New IE Bug Hides Real Site Address

Norman at Davis writes "ZDNet is running a story on a new security flaw in Microsoft's Internet Explorer which could let hackers use a technique to display a false Web address on a fake site according to an advisory from the Danish security company Secunia. The Danes report that 'the vulnerability is caused due to an input validation error, which can be exploited by including the "%01" URL encoded representation after the username and right before the "@" character in an URL.' PC World reports that 'Microsoft says it is investigating reports of the vulnerability. When that inquiry is complete, the company will take whatever steps it deems necessary, such as issuing a new patch, a spokesperson says.' And for good measure, here's what Google news is covering on it right now."

This bodes ill

[panxerox]

for paypal where there are so many redirect scams.

Re:This bodes ill

[glpierce]

...and Slashdot, where there are so many people trying to get you to look at goatse

Re:This bodes ill

[Bobulusman]

Actually, although someone will probably prove me wrong, you couldn't do this with a slashdot link. You have to use the unescape command, and I don't see a way to do that with the allowed HTML.

I'm sure it's main 'use' will be HTML e-mails which lead consumers to fake ebay and paypal sites.

Re:This bodes ill

[metlin]

You're correct.

I even tried various combinations, including a javascript: in the href tag and it did not work -

<a href="javascript:location.href=unescape('http://ww [e-mail]/security/ex01 /vun2.htm')">test</a>

Not as bad as it could be. Atleast not yet.

Re:This bodes ill

[GaelenBurns]

As if anyone actually *trusts* their DNS server. HA!

Re:This bodes ill

[doon]

Like the avg user that falls for the paypal scam knows what a dns server is. Most people believe/trust everything they read in e-mail as long as the "from" address looks right or it looks official. This one might be rough since it might catch the "smarter" users that at least look at the address bar. Hopefully they will realize that it isn't under ssl, and there is now cert, so that they shouldn't do anything, but I am not holding my breath.

Re:This bodes ill

[PyromanFO]

Man and people say Slashdot users don't have a sense of humor .... oh wait.

Re:Cert?

[Derek Pomery]

Like it would be so hard for a group with dubious credentials to acquire a cert. Browsers don't prompt usually so long as the cert is up to date, and from an official cert authority.
Who's going to inspect and notice it wasn't issued to the right corporation?
Well, hopefully any paranoid IE user, for now.

Re:This bodes ill

[rifter]

for paypal where there are so many redirect scams.

You're telling me, buddy. Unfortunately Microsoft is not aware that this occurs at all, ever. This is a good example of how unaware they are in general. Meanwhile...

Microsoft did not set a timetable for its investigation, but said it may eventually release a patch to address the problem. Meanwhile, the company recommended that people follow basic security procedures, including the use of firewalls, software updates and antivirus software.

So I should use firewalls and antivirus software. Riiiight. Doesn't address this vulnerability in the slightest. How about I don't use MS software for business-critical financial transactions. Especially since they "may" release a patch. Someday. Like they did for the 1001 other vulnerabilities they did not wnat reported.

Microsoft faulted security mavens for publicizing the flaw, implying that they hadn't given Microsoft sufficient time to craft a patch.

"Microsoft is concerned that this new report of a vulnerability in Internet Explorer was not disclosed responsibly, potentially putting computer users at risk," the statement reads. "We believe the commonly accepted practice of reporting vulnerabilities directly to a vendor serves everyone's best interests, by helping to ensure that customers receive comprehensive, high-quality patches for security vulnerabilities with no exposure to malicious attackers while the patch is being developed."

So customers should not be warned that they might be fooled into giving their money to thieves/terrorists because it might embarrass Microsoft. That is irresponsible in itself. Besides Microsoft does not fix vulnerabilities unless they are widely publicized enough that CNN is reporting them and CEOs understand them. Again the only responsible thing to do is to advocate Mozilla for financial transactions.

Supply a link, this article says IE only.

[blazerw11]

This article [securityfocus.com] at securityfocus says IE 6 and possibly earlier versions of IE. No Mozilla, Netscape, Opera, Links, Safari, Konq, Firebird, etc.

Doesn't affect my version of Mozilla

[sacrilicious]

Would be nice to have listed which versions were stated to be affected. I have just tested:

• Win IE 6.0
• Mac IE 1.5
• Win Mozilla 1.4.1
• Mac Mozilla 1.4

The only one affected was Win IE.

If any Mozilla versions later than 1.4.1 were to be affected, I'm willing to bet the Mozilla release would be patched within a day, whereas Microsoft would take a minimum of two weeks and a max of maybe never.

Firebird fails in the status bar, sort of

[burgburgburg]

Firebird 0.7 DOES show the spoofed address in the status bar, but with an odd character after the URL. However, it shows the real, spoofed URL in the address bar.

Not patching this month......

[dew-genen-ny]

Nice. Wonder if they're going to break their word again and distribute yet another patch during december.

