Slashdot Mirror
Severe IE 11 Bug Allows 'Persistent JavaScript' Attacks (bleepingcomputer.com)
An anonymous reader writes: New research published today shows how a malicious website owner could show a constant stream of popups, even after the user has left his site, or even worse, execute any kind of persistent JavaScript code while the user is on other domains. In an interview, the researcher who found these flaws explains that this flaw is an attacker's dream, as it could be used for: ad fraud (by continuing to load ads even when the user is navigating other sites), zero-day attacks (by downloading exploit code even after the user has left the page), tech support scams (by showing errors and popups on legitimate and reputable sites), and malvertising (by redirecting users later on, from other sites, even if they leave the malicious site too quickly).
This severe flaw in the browser security model affects only Internet Explorer 11, which unfortunately is the second most used browser version, after Chrome 55, with a market share of over 10%. Even worse for IE11 users, there's no fix available for this issue because the researcher has decided to stop reporting bugs to Microsoft after they've ignored many of his previous reports. For IE11 users, a demo page is available here.
This severe flaw in the browser security model affects only Internet Explorer 11, which unfortunately is the second most used browser version, after Chrome 55, with a market share of over 10%. Even worse for IE11 users, there's no fix available for this issue because the researcher has decided to stop reporting bugs to Microsoft after they've ignored many of his previous reports. For IE11 users, a demo page is available here.
You know it makes sense.
Mind you Google isn't that much better
Dump google
you know it makes sense.
there's no fix available for this issue because the researcher has decided to stop reporting bugs to Microsoft after they've ignored many of his previous reports.
I don't see the author saying this anywhere in Caballero's article. Maybe the reporter at the news site (and the submitter) should have read the article first.
For what it is worth, Caballero is a respected browser security researcher. I don't think he would do something like this.
1. Regular alert: Alert came up, second time. check marked it. Disappeared for ever.
2, 3, 4: htmlFile alert, all at once, in a zombie script: No effect, no popup, nothing.
Browser being tested: IE 11
no carrier
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Fairly sure this can be done other ways... Allakhazam (which has game info for many popular MMO's) auto-loads advertisements every few minutes, regardless of the users browser state.
My wife frequently walks away for 20+ minutes, only to have her computer randomly start playing an advertisement.. I suppose it isn't a "pop up", but clearly "auto refreshing for advertisement fraud" is possible and in use... And Allakhazam's method works on Firefox and Chrome from our experiences
Doesn't Chrome have the same problem? I've had to go into Task Manager and kill Chrome after getting the "You have a virus! Pay us money!" popup. (Have they fixed that in Chrome already?) My ex was stupid enough to actually call the phone number they put up on the screen, after which some Indian guy asked her for money.
I've abandoned my search for truth; now I'm just looking for some useful delusions.
I hope the zombie script will die if the browser is killed? Or have clever people at Microsoft have implemented auto checkpoint and auto restore to make it even more persistent?
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Chrome requires its sandbox process to run as root. Well not on my systems it isn't. Won't run? Tough , I'll just use one of the many alternatives then.
Apparently google thinks is code is 100% exploit and bug free and don't see an issue with having a user application requiring superuser priviledges. Utter morons. And anyone who says to me "but its not the browser, its the sandbox" obviously know the square root of fuck all about security so don't even bother me with your ignorant opinions.
Yes... other languages "could" have the same problem, and it's not the language per se that's the issue, but javscript is in the position where it's loaded from random malicious or semimalicious web sites and executed in your browser.
If you let that happen by default, after an endless fucking series of javascript based exploits and vulnerabilities and nagware and data-harvesting over the years.. at this point I no longer feel sorry for you. You're letting random strangers who do not mean you well control the operation of a not-well sandboxed environment on your computer, so you deserve what you get.
Running with javascript default-enabled is like letting any stranger in the world use your house for any purpose they want. Might be the an organization who saves orphan cancer victims from bear attacks, or might be drug cartels and human trafficking, or the Stasi planting recording devices. You're saying, "Hey, it's all good! Come on in, do what you want!"
I wager almost nobody would do that with their house, but somehow with computers people have decided that's a good plan. Then they wonder why they suffer from the endless series of problems they do.
