IE Vulnerable to Cross-Browser Spyware Attack 619
An anonymous reader writes "The Register reports that Firefox can be used to infect IE on Windows. By visiting a malicious site with Firefox, a user can infect their install of Internet Explorer. Other alternative browers may expose the same vulnerability. The article quotes the CTO of ScanSafe as saying that '[j]ust switching away from IE does not give adequate projection. Now that Firefox and other alternative browsers have a toehold in the market the hacking community will get busy exploiting the vulnerabilities that exist in any complex browser.'" VitalSecurity's report points out that this vulnerability can (only) affect Windows users who use Sun's Java Runtime Environment.
Caveat (Score:5, Informative)
Re:Caveat (Score:5, Insightful)
Re:Caveat (Score:5, Insightful)
That's true, and is why I don't believe that any OS or browser is going to save us from malware. Until the average user learns safe computing practices, they're going to continue installing stuff they later wish they hadn't; in time even if they do stop running as admin, they'll get used to typing in their admin (or root) username and password.
Re:Caveat (Score:5, Interesting)
Secure login (Score:5, Insightful)
Since applications shouldn't be able to hijack that combination it adds additionaly security.
You can have a lot of fun with micking login boxes. Back when I was in uni we'd screw around with each others laptops. I got a terminal window on a friends machine and aliaed the su command to a perl script which would prompt for a password, send the password to my webserver, tell the user it was wrong, and then unalis the command so the next try would go to the real su.
Easy to do, but you'd have to be very on top of things to spot it.
Re:Secure login (Score:3, Informative)
and Re: the script: devilishly clever, sir.
Re:Secure login (Score:4, Informative)
Re:Well yeah (Score:4, Insightful)
However, I do see the problem MS faced. If they made system hooks too restrictive, it would realy hurts third party programmers that needed a system service to start up without a user login. So, ofcourse MS picked the most lucrative path, instead of the most secure ; )
Re:Caveat (Score:3, Informative)
and application
It should be noted that this is from an mkpg, Im looking to see if I have a standalone application installer around
Re:Caveat (Score:3, Insightful)
Re:Caveat (Score:3, Informative)
This case was actually less silly than it sounds. McDonalds was intentionally serving their coffee hotter than safe levels in order to make people take longer to drink it, thus decreasing the number of free refills they had to give out and saving them money. They were repeatedly warned about this but continued serving the coffee too hot, thus the lawsuit.
Re:Caveat (Score:5, Informative)
If anything, this was a case that demonstrated why we need to be able to sue the shit out of a company when it deliberately harms people.
The devil is in the details.
Re:Caveat (Score:4, Informative)
Charring is not, despite Wikipedia's insistence, the sole arbiter of burn degree; depth of burn is the arbiter generally used.
Re:Caveat (Score:5, Informative)
I'm going to give you the benefit of the doubt on this one and assume you're referring to some other case involving a hot coffee suit, and not the infamous McDonalds suit. If you actually take the time to read the details of the McD's suit you'll see that the franchise in question was serving coffee at a temperature way way above what any reasonable person would consider acceptable. They had received numerous complaints about it prior to the incident, and the woman who was burned by the coffee received severe 2nd and 3rd degree burns. In other words - the suit was totally warranted. Any coffee at a temperature high enough to cause 3rd degree burns through clothing is unsafe and should not be served.
I provide this info for other readers who may not know the details of the case but love to point to it as an example of a frivolous lawsuit when in fact it is completely justified.
Relevant Links:
reference article [vanosteen.com]
google search on topic [google.com]
Forget the warnings! (Score:5, Funny)
Re:Unfair analogy (Score:5, Funny)
Re:Caveat (Score:3, Funny)
Re:Caveat (Score:5, Funny)
Funny that. The dialog box has three (count them - 1, 2, 3) exclamation icons, has a title that says "Warning - Security", explicitly states that the certificate is invalid and issued by an untrusted company, and has "No" as the default selected button. What more can be asked of Sun?
I suggest that Java make loud, obnoxious noises and shout Monty Python quotes at the user at an intolerable volume if he perchances to select "Yes", against all warnings.
Exploit, my ass.
