New Spoofing Vulnerability in IE 372
Jimmy M. writes "A new vulnerability has been announced in Internet Explorer, also affecting XP SP2, which can very easily be exploited by a malicious web site to completely spoof the address bar. The vulnerability is very similar to another vulnerability disclosed just about a year ago called the '%00' vulnerability, which also was widely exploited by phishers. A demonstration is also available."
Surprisingly, a patch is already out (Score:5, Funny)
Re:Surprisingly, a patch is already out (Score:2, Funny)
25 - funny
35 - troll
Damn that's a lot of lane switching...
Re:Surprisingly, a patch is already out (Score:3, Funny)
Brilliant.
Re:Surprisingly, a patch is already out (Score:5, Informative)
If it's the IAS proxy that requires NTML authentication, you can always pipe requests through this [sourceforge.net] python rewriting proxy.
YLFIRe:Surprisingly, a patch is already out (Score:4, Informative)
Re:Surprisingly, a patch is already out (Score:2)
Re:Surprisingly, a patch is already out (Score:5, Informative)
In the URL bar type about:config and then filter for "ntlm". In the network.automatic-ntlm-auth.trusted-uris just put a comma separated list of servers you want Firefox to send your NTLM to. For example, double click network.automatic-ntlm-auth.trusted-uris and put in foo.com,bar.com,slashdot.org
The only thing I wish Firefox did was to allow a wild card domain name like *.mycompany.com. My network.automatic-ntlm-auth.trusted-uris entry has gotten pretty long at work : (
Re:Surprisingly, a patch is already out (Score:3, Interesting)
Now, it _is_ talking to a Squid proxy authenticating to AD via winbind and not IAS, but I wouldn't have thought that mattered from a client perspective...
And Firefox is vulnerable to other attacks (Score:5, Insightful)
Anyone know the score? What is Firefox vulnerable to and when will it updated?
Re:Surprisingly, a patch is already out (Score:3, Insightful)
Just copy?
Which was first: Mozaic/Netscape/Mozilla, or Internet Explorer?
Which was first: Unix, VMS, or Windows?
Which TCP/IP stack is Windows using?
Which was first: Xerox Parc, Apple Lisa, or Windows GUIs?
You need a history lesson pal.
Vulnerability Confirmed on Avant Browser (Score:5, Informative)
Re:Vulnerability Confirmed on Avant Browser (Score:5, Informative)
- Block Flash
- Block Popups
- Block Ads
- Disable Sounds
- Disable Videos
- Disable Java Applets
Makes pages load very fast, and if I need one of those functions for the page I'm on, I just toggle it on for the session.
Between these security features and still having the compatibility of IE, that's why I love Avant so much. Yes I used Firefox for 2 weeks, and went back to Avant.
Microsoft is so sweet (Score:5, Interesting)
Re:Microsoft is so sweet (Score:2, Insightful)
Re:Microsoft is so sweet (Score:5, Insightful)
never mention your competitor in advertising
no such thing as bad publicity, people tend to forget the details but "brand reinforcement" still applies, if you have to mention your competitor then it implies your product wont/cant stand up on its own merits = you have LOST
just an anon advertising exec
Re:Microsoft is so sweet (Score:4, Interesting)
Then again, I suppose the phrase could be used for both reasons.
Re:Microsoft is so sweet (Score:5, Interesting)
Re:Microsoft is so sweet (Score:5, Insightful)
Negatively advertising about your competitor (talking about why their product is bad, rather then why yours is good) is bad no matter what position in the market you're in. Instead of saying you're the underdog but people should try you out, you're saying your competitor is bad, so you're all that's left. People aren't interested in leftovers and those winning by default. If Firefox wants to successfully advertise, it should be talking about "faster browsing" without actually mentioning what it is being compared to, let alone naming Microsoft or IE.
And that boys and girls is why the basement dwelling me too fanatics who crowd around OSS are doing far more harm to OSS adoption then good. No business is going to suddenly switch to open source as long as "OMG M$ IS TEH SUX0RS!!!!!!!" is the message crowding out any intelligent and level headed promotion of true technical and cost superiority.
