IE Flaw Exploited (Internet Explorer has become an even bigger security risk)

PCWORLD ^

[Happy2BMe]

E Flaw Exploited

Security firm identifies exploit technique for known browser hole.

Matthew Broersma, Techworld.com Friday, January 07, 2005

Internet Explorer has become an even bigger security risk--even under Windows XP SP2--with the publication of a new and extensive exploit.

Advertisement

Security researchers have warned that the exploit, which takes advantage of known loopholes in SP2, could allow an attacker to run script code on a user's system via a specially crafted Web page.

Known Hole

The holes involved have been known publicly for more than two months, but previous exploit techniques required the user to take actions such as dragging an image from one part of a Web page to another. The new exploit--a demonstration of which has been published by Danish security firm Secunia--is fully automated, requiring the user only to visit a Web page in Explorer. Other browsers and operating systems aren't affected.

"There now is a 'reliable' working exploit that can compromise an SP2 system by just visiting a Web page," says Secunia chief technology officer Thomas Kristensen. Secunia has raised its warning level to its highest, "extremely critical."

Security group Greyhats warned of the new type of exploit in an advisory in late December. Secunia then upgraded its advisory to "extremely critical" and published a demonstration based on a proof-of-concept by a researcher known as ShredderSub7. US-CERT, the U.S. computer security alert organization, has also published an advisory on the issue.

Issues Identified

Microsoft has warned users to turn off IE's 'Drag and drop or copy and paste files' option as a partial solution. The danger can also be lessened by setting security levels to high for the 'Internet' zone or, as several security firms pointed out, using another browser.

The exploit is the first major weakness in SP2 to have surfaced. Microsoft is promoting SP2, released last summer, as a solution to many of Windows' worst security problems.

Researchers have identified three separate but related issues in IE: a bug in the validation of certain drag-and-drop events, and zone restriction errors with embedded HTML Help ActiveX controls. The first problem can be avoided by disabling the 'Drag and drop or copy and paste files' option, but the new exploit doesn't rely on this particular bug, researchers said.

The HTML Help control exploit bypasses one of SP2's key features, the 'Local Machine' zone lock down, designed to make it far more difficult for attackers to execute script on a local system.

[Happy2BMe]

"The HTML Help control exploit bypasses one of SP2's key features, the 'Local Machine' zone lock down, designed to make it far more difficult for attackers to execute script on a local system."

=========================================

I use FireFox.

[1FASTGLOCK45]

I use Firefox also.
Msoft would be better off scrapping explorer and rebuilding a simpler one from scratch..... Wait, isn't explorer part of windows and its 1 unit together.?

[SubMareener]

Then you both will be interested in these posts:

Firefox flaw raises phishing fears ^
	Posted by KwasiOwusu On News/Activism ^ 01/07/2005 6:06:33 PM EST · 219 replies · 2,694+ views ZDNET ^ | 1/7/2005 | Ingrid Marson A vulnerability in Firefox could expose users of the open-source browser to the risk of phishing scams, security experts have warned. The flaw in Mozilla Firefox 1.0, details of which were published by security company Secunia on Tuesday, allows malicious hackers to spoof the URL in the download dialog box that pops up when a Firefox user tries to download an item from a Web site. This flaw is caused by the dialog box incorrectly displaying long sub-domains and paths, which can be exploited to conceal the actual source of the download. Mikko Hypponen, director of antivirus research at software...
55 Ways to Hack Mozilla's Firefox ^
	Posted by Bush2000 On General/Chat ^ 01/07/2005 2:07:43 AM EST · 82 replies · 702+ views CanWest News Service ^ | Sarah Stables Solid reputation paints bull's-eye on Mozilla's Firefox Free Web browser is known to be virtually impregnable to viruses and pop-ups, but it isn't hack-proof Sarah Stables CanWest News Service Thursday, January 06, 2005 A reputation for being virtually impregnable to viruses, pop-ups and other nasties of the Web is driving millions of fed-up computer users to ditch Internet Explorer in favour of the supposedly hack-proof alternative, Firefox, Mozilla's free Web browser. There's only one problem: the upstart isn't hack-proof at all. The evidence is at K-Otic.com, a Web site where hackers and security experts post their latest "exploits" - coded...
Mozilla (Firefox & thunderbird) Vulnerabilities Identified ^
	Posted by itsamelman On Bloggers & Personal ^ 01/06/2005 2:10:03 PM EST · 7 replies · 218+ views Infoworld ^ | Jan. 6, 2005 | Matthew Broersma, Techworld Mozilla vulnerabilities identified Most serious bug affects all versions of Mozilla prior to 1.7.5 and could result in system crash By Matthew Broersma, Techworld January 06, 2005 Users of the Mozilla and Firefox browsers and the Thunderbird e-mail client may be vulnerable to flaws that could allow an attacker to spy on or take over a system, according to security researchers. The most serious bug affects all versions of Mozilla earlier than 1.7.5, and could result in a system crash or the execution of malicious code, the Mozilla Project said. A boundary error in the way Mozilla handles "news://" addresses...
Firefox phishing vulnerability discovered ^
	Posted by ShadowAce On Bloggers & Personal ^ 01/05/2005 1:21:20 PM EST · 59 replies · 709+ views ZDNet UK ^ | 05 January 2005 | Ingrid Marson A newly discovered flaw in Firefox could allow cybercriminals to take advantage of Web surfers A vulnerability in Firefox could make users of the open source browser more likely to fall for phishing scams. The flaw in Mozilla Firefox 1.0, details of which were published by Secunia on Tuesday, allows malicious hackers to spoof the URL in the download dialog box which pops up when a Firefox user tries to download an item from a Web site. This flaw is caused by the dialog box incorrectly displaying long sub-domains and paths, which can be exploited to conceal the actual source...

