Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Widespread Attacks Exploit Newly-Patched IE Bug

Soulskill posted more than 4 years ago | from the of-fish-and-barrels dept.

Internet Explorer 141

itwbennett writes "The first widespread attack to leverage the Internet Explorer flaw that Microsoft patched in an emergency update Thursday morning has surfaced. By midday Thursday Symantec had spotted hundreds of Web sites that hosted the attack code. The attack installs a Trojan horse program that is able to bypass some security products and then give hackers access to the system, said Joshua Talbot, a security intelligence manager with Symantec. Once it has infected a PC, the Trojan sends a notification e-mail to the attackers, using a US-based, free e-mail service that Symantec declined to name." Relatedly, reader N!NJA was among several to point out that Microsoft has apparently been aware of this flaw since September.

cancel ×

141 comments

Sorry! There are no comments related to the filter you selected.

Cum (-1, Offtopic)

Anonymous Coward | more than 4 years ago | (#30869720)

It's what for breakfast.

Re:Cum (-1, Offtopic)

Anonymous Coward | more than 4 years ago | (#30869794)

So you eat your own cum, does that make you gay?

Re:Cum (-1, Offtopic)

Anonymous Coward | more than 4 years ago | (#30869876)

Since every guy who has ever lived has tasted his own cum, I would say no.

Re:Cum (-1, Offtopic)

Anonymous Coward | more than 4 years ago | (#30869914)

So you eat your own cum

Yes.

does that make you gay?

No. Does beating off make you gay? After all, when you masturbate you're stroking a hard cock...

kind of makes you wonder (5, Interesting)

v1 (525388) | more than 4 years ago | (#30869750)

in TFA: The flaw was in the Microsoft Security Response Center's (MSRC) queue to be fixed in the the next batch of patches due in February but the targeted zero-day attacks against U.S.

Kinda makes you wonder just how many of these critical security bugs IE currently has in their queue to be fixed "sometime in the near future"?

And at the same time you have to wonder just how nasty some of the others are that haven't made the cut yet, just waiting to become the next "zero day we own your computer, again"? We see how big of an issue this is, and MS was clearly in no hurry to fix it, so you'd have to assume that there are at least a few more of these that they know about and aren't fixing yet.

Re:kind of makes you wonder (0)

Anonymous Coward | more than 4 years ago | (#30869810)

Ummm...Firefox with NoScript? The devil, you say!

Re:kind of makes you wonder (5, Insightful)

BartholomewBernsteyn (1720348) | more than 4 years ago | (#30870086)

That is the main problem with closed source software; in the event of a security hole, you as a customer / company are left to the mercy / arrogance of your software vendor to patch the flaw. Until he does, you can do nothing but become increasingly concerned, since you're left to the increasing danger of having your machine compromised in the meantime. This might be the right time to educate people about the main merit of open source software: As soon as a security hole is discovered, virtually anyone can contribute to a timely resolution. 0day? Fixed tomorrow!

Re:kind of makes you wonder (5, Insightful)

mpe (36238) | more than 4 years ago | (#30870736)

That is the main problem with closed source software; in the event of a security hole, you as a customer / company are left to the mercy / arrogance of your software vendor to patch the flaw.

Or even admit that there actually is a flaw. Microsoft were told about this months ago and there's no reason to believe that the first person to find a flaw with be a "white hat".

Re:kind of makes you wonder (2, Interesting)

rtfa-troll (1340807) | more than 4 years ago | (#30870910)

I really would be interested to know this too. It's a fairly big coincidence that Chinese hackers should happen to be using the same exploit as was in the MS security queue. The two likely explanations that occur to me are:
  • China has access to the exploits to fix queue and has used that to develop their zero day exploits.
  • The White hat hacker got the exploit from watching an attack

either thing sounds quite bad for Microsoft. The first means their queue security is inadequate and that's a really big problem for the policy of responsible disclosure they try to encourage. The second thing is more serious because it means Microsoft failed to fix or inform about an hole which was actively being exploited. In this case the question is whether the white hat declared to Microsoft how he came about his exploit.

Anyone have a better explanation which doesn't involve such a coinicidence?

Re:kind of makes you wonder (3, Interesting)

ppanon (16583) | more than 4 years ago | (#30871492)

China demanded the source code to Windows years ago and Microsoft gave it to them. I don't think it's a complete coincidence that China has been pushing Red Flag Linux internally. By now they know the bugs in Microsoft Windows and have multiple exploits ready for use, and they have backdoors in Red Flag so they can spy on their own people. If they ever get into a cyberwar with the US, you had better be running something other than Windows.

Re:kind of makes you wonder (0)

Anonymous Coward | more than 4 years ago | (#30870866)

As soon as a security hole is discovered, virtually anyone can contribute to a timely resolution.

0day? Fixed tomorrow!

You're flat out wrong. "Virtually anyone" implies that a there's a high probability that a randomly selected person could do the task. However, the vast majority of the population does not know how to program software at all (even among the people who use computers regularly), so it is quite clear that most people are clearly not capable of fixing a security problem.

Re:kind of makes you wonder (-1, Flamebait)

Anonymous Coward | more than 4 years ago | (#30870900)

I probably know more about software development than you do, but I still don't have the free time to go around manually patching everything I run. Open source won't solve the problem, and you're a god damned moron for thinking it would.

Re:kind of makes you wonder (2, Interesting)

westlake (615356) | more than 4 years ago | (#30871216)

That is the main problem with closed source software; in the event of a security hole, you as a customer / company are left to the mercy / arrogance of your software vendor to patch the flaw. Until he does, you can do nothing but become increasingly concerned...
0day? Fixed tomorrow!

You can patch only what you know how to patch.

In 2008 there were between 6 and 10 million lines of code in the Linux kernel alone. Linux Kernel Surpasses 10 Million Lines of Code [slashdot.org]

In 2003 OpenOffice.org had 9 million lines of code. Build FAQ for OpenOffice.org [openoffice.org]

You can only test your patch only on systems you can access.

That your home-brewed solution is seriously flawed may only be discovered by your neighbors.

The next time they load a JPEG from your site.

As soon as a security hole is discovered, virtually anyone can contribute to a timely resolution.

Most likely by staying out of the way.

There is the final problem of how to roll out a patch. The naive end-user who auto-patches was spared Cornflicker.

Secunia integrated with Microsoft WSUS [secunia.com]

Re:kind of makes you wonder (0)

Anonymous Coward | more than 4 years ago | (#30871230)

That is the main problem with closed source software; in the event of a security hole, you as a customer / company are left to the mercy / arrogance of your software vendor to patch the flaw.

