Pelican Parts Forums - Warning for Internet Explorer users

Pelican Parts Forums (http://forums.pelicanparts.com/)

- Off Topic Discussions (http://forums.pelicanparts.com/off-topic-discussions/)

- - Warning for Internet Explorer users (http://forums.pelicanparts.com/off-topic-discussions/446895-warning-internet-explorer-users.html)

kach22i

12-17-2008 11:31 AM

Warning for Internet Explorer users

Sent to me today from a trusted friend.

Warning for Internet Explorer users
December 16th

Quote:

8 hours ago
Computer security experts are advising users of Microsoft's Internet Explorer to switch to another web browser until a major security flaw is fixed.

The problem, first revealed last week, allows criminals to hijack computers and steal passwords if the user visits an infected website.

As many as 10,000 sites have already been compromised to take advantage of the flaw, according to anti-virus software producer Trend Micro.

So far the websites, which are mostly Chinese, have been used to steal computer game passwords which can be sold on the black market.

But Trend Micro security researcher Paul Ferguson told the Associated Press there were major concerns that the problem could be exploited by "more financially motivated criminals for more serious mayhem".

Microsoft said it had so far only found attacks against version 7 of Internet Explorer, the world's most popular web browser, but warned that other versions were "potentially vulnerable".

In a security update issued on Monday, the computer giant said: "We are actively investigating the vulnerability that these attacks attempt to exploit.

"We will continue to monitor the threat and update this advisory if this situation changes."
Microsoft may fix the problem in its regular monthly security update or issue an emergency software patch.

Porsche_monkey

12-17-2008 12:07 PM

Could be a hoax, could be true. I switched to firefox and would never go back.

red-beard

12-17-2008 12:14 PM

they have already sent out a patch

porsche4life

12-17-2008 12:15 PM

Guess Im safe with chrome.

red-beard

12-17-2008 12:22 PM

I don't understand why people think they are safer with Fixefox, or whatever instead of IE. At least MS will own up to vulnerabilities and patch ASAP. I don't think it is that the others are inherently safer than IE.

Rick V

12-17-2008 12:24 PM

I got the same email sent to me from a trusted friend, who is a subcontractor for the government. I would say that warning is true.
I also use firefox as well.

Paul_Heery

12-17-2008 12:39 PM

This is very real. The vuln is present in all versions of IE from v5.01 to v8.beta2. The patch replaces MSHTML.dll. However, this file is different for different versions of IE, so there are specific versions of the patch based upon the version of IE you are using.

masraum

12-17-2008 12:47 PM

Quote:

Originally Posted by red-beard (Post 4365952)

If you wanted to catch as many fish as quickly as possible, and there was a pond that was full of fish. 99% of the fish will be caught with worms, but 1% of the fish can only be caught with frogs (whatever, I'm not a fisher). Would you use worms or frogs for bait?? I suspect you'd use worms. I'm sure there would be some fishermen out there that would really prefer the fish that only eat frogs and would target those, but most of the pop would go for the easy pickin's.

MSIE has a huge, enormous majority of the browser market. If you're a "hacker" or hoodlum, you can target either/any browser, but if you want to wreak maximum havoc, you'll target MSIE.

old man neri

12-17-2008 12:53 PM

I didn't know people still used IE but anyways here is the webpage from MS telling you how to fix it.

flatbutt

12-17-2008 12:54 PM

Our IT guys consider this a real problem. They've adviced that the originators may indeed move on to Firefox and Chrome etal. However they also say that if the site is "https" then you're ok

Gogar

12-17-2008 01:30 PM

I looked for MSHTML.dll for like . . . an hour and I couldn't find it. Guess I'm safe.:)

http://forums.pelicanparts.com/uploa...1229552967.jpg

MysticLlama

12-17-2008 01:38 PM

From the reg today:

Mozilla has rushed out updates to plug a few critical holes in versions 2 and 3 of its popular open source Firefox browser.

Firefox 3.0.5 fixes three critical security flaws in the browser, while 2.0.0.19 stitches four critical vulns.

Mozilla said that XSS vulnerabilities in SessionStore, XSS and so-called JavaScript “privilege escalation” and crashes that could cause memory corruption have been repaired in Firefox 3.0.5.

The bugs in the browser could have been “used to run attacker code and install software, requiring no user interaction beyond normal browsing,” said Mozilla.

It also once again urged users to upgrade from Firefox 2.0 because version 2.0.0.19 is the final release of updates for the browser.

The company “is not planning any further security and stability updates for Firefox 2, and recommends that you upgrade to Firefox 3 as soon as possible”.