Still this seems like a major flaw - For the last 3 months I've been recommending to all my friends and family to start using Mozilla. Not saying it's perfect but there's a lot less flaws than IE.

Re:Not patching this month......

[Pelorat]

Actually, if they're going to break promises, that's a good one to start with.

Re:Not patching this month......

[Anml4ixoye]

The problem is that it looks like it affects them all.

If I understand what they are saying, if you put a %01 before the @ symbol then the address bar will display one address while going to a different one. Guess what, so does just putting the @ symbol

http://[e-mail]

I'm still not really sure what the problem is. Even if the bug removed the @slashdot.org, it just means that those of us that actually pay attention to the address bar might get fooled. Most people don't pay any attention to

Re:Not patching this month......

[jdreed1024]

The problem is that it looks like it affects them all.

If I understand what they are saying, if you put a %01 before the @ symbol then the address bar will display one address while going to a different one. Guess what, so does just putting the @ symbol

http://[e-mail]

No, no, you're missing the point. Yes, that URL you mentioned will take you to slashdot and not zdnet, fine. But you'll see it in the location bar and know it's a fake. However, with this exploit, if you put a URL encoded ASCII "NUL" (%00) or "SOH" (%01) in the URL, the location bar will not display the @symbol or anything after it. Thus:

http://[e-mail]/0wn-j00.h tml

will take people to the "0wn-j00.html" page on 0wnz0red.com, however the location bar will only display:

http://www.yahoo.com

Assuming 0wnz0red.com is a well-done forgery, even the most clueful geek would have a really, really, really, hard time telling that he's at anything but yahoo.com. (yeah, yeah, netstat and firewalls and all that, but that's not the point)

And before you all say it's only %01, it's not - it's %00 as well as %01. Go read the secunia link.

Re:Not patching this month......

[Anonymous Coward]

These are 2 distinct and different bugs.

"%00" will hide the link in the tooltip and the status bar on both Mozilla and IE. Although Mozilla will correctly display the entire link in the link properties where IE only displays up to the "%00" here also.

"%01" will not hide the link in the tooltip or the status bar in either Mozilla or IE, but it will make the location bar only show up to the "%01" in IE after you click on the link.

HowTo Exploit

[Anonymous Coward]

Here is a one-stop guide to exploting this.

Create a local document:

<html><body>
<script language="javascript">
document.write(unescape('h ttp://[e-mail]'));
</scrip t>
</body></html>

Note that thanks to Slashdot the code is munged. Remember to remove the extra-Slashdot-added spaces.

Open this up in Internet Explorer and you'll see the text, with the "%01" character helpfully encoded into the string for you. Copy this string into another document:

<html><body>
<a href="http://[e-mail]">Google< /a>
</body></html>

Note that in this example, the encoded "%01" has been stripped out by Slashdot. Your copy & pasted string will include this character (It may appear as an empty "Box" symbol)

Save & open the file in Internet Explorer. Surprise!

But wait! There's more! If the user hovers over the link they'll see a funny looking URL in the status bar. We can fix that, though. Edit your file and add the "%00" to that URL E.g.

<html><body>
<a href="http://[e-mail]">Goog le</a>
</body></html>

Again, the encoded "%01" has been stripped by Slashdot. Ensure that you add the "%00" after the encoded "%01" or this won't work. Now save the file again, and re-open it in IE. Now where does that link go?

Feeling lucky, punk?

MOD PARENT UP

[crayz]

Hollllly shit. MS needs to patch this like...two weeks ago.

Someone is going to make a lot of money with this. For an example of this in action(harmlessly):

http://crayz.dyndns.org/test.html [dyndns.org]

Results of the exploit in different browsers

[CowboyMeal]

The problem is that it looks like it affects them all.

That is not the case, if it was, it would be a design flaw in html. This is just a case of different handling of an error condition.

I saw a post somewhere that said that the vulnerability works with either a ascii 1 or an ascii 0 character before the "@".

Here are 2 exploit pages that I just created, that just have a link to http://slashdot.org @goatse.cx.

ASCII 0 [rit.edu]
ASCII 1 [rit.edu]

(Below are the browsers I just happen to have installed)

IE6 for windows (for

Re:Not patching this month......

[Anml4ixoye]

Is this going to break anything useful?

Yes, things like FTP logins rely on that. URLs are subsets of URIs which have a lot more useful things.

For example, if you need to go to a FTP site that has a login, you can type in your address bar:

ftp://user:[e-mail]

That will automatically log you in with your user name and password. You could also do just:

[e-mail]

And it will prompt you for your password

Re:Not patching this month......