That's also the problem with open source software: Even those who don't really know what they're doing can implement a "fix" and may introduce more bugs, incompatibilities, etc.

0day? Fixed tomorrow!

Fixed by which standards?

Re:kind of makes you wonder (0)

awyeah (70462) | more than 4 years ago | (#30871344)

The other problem is that as a company, you can't just make a patch and send it off like you can with open source. You have to QA the thing first. Plus, I'd bet some companies have procedures and sign-offs that need to happen. Basically, red tape.

Re:kind of makes you wonder (2, Interesting)

myspace-cn (1094627) | more than 4 years ago | (#30871934)

Isn't this just an argument for Microsoft's removal of FTP server updates and no "out of band" patching, and to only release "scheduled patching" (All this as I recall back at a time when Microsoft said they were going to enhance security from these changes)

Since that time shit has rolled downhill.

Does the Secunia warning on IE get ignored because of Microsoft's enhanced security policies? Or is it because removing IE's activeX breaks WGA?

Personally I'd love to see tools for XP which allow removal and install of IE6,7,8 regardless of install state or service pack.

I'll bring it back to pro tools, why can't you remove IE8 and install IE7 once your shit is slipstreamed SP3? While I would target the IE for the tool I need, other's might just want to remove IE altogether from their system for stability and security. Good luck if your OS has IE 8 to begin with.

Re:kind of makes you wonder (1)

Reaper9889 (602058) | more than 4 years ago | (#30871462)

That is not really true. You, as a outsider, will need some time to understand the code and what is causing the error before you can fix it. That will take time and you can bet (for everything, but the smallest pieces of software) that it won't be "Fixed tomorrow".

I suppose you could find someone who knows the code and throw money at him to fix it, but I suspect you could do the same with Microsoft, if you cared enough about the problem (but proberly quite a bit more expensive).

I expect to be modded down for this (old, but what you said is the conventional wisdom on /.).

Re:kind of makes you wonder (0)

Anonymous Coward | more than 4 years ago | (#30873084)

I installed Ubuntu in company laptop.

Re:kind of makes you wonder (2, Insightful)

Runaway1956 (1322357) | more than 4 years ago | (#30870260)

"Kinda makes you wonder" if it's another slow news day. I mean, how many people did NOT see this coming? Even Joe Sixpack probably had this figured out - assuming that he even watches the evening news. Wait - maybe I'm getting senile. Joe stopped watching the news when he figured out how to schedule his programming around ESPN, More Gore Television, and Hot Chicks After Hours.

Phhht. Maybe this IS news to part of the world?

Re:kind of makes you wonder (3, Insightful)

Penguinisto (415985) | more than 4 years ago | (#30870262)

I'm the last guy you can accuse of being a Microsoft fanboy, but let's be fair on at least one aspect: it is helpful if the patches do their job (closing the hole) without breaking functionality (especially with enterprise software, where Microsoft counts its biggest customers).

I agree perfectly that it is a fundamental flaw in proprietary software to have potentially exploitable vulns that only, say, Microsoft and maybe the script kiddies know about. I further agree that failing to disclose them prevents users from implementing some sort of work-around (depending on severity, blocking certain script actions at the proxy, implementing certain GPO actions to mitigate damage, etc). OTOH, most of Microsoft's customer base wouldn't even know what a work-around is (aside from just using a different browser, which is probably not what you'll see Microsoft recommending).

The nasty stuff is lurking in there, certainly. Whether the bad guys know about it and can actually use it is another matter. I personally subscribe to the philosophy of full disclosure - it is better that everyone using the product know about flaws in it, if only to protect themselves. OTOH, I can see and appreciate (though not quite agree to) the opposite tack of limiting fields of research for the bad guys, as evidenced by the bad guys' habit (among others) of sifting through patches to find the flaws... where I part ways is in knowing that the patch-sifting is only one of many tools in which to find vulns. Whether it is the most popular method or not, I do not know.

Re:kind of makes you wonder (1)

Opportunist (166417) | more than 4 years ago | (#30870552)

Unfortunately you're right, from a manager's point of view. Security, for them, is nice to have, but it must not get in the way of a smooth workflow. It's not "how secure is my system" but rather "how much does it cost if there's a leak and how likely is it to happen". It does simply not matter to them that they're insecure, as long as the data loss vs. its likelyness to occur comes out on top of the cost (be it direct, i.e. having to buy something, or indirect, i.e. hampering workflow and productivity), security is simply not seen as important.

Not even goodwill loss matters. A company lost your private data? Fffft. Does anyone care? Look, Lady Gaga has a new album out!

Re:kind of makes you wonder (3, Interesting)

X0563511 (793323) | more than 4 years ago | (#30870434)

I like to think that the code for IE is so horribly mangled that it takes a solid month to get the thing to build (including compile errors, stupid typo bugs, compile time, compiling for all the different windows configs, etc)

It makes me feel nicer that it could just be a shitty project, rather than just shitty people.

Re:kind of makes you wonder (3, Funny)

Zero__Kelvin (151819) | more than 4 years ago | (#30871044)

"It makes me feel nicer that it could just be a shitty project, rather than just shitty people."

There is no reason why they can't live together in unison.

Re:kind of makes you wonder (1)

Foredecker (161844) | more than 4 years ago | (#30871504)

Sorry to pop your fantasy bubble, but IE, Windows, Office, Visual Studio and pretty much everyting else we ship build every day. That includes all the flavors: release, checked (debug), 32-bit, 64- bit, Itanium (yes, we still build that), and several languages. The build pretty quickly to - usually just a few hours. This is from 100% source to a fully installable product.

With few exceptions, the code base is very 'clean'. That's true for most our products as well. For example, we have what we call 'MQ' phases of a project where we do nothing but clean things up. Of course, nothing is perfect: one thing great about code is that it can always be better. Thats true for our code, and others as well.

So are you are calling people at Microsoft shitty? If you are than Ill ask you this: Really? Is that the best you can do? Name calling? Okey dokey then...

Foredecker, let me "lay it on the table" for you (-1, Flamebait)

Anonymous Coward | more than 4 years ago | (#30872712)

"So are you are calling people at Microsoft shitty? If you are than Ill ask you this: Really? Is that the best you can do? Name calling? Okey dokey then..." - by Foredecker (161844) * on Saturday January 23, @02:12PM (#30871504) Homepage

Well, then I'll just "cut to the chase" here, for you Foredecker, as I did here vs. these STUPID trolls in your defense today -> http://slashdot.org/comments.pl?sid=1518398&cid=30871878 [slashdot.org]

THEY ARE A PACK OF UNDEREDUCATED SHITHEAD TROLLS MAN, who are DEFINITELY "big talkers" but no substance OR visible accomplishments to their names/credits, first of all...

