New IE Holes Discovered 801
joelt49 writes "Yahoo! News is reporting that 7 new security holes for Internet Explorer have been discovered by a Chinese researcher; however, there apparantly aren't any attacks on IE yet." The part about this story that gets to me is that the researcher didn't alert Microsoft before posting to a public mailing list. Sure, a lot of people don't like Microsoft, but that's no reason to make it worse for the millions of people who are forced to use Microsoft products, especially for security holes which have yet to be exploited.
Incident response times (Score:5, Insightful)
Yep, not ideal. But it'll be interesting to see whether MS's claims of having a faster response time to security incidents that the Linux community stands up. Will they have a patch available withing the next day or so? You can guarantee that the Mozilla or Konqueror communities would have in the same circumstances...
Re:Incident response times (Score:3, Insightful)
And would the Mozilla and Konqueror communities fully regression test their changes against all of the various software it might affect.. no.
Re:Incident response times (Score:5, Informative)
Feel free to Google.
No Exploit, eh? (Score:5, Informative)
Exploit code, anyone? A simple google search or a Bugtraq archive browse should do it.
Re:No Exploit, eh? (Score:3, Insightful)
The statement "There aren't any attacks on IE yet" doesn't mean there are no exploits, just that no one is using exploits (attacking).
Re:No Exploit, eh? (Score:5, Insightful)
Re:No Exploit, eh? (Score:3, Funny)
Re:Incident response times (Score:5, Informative)
It's even worse when done by design [winntmag.com]. Once a scoundrel - always a scoundrel.
Re:Incident response times (Score:5, Insightful)
I can understand Internet Explorer needing to be tested against the rest of Windows and its APIs but Mozilla is a stand-alone web browser - as long as the API isnt affected it ['full regression testing'] shouldnt matter too much IMO.
Re:Incident response times (Score:5, Insightful)
This is also something to watch out for when developers try to mimic the Microsoft Windows system while making Linux more and more user friendly.
IMHO
LoB
Re:Incident response times (Score:5, Insightful)
Code reuse is code reuse, whether it is Windows, Unix, or any other OS/app. Modern programmers are taught to do code reuse, and saing "This is not the design methodology used in the *nix world" is plain stupid.
When gzip security hole was discovered, it hit hundreds of Unix applications, because they reused the code from this library. Is the "design methodology" any different?
The gzip bug demonstrated that it sometimes can even be worse on *nix, due to source code coping instead of shared libs, so that the bug had to be fixed in multiple places.
By the way, Netscape was / Mozilla is actively trying to make itself a platform for writing applications using its XPCOM/XUL and other technologies. It is not very successful so far, but when it will, its bugs and patches will hit lots of independent applications, just like bugs/patches in IE do now.
Code reuse is code reuse (Score:3, Insightful)
Hmmm who modded this troll up as Interesting, ok I'll pretend this is not a troll, and answer, what M$ has done with bimbo's and IE is not just code reuse, they have not just used some of the same libraries again, they have tightly coupl
Re:Code reuse is code reuse (Score:5, Insightful)
And you don't know anything about gzip vulnerability and instead generalize your ideas of how it should be to how it is actually done.
Lots of applications were using customized version of gzip, e.g. Linux kernel used a trimmed down version of gzip. They could not be simply recompiled with new library - the bug had to be fixed in every copy of the source code - yet, it was code reuse via copy/paste as much as it could possibly be. Too little applications used shared library, so even those application that used standard gzip had to be rebuild with new static library.
And if *nix world moves to using shared libraries more, it will face the same problem Microsoft has - a single security fix in a single shared library can potentially break any of hundred applications that use this library, and all these applications has to be tested with patched version. Which is still better than patching hundred applications independently.
Re:Incident response times (Score:3, Informative)
When the bug was found, some other packages had to patch the versions of zlib they containe
Re:Incident response times (Score:5, Insightful)
Re:ROFL!!! (Score:3, Insightful)
Re:Incident response times (Score:5, Insightful)
Re:Incident response times (Score:3, Insightful)
Re:Incident response times (Score:5, Insightful)
Microsoft doesn't either (Score:4, Informative)
Re:Incident response times (Score:5, Insightful)
The whole premise behind FSF is that it is FREE, the user accepts some responsibility in the transaction, in this case by reporting bugs and helping to test beta versions before the code is released live. You seem to be saying that Microsoft has never released code that was not finished, 100% Quality Assured, no Security holes.....
