IE Attack Code Used on Google Made Public

Terry Olaes

Terry Olaes

I Used to be the [H] News Guy
2FA
Joined
Nov 27, 2006
Messages
4,646
The code used in the attacks on Google’s corporate networks last month was made public, according to IT World. The code exploits IE6 running on XP and can possibly be modified to work on newer browser versions. You IT and security admins out there better tighten up your network as there is currently no patch for this exploit.

A hacker could use the code to run unauthorized software on a victim's computer by tricking them into viewing a maliciously crafted Web page. …Microsoft issued a security advisory on the IE flaw Thursday and has not ruled out the possibility of rushing out an emergency "out-of-cycle" patch to fix it. Microsoft's next set of security patches is due Feb. 9, giving hackers more than three weeks to exploit the flaw.
Click to expand...
 
Keep in mind that while that code/exploit released is specific to IE6, the underlying issue and Microsoft advisory does cover IE7 and IE8.
 
Yeah, but AV tools should be able to pick up the exploit in most cases I hope.

But here's the thing. This is a FLAW in IE, apparently used to attack a FLAW in Google. Glass houses.
 
LonerVamp said:
Keep in mind that while that code/exploit released is specific to IE6, the underlying issue and Microsoft advisory does cover IE7 and IE8.
Click to expand...

sot if DEP is enabled, ironically.

DEP is enabled by default for IE8. (not 7, though)
 
Why is it that organizations running IE6 won't fix their code to run on other browsers? You can't put it off forever, at some point it becomes negligence.
 
niconx said:
Why is it that organizations running IE6 won't fix their code to run on other browsers? You can't put it off forever, at some point it becomes negligence.
Click to expand...

Bit of a chicken and egg problem. Any given company is likely to use applications (and possibly hosted systems) from several other companies. You can't upgrade until all of those apps support IE7+. They can't upgrade their apps until all of their customers upgrade to IE7+.
 
The patch for this exploit is to stop using IE6. Upgrade to a new browser FFS. Its a little ridiculous at this point for companies and our government to still be using it.
 
LonerVamp said:
Keep in mind that while that code/exploit released is specific to IE6, the underlying issue and Microsoft advisory does cover IE7 and IE8.
Click to expand...


exactly, all the loltard laughing at it being IE6 are ill-informed

http://news.bbc.co.uk/1/hi/technology/8463516.stm
Graham Cluley of anti-virus firm Sophos, told BBC News that not only did the warning apply to 6, 7 and 8 of the browser, but the instructions on how to exploit the flaw had been posted on the internet.
Click to expand...


Germany has moved to advise its ppl to not use IE at all
 
my boss doesnt like FF and it drives me crazy as to how he can like IE. its always asking stupid questions in pop-up windows, and generally sucks.
 
one swell foop said:
Corporate user or no, If you're still running IE6, you deserve what you get...
Click to expand...

We are switching to IE7 almost completely now, but you can't help it when archaic hospital systems have software that is run by dead brain companies that only support IE6. Not all of us have a choice, so I hope you understand there :rolleyes:
 
Why would anyone use IE? It explodes the internet when you use it. Fucking stupid.
 
ProfessorKaos64 said:
We are switching to IE7 almost completely now, but you can't help it when archaic hospital systems have software that is run by dead brain companies that only support IE6. Not all of us have a choice, so I hope you understand there :rolleyes:
Click to expand...

Why IE7? Why Not IE8?

Why would anyone use IE? It explodes the internet when you use it. Fucking stupid.
Click to expand...

Because believe it or not but IE8 is not a bad browser, it is actually one of the most secure browsers on the market. Its real issues right now is acid 3 compliance along with its JavaScript speed, that is pretty much it besides its opening of a new tab can be painfully slow compared to lets say Google Chrome.
 
Noliving said:
.... Its real issues right now is acid 3 compliance along with its JavaScript speed.....
Click to expand...

Can someone explain the Acid test. I know IE does really badly at it, but are there any websites that are built like the Acid test?
 
srangara said:
Bit of a chicken and egg problem. Any given company is likely to use applications (and possibly hosted systems) from several other companies. You can't upgrade until all of those apps support IE7+. They can't upgrade their apps until all of their customers upgrade to IE7+.
Click to expand...

This is getting to be a really bad problem. Maybe its time to rethink the software upgrade cycle.

I propose that we forgo the concept of a "version" and instead deliver software updates continuously. New features are added as necessary and the software slowly evolves rather than incurring development in large chunks. You pay a fee for access to the update pipeline (except critical security updates).

The software could then be written in such a way that, when a module gets upgraded, one can choose to keep the old code around for running legacy apps.
 
Sublym3 said:
Can someone explain the Acid test. I know IE does really badly at it, but are there any websites that are built like the Acid test?
Click to expand...

the acid tests are online tests that provide features that a certain webstandard supports.
In practice there are no websites that use all of acid3 features HOWEVER... more and more websites are using css to a level that acid3 does test for.
It is the css side of the acid3 and IE* poor performance which has been a real problem for quite some time

I remember when MS went on a FUD train saying IE8 would be std complaint AS well as when they went on that they pass acid3 ... oh how MS lie...
 
HOCP4ME said:
This is getting to be a really bad problem. Maybe its time to rethink the software upgrade cycle.

I propose that we forgo the concept of a "version" and instead deliver software updates continuously. New features are added as necessary and the software slowly evolves rather than incurring development in large chunks. You pay a fee for access to the update pipeline (except critical security updates).

The software could then be written in such a way that, when a module gets upgraded, one can choose to keep the old code around for running legacy apps.
Click to expand...

Keeping old code around to run legacy applications is entirely the problem isn't it? IE6 is that old code. And since you can't run multiple versions of IE on a single machine...

Delivering software updates continuously would be a support nightmare. Who knows what little piece of weekly code generated a regression unless you can label it?

No piece of code exists in a vacuum. Especially nowadays when that extra layer of a browser sits between you and your data. IT departments are thus not in the business of blindly trusting their vendors' patches.
 
You must log in or register to reply here.
Back
Top