Zero-Day IE Exploit In the Wild 239
Eric Sites writes to tell us that a new zero-day IE exploit has been found in the wild. It looks to be a bug in VML in IE. The Sunbelt blog notes, "This exploit can be mitigated by turning off Javascripting."
Whatever (Score:2, Funny)
Re:The power of Open Source (Score:5, Informative)
-uso.
Re: (Score:2)
Re: (Score:2, Informative)
There, fixed that for you.
Cheers,
-S
from your link (which is what I had in my mind):
"Netscape submitted the JavaScript specification to Ecma International for standardization; the work on the specification, ECMA-262, began in November 1996. The first edition of ECMA-262 was adopted by the ECMA General Assembly of June 1997."
Sorry, has to be done... (Score:5, Funny)
Re: (Score:2)
Zonk? Are you kidding me? (Score:3, Interesting)
Re: (Score:3, Insightful)
Wow, nice resolution! (Score:2)
I'm certain that most Internet Explorer users don't write JavaScript.
No surprise (Score:5, Insightful)
Re: (Score:2)
They could just adopt Firefox if they wanted to, but they won't because it's Not Invented Here.
Re: (Score:2)
But how do you acquire something you cannot buy, hmm? The point is, it is not under their control and they couldn't get it there with open source being the base. Besides, imagine the image loss when it becomes blatantly obvious that open source code holes are fixed by magnitudes faster than their own. Because one thing is certain: Should FF become the default browser for Windows, you'll see the malwa
Re: (Score:3, Interesting)
This is not necessarily a smart idea.
If you simply start afresh, chances are that you're going to end up with all the same exploits all over again.
They either need to do a full security audit of the code (unlikley for microsoft), or they need to start afresh *and* write it in a language/toolkit that is impossible/much hard
Re: (Score:3, Interesting)
I don't think that's true any more. This time it would be reasonable for Microsoft to rewrite their browser in C#.Net, which theoretically provides the kind of sandboxing protection that prevents buffer overflows.
But would that address evil Java/J/Ecma Scripts? Image file exploits? Any of the vulnerabilities that are actually rooted in the Win32 APIs and the NT kernel?
Re: (Score:2)
The problem is the incentive structure. No-one ever got as rich at Microsoft finding bugs as hatching them, from Alchin on down.
Re: (Score:2, Funny)
Re: (Score:2)
Re: (Score:2)
easier solution (Score:5, Insightful)
It can also be mitigated by using firefox.
Re: (Score:3, Funny)
Screw that! I'm going back to "telnet www.google.com 80"
And I'll do that within a VMware image running from a Live CD.
Re: (Score:2)
Re: (Score:2, Interesting)
I suppose now is as good a time as any to ask a question.
I still use IE as my default browser, simply because it loads *fast*. I don't have a brand new system, but when I click the little blue E, I have a browser window inside 2-3 seconds. When I click the little orange fox it often takes up to 8-10 seconds before the window has opened and loaded. I use 'about:blank' for the homepage in both browsers.
Are there any ways to reduce the time to load firefox? I'd even be fine with starting Fir
Re: (Score:2)
Re: (Score:2)
There is a folder in your Start Menu labelled "Startup" (or something similar). Drag a copy of the Firefox shortcut into that folder. It will now load when windows loads. Don't close it.
If you're worried about taskbar pollution... well, you're using the wrong OS. (Or the wrong window manager, anyhow, but my experience is that certain basic assumptions about how Windows works are so deeply embedded into the Windows en
Re:easier solution (Score:5, Informative)
The Firefox Tweak Guide [tweakfactor.com] has many options for about:config and other tips for improving your specific experience.
Firefox Preloader [sourceforge.net] will make Firefox load more quickly by making Firefox do the same thing Internet Explorer does. Firefox will use system resources before being specifically called. The application will remain resident in memory like IE does, waiting for you to click the little fox. In this way, IE loads faster but slows overall system performance.
How to use UPX to speed it up a little [techsupportalert.com] is what this article can tell you. Probably not the best way to go about it, but I have implemented this method on my HTPC.
It is VERY important to realize that the few seconds you wait around for the initial loading of Firefox are quickly surpassed by the lag you experience while using Microsoft's Explorer. Firefox ignores many advertisements right off the showroom floor, but can be configured to show NEARLY NO ADS AT ALL. FlashBlock, [mozilla.org] AdBlock, [mozilla.org] and NoScript [mozilla.org] will make your browsing much faster and cleaner.
