Forum Moderators: open
At what point do we need to shift the focus here and start posting slashdot stories when they find some code in IE that actually works?What's sad is that Internet Explorer 6 was released about two and a half years ago, has had no new features added, and they still haven't finished fixing it.
my favorite part:
Solution:Disable Active Scripting.
Use another product.
Looks like Firefox 1.0 can't come soon enough [webmasterworld.com].
Simply put, I don't believe any of the MS brass, including gates, really likes the web that much, or cares about it, except when it looks like maybe they can start generating cash by trying to gain control of some part of it by installing another default app into Windows, like Windows media player, to try to get cash flow going through drm type garbage.
Opensource, on the other hand, wouldn't exist if it weren't for the web, it's built on it. MS is built around a closed network, with a centralized structure, it's the model they understand, and it's the model they project out onto the world as the most desirable way for things to work. It's the model they tried to cram down the corporate world's throat, was that palladium?, where all data is centralized on ms servers. Initiative drops like a lump of lead, totally rejected.
Stopping development on IE 6 is just one manifestation of this ambivalence towards the web and all that is web related. However, when you stop development on something as complex as a browser for 2.5 years while Gecko/Opera/KHTML are raging full steam ahead, something is going to change. One problem for MS of course is that they don't make money off IE, in fact it costs them money, unless they can leverage stuff like default search page msn into actual cash flow.
One possible reason MS doesn't like the web? It's built on fully open standards, not controlled by MS. Well, they tried, active x, XAL [I think], vbscript etc.
If MS didn't occupt a near monopoly position on the desktop, there would be equally universal non proprietary document standards, and they would work as well as the web standards currently do.
Hard to believe there are still holes in Windows 98.
Microsoft CEO Touts Security Push at Conference - Ballmer said that Microsoft's Windows Automatic Update service has seen a fivefold increase in downloads over the last 10 months, with more than 112,000 servers accessing Microsoft's computers that check for updates on a daily basis.
[reuters.co.uk...]
In addition to the unpatched vulnerability currently being exploited, Secunia has found 4 new critical flaws in Internet Explorer version 5.01, 5.5 and 6.0 on Windows. These new flaws again allow for the execution of arbitrary code (read: auto-installed spyware, malware, spamware). Details of the vulnerabilities as well as proof-of-concept exploit code is available here:
[secunia.com...]
Word and MSN Messenger shell: exploit
Apparently, MS Word and MSN Messenger are also vulnerable to the shell: exploit that Mozilla recently patched. The vulnerability is due to a security issue within Windows that will be patched by Windows XP Service Pack 2. There is currently no other patch available.
[infoworld.com...]
Locking Down Internet Explorer
There is no patch for the 5 current exploits. To protect yourself, Internet Explorer should be set to disable Active Scripting (VB and Javascript) on all websites except those in your Trusted Sites Zone. To accomplish this:
1. Launch Internet Explorer
2. Click TOOLS and then Internet Options.
3. Click the Security Tab.
4. Select the Internet Web content zone.
5. Click Custom Level.
6. In the list, scroll down to Active Scripting and set it to Disabled.
7. Click Ok
8. Select the Local Intranet Web content zone.
9. Click Custom Level.
10. In the list, scroll down to Active Scripting and set it to Disabled.
11. Click OK.
IMPORTANT: This should lock you down safely, but will break any site relying on Javascript. If you encounter a site you wish to enable Javascript for, you can add it to your Trusted Sites zone.
1. Launch Internet Explorer
2. Click TOOLS and then Internet Options.
3. Click the Security Tab.
4. Select the Trusted Sites content zone.
5. Click the Sites button.
6. Add any sites you wish to trust.
7. Uncheck the Require HTTPS checkbox.
8. Click OK.
Windows XP Service Pack 2
Windows XP Service Pack 2 (currently in Beta as a Release Candidate) should fix the 5 vulnerabilities mentioned above, however, Microsoft does not recommend running it on production systems. Additionally, there has already been a report of a script-injection technique on IE in SP2 that is still working. This has not yet been verified.
If you genuinely wish to continue using IE and need Javascript enabled for all sites, it may be worth checking out Windows XP SP2. A number of people are running it on their systems without issues (plus the popup blocker in the new IE is supposed to be pretty good), so it may be worth a shot.
Switch to an Alternate Browser
You may also wish to consider switching to another browser without these security issues. Mozilla 0.9.2 is an option as is Opera 7.52. Note the version numbers as previous versions of those browsers have security issues as well.
[mozilla.org...]
[opera.com...]
[secunia.com...]
[software.silicon.com...]
I'll keep using FF, and building up my kid's college funds de-virusing the machines of people who don't want to make the switch.
Microsoft has issued a set of 5 new patches for XP, Outlook, and IE. Please update your computer system.
I count 4 myself:
Security Update for Windows XP (KB841873)
Cumulative Security Update for Outlook Express 6 SP1 (KB823353)
Security Update for Windows XP (KB840315)
Security Update for Windows XP (KB839645)
Microsoft has released 3 Windows patches and 1 Outlook Express patch. The shell: exploit is one of the patches made, so this should take care of the original IE exploit as well as the new MSN and Word exploits. There is also a fix for an htmlHelp vulnerability and a Task Scheduler vulnerability.
