Massive IE phishing exploit discovered

ZDNet ^ | December 17, 2004 | Dan Ilett

[holymoly]

Even SP2 versions of Microsoft's Internet Explorer are vulnerable to a spoofing exploit published yesterday.

A vulnerability researcher posted details of a dangerous Internet Explorer (IE) flaw on Thursday that allows phishers to spoof Web sites more realistically than ever before.

According to security company Secunia, Paul from Greyhats -- a research group -- has published details of a vulnerability that can be exploited to spoof the content of any Web site.

Using the exploit, scammers are able to manipulate all versions of IE, including Windows XP SP2 -- the latest and most secure version of the browser -- and spoof the URL and SSL signature padlock located at the bottom of the browser screen.

The vulnerability is caused by a cross-site scripting vulnerability in the DHTML Edit ActiveX control, but because the flaw is within the browser, it can be used against any Web site, Secunia said.

"That is huge," said Thomas Kristensen, chief technology officer for Secunia. "When you cross-site script a Web site, the user can’t see that anything unusual is happening. The URL looks like it's a legitimate site and if you go to the SSL padlock, it will show a certificate for the site even though it is controlled by malicious scripting."

"The malicious Web site can control what is seen in the address bar. People still don't realise the significant impact of cross-site scripting. This is the vulnerability that phishers and scammers have been looking for. You could also steal cookies from any Web site," Kristensen warned.

"The most likely outcome is a phishing email, where users click on a link, then open the browser. They then briefly see the URL of the malicious Web site, and then see the scam Web site," Kristensen added.

Nick McGrath, Microsoft's security spokesman, and the Microsoft UK security team was unavailable to comment at the time of writing because they are in the United States. The company has previously frowned upon researchers who have posted exploits without letting it know first.

Kristensen said he was unsure why Paul chose to publish the exploit before informing Microsoft. Secunia has developed an exploit test on its Web site which is available for download.

Secunia has labelled the vulnerability as "moderately critical" because people cannot use it to access systems.

[holymoly]

Alternatives to Microsoft Internet Explorer:

Mozilla/Firefox (Open Source/Freeware)
Opera (Shareware)
Off By One (Freeware)

[Dog Gone]

Wonderful

[frog_jerk_2004]

Firefox - The BEST!

[frog_jerk_2004]

IE - Just Say No!

[Terabitten]

That's why I use FireFox.

[ShadowAce]

Browser Ping

[wolficatZ]

I didn't realise my google home page had been hijacked to a google clone..www.about.blank.org.

Sneaky. And I have tons of protection running.. Hrmmm

[Fatalis]

FYI

[DCPatriot]

Just changed from IE to Firefox....surprised (not really) to see that the default homepage is GOOGLE.

[Bloody Sam Roberts]

Firefox - The BEST!

[holymoly]

Just changed from IE to Firefox....surprised (not really) to see that the default homepage is GOOGLE.

Change it.
Firefox Help: Options

[KoRn]

"Just changed from IE to Firefox....surprised (not really) to see that the default"

Now that you have changed to Firefox, go to this thread to help you out.... if you are on a Broadband Internet connection.

How To Speed Up Firefox (Helpful Vanity)

[wouldilie]

I've been using the Avant browser and really like it. I prefer it to Firefox and Mozilla because a lot of the plugins that I use work with Avant and not Firefox or Mozilla. But I never see Avant discussed when people talk about security vulnerability. Does Avant have the same problems as IE or is it more immune??

[holymoly]

Does Avant have the same problems as IE or is it more immune??

As I recall, Avant runs on the IE engine (it requires IE to work).

The browsers I listed are all stand-alone.

In my opinion, if you're going to break with IE, it should be a clean break.

[Graybeard58]

I had the "about blank" problem too until I switched browsers. Any time I rebooted I got "about blank" as my home page. I could change it but it would always come back upon rebooting. I finally got rid of it but I have no problems at all using netscape 7.1 browser.

[RichardW]

I don't believe a browser change will help here although I use Firefox. If the e-mail comes in and you click on it, you will be redirected. I got one the other day and observed the address and it definitely not was from ebay which allegedly needed to "update" my credit card information. Be aware, be very aware.

[Zman]

All Hail KoRn!

[ShadowAce]

I don't believe a browser change will help here although I use Firefox.

One extension that would be helpful here is the Spoofstick extension. It tells you the real URL of the page you are on.

[holymoly]

I don't believe a browser change will help here although I use Firefox.

From the article:
"The vulnerability is caused by a cross-site scripting vulnerability in the DHTML Edit ActiveX control"

I still run a vesion of Mozilla, but I believe that, like Mozilla, Firefox does not use ActiveX.  (I don't know about Opera.)  "Off By One" uses no plugins, java, etc., and so is the most secure browser available.

This and other articles I've read state this is a MSIE-only flaw.

[IamConservative]

I have current IE 6, Windows Xp w/ SP-2. The Secunia test shows my IE browser as vulnerable. I also have Forefox, which I use exclusively for browsing on the same machine - Firefox is not vulnerable. I won't open the test page at all.

The only reason I keep IE is that many things exclusively open IE to display content.