7192658
story
Comments: 202 +- Technology: New Attack Fells Internet Explorer on Sunday November 22, @10:33AM
background: url(//a.fsdn.com/sd/topics/topicie.gif); width:64px; height:64px;
msie
background: url(//a.fsdn.com/sd/topics/topicms.gif); width:75px; height:55px;
microsoft
background: url(//a.fsdn.com/sd/topics/topicsecurity.gif); width:59px; height:78px;
security
background: url(//a.fsdn.com/sd/topics/topicit.gif); width:75px; height:61px;
it
alphadogg writes "Attack code has been identified that could be used to break into a PC running older versions of Microsoft's Internet Explorer browser. The code was posted Friday to the Bugtraq mailing list by an unidentified hacker. According to security vendor Symantec, the code does not always work properly, but it could be used to install unauthorized software on a victim's computer."
Related Stories
Executive ability is prominent in your make-up.
All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2010 Geeknet, Inc.
Is that supposed to be news?? (Score:5, Insightful)
Re:Is that supposed to be news?? (Score:5, Insightful)
old != unpatched.
The article says IE 6 and IE7. It does not say unpatched. For many people these are their current browsers as they have not upgraded to IE 8. For business users, their companies may still insist they use older browsers until they are able to migrate certain software to the new version.
Parent
Re: (Score:3, Informative)
old != unpatched.
For business users, their companies may still insist they use older browsers until they are able to migrate certain software to the new version.
Or upgrade hardware - we have a variety of customers who's machines are too old to run IE7 or IE8 efficiently, and who have no plans (or budget or whatever) to upgrade their hardware until it dies or is very near death.
Re: (Score:2)
Here is the lemma to your myopic car analogy: Replace the brakes, belts, and other wearables. Service your engine and transmission at required intervals. When a warranty recall for a defective part is issued bring the vehicle to dealer to have it replaced. If you don't do these things and service your vehicle, it will break down and leave you vulnerable to the consequences. Yeah I know - maintaining your vehicle keeps mechanics employed.
Re: (Score:3, Insightful)
With an atitude like that, you are a nuisance to everyone else on the road.
Re: (Score:3, Insightful)
If inpections are too heavy a burden on people, those people should not have cars then. As far as getting stuck with "repairs" you don't want, either you're not going to someone trustworthy and should find another mechanic, or you should do the inspection yourself upfront so you can call their BS. Most inspections are just quick checks on belts, brake wear, etc, it should be trivial to do it yourself.
As far as the cost of the inspection, tell that to the state; here its only $20, and only if you pass.
Re: (Score:3, Interesting)
Software doesn't wear out.
Yes it does.
When the world around a piece of running software changes, that piece of software in the middle often doesn't work like it used to. Yes, it's contextual, but it's also mostly true. It's often (humourously) referred to as the "principle of bit decay".
Basically, if it works, it's obsolete.
Re:Is that supposed to be news?? (Score:4, Interesting)
Drat, improving technology keeps programmers employed.
Double drat- your reluctance to update combined with a propensity to complain keeps additional people employed just to make sure things continue to look pretty on your screen.
Parent
Re: (Score:3, Interesting)
What is the improving technology?
Re: (Score:3, Funny)
Re: (Score:3, Informative)
Allow me to translate from trollspeak. "no way of doing that" means "no way of doing that, that I could find by clicking around for a minute on the GUI." In this case, I don't even think they did that, because there are options to change how often it prompts for updates, and for applying security updates automatically without prompting.
I really like Ubuntu's choice of default behavior here. Prompting the user to apply updates means no "I lost data because it upgraded while I was in the middle of working
Re: (Score:3, Informative)
Who ever they are, they have bigger IT problems than this exploit will ever generate.
A lot of people- you'd be surprised. Earlier this year I worked for a place where at least a third of their customers (from academic departments, mostly) were still using IE6 and various IE5 versions.
Re: (Score:3, Insightful)
If MS is going to be taking money for something like this then they should still be supporting IE6 and patching up
Re:Is that supposed to be news?? (Score:4, Insightful)
Considering how long people hold onto their version of IE, it will be ages until IE7 disappears.
I really don't think you are right about that. There will always be those home users on dialup that don't run automatic updates ever but they are not very useful in a bot net anyway. Most people will get update to IE8 weather they mean to do it or not. IE 6 lives in the corporate space because it was around long enough for its own software ecosystem to develop in and on it. IE7 was around for like a year before 8 was released as beta and 8 does not break much compatibility with 7 its much less significant than 6 -> 7.