If you believe so strongly in your statements, why do you post AC?
So I say Mod the Grandparent DOWN, MS whiners be damned!
Re:Incident response times (Score:5, Insightful)
Microsoft has released service packs that kill peoples applications, so much so that they have had to remove the service pack and put in a differnt one to patch the broken patch. Even Microsoft can't check the way everything works with everything.
The big differnce is that with open software, you can patch it yourself, or hire somebody to patch it for you. With MS, you can't patch it, and unless it effects enough people, you can't get MS to patch it either.
Re:Incident response times (Score:3, Insightful)
But I have to upgrade a minor version (!) for free (!). I don't have to upgrade to apache-2. Even if I had to do this, I won't have to pay money to the apache foundation - so they have no interest in making me upgrade to a higher major version. That's a big difference in my opinion.
Re:Incident response times (Score:3, Informative)
Way back when I was getting my degree, one of the lecturers had implemented this interpretive language called Codil (COntext Dependent Information Language) in Cobol. It was apparently really good at solving certain types of problems, but one of it's own problems was that the interpreter partially depended on some bugs in that one particular Cobol compiler. When Bugfixes were applied, the author needed a description of the fixes so he could track down the problems they wer
Re:Incident response times (Score:5, Insightful)
This gets back to the terms sproketboy used: no "commingling" in a "properly written application".
I won't go into a 10-page lecture on software engineering. But just because an application is depended on by any others doesn't mean they're comingled, or improperly written. A good component app will have a limited number of interfaces to the rest of the system (on the order of 10-200, and hopefully towards the low side).
Testing the program's correctness on those interfaces gives you a high trust that it'll work correctly in the larger system.
Microsoft(tm) IE(r) isn't like that. It doesn't have defined interfaces to the rest of the system. Its not an application which runs on the OS kernel and talks with other apps. It's source code is intermixed with much of the rest of the Windows OS. Testing every interface isn't enough to show that a new version is working right... you'd have to go through every line of code and see how it might possibly perturb Windows itself.
Compared to component-interface testing, that's a prohitably lengthy task; a combinatorical explosion of places to check.
no Kate working no editors
Again, Kate is one component, and testing that component's agreement with each of its public interfaces should be enough to verify there are no critical bugs. That only works if the components are well-separated enough. But separation leads to slowness, and Microsoft wants to be fast.
Re:Incident response times (Score:3, Interesting)
Re:Incident response times (Score:5, Interesting)
Have you seen what happens to people who report security issues to MS? Follow the full-disclosure and bugtraq lists sometime; you will be astounded. MS repeatedly ignores reports until there is an exploit. They have gone so far as to lock hotmail accounts of people reporting issues.
They have repeatedly demonstrated a knee jerk reaction to deny problems until they're public, at which point they announce that they've been working been on it all along.
Honestly, with their resources, they could give Linux a serious run on patch speed, but only if they change their mindset first.
Re:Incident response times (Score:4, Informative)
If they are, then I can see why researchers aren't playing their silly game, especially if they discover several bugs. Further, Microsoft is giving up a small advantage they could have over open source. If they allowed non-public reporting of security bugs, then they could have that information before the crackers get it, while open source bugs are generally reported to open developer lists.
Re:Incident response times (Score:3, Interesting)
I really wish someone had done a study, or that there was data somewhere to back that up. Sure, we've got a buttload of anecdotal evidence, but has anyone ever done a study of "average time to fix an exploit once discovered" by Proprietary Vendor versus Open Source?
Such a study would be MOST enlightening.
And greatly help some of us win arguments
it wouldn't change anything (Score:5, Insightful)
P.S. Is it news anymore that IE has holes?
Re:it wouldn't change anything (Score:5, Insightful)
You may be right, but it still doesn't change anything. I think this guy should have told Microsoft first, waited, if they don't respond within 48 hours, report it.
