Slashdot Mirror
IE Vulnerability Exposing Banking Logins, Spreading Rapidly
jfruh writes "A vulnerability in Internet Explorer 9 and 10 that allows attackers to target banking login info, first reported on February 13, is being exploited in the wild, and attacks are spreading rapidly. Sites compromised by the malware run the gamut from U.S. Veterans of Foreign Wars site, to a site frequented by French military contractors, to a Japanese dating site. Microsoft has released a 'fix-it tool' but not a regular patch."
Why is there a banking login on a Japanese dating site? Perhaps we should start by addressing that.
I'm immune!!!!
I'm not sure what anyone can do for you.
Please do not read this sig. Thank you.
From what I'm understanding, the web sites/servers themselves are being compromised.
Not quite. Any compromised website can take over the browser. So a malware ad hosted on Youtube or ./ can infect the browser, and the attacker can then snoop on future activity – e.g. on banking sites.
As the vulnerability seems to allow arbitrary code execution (with user privileges), this means keyloggers and the whole shebang, so using a dedicated banking software isn't necessarily going to save you.
Given the anti-MS slant here, I think it's ironic that Slashdot is sometimes a more timely news source on exploits in MS software than of nearly any of the open source products Slashdot users are so fond of, hmmm....
CEOs have ignored security researchers since the start of the modern internet, because CEOs only want "Results now!"
That's not what I read at all. It seems to be an entirely client side problem.
The compromised site is being used to host/inject the exploit.The vulnerability that is being exploited is in IE 9 &10, and allows code execution. It is being used to get the credentials for other--non-compromised--websites.
Mod points: Guaranteed to remove your sense of humor.
Side effects may include gullibility and temporary retardation
It's the one most banking and investment houses use and develop their sites to work with. So there's that.
.
Prisencolinensinainciusol. Ol Rait!
Still running IE8 so no problems.
Keep pushing the envelope to be cool and edgy and this is what you get.
Actually, Windows 8.1 comes with IE11, so anyone who is completely up to date is immune to this one as well. So, being behind the curve is bad, being either at the forefront or way behind the curve is good.
Any compromised website can take over the browser. So a malware ad hosted on Youtube or ./ can infect the browser, and the attacker can then snoop on future activity – e.g. on banking sites.
And this is exactly why I always run an ad blocker.
Given the current mess that is web advertising, it would be foolish to do otherwise.
Who in their right mind uses IE for anything secure would be my question?
People still use IE?
"If any question why we died, Tell them because our fathers lied."
Of course Secunia will count this is as "one bug", after Microsoft agrees it is a bug. On the other hand, it will look at bugzilla of Firefox, and every bug report by everyone will be counted towards the total bug count on Firefox. Microsoft will continue to insist its browser has fewer bugs than Firefox. Gartner will issue a TCO report based on these numbers. And everyone will be scratching their head, why IE market share continues to fall when all these numbers say IE is the safest browser in the world.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Keep pushing the envelope to be cool and edgy and this is what you get.
Right. People running Windows are really concerned with being "cool and edgy".
Clearly the wild pointer read error is in IE not in the server. They need to hack the server to post the exploit code in their server. But they could also create the same vulnerability in a site owned by them. No need to hack. But it is more difficult to lure visitors to the newly created malware site. That is why they need to hack a well visited site to upload the hack. But all visitors to that site using Chrome and Firefox and other versions of IE are not affected. Fault lies solely on these versions of IE
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
and this is why I have Noscript in Deny All Mode be default. Forget the damn adblocker as blocking scripts is how you do it. I also use a Hosts file * Thanks APK for the reminder * to block most of the god damn advertisers around the world.
Mod me up/Mod me down: I wont frown as I've no crown
And this is why I browse using Lynx. Forget the damn script blocker as blocking all active content is how you do it. I don't need a hosts file as I literally don't see ads.
Netflix kinda sucks though. Kevin Spacey just isn't the same when rendered in ASCII.
So how do you really trust them?
However, Chrome is getting many patches recently between versions due to flaws in blink and flash. So the idea to blame IE as still sucking is disingenuous.
The point is always upgrade your browser and OS in addition to running adblock/flashblock, or if you are a corp banning flash and java altogether. The port of adblock for IE is here.
Many IT professionals who whine about leaving XP and IE 8 behind should be FIRED. IE 11 sandbox is fine for this. If you run WIndows 7 or later both IE 9+ and Chrome have lowrights mode which restrict everything include writting to the disk with the narrow exception of %appdata.
