IE Flaw Turns Your PC into Public File Server
A vulnerability found in Internet Explorer could expose your files to the Internet.
A security consultant on Wednesday provided a live demonstration at the Black Hat DC conference that immediately prompted a security advisory from Microsoft. Jorge Luis Alvarez Medina, the Argentina-based security consultant with Core Security Technologies, showed attendees that it was possible to use an exploit found in Internet Explorer to remotely read files on a victim's local drive.
Medina said that the security flaw extends across all versions of Internet Explorer, and cannot be fixed with a simple patch. Microsoft countered and said that consumers can work around the problem by running Internet Explorer in “protected mode.” Still, that doesn't ultimately solve the problem--many unaware Internet Explorer users will be exposed to the Internet like an at-home FTP offering free, anonymous downloads.
According to Computerworld, Medina offered other workarounds including an IE Network Protocol Lockdown. This is achieved by cranking up the Internet and Intranet Zones to "high," and disabling Active Scripting for both zones. He also suggested that users switch to different browsers when navigating to untrusted Websites.
According to Microsoft, the FTP-style vulnerability affects consumers using Windows XP and those who have disabled Internet Explorer Protected Mode. "The vulnerability exists due to content being forced to render incorrectly from local files in such a way that information can be exposed to malicious websites," the company said.
Given the security issues that has faced Microsoft's Internet browser over the years, surfers should switch to rival software such as Mozilla's Firefox and Google's Chrome. On that note, it's really hard to believe that Internet Explorer 8 is the world's most popular Internet browser. Doh.
- Toyota Admits Braking Problems with New Prius
- Comcast Rebranding Services to 'XFINITY'
- THQ Confirms Name For Sony's Motion Controller
- Insiders Leak Samsung Semiconducter Tech
- Judge: ISP Not Responsible for Illegal Downloads
- Link Found Between Net Addiction, Depression
- Need a Job? Cyberthieves are Hiring!
- Chinese Tablet Maker Admits to Copying iPad
- Watchdog: High Tech Exam Cheating On the Rise
- Gesture Cube: 5 Sides Of 3D Gesturing Awesome
- Sony Considering Charging for PSN
- Webcam Helped Rescue Man From Sea
- Fallout: New Vegas Out This Fall
- Top 5 Best Selling Games of 2009
- Hello Kitty Chainsaw is a Serial Killer's Dream
- GameStop, Staples Share Credit Card Numbers
- 2 Firefox Add-Ons Contain Trojans
- NASA and GM Introduce a New Space Robot
- Brothers in Arms 2 Heading to iPhone
on the other hand it might actually end up being quite secure - eventually LOL
Revenge article for IE8 taking top spot for browser popularity?
Doesn't effect me, I'm all about Firefox.
Funny how when it's bad news they don't use the picture of everyone's favorite photoshopped FF/IE babe. =/
In related news, Chrome is gaining market share by the second!
Wait... Why haven't we photoshopped a Chrome logo onto her shirt yet? ^.^
So basic knowlege wins don't go surfing random websites and you wont get too many virues leave your security settings on default in vista and windows 7 and you're pretty safe. t-t
In other words, you pretty much have to bend over and beg for it before you are actually vulnerable.
I often get asked to fix problems on friends and family's PC's 9 times out of 10 they are caused directly or indirectly by IE. It has gotten to the point where I have removed IE from the menu and desktop and installed FF then warned them if the use IE and stuff up I will refuse to fix their machines.
The worst part are the people selling their PC's to get Mac's because the Mac's are obviously so much more protected than a PC. Then they point to articles like this. Poop.
Per the above comment, I apparently forgot the quotes around the phrase "Mac's are obviously so much more protected than PC's". Sarcasm failure on my part.
Best advice all year.
The last few rounds of virus that I had to clean off where from flash exploits using cross domain scripts. The flash is delivered through valid advertizing companies and end up on sites you would never expect. This is not just an IE problem.
I often get asked to fix problems on friends and family's PC's 9 times out of 10 they are caused directly or indirectly by IE. It has gotten to the point where I have removed IE from the menu and desktop and installed FF then warned them if the use IE and stuff up I will refuse to fix their machines.
Personally, i think adobe's worse...
Why can't MS ever release a decent browser for once.
Its most popular because many businesses and governments use it by default: it comes with the computer and that way they don't have the downtime of finding, installing, and supporting other browsers in their enterprise.
That said, MS should not be proud of that same fact. The reason its most popular is that your customers don't know? I'm certain every systems Admin has recommended switching only for their superiors, ignorant of the real problems and dismissing their employees as "nerds" or such, to shoot down the idea on a cost basis.
Guess they won't be so happy when someone else starts reading their emails and copying IP.
*sigh*
Maybe I'll use SRWare Iron for a while...
So it doesn't affect user of Vista and Win7 unless they screw with their security settings in a bad way.
So I just read that long article and the hate at the end of it to find out that it doesn't apply to me at all.
I thought about how the exploit works and realized that this problem has likely actually prevented many stupid users from a sick amount of malware issues because of how it prevents local file rederings of content. You win some and you lose some. People can have all the access they want to my system. Ain't nothing there but some sales presentations.
Pwnd. Can't wait to see Microsoft create a good browser now.
In other words, you pretty much have to bend over and beg for it before you are actually vulnerable.
Yeah seriously, isn't protected mode enabled by default on IE7 and IE8? Plus it says you have to be using WinXP? Doesn't sound very dangerous to me.
Instead of calling it "Internet Explorer", it should be called, "Internet Explores You".
this is why i dont use internet explorer. 1st off its only the most common browser used . if your not useing firefox or grome you should be. my os dos not even have any core files to internet explorer its 100% none existent . use's 40mb of ram ware as normal retail . and i used a retail cd key for it so its 100% legal . there is a tiny7 aka windows 7
there is even a windows live cd you can use. meaning it be inpossble to get hackd because a cd cant get any thing bad on it. unless it was infected when your burnd it other then that its good option.
use's 40mb of ram ware as normal retail use's 256mb
IE = too scary for me :S
If a sifnificant number of users switched to a different browser, then wouldn't they eventually become targets too?
So IE stands for Infinitly Exploitable.....
Fucking Micro$oft!
"Given the security issues that has faced Microsoft's Internet browser over the years, surfers should switch to rival software such as Mozilla's Firefox and Google's Chrome."
Come on... Don't give false sense of security to people. If you have a complex enough software, you're bound to have vulnerabilities.
http://www.mozilla.org/security/known-vulnerabilities/
So IE stands for Infinitly Exploitable.....
Quoted for great justice.
The company I'm working with ironically use IE as the default browser here as well and XP 32bit as standard OS
That would be because XP works and Vista didn't
There's usually a reason corporations don't immediately jump onto things like a new O/S you know... Being able to continue to make money being the primary one!
Though I did change the default browser to FF, but that doesn't really matter with all the upstream filtering we do anyway.
Same problem at my company of over 10k we have around 4k computers and all are xp sp3 with ie7. funny enough everyone in our it department uses chrome or firefox... at the moment we are testing win7 for all our needs and i personally have been using the beta since its public release. and what do u expect ofcourse you are gonna have holes in an os based off of the ie6 code... time to upgrade and forget about xp
Why dont we all just shut down all computers until a secure OS and system can be produced.
Flaw.. or feature? Easy public web server anyone?