Slashdot Mirror
New IE Vulnerability Used In Targeted Attacks; IE9, IE10 Users Safe
An anonymous reader writes "Criminals are using a new Internet Explorer security hole to attack Windows computers in targeted attacks, though the vulnerability could end up being more widely exploited. While IE9 and IE10 are not affected, versions IE6, IE7, and IE8 are. It's great to see that the latest versions of IE are immune, but this new vulnerability is still bad news for Windows XP users and earlier since they cannot upgrade to more recent versions of Microsoft's browser. 'We are actively investigating reports of a small, targeted issue affecting Internet Explorer 6-8,' Dustin Childs of Microsoft Trustworthy Computing told TNW. 'We will take appropriate action to help keep customers protected once our analysis is complete. People using Internet Explorer 9-10 are not impacted.'"
I tried out IE 10 and it was great. It downloaded firefox and chrome even better than ever. People who haven't updated should. Too bad XP users can't use it though.
Anyone still using IE6 or IE7 deserves to get hacked anyway. I might have a crocodile tear for IE8 users
It's not surprising to me that a Microsoft product would have a vulnerability that might encourage people to pay more money to Microsoft.
With so little U.S. government supervision of abuses, having a virtual monopoly allows many tricky ways of making money.
Try using a 10.x version from Adobe's Flash Player Archive.
Microsoft has wanted for ages that those users upgrade.
Would they resort to this method to scare people into upgrading?
Title: New IE Vulnerability Used In Targeted Attacks; IE9, IE10 Users Safe
Sentence Two: While IE9 and IE10 are not affected, versions IE6, IE7, and IE8 are
Then: "We are actively investigating reports of a small, targeted issue affecting Internet Explorer 6-8,"
Then: People using Internet Explorer 9-10 are not impacted.""
Could someone please tell me which versions are vulnerable and which ones are not?
See my journal for slashdot ID's by year. Mine created in 2005. http://slashdot.org/journal/289875/slashdot-ids-by-year
Your lithium is wearing off.
Anyone still using IE6 or IE7 deserves to get hacked anyway. I might have a crocodile tear for IE8 users
I not a doctor - Do I deserve to get sick, I'm not a mechanic - Do I have to walk..How about fixing leaky tap!...how about making a violin!!. I am not an expert in everything, and have been rarely been out of education, some things take years to learn. The truth is why should everyone be executed to be experts at computing.The sad fact is the world is moving towards electronics away from general purpose computers...making experts like you redundant!
Obligatory: Get the update patch here: http://www.mozilla.org/en-US/firefox/new/
Microsoft has wanted for ages that those users upgrade.
Would they resort to this method to scare people into upgrading?
Microsoft aren't even getting a sales bump from launching a new version of their platform, providing a shitty experience on their platform has them running to any other platform, and have yet to transition to the new world, where they are not the Daddy!. Android is set to surpass them next year. I'd argue it was more to provide advantages over previous versions of their OS when really their is very little real advantages present. Simply leaving the older unmaintained version insecure is simply a bonus.
Obligatory: Get the update patch here: http://www.mozilla.org/en-US/firefox/new/
Its a work around.
Have you tried actually uninstalling Flash? When you do, YouTube serves an html5 video.
Who uses IE?
I want to delete my account but Slashdot doesn't allow it.
Compatibility View seems to turn IE 8-10 into IE 7... And I find people using it all the bloody time (and for no good reason other than they didn't like how the newer version CORRECTLY rendered some random page they were used to seeing broken!). So is Compatibility View immune to the exploit? I'm unclear whether IE has a separate engine for this or just uses some bizarre CSS definitions to achieve the brokenness...
#DeleteChrome
The better story about this vulnerability is the fact that the entire delivery of the malware (from a compromised US foreign policy think tank, no less), was limited to people with the ability to view English (American English), Russian, Japanese and traditional Chinese characters. It's supected of being a 'watering hole' attack. Read more from the earlier submission which didn't include bullshit link bait for advertising dollars.