Secondly?

They'll do ANYTHING so their [insert *NIX flavor of the day here] gets a bit more "market share"... lol, only thing is? Well, I have been hearing "THIS IS THE YEAR OF LINUX" or "THIS IS THE YEAR OF MACOS X v whatever" for oh, almost 6++ yrs. whilst I 'hang around here'

(NO *NIX variant, ever will, or it would have by now... & they're in the stark realization that your companies' softwares ARE ON TOP, & it makes them angry they made the "incorrect choice" basically... lol, and we ALL know it!)

So, they then resort to their what I call "NOT MEN" ways, & b.s., lie, or otherwise harass & troll others who point these WIDELY KNOWN FACTS out to they... as they did to me here this week -> http://linux.slashdot.org/comments.pl?sid=1519330&threshold=-1&commentsort=0&mode=thread&cid=30853490 [slashdot.org] & all they had was ATTEMPTED "adhominem attacks" directed my way, but, nothing of substance (& I even easily turned aside their b.s. there on those too... as they're NOT too well, generally "intellectually gifted", lol, shall we say!)

So, now that I've got that "all said & aside", well, in closing...?

Don't let these little prick trolls get to you man - they're something to amuse yourself with actually, because WE ALL KNOW WHO IS #1 OUT THERE (MS).

APK

P.S.=> I don't HAVE to be "nice" about this either, as you most likely do... you have a position to defend as a representative of your company in Microsoft here - were I in the SAME position? I'd do the same, I'd have to... sucks to have "chains" on you but, that's how it is @ times!

NOW - WHAT they DO want you to "pop" on them. Their only "weapons" lol, as trolls, are "effete mod downs" w/out justifications, or adhominem attacks, and lastly making YOU "get angry" & to waste your time @ the point when they are unable to defeat facts, with their fictions + lies & more... they're pitiful man: Get a laugh out of them!

NOW, couple last things:

I actually DO like LINUX (it's come a LONG WAYS since I first tried it in Slackware 1.02 circa 1994 iirc, & even MacOS X... both work, both are a pleasure to use, & they generally are pretty solid @ this point...

However/by the same token?

I do NOT like their "Pro-*NIX troll community" around here... they're nostly juvenile 10-below plantlife IQ bearing little PUNKS, & ones with no accomplishments to their names & they waste time b.s.'ing others with false PR that is very "Anti-MS" in its sentiments usually... so, instead of ACTUALLY WORKING TO HELP PATCH OR IMPROVE THEIR OPERATING SYSTEMS OF CHOICE THAT ARE *NIX VARIANTS?

These "beyotches" that gossip like women around here instead troll & harass others... why is that? Because they have no real skills & are useless punks, pretty simple!

No, this isn't ALL of you folks here @ /. but a good deal of them fit this critique of mine, by ALL means... apk

Re:kind of makes you wonder (5, Insightful)

b4dc0d3r (1268512) | more than 4 years ago | (#30870506)

I'm a software developer. I have a list of things I need to fix, some things are higher priority. We set a date, and work as many patches as we can toward that date, into a single release or patch. Makes it easier to test when you bundle several things together, and can test 5 patches with a single test case instead of individually. That makes the cycle more efficient.

Now, a large company would have more patches, and more would be high priority. So they fix what they can, that makes sense. Open the bug list, sort by priority, own one (or get assigned one). To the developer, this is just one of several (hundred?) problems on the list. Management has to increase the priority based on input from triage.

The entire world might know a defect is a security vulnerability, but if it's not made clear to the triage guy, it will sit as "possible denial of service" medium or medium-well priority until the known vectors are taken care of.

Thinking about it this way makes Microsoft's blunders understandable. Not forgivable of course. My customer sends me a bug report and says "gwah, you're exposing my entire database to everyone fix it now or face a lawsuit!!!!eleventy". I say, let's take a look, we find out that yes you can see the entire data set - after you enter your credentials and only while on your company's network, and you just sent a mail to your competitor with your credentials in it. Change your password, WONTFIX. In other words, MS has to have good info in order to decide how to prioritize.

At the same time, they have to keep their customers and shareholders happy, so while the triage guy says "this is the worst bug ever in the history of everything and it needs to be fixed yesterday" the company itself says to the employee "sure, but follow all processes and have it reviewed and put it in the next patch cycle and we'll test all of them next week and prepare for a release next week."

Then to its customers and shareholders it says "A small, hard-to-exploit exploit has been found and even though ASLR and DEP and sandboxing are in place, someone might after a million failures be able to exploit this exploit so we've decided to be proactive and fix this exploit. We haven't heard of anyone exploiting this exploit, but we didn't really ask any of our friends in the malicious software industry - but that was just because we didn't want to tip our hand. Your security is, after all, very important to us. Exploit."

In short: there are more than we'll ever know.

Re:kind of makes you wonder (1)

Jaktar (975138) | more than 4 years ago | (#30870874)

Now that was extremely well put.

Re:kind of makes you wonder (1)

Dilligent (1616247) | more than 4 years ago | (#30871766)

Mod parent up, exactly my thoughts as a Software Developer as well.

Bundling (1)

zogger (617870) | more than 4 years ago | (#30871980)

Why is bundling multiple changes/patches better? Seems like if you did it one at a time, if something broke, you would be pretty confident the new code was doing it. With multiple simultaneous changes, if something broke, you would have to sort out *which* of the new changes was responsible first, or also contemplate if the random combination of any of the changes was responsible, which greatly ups the number of potential problems to look at.

Re:kind of makes you wonder (2, Funny)

cheftw (996831) | more than 4 years ago | (#30870672)

The attack installs a Trojan horse program that is able to bypass some security products

I don't see why you're so worried, this obviously refers to the equestrian unit.

Re:kind of makes you wonder (2, Interesting)

Ifni (545998) | more than 4 years ago | (#30871456)

Not to spark a conspiracy theory, but how much do you suppose some over-worked, under-paid, and under-appreciated Microsoft employee was paid by an agent of the Chinese government to provide this flaw from the list of yet to be addressed flaws? How much money do you think there is in selling these exploits in major software products to enemies of the state? I'm not implying that Microsoft does this intentionally, but I can see how their cavalier attitude can certainly create such an opportunity for Microsoft employees in the know. This should certainly be looked into by law enforcement officials to make sure that such leaks don't actually exist.