Using Firefox, especially with these and other add-ons, will make your browsing incredibly secure. Explorer is left in the dust in comparison.
So the trade-off you seem to have made is this: A few seconds at load time in exhange for a combined several minutes waiting for ads to be displayed, just so you can fall victim to the shiny! new! IE exploit that seems to get barfed all over Slashdot once a week. This while using an underdeveloped, overpriced, practically featureless browser that has no database of expansions. Unless you are using the Vista beta (7 beta) you aren't even using tabs! Do you choose to commut on a horse? HOW DID YOU EVER SURVIVE THE PERMIAN MASS EXTINCTION? [wikipedia.org] BAH! Why did I bother?
Re: (Score:2)
Re: (Score:2)
The Firefox Tweak Guide [tweakfactor.com] has many options for about:config and other tips for improving your specific experience.
Firefox Preloader [sourceforge.net] will make Firefox load more quickly by making Firefox do the same thing Internet Explorer does. Firefox will use system resources before being specifically called. The application will remain resident in memory like IE does, waiting for you to click the little
Re: (Score:2)
Re: (Score:2)
BEEEP you completely and utterly missed Noscript's point.
First of all, Firefox does have Javascript blocking built in, and in a much more flexible way than MSIE (since in firefox you can remove Javascript, but you can also just forbid stuff such as moving and resizing windows, hiding parts of the interface such as the toolbars, modifying the content of the status bar or
Re:easier solution (Score:5, Informative)
The behavior now is a little confusing... the first time you click the shortcut, it will not open a window. Instead, it will make a Firefox icon appear in the tray. This confuses the holy fuck out of my wife (rightfully). However, subsequent clicks on the icon will give you instant Firefox. To make it cleaner, you can put a copy of the shortcut in your Startup folder. I don't do this because I hate startup programs :)
Re:easier solution (Score:5, Informative)
There is a utility [sourceforge.net] which will allow you to also preload Firefox in memory on Windows. Of course, this does not give you the ability to unload IE from memory (decoupling IE from Windows, to any degree, is problematic at best).
Of course, how much an extra 6-7 seconds of load time will impact you would depend on usage. Personally I often leave the same instance of Firefox running for days at a time and leave it minimized on a virtual desktop when it is not in use, but if I were really worried about this on a Linux box then I would use prelink [gentoo.org].
Re: (Score:2)
The only thing preloaded for IE when windows starts is the GUI controls and the common-controls (dialog boxes such as print).
The IE/mshtml stuff gets loaded:
a) If you're starting Explorer (not in shell mode, but as the browsing component) with web-functionality (single-click folder change or common tasks)
b) When you load IE, go to a web address with Explorer, or load an app utilizing mshtml
That said, those dlls are kept in memory after that point, but please give up the fucking bu
Re: (Score:2)
Interesting, I just did a test. Firefox: 2-3 seconds, IE: 5 seconds. Of course, I was just using and closed Firefox and restarted it again so that probably had
Re: (Score:2)
Re: (Score:2)
IE loads fast because Windows load slowly. IE loads for about 10 seconds, before the desktop appears. Once you click the blue e, you just open a small executable that tells the system to open a new browser window. If you see "start" button, it means IE is already loaded, it's the same program only called with different parameters.
As others suggested, dropping Firefox into the startup folder gives about the same result - its load time extends Windows load time. C
Re: (Score:2)
Just because it's faster doesn't mean it's the best way.
Re: (Score:2)
Let's help users move away from IE. (Score:3, Insightful)
It's rare these days to find a public site that depends only on IE. Most banking sites, which were really the only holdovers, have realized that Firefox support is necessary.
The only reason I can think of is ignorance. But even then, most people likely know somebody who could help them install Firefox or Opera for the first time. Maybe each one of us should pledge to tell one other person who isn't aware of the alternatives about them. Make a pact with that person: if they are pleased with their new browser, or it keeps their Windows system free of malware, have them tell one new person about Firefox or Opera.
Very rapidly, many people will be able to find out about the alternatives, and it'll benefit us all. Us geeks won't have to help relatives and friends with their malware-infested systems. Those users won't have to ask us to help them, or in the worst case, call the Geek Squad or otherwise bring theirs systems in for expensive and inconvenient "decontaminations" (often performed by fools). Plus the private data of those users is far more safe. In short, we all benefit.