[leifm]

I'd recommend Firebird over Mozilla. While I still like Moz a lot I've started using Firebird 98% of the time, it integrates with Windows a bit better, it's faster, and the interface is simplier. And over the last year to year and a half almost every site seems to render correctly with Gecko based browsers, leaving only Windows Update and other ActiveX dependent sites needing IE. IE was a good browser in it's day, but MS has let it stagnate pretty much since 4.0. They're going to have to do more than just add pop-ip blocking for me to use it with any regularity again.

Re:Not patching this month......

[leifm]

the 0.7 milestone, or a nightly? I generally use nightly builds, and occasionaly there is something broken in them, like a few weeks back my banking site would go back to the login page after I logged in, updated to that day's nightly and all was well. I'm also using the Windows version, so I suppose there could be issues with the Linux one that I don't see. I don't have any issues with Slashdot, the only site that gives me issues consistently is Gamespot.

Re:Not patching this month......

[youngerpants]

I use windows a lot; Linux makes a great server and I use it as such, but in all reality, MS make a good desktop OS for the home user.

OK, back onto topic. Yes, MS said they wouldnt [need to] release any patches this month. So what. If a vuln has been realised, I would rather they sent the patch out than try to keep their word. This is actually a pretty serious vuln (as mentioned above, paypal scams'll love it) and the sooner its patched, the better

Link to POC test

[Anonymous Coward]

http://www.zapthedingbat.com/security/ex01/vun1.ht m [zapthedingbat.com]

See also

[lamery]

http://www.microsoft.com/ie_advisory@%01goatse.cx

Re:See also

[karevoll]

The %01 part should come _before_ the @... and no, it is not just as simple as this... the url must also be unescaped..

See Here [DevGuru] [devguru.com] if you don't know what to 'unescape' means...

(Yes, this means that it will be difficult pulling this one off over i.e IRC, where special characters don't necessarily show up on other peoples terminals)

Re:

[account_deleted]

Comment removed based on user account deletion

That would explain a lot

[Anonymous Coward]

All that bizarre crap on the SCO website must actually be The Onion playing games...?

The example misuse

[trystanu]

Is pretty compelling (spoofs Microsoft.com):

http://www.zapthedingbat.com/security/ex01/vun1.ht m

Re:The example misuse

[trystanu]

Or even (with a marked up URL):

http://www.zapthedingbat.com/security/ex01/vun1.ht m [zapthedingbat.com]

Re:The example misuse

[erasmus_]

Thanks, that definitely illustrates the problem. It looks like the URL in right-click > Properties does not have the same issue, and does display both the bad character and the rest of the URL. I'll be sure to be confirming addresses of important sites until a patch is released using this method.

Re:The example misuse

[dema]

In case anyone is wondering, this doesn't appear to affect IE on mac. When I click the test exploit link on http://www.zapthedingbat.com/security/ex01/vun1.ht m [zapthedingbat.com] it simply turns into http://[e-mail]/secu rity/ex01/vun2.htm

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:That isn't much better though!

[Finuvir]

It would be possible (trivial?) to put a feature in our favourite open source browser to give a security warning when you visit such a URL. Just something that tells you about the possibility that you're at a site different to the one you think you're at. It would just need to ensure that the actual domain is made obvious. eg.

The site you are visiting may be attempting to masquerade as a different site. The site actualDomain.com appears to be masquerading as apparentDomain.com.

Visit the real apparentDomain.com (link)

[ ] Don't show this warning in future. (checkbox)

You would just need to search for 'www.' or one of the TLDs in the part of the URL before the @ sign.

Re:

[account_deleted]

Comment removed based on user account deletion

Word from the Microsoft Information Minister

[JavaSavant]

There is no bug, and there will be no patches in December! We will reveal the vulnerabilities of the infidels and they shall tower over our own!

I don't really get them sometimes, honestly. Is this sort of like their being a SARS outbreak in New York and the CDC saying that they won't look into it for a month?

Re:Word from the Microsoft Information Minister

[mirko]

Yep, and there was no spoon either.

A demonstration

[karevoll]

Click here [ZapTheDingBat.com] [zapthedingbat.com] to see an example of how it is done...

Opera and Mozilla (at least firebird) handles it properly :-)

Re:A demonstration

[baldass_newbie]

But I can't get it to work in Mozilla.
So how do I know it's real?

Re:A demonstration

[joebagodonuts]

I use Firebird and I couldn't figure out why I was unable to re-create the issue. Finally I realized "I'm not using IE"

I need more coffee ;-)

Re:A demonstration

[darkstar949]

I'm at work which uses IE6 ~ ugh.
The demonstration works here.

The patch they should issue!

[rknop]

Why not just pull IE from the market altogether and tell everybody to download Mozilla and get on with their lives?

Not only would all the IE security problems be gone (in favor of Mozilla security problems, granted, but I suspect those would be more tractable), but we'd also finally have everybody using a browser that actually supported web standards! (Yeah, IE is pretty close nowadays, but I found out recently that simple Java 1.4 applet embedding just won't work from IE if you use the basic codetype="application/java" standard, even if you've downoaded Java 1.4, whereas it does work from Mozilla.)