Re:Caveat (Score:5, Insightful)
Create a dialog box with all the warnings. Give it an OK and a Cancel button. Closing it or clicking Cancel always causes the applet not to run.
Give is a checkbox, that says "Allow this potentially dangerous applet to run without security restrictions." Leave it unchecked.
Clicking OK while it's unchecked also causes the applet not to run.
Now the user can't accidently click yes, as two clicks are needed to unlock the applet. You can't accidently make the user install the applet by typing "Y" when the dialog suddenly pops up.
That's how all these "do something insecure" dialogs should be. I should have to explicitly check off "OK" and then hit the "Accept" button. That includes Firefox's XPI install system, which the site mentioned also tries to exploit.
Re:Caveat (Score:5, Interesting)
Hard for them to say they didn't see it.
Re:Caveat (Score:3, Insightful)
Even if one option was "transfer your bank account contents to an unidentified account in Nigeria" some people would still choose it.
Some people are beyond hope.
This reminds me of Japanese Cars.. (Score:5, Interesting)
I heard that this was a measure to prevent people from locking their keys in their car. The Japanese car manufacturers decided that if people have to lock the door, then hold the handle in the open position as they close the door, it will prevent them from accidentally locking their keys in the car.
Sounds nice in theory... until the day I locked the keys in my Civic. It was then that I noticed that because I couldn't lock the car door without holding up the handle, that I had gotten into the habit of *always* holding up the handle while closing the door, even when I didn't want to lock it.
I've known a lot of people who have locked their keys in their Japanese car, they told me the same thing.
So, instead of being a mechanism to prevent people from accidentally locking their keys in their car, it was instead a mechanism to train people to hold their door handle up when closing the car door.
You can't fix a behavioural problem with a technological solution.
Re:This reminds me of Japanese Cars.. (Score:4, Insightful)
Not trying to nitpick, but this is incorrect. It comes out on slashdot on awful lot (particluarly in relation to spam). It is better said as: "You cannot fix every behavioural problem with a technological solution."
Using another car example, switching the car off while the lights are on makes the car beep. This, in my experience, has largely solved the problem of leaving the lights on and getting a flat battery.
I am not certain if this has had the same effect in the wider population, but it is an example of where a behavioural problem of mine has been fixed by technology.
Re:Caveat (Score:5, Insightful)
The security warning explicitly states, "The security certificate was issued by a company that is not trusted".
I mean, what do people expect? A little hobgoblin to pop out of their computer and whack them in the head with a mallet if they try to click 'yes'?
Re:Caveat (Score:3, Funny)
Hey, that was actually a great idea for a new family of USB gadgets.
Re:Caveat (Score:5, Funny)
"Lets just change this DONT-BLAME-SENDMAIL option here...." *Zzzzz!!!* "@#*(%&@*!!!!"
"Now, to change this mail server to an open relay..." *Zzzzz!!!* "*@#$&%*$!!!!"
"Lets just install the Java Desktop system..." *Zzzzz!!!* "^#$&@%@!!!!"
Re:Caveat (Score:5, Funny)
WHAP! No clicky!
re: caveat (Score:3, Insightful)
ed
You know it would happen (Score:3, Funny)
When I visit a web page and it prompts me to install something, a little hobgoblin pops out of my computer and whacks me on the head with a mallet when I click yes.
After this happens, my computer slows down and I get lots of popups. I think the hobgoblin has infected me with a virus. Please disable the hobgoblin so I can install things from websites easier. And stop it from infecting me with viruses! Can't you guys program a computer right?
Re:Caveat (Score:5, Insightful)
Re:Caveat (Score:5, Funny)
While that read likes perfect valid english to me, knowing things that are irrelevant to my daily life and all, most people would NEVER understand that statement.
A clearer statement like "It is probable that a VIRUS is trying to install on your computer, do you want to STOP this VIRUS from installing" with a "yes" and "no" for the check box with "yes" the default.
Re:Caveat (Score:5, Insightful)
A better title for this article would have been "Every application vulnerable to attack due to bug in either Firefox and/or Sun's JRE".
Re:Caveat (Score:5, Informative)
There is nothing stopping the spyware company from getting a valid signature and packaging it. It happens all the time in IE. In fact, most of the spyware installers out there for IE are digitally signed.