Re: (Score:2)
I've tried to switch users from IE to FF. It's been more successful with the ex-Netscape users, 'cause I can sell it and T-bird as a direct upgrade. Some people need Outhouse's calendaring features, and some people just can't cope with certain webshites not being compatible with FF, and other people just think tha
Re:Let's help users move away from IE. (Score:4, Insightful)
People start with IE because it's the Windows default.
People stay with IE either becasue:
If they don't care, why should we? It's their computer that they're leaving vulnerable, after all. Besides, Firefox is starting to lose it's most difinitive advantage over IE - as it's popularity is increasing, so is the number of security vulnerabilities found, rivaling and even surpassing IE month to month.
Any differences in "speed" are pretty much a wash, too. Internet Explorer definitely starts faster, but it's integrated with the shell. Firefox uses an ungodly amount of memory and leaks it like a sieve. IE7 waits until it has the page 99% rendered before actually drawing it; Firefox will start drawing immediately, piece-by-piece as the site's downloaded. (Both, in total, seem to take the same amount of time.) ActiveX is known for being full of holes, but at least they try to sandbox it - Firefox extentions just blindly run native code.
Point is that as the differences between the browsers are diminishing - Firefox has forced IE to innovate and comply with standards and more and more pages are designed for Firefox and non-IE browsers. But, the security differences between the two are diminishing, and IE7s interface is cleaner and snappier now, IMHO.
Save the digivangelism for something more important than "Firefox isn't Microsoft." In Vista especially, IE is next to bulletproof - a reworked Windows kernel runs it within a virtual machine of sorts - and IE+Aero Glass has a much cleaner and prettyfuler interface. Use your browser of choice, but with alternatives and a little healthy competition forcing some new life into the browser world, there's fewer reasons to pick one over the other.
Re:Let's help users move away from IE. (Score:5, Insightful)
why should we get our friends to fix the brakes on their, car? afterall, it's their car, right?
Re: (Score:2)
Not exactly an apt metaphor - a botnot can't kill you, and you would only be affected if you didn't have a virusscanner/firewall/security combo. (Even Windows has a firewall now!)
Re: (Score:2)
They might not kill *you*, but it's quite feasible they'll kill your bandwidth, your bandwidth usage quota, your mailbox, etc...
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
No game I have ever played demanded the use of IE. Gamers are more likely than the average user to have customised their PC with non-default programs such as Firefox, so I find it hard to believe that game publishers would chop off a large proportion of their market in this way.
I *only* use IE to run Javascript and ActiveX (Score:5, Interesting)
If I *didn't* need to be doing something dangerous and stupid, I'd be using some version of Mozilla instead of IE. Sigh.
Yes, I know IE has its security zone thingies that give me a way to restrict it, but it's still annoying.
Re: (Score:2)
In effect, it's not much different than if they required you to rent a spare room in your house to a crack-addicted violent sex offender.
Sure, IE gets "patched" now and then, but crack-addicted violent sex offenders do stints in rehab, too. Doesn't mean I want them around in between...
Yes, you may quote me on that.
Re: (Score:2)
Moo (Score:5, Funny)
Posted by Chacham [slashdot.org] on 10:45 PM -- Monday September 18 2006
from the zero-day-is-overused dept.
[ Slashdot ] [ Teenagers ] [ Slow News Day ]
Chacham [slashdot.org] writes to tell us that an old zero-day Slashdot [slashdot.org] exploit has been found again and again and again. It looks to be a bug in all browsers. This comment notes, "The bug is in the Submit Story [slashdot.org] link, which is apparently easy available in the side bar."
No patch has been released. Story posters are standing by.
IE expliots (Score:2)
IE on VM (Score:3, Informative)
It seems like we're getting to a point where probably the only safe way to be surfing is by using a browser on a sandboxed virtual machine environment.
I'm not trying to point my finger only at Internet Explorer, but with security holes that can allow code execution, that's pretty scary. (And another case of buffer overrun? Maybe they ought to rewrite IE as managed code [microsoft.com], but that's another topic all together.)
Re: (Score:2)
IE7? (Score:2)
I thought ... (Score:2)
Clearly IE has been "out for a while" so you can't make a zero-day for IE.
