Internet Explorer Exploit Steals Data From Windows Users-- Even If They Never Use Internet Explorer (mashable.com) 80
Security researcher John Page has revealed a new zero-day exploit that allows remote attackers to exfiltrate Local files using Internet Explorer. "The craziest part: Windows users don't ever even have to open the now-obsolete web browser for malicious actors to use the exploit," reports Mashable. "It just needs to exist on their computer..."
[H]ackers are taking advantage of a vulnerability using .MHT files, which is the file format used by Internet Explorer for its web archives. Current web browsers do not use the .MHT format, so when a PC user attempts to access this file Windows opens IE by default. To initiate the exploit, a user simply needs to open an attachment received by email, messenger, or other file transfer service...
Most worrisome, according to Page, is that Microsoft told him that it would just "consider" a fix in a future update. The security researcher says he contacted Microsoft in March before now going public with the issue. As ZDNet points out, while Internet Explorer usage makes up less than 10 percent of the web browser market, it doesn't particularly matter in this case as the exploit just requires a user to have the browser on their PC.
Most worrisome, according to Page, is that Microsoft told him that it would just "consider" a fix in a future update. The security researcher says he contacted Microsoft in March before now going public with the issue. As ZDNet points out, while Internet Explorer usage makes up less than 10 percent of the web browser market, it doesn't particularly matter in this case as the exploit just requires a user to have the browser on their PC.
Re: (Score:1)
To disclose that capitalization was changed (Score:3)
I think it was supposed to mean that the "h" was lowercase in the featured article but uppercase in the quotation. The corresponding sentence in TFA begins as follows: "Basically, what this means is that hackers are taking advantage of a vulnerability..."
But in this sense, the word was was used in the sense of electronic intruders, not people who enjoy playful cleverness [stallman.org]. I personally would have marked the entire first word as rephrased: "[Intruders] are taking advantage of a vulnerability..."
Re: (Score:2)
I personally would have marked the entire first word as rephrased: "[Intruders] are taking advantage of a vulnerability..."
Why change a word? That's worse. I always indicate that I have removed parts of sentenses by ellipses : "... hackers are taking advantage of a vulnerability ..."
Re: (Score:2)
Why change a word? That's worse.
In this particular case, I recommended disambiguating "hackers" to "intruders" to distinguish it from other senses of the word. Using a more specific term avoids the fallacy of equivocation.
Re: (Score:2)
What's with that bracket?
Normally, you would put [sic] right behind the misspelled word, but in this case it is not. Here is the original quote from TFA...
Basically, what this means is that hackers are taking advantage of a vulnerability using .MHT files, which is the file format used by Internet Explorer for its web archives. Current web browsers do not use the .MHT format, so when a PC user attempts to access this file Windows opens IE by default.
Basically, the summary took a portion of the whole paragraph starting from 'hackers' and later on. As a result, the summary wants to start a sentence with a lower case without quotations and it seems to be grammatically incorrect. Normally, a pair of square brackets is used to correct certain incorrect word in-place for readers. As a result, the word 'hacker' becomes '[H]acker' b
Re: (Score:2)
There are plenty of corporations that still force their employees to use IE.
Microsoft told us that it was "part of the operating system", so they must be using it if they use Windows.
Nani?! (Score:5, Funny)
Re: (Score:1)
Re: (Score:2)
Re: (Score:1, Insightful)
Re: (Score:2)
Re: (Score:2)
I agree.
I worked what we used to call, "the big site mentality," long before the word, "enterprise," came along. We automated shit and blocked extensions that we didn't like and pushed those out to the desktop using login files on the servers.
This shit about blaming the user is old. Failures aren't because of "stupid users," the failures are the property of the goddam admins.
Re: Nani?! (Score:1)
Nope, it's not a concern for it managers either.
They just simply disable MHT since nobody really uses it. Problem solved
Re: (Score:2)
Block files with that extension, and push a policy to disassociate that extension so users don't open the files by mistake...
Re: (Score:2)
Back in the days when Windows Scripting Host and viruses based on it reigned supreme, I wrote a small program to stop them. It took over the WSH file association. It would check the file when run, warn you of any potential issues (e.g. "this script will delete files") and give you the opportunity to either stop the script from ever running or run it (if it was a valid script you meant to run). As the years passed, this program had a small following but it died out as other anti-virus tools got this capabili
Re: (Score:1)
Damn near every single security hole is exploited via ID-10T and PEBCAK methods these days.