If you get a standard stupid automated copy/paste reply, report the holes.... but you SHOULD give the company some notice. As stated in the article, not giving the company any info just makes it bad for anyone having to use IE.
Is it news anymore that IE has holes?
Nope. Seriously, who here gives a crap about IE holes? Everyone here probably knows that using IE is about as secure as getting water in a fishingnet.
Re:it wouldn't change anything (Score:5, Interesting)
I believe the current "best practice" is to wait at least 1 week for the vendor to initially respond... and to give them at least 1 month to create a patch if they (privately) acknowledge the problem.
But giving them ZERO hours is about as bad as it gets.
Re:it wouldn't change anything (Score:5, Informative)
Re:it wouldn't change anything (Score:5, Interesting)
Consider that people use IE because "it's there," and not generally for any other reason. These people are going to continue to do so until the consequences are too high. Really, the same should apply to corporations too. The more often they get bent over, and the rougher those encounters are, the more the point gets "driven" home...I've been on a campaign lately trying to get people to switch from IE. I've been pushing Netscape 7.x instead of Mozilla though, as I find explaining the difference is tedious to say the least. I'd prefer if they used the AOL-brand free version, but Netscape is better than nothing.
Really, this should go for all MS products with shoddy track records. Any time you have to explain why "the computer was infected with another virus, even though you had AntiVirus software," be very _blunt_ about the reasons. Internet Explorer was designed to kill Netscape, not be secure..."Yes, you're virus signatures were up-to-date (not likely), and you still got a virus." That's because MS knew about the problem 3 months ago but it wasn't made public so they didn't fix it. It's not Norton/McAfee's fault. This virus didn't exist until yesterday...
Now, I'm not saying I think every use should immediately switch to Linux, but I do recommend Mac OS X quite often. I know that nothing is perfect, but it's time people started using _anything_ other than Windows and IE. Don't hide the flaws of the other systems. Yes, Mac OS X did have a problem recently. Nothing is perfect. Most things just happen to be more perfect than Windows and IE.
-Ben
Re:it wouldn't change anything (Score:5, Insightful)
At the end, we did not bother. After a few more months, it was made public (not by my friend though). Nowadays, reporting MS bug becomes a dangerous maneouver... If MS is really serious about security and good quality software, they would put a contact on the front page and offer reward for anyone who spots a new major bug. Before then, I don't see why we need to be nice to MS.... They say they are capitalist. We should respect their value and don't do any free work for them...
It's hardly bad... (Score:5, Insightful)
Sure, a lot of people don't like Microsoft, but that's no reason to make it worse for the millions of people who are forced to use Microsoft products, especially for security holes which have yet to be exploited.
If OSS people can fix the bugs in less than half a day, it should be a piece of cake for a giant software company with lots of programmers to do the same. Sure, a days warning would have been nice, but if there isn't a fix by tonight, it only shows badly on Microsoft.
Re:It's hardly bad... (Score:2, Funny)
At least do it on a Monday thru Thursday.
Re:It's hardly bad... (Score:5, Insightful)
Bug? (Score:3, Insightful)
Which, to the end user, is the exact same thing.
Re:It's hardly bad... (Score:3, Interesting)
Certainly, he's right, IN THEORY. However, the truth is that people come to RELY ON undocumented behavior in Microsoft APIs. When you do something under the hood that changes one undocumented behavior to another, you stand a chance of breaking things that a programmer wrote, intending to take advantage of that undocumented behavior.
Sure, you can blame the 3rd party programmer for trying to use an undocumented behavior.
But
Re:It's hardly bad... (Score:3, Insightful)
Problem with Microsoft fixes is that they sometimes break other things. That's what the parent was complaining about. A pat
Re:It's hardly bad... (Score:3, Informative)
That's ridiculous. No decent OS should allow itself to ever be crashed by any application software.
Re-read the parent's post. He's not talking about Microsoft having to do workarounds for bad apps to prevent Windows from crashing. The workarounds are to prevent the bad 3rd party app from crashing.
