Slashdot Mirror
New IE Vulnerability Used In Targeted Attacks; IE9, IE10 Users Safe
An anonymous reader writes "Criminals are using a new Internet Explorer security hole to attack Windows computers in targeted attacks, though the vulnerability could end up being more widely exploited. While IE9 and IE10 are not affected, versions IE6, IE7, and IE8 are. It's great to see that the latest versions of IE are immune, but this new vulnerability is still bad news for Windows XP users and earlier since they cannot upgrade to more recent versions of Microsoft's browser. 'We are actively investigating reports of a small, targeted issue affecting Internet Explorer 6-8,' Dustin Childs of Microsoft Trustworthy Computing told TNW. 'We will take appropriate action to help keep customers protected once our analysis is complete. People using Internet Explorer 9-10 are not impacted.'"
I tried out IE 10 and it was great. It downloaded firefox and chrome even better than ever. People who haven't updated should. Too bad XP users can't use it though.
There is only one site on which I still use IE--YouTube! For some strange reason, Flash doesn't work very well in Chrome with my old XP machine. In a short time, XP itself will be not be maintained, so it's a curious state of affairs. IE doesn't perform as well as it did before either. I assume this is Flash demanding more of the CPU; but it's not a priority for me to figure this out. Unfortunately I haven't find a way to "nice" a plug-in like Flash, so regardless of which browser I'm using Flash gets interrupted due to mouse movements. This never used to be a problem. It happens in both IE and Chrome; but it's worse in Chrome. I don't know of Adobe is waging war on Google here, or if they just carelessly forgot to request priority in the plugin. It's annoying anyway...
Anyone still using IE6 or IE7 deserves to get hacked anyway. I might have a crocodile tear for IE8 users
It's not surprising to me that a Microsoft product would have a vulnerability that might encourage people to pay more money to Microsoft.
With so little U.S. government supervision of abuses, having a virtual monopoly allows many tricky ways of making money.
Microsoft has wanted for ages that those users upgrade.
Would they resort to this method to scare people into upgrading?
Title: New IE Vulnerability Used In Targeted Attacks; IE9, IE10 Users Safe
Sentence Two: While IE9 and IE10 are not affected, versions IE6, IE7, and IE8 are
Then: "We are actively investigating reports of a small, targeted issue affecting Internet Explorer 6-8,"
Then: People using Internet Explorer 9-10 are not impacted.""
Could someone please tell me which versions are vulnerable and which ones are not?
See my journal for slashdot ID's by year. Mine created in 2005. http://slashdot.org/journal/289875/slashdot-ids-by-year
Your lithium is wearing off.
Is Firefox. (Opera is a good 2nd choice)
Funny how MS doesn't readily patch things that are not on its immediate marketing agenda. No patches for IE 7 so if you insist on using a standard broken product like IE, you need to use Windows 7. Next will be patched browsers that are only available on Windows 8. I Remember MS Office 2000+ had a similar pattern: Want critical bugs fixed, BUY the latest version. (Many bugs were only fixed on the next iteration even when acknowledging the bugs). Firefox on the other hand, works on ALL of these platforms (as well as MacOS, Linux, etc..) and you don't have to pay for bug/security fixes. Plus IE had a way of spitting on W3C standards for years (and to an extent still is).
MS's security record isn't all that great either: IIS Web server vulnerabilities by default (rather than locking them down), ActiveX on the Internet (later disabled by default after numerous security issues), MS Specific HTML/Javascript breaking standards. Perhaps if the market share of IE goes down to, say 30%, Balmer and his cohorts will get a clue. Until then, don't expect this culture or its security/standards issues to change anytime soon.
Anyone still using IE6 or IE7 deserves to get hacked anyway. I might have a crocodile tear for IE8 users
I not a doctor - Do I deserve to get sick, I'm not a mechanic - Do I have to walk..How about fixing leaky tap!...how about making a violin!!. I am not an expert in everything, and have been rarely been out of education, some things take years to learn. The truth is why should everyone be executed to be experts at computing.The sad fact is the world is moving towards electronics away from general purpose computers...making experts like you redundant!
See subject-line above, & answer it please... thank-you!
* Users DO have the option of using other webbrowsers, but again, see my question above!
(It never EVER seems to stop here, all the "anti-microsoft" sentiments... oh well! It's "/."...)
APK
P.S.=> Besides - the mitigating measures they noted in disabling javascript &/or Active X? That's a great measure... (as well as using the EMET tool, which helps spot potential openings in the OS itself, helps to "security-harden" the whole show as well)... & yes, it'd work here too.