Re:kind of makes you wonder (2, Informative)

bug (8519) | more than 4 years ago | (#30872146)

Security firm eEye used to keep a long list of Internet Explorer vulnerabilities that they had reported to Microsoft, but Microsoft hadn't developed patches for. eEye's list tracked how many months, or even years, Microsoft had known about the vulnerabilities without releasing a patch. A few years ago, under pressure from Microsoft, eEye agreed to take their list down. Microsoft happens to be a big customer of eEye's, and presumably is responsible for a lot of eEye's revenue. This has been fairly typical behavior for security firms that have signed lucrative contracts with Microsoft over the last few years, and one wonders how much of this type of thing is merely hush money.

threat? (4, Insightful)

clarkn0va (807617) | more than 4 years ago | (#30869758)

Microsoft has apparently been aware of this flaw since September.

Further evidence that the only "threat" as far as MS is concerned is the threat of a damaged public perception. Although I suppose that's an improvement in itself.

Re:threat? (1)

hoboroadie (1726896) | more than 4 years ago | (#30869778)

I just laugh. I haven't had to reformat the drive even once since I obscured IE.

Re:threat? (5, Informative)

1s44c (552956) | more than 4 years ago | (#30869906)

I just laugh. I haven't had to reformat the drive even once since I obscured IE.

If you use windows without IE you are still very much at risk from the many other windows holes. You will cracked sooner or later and you may not even notice.

Re:threat? (1, Insightful)

Anonymous Coward | more than 4 years ago | (#30870006)

OK, that's just a ridiculous statement.

If you use windows without IE you are still very much at risk from the many other windows holes. You will cracked sooner or later and you may not even notice.

How would you possibly know he will be cracked? If he doesn't click on and run malicious code he won't be "cracked". You do realize that Windows has had a firewall on by default for many years now, right? Today, the biggest source of vulnerabilities are applications. Since he has already taken Internet Explorer out of the equation by not using it, these vulnerabilities are in things like Firefox, Flash, Office, Acrobat Reader, etc. The attacks based on those vulnerabilities are not using "windows holes"; they are using problems with the applications. Simple safe computing practices insulates you against most all of them.

Re:threat? (2, Interesting)

1s44c (552956) | more than 4 years ago | (#30870236)

So you are saying that any windows machine that doesn't run IE is safe-ish? Because it's not, there are countless flaws in other Microsoft code any one of which could cause a major security problem. If you don't start with a good design you have NOTHING.

You don't really trust a software firewall written by Microsoft do you? If you want a firewall use a proper ( i.e. not software ) one.

(i.e. not software) (1)

tepples (727027) | more than 4 years ago | (#30870794)

What useful firewall are you referring to that isn't implemented in software? Or by "(i.e. not software)" were you referring to anything implemented on an appliance?

Re:(i.e. not software) (1)

1s44c (552956) | more than 4 years ago | (#30870818)

What useful firewall are you referring to that isn't implemented in software? Or by "(i.e. not software)" were you referring to anything implemented on an appliance?

Ok, they are all implemented in software on some device or other. I was using the naive definition of a 'software firewall' which I take to mean one running on the user system it's meant to protect.

A better firewall would be one running on a device between the two user system and the internet like a Cisco device or a OpenBSD or Linux machine.

Re:(i.e. not software) (1)

lukas84 (912874) | more than 4 years ago | (#30872338)

The question is what you're expecting a firewall to do.

What the Windows Firewall does by default (in a Public network) is prevent any incoming traffic to open TCP or UDP ports. This works very well and there are few edge cases where a separately hosted Firewall would provide a significant advantage.

What it does not do is prevent any kind of outgoing traffic - you can configure this through policies in a corporate network, to prevent unapproved applications from accessing the network (which also works well), but this can't work on a home computer where the users have local admin rights, as a malicious app can just add the required firewall rules. A separately hosted Firewall doesn't work any better - it can't tell if the SSL Traffic on Port 443 is coming from IE or a malicious application.

Re:threat? (2, Insightful)

ozmanjusri (601766) | more than 4 years ago | (#30870642)

How would you possibly know he will be cracked?

80% of home Windows computers have been compromised [eff.org] by one or more viruses.

IE market share is below 40% [w3schools.com]

You do the math.

Interestingly, even though most of those apps you mentioned as sources of vulnerabilities exist on other platforms, the rates of infection of anything other than Windows remains at zero or close to it. I'd say that points to a platform problem, not an application one.

Just wait until Linux becomes popular! (1)

Zero__Kelvin (151819) | more than 4 years ago | (#30871134)

No, No! Haven't you heard? Even though Linux owns the server market and is used by many big corporations including Google, Windows has almost all of the malware because it is more popular!

Re:Just wait until Linux becomes popular! (2, Interesting)

lukas84 (912874) | more than 4 years ago | (#30872388)

I've seen many compromised Linux machines sending out spam. Especially prevalent in Germany, where 1&1 and similar mass hosters provide hosted very cheap rental of Linux servers.

Of course, the issues are the same as those of compromised Windows systems:

* Not up to date on security patches
* Admin doesn't know what he's doing
* Using insecure legacy versions of software

Claim EPIC FAIL (1)

Zero__Kelvin (151819) | more than 4 years ago | (#30873252)

"Of course, the issues are the same as those of compromised Windows systems:

You forgot to list one: designed from the ground up with insecurity in mind

Oh wait. That's right. Only one of the OSes mentioned meets that criterea.

"I've seen many compromised Linux machines sending out spam.

You have offered no evidence that a Linux machine was compromised. It is impossible to tell based on the fact that SPAM is coming from that direction. A poorly configured mail server allowing SMTP relaying does not constitute a compromised system.

Re:threat? (4, Informative)

nmb3000 (741169) | more than 4 years ago | (#30872040)

IE market share is below 40% [w3schools.com]

Anyone who uses w3schools's browser stats as a reference for general browser usage needs to get knocked on the head a few times. That is a perfect example of biased results due to the nature of the sample.

A better number is about 62% [wikipedia.org] .

Re:threat? (3, Insightful)

Kozz (7764) | more than 4 years ago | (#30870326)

If you use windows without IE you are still very much at risk from the many other windows holes. You will cracked sooner or later and you may not even notice.

Even more disturbing, some people may notice and not think much of it. What is the most obvious evidence you can imagine of being 0wned? I talked to a guy once who was telling me of PC troubles (he knew I was a "techie" guy) and said he occasionally would notice the mouse would move, click, etc without his input. I quickly asked him if he did any kind of commerce, banking, online bill-paying stuff, and he said "yes". I told him to go home and unplug his modem/cat5/whatever and to format the computer asap.