At this point, it does not look like this will fix the latest 4 vulnerabilities posted by Secunia.com as they are exploits within other systems (Javascript and the Channels zone in IE), but I could be mistaken. This means that IE is still vulnerable to arbitrary code execution. I would suggest watching their advisory and Microsoft's site for updates.
The 4 patches are available through Windows Update. The shell: exploit patch failed on my PC. Downloading and running it directly solved the problem. If this occurs on your system, you can download it here:
[microsoft.com...]
Microsoft has issued a set of 5 new patches for... Outlook
Microsoft is showing no need on my computer for an update to Outlook 2003 at this time. Perhaps you meant Outlook Express?
Not sure what it all depends on...
I'll keep using FF, and building up my kid's college funds de-virusing the machines of people who don't want to make the switch.
even if everyone with 'doze switched to another browser tomorrow ..there are still so may ways to contaminate the OS.. via cds ..memory sticks , flash cards , games copied from your kids friends with the downloaded version ( cracked of course ) of clone*** ....ah the list goes ever on ..
I may actually start a thread on it one day ..not a "how to hack" ..just a "what not to"....
But the work in clean ups is guarranteed for many of us for years to come ...even if some of it is gonna come from "blindfolding palladium" boxes..
I'm kind of glad MS has stopped doing the one release a month routine. I'd rather they got these holes closed when they occur.
Be sure to check [windowsupdate.microsoft.com ] today if you have automatic updates turned off.
(Don't even ask why I don't have broadband!)
You may also wish to consider switching to another browser without these security issues. Mozilla 0.9.2 is an option as is Opera 7.52.
That should of course have read "Mozilla Firefox 0.9.2" as Mozilla is a separate browser, currently at version 1.7.
However, because IE is tighty integrated into the Operating System, not only are more exploits possible, more devastating and intrusive exploits are possible.
That's a fundamental design flaw that does not affect stand-alone browsers, and has allowed all kinds of "swiss army knife" exploits that combine viruses, worms, dialers, and malware of many species, all in one payload.
Even if Mozilla had 99% of the market, no more than a handful of security problems would befound. Of those, they would be fixed within 24 hours and available for download at your leisure. Compare that to hundreds (many believe THOUSANDS) of problems in IE.
Mozilla benefits from thousands of eyes on the code. It also benefits from open source. Every hacker on the net would love to crack mozilla - in order to attempt to install malware. Whereas, ActiveX is not a hacking problem, it is a program design flaw.
On the other hand, hads of to MS for pulling off the "ya, we have $40 billion in the bank and 20k employees around the planet, but those little bad hackers are picking on us. If you were as big and had as many resources, they'd pick on you too" ploy. Absolute text book case in pure press and public control (eg: propoganda).
However, because IE is tighty integrated into the Operating System, not only are more exploits possible, more devastating and intrusive exploits are possible.
That's true. Brett also mentioned ActiveX. On the other hand, both, FF and IE support plugins - I believe FF uses the same interface as IE - as well as JavaScript.
Mozilla benefits from thousands of eyes on the code. It also benefits from open source.
The thousand eyes might be those of 450 hackers and 50 developers. Just because something is open source, doesn't mean it's quality software. Any complex piece of software, open or closed source, has bugs and most of the time only the developers understand their code. Also it's a lot easier to scan source code for certain types of bugs like buffer overflows than to fully understand the code and become a contributing developer. Take for example this FF vulnerability [kb.cert.org]. Although IE has far more vulnerabilities in the past 12 months it is also used 20 times more often, so I assume it is a 20 times more attractive target, hence hackers will invest 20 times more energy into finding and exploiting new vulnerabilities.
Am I starting to sound like a MS representative?
Absolutely! That is part of the perk of Open Source. Who better to find and expose holes than hackers? The fact that hackers are looking it over from the inside out is a boon to debugging and problem finding. The faster the hackers find them - the faster they can be fixed.
The big difference is that when a hole is found in Mozilla, it can be fixed literally overnight. Whereas a few of the latest IE holes have been known since 1998.
Anyway, back to the topic at hand - please update your windows systems.
[theregister.co.uk...]
Take for example this FF vulnerability [webmasterworld.com]. Although IE has far more vulnerabilities in the past 12 months it is also used 20 times more often, so I assume it is a 20 times more attractive target, hence hackers will invest 20 times more energy into finding and exploiting new vulnerabilities.
You mean the one that has already been patched and is actually a vulnerability within Windows that Internet Explorer, MSN Messenger and MS Word were also vulnerable to?
Your 20 times argument is specious. It would be more accurate to say that if there are 1 million compromised IE installations, there should be 50,000 compromised Firefox installations. I've seen lots of compromised IE installations... no Firefox ones, despite the fact that Firefox *IS* being targetted by malware and spyware authors. The Mozilla folks are being proactive in dealing with it.
Am I starting to sound like a MS representative?
That in itself is n't a problem ....rabbiting on in the face of the hard evidence is ..
IE and the Extension of it that is 'doze ( yep it's near enough that way round ) has always been a clunker ...
Maybe some hackers will try to take down firefox ..IMO only the scumware writers and dialer installers and children with virii lab found on Kazza ...
Most hackers who hit on IE and 'doze do so as protest against the ethos behind it and to show it up for the ersatz crap it is ....and puleez don't tell me "why don't you complain to the authorities"....
Free real competition and open source co-operation isn't seen by them to be in their interests either ...