Tom
Re: (Score:2)
It's not IE that's zero day, it's the exploit...
Re: (Score:2)
"Zero-Day exploits are released on the same day the vulnerability -- and, sometimes, the vendor patch -- are released to the public. The term derives from the number of days between the public advisory and the release of the exploit. The term 'zero-day exploits' is sometimes misused to indicate publicly known exploits for which no patches yet exist."
The misuse of "zero day" in this article and "back door" in the Adobe article bother me more than the existence of
Re: (Score:2)
Re: (Score:2)
Re:I thought ... (Score:5, Informative)
In exploit terms, n-day means the number of days after a fix is released for the problem exploited by the attack. Most notable worms of the past have been n >= 1 (often much more) attacks - either someone deduces the flaw based on the patch release or the flaw was already known but only guardedly used in order to do high level target attacks while it was still unknown to the public.
Zero day refers to attacks that are released before the flaw is publically known. It's based on the specific flaw, not the application in general. Zero day attacks are nasty on two fronts - first, no one has specific protection or detection available for it, second, as mentioned, they are sometimes used on very specific targets. There was a recent string of what appears to be industrial espionage where very specific people have been sent MS Office attachments with previously unknown exploits in them.
My two cents... (Score:3, Informative)
Re:My two cents... (Score:4, Insightful)
What you propose would require people to add the likes of Slashdot and Hotmail to the 'Trusted Sites' zone to function correctly. This effectively gives such sites far more access than you would probably like, much more than without playing with your 'zones' at all.
thats a daft proposal.
Re:My two cents... (Score:4, Informative)
Slashdot, no. Slashdot works fine without Javascript.
You don't have to pour a bunch of sites into the Trusted sites category. Only the ones that you are positive are safe and constantly use that REQUIRE javascript.
Re: (Score:2)
Run with JavaScript enabled, OK? (Score:2)
Simple, eh?
Of the 4 browsers I have here, all are safer in JavaScript than MSIE (FireFox [mozilla.com], SeaMonkey [mozilla.org], Opera [opera.com], Konqueror [konqueror.org]). Three of those are easily available for 'doze & even Konqueror can be made to work [straightrunning.com] in it.
Er... sorry, I also have lynx [isc.org], links [sourceforge.net] & w3m [sourceforge.net] available, plus Galeon [sourceforge.net] and a few other GNOMEish built-ins kicking around. Spoilt for choice!
No need to worry! (Score:5, Funny)
Oh, okay... (Score:5, Interesting)
One acronym: AJAX.
Looking at a variety of server logs for websites I'm currently in charge of, I see that Internet Explorer, even among the "geek" crowd, still has a very strong foothold in the browser market. I've worked closely with customers of my own and even after explaining the threat to them, they continue to use IE.
Thanks to Web2.0 (and various other forms of propganda), Asynchronous JavaScript and XML (AJAX) has all but taken over the Internet. Now, with a bug such as this, the AJAX-driven sites are in trouble (assuming every IE user does turn off JS).
I'm not about to start a "Browser War" with this entry, but I have to say; IE is a very volitile threat, and an Open Source replacement would more than benefit the well-being of the Internet as we know it. Pick your poison - Firefox, Mozilla, Opera, Lynx, wget - they're all superior to IE in the sense that they are not an integral portion of the operating system, thus they pose less risk to the security of said OS.
Rather than disable JavaScript in every IE install in the world, take the time to replace IE with something far less dangerous and educate the user on the dangers of using IE over the replacement.
Re:Oh, okay... (Score:4, Funny)
Dude, you must be one master coder - you've got an AJAX framework that will work with wget?
Re: (Score:2)
Re: (Score:2)
I'd agree with your IE rant except that part. First of all IE being "part of the OS" was never a security issue. It's a myth. There's no pieces of IE running in "kernel mode". That's a myth too.
Hell, IE7 isn't even a part of the OS. It's a standalone app, and Windows Explorer uses different librarie
Re: (Score:2)
That's only if the programmers throw graceful degradation out of the window. Graceful degradation has been there since the beginning of HTML and Javascript, and I feel webmasters who break it are not worth the name (unless, of course, their bosses force them to, in which case the bosses are acting dumb).
The right way to make websites is as it's always been: make a simple page that displays the co
Javascript: Not a verb (Score:2)
That made me cringe.