I doubt there is much code out there target at 7 that does not work on 8. The projects that do would have to have been pretty small and would have been designed and completed in a pretty narrow time window between 7's release and the pretty clear public information on what was coming in 8.
Parent
Re:Is that supposed to be news?? (Score:5, Insightful)
Parent
Re:Is that supposed to be news?? (Score:5, Interesting)
Using SAP by any chance ?
In my former company, they use SAP and it's absolutely an IE only application for its web interface. It doesn't work *at all* with Firefox. At least that was the case when I was working there (We were using SAP ECC6)
Parent
Re: (Score:3, Interesting)
Oh good Lord *facepalm* (Score:5, Funny)
Microsoft Windows has once again trounced all comers in security, with a recent survey showing 59% of all Windows machines on the Internet being infected with malware and under the control of botnets. Malware rose 15% just from August to September this year.
Windows users continued to be stupidly complacent Typhoid Marys, telling Mac and Linux users that they were every bit as susceptible to viruses and Trojans, despite the Windows:Mac:Linux virus proportions in the wild continuing at approximately 100%:0%:0% for the fifteenth year in a row, and pumping out gigabytes of spam and denial-of-service attacks from their thoroughly 0wn3d computing cesspits.
“The truth is out,” said Steve Ballmer, taking care not to wash his hands [today.com] when preparing the food for his Windows 7 House Party. “Mac and Linux users are just too pussy for viruses. Gotta keep your immune system up! What are you, some sort of faggot? Too artsy or nerdy for MANLY food?”
The time on the digital clock behind him changed at random as he foamed slightly at the mouth. “Windows — we’re NUMBER ONE! And here you were saying Windows was a load of ‘number two.’”
U.S. Government (Score:2)
This is a huge problem. Many U.S. Government agencies have yet to move off of IE6. Especially the military. Mostly due to IT management contracts that require the gov't to pay for every little upgrade action. For a simple upgrade, one agency gets tagged per profile per month by the company that runs their IT. That same company has a policy of being 2 versions behind current. Meaning, it is actual policy to be running IE6, Office 2003, and XP/Server 2003. The approval process is so overtaken with red tape an
Re: (Score:2, Informative)
The problem isn't anything Microsoft doing, it's users who don't upgrade their OS. Did you notice the part where this only affects IE6 and IE7? Upgrade to IE8, and, presto, you're immune!
MSIE version 8 is not known, according to TFA. (Score:3, Interesting)
Some users, like office workers, are not in control of the computers they use and cannot switch away from what they were given. Sometimes they were set up with particular versions of software to suit other programs. The "Banner" system some universities use, for instance, requires MSIE7 and a particular old version of Sun
Re: (Score:3, Funny)
Re:Oh good Lord *facepalm* (Score:5, Funny)
Humor Process Failure
(A)bort, (R)etry, (F)lail
Parent
Versions 6 & 7 (Score:2, Informative)
Summary needs clarification (Score:5, Funny)
"According to security vendor Symantec, the code does not always work properly, but it could be used to install unauthorized software on a victim's computer."
So, are they referring to IE or the attack code?
Re:Summary needs clarification (Score:5, Funny)
No, they're referring to Symantec's code :)
Parent
Re: (Score:3, Funny)
Is it too much to hope that someone is using this attack vector to upgrade corporate computers from IE6 to something that can render web pages correctly?
CSS Behvaiors? (Score:2, Informative)
Not aware of a patch? (Score:2, Interesting)
I know most of us would like to pretend IE doesn't exist, but they haven't even heard of IE 8?
Re: (Score:3, Informative)
VUPEN Security is not aware of any vendor-supplied patch.
I know most of us would like to pretend IE doesn't exist, but they haven't even heard of IE 8?
Microsoft doesn't make IE 8 for older versions of Windows such as Windows 2000. It'd be like saying Windows 7 is a "vendor-supplied patch" for Windows Vista.
Re: (Score:2)
There are plenty of web apps (especially in the "Enterprise" environment) which depend of quirks of specific browsers. Most commonly IE6. Using a different browser means making major changes. At which point it probably dosn't matter if the change were to be to Firefox, Opera, Safari, etc. Indeed there are versions of Windows which won't run IE8, but will run modern non Microsoft browsers.
Indeed if things are web
Re: (Score:2)
Re:Not aware of a patch? (Score:4, Insightful)
Surely one of the main reasons for having web based applications in the first place is to get some independence from the clients' platform.