For example, many apps written for Win9x had tons of flaws with heap overflows, double-freeing pointers, dangling pointers, etc., but the developers "lucked out" and their apps didn't crash. However, when y
New Rival to Internet Explorer... (Score:5, Funny)
A spokesman was quoted as saying, "It's the only way we can release a product with more holes than IE".
It is unconfirmed if StringVest will be integrated into Windows XP SP2 or if we will have to wait until LongHorn is released.
I've been trying my best to switch people away (Score:5, Interesting)
Re:I've been trying my best to switch people away (Score:4, Insightful)
I use Mozilla Firebird [mozilla.org], myself, and like you, I've tried to encourage my friends to switch. ;-)
Doesn't help much when I'm forced to use a university workstation (like today), but I find it's a better quality browser than IE. Renders faster, blocks pop-ups, and I find tabbed browsing to be pretty much invaluable.
Of course, the best thing about Firebird is, I can still watch Doctor Who: Scream of the Shalka [bbc.co.uk]
There are, of course, some times when you have to use IE (like Windows Update, though I guess I could always just download each update manually).
The big problem I've hit is that, even with all these MSIE vulnerabilities that come out on a near-weekly basis - not to mention annoying pop-ups and pop-unders, and other little security-related issues - I don't seem to have any success.
So what's your persuasive technique for getting people onto pre-1.0, non-MS, reliable-but-not-100%-complete software?
Re:I've been trying my best to switch people away (Score:3, Interesting)
Everyone is shocked that these programs are not designed to do them a favor. They're di
Re:I've been trying my best to switch people away (Score:3, Funny)
Re:I've been trying my best to switch people away (Score:3, Insightful)
I don't think intellectual dishonesty is the right way to get people to switch.
Comment removed (Score:5, Interesting)
blablabla (Score:5, Insightful)
Believe me, in these days that is the only way to report bugs AND making sure they'll get fixed.
Dream world scenario:
1) Report bug to company
2) Company will announce the bug to the public
3) Company will fix the bug as soon as possible
Real World scenario 1:
1) Report bug to company
2) They don't report it to the public and they don't fix it
3) You report it to the public
4) Company sues you for IP violation or any other shit they can pull out of their asses
Real World scenario 2:
1) Report it to the public (anonymously).
2) Company will fix it
Re:blablabla (Score:2)
1) Report it to the company (anonymously).
2) See if they fix it.
3) If they don't fix it within X days, report it to the public (anonymously).
Immediate full disclosure is best security practic (Score:5, Insightful)
The "give us time to fix the hole/do a P.R. coverup" fiasco is WHY I DON'T USE MICROSOFT SOFTWARE ANYMORE.
Re:Immediate full disclosure is best security prac (Score:5, Insightful)
Prove it. Anything that can be found by a white/gray hat can be found or was already found by a black hat.
Re:Immediate full disclosure is best security prac (Score:3, Interesting)
Undoubtedly, you would look upon the history of the last few years, where virtually all attacks (manual and automated in virus/worm code) have exploited known bugs for which patches had been available for weeks or months, and say "that's not PROOF".
And in a mathematical sense, that would indeed not be "proof".
The best anyone can offer you is a "preponderance of the evidence", which might even be "
Topic was briefly discussed at NTBugTraq (Score:5, Informative)
I think MS has the responsibility to address their customers concerns immediatelly (naive, I know), especially IE's overly close integration with the OS which causes most of these exploits.
Addendum (Score:4, Informative)
Disable Active Scripting and find an alternative to IE ("use another product"). Not very realistic unfortunately, when companies have invested so much in integrating (and accepting) some of the flawed functionality in IE.
I do find that people are starting to be a lot more receptive towards MS-alternatives, especially when the mass media is now jumping on the bandwagon as well. Now techies find themselves explaining their choice of MS over and over again, to hype-induced managers.
Re:Addendum (Score:5, Insightful)
Are you talking about internet companies or companies using IE for their intranet apps? If a company is using IE-specific functionality to offer services over the internet, they deserve to get bitten periodically. I have no sympathy for any company that provides a service to the "public" but forces them to use one specific browser.