-Rob

Re:

[account_deleted]

Comment removed based on user account deletion

Re:The patch they should issue!

[gad_zuki!]

More importantly why aren't banking sites suggesting users use Moz? Some could argue that if they knew this in advance they are liable for being negligent, like leaving the vault door open.

It would only be fair to see a link to Moz and Opera on banking sites and suggesting people use these browsers for maximum privacy and security.

Re:The patch they should issue!

[Ubergrendle]

I work for a bank in their internet division. We list 'supported' browsers, but don't make any recommendations. Why? Because we don't want our telephone representatives providing tech support for our 5 million customers. We tried recommending Netscape about 4 or 5 years ago... "NEVER AGAIN" is our mantra.

Yes, it sucks. But we're a business and we can't lead technology change. Just be thankful we don't use .asp, Active X, or flash on our site. :)

Re:The patch they should issue!

[robbo]

It's not a mozilla/ie issue, it's a social issue. Mozilla is likely to have its share of egregious security holes (but probably not as many). Even if patches are released within hours of the discovery of a bug, the likelihood that joe user will install the patch is slim. We can all hoot and holler-- install Mozilla! but if Mozilla gained majority market share, people would still fail to take the time to patch their systems, and it's inevitable that moz security bugs will be discovered too.

Re:The patch they should issue!

[nolife]

It can be done. Mom doesn't know shit about Gator, nothing about the extra "search helpers" embedded into IE, the date manager, the time syncronizer, comet cursor, and the software she has that gives her popups all the time and those got installed without any problems. I'm sure that same technology that allowed those to be installed could also be used for Firebird considering in its current state it's not even actually an "install" but more of a tarball and a shortcut to MozillaFirebird.exe.

MicrowhocaresjustuseandOSOS

[wud]

'Microsoft says it is investigating reports of the vulnerability. When that inquiry is complete, the company will take whatever steps it deems necessary, such as issuing a new patch

lets just hope they release the patch on purpose this time

moderately critical

[maharg]

Secunia rated the vulnerability as "moderately critical."

How long will it be before someone finds a "critically critical" uber-flaw.

ludicrously critical

[thatguywhoiam]

How long will it be before someone finds a "critically critical" uber-flaw.

What I want to know is, just how badly does the regular computer-using public need to get battered, by security holes and other exploits in IE, before they finally just ditch the damn thing?

I installed Firebird for a co-worker the other day. While I was doing this I explained that they should turn on the pop-up blocker. They were astounded that this feature existed at all. I find this is a very common reaction (which, in turn, a

Works fine on IE

[nberardi]

No bug in my box from some reason. It works fine on my version IE 6.0 on Windows 2000.

Re:Works fine on IE

[karevoll]

What is your version-number? Mine is 6.0.2800.1106, and I can confirm that its working (infortunately)...

Have tried some examples? Such as this one? [zapthedingbat.com] [zapthedingbat.com]

Re:Works fine on IE

[maharg]

mebbe someone spoofed your shortcut to point at Internet%20Explorer%01@Mozilla

Re:Works fine on IE

[djmurdoch]

It only affects people who leave Javascript turned on on untrusted sites. Why would anyone do that? Do they like popup hell?

Re:Works fine on IE

[djmurdoch]

Please note however that there's a related bug described here [slashdot.org] that fools the status bar. So even a careful user could be sucked in.

The new version doesn't fool the address bar, but I wouldn't be surprised if there's some combination of characters that does.

These are pretty nasty bugs.

[Sheetrock]

I've found that people are more likely to encounter these sort of things via e-mail, and that they lend themselves quite easily to fraud/theft. Hopefully, Microsoft will release a patch for this even though it's December, because this will no doubt find its way into (illegitimate) spammers' arsenals.

Goddamn it!

[nordicfrost]

Just after I had a lecture for my parents / friends on how to validate URLs, some shit like this comes up. Using Microsoft products is like fighting windmills all the time. Lucky for me, I have ended all friend-support for anyone not using Linux or MacOS.

Re:Goddamn it!

[MikeCapone]

Lucky for me, I have ended all friend-support for anyone not using Linux or MacOS.

Or you could've been a bit less drastic and made them switch to more secure apps while keeping the MS OS (yeah I know, not perfect but it's a step in the right direction -- people are less likely to ditch everything at once).

Why couldn't you just migrate them to Mozilla/Firebird and install some security measures on their computers (good anti-virus, Spybot:S&D, etc)?

Re:Goddamn it!

[Covener]

I don't get it -- your friend couldn't follow your awful advice?

Not a problem in Opera

[rbb]

Why people keep on using Internet Explorer is a mystery to me, as these problems have been solved ages ago in browsers like for example Opera [opera.com]:

Security warning: you are about to go to an address containing a username:

username: www.paypal.com
server: rc6.org

Are you sure you want to go to this address?