No major version since 2013, dumped by Microsoft for Edge. Only corporate web apps still need IE, the rest of the web should move on and drop support for IE.
"new ActiveXObject('Microsoft.Ancient.Bad.Idea')" I think I've seen this exploit before. SMH. It's time to kill ActiveX in the browser already.
If this issue were a problem in Javascript it (or some variant) would work in a lot more browsers than just IE11.
But it's not. The bug here boils down to Microsoft adding an ActiveX call into Javascript, then that call activating some native HTML ActiveX component and using it in a super bad way.
That's not Javascript's fault, that's on Microsoft for punching such a large hole in the sandbox.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Microsoft should promptly notify IE11 users ... both of them
If any outsider can install and run a program on your computer it is no longer your computer. Javascript is such a program. So is the permission to open a Microsoft docx document. In a corporate environment there is usually a guard dog to protect you. In a home Windows, Apple or Unix-based system you are on your own. If you leave the keys to your car in the ignition don't be surprised if someone takes it for a ride.
Make your own decision.
That way we can track you with an advertiser ID in a feeble way to sell apps on the appstore and actual think this will get people to buy Windows Phone?
Why fix it? This is great scareware to get PHB IT managers to upgrade and leave perfectly working 7 behind.
http://saveie6.com/
Stop using a shit OS.
Linux setuid sandbox allows local privilege escalation
Java and Javascript are not the same thing. They're similar in many ways, but Javascript is usually interpreted/run directly by a Javascript interpreter/engine in the web browser.
Java is run by a separate interpreter/engine which can have browser plugins, so Java code can be run from within html. Java apps can run without a browser- directly in the OS's GUI.
Caballero just discovered another hidden feature. Won't be fixed of course, because it is (an evil) feature for three letter agencies and not a bug. I am lucky I don't have IE11, can't install that one so I am stuck with IE6 on my XP
captcha: mindful
Running with javascript default-enabled is like letting any stranger in the world use your house for any purpose they want.
If most people change the default to no JS, what steps should a developer of a web application take to convince prospective users that the web application is legitimate? Or should all applications instead be native and therefore specific to a single operating system?
Java and Javascript are not the same thing.
I think Joe Branya would recommend turning them both off, as well as Flash and Silverlight.
See my subject: I'm an avid Opera 12.18 64-bit user. It does the job for MOST everywhere I go except outlook.com (which forces me to use IE 11) - what I cannot STAND is how SLOW IE 11 is!
* I mean it - in comparison to Opera (the last REAL Opera, not "Chopera") it's DOG slow AND doesn't have all the features Opera does natively (not by a long shot - no browsers really do to this day minus addons).
I could see saying that if say, Opera was a DOS window/tty term app with no GUI overheads vs. IE in GUI - that I can understand where slowups occur & it's not comparing apples to apples either (GUI has way, Way, WAY more overheads than character mode apps do).
It's been PATCH after PATCH for decades now in IE which is probably contributing to that slowness & did it solve anything? Bugs keep popping up!
Personally? Javascript is the ROOT of all slow & bugs imo. It's junk & I cannot understand HOW it took over CGI bin/WinCGI which imo was a LOT safer & iirc, run server-side (instead of raising my powerbill via cpu overuse clientside here & infecting us users too).
APK
P.S.=> I don't have or use Win10, but folks that DO use it tell me Edge IS FASTER than IE by far... & imo, what keeps IE alive is the fact it TRULY IS the most flexible programmable browser there is for INTRANET usage (I will give it that) imo... apk
Internet Explorer 11 requires Windows 7 SP1 for higher. Microsoft would be quick to point out that that have offered free upgrades to Windows 10, featuring their new, more secure Edge browser, for over a year now.
This is why everyone should be running Noscript. Javascript is a major security risk and should only be run on sites you completely trust 100%. Even then it is the most likely vector for viruses and malware.
Quite an experience to live in fear, isn't it? That's what it is to be a slave.
the researcher has decided to stop reporting bugs to Microsoft after they've ignored many of his previous reports
Yeah, I can empathise... MS have some really shitty strategies for dealing with bug reports, although I don't post security bugs my experience is:
I know that closed source has less resources but a) don't be fucking closed source then and b) don't use underhanded techniques to reduce your bug count because it will just piss everyone off.