On the other hand, it is quite common to use IE-specific functionality for intranet applications. That's not a problem, one assumes that the intranet server is safe. The solution is to continue to use IE for intranet (and remove all links to internet sites from intranet apps), but use a more secure product to access the internet.
Just downloaded the IE patches (Score:4, Interesting)
Forced? (Score:5, Interesting)
I'm not forced to use Windows - I use it by choice. So does everyone else I know who uses Windows. As you may know, there is a viable alternative to Windows: OS X.
Oh wait, actually at my last job I was forced to use Windows. When the company purchased a new computer for me (I'm a software developer) I requested an Apple but was turned down. They didn't want to spend the money and didn't want to deal with integration on the network. I doubt the number of people being "forced" to use Windows numbers in the millions though. Besides, there was a benefit to the Windows box that the company certainly never intended - a wider variety of LAN games to play head-to-head against my office mate.
Re:Forced? (Score:3, Informative)
1) There are virtually no "integration" issues between Mac OS X and Windows. OS X supportes Samba out of the box.
2) I thought most companies frowned upon games on company computers , on company time ?
Re:Forced? (Score:5, Insightful)
I know I am forced to use windows at work, even though either a Mac or any Unix Desktop would do.
I ditch IE whenever I can, but for example our HR Website and anything else RELIES on Windows, no way around it.
mom's not sucked into ie anymore (Score:5, Interesting)
maybe it's stuff like this that we need, and more people should get their families exposed to it...
momentum, people, momentum.
Public mailing list? (Score:5, Insightful)
Thats because Microsoft's past record is to ignore people who have contacted them privately regarding security issues, or take legal action against them.
If you really wanted something fixed by MS, and the last 15 times you'd contacted them they'd ignored you, but you've seen someone else release information into the wild and get MS's attention re: a fix within hours... WWYD?
haha (Score:4, Insightful)
Having tried a few of these (Score:5, Interesting)
At least he reported it to someone!!! (Score:3, Insightful)
Mozilla! (Score:2, Insightful)
I can understand complaining about being forced to use Windows. However, no one is "forced" to use Internet Explorer, even on Windows---Mozilla is a better alternative in Windows.
Most of my family and co-workers use Mozilla, and they haven't looked back.
Forced to use IE? (Score:5, Insightful)
Mozilla (or Phoenix) is a slick alternative with an almost zero learning curve to pick up the same level as IE. It also takes almost no time to learn features _that aren't in IE anyway_ that help you see the internet in a much more useful way (ad blocking etc).
No one is forced to use IE with very few exceptions:
People who have it mandated at work, but that's work's problem not yours - they could change too.
People on dialup who have a very slow net connection - but they probably have it on a dial up CD.
People who use it's integrated rendering engine for OE/HTML email - but you can change that easily too.
People who _must_ access IE only websites - but there are very few of these any more, and you can always use IE just for these to lower your exposure.
Microsoft Zelots who refuse to believe that Free software can be any good - but they deserve everything they get.
yes, forced, ESCAPE NOW. (Score:3, Informative)
Not true, Microsoft makes it very difficult to use anything but Microsoft junk. The first level of anoyance is a barage of scary warning messages about "signed code". Then there are constant anoyance messages which require confirmation and include the option you don't want. In time, you will push the wrong button. Finally, Microsoft breaks other programs on their platform. My little brother uses XP and keeps it "up to date" by accepting whatever M$ p
using Mozilla is not a cure all (Score:5, Informative)
So the fact that I'm using Mozilla on Win 98 right now, doe not mean I'm guarenteed immunity from these new holes.
Sometimes it's all about timing (Score:5, Insightful)
What makes it worse is the timing, over a holiday weekend (States side), where most systems staff will be unable to apply patches or mitigate risks.
Now this is an Internet Explorer exploit, hence, few people using IE at work over the weekend. It still provides 48 hours for a few unsavory individuals to develop exploits for Monday morning.
We need to exercise better judgement when dealing with vendors and security issues, this isn't the first time things like this have happened, and won't be the last.
Perhaps we should consider spending more effort creating a Security Researchers Organization as has been discussed on BugTraq [securityfocus.com].
Until we have a strong unified organization I believe we will continue to see unresponsive vendors and poorly timed vulnerability releases.