Re:Not a problem in Opera

[RFC959]

The problem is that there are still so many sites that are borken in other browsers. (Well, one of the problems, anyway.) Not necessarily because the other browsers are bad, but because developers assume that everyone is going to have IE, think they should force everyone to use IE, or just don't bother to test at all. Off the top of my head I can think of two sites which are intentionally broken:
http://www.scps.nyu.edu [nyu.edu] and
http://www.expensable.com [expensable.com]. (expensable.com, by the way, is an excellent showcase for bad design, but most of it you'd have to log in to see. For example, the main interface is in a popup, and if you have popups blocked, you just can't log in, and it gives you no indication why.) Try going to either of those sites with your User-Agent string set to something unusual. Sure, you and I know how to change that...but for my mom, who can't even figure out how to change her Windows desktop image on her own, that's going to be a deal-breaker.

Re:Not a problem in Opera

[kent_eh]

Why people keep on using Internet Explorer is a mystery to me

Lots of us aren't given a choice. Our desktops at work are locked down, so normal users can't install or change the software available.

My desktop machine is so locked down that I can't adjust the clock. I have to put in a formal request to IT to have it done whenever the clock gets too far away from reality. And then another request for them to set it to the correct time in my time zone, not theirs.

At home, it's a differnt story. Mozilla on

Re:Not a problem in Opera

[Trelane]

Have you tried using the Mozilla Zip file version, as opposed to the installer version? Essentially, install goes like:

1. Download the Zip file containing Moz to My Documents or something (should be under the release page for Mozilla)
2. Unzip the file to somewhere in My Documents
3. Optionally, bring in a floppy or something with the plugins for Moz (or copy them from where they might be installed with Moz; getting them from a Netscsape install is optimal, since they're then self-contained). Put the plugins in the plugins sub-directory in your new Mozilla directory.
4. Go to the new Mozilla directory, and run Mozilla!

I used it to put Moz on the Windows Ex-Privacy machines at my uni with just my user account. Naturally, you can't change the "System Access Preferences" or whatever it's called since it'd be completely assinine for anyone but Administrator to let the user choose what browser they prefer to use....

Anti-Trust Penalties my ass.

Re:Not a problem in Opera

[EnVisiCrypt]

Ahem. Mozilla *is* strict, plain and simple, but only if you use the proper doctype definition. If you don't you probably don't care about "strict" rendering anyway.

I don't use Opera, but I suspect the same is true. If it isn't, then why would you want a browser that intentionally misrenders pages for which the author did not clearly state a doctype? Aren't you just hurting yourself?

ideal:
doctype def == strict or "standards" rendering
no doctype == loose

This way you get to see most sites on the web, and those authors who have taken the care to craft their pages properly get their pages rendered in the fashion in which they intended.

Human nature will pull people in more

[Amiga Lover]

I think the nature of humans to run on autopilot, and that will pull more people in than anything else. A correct-looking url will just add a few more to the gullible.

My boss in 2001 was a pretty cluey guy most of the time. Into his mailbox came one of the eBay scams. "Re-enter your username and password etc and we'll have your records up to date, otherwise your eBay account will be deleted". Partway through doing this he got a bit confused by the process, and I picked up immediately it's not an ebay address. I pointed that out to him. the email's fake. a scammer looking for a way to make a quick scam using his ebay account.

What's he do? goes straight to the main eBay site and starts looking for the equivalent page - he was still on the track of "Must update my ebay account details". It didn't even enter his head that the scam was a COMPLETE scam. half an hour later he's asking again whether or not maybe he should use the URL in the email because he didn't want to lose his eBay account.

A fake URL might catch a few more, but it's peoples attitude, trust of random emails, and acting on autopilot regarding emails that come into their mailbox that catches more than anything else IMHO

IE Mac is fine

[wolrahnaes]

Strangely IE 5.2 on OS X.2 is seemingly immune. Wouldn't the two logically use similar codebases and thus be vulnerable to the same attacks?

Re:IE Mac is fine

[Talthane]

No, the Mac and PC versions of IE have nothing to do with one another beyond a superficial similarity in looks. The Mac version of IE has often been ahead of its bigger brother in terms of standards compliance and suchlike - for example, IE 5.2 does not require the CSS "box model hack" that you have to use to get some sites to render properly in IE 5.5 on Windows. They have a totally different codebase - Microsoft just made use of a name with high brand recognition.

Re:IE Mac is fine

[Deven]

Wouldn't the two logically use similar codebases and thus be vulnerable to the same attacks?

You would think so, wouldn't you? No, a separate development team worked on IE for the Mac; the codebases weren't unified at all. From all reports, IE on the Mac was better than IE on Windows in many ways, particularly standards compliance. Go figure!

Time to declare a War on Bugs...

