Posted on 01/28/2004 1:10:12 PM PST by Salo
New Explorer hole could be devastating Browser users could be fooled into downloading executable files
By Kieren McCarthy, Techworld.com January 28, 2004
A security hole in Microsoft Corp.’s Internet Explorer could prove devastating. Following the exposure of a vulnerability in Windows XP earlier this week, “http-equiv” of Malware has revealed that Explorer 6 users (and possibly users of earlier versions) could be fooled into downloading what look like safe files but are in fact whatever the author wishes them to be -- including executables.
A demonstration of the hole is currently on security company Secunia’s website and demonstrates that if you click on a link, and select “Open” it purports to be downloading a pdf file whereas in fact it is an HTML executable file.
It is therefore only a matter of imagination in getting people to freely download what could be an extremely dangerous worm -- like, for instance, the Doom worm currently reeking havoc across the globe.
However what is more worrying is that this hole could easily be combined with another Explorer spoofing problem discovered in December.
The previous spoofing problem allowed Explorer users to think they were visiting one site when in fact they were visiting somewhere entirely different. The implications are not only troublesome, but Microsoft’s failure to include a fix for the problem in its January patches has led many to believe it cannot be prevented.
If the same is true for this spoofing issue, then it will only be a matter of time before someone who thinks they are visiting one website and downloading one file will in fact be visiting somewhere entirely different and downloading whatever that site’s owner decides.
We also have reason to believe there is no fix. It may be that today’s flaw is identical to one found nearly three years ago by Georgi Guninski in which double-clicking a link in Explorer led you to believe you were downloading a text file but were in fact downloading a .hta file.
In both cases, the con is created by embedding a CLSID into a file name. CLSID is a long numerical string that relates to a particular COM (Component Object Model) object. COM objects are what Microsoft uses to build applications on the Internet. By doing so, any type of file can be made to look like a “trusted” file type i.e. text or pdf.
Guninski informed Microsoft in April 2001. The fact that the issue has been born afresh suggests rather heavily that the software giant has no way of preventing this from happening.
So how bad could it get? Just off the top of our heads -- suppose someone set up a fake Hutton Inquiry site today with a link to the report’s summaries -- how many people across the U.K. would download a worm this afternoon? And imagine the computers it would end up on.
The possibilities are endless, and since both spoof issues appear to be unfixable, it must surely place a big question mark over Explorer’s viability as a browser.
The advice is to avoid this latest hole is always save files to a folder and then look at them. On your hard drive, the file’s true nature is revealed. But this advice is nearly as practical as Microsoft telling users not to click on links to avoid being caught out by the previous spoof problem.
All in all, it does not look good. Not good at all.
Salo, I see now why you're confusing me. This is the IE hole thread, not the DOS of SCO one. ;-)
suppose I am a ceo. I can spend money to fix a hole or I can delay it until after the annual report so the stock goes up and I can execute my options and dump my stock for a huge profit. Hmmm.
But seriously, I think the bigger problem is the incentive to release beta code as product if you can fix holes later would be the bigger threat. There is a lot of pressure to release software before it is ready and your proposal would only encourage this practice.
BTW, good article link.
Which I never understood. If it gets to your inbox you don't necessarily need IE to inflict damage. Nor do mail-provided links guarantee remote hosts are available. For this thing to be the primary exploit method, users would be surfing infested websites. Which does occastionally happen like Code Red, but typically require "worm" like propogation, not "virus" like the current SCO attack.
But seriously, I think the bigger problem is the incentive to release beta code as product if you can fix holes later would be the bigger threat. There is a lot of pressure to release software before it is ready and your proposal would only encourage this practice.
Your comments seem anti-Capitalistic in nature. But companies like Microsoft would have to weigh the importance of risking it, and face the free enterprise music if they push the envelope. The face that same music by selling beta code. Those things will easily take care of themselves. The more important issue is to distinctly draw the lines between the good guys and the bad guys, which is very blurred right now.
Not necessarily. This exploit might be useful in HTML formatted email. And, once compromised, it would be relatively easy to install a daemon/server that would provide the download link for all email sent by that particular system.
Which does occastionally happen like Code Red, but typically require "worm" like propogation, not "virus" like the current SCO attack.
No, Novarg/MyDoom is a worm that uses email and p2p to propagate. It exploits breaches in security and user psychology, rather than piggy-backing on other programs.