Firefox addons give you site-by-site preferences. Take a look at NoScript. I'm pretty sure some others do as well, but I use NoScript all the time. It's probably not the best thing since sliced bread, but it comes close.
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
Terrible analogies. Before you go around driving a car by yourself, you typically learn how to drive a car with the help of others so you don't put others in danger, right?
...but not replace the engine.
I believe those fall back to Silverlight mode.
Try Gnash.
--
BMO
Who uses Windows?
Get free satoshi (Bitcoin) and Dogecoins
TFA implies that IE9 and IE 10 users are not vulnerable to this attack. Well, neither are Firefox users, nor Opera users, nor Chromium users, nor Safari users, nor ... and the list goes on and on. Oh and obviously people using BSD or Linux or Mac are not vulnerable either.
Those who can make you believe absurdities can make you commit atrocities. - Voltaire
who uses IE?
...about 54% according to Net Application, and has been rising for the past four months. Thank god for Mobile computing is all I can say.
They are past tense.
It shows that their code was [and maybe he potential to be ]portable, admittedly last version for the Mac was 9 years ago 5.2.3 http://en.wikipedia.org/wiki/Internet_Explorer_for_Mac. Microsoft admit their own inadequacy by not just producing code incompatible with other platforms, but even versions of its their own platform. The sad fact is they have lost half their market to competing platform even though though they bundle it with their monopolistic product. Nobody would ever install it on alternative platforms. Although Microsoft not doing so is a sign that they are not planning on competing though improving their products.
But how will that work on popular YouTube-like sites that aren't really YouTube?
Most larger sites tend to serve html5 video due to the 250 million or so iOS users.
Not all of them do so properly yet, however. Specifically, a number of sites still check the user agent, rather than for Flash presence. On Safari, you can work around this by enabling the developer toolbar in the settings -- you use it to make the browser advertise itself as an iPad, which reloads, and more often than not things will then work without a hiccup. Being based on Webkit, I'd be surprised if Chrome doesn't have a similar developer toolbar.
Along the same lines, some of the embed code that news sites offer always work when it's used on 3rd party sites. When this occurs, there's a good chance that the video actually works on the news site itself. Most sensible bloggers will post the link to the original along with the embedded video; when not, it's usually a google away and, more often than not, on youtube as well.
At any rate, I've been living without Flash at all for the past two years or so. Admittedly, I never played Flash games, nor used it for much other than youtube videos, so your mileage may vary. For what it's worth, I don't miss it at all.
Nothing wrong happened.
Redmond, CEO office. Ballmer is practicing chair throwing against a human wall of Microsoft interns.
Fling......
"OUCH! THANK YOU SIR MAY I HAVE ANOTHER ONE SIR!"
Fling.....
A well dressed executive gets in, and says: "Your Sanctity, I have some bad news and some good news. We have a new vulnerability on IE"
Ballmer mutters among himself: "Damn, with the undisclosed ones it's the fifth one today... and it's only 10 am..."
The chairs get thrown with more energy. The human wall crumbles.
Finally Ballmer adds: "And the good news are?"
- "Well, it affects only IE on XP and below"
- "No fucking problem, then! God, I have to give those russian hackers a medal. You know what? let's go have a drink. CHAMPAGNE!"
---- MISSING MISCELLANEOUS DATA SEGMENT --- [sigdash] trolololol
Chrome comes with a built-in, supported-by-google. inline-process version of Adobe Flash. Yes, even in Linux, in fact that is the only supported Linux version of Flash going forward. Sounds to me like you have a misconfigured Chrome with it using the separate Adobe Flash Netscape-type plugin, the one you have for Mozilla-based products. Chrome's built-in Flash works fine, even on relatively low-resource machines. Since you are on Windows, you should be able to use it without problems on anything approximating an 8-year-old machine or newer. Unless you have totally horked your system, in which case have fun..