It added that Mozilla’s “Phishing Protection” service would no longer be available in Firefox 2. In other words, it won’t be supporting the browser against future online scams and attacks.

Mozilla’s security updates today follow on from Microsoft having to push out an emergency security patch for Internet Explorer on Wednesday, addressing a critical security hole currently being exploited in the wild.

The latest zero-day vulnerability stems from data binding bugs that allows hackers access to a computer's memory space, allowing attackers to remotely execute malicious code as IE crashes, said a red-faced Microsoft yesterday. ®

masraum

12-17-2008 01:51 PM

Quote:

Originally Posted by Gogar (Post 4366068)

I looked for MSHTML.dll for like . . . an hour and I couldn't find it. Guess I'm safe.:)

< clipped fruity pic >

Don't worry, you're completely safe. The apple will keep you completely safe and warm and happy.

http://www.techworld.com/security/news/index.cfm?newsid=1798

Quote:

Mac OS X doesn't stand out as particularly more secure than the competition, according to Secunia. Of the 36 advisories issued in 2003-2004, 61 percent could be exploited across the Internet and 32 percent enabled attackers to take over the system. The proportion of critical bugs was also comparable with other software: 33 percent of the OS X vulnerabilities were "highly" or "extremely" critical by Secunia's reckoning, compared with 30 percent for XP Professional and 27 percent for SLES 8 and just 12 percent for Advanced Server 3. OS X had the highest proportion of "extremely critical" bugs at 19 percent.

http://news.cnet.com/8301-10789_3-9976122-57.html

Quote:

Building on the Trojan released last week, a group of hackers appear to be targeting the Mac OS X platform with more variations.

Last Thursday, Mac antivirus vendors Intego and SecureMac reported a serious vulnerability within the Apple Remote Desktop Agent (ARDAgent). It is part of the remote-management component of Mac OS X 10.4 and 10.5 and is owned by root. Thus, the ARDAgent executable runs this malicious code as root without requiring a password.

http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9123 467&intsrc=news_ts_head

Quote:

December 15, 2008 (Computerworld) Apple Inc. today patched 21 vulnerabilities in Mac OS X, including seven flaws in Flash that the popular media player's maker, Adobe Systems Inc., fixed more than a month ago.

http://robrohan.com/2008/06/19/nasty-mac-os-x-exploit/

Quote:

It seems there is an exploit floating around that allows root access via applescript. It’s a good idea to only download software from trusted sources, but you might want to be extra cautious - or at least let this serve as a reminder to be cautious.

http://www.theregister.co.uk/2008/07/28/pwning_security_updates/

Quote:

A researcher from Argentina has released an exploit package that can install malware on end user machines that run iTunes, Mac OS X, Winzip and a host of other popular software.

Evilgrade is the brainchild of Francisco Amato and works by exploiting weaknesses in the automatic upgrade feature of an affected program or operating system. It works only when a man-in-the-middle attack has first been carried out, but thanks to the domain name system vulnerability that has dominated security coverage ever since researcher Dan Kaminsky sounded the alarm three weeks ago, that's not much of a problem.

This one is pretty interesting
http://blogs.zdnet.com/security/?p=758

Quote:

So this shows that Apple had more than 5 times the number of flaws per month than Windows XP and Vista in 2007, and most of these flaws are serious.

masraum

12-17-2008 01:59 PM

Actually, I'm a strong proponent of Microsoft alternates. Over the years I've explored and tinkered with lots of non-MS stuff, whether it be programs or OS. I used to prefer WordPerfect and hated when I finally had to ditch it in favor of Office. I've had dual boot systems and VMWare with Linux. I've done research on other OSs and programs, and I've been using NetScape/Mozilla/Firefox since 1995 or 1996 whenever I got on the Internet except for a period of a few months where IE was actually better than Netscape way back in the early days.

I just get tired of hearing all of the "Superior" Mac folks trying to make claims that don't really hold water.

The other equalizer is that at least in the past, and I believe to this day, your hardware options in a Mac were regulated by Apple. By regulating what hardware you can put in the machine, you control a major factor in the stability wars. If you only have to program the OS/Apps for a small, relatively fixed set of factors, that's an easier job and should result in a more stable environment. With Windows, since any monkey can buy some chips, through together a sound card, modem, video card, etc.... and stick it in a PC with highly questionable drivers, the fact that Windows is and has been as stable as it is/was with pretty much infinite combinations of software hardware, is a miracle.

imcarthur

12-17-2008 02:19 PM

Thank you Steve & Robb for some reality.

