Slashdot Mirror
Internet Explorer 0-day Attacks On US Nuke Workers Hit 9 Other Sites
SternisheFan writes with an excerpt from Ars Technica: "Attacks exploiting a previously unknown and currently unpatched vulnerability in Microsoft's Internet Explorer browser have spread to at least nine other websites, including those run by a big European company operating in the aerospace, defense, and security industries as well as non-profit groups and institutes, security researchers said. The revelation, from a blog post published Sunday by security firm AlienVault, means an attack campaign that surreptitiously installed malware on the computers of federal government workers involved in nuclear weapons research was broader and more ambitious than previously thought. Earlier reports identified only a website belonging to the US Department of Labor as redirecting to servers that exploited the zero-day remote-code vulnerability in IE version 8.
... 'The specific Department of Labor website that was compromised provides information on a compensation program for energy workers who were exposed to uranium,' CrowdStrike said. 'Likely targets of interest for this site include energy-related US government entities, energy companies, and possibly companies in the extractive sector. Based on the other compromised sites other targeted entities are likely to include those interested in labor, international health and political issues, as well as entities in the defense sector.'"
Just lost their job... The same idiot that insisted in "lets make all our content only available through IE"...
Nom de dieu de putain de bordel de merde de saloperie de connard d encule de ta mere.
How about Global ThermoNuclear War..
If I make a medical device that has a serious software bug and goes awall and kills people I'm held responsible. If I start a company who dumps oil into the ocean by accident and it kills people / animals I'm held responsible. So shouldn't company's who release buggy software be held responsible for damages and compensation?
It would could far less than incident analysis and cleanup to provide dedicated machines for external web use. Companies and agencies that tollerate occasional surfing should have machines that do not share the internal network.
Yea, the doctor could have known.
I've already removed it in favor of Chrome.
I will let you in on a secret. There is only tiny number of wannabe IT experts who are "outraged" while everybody else saves their indignation for shit that really matters. And as far as software bugs go name one program more complicated than "Hello World" that doesn't have bugs. If you want bug free software you might as well get used to a 10 year release cycle becuase that is how long it would take to guarantee bug free software. Of course that puts a real crimp in the advancement of any actual hardware, especially processors. Anyone running highly critical applications such as utilities have all the tools, policies, and procedures necessary to secure their networks and applications. If some moron allows Internet access to their secure system than yes they should be held accountable for incompetence and fired. However you can't always rely on someone not doing something stupid. The most frequent vector used today is through phishing and spearing attacks via a persons e-mail and clever social manipulation. In the case of this exploit it compromised a Internet site that is little more than a brochure site with non-critical information. People brayed about the latest batch of script kiddies defacing the FBI and US Congress sites but that does not mean they got access into any secure systems. Outward facing websites should never be designed to allow someone into a secured network and when it is easy to configure and design such a system. But like I said you can't rely on everyone being competent.
Malicious links embedded in the Department of Labor website focused on webpages that dealt with illnesses suffered by employees and contractors developing atomic weapons for the Department of Energy.
So in addition to the 0-day exploit found in IE, what was exploited to put malicious links on the web site?
We don't blindly hate Microsoft; we've seen it all too much.
Time travel has its advantages.
This was a known patched vulnerability in an old version of IE. It was not a 0-day vulnerability. A 0-day vulnerability is one where there were 0 days to fix it because it was exploited before the software vendor knew about it. Stop using that term for every single headline! (Not blaming Slashdot this time - The title is straight from the arstechnica article)
IE can be removed enough from Vista and later that it's engine is not easily used for untrusted content.
IE9 and later are not affected by this zero day.
Because the Java exploits applied to the latest, fully patched version – not an old version which has been superseded for more than 2 years.
You're completely incorrect about consumer behavior and market regulation, and your example of Nader is a fabulous example.
The Nader-inspired passenger safety craze is directly responsible for the horrendously low average MPG in the USA and all the attendant environmental and political problems. It's also responsible for increased pedestrian and cyclist fatalities (known as early as Pelzman's 1975 study) and may even make drivers less safe.
48 years after his book, despite all the tremendous advances in engineering and materials science, instead of the average vehicle on US roads being sub-1000 lbs and getting 200MPG (very feasible to do considerably better than this for 1-2 passenger cars, c.f. the decade-old VW 1L prototype), the average vehicle is >4000 lb and gets worse than 20MPG, little better than in 1965.
The reason is a curb weight arms race caused by our absurd safety standards. The main way to meet crash test standards when faced with heavy vehicles is to increase your vehicle's weight.
Passenger collision safety involves tradeoffs- among other things, tradeoffs with performance, efficiency, cost, and the safety of others on the road. Nader refused to recognize these tradeoffs. Our current safety laws ignore these tradeoffs, and even if they took them into account, overriding consumers' preferences regarding these tradeoffs will lead to inefficient market outcomes.
If someone wants to purchase a more efficient, less expensive vehicle, the government shouldn't stop them just because it does slightly less well in collision tests. Consumers are perfectly capable of rationally choosing how much they're willing to trade guarantees of their own safety for other desiderata and vice versa.
Regulating externalities, on the other hand, is often OK. Vehicle safety requirements should be based ONLY on the damage caused in collisions to other road users (other drivers, pedestrians, cyclists) and their property. Heavier vehicles perform WORSE in such tests; we might consider having a weight-based Pigovian vehicle tax to offset the safety and pollution externalities for those heavier cars we're still willing to allow on the roads.
Providing consumers with more information is a good idea. I'm fine with performing tests and requiring companies to provide prospective buyers with that information. But requiring disclosure without regulating/prohibiting the sale of the product still allows for what I think most would call a "truly free market."
If using MS's software may brick your neighbor's PC, go ahead and hold MS to the fire. If using MS's software may brick your own computer, require testing and a warning label. But the kind of guarantees the OP seems to want to require would override consumer preferences in a way that would cripple the software industry.