Re:Sometimes it's all about timing (Score:4, Interesting)
http://www.safecenter.net/UMBRELLAWEBV4/ie_unpatch ed/ [safecenter.net]
There used to be a bigger list at: http://www.pivx.com/larholm/unpatched/ but hey MS didn't do anything about it.
So might as well just report it directly to the public and skip all the MS BS.
In other news... (Score:2)
In other news
actually, this is old (Score:5, Informative)
Re:actually, this is old (Score:4, Interesting)
That is why I don't understand what all the hoopin' and hollerin' is all about. Microsoft has known about this for quite some time. In addition, two months ago when the demonstration/exploit was make publicly available the author clearly stated that one of the exploit techniques had been documented for over 2 years.
I'm curious for those here who think this should have been reported to MS first, please post the email addr or website where one would report this -- that would be a public service. I dont have a lot of faith they would have acted even if told -- but for future reference.
Microsoft is being forced to eat their dogfood... (Score:4, Informative)
Microsoft has claimed time and again that their response times to security alerts are sterling, as opposed to the "slow" response times for OSS. They make these claims without telling consumers that they have known about the exploit for months and are publicly releasing knowledge right before they release the fix.
This is a case of people letting Microsoft's boastful ways catch up to it. If they are as fast as they have claimed, time and again, there won't be a problem for those people who are diligent in patching.
Additionally with the advent of companies using the DMCA to try and stifle this behavior, it is more important than ever to engage in it and further show the flaws with this absolutely off the wall piece of legislation. See this [slashdot.org] article.
What I don't understand... (Score:5, Interesting)
What irks me is that MS did not discover these themselves. After all, the closed source, security by obscurity, we can do it all ourselves model of software development is so superior, that we can only draw one of two conclusions. Either their superior technicians found the problems already, but the management decided not to put in the resources to fix it, or their superior technicians did not find the bug, in which case they need to not only fix the problem, but understand why their process so routinely fails.
This is not an issue of hating MS, any more than the other recent alert was an issue of hating Apple. It is an issue of knowing there is a problem out there, but having no power in the official process to correct the problem. The only power the might be had is that of public relations. This is very different from OSS, in which one can potentially affect the development process and at least see that something is being done.
This whole issue of course assumes that dozens of other people have not already found the bug and are exploiting it on small scales not easily detectible by the common methods. And of course does not take into account the ability for people to switch browsers. Just imagine how many lives would have been saved if people had been fully aware of the incompetent design of the Explorer and bought other cars instead.
Re:What I don't understand... (Score:3, Insightful)
Truly. Makes one wonder if there are internal memos in M$ that warn of the possible mayhem in IE and are swept under the rug like the Explorer chassis problems in Ford motor...
Oh, and for bonus points, both products are "Explorers" ;)
No Notification (Score:3, Insightful)
There is no requirement to notify Microsoft, nor should there be. I want to know about this kind of stuff as soon as possible. In my opinion, it is not for Microsoft to determine when I know that my computer has a security problem.
Besides, this kind of thing should show if Microsoft's boasting about response time to security vulnerabilities is the truth or just plain old anti-open source FUD.
Eating your own dog food (Score:3, Interesting)
When will Microsoft go to court for all of this crap? Can you imagine purchasing a new car and seeing a note on the seat. You open the door of your new car and read the note. It says that the auto maker has no responsibility to how the car works or if it will work.... The auto makers can't pull the kind of EUL that Microsoft gets away with. Yet no lawsuits. What gives?
LoB
"Forced to use Microsoft products" ? (Score:5, Insightful)
Even when you need to work on Windows, why should you be _forced_ to use Internet Exploder?
Mozilla is the first thing I always install on Windows.
There are organizations where people are indeed forced to use a fixed set of software. In this case, if there's a security hole, the responsability belongs to the sysadmin who forced people to use broken and out of date software.
I can imagine not giving info to MS (Score:5, Interesting)
Also I find that MS is so bold and arrogant to ask money for everything and tells others to stop doing things for nothing...
Let them pay for the info on security problems...
No payment, no bug reports, period.