Ian

kstar

12-17-2008 03:07 PM

There's probably not enough room on Wayne's servers to make a comparable "PC" post to the one above re OS X. :D

Porsche_monkey

12-17-2008 03:08 PM

[QUOTE=masraum;4366117] I used to prefer WordPerfect and hated when I finally had to ditch it in favor of Office. [QUOTE]

Still have it. And QuatroPro.

masraum

12-17-2008 03:13 PM

Quote:

Originally Posted by Porsche_monkey (Post 4366251)

Quote:

Originally Posted by masraum (Post 4366117)

I used to prefer WordPerfect and hated when I finally had to ditch it in favor of Office.

Still have it. And QuatroPro.

Yeah, at the time, the two weren't really compatible, and I needed compatibility. I was also having a much harder time "acquiring" the WP suite. Now they are, but the MS Office suite these days is actually pretty nice.

imcarthur

12-17-2008 03:24 PM

I too, was a WordPerfect fan. Since the late 80s. I hated to change over but I was pretty well forced to due to Office. Lotus 123 also. I actually made money macroing that sucker for wage & benefit surveys etc for a while in the early 90s. CorelDraw was another fav & I still use it on occasion. And the list goes on . . .

Ian

Justin S

12-17-2008 04:13 PM

Quote:

Originally Posted by masraum (Post 4366105)

Don't worry, you're completely safe. The apple will keep you completely safe and warm and happy.

http://www.techworld.com/security/news/index.cfm?newsid=1798

http://news.cnet.com/8301-10789_3-9976122-57.html

http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9123 467&intsrc=news_ts_head

http://robrohan.com/2008/06/19/nasty-mac-os-x-exploit/

http://www.theregister.co.uk/2008/07/28/pwning_security_updates/

This one is pretty interesting
http://blogs.zdnet.com/security/?p=758

For me to actually get a virus (I cannot since apple released a bunch of security updates for the above, plus the built in firewall works well), I actually have to think it is a piece of software I want to actually install (I have to type in my username and password, hit continue a few times, and click on the hard drive I want to install to). I think this is very different from just opening a sketchy .exe file.

I'll take anything UNIX based over windows ANY day. Don't get me wrong, Windows works very well when it is NOT plugged into a network.

Gogar

12-17-2008 04:21 PM

Hey, I just had fun setting the hook; I knew someone would go off.

That's definitely some interesting reading, for sure.SmileWavy

Feeling that you're "superior" because of something like a computer is silly. Next thing you're going to tell me that some people believe they're 'superior' because of . . . . I don't know . . . . the cars they drive or something.

SlowToady

12-17-2008 04:32 PM

edit: Are you aware that Windows NT has a POSIX subsystem? And that technically Windows NT could be certified as UNIX, were MS to submit it for testing? Oh I'm sure it wouldn't pass as-is, and would need some development, but nonetheless. And you're aware that Apple didn't even WRITE OS-X? It's based off the BSD kernel, which was developed at Berkley. Actually it's based off NeXTSTEP, which uses a modified Mach derived BSD kernel. Are you aware of the HUGE similarities between Windows NT and DEC/Compaq VMS/OpenVMS? Did you know that Dave Cutler, lead engineer for Dec, left DEC for Microsoft, with 20 engineers and developers in tow to work on NT, and that they are internally very similar? Or that NT was written to be processor/platform independent, and in fact, is? NT has run on more platforms than Mac OS -any-revision ever has.

NT is awesome. You want to ***** about virus, bad software, stuff crashing, crappy drivers, blame third party vendors because your beef lies there. Blame hacky, crappy developers who can't figure out how to write software that doesn't require Administrator access, doesn't have to write to NT system folders, and can't figure out how to open Registry keys in Read Only mode.

Sorry for the rant, but people spouting off about which OS is better, and how anything UNIX based is the way to go in all cases, annoy the hell out of me. Mostly because they almost NEVER know what they're talking about.

Disclaimer: I run Solaris 10 on my desktop, for general computing and software development. I run varies NT machines. And Plan9. No MS Fanboy-ism here.

Quote:

Originally Posted by Justin S (Post 4366388)

I'll take anything UNIX based over windows ANY day. Don't get me wrong, Windows works very well when it is NOT plugged into a network.

kstar

12-17-2008 05:00 PM

Quote:

Originally Posted by SlowToady (Post 4366428)

Congratulations on knowing nothing of what you speak.

edit: Are you aware that Windows NT has a POSIX subsystem? And that technically Windows NT could be certified as UNIX, were MS to submit it for testing? Oh I'm sure it wouldn't pass as-is, and would need some development, but nonetheless. And you're aware that Apple didn't even WRITE OS-X? It's based off the BSD kernel, which was developed at Berkley. Actually it's based off NeXTSTEP, which uses a modified Mach derived BSD kernel. Are you aware of the HUGE similarities between Windows NT and DEC/Compaq VMS/OpenVMS? Did you know that Dave Cutler, lead engineer for Dec, left DEC for Microsoft, with 20 engineers and developers in tow to work on NT, and that they are internally very similar? Or that NT was written to be processor/platform independent, and in fact, is? NT has run on more platforms than Mac OS -any-revision ever has.