Viruses insert themselves into legitimate programs, just like biological viruses insert their DNA into a cellular organism. Before the 'Net, viruses were spread in boot sectors of floppies or shareware being passed from person to person. They are relatively rare, these days.
It might, but what's the point, if you're in their inbox you're in their inbox.
And, once compromised, it would be relatively easy to install a daemon/server that would provide the download link for all email sent by that particular system.
There's a lot of holes in that theory. From dial in clients? Behind firewalls? Forget those working in your scheme right off the bat.
Novarg/MyDoom is a worm that uses email and p2p to propagate. It exploits breaches in security and user psychology, rather than piggy-backing on other programs.
It may be technically classified by some as a worm because of it's complexity, but it's still at it's heart an e-mail virus that requires user interaction to propogate. If you're running illegal software like Kazaa that's their problem. A more traditional "worm" is one that propogates competely by itself, exploiting something like a buffer overflow on an always on host.
"The largest cost will come from medium-to-small sized companies with 400 employees or less, said Andy Cummins, CEO of technology services firm U.S. Networks. "We think MyDoom will cost these companies $48,000 to $58,000 (each) to secure themselves from MyDoom,"
That, plus the fact that you usually need fewer admins for a Linux system and the actually non-existant sysadmin pay gap (source: Foote Partners, an independent IT salary research firm that doesn't do commissioned surveys), throws the TCO way towards Linux.
You originally wrote:
For this thing to be the primary exploit method, users would be surfing infested websites.
I was simply pointing out that surfing a website isn't necessary. The link can be delivered in email.
You should at least read your own posting that I responded to, so that you'll understand the point I was trying to make.
There's a lot of holes in that theory. From dial in clients? Behind firewalls? Forget those working in your scheme right off the bat.
The current Novarg/Mydoom worm is affected in a similar way: the backdoor installed on port 3127 also isn't accessible under the circumstances that you describe. But you're right, it would limit the propagation.
It would be interesting to know the percentage of broadband clients that have an effective firewall. Since Microsoft is finally enabling their firewall by default (in the next service pack of XP), that percentage will hopefully start to increase.
It may be technically classified by some as a worm because of it's complexity, but it's still at it's heart an e-mail virus that requires user interaction to propogate.
It's classified as a worm by:
It's classified as a virus by:
Symantec provides the most concise explanation of the difference:
Virus: A program or code that replicates; that is, infects another program, boot sector, partition sector, or document that supports macros, by inserting itself or attaching itself to that medium. Most viruses only replicate, though, many do a large amount of damage as well.
Worm: A program that makes copies of itself; for example, from one disk drive to another, or by copying itself using email or another transport mechanism. The worm may do damage and compromise the security of the computer. It may arrive in the form of a joke program or software of some sort.
I'll jump in here with a recommendation--and I think zeugma would recommend the same thing if I remember correctly.
I think I'll trust the Gartner figure over your generalizations. And I know first hand that Gartner is not anti-Microsoft.
Companies have already figured out that you need to quarantine executable/script/binary email attachments at the mail server
Thereby reducing the functionality of the whole system.
Their are also open source versions, if you're a cheapskate.
...if you have any appreciation for the value of money and want to increase profit for your company.
I've been using Thunderbird for email, which is the next generation mail client destined for Mozilla.
I also recommend that you install a flash extension killer. The one I'm currently using puts a big button in place of flash ads and apps. If you click the button, the flash plays, otherwise it doesn't. Cool.
Oh, I don't know. I hear constant refrains from the 'it's never microsoft's fault crowd that it's the consumer's fault for not patching their computer every day.
And now for our regularly scheduled anti-astroturfer post...
FreeRepublic is a conservative news and commentary forum that covers many topics every single hour of the day. If it's topical, and in the news, you'll find it here. One of the things I've noticed is, that if you look at the posting history of individual users, you'll notice that many tend to congregate around several different subjects. Sure there are always a few Johnny-one-notes, but even the ones who seem to post mostly about abortion because the subject is of intense importance to them, will occasionally find topics that diverge from this interest to comment upon.
Below, you will find the posting history of one FreeRepublic user distilled into an easily readable bulleted list. It begins at 11/18/2003, and ends today (1/26/2004). If you look closely, you will see a common thread that suffuses every single post - the position of the professional microsoft astroturfer. Never deviating from this theme, I give you golden Eagle
There you have it, 34 threads, and about 250 separate post, never deviating from the official microsoft propaganda sheets in even a single post for over 2 months.Also note: that there was not a single post on any other topic in those 250 posts. Astroturfing at it's finest.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.