Vulnerable Internet Explorer

S

S.M.

What is the truth about the below article?

from: http://www.capetimes.co.za/index.php?
fSectionId=272&fArticleId=2137918


Web experts urge surfers to stop using vulnerable
Internet Explorer

London: Its curved blue "e" sits on almost every computer
desk top in the world, but the global dominance of
Microsoft's web browser could soon be over following a
stark security warning from a senior panel of web experts
who say it opens the door to online criminals.

They are urging all users of Internet Explorer (IE) to
stop using the browser because they say it is vulnerable
to hackers and credit card fraudsters.

The alert, from the US Computer Emergency Response Team,
comes as a blow to the global giant Microsoft, which has
fought successfully to retain its dominance of the
browser market - 95% of internet surfers use IE.

The team said flaws in the software expose users to
criminals who can spy on their activities, steal their
personal details or send junk e-mail from their computers
without them knowing.

It said internet users should consider dumping the
Microsoft software - which comes as standard installed on
PCs - and switching to another web browser, such as the
free Mozilla or commercial Opera products.

In its warning, under the technical title "Vulnerability
Note 713878", the agency notes that IE has "significant
vulnerabilities in technologies" but adds: "It is
possible to reduce exposure to these vulnerabilities by
using a different web browser."

The advice follows a continuing tide of attacks taking
advantage of holes in IE.

In the past seven days, security experts have discovered
criminals using two different "vulnerabilities" in IE to
exploit Windows PCs.

The first, called "Download.JECT", silently redirected
the browser to a Russian website and made it download
software that monitored keystrokes and would send out
spam.

Last week researchers at the Internet Storm Center
discovered a malicious program that used a flaw in the
software to install itself on the user's PC when a
particular pop-up ad appeared.

It would then monitor the user's typing when they visited
any of 50 bank sites, including Barclays Bank, Citibank
and Deutsche Bank.

Neil Barrett, security consultant of Information Risk
Management, which carries out internet security audits of
companies and software, said: "The number and seriousness
of the vulnerabilities is now getting past a joke.

"Some things that can be done to it are really powerful
from the hacker's point of view. There are presently more
than 30 attacks that it's vulnerable to which haven't
been fixed by Microsoft."

Barrett said he, for one, has seen enough. He said: "The
next machine I'm going to buy will be an Apple laptop
running Netscape. That way I won't have any IE-related
holes, but will be able to run software like Microsoft
Office.

"For my purposes I'm getting out of the line of fire,
because it's just less vulnerable." - The Independent

Published on the web by Cape Times on July 5, 2004.
 
L

LuckyStrike

S.M -

First I have patched (pardon the pun) your supplied URL, so that others may
simply "click and go" rather than having to copy and paste it.

http://www.capetimes.co.za/index.php?fSectionId=272&fArticleId=2137918

A patch has been made available which addresses this issue. Access Windows
Updates and install that patch.

Windows Updates
http://v4.windowsupdate.microsoft.com/en/default.asp

What You Should Know About Download.Ject
(Note: Users of Windows XP Service Pack 2 Release Candidate 2 (Windows XP
SP2 RC2) are not at risk.)
http://www.microsoft.com/security/incident/download_ject.mspx
How to disable the ADODB.Stream object from Internet Explorer
http://support.microsoft.com/default.aspx?scid=kb;[LN];870669

Critical Update for Microsoft Data Access Components - Disable ADODB.Stream
object from Internet Explorer - Win9x (KB870669)
http://www.microsoft.com/downloads/...1C-FF30-40A0-8E70-C9F1F4DCD8C2&displaylang=en
--

LuckyStrike
(e-mail address removed)

How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm
http://home.satx.rr.com/badour/html/post.html
--------------------------------------------------------------------

What is the truth about the below article?

from: http://www.capetimes.co.za/index.php?
fSectionId=272&fArticleId=2137918


Web experts urge surfers to stop using vulnerable
Internet Explorer

London: Its curved blue "e" sits on almost every computer
desk top in the world, but the global dominance of
Microsoft's web browser could soon be over following a
stark security warning from a senior panel of web experts
who say it opens the door to online criminals.

They are urging all users of Internet Explorer (IE) to
stop using the browser because they say it is vulnerable
to hackers and credit card fraudsters.

The alert, from the US Computer Emergency Response Team,
comes as a blow to the global giant Microsoft, which has
fought successfully to retain its dominance of the
browser market - 95% of internet surfers use IE.

The team said flaws in the software expose users to
criminals who can spy on their activities, steal their
personal details or send junk e-mail from their computers
without them knowing.

It said internet users should consider dumping the
Microsoft software - which comes as standard installed on
PCs - and switching to another web browser, such as the
free Mozilla or commercial Opera products.

In its warning, under the technical title "Vulnerability
Note 713878", the agency notes that IE has "significant
vulnerabilities in technologies" but adds: "It is
possible to reduce exposure to these vulnerabilities by
using a different web browser."

