Nasty Data-Stealing Bug Haunts Internet Explorer 8 151
Trailrunner7 writes "There's an unpatched vulnerability in Internet Explorer 8 that enables simple data-stealing attacks by Web-based attackers and could lead to an attacker hijacking a user's authenticated session on a third-party site. The flaw, which a researcher said may have been known since 2008, lies in the way IE8 handles CSS. The vulnerability can be exploited through an attack scenario known as cross-domain theft, and researcher Chris Evans originally brought the problem to light in a blog post in December. At the time, all of the major browsers were vulnerable to the attack, but since then, Firefox, Chrome, Safari and Opera all have implemented a simple defense mechanism. The upshot of this is that if a victim has visited a given Web site, authenticated himself to the site, and then visits a site controlled by an attacker, the attacker would have the ability to hijack the user's session and extract supposedly confidential data. This attack works on the latest, fully patched release of IE8."
Ie9 ? (Score:1, Interesting)
how about ie9?
Re: (Score:1)
You're asking if it's been fixed in an pre-release, unsupported version of IE?
Re: (Score:2, Funny)
Isn't that all of them?
Re: (Score:2, Interesting)
Re: (Score:2)
I think you mean that it'll run on every version of windows released in the past 8 years.
Re: (Score:2)
I would say that it runs on the current majority of Windows platforms (outside of China). Most windows systems in North America and Europe are currently running either Windows Vista or Windows 7 with Windows XP market share continuing to drop 1-2% each month. Since IE 9 isn't expected to be released until sometime in 2011, XP market share will likely drop another 6-10% before then. Seems Microsoft actually has people that know their market better than slashdot UID #646467. But I understand, your post wa
Re: (Score:2, Insightful)
Seems Microsoft actually has people that know their market better than slashdot UID #646467.
Snirk. Yeah, that would totally explain Vista and Kin, Plays For Now, Zune and Bing. They have Vision. They have Skills. They are Learned in the arts of the graphs and the Powerpoints. If they only spend a few more tens of $Billions on awkward ads, they can put it over. You so totally dominated me with your argument I must defer to your superior knowledge.
At this point there's nobody reading this but you and me so it's ok to get a little off-topic.
When you're finding in the charts the information yo
Re: (Score:2)
Seems Microsoft actually has people that know their market better than slashdot UID #646467.
Snirk. Yeah, that would totally explain Vista and Kin, Plays For Now, Zune and Bing. They have Vision. They have Skills. They are Learned in the arts of the graphs and the Powerpoints. If they only spend a few more tens of $Billions on awkward ads, they can put it over. You so totally dominated me with your argument I must defer to your superior knowledge.
Ah yes, and I see your vast fortunes outweigh Microsofts, and all the great things you've done make Microsoft seem insignificant. How foolish of me to have compared you to them.
When you're finding in the charts the information you want to find regardless of the later outcome, you might as well be looking at Tarot cards or bird entrails. It's clear you and I are not going to agree on how to project the uptake curve of W7 against XP. I see W7 at 15 to 20% at the end of July, nearly a year after RTM, and having gotten nearly all of that from the much reviled and structurally similar Windows Vista.
I see W7 at 20.68% at the end of August, and Vista at 24.67%, with a combined total of 45.35%. XP having a share of 40.61%, does mean that currently IE 9 supports over 50% of the windows market, with that market increasing every month.
The plateau is plain as day.
What plateau? XP has gone from 51.82% to 40.61% over the past year, noone in their right mind wou
Re: (Score:2)
Sorry, I guess I should make the distinction.
Intel is/has acquired Infineon Wireless, which is the manufacturer of ARM based CPUs in the iPhone and Android. Intel doesn't own ARM itself, just the (largest?) manufacturer of ARM based CPUs.
No way! (Score:2)
Re: (Score:3, Interesting)
Re: (Score:3, Interesting)
would not surprise me if some major corporations intraweb (or whatever the term is) package makes use of this as a feature in their design. As such, Microsoft needs to find a way to block the issue without destroying the workings of said package.