Re: (Score:2)
It's a clunky explanation. You have software X installed to handle filetype A, and you never use software X. Then you get a file of filetype A, and it opens the software. "WE CAN EXPLOIT THE SOFTWARE EVEN IF YOU NEVER RUN IT!" ... just like Microsoft Word with malicious DOCX files...
Um (Score:1)
User opens malicious attachment. Ok...this is new how?
Also, if a user never has to use IE, then why do they have to open the attachment in IE?
Re: (Score:1)
Also, if a user never has to use IE, then why do they have to open the attachment in IE?
For in the depths of the spaghetti patchwork commonly referred to as "Windows" lies code that defaults to opening .mht files with IE.
Mitigation (Score:5, Interesting)
Chrome can open MHTML files [wikipedia.org], Firefox used to (with an add-on) but not anymore, and there are free viewers available. All one has to do is to set the association of .MHT files to another program.
Re: (Score:1)
Chrome can open MHTML files [wikipedia.org], Firefox used to (with an add-on) but not anymore, and there are free viewers available. All one has to do is to set the association of .MHT files to another program.
You could also try associating .mht files with say, an antivirus program instead of a defunct browser. Seems like a difficult fix...
Re: (Score:1)
Till the next build resets the file association.
Re: (Score:2)
If you do not use IE then renaming the directory containing Internet Explorer will bring up a "name.mht" file choose application to open this file dialogue. As a temporary defense this works for me.
Re: (Score:3)
Re: (Score:2)
You cannot escape IE (Score:5, Insightful)
Fixed long ago... (Score:1)
... by setting all the "dangerous" file associations to non-MS programs.
File extensions like .mht, .xls*, .doc*, even .csv. .mht files have been known-dangerous for a decade now. Useless plus dangerous should be enough of a signal to the security conscious to have made them harmless by now.
MHT is a good format (Score:2)
It is a natural use of Mime. And it allows HTML to be used as a document format,in one document.
It is really annoying that the other browsers refused to support it just because it was Microsoft's idea.
not much to see here (Score:2)
Good thing (Score:2)
This is the first app I uninstall when I first use a Windows machine.
Easy to fix (Score:1)
The average person can't fix this, but it's not hard. I've never even seen an MHT file. I'm not worried about missing them.
So? Go into HKEY_CLASSES_ROOT\.mht and HKEY_CLASSES_ROOT\.mhtml. Change the default value to "txtfile". Delete the content type entry. Now it's just a text file, opened in Notepad.
You have always used explorer.exe (Score:2)
So here "never used internet explorer" need some context - on whether the exploit is based on files related to opening web files or was it related to the executable.
Why contact IE? (Score:2)
"Zero day".... (Score:1)
What the fuck is the point of calling an exploit "zero day" when the relevant software hasn't been updated in years anyways?
Zero day used to mean that it came out *before* the main release of whatever it applied to, but if there is no otherwise upcoming release, then it isn't really "before" anything... it's just a previously unknown exploit.
Re: (Score:2)
Re: (Score:2)
Exactly.... "prior to".
This software is not being actively updated anymore. There is no notion of being before *anything* here.
Amazing! (Score:2)
"Security researcher" mad he didn't get paid (Score:1)
Re: (Score:2)
But they said my computer had a virus and this executable would clean it up!
Move along... (Score:2)
> To initiate the exploit, a user simply needs to open an attachment received by email, messenger, or other file transfer service.
When you can convince a user to open a malicious attachment, there are many many options open to you. This is nothing new.
Re: (Score:2)
Yep... especially MHT which is just HTML, in effect.
If you're aren't already blocking that file format at your email server, you're in trouble anyway.
Though it would be nice occasionally to get a 2019 email client that doesn't just open attachments and execute them in the general user context.
Re: (Score:1)
You'd also have to convince me to stop using Linux and go back to Windows.
To Disable The Association in Windows... (Score:5, Informative)
You should get a User Account Control prompt, select yes.
To see what the current association is, enter
and press Enter/Return. It'll likely return
and if you wish to check if IE is the handler for that file type enter
and press Enter. If the result mentions iexplore.exe, that's IE.
Enter the following two lines (pressing Enter after each) to break the association for IE archives (there are two extensions associated):
Close the prompt (type exit and press Enter, or click the "X" close window control).
A somewhat safer way (in terms of other possible exploits, not in mucking up your PC) is to use ftype to list any file types opened by IE ( ftype | find "iexplore" ) and then delete those filetypes ( ftype filetype= ), but if you're not confident with what you're doing, skip that.