These days most of the infections I see come from Firefox and plugins. Firefox has no lowrights mode and if anyone reading this is using XP you neglect sandboxing on all browsers and expose yourself.
http://saveie6.com/
Funny IE 11 is fine and is the most recent. I would argue an older browser is less secure and IE 8 has more vulnerabilities than IE 9 and IE 10.
Yep forget better sandboxing, HTML 5 support, h.264, and lowrights mode if you are on XP still as well. Stay with the old!
Many sites and not just geek ones like my t-mobile site to pay my bill are not IE 8 compatible. If you read about the vulnerability it uses flash too. So get rid of flash and then hafl the web wont work when you want to listen to pandora or youtube music videos.
IE 8 has alot more exploits than IE 11 as it doesn't have as many modern sandboxing techniques due to compatibility for XP.
http://saveie6.com/
I hated Microsoft pretty hard. Now... McComputer sounds about right. Good Call!
I mostly use Windows at work (because that's what my work uses) and just about entirely Linux at home (that's what I choose). This hasn't changed.
I don't think I have changed. Microsoft has changed and so has the market. I just don't see Windows computers crashing like they used to. Quality has improved Perhaps this was in part due to the threat of competition from oss? Note that I said threat of, not actual competition. We all know Linux didn't take off on the desktop but there certainly was enough hype about the possiblity!
Also, you can actually do something in Windows without having a corporate sized budget. Want to be an amateur programmer? It used to be all Windows had was a BASIC interpereter. To get an actual compiler (any language) was 100s of dollars. Apparently you had to pay for the privilege of creating software for Windows. Even though more software existing for Windows just makes Windows more desirable... explain that one. Now Micorosoft releases free versions of their development environments which are cut down enough to give companies a reason to buy the real thing but not so much as to prevent one from compiling a useful application.
Besides what Microsoft offers, now there is all sorts of free oss available for Windows. You can develop for Windows in gcc! Can't afford Photoshop? Gimp runs on Windows now. How about web serving. Microsoft used to charge big bucks for different levels of licensing on their web server. They limited how many people could connect at a time. I thought that was a very assinine money grab. It's not like Microsoft programmers put in more hours every time your server serves 100 copies of your web page vs 5! Do they still do that? I don't know. Who cares?!? I can always run Apache on Windows or any one of a million other free programs.
In the early days Microsoft plus IBM were the PC. The PC was awesome for hackers, makers and all kinds of geeks. Before that everything was pretty much proprietary. Now you could mix and match hardware pieces as you please. Also, I could run the same program on my Tandy as my friend ran on his Dell even though it was written on a computer made by IBM!
Later Microsoft became evil in part becasue the kind of compatiblity the PC gave us was expected. We didn't need Microsoft to help us get that anymore. But.. Microsoft was pushing things the other way, embracing standards just to change them a bit once they had a market share so that people would be locked in to using their product.
Now.. Microsoft is losing that monopoly power. They can't do as much damage as before. But.. mobile devices are the big thing, not Desktops. And with our phones and tablets we are back to the bad old pre-pc days where everything is proprietary. I'm not saying that Microsoft is doing anything to try to change this but at least they aren't the driving force behind it. That title is shared by Apple and the cellphone carriers.
So.. Microsoft is a de-fanged wannabe villian who occasionally does nice things. Apple and the Telecoms, they are where the real evil lives today.
... we would stop loading up web browsers with "features" that only help content providers shove ever more ads and video down our gullets.
Kevin Spacey In ASCII for all those who were wondering.
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
Yes it is. IE has a bug that allows a site to get it to execute arbitrary code. That is always wrong.
Well, that's hardly surprising: the lesson for a decade now has been "don't run what most people run". If Win8 had been successful, this would have been an IE11 exploit. In a few years, it will all be Chrome exploits.
Socialism: a lie told by totalitarians and believed by fools.
The vulnerability is a remote code execution vulnerability. The vulnerability exists in the way that Internet Explorer accesses an object in memory that has been deleted or has not been properly allocated. The vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer. An attacker could host a specially crafted website that is designed to exploit this vulnerability through Internet Explorer and then convince a user to view the website.
The vulnerability exists in IE version 9 & 10 themselves at http://technet.microsoft.com/e... (from TFA). The problem in this case is not about users hit the site which is already compromised, but it is that the browser being used allows exploitation to happen. Furthermore, MS has not come out with an official patch but rather suggested a work around.
If other browser has exactly the same vulnerability that can be exploited the same way, then your statement is somewhat valid. However, I doubt that other browsers would have it even though they may have similar vulnerability but cannot be exploited the same way.