Using Java, they could easily socially engineer you to download and trust this thing, use Java to find out what OS your running, download spyware/rootkits/etc for your particular PC OS and own your box totally independant of IE.
A lot of the reason why Firefox is so safe is because it doesn't support ActiveX and prompt you all day to install the legacy scumware stuff. If it did support ActiveX in any way it would be prompting you just like IE would, People would click on yes just like they do in IE, and people would get owned just like they do with IE. Since it supports Java, however, they will just gamble that you have Java and get you to do the same thing they were doing in ActiveX, only with Java instead.
The Spyware writers know that 99% of computer users dont know what they are doing and they exploit that, Pure and simple, And there's nothing that Bill Gates, Linus Torvalds, or Steve Jobs is going to do about that. This is what Kevin Mitnick has been preaching for some time now, that social Engenering is the hackers favorite tool, and until anyone who writes internet enabled code understand that, there's going to be a really big security problem in the future.
No problem. (Score:5, Interesting)
Oh, well, it's no problem then. It's not like anybody uses THAT...
who fixes it? (Score:3, Insightful)
Re:who fixes it? (Score:3, Funny)
Is it still a security hole? (Score:5, Insightful)
Re:Is it still a security hole? (Score:5, Insightful)
Yes, it does - it's exploiting their stupidity, not only the program's vulnerabilities. The vast uneducated public, who will jump at the chance of free blue monkeys giving them a firewall to stop their computer broadcasting an IP address that can be seen by hackers to steal your children, will be the ones who will get infected by exploits like this. And it's not as if you have to open a zip, enter a password and run an exe to get infected with this, just a simple "Yes" click - and most users do that just to make the dialog box go away.
The ShellBlock vulnerability in Firefox was considered an 'exploit' - like this case, it was doing the right thing (passing shell:// commands to Windows), but could be exploited.
Re:Is it still a security hole? (Score:3, Funny)
exploit = no user input required other than visiting website
users-doing-something-dumb = clicking yes to a security warning (that's teh best name I can come up for this) or something more brain intensive
Re:who fixes it? (Score:5, Insightful)
Re:who fixes it? (Score:5, Interesting)
Re:who fixes it? (Score:5, Funny)
Re:who fixes it? (Score:4, Insightful)
Re:who fixes it? (Score:5, Insightful)
The downside, of course, is that there would have to be some sort of master server for storing/relaying this information... and that'd be quite a task.
The whole "signed"/"unsigned" model is semi-broken, at least to the non-geeky. They have no idea what that means. I also think the dialogs should be severely re-designed and re-worded..
Same old story (Score:5, Funny)
I have to imagine Slashdot's bandwidth saving would be enormous.
Re:Same old story (Score:5, Insightful)
Re:Same old story (Score:4, Informative)
Re:Same old story (Score:4, Insightful)
How about IVABUG? (Score:4, Funny)
Alternatively, there's the more generic ESF - (E)xploitable (S)ecurity (F)arce. This is the exact inverse of ESP, in that it is something that should have been predicted but wasn't, rather than the other way round.
For bugs from the (usual) Corporate culprits - Microsoft, Sun and IBM, I suggest that these be called ISMs.
We already have one (Score:5, Funny)
"Monday".
Remove IE..... (Score:5, Funny)
Re:Remove IE..... (Score:3, Informative)
Actually, it's [vorck.com] possible [stopie.com]. It's not particularly easy, but it can be done.
Bogus Headline (Score:5, Informative)
There _is_ a dialog box, since the applet is unsigned. I tried signing it with my certificate; it installed itself without prompting. I believe it uses some sort of JRE exploit.
Re:Bogus Headline (Score:5, Informative)
Re:Bogus Headline (Score:5, Insightful)
They can't, unless the user clicks "I allow this applet to modify files on my harddrive. Warning, this is unsafe, only do this with applets coming from a source you trust."
This isn't a java exploit anymore than a downloaded executable is an OS exploit.
What do I need? (Score:5, Funny)
What do I need to be able to project my fears of infection adequately?
Misleading title (Score:5, Insightful)
Re:Misleading title (Score:5, Insightful)
Java isn't to blame here, its honored the unrestricted access permission given to the applet by the user.
