×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

IE Flaw Exploit In Hacker Kit 'Raises the Stakes'

Soulskill posted more than 3 years ago | from the calling-a-bluff dept.

Internet Explorer 96

CWmike writes "Roger Thompson, chief research officer of AVG Technologies, said Sunday that an exploit for the newest IE flaw had been added to the Eleonore crimeware attack kit. 'This raises the stakes considerably, as it means that anyone can buy the kit for a few hundred bucks, and they have a working zero-day,' Thompson said on his company's blog. Microsoft has promised to patch the vulnerability, but last week said the threat didn't warrant an 'out-of-band' update. Microsoft will deliver three security updates Nov. 9, but won't fix the IE bug then."

cancel ×
This is a preview of your comment

No Comment Title Entered

Anonymous Coward 1 minute ago

No Comment Entered

96 comments

Bug is really for Windows XP (2, Informative)

Anonymous Coward | more than 3 years ago | (#34167092)

This bug is really only a serious problem for Windows XP users. (Yes, I know there are still a lot of them - however there are also a lot of Windows 7 users now and some Vista users). For Vista and Windows 7, since IE runs not just as a standard user, but also with Protected Mode (less than standard user rights and cannot write to the file system or registry outside of some very restricted locations, it isn't really an issue. Hence the lower priority on the patch.

Re:Bug is really for Windows XP (5, Informative)

NetNed (955141) | more than 3 years ago | (#34167292)

Ah no it is a IE6 and potentially a IE7 problem if you do not have DEP turned on. It is on by default on IE8, but not in 7 and doesn't exist in 6. Really has nothing to do with the UAC controls in place on Vista or Windows 7 since DEP is the front line defense against these attacks and works to stop the attacks before any registry altering is even possible.

Re:Bug is really for Windows XP (0, Flamebait)

$RANDOMLUSER (804576) | more than 3 years ago | (#34167348)

And it's even possible for a browser to alter the registry exactly why???

Re:Bug is really for Windows XP (2, Insightful)

MightyMartian (840721) | more than 3 years ago | (#34167406)

I don't see the problem here, providing permissions on registry keys is set up appropriately. At the end of the day, browsers like Firefox and Chrome can modify files in the filesystem.

Re:Bug is really for Windows XP (0)

Anonymous Coward | more than 3 years ago | (#34168520)

Chromium's browser process can't modify files or registry. It has the same feature IE likes to call Protected Mode. Chromium's XP impl emulates PM with restricted [microsoft.com] access [microsoft.com] tokens [microsoft.com]. Chromium on Linux is a little different; it's described over at LWN [lwn.net].

Re:Bug is really for Windows XP (1)

The Grim Reefer2 (1195989) | more than 3 years ago | (#34169464)

I don't see the problem here,

From the article: "So far, the attacks we have seen only target Internet Explorer 6 and would not have been successful against Internet Explorer 8,"

Neither do I.

Re:Bug is really for Windows XP (4, Funny)

benjamindees (441808) | more than 3 years ago | (#34167450)

And it's even possible for a browser to alter the registry exactly why???

Broken Windows create jobs.

Re:Bug is really for Windows XP (4, Insightful)

CoderJoe (97563) | more than 3 years ago | (#34167566)

And it's even possible for a browser to alter the registry exactly why???

Because it is a program, just like any other, and needs to be able to store its own settings somewhere. For many windows programs, this somewhere is the registry.

(who modded this insightful?)

Re:Bug is really for Windows XP (1)

danomac (1032160) | more than 3 years ago | (#34168336)

Yes, but the application shouldn't be allowed to alter settings in the registry other than its own.

Re:Bug is really for Windows XP (2, Funny)

RaymondKurzweil (1506023) | more than 3 years ago | (#34170502)

Fuck you... this is an issue of a fundamental freedom. An application as powerful and useful as a browser should have the right to alter an setting in the registry it wants!!

Re:Bug is really for Windows XP (1)

Peeteriz (821290) | more than 3 years ago | (#34174654)

Windows registry does not really have a secure concept of "app's own settings" - apps are encouraged to limit their settings to registry tree with the vendor and app name, but there's no secure mapping that would allow to check if virus.exe is or isn't really 'Microsoft\Internet Explorer'.