It wasn't clear what exactly he thought the problem was, but I recall thinking he was surprised when I told him that there was a person on the other end of the wire moving the mouse, using his PC for who-knows-what. And even then he didn't seem to have a sense of urgency about fixing it. You can't fix stupid, as they say.

Re:threat? (0)

Anonymous Coward | more than 4 years ago | (#30873126)

Or he could have a track pad...

Re:threat? (1)

AmberBlackCat (829689) | more than 4 years ago | (#30871020)

If you use Linux, you are very much at risk from the many holes. You will be cracked sooner or later and you may not even notice.

Re:threat? (1, Insightful)

Anonymous Coward | more than 4 years ago | (#30871156)

You will cracked sooner or later and you may not even notice.

And how is the average user going to notice they got rooted on Linux? Nice try at FUD though. Wouldn't expect anything but the best anti-ms hate around here..

Re:threat? (1)

Zero__Kelvin (151819) | more than 4 years ago | (#30871090)

"I just laugh. I haven't had to reformat the drive even once since I obscured IE."

Ironically your malware is clearly now, like your IE, better hidden.

Re:threat? (4, Insightful)

v1 (525388) | more than 4 years ago | (#30870008)

What's unfortunate here is there's still a lot of people out there that don't understand why some security researchers publish security bugs they find. It's issues like this where "We reported this to you FOUR MONTHS AGO and you haven't fixed it yet. We're going public with it tomorrow." Oh noes! Everyone's computer getting owned, it's all your fault, you should keep security bugs QUIET so we have time to fix them!.

Ya, right, whatever. They don't want the researchers to keep the bugs quiet so they "have time to fix them". Clearly four months is more than enough time to fix anything important. So, just how many more of these critical security bugs are we continuing to keep under wraps until someone exploits them before getting around to fixing? The logical conclusion is the researchers should give companies like MS a flat 30 days notice, and then go public immediately after that. At least we'd be getting the bugs patched 35 days after discovery, instead of 130 days. Either way, the amount of exposure we experience is the same, they're going to drag their feet until someone lights a fire under them. The only one this "irresponsible disclosure" hurts is the publisher. In the end, it helps the users, because the publishers now have a concrete deadline to avoid losing face, rather than "lets hope no one else discovers this before spring".

We don't need them gambling with our security, and that's exactly what they're pushing with their cries for "responsible disclosure".

Re:threat? (1)

Antique Geekmeister (740220) | more than 4 years ago | (#30870410)

Not to defend Microsoft's consistent failure to address security issues, but 4 months is not an unusual release time for a non-critical bug. It needs to be tested, it needs to be reviewed if it changes or breaks any other tools that rely on a sloppy API or tricky "feature", and it needs to pass regression testing. When you're running core servers, worldwide, and stand to lose millions of dollars if you accidentally break something critical, you'd better test it well. And for we who install patches, we expect official vendor patches to _not break other things_.

The risk of breaking things with an untested patch has to be measured against the risk of leaving the vulnerability open: this is why so many server-class systems out there have _no_ scheduled updates, and rely on "we trust the people we work with" to protect their internal services, and will never _get_ this recently published patch.

Re:threat? (1)

jesset77 (759149) | more than 4 years ago | (#30871050)

It needs to be tested, it needs to be reviewed if it changes or breaks any other tools that rely on a sloppy API or tricky "feature", and it needs to pass regression testing. When you're running core servers, worldwide, and stand to lose millions of dollars if you accidentally break something critical, you'd better test it well.

This entire line of reasoning is merely another call for open source software. Browser makers should not be in a position where they are somehow personally responsible for complex, demonstrably unstable business installations. If the code is open, then the business clients who stack complicated houses of cards on the software (be it browser, OS, or wherever) can take their own responsibility for their non-standard decisions, and the software vendors can focus on meeting generic standards and keeping security up to date for everyone.

Luckily, we don't have to expend any effort in this fight. The market will clean the mess up for us nicely. :)

Re:threat? (1)

Zero__Kelvin (151819) | more than 4 years ago | (#30871164)

"Not to defend Microsoft's consistent failure to address security issues, but 4 months is not an unusual release time for a non-critical bug."

Great point! What could be less critical than a bug that lets the Chinese own your data!

Re:threat? (1)

Antique Geekmeister (740220) | more than 4 years ago | (#30872532)

You've got it backwards. What is _more_ critical? A bug that prevents Microsoft from booting on new OEM systems? A bug that fails to reset IE as your default web browser? A bug that breaks the MS update tools and blocks other updates? A bug that causes 2003 servers to crash on Jan 1., 2010?

I don't know the full set of bugs recently patched, but a fast look at Windows Update shows a whole stack of "Windows Defender" updates, and other security updates, that were doubtless already in the queue.

three months, max. (0)

Anonymous Coward | more than 4 years ago | (#30870498)

What's unfortunate here is there's still a lot of people out there that don't understand why some security researchers publish security bugs they find. It's issues like this where "We reported this to you FOUR MONTHS AGO and you haven't fixed it yet. We're going public with it tomorrow." Oh noes! Everyone's computer getting owned, it's all your fault, you should keep security bugs QUIET so we have time to fix them!.

I think three months (a quarter) should be sufficient to fix just about any bug. If I ever found a bug, I'd given them at least that long, and then set up a cron/at job to send out the announcement after the ~90 days expired. Of course if they agree to a shorter period all the better. If they act all huffy and refuse to acknowledge it or give a deadline, fuck'em release right away. I think most coders want to do the right thing (unless they're ass hats).

Remember, even in the open-source world, a little time would be helpful to co-ordinate with (say) the security teams of the distributions as well.

But in general at least try to be civilized yourself.

Re:threat? (1)

Phroggy (441) | more than 4 years ago | (#30870482)

Microsoft's reasoning is this:

Most security flaws are found by white-hats, who report the flaw to the vendor and keep their mouth shut until the vendor releases a patch - and even then, the details of exactly how to exploit it are usually not disclosed right away. However, as soon as the patch is released, the black-hats (who had previously been unaware that the flaw existed) now begin analyzing the patch itself, to see what it changes - and they soon figure out how to exploit the flaw in unpatched systems.