LOL. What?
The only way to make Microsoft software trustworthy is to cut power to the computer.
http://youtube.com/html5
to manually enable/disable HTML5 video.
if you're logged in, this preference can even be saved.
Youtube automatically detects which codecs are supported (Chrome and Firefox both support WebM. Chrome also supports H.264. Older versions of Firefox don't (due to licensing restrictions), newer version of Firefox will tap into whatever system codecs is available for firefox to use: GStreamer on Linux, DirectShow in Windows, hardware codecs wherever supported).
Also, video ads require flash to play.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Sorry if this is a dumb question, but what does the monthly cost of internet access have to do with it?
MS's security record isn't all that great either
And the understatement of the year award goes to Anonymous Coward.
Good idea. Risk getting malware by not installing an anti-malware tool and a current version of a browser. Providing any reason for your actions would make your tin foil hat harder to see.
This is where car analogies fall apart, the engine of a computer is the CPU, but they are usually much easier to change than a car engine except when then are surface mounted. But no I wouldn't expect the average user to be able to change a CPU, but installing a new web browser is something every computer user should be able to do, it isn't really any harder than sticking a new satnav to your windscreen and plugging the cord in the cigarette lighter socket.
....Its a skill analogy...It could have been butcher; baker and marine biologist. This week indirectly I paid hundreds of people for their skills, some as basic as *packing*,and vast majority of them were completed better than I ever could, and many would require thousands of hours to become an expert.
As a side note the CPU in the Car...is part of the driver ;)
lol - I completely missed that.
Older browser version with vulnerability -> JavaScript -> Flash ActiveX -> Java -> sad clown face. Should anyone be surprised? Here's a link to the CERT KB for more information.
But no I wouldn't expect the average user to be able to change a CPU, but installing a new web browser is something every computer user should be able to do
Here is the thing I disagree. Windows is crap in he context of this discussion, and Linux is a dream(and Android /iOS). Because installing is hard. Let me paint a typical scenario...Windows is running slowly!! The problem is not one thing; its everything, There is 4 unused bittorrent clients, A half uninstallled version of MobileME (how do you get rid of that icon...what is Mobile ME), there is a dozen links to defunct printers; scanners; wireless dongles and additional crap it installs. There is a whole host of things running in the background Bollox.exe is using a lot of CPU. There is Firefox 3.6, and IE with several toolbars how did they get there...both Yahoo and Google. A typing Tutor Program, that records every damn keystroke, and several programs that update and load Adobe/Office products in the background to speed up its loading while crippling everything else...and that outdated virus scanner...still searches, but never fixes or updates...until it gets fed some money!...and this is the EVERY PC.
Please don't pretend things are easy because they are for you.
Ubuntu lets a machine's owner install a third-party repository called a PPA after the owner has decided to trust the PPA's operator. Android allows the same thing: owners of devices with Google Play Store can turn on "Unknown sources" and install SlideME and Amazon Appstore, and owners of Kindle devices can turn on "Unknown sources" and install SlideME. Windows RT, the "Modern UI" environment of Windows 8, iOS, and the consoles, on the other hand, don't let a device's owner add repositories.
Not all of them do so properly yet, however. Specifically, a number of sites still check the user agent, rather than for Flash presence.
And other sites check for Flash Player and HTML5 and raise an error "This video is not available on mobile" if HTML5 is detected but Flash Player is not. Still other sites support only AVC, which won't work on browsers that support only the freely licensed VP8. Presence of Flash Player guarantees presence of AVC.
It was a joke...
You were supposed to laugh.
*bmo pouts*
--
BMO
replying to an ac, i must be drunk. try chrome with tampermonkey and the Download YouTube Videos as MP4 script. i can barely bother putting up with the streaming any more
This is a joke. I am joking. Joke joke joke.