Re:Microsoft is so sweet (Score:3, Funny)
Re:Microsoft is so sweet (Score:5, Funny)
A fundemental rule of marketing is that your commercials should be understandable by your entire demographic (sometimes ad campaigns will use "inside jokes" if the demographic they are targeting is tight enough, but it's still risky). By using special words or concepts only known or believed by a small number of people will mean you risk (or nearly guarantee) having your commercial coming across to your audiance like The Architect from The Matrix trying to sell them car insurance -
Re:Microsoft is so sweet (Score:3, Insightful)
NEVER mention competitor?? (Score:3, Interesting)
It's much more of a matter of people (A) not hearing about Firefox, and (B) not using it because they d
Re:NEVER mention competitor?? (Score:3, Informative)
Laura Ingraham recently changed her website. The day she changed it, she had people calling in telling her whether they were being directed to her old site or her new site, and was asking what browser and ISP they were using. You would be amazed (or maybe you wouldn't) at how many people just responded with something like 'my internet' or 'AOL' for their browser. Her little sidekick dude kept tel
Re:Microsoft is so sweet (Score:3, Insightful)
never mention your competitor in advertising
no such thing as bad publicity, people tend to forget the details but "brand reinforcement" still applies, if you have to mention your competitor then it implies your product wont/cant stand up on its own merits = you have LOST
So.... does this mean that Microsoft has already lost when they mention 'get the facts'??? [microsoft.com]
Not mentioning your competitor (Score:3, Insightful)
There are tons of people who "click on the 'e'" or "go into the Internet" or "use the Internet Explorer to get to Google"
These people don't even realize that "web browser" is a product they use, made by multiple companies. If you're lucky, they remember Netscape. If they read "Firefox 1.0!" in a newspaper, they skim past it just like they skim past "B
Re:Microsoft is so sweet (Score:3, Insightful)
Get a grip. The internet is only the entire way of life for slashdotters and other nerds. "Outside of nerdville," most people will continue to be quite able to play softball, mow the lawn, and tell stories to their kids even without IE. Even I shall survive. Even thou mightest.
Re:Microsoft is so sweet (Score:5, Interesting)
Of course we'll survive. It's just the internet. But, many of us are software professionals. We care so much about this we decided to make a career of this. We care so much about this we're willing to give away our ideas as open source projects, just to share them with the world. Forgive us if we care passionately about this, and think that basic things like browsers should not have security hole after security hole till we wonder if it will ever stop.
And, it's not even too much of a stretch. Enough people get screwed with identity theft, and the trust of the system falls apart and it ceases to be a method that many of us earn a living with. If one of the largest companies in the world can't even fix their browser, with all the resources of an almost monopoly on the market and stock options to hire every CS post graduate student on the planet -- a technology that went through its basic definition years ago -- it puts into question the entire value of software professionals.
Re:Microsoft is so sweet (Score:5, Interesting)
But I can't name any other profession in which it is possible to profitably release product after product while being completely incompetent to produce. [Ignore management; it's not their job to produce.] You don't have to be a good programmer to succeed; you only have to look good. I was taught programming by a college professor who believed--seriously believed--that having five consecutive GOTO statements was a valid result of "structured programming"! I've seen countless examples (as have most people here) of bad programming. I decided years ago that anybody who actually trusts a computer is insane. I rely on computer records; I have no choice unless I want to live in a hovel in the woods and keep all my money in a mason jar. But I don't trust them, and I never will; I've known too doggone many programmers.
Just yesterday I had a lengthy discussion with my boss (the company owner) about why IE (and Windows in general) is so weak. With all the resources of an almost monopoly on the market, you said--that is exactly the problem. Microsoft has little motivation to do more than keep hot-patching the holes in IE and Windows instead of tearing up the whole street and laying a solid foundation. In the 1960's and 1970's, IBM stayed on top of the mainframe market despite having one of the worst OS's around, because they had the most ruthlessly effective body of marketeers anybody'd ever seen; only the virtual disappearance of the mainframe market took IBM from the top. As long as Microsoft's marketeering position stays strong, MS software will stay weak.
Quality is good. Many people will pay for quality when they can find it; people are downright amazed when they can get quality for free. But the majority of available products are going to remain Wal-Mart quality, because the vast majority of people are still going to get whatever is on the shelf at Wal-Mart.
And their world won't end. But its shine may tarnish a lot more easily.
Re:Microsoft is so sweet (Score:5, Interesting)
Just about everyone I install Firefox for (almost all non-geeks)... People who don't give a shit just plain don't know about it. Firefox is faster, it has a nicer interface, and prevents things like popups and bad security practice within the browser environment. The people that start using Firefox by force (by me) usually thank me profusely and rave to me (and their other non-geek friends) about it within 30 minutes of using it.
Plus, just look at the themes!! Who doesn't like themes??
Some who SHOULD care do not know (Score:3, Interesting)
Re:Some who SHOULD care do not know (Score:3, Interesting)
The funny thing was that on the next powerpoint slide she brought up was an example of email spoofing, and the example was showing an email coming from webmaster@mozilla.com.
Re:Which version of Firefox isn't? (Score:3, Informative)
I'm thinking hard here, and the only things I am coming up with are OS shell integration and activeX, which are dubious at best.
