Heads up - Tilted Forum Project Discussion Community

feelgood · 01-28-2004, 10:28 AM

Quote:

New Explorer hole could be devastating
A little imagination could undermine browser

By Kieren McCarthy, Techworld

A security hole in Microsoft’s Internet Explorer could prove devastating.

Following the exposure of a vulnerability in Windows XP earlier this week, “http-equiv” of Malware has revealed that Explorer 6 users (and possibly users of earlier versions) could be fooled into downloading what look like safe files but are in fact whatever the author wishes them to be - including executables.

A demonstration of the hole is currently on security company Secunia’s website and demonstrates that if you click on a link, and select “Open” it purports to be downloading a pdf file whereas in fact it is an HTML executable file.

It is therefore only a matter of imagination in getting people to freely download what could be an extremely dangerous worm - like, for instance, the Doom worm currently reeking havoc across the globe.

However what is more worrying is that this hole could easily be combined with another Explorer spoofing problem discovered in December.

The previous spoofing problem allowed Explorer users to think they were visiting one site when in fact they were visiting somewhere entirely different. The implications are not only troublesome, but Microsoft’s failure to include a fix for the problem in its January patches has led many to believe it cannot be prevented.

If the same is true for this spoofing issue, then it will only be a matter of time before someone who thinks they are visiting one website and downloading one file will in fact be visiting somewhere entirely different and downloading whatever that site’s owner decides.

We also have reason to believe there is no fix. It may be that today’s flaw is identical to one found nearly three years ago by Georgi Guninski in which double-clicking a link in Explorer led you to believe you were downloading a text file but were in fact downloading a .hta file.

In both cases, the con is created by embedding a CLSID into a file name. CLSID is a long numerical string that relates to a particular COM (Component Object Model) object. COM objects are what Microsoft uses to build applications on the Internet. By doing so, any type of file can be made to look like a “trusted” file type i.e. text or pdf.

Guninski informed Microsoft in April 2001. The fact that the issue has been born afresh suggests rather heavily that the software giant has no way of preventing this from happening.

So how bad could it get? Just off the top of our heads - suppose someone set up a fake Hutton Inquiry site today with a link to the report’s summaries - how many people across the UK would download a worm this afternoon? And imagine the computers it would end up on.

The possibilities are endless, and since both spoof issues appear to be unfixable, it must surely place a big question mark over Explorer’s viability as a browser.

The advice is to avoid this latest hole is always save files to a folder and then look at them. On your hard drive, the file’s true nature is revealed. But this advice is nearly as practical as Microsoft telling users not to click on links to avoid being caught out by the previous spoof problem.

All in all, it does not look good. Not good at all.

I know this should be in the Tech section but how many techie IE user do we have out here? Not many eh?

So, just heads up for those of you who use Opera or IE to keep an eye on what they're clicking on. I don't know if Netscape or Mozilla have the same problem.

bonehed1 · 01-28-2004, 11:04 AM

Thanks for the heads up bro. Gonna keep my eye out for this and see what happens.

tinfoil · 01-28-2004, 11:09 AM

Normally I blame uninformed users for viruses and the like, but with bugs like this, even the most educated geek (still using IE) could be duped.

Gah.. thanks MS!

Redlemon · 01-28-2004, 11:13 AM

Quote:

Originally posted by feelgood
So, just heads up for those of you who use Opera or IE to keep an eye on what they're clicking on. I don't know if Netscape or Mozilla have the same problem.

Just checked the demonstration URL with Mozilla Firebird (current 0.8 branch), and it is not fooled.

Firebird for safety!

01-28-2004, 11:39 AM

ya, thank you- yikes! I don't download much, but if I do, I will be very cautious.

skier · 01-28-2004, 02:36 PM

i'm not going to click on your link. nyah!

Silvy · 01-28-2004, 02:58 PM

Quote:

Originally posted by feelgood
So, just heads up for those of you who use Opera or IE to keep an eye on what they're clicking on. I don't know if Netscape or Mozilla have the same problem.

I don't know why this IE vulnerability turned into an Opera one as well, but my Opera isn't fooled...
But thanks for the warning!

Holo · 01-28-2004, 04:54 PM

*cough*

sailor · 01-28-2004, 08:02 PM

/me is glad it doesnt effect Mozilla

orphen · 01-28-2004, 08:10 PM

One more reason to use mozilla!

MSD · 01-28-2004, 09:46 PM

Did anyone else notice that she wrote "reeking havoc" instead of "wreaking havoc"?

01-28-2004, 11:04 AM	#2 (permalink)
bonehed1 Psycho Location: California	Thanks for the heads up bro. Gonna keep my eye out for this and see what happens. __________________ Stuff is Good

01-28-2004, 11:09 AM	#3 (permalink)
tinfoil Fucking Hostile Location: Springford, ON, Canada	Normally I blame uninformed users for viruses and the like, but with bugs like this, even the most educated geek (still using IE) could be duped. Gah.. thanks MS! __________________ Get off your fuckin cross. We need the fuckin space to nail the next fool martyr.

01-28-2004, 02:36 PM	#6 (permalink)
skier Rawr! Location: Edmontania	i'm not going to click on your link. nyah! __________________ "Asking a bomb squad if an old bomb is still "real" is not the best thing to do if you want to save it." - denim

01-28-2004, 04:54 PM	#8 (permalink)
Holo A Real American	cough __________________ I happen to like the words "fuck", "cock", "pussy", "tits", "cunt", "twat", "shit" and even "bitch". As long as I am not using them to describe you, don't go telling me whether or not I can/should use them...that is, if you want me to continue refraining from using them to describe you. ~Prince

01-28-2004, 08:02 PM	#9 (permalink)
sailor beauty in the breakdown Location: Chapel Hill, NC	/me is glad it doesnt effect Mozilla __________________ "Good people do not need laws to tell them to act responsibly, while bad people will find a way around the laws." --Plato

01-28-2004, 11:39 AM	#5 (permalink)
:::OshnSoul::: Guest	ya, thank you- yikes! I don't download much, but if I do, I will be very cautious.

01-28-2004, 08:10 PM	#10 (permalink)
orphen Insane	One more reason to use mozilla!

01-28-2004, 09:46 PM	#11 (permalink)
MSD The sky calls to us ... Super Moderator Location: CT	Did anyone else notice that she wrote "reeking havoc" instead of "wreaking havoc"?