And it's the same with unix config files - what's stopping an exploit in linux firefox from writing not to FF settings file in your home directory, but to some other applications configfile?

Re:Bug is really for Windows XP (1)

f.ardelian (1931920) | more than 3 years ago | (#34178232)

(who modded this insightful?)

It was probably someone who thought "hmm... where's this browser's config file?"

Re:Bug is really for Windows XP (1)

master0ne (655374) | more than 3 years ago | (#34167640)

every setting you set in your browser is stored as a registry key. If you set your browser to enable TLS 1.0, thats a boolean reg key that gets enabled, homepage is stored as a.... registry key!

Re:Bug is really for Windows XP (2, Insightful)

dimeglio (456244) | more than 3 years ago | (#34167968)

I believe the registry keys we're having an issue with are those, for example, which control application startup enabling malware to install, and not the browser's settings.

Re:Bug is really for Windows XP (1)

v1 (525388) | more than 3 years ago | (#34167686)

And it's even possible for a browser to alter the registry exactly why???

This is simplifying things a bit, but in short, the registry is the one central place where all preferences are stored, for everything, including the OS, its security system, and every single installed application. So at least in hindsight MS tries to stop apps from being able to change each other's registry keys, or add new keys that other systems will use. But the whole thing is basically starting with a sponge and trying to fix the holes one at a time, while the sponge is getting bigger.

Basically if you have unrestricted access to the machine, you own it. And the OS must allow you a somewhat liberal degree of access to function. It's like being forced to allow thieves into a warehouse size department store, and you've only got a handful of guards. There's just so many ways you can lock so much stuff down, you're going to lose. The entire concept is broken, but all the windows apps rely heavily on it, so you either break the world, or live with it. Nowadays most malware removal consists of two steps: (1) delete files and (2) delete registry keys.

How the concept of "registry" survived into vista, let alone 7, astounds me. By XP everyone realized it was a horrible idea.

Re:Bug is really for Windows XP (1)

metrix007 (200091) | more than 3 years ago | (#34170918)

What rubbish. A process started as a user can do anything a user can do. That's because current security models are shit. It's no different that under *nix any process started as a user can edit any dotfles in the users home directory.

Becuase you are an administrator (4, Informative)

Sycraft-fu (314770) | more than 3 years ago | (#34167796)

If you are an administrator of a system that by definition means you can do everything, including modify the registry. If you cannot understand this concept, then you need to learn more about how privilege levels in computers work and come back. There is no power without responsibility. The power to do something is the power to fuck something up.

Now as this applies to this specifically, most people who use Windows XP run as an administrator. They don't have to, you can run as a deprivileged user and indeed we make people here do that at work, but users do not choose to because it is a pain to do. That means any program they spawn runs with permissions to do anything, since that is the whole idea of an administrator. There is nothing special about a web browser, it is just a process. It can write to the registry, drive, or anything else. The OS doesn't put random restrictions on programs.

In Vista and 7, things are a little different. By default, even users flagged as administrators aren't actually running at an administrator privilege level. They run as regular users and have to elevate when they need to. This means that programs they launch without elevation cannot do things such as write to the registry, as that is not a normal user (and thus their programs) have. Also an additional layer of security was introduced called Mandatory Integrity Control. This allows for programs to be launched with even less privilege than a normal user has. This has to be configured per application, and the only thing I know that uses it is Internet Explorer. It restricts access much further, including denying read access to a great deal of what a user can read.

This is all the same deal as with UNIX. Though Windows permissions are different (Windows has far more granular security) it is the same basic thing. If you run a program as root in UNIX it can do everything, including mess with config files not belonging to it and so on. That is the point of root: To have access to everything. You can't grant that access to the user, but somehow deny it to the user's processes, that goes against the whole idea.

The fundamental problem is that people using XP and older run their systems as administrators, because it is easy to do. The first user you make is an administrator (the system must have one) and it doesn't make you make another. That means that all apps have all access.