It has surpassed IE in the following categories:
Re:Which version of Firefox isn't? (Score:3, Insightful)
Javascript whitelisting and/or security zones. I cannot always remember to turn off javascript after I have enabled it for a particular site, so this is a very important feature to me. Until Firefox adds it I'll stick with IE thank you very much.
How many of these exploits work with active scripting and activeX turned off? Not many.
Re:Microsoft is so sweet (Score:5, Funny)
Or maybe a simple 5 color-coded chart!
RED - Browsing with IE
ORANGE - something witty
YELLOW - something wittier
GREEN - Browsing with Firefox
BLUE - Unplugging your network cable
Firefox(tm). The next safest thing to unplugging your network connection.
Re:Microsoft is so sweet (Score:2)
YELLOW - downloading the latest paris hilton video
Re:Microsoft is so sweet (Score:5, Funny)
ORANGE - Giving your cat a bath
YELLOW - Cooking bacon in the nude
GREEN - Browsing with Firefox
BLUE - Unplugging your network cable
Re:Microsoft is so sweet (Score:2, Funny)
BLUE - Unplugging your network cable
ULTRAVIOLET - Browsing with Opera
Opera(tm). The next, from the other side, safest thing to unplugging your network connection.
Re:Microsoft is so sweet (Score:3, Insightful)
The Times ad was effective (Score:3, Interesting)
Safari (Score:2, Informative)
Next.
Re:Safari (Score:3, Informative)
Re:Safari (Score:2)
Error: node : TypeError: Undefined value
Re:Safari (Score:2)
Re:Safari (Score:3, Funny)
infinite popups (Score:4, Informative)
Not the advertised exploit, but pretty damn annoying in its own right.
Re:infinite popups (Score:2)
Re:infinite popups (Score:2)
Geez... (Score:3, Interesting)
No way... a bug in IE? (Score:2, Funny)
Spoofstick and Qwik-Fix don't detect/block this (Score:2, Informative)
Re:Spoofstick and Qwik-Fix don't detect/block this (Score:2, Informative)
How long until... (Score:5, Insightful)
Or, is Mozilla just that good at plugging leaks before they happen?
Re:How long until... (Score:5, Insightful)
I frequently wonder what will happen as people start to shift more focus onto the software we so highly regard. Hands down Firefox is a more usable browser but I don't think it yet has the sort of attention that Internet Explorer does. Until such a time we will never truly know just how resilient Firefox is.
Re:How long until... (Score:3, Informative)
Once exploits start coming out for Firefox (as most reasonable people expect them to) those many eyes from around the OSS community (some
Re:How long until... (Score:3, Informative)
Re:How long until... (Score:3, Insightful)
It's probably safe to say that firefox is simply a better written browser, but another aspect of the issue is the question of system incorporation. Bugs on IE are critical because not only can they do the normal spoof/phish/etc, they can also worm their way into the guts of windows. Bugs on Firefox can't, simply because firefox isn't integrated as tightly into the operating system as a whole -- and
Re:How long until... (Score:3, Insightful)
Re:How long until... (Score:3, Interesting)
Re:How long until... (Score:3, Insightful)
Wine Help (Score:5, Funny)
IE for the mac is safe (Score:3, Informative)
yeah the only problem is (Score:2)
So I disable javascript ... (Score:2, Interesting)
what!? (Score:3, Interesting)
Re:what!? (Score:2)
Re:what!? (Score:2, Interesting)
Apparently, [slashdot.org] they still do.
Disable ActiveX (Score:5, Insightful)
Re:Disable ActiveX (Score:2)
Re:Disable ActiveX (Score:3, Insightful)
Doesnt work for me at all (Score:2)
At least the announcment was timed well. [slashdot.org]
Master Plan (Score:2, Insightful)
Changing from IE (Score:2, Interesting)
http://reviews.cnet.com/4520-3513_7-5570803-1.htm
NYT Ad (Score:3, Insightful)
Maturity (Score:3, Insightful)
Where I work, we have code reviews, automated code scrubbers, and extensize QA, and we're a relatively small shop compared to them.
I know they're trying, otherwise it would be a lot worse, and SP2 did a good bit to improve things, so I can't be that hard on them.
Jerry
http://www.syslog.org/ [syslog.org]
Microsoft bashing (Score:2, Interesting)
Sound familiar? (Score:2, Informative)
Outlook / Outlook Express? (Score:5, Interesting)
Re:Outlook / Outlook Express? (Score:2)
Nelson Says: (Score:4, Funny)
And now to the best house of cards on the planet (Score:3, Insightful)
Maybe it's just me, but I would love to see what IE's source code must look like at this point with all the patching it has gone through over the years.