They can take care of themselfs? ok let them solve their own problems...
Microsoft makes money on their software... (Score:3, Insightful)
If they want us to test their stuff then they should pay us to do it; rather than charging us for the privelege of testing their stuff.
Perhaps the Microsoft spokesman is lying (Score:5, Informative)
What was released recently was sample exploit code.
If you are a Microsoft spokesman then, of course, you have to say that, "Hey, if we don't have a fix then it must mean we didn't know about it." So it's not even lying to say that you weren't told. It's the only logical thing.
The spokesman was not aware that Microsoft had released unmarked patches [ntbugtraq.com] for some of the problems.
disclosure (Score:5, Interesting)
Guess you would've preferred that he either:
a) keep it to himself and use it to root your box
b) tell M$ about it, who will as usual drag it out for a few months before even acknowledging that he found a problem.
If you were reading any of the security mailing lists, you'd know that the general experience researchers have with M$ is that it's a big waste of your unpaid time to contact them.
Frankly, if they neither pay you nor treat you with some courtesy, then why exactly should you bother?
Its all about netrep (Score:5, Insightful)
Truth. But here's the problem. Microsoft's reputation for responsiveness (that is, not!) and collegiality (that is, not!) in these situations is awful. Nor does Microsoft treat those who report such problems with any degree of warmth. Having established its Chinese wall as it has, Microsoft has lost its standing to whine about non-collegiality of the world it has created.
This is the entire point about open systems, or at least openness about security -- it leverages what happens out there. Frankly, I feel more secure knowing what are the leaks, whether they are addressed or not, than I do knowing there are secret leaks out there for someone to exploit without my knowledge.
If Microsoft had a reputation: (i) for assuring that a report of a leak would be responsibly handled and escalated promptly and without agonizing pain on the part of the reporter -- who is doing Microsoft a favor; and (ii) for responsibly, promptly and professionally addressing the problem, I would feel much more sympathetic.
The problem is that they don't. Maybe they will change as they said they would. But until they do, I'd rather hear the news in time to know for what I have to watch out than to have it buried while others who have discovered the leak exploit it.
Here's the thing, it is highly unlikely that any leak that is discovered by me was discovered only by me. Others, less responsible than I, will disover a leak, find the exploit, and either keep it in their "bag of tricks," trade it or what have you. In any case, if I find it, the exploit is likely out there in someone else's hands. I'd rather know the problem than wait for the solution.
Yes, the kiddies are more likely to play if it is readily "out there." But guys, that happens anyway, one way or the other. Beside, Microsoft seems far more responsive to public leaks than private ones -- maybe this kind of report is more likely to assure that the bug will be repaired than otherwise.
And you spend much less time on hold . . .
Truly innovative thinking at Microsoft (Score:5, Funny)
Programmer 2: "I've got an idea! My CS prof used to joke that you could solve any problem by adding one more layer of abstraction. In this case, it's true. Imagine how totally cool it would be if IE was just a regular application. Right now we've got it tangled up in the OS, but if you think about it, there's really no good reason for that. I mean, why does IE need special priviledges just to load files and render some HTML? If we pull it out of the OS, it'll still work fine, and it'll just naturally be subject to all the OS-level protection mechanisms we've got."
Programmer 1: "What?! You're talking madness, man! Are you saying that we should subject one of our own applications to the same forces we use to prevent third parties from gaining too much market share? Egads, that's brilliant! I'll bet we can even patent that..."
Programmer 3: "Guys, the idea certainly sounds cool, but it won't work. Bill said it's impossible. Don't you remember that Netscape trial thing? I know we're not supposed to ever talk about it, but he said it was impossible during his taped deposition. If Bill says it's impossible..."
Programmer 2: "...then it must be impossible. You're right."
Porgrammer 1: "Damn, you're right. Seemed like such a good idea."
IE users are sheep and deserve whatever they get (Score:3, Interesting)
Those stupid enough to continue using that piece of garbage or any other microsoft software for "secure" applications, are getting it up the ass exactly like they asked for. The only people I see with desktops infested with bonzo and popups and spyware are retarded IE sheep anyway. The comments from the poster of the article just make me laugh. Security from obscurity isn't! The more exploits the better, the sooner people will be forced to switch.