[adrianbaugh]

... after all, friends don't let friends use Microsoft :-)

check here to test your browser

[nikster]

click on the test button on this [heise.de] page.... it's quite scary.

Of course, you have to use Internet Explorer to see it.

Internet Explorer is usually found under C:\Program Files\Internet Explorer ;)

Comment removed

[account_deleted]

Comment removed based on user account deletion

Not so bad from a different point of view

[castlec]

As bad as this may seem, perhaps it will push users into other browsers. Microsoft has already said that future IE versions will only be available through an OS upgrade. Perhaps the less enlightened will become enlightened when they find that IE X.X is no longer supported and [insert vulnerablity here] can only be fixed with an OS upgrade because you can't just get an IE upgrade. Maybe then, the less enlightened will just get another browser and then be enlightened.

The patch problem, two-fold

[LilJC]

The issue of "read my lips, no new patches" (for December) here is obvious. But now we have two problems. It normally takes a month for a fraction of end users to update even after a patch is issued. Even if this patch is issued immediately when MS said it can be, do you really think that people are going to wake up bright and aware after New Year's Eve and patch their machines?

The people who patch immediately are basically immune to this anyway - we're not idiots. We know there is no time that PayPal would send us an email even directing us to their site to ask for a password. It's the people that need auto-update every damn day that will fall prey to this.

Sure, most of us patch/encourage updates of those around us, but even that might take some time. There will still easily be weeks of January where "Verify your PayPal account for free Valentine's chocolates sent to your significant other" emails will be rampant.

I like the idea of more predictability to patches, but I don't think it's feasible for reasons like this. The only way to predict when a patch will be needed is to set a schedule for their issue, and then immediately after that all the security problems will be exploited that have been found. i.e. in January serious problems found in December will come out and we'll have hell from then in January. Come the patch for January, all the problems found in January will crawl out, and we'll have hell again.

This will continue, ad extremum nauseum.

Enough ranting, I'll propose a solution. Windows is shipped with an auto-update immediately feature for home users who wouldn't dream of making a configuration change. Then there is a monthly patch that rolls everything together, and Update can be set to use that instead for appropriate machines that are administrated appropriately with users aware of issues. Or perhaps security issues are patched immediately and the latest WMP functionality gets put in the same patch with all the driver updates, etc. that can seriously wait a couple of weeks instead of everyone having to reboot their machines an extra half dozen times a month. There - that's two ideas off the top of my head that I would take over our current state of affairs in a heartbeat.

Microsoft update eats Mozilla profile?

[gvc]

Microsoft update routinely resets "program access and defaults." Most annoying, but not what this note is about.

On three occasions, with two different users, I have observed that Netscape/Mozilla profiles have disappeared following Microsoft update. Just a concidence? Perhaps, but after the third occurrence I have become suspicious.

Because Microsoft update is an opaque process, there's no way I can even attempt to 'reproduce the problem' as I would normally do in similar circumstances.

So I'll ask /.:

Re:Microsoft update eats Mozilla profile?

[pubjames]

On three occasions, with two different users, I have observed that Netscape/Mozilla profiles have disappeared following Microsoft update. Just a concidence? Perhaps, but after the third occurrence I have become suspicious.

One time I played with the application that let's you set your default browser and email package - the thing that Microsoft had to do because of the DOJ ruling. It completely screwed up Mozilla - it actually renamed files in the Mozilla directory, I kid you not. I couldn't believe it. I

Re:Microsoft update eats Mozilla profile?

[gvc]

Your experience would be consistent with mine. As I mentioned, Update routinely sets the default mailer to Outlook, and I have to reset it using the DOJ-mandated tool. So it could be that the tool is messing me up rather than the update. But it is still a consequence of the update, and still evil.

If indeed the tool is the culprit, it may be easier than I had originally thought to reproduce the problem, and hence build a case against Microsoft. At least a case against their software. Proving intent wou

Not that big of a deal

[hugesmile]

Is this really significant?

I can create a web page that opens a window with NO menu at the top, buttons, or address bar (pop-ups do this all the time). And then I can have that web page CONTAIN a substitute menu, buttons, and address bar. In that fake address bar, I can write "www.microsoft.com", just like the sample demonstration. Simple exploit. May fool some people. May get them to enter their credit card info.

Better yet... imagine this.... set up a whole www.ammazon.com (sic) site that looks l

Scares the pants off me...

[pubjames]

Personally I think this is one of the worst security holes I've seen in ages. Why? - very easy to do and very useful if you're trying to do something fraudulent. I don't understand why they rated this "moderately critical" - personally I think it should be rated "super critical with mayo and large fries and a banana shake (with chocolate sprinklings)"

Now is the time to Push Mozilla and Firebird

[gad_zuki!]

At least I've been having more success pushing alternatives to MS when scary MS articles come out.