IE isn't even to blame here (!), its just a target. Once the applet is running without restrictions, it can do anything any other executable could do.
This "exploit" could be delivered via some other JavaPlugin-enabled browser and modify any other peice of software installed on your box.
The blame here, at least in the case of the original article on Vital Security would appear to be the author experiencing a profound "curiosity killed the cat" moment.
In other news (Score:3, Insightful)
Not just browsers. (Score:5, Informative)
Re:Not just browsers. (Score:5, Insightful)
Any time a website asks you to trust them to install something on your computer, you should probably say no. If you say yes, you are going to get owned 99% of the time.
This can already happen (Score:5, Interesting)
Re:" IE can already be infected" (Score:4, Insightful)
Why are the authors not prosecuted?
Re:This can already happen (Score:3, Informative)
But you still need IE. (Score:5, Insightful)
Really? The microsoft website oftens blocks browsers other than IE from downloading updates and whatnot.
You CAN'T just remove IE. You need it. Just try to update office on firefox for example:
http://office.microsoft.com/en-us/officeupdate/de
Re:But you still need IE. (Score:5, Insightful)
You can't use Firefox to automatically update Office, but you can manually download patches with Firefox. However, you can use the Microsoft Software Update Tool (formerly Internet Explorer) to automatically find updates.
Re:But you still need IE. (Score:4, Insightful)
No problem. Office XP SP 3 coming right up!" [microsoft.com]
And here [microsoft.com] is Windows XP Service Pack 2.
Both found and downloaded via Opera. What you don't get is Automatic Update. Can't argue that, but it's not like the updates you need aren't accessible without IE.
The Four Rules of Browsing the Net on Windows (Score:5, Funny)
2. You can't break even
3. You can't get out of the game
4. No matter how hard you shake it, the last drop always rolls down your pant leg.
What? (Score:3, Interesting)
So by using a browser that this exploit is not aimed at will infect part of the operating system your trying to get away from because everything is so integrated with no end user control.
How is this bad for firefox? If anything its a big black eye for MS and integrating IE into the OS.
Let me get this straight... (Score:5, Informative)
So, the attack happens through Sun's JVM, affects IE, and consequently has nothing to do with Firefox, which was inserted into the article for maximum troll capability.
Re:Let me get this straight... (Score:3, Informative)
Java Exploit (Score:3, Insightful)
Re:Not a Java Exploit (Score:5, Informative)
Signed applets don't run inside a sandbox. A signed applet can do anything that any other executable program can do; including formatting your disk or installing spyware. They are not any safer than programs written in C or assembly language.
--Steve
Can't resist (Score:5, Funny)
I'm not defending IE by any stretch... (Score:5, Insightful)
Trend Micro (Score:3, Informative)
What scares me most, is that FF didn't ask to download the file, it just downloaded the JAR into the cache folder.
Non-issue (Score:3, Insightful)
Time for a new security model (Score:5, Interesting)
I keep wondering if it wouldn't be better to have something like VMWare a standard part of a consumer OS. You would intantiate a VMWare-type virtual machine, preloaded with your Web browser, email client, etc., for all external communications. You would leave your "real machine" with no Net connection, but use it for other tasks that didn't need a live Net connection. Attacks from the outside would have no way to damage anything other than a virtual machine. If it got screwed up or infected, even by your kids playing with it and saying "Yes" to download offers, you'd just delete it and instantiate a new one.
You'd be able to reach from the real machine into one of the VMs and retrieve a file that you were satisfied was safe, but there would be no way for a VM to export (VMWare is like this). There would be occasions when fetching an infected file would infect your real machine, but the overall incidence of external damage should be significantly reduced by this approach and recovery from screwups would be quick and easy (at a cost of performance for activities done from a VM).
It's just a thought, but it seems as though this would just be an extension of the Unix notion of having root power but doing most of your work from a non-root account just to be safe.
Re:Time for a new security model (Score:3, Insightful)
Ironic that Java, famous for its sandbox, seems to be the door through which this intruder enters.
Ah I was waiting for something like this!
The sandbox works just fine, thanks.