Go open source, go with glass box solutions.
There's absolutely no reason to continue using IE, it's not as if you have to visit the few websites refusing service to other browsers. Refusal of service to other browsers only indicates incompetence - who'd make business with such a company anyway?
What gets to me (Score:4, Insightful)
The part about this story that gets to me is that a single person finds 7 (!) holes/exploits by himself. Makes one wonder just how many things are left open simply because no one has looked at them yet. Scary.
Apples to Apples; This is an Orange (Score:3, Interesting)
He *is* from China, the country who is so frustrated by Microsoft that it's making its own, full-scale flavor of Linux. The country who may see most of the Western, MS-using world as a competitor. A country so big yet secretive that security practices may be subtly different over there.
Disappointed? Sure, you can be disappointed in how this went down. Though it may be an apple judging an orange.
Surprised? I don't think you have the right to be surprised.
RD
Why notify the company first? (Score:3, Interesting)
That was my initial reaction too, but then I asked myself why? Why must the manufacturer be notified first? All Linux expolits are announced publically aren't they? Or am I mistaken? If defects in Linux can be made public and fixed quickly, why can't commercial software be done the same way?
To be fair (Score:4, Insightful)
Bug was TWO YEARS old (Score:5, Interesting)
Running Down The Veulnerabilities (Score:4, Insightful)
My Classification: Minor
This isn't all that serious. The major threat is that a hacker could get your cache directory. The downloaded web page runs as part of the "internet" zone, meaning that there is no privelage elevation (IE has a zone system to give different pages different privelages).
"LocalZoneInCache"
Moderate/Severe
This is more serious. It allows an attacker to modify files on the system or worse. Note that this *is not* the same as a root exploit, but it could be as damaging as running an executable. Note that the user *does* have to choose "open" in the download dialog, but they are not warned about the security risks and may not consider them as the file extention is ".htm".
"MHTML Redirection Leads to Downloading EXE and Executing - Remote Compromise(requiring MYCOMPUTER zone)"
Moderate
This is somewhat less severe. It allows an attacker to download and execute an executable, but only if the user has already downloaded the page, saved it to disk, and executed it. The user might assume (incorrectly) that the file is safe.
"MHTML Redirection leads to local file parsing in INTERNET zone"
Severe (If an issue)
I was not able to reproduce results with this veulnerability (IE6 SP1). Please comment if you can reproduce it. If it is indeed true, it would allow an attacker to parse the contents of a local file. They would need the absolute path. This could be used to discover potentially private information.
"HijackClickV2 - Adding a Link to Favoriate List(requiring clicking a link)"
Minor
This would allow an attacker to add their site to favorites. The user would have to click a link and would have to release their mouse button over the favorites list (which is placed under their cursor after clicking the link).
"execdror6"
Severe (if issue)
I was not able to reproduce results with this veulnerability (IE6 SP1). Please comment if you can reproduce it. If it is indeed true, it would allow an attacker to run an executable on the user's system. The user would have to click "open" on an HTML file download. Security warnings would not be displayed.
"BackToFramedJpu - Cross-zone scripting(requiring a subframe in victim page)"
Moderate
This could allow an attacker to execute code in another security zone. It could potentially be used to execute code in the "my computer" zone if the attacker knows the location of a local page with frames.
I'll comment on the rest later.
Re:Unbelievable Arrogance (Score:5, Insightful)
People at work who have to use Windows because it's work mandated.
Their's millions of those type of people...
Re:This has gone on long enough! (Score:4, Funny)
Actually, it wasn't a choice. MS had a monopoly, and therefore, you really had no choice.
Re:This has gone on long enough! (Score:4, Funny)
So you do admit that Windows users are not free in their choice?!
wow, that's moving. (Score:3)
It's more like a blue screen of death after innumerable pop-up anoyances. Oh, the thrill of crap that does not work. Wooot. If that turns you on, you must be on Bill Gate's payroll. I prefer to get things done.
Re:This has gone on long enough! (Score:3, Insightful)
Why do yo
Re:er... (Score:3, Insightful)