Re:Becuase you are an administrator (0)

Anonymous Coward | more than 3 years ago | (#34169200)

There is nothing special about a web browser, it is just a process. It can write to the registry, drive, or anything else.

My web browser can drive? Ooooh goodie!

Re:Becuase you are an administrator (1)

fireylord (1074571) | more than 3 years ago | (#34172086)

My web browser can drive? Ooooh goodie!

I'd watch out with that thout, crashing twice a day would be bad for your insurance premiums

Re:Becuase you are an administrator (0)

Anonymous Coward | more than 3 years ago | (#34169330)

http://www.gentoo.org/proj/en/hardened/ [gentoo.org]

WRT unix granularity, you are probably a bit behind the times.

But yes, in many scenarios this is overkill, in fact, I remember the frustration of the cygwin folks in the past as they discovered that the more granular windows system was incapable of doing all variations the basic user / group / world read/write/no access set.

There was some discussion of it on the mailing lists at the time.

Anyway. To frame this a bit more productively. Under linux systems nowdays, configuration overrides on a per-user basis are in places like ~/.local and ~/.gconf

Is there something like that for windows, so you don't need special privs to override generic system values w/ user-specific ones?

Re:Becuase you are an administrator (1)

metrix007 (200091) | more than 3 years ago | (#34171712)

You probably wont reply to this, but what the hell are you talking about? Windows having more granular security means it can do all the permutations of permissions available in unix and then some.

Re:Becuase you are an administrator (1)

Derek Pomery (2028) | more than 3 years ago | (#34173084)

Uh. More granular, yes, but also different. There were a couple of specific combinations they had issues with when mapping rwxrwxrwx to actual permissions.

Trying to find the mailing list entries now. Last time I ran into this with cygwin was around 8 years ago.
Windows permissions presumably haven't changed too much since then though.

Re:Becuase you are an administrator (1)

Derek Pomery (2028) | more than 3 years ago | (#34173100)

Found it. That took all of 20 seconds of googling. Let's see how long it takes slashdot to let me repost.

http://www.cygwin.com/cygwin-ug-net/ntsec.html#ntsec-mapping [cygwin.com]

Still kinda curious about local overrides to global settings though. Does windows have that concept?

Re:Becuase you are an administrator (1)

ginbot462 (626023) | more than 3 years ago | (#34174128)

Does the "Document and Settings (XP)" and "User (Vista/Win7)" folder count for what you are asking? It IS the "~" equiv in Windows. "Application Data" is under there, where app specific settings are.

Re:Becuase you are an administrator (1)

Derek Pomery (2028) | more than 3 years ago | (#34178484)

Naw. I'm aware of those. We use 'em in our apps.

It is more like automatic override of global settings with user specific ones. Bears some similarity to the HKCU hive, except from my understanding of things, not automatic.

Re:Becuase you are an administrator (1)

dbIII (701233) | more than 3 years ago | (#34170136)

If you are an administrator of a system that by definition means you can do everything

Not in the weird MS Windows security model where users can lock the root user out (unless that's been fixed, it used to be sold as a feature) - but most of the time your point stands.

Re:Becuase you are an administrator (0)

Anonymous Coward | more than 3 years ago | (#34171726)

IIRC that only happens if the file/key is encrypted or its 'owner' is changed (e.g. to NT SERVICE\TrustedInstaller or whatever Windows used for protected objects). Admin can reset any owner, I think.

Re:Bug is really for Windows XP (1)

Blakey Rat (99501) | more than 3 years ago | (#34167934)

And it's even possible for a browser to alter the registry exactly why???

Here's a shocking revelation: browsers can also *write files to the filesystem!*

Oh sure, they try to justify this as some kind of "bookmarks" or "caching" feature, but we know they're just intentionally putting security holes in their software.

(On a more serious note, if the user is running Windows XP, IE 6 or 7, and doesn't have DEP turned-on... then they're probably also running as Administrator, which means the browser can do anything it damn well pleases. Note that this applies to Firefox, Chrome, and Safari also... I don't understand why you find this shocking.)