If you click "Yes" to the question: "This applet wants to access the network and your local disks. Are you sure you want to let it do this?" then, you are in trouble, because you just answered the question "Do you want to give up all security provided by the Java sandbox by running this applet that is not even signed correctly"
Re:Time for a new security model (Score:3, Interesting)
Social engineering, but still a problem... (Score:5, Insightful)
If allowing an unrestricted Java applet to run is just as dangerous as installing and running an application, then the dialog box should reflect that. If Firefox is going to make you manually approve sites that you're going to allow XPI installs from, and *then* run a countdown in the warning dialog, they need to be at least as thorough about any other operation that takes you outside the sandbox.
EVERY PROGRAM is vulnerable (Score:3, Insightful)
If a user downloads an untrusted applet and grants it unrestricted security access, EVERY SINGLE THING ON YOUR COMPUTER IS VULNERABLE. Just because this particular exploit attacks IE, doens't mean that the exact same applet couldn't be altered to infect Firefox of even something completely different like Adobe Photoshop.
Some FUD here? (Score:3, Interesting)
In the meantime watch out for FUD. MS will say Sun and Mozilla are bad and IE is good. You never say in business: "I told you so", but MS will. WATCH
OUT! As usual there is a spin on this that seems to favour Microsoft. Don't buy it.
There are some 'unfixable' bugs in all Windows and MS products due to the "I want to be different factor". Being able to completely remove IE (use Firefox, Opera, etc.) would go a long way in reducing the threat. Removing "Media Player" (use mplayer) would help a little more. The real truth however is that Windows is flawed by design and can never be fixed in an acceptable way.
If you are unfortunate enough to be using Windows, please look at the track record, including all the lies you've been told and make an informed decision. Get Solaris 10 if you wish, I'll stick with FreeBSD. Linux has a range of distros that range from 'true hardcore' to 'clickity-click' and even have a dual boot. Sooner or later, you are going to have to make the transition. You decide when.
STOP ARGUING FOR A FIX (Score:3, Insightful)
At some point, the user must take some responsiblity for their own security.
System doing something unintended, without user notification or permission? Security exploit.
System doign something unitended, after user notificition and approval? Idiot exploit.
The ONLY way to stop idiots from being exploited to take the permission/aprroval step out of their hands, and give it to someone else.
Either the sys-admin, or the OS manufacturer.
The sys-admin route is already possible. We don't need anything else for that. These boxes are secure, but a giantic pain to work with, depending upon what you users needs/wants are.
The OS manufactuer route. This is the route Microsoft would love to push us all.
Dump Java. It's insecure. User our New(TM) Palladium(TM) Super-Secure Trust-In-Our-Magic-Decision-Making Signed Certificate, only MS(TM) software ActiveSecureX.
The only way to prevent (idiot) exploits such as this one, is to prevent any 'unapproved' application installs.
Ask for that, and you're asking for Trusted Computing(TM).
And I'll bet ten grand that someone will figure out how to exploit THAT, and then you'll have an pwned box that is unfixable.
This is Microsoft. Even though your users make DAMN STUPID decisions on what to install (Press Yes to Install MySpware Super-Happy Plugin!), Microsoft has proven itself to be just as, if not far more vulnerable.
this is pure fud (Score:3, Insightful)
Social Engineering? (Score:3, Insightful)
It's been a long time since I worked with Java code, but I recall that once the user tells Java he "trusts" the code, (signed or unsigned), he opens himself up to a number of risks, including accessing the local filesystem and making network connections to hosts other than the host from which the applet was downloaded. This would, of course, include HTTP calls, probably using the installed default browser. I don't know about executing local programs.
So, while this may have been an exploitation of MSIE, the fact remains that it would never have occurred had the user not agreed to trust the applet. This is why it's important for developers and sites to sign their code, but more importantly, it shows the importance of embedding into end-users' brains: "Never, never, never click 'yes' when the application tells you the code is untrusted."
WTF? (Score:4, Insightful)
This sounds like a FUD factory somewhere is trying to come up with vulnerabilities against Firefox. Interesting that the best they can come up with so far is an exploit of IE. "Hey, wait, guys, we can make this one run with another browser! Let's run with that!"
The Giant DUH! Award (Score:5, Insightful)
At the end of his blog, the author says that the purpose of his article is NOT to point out the social-engineering aspects of this exploit, but to point out that "most spyware installs occur when someone clicks "yes" to something they shouldn't have."