However - I truly *wish* that IE (yes, I use IE10 on Windows 7 64-bit here) had an ability like Opera has - which is a "by site preferences" option! I am not even SURE if FireFox does that (Chrome MAY now though iirc). I haven't used either in awhile, probably 1++ yr. for Chrome (just to try it to "see how the other 1/2 lives") & perhaps 6++ months for PaleMoon or WaterFox 64-bit builds of FF.
Since that way? I only use scripting, cookies, extensions of any type, plugins, & frames/iframes (often used sources for attack) ONLY WHERE I NEED THEM!
Which is usually on banking or online shopping/e-commerce type sites MOST of the time...
The rest of the websites I visit default to my "global policy" (which NO sites use any of those)...
That way? No way to 'blast me', essentially, + I surf way, Way, WAY faster without them present (since most sites I have found do NOT really TRULY require them operating for me to get what I need there - information!)...
... apk
Obligatory: Get the update patch here: http://www.mozilla.org/en-US/firefox/new/
Microsoft has wanted for ages that those users upgrade.
Would they resort to this method to scare people into upgrading?
Microsoft aren't even getting a sales bump from launching a new version of their platform, providing a shitty experience on their platform has them running to any other platform, and have yet to transition to the new world, where they are not the Daddy!. Android is set to surpass them next year. I'd argue it was more to provide advantages over previous versions of their OS when really their is very little real advantages present. Simply leaving the older unmaintained version insecure is simply a bonus.
Damn. Good thing I'm still using Mosaic.
Obligatory: Get the update patch here: http://www.mozilla.org/en-US/firefox/new/
Its a work around.
Fuck off back to Usenet, there's someone there criticizing MICROS~1 ..
Who uses IE?
I want to delete my account but Slashdot doesn't allow it.
Compatibility View seems to turn IE 8-10 into IE 7... And I find people using it all the bloody time (and for no good reason other than they didn't like how the newer version CORRECTLY rendered some random page they were used to seeing broken!). So is Compatibility View immune to the exploit? I'm unclear whether IE has a separate engine for this or just uses some bizarre CSS definitions to achieve the brokenness...
#DeleteChrome
The better story about this vulnerability is the fact that the entire delivery of the malware (from a compromised US foreign policy think tank, no less), was limited to people with the ability to view English (American English), Russian, Japanese and traditional Chinese characters. It's supected of being a 'watering hole' attack. Read more from the earlier submission which didn't include bullshit link bait for advertising dollars.
Terrible analogies. Before you go around driving a car by yourself, you typically learn how to drive a car with the help of others so you don't put others in danger, right?
...but not replace the engine.
Some big corporations are still using IE6, including banks and government, some upgraded to IE7 or IE8 (quite recently!).
You go to a Hotel? There is a PC desk there, and it is a lockdown XP / IE6 machine.
No other choice, can't install or run a newer browser either.
Doctors in a hospital looking for your record? XP / IE7.
Banks looking for your employer website and mortgage intranet application usage? XP / IE6.
Some corporation do not allow you to install anything by policy, you are not Administrator on your own machine.
The list goes on and on... you would be surprised.
If it *works*, then don't *fix* it. Even if there is a security bug fix, especially if it breaks intranet apps ?!?
who uses IE?
Who uses Windows?
Get free satoshi (Bitcoin) and Dogecoins
TFA implies that IE9 and IE 10 users are not vulnerable to this attack. Well, neither are Firefox users, nor Opera users, nor Chromium users, nor Safari users, nor ... and the list goes on and on. Oh and obviously people using BSD or Linux or Mac are not vulnerable either.
Those who can make you believe absurdities can make you commit atrocities. - Voltaire
who uses IE?
...about 54% according to Net Application, and has been rising for the past four months. Thank god for Mobile computing is all I can say.
Always! Good choice on your part too - I think it's the GREATEST addon FF has for security in fact!
APK
P.S.=> I also wouldn't doubt that @ least BY NOW, FF has such an addon as you describe for "by site preferences" like Opera has natively built-in. FF has the biggest community building addons for & around it, hands-down... @ least, afaik!
... apk
ASP.NET coder here over time, via Visual Studio 2002-2005, but... NOT by choice though - as I think "web-programming" is for 'noobz' (don't be offended if you do it yourself though, I just feel that way vs. coding native apps in C/C++/Delphi is all), but you have a point!
* Good "exception point" in fact... kudos!
APK
P.S.=> Your post also reminds me of Korea - they're "HUGE" on ActiveX too...
... apk
They are past tense.
