Posted on 01/28/2004 1:10:12 PM PST by Salo
New Explorer hole could be devastating Browser users could be fooled into downloading executable files
By Kieren McCarthy, Techworld.com January 28, 2004
A security hole in Microsoft Corp.s Internet Explorer could prove devastating. Following the exposure of a vulnerability in Windows XP earlier this week, http-equiv of Malware has revealed that Explorer 6 users (and possibly users of earlier versions) could be fooled into downloading what look like safe files but are in fact whatever the author wishes them to be -- including executables.
A demonstration of the hole is currently on security company Secunias website and demonstrates that if you click on a link, and select Open it purports to be downloading a pdf file whereas in fact it is an HTML executable file.
It is therefore only a matter of imagination in getting people to freely download what could be an extremely dangerous worm -- like, for instance, the Doom worm currently reeking havoc across the globe.
However what is more worrying is that this hole could easily be combined with another Explorer spoofing problem discovered in December.
The previous spoofing problem allowed Explorer users to think they were visiting one site when in fact they were visiting somewhere entirely different. The implications are not only troublesome, but Microsofts failure to include a fix for the problem in its January patches has led many to believe it cannot be prevented.
If the same is true for this spoofing issue, then it will only be a matter of time before someone who thinks they are visiting one website and downloading one file will in fact be visiting somewhere entirely different and downloading whatever that sites owner decides.
We also have reason to believe there is no fix. It may be that todays flaw is identical to one found nearly three years ago by Georgi Guninski in which double-clicking a link in Explorer led you to believe you were downloading a text file but were in fact downloading a .hta file.
In both cases, the con is created by embedding a CLSID into a file name. CLSID is a long numerical string that relates to a particular COM (Component Object Model) object. COM objects are what Microsoft uses to build applications on the Internet. By doing so, any type of file can be made to look like a trusted file type i.e. text or pdf.
Guninski informed Microsoft in April 2001. The fact that the issue has been born afresh suggests rather heavily that the software giant has no way of preventing this from happening.
So how bad could it get? Just off the top of our heads -- suppose someone set up a fake Hutton Inquiry site today with a link to the reports summaries -- how many people across the U.K. would download a worm this afternoon? And imagine the computers it would end up on.
The possibilities are endless, and since both spoof issues appear to be unfixable, it must surely place a big question mark over Explorers viability as a browser.
The advice is to avoid this latest hole is always save files to a folder and then look at them. On your hard drive, the files true nature is revealed. But this advice is nearly as practical as Microsoft telling users not to click on links to avoid being caught out by the previous spoof problem.
All in all, it does not look good. Not good at all.
What makes you say that? It's no different than things were in 2003...or 2002...or 2001 (Nimda and Code Red, anyone?) or 2000...1999...1998...et cetera, ad nauseum.
Huh...and Steve Ballmer says everything would be fine if security researchers would "just be quiet."
Explorer | ![]() |
|||
Netscape | ![]() |
|||
unknown | ![]() |
Actually, that's not quite the whole of it. What makes an OS a target is not its popularity, but the ease with which it can be readily exploited.
Considering that Microsoft has been a known target for six years and it's still vulnerable to these issues shows the hazards of putting convenience ahead of security. By making things more convenient without thoroughly-audited code review, we're most assuredly going to be plagued with these silly viruses, trojans and worms for decades to come.
Why Microsoft doesn't address this core issue is simple. Microsoft doesn't hold itself accountable for its p!ss-poor security. Instead, Microsoft blames the hackers and the consumers.
You think a car manufacturer would stay in business long if it kept making cars that could be hijacked with a Radio Shack DIY electronics kit? You think a car manufacturer would stay in business long if it kept blaming Radio Shack and its consumer base for the hijackings? I personally doubt the American consumer would stand still for it.
...but for some reason, when the same thing happens on the digital level, the American consumer buys it; lock, stock and steaming, stinking barrel.
If this exploit can be inserted into an HTML-formatted email, it could be spread the same way as the fdic.gov scam (which used the URL spoofing exploit).
Send out a bunch of emails, with a "PDF" link to a compromised webserver somewhere (or even one of the many "zombie" PC's). Entice the recipient to open the "PDF", but instead download and run a script that compromises the system. Finish up by actually loading and displaying a PDF file.
However, I don't know for sure if an HTML-formatted message is vulnerable to this exploit.
Virus writers will guess that the user is Admin and hit 80% of all home XP users correctly, no?!
He actually makes a very good point. Security researchers would be doing a much greater service to society if they submitted their findings to Microsoft for private correction so that the patch could be released before the public was even aware the hole had been found. That way, you got the patch before any of these foreign hackers were attacking you.
And it's always these foreign "security firms" that open source the exploit if not the viral code itself to the general public leaving Microsoft in a "you have to be kidding, who are you supposedly helping here" position, one that certainly seems understandable.
However some feel that the open source release of viral code before notification of Microsoft or other vendor is a positive thing. There are as we've come to learn those that wish as much ill harm on Microsoft as possible, and there is also a group that feels the virtual terrorists are already pulling out all the stops to get viral code in effective use by open sourcing it to the internet, but that ultimately that has helped the overall security of the internet by already requiring the fastest possible responses to emerging threats.
I disagree with anyone who supports publicly releasing exploits much less open source code of viral technology before vendor notification, as they are crossing the line between being a white hat hacker and a black hat one.
Certainly possible, and hackers can never be underestimated (can't say that enough), but a single serverhost attack is never going to infect millions of systems, not unless it was hosted overseas at a server farm or something, but then you have latency issues and the ability to block the requests at the major ISPs. However those sorts of attacks could be the next wave, as these anti-American hackers are relentless in their pursuit of causing us harm.
Microsoft rightly blames the hackers but where have they blamed "the consumers"? And Microsoft certainly bears the responsiblity of their product, but the fact is until a hacker exploits any vulnerability no crime has been committed. Microsoft is legally in the clear, and they must face their consumers (who I still don't remember them blaming for hacker attacks) in the free enterprise market, something they seem to be dominating with reports of record profits this week.
I think a better description of Ballmer's position is he wants OFFICIAL law enforcemnt in charge of these events. Using your own gun analogy, he would prefer the "specific technical details" of the crime scene to be more in relation to the investigative work of equivalent "CSI" units that are publicly funded but keep their evidence to themselves.
The development of the Homeland Security department is a good step in that direction, and while highly criticized and currently limping as any new huge government agency would be, it will eventually prove essential in dealing with these virtual bandits.
Yep. During the last major blow-up thanks to Microsoft's lousy security, they blamed administrators and users alike for not upgrading their systems. Don't you read their press statements?
That is precisely the reason why no-one in their right mind should trust Microsoft. Anyone who says otherwise is just a shill for Redmond.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.