Slashdot Mirror
IE Flaw Exploit In Hacker Kit 'Raises the Stakes'
CWmike writes "Roger Thompson, chief research officer of AVG Technologies, said Sunday that an exploit for the newest IE flaw had been added to the Eleonore crimeware attack kit. 'This raises the stakes considerably, as it means that anyone can buy the kit for a few hundred bucks, and they have a working zero-day,' Thompson said on his company's blog. Microsoft has promised to patch the vulnerability, but last week said the threat didn't warrant an 'out-of-band' update. Microsoft will deliver three security updates Nov. 9, but won't fix the IE bug then."
This bug is really only a serious problem for Windows XP users. (Yes, I know there are still a lot of them - however there are also a lot of Windows 7 users now and some Vista users). For Vista and Windows 7, since IE runs not just as a standard user, but also with Protected Mode (less than standard user rights and cannot write to the file system or registry outside of some very restricted locations, it isn't really an issue. Hence the lower priority on the patch.
IE is such a poor piece of technology. Before I enter a serious relationship, in addition to a background check, I also investigate the browser my potential significant other is using. If it's IE, I don't even bother since I don't date dummies.
Err, I don't really think you can call it a zero-day anymore.
There's this new tool you really should check out.
I'm sure you could purchase it somewhere, if you wished. Google would probably help. Or, you could just checkout the latest Metasploit SVN, which is probably where the Eleonore kit writers got the exploit. There's been PoC exploit code in there since Thursday.
Parent is right, it is only a problem for XP users
Not really a AV programs problem as it is that DEP (data execution prevention) isn't available in IE6 and isn't on by default in IE7. IE8 has it on by default so it is not possible to execute the attack on it. So if you are running the latest version of IE8 it is not a issue. OR you could be smart and stop using IE and run Firefox, Chrome, or any other browser that doesn't seem to have as many loopholes, bugs and exploits as IE does.
Right, Microsoft was sitting on this goldmine for the past 9 years just waiting to cash it in.
"Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
Pretty sure 4) follows from 2), thus negating the need for 3).
Now, collecting underwear...therein lies the true mystery.
Though at all times it bears remembering that Firefox, Chrome and Others are all vulnerable to serious exploits from time to time.
How is Microsoft not fixing a vulnerability news? I say let the Windows users rot in their crapware infested systems!
If taxation is legalized theft, then Capitalism is a prolonged rape followed by a slow death.
If you are an administrator of a system that by definition means you can do everything, including modify the registry. If you cannot understand this concept, then you need to learn more about how privilege levels in computers work and come back. There is no power without responsibility. The power to do something is the power to fuck something up.
Now as this applies to this specifically, most people who use Windows XP run as an administrator. They don't have to, you can run as a deprivileged user and indeed we make people here do that at work, but users do not choose to because it is a pain to do. That means any program they spawn runs with permissions to do anything, since that is the whole idea of an administrator. There is nothing special about a web browser, it is just a process. It can write to the registry, drive, or anything else. The OS doesn't put random restrictions on programs.
In Vista and 7, things are a little different. By default, even users flagged as administrators aren't actually running at an administrator privilege level. They run as regular users and have to elevate when they need to. This means that programs they launch without elevation cannot do things such as write to the registry, as that is not a normal user (and thus their programs) have. Also an additional layer of security was introduced called Mandatory Integrity Control. This allows for programs to be launched with even less privilege than a normal user has. This has to be configured per application, and the only thing I know that uses it is Internet Explorer. It restricts access much further, including denying read access to a great deal of what a user can read.
This is all the same deal as with UNIX. Though Windows permissions are different (Windows has far more granular security) it is the same basic thing. If you run a program as root in UNIX it can do everything, including mess with config files not belonging to it and so on. That is the point of root: To have access to everything. You can't grant that access to the user, but somehow deny it to the user's processes, that goes against the whole idea.
The fundamental problem is that people using XP and older run their systems as administrators, because it is easy to do. The first user you make is an administrator (the system must have one) and it doesn't make you make another. That means that all apps have all access.
But cerainly not the best one - a quick search on youtube yielded great results - check out the liquavista display.
Broken Windows create Jobs.
Well, that explains quite a bit, actually.
Cheers,
"What in the name of Fats Waller is that?"
"A four-foot prune."
Author contact details are here: https://damagelab.org/index.php?showtopic=17952&hl=eleonore
The post is from last year, but there's a bump from the autor on the second page. I don't know russian, checked it out using google.
Emotions! In your brain!
I wonder if this affects Windows Mobile 7? As I recall, it uses IE7. BTW, did you know that windows kill about a billion birds each year? No shit. They run into them, banging their heads again and again. Before anyone mods this off-topic, please consider the metaphor.
Maybe it's my memory, but I don't see the people behind those browsers say "I don't think this is serious enough for an out of band update". Out of band? Fix teh damn bugs as soon as you can and let people install the patches later if that's what makes them happy.
I just find it silly that so much of what is being discussed is all based upon this supposed tool with nary a source to be found. This whole seem things more like a plug for AVG than any real discussion on matters of import.
On the Oregon Cost born and raised, On the beach is where I spent most of my days
I helped a Doctor with his laptop a while back and he was using.....IE8 (GASP). He must have been dummy. I've also helped people who were dolts when it came to picking up malware and they were running Firefox.
Most people use IE8 because it is good enough and its security is fine as long as you are using Windows 7 or Vista. IE6 sucks, IE8 is just mediocre.
...is to stop using IE for anything. It's a garbage browser.
Why would anyone use it when there's so many higher-quality free alternatives? Firefox? Chrome?
Just let it die.
If the only way you can accept an assertion is by faith, then you are conceding that it can't be taken on its own merits
Yeah. But on the other hand, actual informed commentary would be lost on anyone but malware analysts/coders. Offensive computing has a sample and some initial dissection data at http://www.offensivecomputing.net/?q=node/1419, but anyone who would actually be interested already knows this.
Emotions! In your brain!
Internet explorer is Internet explorer. If you're using it, you deserve whatever you get.
"People don't want to learn linux" hasn't been a valid excuse since '03.
No, you're paying to an industry that centers around making itself obsolete.
Emotions! In your brain!
If the parent post is correct that only IE7 and earlier are vulnerable in their default configurations, the fair comparison would be to update support for browsers a year and a half out of date--are firefox 2.0 or 3.0 still getting timely security patches?
Why was this modded down?
why?
The new right fascists are bilingual. They speak English and Bullshit.
> Microsoft has promised to patch the vulnerability, but last week said the threat didn't warrant an 'out-of-band' update.
So, this is a zero-day HOW ?
What a depressingly stupid machine.
So if you read between Microsoft's lines, they appear to be suggesting a temporary workaround of not using IE.