NT is awesome. You want to ***** about virus, bad software, stuff crashing, crappy drivers, blame third party vendors because your beef lies there. Blame hacky, crappy developers who can't figure out how to write software that doesn't require Administrator access, doesn't have to write to NT system folders, and can't figure out how to open Registry keys in Read Only mode.

Sorry for the rant, but people spouting off about which OS is better, and how anything UNIX based is the way to go in all cases, annoy the hell out of me. Mostly because they almost NEVER know what they're talking about.

Disclaimer: I run Solaris 10 on my desktop, for general computing and software development. I run varies NT machines. And Plan9. No MS Fanboy-ism here.

Geeze; and to think some of us Mac folk get heck for an "attitude". :D

kstar

12-17-2008 05:02 PM

Quote:

Originally Posted by Gogar (Post 4366401)

Yeah, nice work with the Apple logo. :D

I think the balls sailed clear off the monkey.

Justin S

12-17-2008 05:03 PM

Quote:

Originally Posted by SlowToady (Post 4366428)

It is based off of NeXTSTEP, which was designed by NeXT. If I recall correctly, NeXT was owned by Steve Jobs, one of the co-founders of Apple. The company had a lot of Ex-Apple engineers, and then went back to Apple once they were bought out. So, technically Apple did write SOME of OS X.

I wasn't trying to say which OS was better, I just wanted to point out how difficult it is to install something malicious on os x.

SlowToady

12-17-2008 05:15 PM

As I mentioned in my post. Steve left Apple, started NeXT, which built NeXTSTEP off of a modified Mach 3.0 microkernel. Apple acquired rights to NeXT when the company folded.

Ok, so Apple wrote a (relatively small) portion of OS-X. I already admitted that. Pretty much "theirs" only by rights, not by development. But anyway...

Microsoft did the whole UNIX, thing, too. Way before OS-X. Way before Windows, even. Microsoft XENIX.

Further UNIX doesn't really mean anything anymore. There was a time when UNIX was actually the NAME of an Operating System. Now it's a certification that is given to Operating Systems whose companies pay lots of money to have tested to conform to UNIX standards by the company that owns the UNIX trademark. It's meaningless. An Operating System doesn't even have to be based off some original ATT UNIX code to be UNIX. As I mentioned, NT could be certified UNIX, that POSIX subsystem and what not.

And, given that UNIX doesn't actually mean anything anymore, what's so great about UNIX? It's an antiquated, outdated model of computing, it's from the 60s! (Yes, I'm aware NT goes back about as far.) Nothing UNIX does is new, or revolutionary, as much as the OS-X and GNU/Linux fanboys wants it to be so. Plan9, by Bell Labs, now that is a modern, well thought-out OS design. Avoids a lot of mistakes UNIX made, and continues to make.

But, alas, my only point here is that OS-X is not necessarily better than NT, and is certainly no better just because it's UNIX branded. You want to blame NT problems on someone, like I said, ***** at 3rd party developers, not MS.

Off my soapbox now:)

SlowToady

12-17-2008 05:16 PM

I can't have an attitude, I'm campless:-D

Quote:

Originally Posted by kstar (Post 4366480)

Geeze; and to think some of us Mac folk get heck for an "attitude". :D

kstar

12-17-2008 05:25 PM

I think the following is a realistic, reasonable and non-confrontational representation of OS X vs. Windows re viruses, with my emphasis in bold:

Quote:

Mac OS X, mythically immune to common computer plagues, has actually always welcomed antivirus software. Or, uh, maybe not. Confused? No worries—here's how OS X and Windows differ on resisting viruses and other nasties.

It's not a matter of opinion: OS X is less susceptible to catching a cold than Windows. So is Linux, for that matter. There are two major reasons (and Steve Jobs' pee actually isn't one of them). First, Windows is on 89.6 percent of the world's computers, while OS X is on just 8.9 percent of them. Second, the Unix architecture that OS X and Linux are based on is inherently more secure than Windows, particularly pre-Vista versions. (If these reasons are familiar to you, you may not know the subtler side-effects of each reason that strengthen the case even more, so read on.)