Re: (Score:2)
Safe browsing (Score:3, Interesting)
Flashblock and Noscript (Score:2)
Flashblock doesn't work if Noscript is blocking a site.
was Re:Safe browsing
"mitigated by turning off Javascripting..." (Score:3, Informative)
Why do people even bother to give advice that is basically impossible to follow?
It's not my fault that so many of the websites I want to use now rely on Javascript, but the fact is they do.
Saying "This exploit can be mitigated by turning off Javascripting" is true, but as about as useful as saying "the risks of plane crashes can be mitigated by not flying."
"This exploit can be mitigated by turning off Java (Score:3, Funny)
. . . and you can avoid >99% of car accidents by not turning on the engine, but then the car isn't very useful, is it.
Re: (Score:3, Insightful)
No, you need to blame Javascript too. (Score:5, Informative)
Javascript was designed to be lightweight, friendly, and convenient, and almost anything related to security was later bandaids applied to the gaping wounds. It's possible and easy to write perfectly safe Javascript, but that's unfortunately totally irrelevant because it's possible to write Evil Javascript as well - so anybody who wants to run your "Safe" Javascript has to leave Javascript turned on for the Evil Javascripters as well.
IE does theoretically have a "security zone" mechanism that lets you identify trusted sites, so you can theoretically allow it to run purportedly-safe Javascript from people you trust while not running it from people you don't trust, but that's an annoying hassle. It'd be much safer if they'd built "WimpyScript", designed to be absolutely safe even if all it lets you do is make stuff flash decoratively when you wave a mouse at it; I guess CSS is as close as we get to that. PDF used to be safe, back when all it would do would be display static black or colored marks on virtual paper, but now it's helpfully willing to open web pages and run programs on your PC too.
Re:No, you need to blame Javascript too. (Score:4, Insightful)
Re: (Score:3, Insightful)
They wouldn't have been damned if they didn't, they just would have had to compete on merits instead of pushing product.
ActiveX is what really kicked Netscapes ass because that is what the masses liked, not IE's implementation of JS.
Re: (Score:2, Insightful)
Re:No, you need to blame Javascript too. (Score:5, Insightful)
Uh, no, what "kicked Netscape's ass" is that
In a word, what killed netscape is that MSIE was, at the time, a much better browser than Navigator
Re: (Score:2)
Re: (Score:3, Insightful)
There is no such thing as "100% secure".
Re:No, you need to blame Javascript too. (Score:4, Funny)
http://old.zone-h.org/advisories/read/id=8276 [zone-h.org]
https://rhn.redhat.com/errata/RHSA-2003-029.html [redhat.com]
I'd suggest telnet to port 80, typing in GET commands, and reading the HTML. But then someone would embed the nam-shub of Enki [wikipedia.org] and you'd be even worse off.
Re: (Score:2)
WTF?
Re: (Score:2, Interesting)
I use Talklets [textictalk.com] to help with my reading difficulties, when out and about. Switching off Javascript on public machines will realy cause me issues! So don't. Switch to Firefox. Thanx
Re: (Score:2)
Oh, wait-
Re: (Score:2)
Re: (Score:3, Funny)
$ telnet slashdot.org 80
Trying 66.35.250.150...
Connected to slashdot.org.
Escape character is '^]'.
GET / HTTP/1.1
Host: slashdot.org
User-agent: none
It even makes it easier to read the Futurama quotes in the headers!
Re: (Score:2)
mini:~ idontwanttoputmyrealusernamehere$ telnet slashdot.org 80
Trying 66.35.250.150...
Connected to slashdot.org.
Escape character is '^]'.
GET / HTTP/1.1
Host: slashdot.org
HTTP/1.1 200 OK
Date: Tue, 19 Sep 2006 03:53:05 GMT
Server: Apache/1.3.33 (Unix) mod_gzip/1.3.26.1a mod_perl/1.29
SLASH_LOG_DATA: shtml
X-Powered-By: Slash 2.005000126
X-Bender: That's not my gold-plated 25-pin connector.
Cache-Control: private
Re: (Score:2, Funny)
Re: (Score:2)
Re: (Score:2)
Re:Two browsers... (Score:4, Funny)
Re:You know... (Score:4, Informative)
Re: (Score:2)
Re: (Score:2)
Re:Why disable javascript? Change to firefox ... (Score:5, Informative)