Until Oracle, Kronos, Siebel, DerpMaster, Manpower, Sap, and about 85% of all intranet app makers support anything above IE 8 the answer to any recent or different browser is a resounding NO!
Part of me feels they do so on purpose to hurt Microsoft so they can sell cloud solutions and make the pc platform and internal intranet apps higher TCO (Sap and Oracle) and we all need to suffer in the process by not having HTML 5 yet.
College kids reading this. Be prepared for disappointment in the real world as your paycheck comes at a price. THe real world is not so liberal and open to alternative and cutting edge things as your school is.
http://saveie6.com/
This user is precisely why IE 8 is still high, besides a few gray hair surfers with XP who click on the blue E like they normally since 2001 all the users are corporate. Many have finally just left IE 6 and to them IE 8 is a GREAT improvement sadly enough.
Geeks who do not work in corporate IT do not get it as these systems are not like their own pcs in their dorm rooms where it is free and easy to switch.
The same bean counters who sign for these $$$$ IE 8 only apps also sign your paycheck! If your cool browser doesn't work with these expensive investments it doesn't get deployed. The same bean counter will be happy to fire you too as you are a cost and he is an all so important profit center in his eyes ... vomits.
http://saveie6.com/
It is not old flash. The issue is GPU acceleration. Chrome auto updates to the latest flash.
One of the reasons to retire XP is its horrible GPU acceleration which will become more and more of a deal as phones and tablets offer the best smooth scrolling and visual experiences with the xception of Windows 8. Windows 7 is smoother but still flickers due to WDDM 1.1.
Intel makes some very crappy graphics a half decade ago. 915 is the IE 6 of directX and OpenGL developers with so many shit needing quirks due to Intel wanting everything in software to sell more expensive CPUs. It simply cant handle h.264 and 1080p with motion blur, smooth font rendering, and other things mixed with an 11 year old GDI XP subsystem. Chrome uses more resources to appear faster which makes it crash more.
I think it is time this grandparent traded his computer in for a new one.
http://saveie6.com/
Recently http://battlelog.battlefield.com/ (Battle Field 3 web interface)
stopped supporting IE 8.
http://battlelog.battlefield.com/bf3/news/view/2832654782553529670/
A clan member asked what they could do about it, I told her to use a different browser.
they came back: I suppose you expect everybody to have two browsers installed.
Actually I did, the only browser they used was an out of date IE. Playing games on-line,
having a functioning chat system installed; one would think they'd have an above average
knowledge of Internet security (#1 being not to use IE).
I'm sure many are being hit by malware and exploits that have been know for years.
Intel makes some very crappy graphics a half decade ago. 915 is the IE 6 of directX and OpenGL developers with so many shit needing quirks due to Intel wanting everything in software to sell more expensive CPUs. It simply cant handle h.264 and 1080p with motion blur, smooth font rendering, and other things mixed with an 11 year old GDI XP subsystem.
GMA 915 is also a pile of garbage because it could not handle WDDM, thus could not run Aero, and Intel bullied Microsoft into considering GMA915 "Vista capable". I also have some old Pentium III's with GMA 815. That's a real pile of shit too. Can't support VESA modes higher than 640x480x16 color, and just flat out garbage. Apparently Intel tried selling it as a standalone GPU on a daughter card at some point.
The GMA 500 found on Atom Z series was a steaming pile of crap too. A PowerVR design with decent specs, driver support on all operating systems (XP, Vista/7, Linux) was beyond terrible.
Intel keeps trying to outdo itself with crappy GPUs.
Install IE9. If you're going to run any version of IE, IE9 is so much better than IE8 (or previous) it isn't even in the same sport, let alone the ballpark. But yes, Vista and XP users are screwed, as IE9 is not available for them.
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
They are. The malicious software removal tool is a monthly "poor mans virus scanner", not a single install.
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
If you were running an operating system from the last 6 years that wouldn't be the case.
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.