I find giving people the link (or installing it myself) to the Firebird installer [mozdev.org] and showing them how multiple homepages, pop-up blocking, and tabs work usually wows them.

I'd much rather field some tech support questions about Moz than deal with a frantic relative or friend telling me how all the money in their bank account was stolen by "internet theives."

Paypal et al should be pushing for more secure browsers on their site. I don't see how this could be a business conflict with MS. Paypal has a lot to gain by simply suggesting there are more secure browsers out there.

Chrome-free windows already allow this!

[Zog The Undeniable]

A similar phishing exploit can be done using chrome-free windows (see earlier story) with the IE toolbar, address bar and even the little SSL padlock inserted as a GIF (just cut and paste from a screen dump of the real site). So the victim's screen looks exactly like www.fatcatbank.com when it's really at www.russianmafiaownzj00.ru. Mousing over the address bar would give the game away with this simple example, but it's not impossible to use HTML forms to make an address bar that works.

Similar IE bug

[sopuli]

A little experimentation with this bug yielded another similar bug. The following bit of html:

<a href="http://[e-mail]">click me</a>

when this is displayed in IE, and you hover the mouse over the link, it will display "www.sco.com" in the in the status bar, but when you click it, it will take you to "www.fsf.org". I'll leave it to the reader to replace the latter link with a more offensive one...

Still..

[Dwedit]

Even if it's hidden in the address bar, you can do File > Properties to see the full URL.

And no, this bug won't work on slashdot since slashdot removes the username parts of a URL, and also removes the DOS smileyface character from posts.

Exposed Cookies?

[Terragen]

Does IE know its being tricked, or does it know the real site and just display the wrong one?

I'm wondering if some shady types could use this exploit to get your cookies for any site of their choosing.. that just might be a slight problem :/

Results of dumbing down UI

[Wolfier]

If MS browser actually displays everything on the address bar without filtering of any sort, problem would not have existed.

Just another example of a solution that solves a problem that doesn't exist and creates security holes.

Why is there an @ at all?

[jfengel]

I was baffled to discover that my browser (Firebird) supports the @ redirection at all. I've been unable to uncover any W3C or RFC standard that covers it, though presumably one exists. Can somebody point me to it?

Perhaps that would explain why such a silly feature exists at all. It seems to have no other purpose than for spoofing.

Re:Why is there an @ at all?

[HeghmoH]

It's covered in RFC 1738 [ohio-state.edu]. Look for section 3.1 Common Internet Scheme Syntax.

Basically, it allows you to specify a username and possibly a password as part of a URL. http://w:[e-mail] says to connect to y.com with username w, password x. The URL http://[e-mail] means to connect to x.com with username w. This is not in particularly common use for HTTP, but it can be useful for sites that use HTTP authentication.

Web servers ignore the username and password if you connect to a page that doesn't require authentication, so for most sites, everything before the @ is simply ignored.

So this really is part of a standard, and it exists for a good reason. It's not a redirection at all, but simply a part of the URL standard that isn't used often enough for people to know what it means. The whole spoofing this is a completely unintended consequence of that.

Perfect

[KalvinB]

One more trivial tell to drop crap e-mails from my inbox.

If an e-mail contains the characters "%01@" or "%00@" kill it.

I can't think of any reason why those strings of characters would legitimatly found in an e-mail.

This "exploit" has very very few practical applications that would actually fool anybody. No legitimate company sends out an e-mail asking to verify your information by clicking on a link. This doesn't change anything in that area. So instead of telling grandma not to click on links in e-mails that look "suspicious" how about telling her simply to not divulge any information to web-sites that ask for that information through an e-mail.

If PayPal needs to verify your information they ask AFTER you log in. They may send an e-mail saying they need you to log into your account to take care of something.

So for a real world example, if Grandma get's an e-mail from "PayPal" or her "bank" telling her that she needs to validate some information tell her to open her browser and go to her bank's web-site the old fashioned way of typing it in, to log into her account and then see if any notices are there.

If not, the e-mail is a fake. If a notice is there, do what the notice says on the site.

Simple lesson for grandma: Never click on a click from an e-mail to verify information. ALWAYS manually type in the URL for the company you're involved with asking for your information, log in, and THEN look for notices and do what they say. Grandma should already know not to give information to companies she has no knowledge about.

Anyone throwing up their hands about having to reteach grandma, didn't teach grandma properly in the first.

There's a very generic object lesson here that has zero to do trying to see if a URL is being sneaky that you should have taught her years ago when the first "click here to update your info" scams came through.

Ben

A way to block this exploit....

[alwsn]

I use proxomitron (You can google to find it) as an ad block and a general crap filter. Since I use a really nice browser based on the IE rendering engine (MyIE2) it's important for me to block crap like this out.