If Microsoft releases patches immediately as soon as the patches are available, the black-hats will begin working on them immediately and will have an exploit soon. But although individual consumers might have automatic updates enabled, corporate IT departments prefer to test things before deployment, and this is much easier to do when patches are released on a schedule - for example, if all patches are always released on the second Tuesday of the month, then an IT department can plan to begin testing new patches on that day, push out updates to workstations Wednesday night, and schedule downtime to update production servers Friday night. If they work this into their schedule, patches will get deployed quickly, and with any luck, the black-hats won't hit them with an exploit within those few days.

But if patches are released whenever they become available, IT departments can't prepare for them, and are more likely to put them off until it's convenient. Maybe that'll be a couple of weeks - but maybe it'll be a couple of months, because there is no coherent plan for deploying updates at all. This gives the black-hats plenty of time to weaponize the exploit, and script kiddies to start using it.

So, if you assume that in most cases the black-hats don't find bugs before the patch is released, Microsoft's strategy is actually good. The danger, of course, is that if the black-hats discover the flaws before a patch has been made available, and are quietly exploiting them without drawing attention to themselves, then Microsoft's strategy is bad.

Re:threat? (0)

Anonymous Coward | more than 4 years ago | (#30870502)

Microsoft don't give a shit about public perception - if Windows/IE is part of your corporate strategy and/or you have tied your organisation into Microsoft products and all-but need IE at the front to make them work what are you going to do? Go elsewhere? So your corporate sales contact at Microsoft gets a bollocking and you get some discounted licences, free support time or some Microsoft mugs. No skin off Microsoft's nose and we all move on.

Home user? System infected? Well, you have a backup don't you? Wipe clean, reinstall, restore and repeat. How much in sales will MS lose if you switch to another browser - sweet F.A. And when it comes to the time when you need a new PC you're going to be paying the MS tax again anyway, aren't you?

Tech savvy and already gone to Linux or considering it - well, MS has lost you anyway so there's no point investing in your retention or recovery is there?

The MS juggernaut is so big that this 'problem' is merely a bump in the road.

This clearly needs 10 more stories (1, Flamebait)

abigsmurf (919188) | more than 4 years ago | (#30869776)

This has been covered ad nauseum here. Do we really need an update every 10 hours? A bug was exploited, it is now patched. Anyone who falls victim to it now deserves to do.

No doubt there'll be more stories about this. Was the patch larger than it needed to be? Does the patch break applications (it already breaks ones that exploited! It must break more!). Is Microsoft's failure to patch speedily yet another indication that Obama's administration is failing to meet its promises?

Stay tuned as Slashdot milks this story for another week!

Re:This clearly needs 10 more stories (0)

Anonymous Coward | more than 4 years ago | (#30869854)

This has been covered ad nauseum here. Do we really need an update every 10 hours?

Yes. Micro$oft bad!

A bug was exploited, it is now patched. Anyone who falls victim to it now deserves to do.

Windows users dumb.

Stay tuned as Slashdot milks this story for another week!

Stories like this are raw meat for the Linux Hammer Legion members.

Re:This clearly needs 10 more stories (2, Insightful)

1s44c (552956) | more than 4 years ago | (#30869964)

This has been covered ad nauseum here. Do we really need an update every 10 hours?

Yes. Micro$oft bad!

Well, they are.

A bug was exploited, it is now patched. Anyone who falls victim to it now deserves to do.

Windows users dumb.

That doesn't follow. Fooled because they don't know better or don't get the choice maybe, but dumb isn't the right word.

Stay tuned as Slashdot milks this story for another week!

Stories like this are raw meat for the Linux Hammer Legion members.

Stories like this clearly show Microsoft for what they are - A company that doesn't care about the online safety of their customers data. They are a monopoly with the normal monopoly mentality that customers are there to serve them.

Re:This clearly needs 10 more stories (1)

Arancaytar (966377) | more than 4 years ago | (#30869858)

Is Microsoft's failure to patch speedily yet another indication that Obama's administration is failing to meet its promises?

Absolutely! :-P

Re:This clearly needs 10 more stories (3, Insightful)

1s44c (552956) | more than 4 years ago | (#30869926)

This has been covered ad nauseum here. Do we really need an update every 10 hours? A bug was exploited, it is now patched. Anyone who falls victim to it now deserves to do.

Thats not entirely fair. It's not practical for many people to update all systems within a day or two. Most organizations don't move that fast.

Re:This clearly needs 10 more stories (0)

Anonymous Coward | more than 4 years ago | (#30870676)

Uptime on my Macbook Pro is 43 days. Back when I was running an XP box I had auto updates on (as everyone should) -I had a couple weeks where I ran security updates and had to reboot every day. Even when Microsoft is patching the security vulnerabilities its hard to keep up. After a certain point even the most dedicated geek finds this situation unacceptable and starts to explore other options.

Re:This clearly needs 10 more stories (1, Insightful)

Anonymous Coward | more than 4 years ago | (#30870134)

"Anyone who falls victim to it now" is a typical Microsoft client. The IE security flaw in Windows has been arguably patched for years already anyway -- it's called Firefox.

Right now we're in NASCAR effect - this is the slowmo replay of the latest pileup that has included major governments saying stop using the browser. You think it stopped being notable after the original tire blew? Rub a lamp. There's at least a full week's worth of commentary about the individual cars wrapping into balls on the guardrail now.

Which is great. MS's crap approach to security needs broader, louder coverage. Clearly it hasn't been loud enough yet.

Re:This clearly needs 10 more stories (1)

abigsmurf (919188) | more than 4 years ago | (#30870416)

Yeah, an exploit for firefox couldn't possibly be made public before a bug is patched patched [cnet.com] . Adding to that, if a bug is exploited in Firefox it is far easier for it to do more damage than in IE8 due to lack of sandboxing and protected memory.

This current exploit doesn't even work if people had IE8 with default settings.

Re:This clearly needs 10 more stories (1)

the eric conspiracy (20178) | more than 4 years ago | (#30871152)

Stop trying to change the subject. This issue is about a bug in IE 6 which DOES NOT run in a sandbox. See #4 in the grandparent post. In addition it is normally run on systems where the user is forced to run in administrative mode due to other stupid MS practices.

Finally the icing on the cake is that many people are forced to use IE 6 because they must use applications that are written to MS's prior non-standard ideas of how HTML should be interpreted.

It is a lose-lose-lose-lose scenario that MS forced upon its users through shoddy engineering practices at every step of a long and winding path.

Not only that - the bug exists in IE 7, and there is speculation that despite the sandbox it is exploitable because Vista does not turn on DEP by default.