The advice follows a continuing tide of attacks taking
advantage of holes in IE.

In the past seven days, security experts have discovered
criminals using two different "vulnerabilities" in IE to
exploit Windows PCs.

The first, called "Download.JECT", silently redirected
the browser to a Russian website and made it download
software that monitored keystrokes and would send out
spam.

Last week researchers at the Internet Storm Center
discovered a malicious program that used a flaw in the
software to install itself on the user's PC when a
particular pop-up ad appeared.

It would then monitor the user's typing when they visited
any of 50 bank sites, including Barclays Bank, Citibank
and Deutsche Bank.

Neil Barrett, security consultant of Information Risk
Management, which carries out internet security audits of
companies and software, said: "The number and seriousness
of the vulnerabilities is now getting past a joke.

"Some things that can be done to it are really powerful
from the hacker's point of view. There are presently more
than 30 attacks that it's vulnerable to which haven't
been fixed by Microsoft."

Barrett said he, for one, has seen enough. He said: "The
next machine I'm going to buy will be an Apple laptop
running Netscape. That way I won't have any IE-related
holes, but will be able to run software like Microsoft
Office.

"For my purposes I'm getting out of the line of fire,
because it's just less vulnerable." - The Independent

Published on the web by Cape Times on July 5, 2004.
 
L

LuckyStrike

Hi -

Listen S.M., it is a well established fact that IE has a lot of issues
regarding security and the like. That's not a secret by any stretch of the
imagination. When one looks into this to any degree of depth, you'll see
that a number of factors come into play. In no particular order of
appearance:

It is the most popular and widely used - and therefore most widely exploited
browser.
Most people who get their first PC and connect to the WWW haven't a clue as
to the threats which are possible
Those who have some experience continue to "surf wildly" without regard to
security; all in the name of speed and convenience. They have their security
settings at duh-fault (sic) so as to "not be bothered". Enabling ActiveX
*and* Active Scripting will leave the door wide open for attack.

http://www.infinisource.com/techfiles/surf-safe.html
http://www.nwnetworks.com/iezones.htm?
http://www.claymania.com/safe-hex.html
http://boards.cexx.org/viewtopic.php?t=957
http://securityadmin.info/noframes/faqget.asp
http://www.cert.org/homeusers/HomeComputerSecurity/
http://www.microsoft.com/security/incident/settings.mspx

It is most unlikely that IE is "patched once and for all and forever". New
exploits of old flaws will be discovered. New discoveries of old exploits
will be uncovered. Because of how the code is written (not open source), you
will only have a limited number of users who are astute enough, and fewer
still who will find ways to "solve" the problems inherent in a program which
has all of the above mentioned weaknesses.

Bear in mind that if and when another browser (should that ever become the
case) becomes the most popular in use, it too will attract a greater number
of script kiddies and outright greedy and / or malicious parasitical foes
who go "where the money is".

As for the use of alternative browsers (and I don't know much about all of
the choices in detail) there are choices out there and that is what makes
things better. A few of the choices offer alternatives which are faster or
more secure. This is true to a degree. Some browsers are not as bloated as
IE; hence faster, while still offering a wide array of feature options.
However as one adds those options, the bloat increases - speed decreases.
Security: some browsers -such as Firefox - to name but one, are more secure.
Why? Because they don't load ActiveX as MS does by default. That fix is
easy... don't use default settings. Again, many users bring much of this
problem upon themselves by not keeping current, not Updating (!) or seeking
updates regularly, surfing without adequate protection (Firewall, Antivirus
and Anti-spyware/malware) and without taking preventative measures such as
adjusting their browser settings.

Has MS taken notice or have any comments of these flaws? Here; you be the
judge:
http://slate.msn.com/id/2103152/

Don't bother wasting time and money asking MS questions for which there
aren't answers. But one thing you need to understand here S.M., (please
don't take this personally) is that it is not MS's software. It is *your*
software. You needn't use it if you don't want to. There are other choices,
and many swear by them and not at them. Me? I do use IE6 SP-1 and have a
second browser - without the entire suite - as well.

HTH -
--

LuckyStrike
(e-mail address removed)

How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm
http://home.satx.rr.com/badour/html/post.html
--------------------------------------------------------------------

in message LuckyStrike,

Thanks! I am still wondering though if the last three
patches MS has supplied will eliminate all the problems
of vulnerability? In other words is MS IE truly so bad
people should just ditch it and install and use some
other (safer) browser? I prefer MS IE. I don't want to
switch, but the article defines some terrible flaws. Has
anyone from Microsoft made any comment about the validity
of the article? I cannot ask Microsoft directly without
having to pay and arm and a leg, and that should not
happen when it is THERE software with a vulnerability
problem.

S.M.
-----Original Message-----
<snipped>
 
G

Guest

Indeed, you are right. I appreciate the information you
have provided. Thank you!
S.M.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top