To nuke this exploit from links you follow on a website (it won't help if you follow it from an e-mail or paste it into the address box, but if you are duped by that, they you probably aren't reading slashdot) you can ad this rule to the proxomitron (or a similar one to Privoxy, and open source equivilent)

(Matching expession)
http*@

(Replacement text)
!@!

and it will do a nice job of blocking all of these links.

bad for the corporate user

[moojin]

take this example email to a corporate user from a malicious person. the email is a simple example, i'm sure other more complex examples can be created:

To: corporate user
From: corporate help desk
Subject: MANDATORY: Username and password verification

Last night, one of our authentication servers went down and we need to rebuild the our database. To make this process easier for us, please use the form below to verify your username and password.

http://[e-mail]_s it e.com/username_and_password_verification.html

Thank you for your cooperation.

IT Help Desk

===

i can't believe that MS is just considering a patch for this. i would write to your corporate internet security officer and urge this person to take a look at this MS IE vulnerability and also to switch to Mozilla. this could be mozilla's chance.

Gotta love microsoft's response

[jerrytcow]

Microsoft did not set a timetable for its investigation, but said it may eventually release a patch to address the problem. Meanwhile, the company recommended that people follow basic security procedures, including the use of firewalls, software updates and antivirus software.

How many people are going to give their credit card/bank/paypal info to these sites thinking they are safe because they have norton antivirus or zone alarm running. They are basically telling people not to worry when this is a huge security flaw - the only way to be safe is to type the URL in instead of following links.

The one piece of good news in this is . . .

[InfoSec]

That it doesn't fool the security zones in IE. If you have a site in your "Trusted Sites" zone, and you try to spoof that site using the mentioned vulnerability, the Address Bar shows false, but the Zone is not fooled. Thank heavens for small miracles.

Patch Just Released!

[BandwidthHog]

Who says MS doesn't release patches faster than Linux?

www.microsoft.com/ie/[e-mail] /p ub/mozilla.org/firebird/releases/0.7/MozillaFirebi rd-0.7-win32.zip

Re:Crap like this.....

[gazbo]

Oh man!

That's pretty elite - can you post your config files on how to do that?

Re:Crap like this.....

[nolife]

I did the same in the past and that is a very good idea. It's works even better if you leave IE as the Windows "Default Browser". Anything spyware/application wise/etc that tries to phone home or fetch something using the default browser or calling the IE rendering engine directly will also get blocked automatically and you can happily continue to use your other browser with out any problems!

Re:Not just an IE bug...

[BenjyD]

No it doesn't. The exploit page linked to in the article displays the full URL with Mozilla 1.5 on my Linux system:

http://[e-mail]/secur it y/ex01/vun2.htm

Re:Not just an IE bug...

[MrPink2U]

How did you come up with that deduction? IE6 is the only f'd up browser I tested. All other browsers display the proper URL.

Come on ...

[zonix]

Do you really believe that the same stupid coding error would appear in three different implementations by three different organisations? It's not a flaw in the HTTP protocol's GET request method, it's a flaw in Microsoft's URL handler.

z

Re:This affects mozilla firebird too

[WebMasterJoe]

Are you sure? I tested Mozilla using this page [zapthedingbat.com] and it worked correctly. I tested the same page using IE and the url came up "www.microsoft.com".

Yes, I know you're a troll. But I figured anybody who might be fooled by your outstanding writing should be able to click on a link and test their own browsers.

Also, I should note that Opera actually gave me a pop-up warning that I was sending a username to the site - the username www.microsoft.com - and after I agreed to do that I got a page with the correct url. Has anybody else tested this on other browsers?

Re:Why is it slashdot never reports......

[The Bungi]

This is very interesting. When the "best" alternative to IE was that piece of unbridled crap closed source Netscape Navigator you wouldn't hear a peep from anyone about "standards". Mozilla and friends have been viable products for what, a year and a half? And now IE is a piece of crap.

As for this particular problem, as always Bashdork makes it seem like the end of the world, front and center. Check the other responses on this article - Mozilla is also vulnerable. I'm running Mozilla 1.6a (2003110515) and I see the "http://www.microsoft.com/" URL on the Secunia spoof page [secunia.com]. This kind of puts it in perspective, eh?

Mozilla is an excellent browser, that's for sure. But it is what it is because IE4 raised the bar so high (compared to NSN) that there was really nowhere to go. I personally use both, and I'm glad that Mozilla is (finally) giving IE a run for its money. But to go from embarrassed silence to this... well, as so many other areas where open source had to play catch up, the FUD tends to convey the idea that Microsoft has always produced non-functional "crap" and everyone else has been running circles around them forever.

Very funny. Oh, and the "economy cereal" thing? Brilliant. I've heard the same thing said about Mozilla (albeit with a different angle), with its 40-second load times and cluncky one-size-fits-all non standard GUI. Not that I'd agree though. But hey, don't let that put a dent in your superb flaming skillz.

And let's see how long it takes for the Mozilla folks to patch this one. And of course, for all those people running older builds to actually download and install.