It shows that their code was [and maybe he potential to be ]portable, admittedly last version for the Mac was 9 years ago 5.2.3 http://en.wikipedia.org/wiki/Internet_Explorer_for_Mac. Microsoft admit their own inadequacy by not just producing code incompatible with other platforms, but even versions of its their own platform. The sad fact is they have lost half their market to competing platform even though though they bundle it with their monopolistic product. Nobody would ever install it on alternative platforms. Although Microsoft not doing so is a sign that they are not planning on competing though improving their products.
As a tech that insists on bringing value to customers, i no longer work on xp machines. I can hand them a linux live cd or offer to accompany them to the local computer store.
an xp machine on the internet is just stupid, considering the monthly cost of internet access.
Nothing wrong happened.
Redmond, CEO office. Ballmer is practicing chair throwing against a human wall of Microsoft interns.
Fling......
"OUCH! THANK YOU SIR MAY I HAVE ANOTHER ONE SIR!"
Fling.....
A well dressed executive gets in, and says: "Your Sanctity, I have some bad news and some good news. We have a new vulnerability on IE"
Ballmer mutters among himself: "Damn, with the undisclosed ones it's the fifth one today... and it's only 10 am..."
The chairs get thrown with more energy. The human wall crumbles.
Finally Ballmer adds: "And the good news are?"
- "Well, it affects only IE on XP and below"
- "No fucking problem, then! God, I have to give those russian hackers a medal. You know what? let's go have a drink. CHAMPAGNE!"
---- MISSING MISCELLANEOUS DATA SEGMENT --- [sigdash] trolololol
#WindowsRage #WindowsRage #WindowsRage #WindowsRage
I guess IE8 on my windows 7 virtual machine will stay vulnerable, because i'm not going to install "Windows Malicious Software Removal Tool"
LOL. What?
The only way to make Microsoft software trustworthy is to cut power to the computer.
http://youtube.com/html5
to manually enable/disable HTML5 video.
if you're logged in, this preference can even be saved.
Youtube automatically detects which codecs are supported (Chrome and Firefox both support WebM. Chrome also supports H.264. Older versions of Firefox don't (due to licensing restrictions), newer version of Firefox will tap into whatever system codecs is available for firefox to use: GStreamer on Linux, DirectShow in Windows, hardware codecs wherever supported).
Also, video ads require flash to play.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Good idea. Risk getting malware by not installing an anti-malware tool and a current version of a browser. Providing any reason for your actions would make your tin foil hat harder to see.
Are you sure the Malicious Software Removal Tool is a mandatory install with IE? I thought they were separate.
This is where car analogies fall apart, the engine of a computer is the CPU, but they are usually much easier to change than a car engine except when then are surface mounted. But no I wouldn't expect the average user to be able to change a CPU, but installing a new web browser is something every computer user should be able to do, it isn't really any harder than sticking a new satnav to your windscreen and plugging the cord in the cigarette lighter socket.
....Its a skill analogy...It could have been butcher; baker and marine biologist. This week indirectly I paid hundreds of people for their skills, some as basic as *packing*,and vast majority of them were completed better than I ever could, and many would require thousands of hours to become an expert.
As a side note the CPU in the Car...is part of the driver ;)
Older browser version with vulnerability -> JavaScript -> Flash ActiveX -> Java -> sad clown face. Should anyone be surprised? Here's a link to the CERT KB for more information.
But no I wouldn't expect the average user to be able to change a CPU, but installing a new web browser is something every computer user should be able to do
Here is the thing I disagree. Windows is crap in he context of this discussion, and Linux is a dream(and Android /iOS). Because installing is hard. Let me paint a typical scenario...Windows is running slowly!! The problem is not one thing; its everything, There is 4 unused bittorrent clients, A half uninstallled version of MobileME (how do you get rid of that icon...what is Mobile ME), there is a dozen links to defunct printers; scanners; wireless dongles and additional crap it installs. There is a whole host of things running in the background Bollox.exe is using a lot of CPU. There is Firefox 3.6, and IE with several toolbars how did they get there...both Yahoo and Google. A typing Tutor Program, that records every damn keystroke, and several programs that update and load Adobe/Office products in the background to speed up its loading while crippling everything else...and that outdated virus scanner...still searches, but never fixes or updates...until it gets fed some money!...and this is the EVERY PC.
Please don't pretend things are easy because they are for you.
Ubuntu lets a machine's owner install a third-party repository called a PPA after the owner has decided to trust the PPA's operator. Android allows the same thing: owners of devices with Google Play Store can turn on "Unknown sources" and install SlideME and Amazon Appstore, and owners of Kindle devices can turn on "Unknown sources" and install SlideME. Windows RT, the "Modern UI" environment of Windows 8, iOS, and the consoles, on the other hand, don't let a device's owner add repositories.