There are a few different ways that Microsoft's mammoth market share actually hurts Windows and helps OS X. For one, writing nastiness that the vast majority of the world's computers are susceptible to is a more efficient use of resources than writing the same evil for a sliver of the population. In biology, a more homogeneous population is more susceptible to a genocidal plague. Same principle applies to the vast, Windows-powered ecosystem. I don't mean someone could write a virus that wipes everybody out. Just that if everybody's running Windows, the population is a much easier target.

The flipside of this—which you might not have considered—is that most malware writers obviously use Windows. They're going to whip up code for the OS they're familiar with and know best. And more to that point, most of the tools and scripts used to wreak havoc on computers are written for Windows. The same ecosystem that provides the biggest, most susceptible audience also provides the most fertile breeding ground for the nasty executables.

But suppose this was some bizarro world where OS X was king. Would Microsoft run ads about how virus-plagued OS X was? Well, it would still be more prudent to run anti-virus software, since there'd be a lot more crap thrown at the Mac OS, but if malware acted mostly like it does today, it likely wouldn't have the same impact as it did on Windows pre-Vista.

A lot of that is because of the way permissions work in OS X vs. Windows. Basically, Unix-based systems are architected so that they require administrator privileges to modify the OS and are traditionally more strict in enforcing them. Critical areas are walled off from normal users—you see this when OS X asks for a password to install updates or change a system setting. A standard non-admin user account is restricted; bad software can't wreak much havoc at all without that password.

This is precisely what Vista's somewhat-maligned User Account Control attempts to replicate, limiting points of intrusion and requiring explicit user permission to get anywhere deep. On Windows, historically, the enforcement of these restrictions has been lax in the name of convenience.

This is not to say that OS X is invulnerable, by any means. The main applications folder is relatively unprotected, and any running app can write to it and most of what's inside. Coupled with OS X's app-bundling architecture, this makes it easier to replace program executables or sneak in a piggybacking one. Even then, however, the malware would need to elicit elevated permissions to do any hardcore damage to the core OS; it could, unfortunately, nuke your relatively unprotected Home folder though. Another point of vulnerability, or at least a pain point, according to Mac Forensics Lab, is OS X's centralized address book, which also has weak defenses. If the Home folder book did require the same level of permissions, it would be kinda unusable, because you'd have to elevate permissions to make any and every change.

This brings us to OS X's biggest security hole, the one that it actually shares with every operating system: you. It doesn't matter how good baked-in security is if a user throws out the welcome mat for whatever crap comes their way. On the flip side, you're also the first, and best, line of protection. Don't do anything stupid, and you'll be fine, anti-virus software or not—whatever OS you're running.

http://www.gizmodo.com.au/2008/12/giz_explains_why_os_x_shrugs_off_viruses_off_bette r_than_windows-2.html

Security through (relative) obscurity and BSD underpinnings do offer an advantage against pre-Vista Windows, regardless of whomever from wherever contributed to writing the OS and whether or not they kissed Steve's ring.

While there may be an OSX "virus" (infects w/o user interaction) in the wild, I am not aware of it, although I am aware there are/have been trojans (infects with the help of user interaction).

FWIW and not meant to inflame! I know people that I consider very close friends and have even had relations with women who use MSFT OSs, and we get/got along just fine! :D

FWIW.

kstar

12-17-2008 05:25 PM

Quote:

Originally Posted by SlowToady (Post 4366516)

I can't have an attitude, I'm campless:-D

I was just giving you a hard time. :)

stealthn

12-17-2008 06:42 PM

Man did you guys go off on a tangent, now get out of your mothers basement and go look at girls :p

Anyway several of my customers got hit with the exploit and we pushed Microsoft hard for a fix (as did several other countries). The real culprit is the end user as this was a user initiated exploit on the browser (you would have to go to a compromised site and it would exploit your browser)

The fun began when the blackhats/script kiddies found out how easy it was to exploit, then we were seeing 4 year old malware start surfacing. It was pretty funny (not)

Anyway patches have been tested and we found no issue with any browser based applications our clients run. MS has it in Windows update now so I would suggest updating your PC ASAP.

Happy Holidays Steve and Bill....

All times are GMT -8. The time now is 10:12 PM.

Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2025, vBulletin Solutions, Inc.
Search Engine Optimization by vBSEO 3.6.0
Copyright 2025 Pelican Parts, LLC - Posts may be archived for display on the Pelican Parts Website

DTO Garage Plus vBulletin Plugins by Drive Thru Online, Inc.