What? (Score:5, Funny)
People still use MSIE?
Re: (Score:1)
Re: (Score:1, Interesting)
I'm as surprised as you. I think only people who have no idea about security use it. And not even more of them.
Agreed: only people who don't know any better use MSIE. That and MS fanboys. Yes, they all have their vulnerabilities, but experience (12 years worth) tells me that getting off of IE is the first step to getting rid of malware.
Re: (Score:2)
No, not necessarily. If you have sharepoint (or a million other different legacy apps) in the workplace, IE is a necessity.
If you want to easily roll out configuration settings in an MS environment, you use IE.
And given the above, to maintain a sane, controlled, easy to maintain and troubleshoot environment - you roll ONE standard browser and keep that maintained. Anything else = unsupported.
If you happen to be on Windows, IE is already there anyway. Adding another browser simply means 2 sets of s
Re: (Score:2)
If one machine gets infected, that infection may spread... If all the workstations are part of a domain and share authentication details it becomes far easier to spread too.
The fact IE comes by default, and isn't easily removable is even more reason not to use it, it shows that it cant (and never could) stand on its own merit as a browser, they have to use dirty tricks like this to get people to use it.
Re: (Score:2)
Im all for lambasting IE8 for the awful awful browser it is, but lets lay blame where its deserved-- most malware is plugin-induced.
Re: (Score:1)
Re: (Score:2)
There have been a bunch of vulnerabilities that were rendered completely ineffective by IE's protected mode which, I think, is still unmatched by other browsers. I think IE has evened the game up a lot now, and there's a reasonable argument that since IE is pretty much forced to be on the computer anyway you are best limiting the surface area of attack by not installing any more browsers or other software that you don't need.
Now, as it happens, IE is so much more unpleasant to use (mainly speed, but other
Re: (Score:2)
+1 to this. All our new office machines are Windows 7 64 bit with IE8 in protected mode, and sites locked down into security zones. IE 8 is a mandatory install on all the old XP boxes.
And yes, javascript performance (and web performance in IE8 in general) is pretty abysmal, but IE is already there, and installing anything else in addition to that is simply increasing your exposure, configuration and patch maintenance, etc.
Re: (Score:3, Informative)
And still it will not help with this problem.
This is not an attack where it tried to infect your windows installation or anything like that.
This is an cross-domain information leakage problem.
Where someone can get information from domain x by inserting something from domain y and use that to do thing on domain x or do session hijacking.
Session hijacking would mean if you logged in on some site, someone else from somewhere else can login while you were logged in.
Come back when you understand web-development.
Re: (Score:2)
Did I say it would help with this particular problem? No, it won't. However security problems are NOT exclusive to IE, and there is plenty you can to do mitigate issues that you can't easily do with other browsers.
Come back when you understand application security.
Re: (Score:2)
OK, the way I put it, I was being an asshole.
But the point was, it did not apply. And you mentioned you didn't want it to.
Fine, I'll shut up about it.
Re: (Score:2)
So people will make do with an inferior browser, because its more efficient than the only other alternative of having an inferior browser *AND* a better one at the same time. Does that not sound extremely stupid to anyone else?
So basically the most secure configuration of windows is still weaker than that of any other platform.
Glad i don't use windows, and can therefore have only the browser(s) i want installed and can easily remove anything which is unwanted therefore having even less exposure, configurati
Re: (Score:3)
Re: (Score:2, Troll)
People still use MSIE?
I used it last week on a friend's computer, and was amazed to discover that this product of a multi-billion dollar software company doesn't even support multicolumn rendering or HTML5 video tags. It felt like I'd fallen through a time warp into the 1990s.
Re: (Score:2)
Don't be surprised. It took them long enough to finally interpret the alpha information stored in PNG images.
Re: (Score:3, Informative)
Re: (Score:2, Insightful)
Re: (Score:2)
Contrary to popular opinion, advertisement works.
I think my head just exploded.
Re: (Score:3, Insightful)
As a web app developer, I welcome IE9 with open arms. I'm certainly not going to be switching to it for personal use, but it promises to at least catch IE up with the browsers of three years ago.