Not all of them do so properly yet, however. Specifically, a number of sites still check the user agent, rather than for Flash presence.
And other sites check for Flash Player and HTML5 and raise an error "This video is not available on mobile" if HTML5 is detected but Flash Player is not. Still other sites support only AVC, which won't work on browsers that support only the freely licensed VP8. Presence of Flash Player guarantees presence of AVC.
I use Windows XP but you are nuts if you believe I use IE for anything more that see if it doesn't freak my webpages. ;) Also IE alone is not a reason for upgrade. Windows 7 is my second partition OS aka Plan B, thanks several apps that don't run well from XP. Try Linux? No thanks, maybe when is a OS for the home (real apps for home office/games/animation/design, not half baked experiments) user and really supports more hardware. That won't happen soon.
go fuckin stuff windows 8 up your secure arse with a boot
I say kill them and the brains that invented the exploit.
The end. (well unless they documented it online)
Then I say to them kudos for spreading nonsense.
This is the turd RIECH. Kill all the people who don't comply with common sense.
everyone wants justice for stupid is as stupid does though no one is willing to admit that people will create and push the envelope no matter what the law or the "TURD" Riech has to say.
Until Oracle, Kronos, Siebel, DerpMaster, Manpower, Sap, and about 85% of all intranet app makers support anything above IE 8 the answer to any recent or different browser is a resounding NO!
Part of me feels they do so on purpose to hurt Microsoft so they can sell cloud solutions and make the pc platform and internal intranet apps higher TCO (Sap and Oracle) and we all need to suffer in the process by not having HTML 5 yet.
College kids reading this. Be prepared for disappointment in the real world as your paycheck comes at a price. THe real world is not so liberal and open to alternative and cutting edge things as your school is.
http://saveie6.com/
This user is precisely why IE 8 is still high, besides a few gray hair surfers with XP who click on the blue E like they normally since 2001 all the users are corporate. Many have finally just left IE 6 and to them IE 8 is a GREAT improvement sadly enough.
Geeks who do not work in corporate IT do not get it as these systems are not like their own pcs in their dorm rooms where it is free and easy to switch.
The same bean counters who sign for these $$$$ IE 8 only apps also sign your paycheck! If your cool browser doesn't work with these expensive investments it doesn't get deployed. The same bean counter will be happy to fire you too as you are a cost and he is an all so important profit center in his eyes ... vomits.
http://saveie6.com/
Recently http://battlelog.battlefield.com/ (Battle Field 3 web interface)
stopped supporting IE 8.
http://battlelog.battlefield.com/bf3/news/view/2832654782553529670/
A clan member asked what they could do about it, I told her to use a different browser.
they came back: I suppose you expect everybody to have two browsers installed.
Actually I did, the only browser they used was an out of date IE. Playing games on-line,
having a functioning chat system installed; one would think they'd have an above average
knowledge of Internet security (#1 being not to use IE).
I'm sure many are being hit by malware and exploits that have been know for years.
..that security-broken IE6 "in the intranet" is used to open an html-coded email attachment from Chicom ltd. That run that IE6-based virus and send 30 years of hard-won R&D data to Shenzen, to be used for outfoxing an American company who will have to lay of their workers as a consequence.
Alternatively, American R&D data will end up in Chengdu, to be used to beef up China's new stealth fighter.
You see - All The Joys Of Internet Explorer !
I have not used Acrobat Reader for a long time. It is insecure as hell and the primary vector for infections by Chinese intelligence. I use evince and that is perfectly OK for me.
So your multi-billion dollar corporation cannot afford a few millions to get a proper IT system (one that works without insecure crapola), because they have to stuff that money to their shareholders RIGHT NOW. Fuck all the customer and R&D data, quarterly results rule !!
"FIXED" already (well, easily mitigated fixed, that is) -> http://www.neowin.net/news/microsoft-releases-fix-it-patch-for-ie6-8-exploit
* And, there you are...
APK
P.S.=> At the very least? MS, as per their usual, @ least does the 'automating' of the hacks needed to stop these things from 'insta-NUKING' folks, via these "Fix-It" patches - until a FULL patch comes out, & odds are?? 2nd Tuesday of the month (Happy New Year 2013 everyone by-the-by), it will be fixed (hopefully)...
... apk
Install IE9. If you're going to run any version of IE, IE9 is so much better than IE8 (or previous) it isn't even in the same sport, let alone the ballpark. But yes, Vista and XP users are screwed, as IE9 is not available for them.
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
They are. The malicious software removal tool is a monthly "poor mans virus scanner", not a single install.
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.