lennier1]

People still use MSIE?

Re:What?

[Beelzebud]

At least they get told "sorry, I love you, it won't happen again".

People using IE don't even get that much!

Re:Let me the first to say.....

[AnonymousClown]

Well, now, using Einstein's time dilation equations and multiplying by the number of years that IE has existed, the internet, the speed of the signals around the net, that 15 years from our perspective is actually 30 by IE's perspective.

Steve Hawking goes into a little more depth in his new book and Greene actually says String theory supports it too.

We're on our way to a Unified Theory all thanks to IE and Microsoft.

IE and Microsoft

[js3]

It's a strange thing. It seems the only reason IE exists it to repeated punch microsofts reputation in the face. I'm surprised one executive hasn't gotten so fed up and fired the "IE team" or replaced them with monkeys. I watch Channel 9 and there are some seriously smart people working at this company and yet this one program has done more to harm the company's reputation like no other.

Re:IE and Microsoft

[Zixaphir]

It's a strange thing. It seems the only reason Ballmer exists it to repeated punch Microsoft's reputation in the face. I'm surprised shareholders haven't gotten so fed up and fired the "Monkey Dance" Ballmer or replaced him with a better monkey. I watch Channel 9 and there are some seriously smart people working at this company and yet this one person has done more to harm the company's reputation like no other.

Re:IE and Microsoft

[WrongSizeGlass]

I'm surprised one executive hasn't gotten so fed up and fired the "IE team" or replaced them with monkeys.

Do you have any proof that they haven't been replaced by monkeys?

Re:IE and Microsoft

[grcumb]

Has Microsoft put out any Shakespeare yet? Then there's your proof.

I dunno, I consider MSIE to be the of the great tragedies of my lifetime....

Re:About 80% to 85% of all users worldwide...

[Lanteran]

actually its only 52% and dropping rapidly. If nothing else, at least MS is having to make a modern standards complaint browser. I for one, don't think it'll be enough to gain back much lost market share, but at least it'll make it easier on us web developers. Source: http://en.wikipedia.org/wiki/Internet_Explorer#Market_adoption_and_usage_share