Perfect? Not even close. Acceptable? Sure. Any time I spend fighting with it will be over minor CSS3 graphical enhancements, not basic rendering. And yes, I'd prefer if MS just bit the bullet and switched to an open rendering platform like Webkit, but if IE9 ends up living up to the claims, it's as good as I can ho
Re: (Score:2)
Ditto. However I think microsoft are trapped by their own success. There is that much legacy content out there on corporate intranets, etc that they can't change rendering engines. They need to keep all the old cruft in there so that they can fall back to IE6 mode to render content generated by their own software (eg, sharepoint, etc) properly.
I'm certainly looking forward to IE9 as it means I'll have a half-decent standards compliant (or certainly better than current) browser that I can lock down wit
Re: (Score:2)
Don't rely on group policy to "lock down" anything, the best you can hope for with group policy is to distribute a set of defaults... DO NOT rely on it for any kind of security whatsoever.
Re: (Score:2)
DOS 5 (built in EMS/XMS support, upper memory use). Windows 2000 (those who weren't administering MS networks before active directory have no idea on the improvement), Windows 7.
Were those products best in class? No, but they were huge improvements that worked with your existing MS stuff, and made your life a hell of a lot easier if you were in a microsoft shop (as most corporates are).
Re: (Score:3, Insightful)
So it doesn't support standards that aren't finished? Wow, how criminal.
Browsers have always supported standards that aren't finished, at least since I started using them in the early 90s; heck, many of the standards themselves co-opted features that browsers had implemented themselves.
And every other major browser I'm aware of already supports those things, which puts IE well into the second rank in terms of features as well as security.
Re: (Score:3, Insightful)
Browsers have always supported standards that aren't finished, at least since I started using them in the early 90s; heck, many of the standards themselves co-opted features that browsers had implemented themselves.
Oh, I agree with you completely. But you can't *blame* them for it.
The complaint sums to: "they didn't go as much above and beyond as other browsers have."
Re: (Score:2)
They haven't caught up, IE8 is still way behind the current releases of other browsers... They've shrunk the gap slightly, but they're woefully far behind. Look at their acid3 score, or the html5test site, or there was another site which showed what percentage of the various standards were supported by various browsers... Whatever metric you use, IE comes up laughably short compared to all the other major browsers.
Re: (Score:2)
As a (multi-disciplinary) systems engineer, I deal in reality and I'm nobodys fanboi but I know when the ideal meets th
Re: (Score:2)
Don't worry about it, I always get modded troll. I have some guy with a grudge and tons of mod points following me around or something, I dunno. (I had a karma bonus for like 5 solid years, and this guy has removed it in a couple of weeks. Slashdot's karma system is broken beyond belief.)
Re: (Score:2)
The problem is that the standards process moves too slowly, and the web has traditionally moved very fast (except for the few years when IE6 was stifling progress)...
Not implementing a draft standard is one thing, but not implementing the same fully documented standards, draft or not, that are implemented by everyone else is just ridiculous.
Re: (Score:2)
Re: (Score:2)
It's perfectly fair to gripe, when for several years now not just one but several other browser makers have been light years ahead...
Why can't MS at the very least try to be in the same league as webkit/opera/mozilla?
Re: (Score:2)
IE9 is just another attempt at catching up, it's pretty feeble when a browser thats "coming soon" is only going to be "on-par" with whats already available, and will be behind what everyone else has coming soon.
Re: (Score:2)
Most people aren't geeks that know how to change their User Agent String (Other than perhaps Safari which has it right in the menu). While technically true, your statement is so highly unlikely that it isn't not even worth pursuing.
Re: (Score:3, Interesting)
Yes, and there are women who stay with abusive husbands because "he said he's sorry, and he loves me, and it'll never happen again".
Re:What? (Score:5, Funny)
People using IE don't even get that much!