Re:This clearly needs 10 more stories (1)

abigsmurf (919188) | more than 4 years ago | (#30871286)

IE6 is 10 years old, obsolete and MS have been pushing for people to upgrade for a long time now. Microsoft's support of legacy products a lot better than most companies (including OSS ones). How many flaws are there in Phoenix/firebird?

As of yet there is no exploit that will work with a default install of IE7+ and there probably never will be now as it would be a waste of time.

Re:This clearly needs 10 more stories (1)

the eric conspiracy (20178) | more than 4 years ago | (#30872604)

IE 6 was first sold 8 years ago, not 10. And since when is an obsolete legacy system something that you can go out and buy off the shelf for installation in new systems? According to Wikipedia IE 6 is the most used IE version, likely mostly due to the unpopularity of Vista and the long and tortured development cycle for that product.

As far as Pheonix and Firebird, sure they have flaws, however use share is less than 1%, completely unlike the 20+% of IE 6.

Of course MS is encouraging people to upgrade. However plenty of people don't have that option because of functional requirements and corporate IT policies.

Re:This clearly needs 10 more stories (2, Insightful)

the eric conspiracy (20178) | more than 4 years ago | (#30870228)

The problem is that M$ gets the timeline wrong so often. It should be:

1. Find bug
2. Patch bug

Not:

1. Find bug
2. Ignore bug for n months
3. News released about exploit
  compromising customers installations
  causing international incident.
4. Release self serving announcement
  that other systems are not affected
5. More exploits appear
  affecting larger numbers of customers
6. Patch bug

Until this irresponsible behavior stops there should ba a lot more stories. These guys need to have the light shown on their absurd practices as brightly as possible.

Attacking hate comments ain't changing the facts (-1, Flamebait)

Anonymous Coward | more than 4 years ago | (#30869798)

To all M$ lovers: once more it seems uh!?

Please paid M$ astro-turfers, do attack and mod down this comment and ignore the facts ;)

Re:Attacking hate comments ain't changing the fact (0)

Anonymous Coward | more than 4 years ago | (#30869866)

It's still the OS that runs my apps and with a little common sense I've never gotten a virus or a malware.

If I had to deal with another OS on my system I wouldn't have a reason to turn it on since it doesn't run my apps. Ignore that fact.

Exactly how does it work. (2, Interesting)

Murdoch5 (1563847) | more than 4 years ago | (#30869802)

What protocol is used to search the system? sure the attacker can get in but once inside just how much access do they have.

Do they get returned an FTP / HTTP view of the computer folder by folder. Do you get kicked into a telnet terminal / ssh terminal maybe even a NFS terminal.

Correct me if I'm wrong (but I do have a CCNA cert) Why not block the access ports that get opened, unless it's port 80 and then filter the traffic.

Yes it's microsofts problem to roll out a patch and fix the bug but it seems like theres a lot that the user could do before the patch is ready.

Re:Exactly how does it work. (5, Informative)

Arancaytar (966377) | more than 4 years ago | (#30869852)

Once Windows is compromised (by a sophisticated worm, not something that places advertisements in IE), there is very little a user can do that the worm cannot prevent or bypass.

The Windows settings assistant may nod and smile, and say the port is closed, while the worm is using it in the background. You might see that if you look at the router's logs, but inside Windows the worm can control what you see or do.

Re:Exactly how does it work. (1)

Murdoch5 (1563847) | more than 4 years ago | (#30870586)

Fair enough. I was thinking more along the lines of blocking on the router it's self. I can admit that might be alittle much for a lot of users to really take apart the firmware and write long IP rules.

Re:Exactly how does it work. (0)

Anonymous Coward | more than 4 years ago | (#30872444)

More importantly, there is no way to be sure that you have removed all pieces of the worm. Even if you pull the hard drive and do an off-line virus scan, that just means that you removed the piece used to detect the worm.

Re:Exactly how does it work. (0)

Anonymous Coward | more than 4 years ago | (#30870038)

I don't have your fancy "CCNA cert", so maybe these technical things are beyond me... but I have to ask.

What's an "NFS terminal"?

Re:Exactly how does it work. (0)

Anonymous Coward | more than 4 years ago | (#30870240)

but I do have a CCNA cert

But haven't managed to master basic written English. That's about par for the course these days.

Re:Exactly how does it work. (2, Interesting)

jesset77 (759149) | more than 4 years ago | (#30871162)

Correct me if I'm wrong (but I do have a CCNA cert) Why not block the access ports that get opened, unless it's port 80 and then filter the traffic.

Ah, CCNA. ;D

Most users, if they have a router at all, have a SOHO router with minimal firewalling ability, just NAT/PAT.

The simplest worm I could think of that would drink your milkshake would just dial home via SSL port 443. Client-initiated connection, redialed as needed: what on earth could your fancy firewall do about that? :3

Moral of story: Don't get rooted. :(

Re:Exactly how does it work. (3, Funny)

Zero__Kelvin (151819) | more than 4 years ago | (#30871182)

"Correct me if I'm wrong (but I do have a CCNA cert)"

That's just plain wrong

I wonder if responsibility is ever assigned (1, Interesting)

erroneus (253617) | more than 4 years ago | (#30869986)

So someone or a project team writes some code. The code is later found to be used as part of an exploit that further harms the reputation of the company. Does anyone ever go back and say "hey, you wrote this crappy code! You're fired!"?

It almost seems there are more vulnerabilities (both patched and unpatched) than there are lines in the Windows source code. I know there will be no end to the finger pointing where developers decry the problem of deadlines while management points to the lack of skilled coders. But seriously, how much of all this can be attributed to poor programming practices? I remember from the earliest days of coding C that there were a few functions that existed that wise programmers should avoid as the use of those functions would immediately make your programs vulnerable. Further, it seems that bounds checking and other data validation needs to go on more often as well. How is it that the top dog in the software game can't keep up with these very simple principles?

And what of public disclosure? Some people try to say that public disclosure is what is responsible for most of the hacking that goes on out there. Meanwhile, this was essentially a -1 day vulnerability that didn't get disclosed until after the damage was done... or was it? Was this yet another of the reported bugs that Microsoft sits on rather than acts on? While following the bugtraq and other mailing lists, I observe that Microsoft tends to ignore or disregard a great many of the bugs reported to it, so I have to wonder.

Re:I wonder if responsibility is ever assigned (1, Insightful)

Anonymous Coward | more than 4 years ago | (#30870612)

How is it that the top dog in the software game can't keep up with these very simple principles ?

Why should they ? They have a monopoly on the desktop, and unless it affects their profit line, there is no reason for them to fix anything.