Even more amazing perhaps are the facts that:
Most certainly the best built house of cards on the planet!
Maybe it would be easier... (Score:3, Funny)
--AC
misunderstood vulnerability (Score:5, Informative)
This bug however allows to break cross-domain scripting boundaries.
A practical example is that an attacker could craft a web page so that when a slashdotter visits it, it automatically submits a silly comment in reply to a particular post (yes, in spite of the hidden formkey field.)
Worse things could be done, like automatically grabbing the last 10 emails from your hotmail account if you happened to be logged in, send random replies to them, etc...
Use your imagination.
Describing this as a way to "completely spoof the address bar" misses the impact of this bug entirely.
All in all, a pretty cool exploit. I can't help but wonder if the double use of ExecScript and setTimeout is really necessary, but maybe that's an attempt to make it work accross more environments.
MSIE's clock. (Score:5, Funny)
Bill Gates died and went to heaven. As he stood in front of St.Peter at the Pearly Gates, he saw a huge wall of clocks behind him. He asked, "What are all those clocks?"
St. Peter answered, "Those are Software Vulnerability Clocks. Every computer program on Earth has a Software Vulnerability Clock. Every time a program is compromised due to a bug in the code, the hands on that program's clock will move.
"Oh," said Bill, "which clock is that?"
"That's the UNICOS clock. The hands have never moved, indicating that it was never compromised by an attacker."
"Incredible," said Bill. "And which clock is that one?"
St. Peter responded, "That's the OpenBSD clock. The hands have moved twice, telling us that the "Only one remote hole in the default install, in more than 8 years!" was compromised only two times in this operating system's life."
"Where's Internet Explorer's clock?" asked Bill.
"That's in Jesus' office. He's using it to drive the generators, which provide power for our celestial copy of Las Vegas."
Re:No browser bug will ever affect me (Score:2)
GNU WGet Multiple Remote Vulnerabilities (Score:5, Interesting)
Re:Yet another reason... (Score:4, Interesting)
No way! (Score:4, Funny)
I just clicked the demo link using Firefox 1.0, and nothing happened at
Never mind.
Re:No way! (Score:3, Interesting)
Re:No way! (Score:4, Insightful)
I won't use a bank or financial service that requires IE.
Re:Yet another reason... (Score:5, Insightful)
From Microsoft Help & Support [microsoft.com]. "The most effective step that you can take to help protect yourself from malicious hyperlinks is not to click them. Rather, type the URL of your intended destination in the address bar yourself. By manually typing the URL in the address bar, you can verify the information that Internet Explorer uses to access the destination Web site. To do so, type the URL in the Address bar, and then press ENTER."
Just defeat the purpose of hyperlinks. Thanks MS!
Re:Yet another reason... (Score:5, Funny)
http://by2fd.bay2.hotmail.msn.com/cgi-bin/getms
in my address bar....
Thanks, Microsoft! I needed to brush up on my typing skills.
Re:Yet another reason... (Score:4, Interesting)
Re:Yet another reason... (Score:3, Informative)
BTW the site seems to not be working right now, but that should be temporary.
Re:Vulnerability? BS! Try crash. (Score:2)
TFA was quite clear on what it was supposed to do. BTW, the exploit doesn't claim to be in anything but IE.
Re:Vulnerability? BS! Try crash. (Score:2)
Actually, you are wrong. With default settings, it does in fact work on a fully patched Win2K system. I tested *THIS* fuly patched Win2K system. Turning off ActiveX however prevents the exploit. Perhaps you have ActiveX disabled already (a good idea) and not even annonying mostly unless your bank/vendor/etc is a bunch of jerks and requires it.
BTW, 5.00.3700.100 isn't up to date for Win2K. That's IE 5.x. That would be 6.0.2800.1106.
Re:That's nothing! (Score:2)
Re:Firefox is immune (Score:2)
How to detect Internet Explorer [ericgiguere.com] and encourage IE users to switch to Firefox...
EricRe:SLASHDOT SPOOFED (Score:2)
Re:javascript (Score:2)
Re:Dupe (Score:3, Informative)
The vulnerability discussed in the article you linked is here:
http://secunia.com/advisories/13251/ [secunia.com]
which, as you can plainly see, is #13251. Secunia calls it the "window injection vulnerability."
The vulnerability discussed in THIS article is
http://secunia.com/advisories/13482/ [secunia.com]
Quite obviously number 13482. Secunia calls this one the "cross-site scripting vulnerability."
So no, they're not the same thing at all, and you're karma-whoring with falsely "informative" posts.
p