DUH!!!! What a total maroon.
Let's review. The user is presented with a dialog box that warns them, 3 times, that this thing can't be trusted, but they click 'Yes' anyway.
This is not a Firefox exploit. It is not an IE or Java exploit. It is a USER STUPIDITY exploit.
McAfee VirusScan (Score:4, Informative)
Additionally, Firefox automatically blocks the installation with its pop-up blocker, so it appears that, with my settings (which are not terribly restrictive), I have a double layer of security preventing me from even getting to the point of clicking "yes" to the installer.
Not too big a deal, this, but it is good to know that following basic security procedures like keeping virus definitions up to date and using the pop-up blocker correctly can make it a lot easier to avoid the kind of crap this story deals with. I do realize, however, that a great many people do not follow these guidelines, and that that is the point of the story.
But I would like to point out that it seems that I am not quite as vulnerable as this story makes it appear that I will be (when running Windows). And, of course, if I flip over to my Fedora Core 3 partition, this problem goes away entirely.
And yes, I am using the Sun Java Runtime.
B
Re:Ahem... (Score:5, Insightful)
Firefox warns the hell out of you about allowing a signed, but unverifiable applet from installing itself. Look at the screenshot, there's three separate big warning images.
If the web browser lets you download and install software, even if it warns you that doing so might be dangerous, the author contends this is a bug. That's silly. That's the *point* of a web browser. To download content from the internet.
Re:Ahem... (Score:3, Interesting)
Re:Java (Score:5, Informative)
Java is behaving in exactly the manner it's designed and advertised to act.
Re:Java (Score:5, Informative)
No. The user unlocks and opens the door, THEN the exploit escapes.
All the systems are working as designed. It is the user who opens the door.
Re:IE? (Score:5, Informative)
Re:IE? (Score:3, Insightful)
Re:Not a browser issue and not a Java issue (Score:5, Insightful)
The JRE pops up it's "Warning" dialog, like its supposed to . It displays to the user that it cannot verify who signed this, that the cert is out of date etc, like its supposed to . It displays a warning reccomending that you NOT say yes and install the applet, like its supposed to . So when you ignore all of that and say yes, you deserve to get infected. I mean, what do you want, another dialog asking "Are you sure?".
I mean 3 big yellow exclaimation marks? I've never seen that even in the most unstable of development environments.
Oh and BTW, if you say yes to a Java applet in this instance, it runs as a local application without a security manager. This is not a 'hole' it is what it is supposed to do. When you say yes, that's what you're saying 'yes' to.
Now if people were taught not to do that the same way their are taught not to run arbitrary files sent to them via e-mail, this wouldn't be a problem. (That's sarcasm BTW)
In the end, the problem is the goof behind the keyboard that is willing to say 'Yes' to run applications they don't know about and that the JRE itself warns them at least 3 times in 3 ways not to run.
How do you defend against that?
Re:Not a browser issue and not a Java issue (Score:4, Funny)
How do you defend against that?
Clearly, all software should only be installable from floppy disks, and not from over the Internet. That way, script kiddies would have to send people their exploits by snail mail, with a note attached that reads:
Still, I'm sure there'd be a few who did...
Re:If you are using Firefox, you won't need to use (Score:4, Informative)
Re:The assumption was that Java Applets can't 0wn (Score:5, Informative)
The idiot said yes anyway.
Now, if this happened without those warning, then there would be an issue. But that is not the case. The JRE functioned as it was designed to - to allow for extra privileges to be granted to an applet under certain circumstances and to vigorously warn the user and present them with information before hand. It was the user that ignored the warning, not the JRE.
Note to self: never get advice from "Vital Security" about security because anyone that would ignore that kind of warning from a site they did not know is definitely NOT a security professional
Re:The assumption was that Java Applets can't 0wn (Score:3, Informative)
It is not true that they can't 0wn your box.
In fact, whoever told you that should be shot.
Java is very powerful, and can do many, many interesting things.
If it works properly (i.e. no exploits), than a Java applet will not be able to silently 0wn your box.
It'll request permissions, and you'll have to approve it.
There are two possible circumventions.
1. Set system-wide permissions too low. By default, they come pretty restrictive. I would not suggest changing the