Re:What? (Score:4, Funny)
Re: (Score:2, Insightful)
Users of Microsoft software always remind me of the first little pig, the one that builds a house of straw.
http://en.wikipedia.org/wiki/Three_Little_Pigs [wikipedia.org]
Re: (Score:2)
Re: (Score:2)
Not at all, ditching windows would be like divorcing a leeching spouse who is only there for your money...
The divorce settlement may cost a lot, but its a one off payment and once you're free you won't be hemorrhaging cash year on year.
About 80% to 85% of all users worldwide... (Score:2, Interesting)
IE's world-wide market share is currently around 80% to 85% of all web users.
Alternate browsers have very poor support for properly rendering the text of most Asian languages, while IE has exceptionally good support, so the use of alternate browsers in places like Japan, China, Thailand, Taiwan and the Koreas is virtually unheard of. These markets, which are already far larger than the American or European markets, are still growing.
Don't let the W3Schools stats confuse you. Those are for a small subset of
Re:About 80% to 85% of all users worldwide... (Score:4, Insightful)
Don't let the W3Schools stats confuse you. Those are for a small subset of the comparatively small American market, and thus aren't indicative of the global trends.
Just keep fiddling while Rome burns, Nero.
Re:About 80% to 85% of all users worldwide... (Score:5, Informative)
Re: (Score:1)
Re: (Score:1)
a modern standards complaint browser.
You got THAT right! ;-)>
Re: (Score:2)
Beat me to it.
Re: (Score:2)
actually its only 52% and dropping rapidly. If nothing else, at least MS is having to make a modern standards complaint browser. I for one, don't think it'll be enough to gain back much lost market share, but at least it'll make it easier on us web developers. Source: http://en.wikipedia.org/wiki/Internet_Explorer#Market_adoption_and_usage_share [wikipedia.org]
I'd mod you "+1 Damn, I've been dreaming of that day for ages!!" but apparently slashdot doesnt have such a mod.
Re: (Score:2)
In south korea the problem is because their online commerce system is locked into a proprietary system that requires an ie-only plugin, rather than using standard ssl like everywhere else.
America also has a relatively large percentage of IE users...
Europe however, has far lower IE market share than anywhere else.
Re: (Score:2)
Which twat modded this Flamebait? Mod it Funny, twat or don't mod it at all.
Bummer (Score:3, Funny)
I just upgraded to IE 8 yesterday to verify a support issue.
Times change (Score:2, Insightful)
Can't remember the last time I fired up IE (I do have IE8 installed).
Kudos to FF team. Thank god I don't work on webapps anymore.
Re: (Score:3, Informative)
What year are you from? IE hasn't been used for Windows Update since... well, hell, it was optional even in Windows XP. Going to the site in Vista (almost 4 years old now) or higher just redirects you to the control panel.
It's not 1998 anymore.
Re: (Score:2)
Re: (Score:2, Funny)
I guess I had the magic version of XP, where all you had to do was check "automatically download and install updates" in the Windows Update control panel.
Re: (Score:2)
Oh? What about windows update?
I think the updates will find their way to your computer automatically if you select either of two certain radio buttons in a control panel somewhere ... you don't need IE to get them. Also, in case you're a rebel and/or a maverick, you can read the MS security bulletin in a non-MS browser, follow the links and download the updates manually to be installed at your convenience.
Re: (Score:2)
IE and Microsoft (Score:5, Interesting)
It's a strange thing. It seems the only reason IE exists it to repeated punch microsofts reputation in the face. I'm surprised one executive hasn't gotten so fed up and fired the "IE team" or replaced them with monkeys. I watch Channel 9 and there are some seriously smart people working at this company and yet this one program has done more to harm the company's reputation like no other.
Re:IE and Microsoft (Score:4, Funny)
Re:IE and Microsoft (Score:5, Funny)
I'm surprised one executive hasn't gotten so fed up and fired the "IE team" or replaced them with monkeys.
Do you have any proof that they haven't been replaced by monkeys?
Re:IE and Microsoft (Score:4, Funny)
Re:IE and Microsoft (Score:5, Funny)
Has Microsoft put out any Shakespeare yet? Then there's your proof.
I dunno, I consider MSIE to be the of the great tragedies of my lifetime....