You haven't been in IT long, have you?
Parent
A great reason to choose Firefox (Score:4, Informative)
Re: (Score:3)
It sounds like the root flaw actually lies in your own login implementation. I guarantee that IE is capable of handling sessions. If you have a website that makes you money, you should realize a couple points: First, most of your userbase runs IE. Having the site unusable in said browser is very bad. Second, special casing code for IE is a fact of life in the web development world, and you should just get used to it.
Re: (Score:3, Interesting)
It looks like there is a root flaw in your logic implementation there jbacon. You are right about the special casing needs, but a simple redirection to a page explaining that they are using a non-standards compliant virus sink with links to getfirefox.com and articles backing up the claim would be much more effe
Re: (Score:3, Insightful)
More likely the users would complain, management would haul the IT chief in to a room to ask what was going on, and he'd explain that the users were wasting lots of time filing frivalous tickets trying to access sites for non-work purposes, and management would issue a statement telling them to stop wasting time and money.
In the home space, people would simply go "Huh? But then I won't be able to use my other webs!" and go somewhere else - especially if it's a commercial site they were looking to make a pur
What the world needs (Score:5, Interesting)
is a definitive software engineering treatise on the history of IE security exploits.
It is certainly true that there is a kind of economic network effect going here. For many years we saw so many web sites that only worked properly with IE because IE was so dominant. The same factor naturally attracts black hats looking for systems to exploit. Once we factor that out, what can we learn from how IE was conceived and maintained?
Did clumsy code-reuse and maintenance play a significant role? That is did they stretch existing code to do things it hadn't been designed to do because it was close enough to pass the demo test on time? That's a decision we all face; we'd all *like* to rewrite things better when we take a look at them, but in the real world we've got to ship good enough code on a deadline to justify our salary. I think MS might be particularly vulnerable to the "killer demo" imperative. They are a business that is dependent on organizations choosing entire MS product stacks because they *anticipate* something they're going to need in the future will be dependent on something else in that stack.
Did "business strategy" considerations confuse priorities for system requirements? E.g., The decision to make IE a fundamental part of the OS allowed MS to gain control of (destroy) the browser market while evading anti-trust regulation. Did that result in undesirable coupling of IE to the underlying system? Did the desire to leverage browser market dominance to give other MS products a competitive advantage create confusion in requirements or priorities?
Were there cultural attitudes that made security and quality secondary? E.g. Did MS value having shiny new features soon before doing a quality implementation? Did their success at achieving effective control of the browser market cause them to under-invest in maintenance because they had no competition worth worrying about?
These are the kinds of things I'd like to know. It's almost past the point where any individual security flaw in IE is interesting to me, because there have been so many and will be so many more. It's time for a really first rate summing up by somebody who knows what he's talking about.
Re: (Score:3, Interesting)
Yup. We definitely need a "Truth and Reconciliation Commission" for what Microsoft has done to us. Whether or not to prosecute them later is a political decision. ;)
Re: (Score:2)
I was thinking more along the line of the Nuremberg Trials.
Google strikes back (Score:2, Funny)
Hypocrits! (Score:5, Insightful)
So, isn't the responsible thing to do to notify Microsoft, and given them adequate time to produce a patch?
By posting the exploit to a public list, this guy is basically handing the bad guys a weapon. That's criminal. But because it's a Microsoft product, the Slashdot folks just eat that up -- Hey, fuck'em, they're running Wind0ze!!!111
MS could have found+fixed it (Score:2)
but all their code security auditors were working on the Chrome plugin :-p^
Re: (Score:3, Insightful)
FTFY.
Re: (Score:3, Informative)
Yes, it detects the code on display, not an actual exploit.
It is crappy AV software.
Re: (Score:2, Informative)
Re:In other news... (Score:5, Insightful)
What does that have to do with anything? Fully patched IE 6 and IE 7 are _supported_ products, the ones you list are not.
Parent
Re: (Score:2)
that's just mean.
Re: (Score:2)
In the UK that would fall foul of the Computer Misuse Act; other countries have similar laws.
It's also a really, really stupid idea, only marginally less anti-social than writing traditional malware.
Re: (Score:3, Insightful)
The only people still using internet exploder are people who don't care about security.
Or perhaps they just don't know about that sort of thing, and expect their computer to just work, just as their TV, fridge, microwave, phone, etc all just work?
or whatever the OS X browser is called
First you lambaste people for not knowing enough about IE and its alternatives, then you admit to not knowing enough about Safari. Beautiful.