A US-based, free e-mail service (3, Insightful)

Stephan202 (1003355) | more than 4 years ago | (#30870016)

[...] the Trojan sends a notification e-mail to the attackers, using a US-based, free e-mail service that Symantec declined to name.

Hotmail, perhaps? No?

Re:A US-based, free e-mail service (1)

Isao (153092) | more than 4 years ago | (#30870094)

Juno.

Re:A US-based, free e-mail service (1, Funny)

Anonymous Coward | more than 4 years ago | (#30870352)

Juno

No I don't. Juno who might?

Re:A US-based, free e-mail service (1)

kaptink (699820) | more than 4 years ago | (#30870122)

Wouldn't the obvious thing to do is shut the email account down and watch for people trying to log into it?

Re:A US-based, free e-mail service (2, Insightful)

Zero__Kelvin (151819) | more than 4 years ago | (#30871448)

"Wouldn't the obvious thing to do is shut the email account down and watch for people trying to log into it?"

That would certainly trace them all the way to the anonymous proxy in a country with laws that don't require them to give up the logs.

Update your Acrobat Reader. (3, Interesting)

Old Flatulent 1 (1692076) | more than 4 years ago | (#30870112)

There was a similar hole in the way Acrobat Reader [adobe.com] prior to 9.2 handled xml multimedia calls. And there were resent releases of updates for Shockwave Flash. [adobe.com]

It is rather telling that the same type of buffer trouble is showing up in other peoples software. I am just wondering if the flood "Gates" are about to open and we will wind up seeing multiple trouble with things like WMP, Silverlight ...there was already the same update happening for RealPlayer [real.com]

Just maybe there is a system xml call that is easily exploited in all versions of Windows....I can just see it now some lazy MS exec using old legacy system xml that is written using the gets and puts function. I would not put it past Microsoft to use old garbage code without even checking the old source then including the pre-compiled executable

Re:Update your Acrobat Reader. (3, Insightful)

Antique Geekmeister (740220) | more than 4 years ago | (#30870418)

Maybe, just maybe, they should throw out most XML use. It's expandability and flexibility have caused repeated security and performance issues, and it's being used consistently instead of far simpler and more robust configuration technologies.

Re:Update your Acrobat Reader. (1, Insightful)

Anonymous Coward | more than 4 years ago | (#30871268)

Yeah, using XML has been a total plague... Apple uses it everywhere in OS X, and I'm sure we all remember the endless number of exploits endured by the poor bastards who use Macs since OS X shipped in 2001.

Oh, wait... there haven't been any exploits on OS X.

There must be something else at work here... like Apple employing more competent people to write code than Microsoft and Adobe.

And do I care? (1)

bradbury (33372) | more than 4 years ago | (#30870748)

Cough, no, because I am running a Linux system with a variety of browsers (epiphany, galeon, Firefox, Chromium) and I simply do not run MS software (and to read the ongoing saga, lucky me), why does /. even bother to track these items? We know the MS users are brain-dead (they hover under a belief that the software doesn't have bugs or is secure and that will protect them -- how wrong they are.).

I have no misconceptions that Linux based software is any more secure -- but I rest in confidence that epiphany, galeon, Firefox and Chromium are *all* open source -- and if there is a security problem within them I can update and take advantage of it within hours -- not months as Microsoft seems inclined to do.

Using closed source software is akin to laying oneself out on the Washington Mall and saying, hey "rape me". Its not so bad "I'll recover".

Re:And do I care? (1)

Zero__Kelvin (151819) | more than 4 years ago | (#30871470)

"why does /. even bother to track these items?"

You do realize that you read the story and then went on to post in it, right?

Time to Bury IE (1)

BoRegardless (721219) | more than 4 years ago | (#30870778)

For God's sake and all of our digital information, it is time for a revolution.

IE has failed so many times with so many bad consequences it is time to simply outlaw the use of IE.

How many car crashes due to any number of causes before they yank ALL those car models and force the manufacturer to replace the brakes.

Get rid of MS Internet Explorer, once & for ALL. If Microsoft were an honest company they would have stopped IE and started including FireFox a long time ago. At least then, everyone can examine code and offer patches.

Re:Time to Bury IE (0)

Anonymous Coward | more than 4 years ago | (#30870878)

... it is time to simply outlaw the use of IE.

I'll bite.

Yes. It is much better to let Random Strangers dictate what I can and cannot use, than let people take responsibility for their own computers.

If I choose to use IE/Windows (I don't, I am posting from Firefox - in Windows), that is my choice. I also believe if I get compromised, it is MY problem. I do what I can to stay secure - and guess what? I didn't format my Vista for 2 years - till I got Windows 7. I know how to take care of my computer.

It will be a cold day in hell before I to some arrogant fanatics dictate what I can and cannot do.

Time to bury Firefox (0)

Anonymous Coward | more than 4 years ago | (#30870966)

http://www.mozilla.org/security/known-vulnerabilities/firefox35.html [mozilla.org]
http://www.mozilla.org/security/known-vulnerabilities/firefox30.html [mozilla.org]

Firefox works with user's permissions on current systems - at least Google Chrome and IE are sandboxed.

Re:Time to bury Firefox (2, Informative)

baka_toroi (1194359) | more than 4 years ago | (#30871408)

Thanks for showing me fixed vulnerabilites!

Stuff works optimally with IE6! (1)

Zero__Kelvin (151819) | more than 4 years ago | (#30871508)

"Get rid of MS Internet Explorer, once & for ALL."

But the intertubes will cease to function properly. Are you trying to starve children in Massachussets? Don't you know that lots of out of work website designers need to use a website that works optimally with IE version 6 [detma.org] ??!!!

MSFT has no reasonable excuses (1, Interesting)

Anonymous Coward | more than 4 years ago | (#30871720)

3 billion dollars in profit a quarter. Just think about that. That is 120k software developers paid 100k a year. That's how many more people they could have fixing any bug you have. It may be unreasonable to ask a public company to not make a profit, but it is quite reasonable, that, even with the mythical man month, they could hire 5k more developers and testers and fix this BS. This was the size of the Windows 2000 team, when I was there that year.

I knew IE 6 was going to be bad though - people from the QA team came to me and asked if managers in other teams tell you to stop entering bugs because it makes the dev team look bad. Seriously. Trident was even worse.

Can someone please post an URL... (1)

ArsenneLupin (766289) | more than 4 years ago | (#30873148)

... I am currently in a Sauna, who refuse to put anything but Internet Exploder on their PCs....
Load More Comments
Slashdot Login

Need an Account?

Forgot your password?

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>