Re: (Score:2, Funny)
That's only proof that it's not an infinite amount of monkeys...or that they haven't been given typewriters and are struggling with all of Word's delightful little habits.
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Insightful)
Well - you know the big fight they posed about "IE being a core part of Windows". And i guess a selling point for large administrations was "working together very well with the OS" and "supporting you old web applications with active X as long as you want". Yeah sure.
Go to your customers with 10000 licences of Windows (and 10000 licenses of MS Office) and tell them in the face: "Sorry guys, we know we said IE would be working forever and especially well with windows, but you know, we cant afford that team a
Re: (Score:2)
It's a strange thing. It seems the only reason IE exists it to repeated punch microsofts reputation in the face.
I question why they bother with a browser at all. What do they really gain from it? Wouldn't the money they spend on IE be better spent on the core OS?
If it is broke (Score:1, Funny)
why fix it?
So? (Score:3, Insightful)
Re: (Score:2)
Re: (Score:2)
You policy has to be really strict to have that filtering filewall work against these kind of cross-domain exploits.
I know it might be to much to ask for people to read the article and understand what issue it is about. This is slashdot after all...
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
If you're using internet explorer, you deserve every known bug that M$ neglects to patch for a long long time.
FTFY. All mayor browsers except Opera suffered from this attack vector, but all others patched it fairly fast. This isn't a problem with bugs, this is a problem with the patching of those bugs, and M$ shows how little they care for customers every day they leave exposing bugs like this and many others [wikimedia.org] unpatched for *years*.
in the wild (Score:2)
Re: (Score:3, Funny)
Yes there is sites out there where the company behind them send out software that infect your computer and causes it to become open for anyone to take over.
Some of them even pretend to do useful things for you like pretending to be a way to secure your computer from nasty attacks.
For one nasty example check out this site:
http://www.microsoft.com/ [microsoft.com]
think about it ... (Score:2, Funny)
God's ten commandments aren't adhered to ... well at least a major subset of them. How can you expect the rest of the population to listen to administrators when they suggest "don't use IE"?
Theft, really? (Score:4, Insightful)
Data theft is easy to detect, just look for missing data. These sound like data spying/eavesdropping attacks, that is, where the attacker is able to monitor all your data without your knowledge. Nowadays it seems that "theft" has come to mean "something I don't like".
Re: (Score:2)
Yes, stealing data will altert the user as to the theft, so you should copy it instead of stealing it. But it sounds like you're saying that copying something is stealing it. Data theft is taking a hard drive full of the only copies someone has of something, or (idiotically) making copies and then deleting the originals. Merely copying that and leaving the original w
Re:Let me the first to say..... (Score:4, Informative)
Re:Let me the first to say..... (Score:5, Funny)
Steve Hawking goes into a little more depth in his new book and Greene actually says String theory supports it too.
We're on our way to a Unified Theory all thanks to IE and Microsoft.
Re: (Score:2)
Re: (Score:2)
>15 years from our perspective is actually 30 by IE's perspective.
The there are those that feel it should be measured in dog years
Re: (Score:3, Insightful)
Browser usage (Score:2)
Re: (Score:2)
While virtual machines add an extra layer, they also add extra code and hardware which can be exploited.
I wouldn't bet my life on it.
Re: (Score:2)
"I wouldn't bet my life on it."
Frankly, I find it highly unlikely that I'll ever become a successful target given my penchant for multiple layers, deep scanning, and extensive (signature and behavioral) monitoring (including honey pots) but given the shoddy state of affairs with software development these days, I have no faith that I'll forever be malware free. I've even found verified infections in software by Fortune 500 companies. Not good.
Speaking as, among many other things, a successful software
Re: (Score:2)
And yet, of that list, chances are 90% of them:
1. Use the IE core, or
2. Use the Firefox core, or
3. Use the WebKit core
There are a small handful of browsers that don't use the above, but they are few and far between.
Re: (Score:2)
I think if you count like that you will probably find that it's 99% or something like that. Maybe a bit less in the mobile space.
Re: (Score:2)