New Highly Critical IE Exploit Found

[scar3crow]

http://secunia.com/advisories/18680/

Basically an exploit that allows program flow to go right into your heap, thus allowing for execution of arbitrary code.

This was confirmed on Internet Explorer 6.x with a fully patched XP SP2 system.

This is why I use Firefox... Im just curious as to how long it will take IE to patch this... Not to say Firefox hasnt had holes, but theyve been patched within a week of discovery pretty much.

[Baker]

New one every week, it seems like.

I'm fairly well known to be not a real big fan IE, to say the least. I've avoided IE like the plague ever since I discovered just how bad you could abuse vbscript and ActiveX back in 1998.

They were cool features at a time when people didn't think about security, I know most programmers were initially thrilled with the possibilities of vbscript and ActiveX.

But when I discovered sites trying to secretly install crap -- keyboard loggers, spyware, etc -- on my computer with IE, that was it and that was back in 1998.

At that time, I loved MS Office and Microsoft products in general and I thought IE would be just as high quality. I was quickly disillusioned when I'd do things like click the STOP button in IE 4.0 and it didn't stop loading the page, and this was in the dialup days when you damn well wanted the page to stop loading if you clicked stop.

Around 2002, when IE had effectively killed off everything and Netscape 5 and 6 were disappointing turdballs, they basically lost interest in maintaining it entirely.

When 2004 hit, spyware and backend installs had become a 5-alarm fire due to Microsoft's neglect and, as I mentioned in another thread, I did Verizon DSL support and everyone that called had spyware and virus issues, including those wonderful non-removable hijack toolbars.

That level of neglect basically has killed all my former love of Microsoft. I used to think they were "da bomb".

The internet has pretty much evolved to be a FireFox and IE compatible world and ActiveX is for the most part a thing of the past.

If I have to use IE at work or somewhere else, that's their problem and they can clean up the mess

[/end Microsoft rant]

[Solecord]

I don't fully buy the argument that because we hear about exploits with IE all the time that Firefox is more secure.

http://blogs.zdnet.com/Ou/index.php?p=103

http://news.com.com/Symantec+Mozilla...3-5873273.html

I'm not saying I don't like Firefox, I just find these arguments to be less than true. Sure IE is inherintly more vulnerable than Firefox, but that doesn't mean Firefox is the GOD of web browsing. It can be just as vulnerable.

IE has been around longer and Microsoft has and always will be a larger target for hacking. That's the only reason why we hear more about these attacks on IE. If the hackers started to actually fully target Firefox instead of IE we'd be hearing Firefox stories instead of IE stories.

[scar3crow]

I repair computers in the software aspect at my university. This means 13,000 people who use IE to browse MySpace and download SecretSmileys while checking their weather with WeatherBug before giving Steam their latest bank account information.

For every computer I work on, I install Firefox, Adaware, Ewido and recommend to them to be a bit more cautious online and more selective on what they download. It gets bad enough though that I have considered putting out an article in the student paper just giving general advice on the matter, because in all the computer classes, they never teach How to Browse the Internet.

[Solecord]

And let me add a response to Baker's comments about Spyware and crap that gets on your computer because of IE -

Again, while IE may have security flaws, if you keep your computer up to date with all the latest virus blocking software and spyware protection software, you won't run into these problems. I've used IE since Windows 95 and I've never had a virus on my computer and I've only had 3 spyware programs on my computer (and those were installed because I installed one of those P2P programs that came packed with the spyware). Other than that, I've never had a problem - and I download tons of shit.

The real problem is educating the populus on how to use technology properly.

Another good read heh http://www.ireallydontcare.com/index...ge=fun/firefox

[scar3crow]

Solecord; Thats not quite the point, look up exploits found in both, and the status on whether or not they were patched, and then how quickly. The difference is that the Firefox team maintains their code base, and pounce on the particularly large holes. They operate in measurements of 12 hours to a week, rather than months.

Another problem with IE is... it is made by Microsoft - this isnt an anti-Microsoft statement, theres the problem that if you can overflow the buffer with a particularly large string in many cases, IE will give up on stopping it, and let it on through, and being that IE is permitting it, Windows sees that as a Microsoft authorized data transfer and it goes silently. This isnt a criticism of Microsoft here, it is simply the potential consequence of having the browser and OS running on the same credentials.

