Slashdot Mirror
IE Flaw Exploit In Hacker Kit 'Raises the Stakes'
CWmike writes "Roger Thompson, chief research officer of AVG Technologies, said Sunday that an exploit for the newest IE flaw had been added to the Eleonore crimeware attack kit. 'This raises the stakes considerably, as it means that anyone can buy the kit for a few hundred bucks, and they have a working zero-day,' Thompson said on his company's blog. Microsoft has promised to patch the vulnerability, but last week said the threat didn't warrant an 'out-of-band' update. Microsoft will deliver three security updates Nov. 9, but won't fix the IE bug then."
This bug is really only a serious problem for Windows XP users. (Yes, I know there are still a lot of them - however there are also a lot of Windows 7 users now and some Vista users). For Vista and Windows 7, since IE runs not just as a standard user, but also with Protected Mode (less than standard user rights and cannot write to the file system or registry outside of some very restricted locations, it isn't really an issue. Hence the lower priority on the patch.
IE is such a poor piece of technology. Before I enter a serious relationship, in addition to a background check, I also investigate the browser my potential significant other is using. If it's IE, I don't even bother since I don't date dummies.
Err, I don't really think you can call it a zero-day anymore.
I just needed a small botnet to promote my new penis enlargement and university degree business.
Where can I purchase it? I mean if they state there is a product and even quote a price one would assume it's purchasable somewhere.
On the Oregon Cost born and raised, On the beach is where I spent most of my days
Where can I buy it ? Or maybe anyone know of a torrent tracker specialized in such kit ?
Ever since AVG decided to break compatibility with previous versions and introduce nagware in their current products, I have decided to avoid Grisoft.
Are there AV solutions available that handle this latest problem yet? Does MS Security Essentials do it?
are the same people who make profit from making software to 'be safe from it'
the same was with a botnet-study which was reported here a year or few back;
it had the botnets drawn to a network-graph with their ips and domain-names included.
the ips of all 'anti-identify theft' led through a central hub, they were comparing eachother in pricing and performance or "what's included in the deal".
you're paying to a mafia.
1. Make browser with undocumented vulnerabilities 2. Sell exploits for lucrative prices 3. ????? 4. Profit!!!
Politics is Treachery, Religion is Brainwashing
Parent is right, it is only a problem for XP users
Hacker kit exploit IE flaw.
Yours In Electrogorsk,
Kilgore T.
P.S.: Sarah Palin for former U.S.A. President ! Go bitch.
How is Microsoft not fixing a vulnerability news? I say let the Windows users rot in their crapware infested systems!
If taxation is legalized theft, then Capitalism is a prolonged rape followed by a slow death.
If you are an administrator of a system that by definition means you can do everything, including modify the registry. If you cannot understand this concept, then you need to learn more about how privilege levels in computers work and come back. There is no power without responsibility. The power to do something is the power to fuck something up.
Now as this applies to this specifically, most people who use Windows XP run as an administrator. They don't have to, you can run as a deprivileged user and indeed we make people here do that at work, but users do not choose to because it is a pain to do. That means any program they spawn runs with permissions to do anything, since that is the whole idea of an administrator. There is nothing special about a web browser, it is just a process. It can write to the registry, drive, or anything else. The OS doesn't put random restrictions on programs.
In Vista and 7, things are a little different. By default, even users flagged as administrators aren't actually running at an administrator privilege level. They run as regular users and have to elevate when they need to. This means that programs they launch without elevation cannot do things such as write to the registry, as that is not a normal user (and thus their programs) have. Also an additional layer of security was introduced called Mandatory Integrity Control. This allows for programs to be launched with even less privilege than a normal user has. This has to be configured per application, and the only thing I know that uses it is Internet Explorer. It restricts access much further, including denying read access to a great deal of what a user can read.
This is all the same deal as with UNIX. Though Windows permissions are different (Windows has far more granular security) it is the same basic thing. If you run a program as root in UNIX it can do everything, including mess with config files not belonging to it and so on. That is the point of root: To have access to everything. You can't grant that access to the user, but somehow deny it to the user's processes, that goes against the whole idea.
The fundamental problem is that people using XP and older run their systems as administrators, because it is easy to do. The first user you make is an administrator (the system must have one) and it doesn't make you make another. That means that all apps have all access.
But cerainly not the best one - a quick search on youtube yielded great results - check out the liquavista display.
Broken Windows create Jobs.
Well, that explains quite a bit, actually.
Cheers,
"What in the name of Fats Waller is that?"
"A four-foot prune."
I wonder if this affects Windows Mobile 7? As I recall, it uses IE7. BTW, did you know that windows kill about a billion birds each year? No shit. They run into them, banging their heads again and again. Before anyone mods this off-topic, please consider the metaphor.
Learn what their for and how to use them.
I helped a Doctor with his laptop a while back and he was using.....IE8 (GASP). He must have been dummy. I've also helped people who were dolts when it came to picking up malware and they were running Firefox.
Most people use IE8 because it is good enough and its security is fine as long as you are using Windows 7 or Vista. IE6 sucks, IE8 is just mediocre.
...is to stop using IE for anything. It's a garbage browser.
Why would anyone use it when there's so many higher-quality free alternatives? Firefox? Chrome?
Just let it die.
If the only way you can accept an assertion is by faith, then you are conceding that it can't be taken on its own merits
Internet explorer is Internet explorer. If you're using it, you deserve whatever you get.
"People don't want to learn linux" hasn't been a valid excuse since '03.
And the mobile IE is more like IE 7.5.
> Microsoft has promised to patch the vulnerability, but last week said the threat didn't warrant an 'out-of-band' update.
So, this is a zero-day HOW ?
What a depressingly stupid machine.
So if you read between Microsoft's lines, they appear to be suggesting a temporary workaround of not using IE.