[Izzy Dunne]

I use Safari.

[1FASTGLOCK45]

Yes i have seen them. :|

[Happy2BMe]

"Wait, isn't explorer part of windows and its 1 unit together.?"

==============================================

To answer that question, simply go to 'EXPLORER' (not the Internet Explorer - the file explorer).

Now, at the ADDRESS\FILE PATH enter in a known good url (e.g., www.freerepublic.com).

Lights coming on?

[Happy2BMe]

IE is no safer than FF.

IE is tied much closer to the OS than FF is.

True, virus and trojan programs are coded towards IE instead of FF.

The only way to ensure you are not exposed to scams, spam, viruses, trojans, malware, spyware, and breach of security is to STAY OFF OF THE INTERNET.

Period.

[Happy2BMe]

What browser do you use?

[backhoe]

 

Things you need--(all FREE)
Anti-Virus
AVG Anti-Virus version 7 (free) release available...

 Avast
Firewall
Kerio(Direct Download) Zone Alarm

 If are using zone alarm it may slow your PC. Try Outpost Firewall http://www.agnitum.com/products/outpost or Sygate Firewall http://www.sygate.com/ both have FREE and Pro versions and are heads above ZA.
Misc.
IE Spyads SpywareBlaster Spyware Guard
Windows Update- you must keep updated, it is the start of a secure system-
get all CRITICAL Updates

Things you want(Still Free)
 

  I use Firefox PR1 and IMHO, beats the sox off MS Explorer. Life is good with tabs. Click the link and give it a try.

Ad-Aware
Spybot S&D

SpywareBlaster
MS MVP Hosts file

Mike Lin's Homepage and get the Startup Control Panel and Startup Monitor tools.

 

The best forum for malware removal:

-SWI Forums-

---

...and let me add these personal observations:

Yes, Linux or Mac have fewer problems, but some of us don't have that option, so remember that the first line of defense is to keep your OS updated. Really.

Don't use IE except for sites that refuse other browsers. I like Firefox, some folks like Opera, but even that old copy of Netscape you have on a free disc will probably give you less grief than IE.

Use a hardware firewall. Most modern LANs and some digital modems feature them.

Use a software firewall- so you'll know when your PC tries to "ET phone home!"

Keep your antivirus updated and use antispyware scans. FWIW, Microsoft's ( revamped Giant ) new freeby caught stuff ad-aware and search & destroy had missed.

[DYngbld]

IE will continue to be exploited as long as the masses use it. If the majority of Internet users started using Firefox, netscrape, or any other XYZ Browser, then the low life scum that have nothing better to do with there talents then try to rip people off would start hacking that browser as well. There is no perfect "Hack proof" code.

[Quix]

Microsoft is insufferable . . .

except that it's required for a number of us in education.

Their cheeky, greedy hostility to their customers is hideous and legendary.

They improve the window dressing occasionally.

Their software still seems to be a kudged together bunch of problems more than solutions.

They are insolent, arrogant, dismissive and horridly unfriendly to their customers--as is their software.

Why are you such a fan?

[Quix]

Thanks much.

[nmh]

bttt for later read.

[backhoe]

You bet. I found most of those links useful during my adventures with that browser hijacker last summer. Just used Avast to rid myself of "Korn32" which was sending my email to assorted spammers.

People who write or knowingly propagate this garbage should be triple-fined for downtime and publicly flogged.

[Happy2BMe]

"FWIW, Microsoft's ( revamped Giant ) new freeby caught stuff ad-aware and search & destroy had missed."

=============

Isn't that a BETA, and isn't M$ going to be charging a subscription fee for that?

[backhoe]

Isn't that a BETA, and isn't M$ going to be charging a subscription fee for that?

I think you are right on both counts. Still, I wouldn't mind paying for it if it gets the garbage out. Ad-aware and Spybot kept missing stuff on both home PCs that MS eliminated.

[PokeyJoe]

yes there is. It's called a "off" switch.

[DYngbld]

yes there is. It's called a "off" switch.

True.. OK you got me.
I use that line all the time.I'm slacking this morning. :)

[Maceman]

Kudged? Is that a word?

[Quix]

errrr, kludged.

cobbled,

piled,

tumbled,

thrown,

tossed,

mangled,

chaotically 'engineered'

loosely arranged,

blindly assembled,

junk yard collected,

tornado 'assembled,'

hurricane piled,

. . . . . . . . . . . 'together'

For all their vaunted IQ's, creativity and lofty credentials, the code writers at MS reportedly never became acquainted with the concept of tidy, efficient, concise programming code.

Worse, the whole operation seems to believe that customers' only rights and functions are to serve as blind, mindless, silent and ignorant cash cows for the firm.

Sheesh.