Nasty Data-Stealing Bug Haunts Internet Explorer 8 151
Trailrunner7 writes "There's an unpatched vulnerability in Internet Explorer 8 that enables simple data-stealing attacks by Web-based attackers and could lead to an attacker hijacking a user's authenticated session on a third-party site. The flaw, which a researcher said may have been known since 2008, lies in the way IE8 handles CSS. The vulnerability can be exploited through an attack scenario known as cross-domain theft, and researcher Chris Evans originally brought the problem to light in a blog post in December. At the time, all of the major browsers were vulnerable to the attack, but since then, Firefox, Chrome, Safari and Opera all have implemented a simple defense mechanism. The upshot of this is that if a victim has visited a given Web site, authenticated himself to the site, and then visits a site controlled by an attacker, the attacker would have the ability to hijack the user's session and extract supposedly confidential data. This attack works on the latest, fully patched release of IE8."
Times change (Score:2, Insightful)
Can't remember the last time I fired up IE (I do have IE8 installed).
Kudos to FF team. Thank god I don't work on webapps anymore.
Re:Let me the first to say..... (Score:3, Insightful)
Re:About 80% to 85% of all users worldwide... (Score:4, Insightful)
Don't let the W3Schools stats confuse you. Those are for a small subset of the comparatively small American market, and thus aren't indicative of the global trends.
Just keep fiddling while Rome burns, Nero.
Re:What? (Score:2, Insightful)
Re:What? (Score:3, Insightful)
As a web app developer, I welcome IE9 with open arms. I'm certainly not going to be switching to it for personal use, but it promises to at least catch IE up with the browsers of three years ago.
Perfect? Not even close. Acceptable? Sure. Any time I spend fighting with it will be over minor CSS3 graphical enhancements, not basic rendering. And yes, I'd prefer if MS just bit the bullet and switched to an open rendering platform like Webkit, but if IE9 ends up living up to the claims, it's as good as I can hope for.
So? (Score:3, Insightful)
Re:What? (Score:3, Insightful)
So it doesn't support standards that aren't finished? Wow, how criminal.
Browsers have always supported standards that aren't finished, at least since I started using them in the early 90s; heck, many of the standards themselves co-opted features that browsers had implemented themselves.
And every other major browser I'm aware of already supports those things, which puts IE well into the second rank in terms of features as well as security.
Re:What? (Score:3, Insightful)
Browsers have always supported standards that aren't finished, at least since I started using them in the early 90s; heck, many of the standards themselves co-opted features that browsers had implemented themselves.
Oh, I agree with you completely. But you can't *blame* them for it.
The complaint sums to: "they didn't go as much above and beyond as other browsers have."
Theft, really? (Score:4, Insightful)
Data theft is easy to detect, just look for missing data. These sound like data spying/eavesdropping attacks, that is, where the attacker is able to monitor all your data without your knowledge. Nowadays it seems that "theft" has come to mean "something I don't like".
Re:IE and Microsoft (Score:3, Insightful)
Well - you know the big fight they posed about "IE being a core part of Windows". And i guess a selling point for large administrations was "working together very well with the OS" and "supporting you old web applications with active X as long as you want". Yeah sure.
Go to your customers with 10000 licences of Windows (and 10000 licenses of MS Office) and tell them in the face: "Sorry guys, we know we said IE would be working forever and especially well with windows, but you know, we cant afford that team any more, they just suck too much - take care about yourself.".
Good luck with that.
At MS it has always been a policy that if something does not crash immediately and enables the customer to do some work you can put it on a floppy disk/press the cd. To the standard PEBKAC the cuprit is not obvious anyway - if the computer crashes, is hacked, rund slower than before, need more memory than before to do the same work - for sure its not MS fault. However if something visible to the PEBKACs goes missing, then they would blame Microsoft.
Re:What? (Score:1, Insightful)
So your defense is, "yeah, they are clearly the worst of the bunch but you can't blame them for it". I guess it would be easy to agree with you if the result hadn't been so destructive to the progress of the whole internet.
I don't understand what you want W3C to do by the way... they've tried the "let's standardize first and wait for implementations later" before and it's failed miserably.
Re:What? (Score:2, Insightful)
Users of Microsoft software always remind me of the first little pig, the one that builds a house of straw.
http://en.wikipedia.org/wiki/Three_Little_Pigs [wikipedia.org]
Re:Ie9 ? (Score:2, Insightful)
Seems Microsoft actually has people that know their market better than slashdot UID #646467.
Snirk. Yeah, that would totally explain Vista and Kin, Plays For Now, Zune and Bing. They have Vision. They have Skills. They are Learned in the arts of the graphs and the Powerpoints. If they only spend a few more tens of $Billions on awkward ads, they can put it over. You so totally dominated me with your argument I must defer to your superior knowledge.
At this point there's nobody reading this but you and me so it's ok to get a little off-topic.
When you're finding in the charts the information you want to find regardless of the later outcome, you might as well be looking at Tarot cards or bird entrails. It's clear you and I are not going to agree on how to project the uptake curve of W7 against XP. I see W7 at 15 to 20% at the end of July, nearly a year after RTM, and having gotten nearly all of that from the much reviled and structurally similar Windows Vista. The plateau is plain as day. Though the Vista base continues to erode, adoption by XP users is levelling off and it never was much. To expect to get from 20% to 50% in another year would presume an upward curve to the line rather than the levelling one that is shown. I'll go ahead and project that W7 will not achieve 50% share on an average of the top five metrics in CY2011. Hell, I'll go ahead and say it won't get 40% as measured in the single month December 2011 in an average of the top five metrics. I'd go as far as to bet a beer on it. A risky thing, this fortune telling is. I can't delete this slashdot comment, so if I'm wrong you'll be able to throw it in my face forever after, and that means a lot to me.
Microsoft has renewed the family pack offer for W7, but you still have to have W7 capable hardware in order to be even slightly interested. Some people may be buying new hardware and unable to avoid W7, but they're handing their old hardware down mostly, so each unit should count only as a half-step rather than a whole one. To get a whole step that old PC has to go in the landfill rather than being given away or resold on Ebay, and I don't see that happening. XP may be discontinued, but "W7 pre-downgraded to XP" seems to be a popular netbook option even today, particularly on Intel Atom netbooks which don't run W7 well. Considering that XP is in fact still selling well at retail calls the lie to its demise in the context of browser share. Those are backsteps that cost double. Microsoft may want us to let go of XP, but internally one must presume they are conflicted since W7 doesn't work well on a netbook and they don't want to dismiss the migration to mobile because that's where the crowd is going. If the OS is still for sale on emerging platforms today, how dead could it be? A lot of users still use W2K because they have apps from dead companies that they still need to do what they do, and W2K had a relatively brief moment of dominance compared to XP. XP in actual use is going to be a significant share for a very long time, even if people have to license W7 to get it.
And then there's the migration to mobile. We're going to ARM. We're giving up on Intel, the storied company that brought forth the computer revolution, founded by the inventor of the transistor, just to get away from you. That's got to make you proud.
But yeah, internally in Redmond go ahead and spread the word that W7 is being embraced by the masses, that XP is seen by the bloggerati as completely croaked. We need you to be oblivious to Android on the desktop and as a VDI solution so that when it's time to lead you out behind the barn you come along meekly. The more you make your own apps incompatible with your own operating systems the better off we are.