That and Ive never tricked Firefox by binding a jpeg to an exe and masking the file extension, where once the jpeg is saved the functional exe is on your machine - reminds me what a friend once said as it applies very well to that particular, unpatched, exploit "Looking at porn in IE is like walking through a swamp with a ball and chain around your feet".

Firefox is not a cure all, but it is a step forward. I use it primarily for functionality, but also feel a little more secure in it - however I do not see it as my only line of defense, I just have less problems with it, and back it up with AdAware, Ewido, Spybot, and various other programs.

I have never had a customer bring their PC back due to spyware a second time when Firefox had been installed on their system and they were advised to give it a try.

[Baker]

Again, while IE may have security flaws, if you keep your computer up to date with all the latest virus blocking software and spyware protection software, you won't run into these problems.

I don't want any more hobbies. I just want it to work.

I've used IE since Windows 95 and I've never had a virus on my computer and I've only had 3 spyware programs on my computer (and those were installed because I installed one of those P2P programs that came packed with the spyware). Other than that, I've never had a problem - and I download tons of shit.

Competent people can use IE with no problems. No doubt about it.

The real problem is educating the populus on how to use technology properly.

I think most people just want stuff to work without attention.

The GameCube, PS2, XBox, you put the game in and it works, you don't mess with video cards, drivers and stuff. And it's eroding PC gaming a little. I listed some reasons I don't care much for newer games in the "Why Quake?" section, one reason is I don't want to keep downloading patches, updates, Punkbuster upgrades and shit. I just want it to work and not do "Hey Igor, go for brains" and jump thru hoops.

I'm not totally anti-IE, it views pages ok. They *have* fixed many of the security problems. It isn't so much of a problem as it once was.

My main reason I won't use IE is that I think Microsoft neglected IE for so long and really let shit get out of hand. I don't want that.

Hell, I told a bank to f*** off and cancelled an account with them because I couldn't tell them what my interest rate was. I made an overpayment and wanted the $47 mailed to me, they asked me 3 questions. The third question was my interest rate and I didn't know. The mindless drone said "I'm sorry, I can't verify your identity, I'm transferring you to fraud." I said "How about you transfer me to cancelations instead because I don't see why I have to answer all these questions to get a check mailed to the same f***ing place you a**holes mail my statement to."

My point being, it was that Microsoft did nothing for so long and they made it crystal clear they didn't really care about the problems. That's all I needed to know. All this is going on and Microsoft wants to fiddle while Rome burns. "Ok, Microsoft, you really just don't give a damn. Point taken. Thanks!"

And, I don't think FireFox is god. I think FireFox is overhyped.

[Baker]

Just to add. I'm pretty comfortable about how things are. You can use whatever want to browse the web anymore. It's all a non-issue with me, I don't care.

Back when you had to use IE, I cared. It was terrible and half the sites didn't work with anything else.

Today, you can use IE or not and it doesn't really matter.

[Yellow No. 5]

IE makes me feel cheap and dirty.

[Monster]

My Windows updates never work anyway. IE SUCKS

[Baker]

When I run Windows update, I know something that used to work will stop working right.

I refuse to run Windows update and since I don't use IE and have a firewall and a router, I have no reason to.

[Canadian*Sniper]

Whether is Outlook or IE, keeping up with the patches will keep you from running into any problems. Just stop visiting porn sites and you'll be fine.

[Grim]

Well, I use IE. So far, (knock on wood), I haven't had any major problems. I heavily monitor my machine because I do not have an anti-virus on. I use it when I deem necessary. I do not run any spyware detecting utilities.

I use my machine mainly for gameplay. There are a couple of sites I may go to... all that are reputable companies that I purchase items from.

So I guess in essence, my computer doesn't see much of the outside world and the threat is minimal. I also have my machine setup so that I can format and install XP at the drop of a dime. C drive keeps only my OS and the D drive contains my everything else. I also make it a habit to back-up important files in case something happens.

[Solecord]

I don't want any more hobbies. I just want it to work.

Now I'm know you're a competent person so I'm not referring to you, I'm making this statment in general but I think that stance is still the whole problem. People think they can just sit down on a computer and do what they want and leave and not have to worry about anything. Things need maintence and care. If you don't take care of your car it'll go to the crapper. Same with your computer. If people realize they can take an hour's effert each week or month and their computer will remain stable and safe the computing world would be a better place - but I'm sure some would be out of their jobs then

[Monster]

when I go to porn sites, I never get any virus pop-ups.. Weird. Nothing bad seems to happen either.