Re:Bug is really for Windows XP (1)

KingMotley (944240) | more than 3 years ago | (#34169850)

I have to say that's a pretty ridiculous question. Because the registry is where all the application settings are supposed to be stored. Funny how an application needs access to change things in the registry when that's what it's designed to do.

Re:Bug is really for Windows XP (1)

Phopojijo (1603961) | more than 3 years ago | (#34170442)

One reason is because they're dependent on higher-permissions code... which the exploiting code pretends it is by over-writing part of the higher-permission code in memory... such that the next time said code is run, it is no longer there.

That's actually how DEP works... the CPU executes a string of commands... one after another... some from memory, some from cache, some jumps, some sequential... ... then when it sees code marked as "data"... it freaks out and realizes it somehow got misdirected out of "execute" and fell in a data buffer. If DEP wasn't enabled... it wouldn't check to see where it is and would just run it with whatever permissions SHOULD be there. If DEP was enabled... the CPU freak-out would force an instant crash and signal Windows that (x) was terminated because it tried to execute data.

The reason why executing data is dangerous is because it's a section of memory that the programmer said "this should not contain any code... and can be written to by someone other than me".

Which by the way is how jailbreaking Apple products works... you're installing malware on the system to get a higher permission level than the application wishes you to have. The same process you used to usurp admin rights from Apple on your phone is the same process anyone else needs to do to usurp admin rights from Apple on your phone... which is exactly how viruses are made.

Simply put... it's ridiculously hard to write secure code. All you can do is reduce how much access to elevated permission code you have... and fix any errors as you, or someone, finds them.

Re:Bug is really for Windows XP (0)

Anonymous Coward | more than 3 years ago | (#34170710)

And it's even possible for a browser to alter the registry exactly why???

It is necessary for a browser to change registry settings so it can:

  • change browser settings
  • install ActiveX components
  • install and register plugins

Re:Bug is really for Windows XP (1, Informative)

Anonymous Coward | more than 3 years ago | (#34167428)

Ah no it is a IE6 and potentially a IE7 problem if you do not have DEP turned on. It is on by default on IE8, but not in 7 and doesn't exist in 6.

DEP is a hardware-based feature, so it is only "on by default on IE8" when the hardware supports it. There is plenty of old hardware out there either without NX support at all, or with NX disabled by default in the BIOS, perfectly capable of running IE8 and Windows 7, and they are vulnerable. For the former set of hardware, the only software fix is a patch from Microsoft. DEP fixes nothing when NX (or equivalent) doesn't exist.

Re:Bug is really for Windows XP (3, Informative)

NetNed (955141) | more than 3 years ago | (#34167552)

No DEP is both hardware based and software based.

Microsoft has software based DEP listed as: "An additional set of Data Execution Prevention security checks have been added to Windows XP SP2. These checks, known as software-enforced DEP, are designed to block malicious code that takes advantage of exception-handling mechanisms in Windows. Software-enforced DEP runs on any processor that can run Windows XP SP2. By default, software-enforced DEP helps protect only limited system binaries, regardless of the hardware-enforced DEP capabilities of the processor."

You can read all about it here [microsoft.com]

Re:Bug is really for Windows XP (4, Informative)

Anonymous Coward | more than 3 years ago | (#34167836)

No DEP is both hardware based and software based.

Nope, DEP is hardware only. What Microsoft calls "software DEP" is nothing more than SafeSEH, which is a totally unrelated and considerably less useful security measure.

Re:Bug is really for Windows XP (1)

NetNed (955141) | more than 3 years ago | (#34174924)

So you didn't RTFA? Or click the link I posted? Really, it's just a link to Microsoft's page on DEP where it talks of Software DEP, the one that stops this attack from happening. I'm sure there are other exploits that find it easy to surpass software DEP, but in this one software DEP, which is real and is what the original story is talking about, is more then enough to stop this exploit. That is why Microsoft hasn't really been quick to issue a out of sequence update to fix the problem because it only effects IE6 and IE7 if DEP is not on. Since most run IE8 or alternative browsers, then no issue and SOFTWARE DEP is taking care of it.

Re:Bug is really for Windows XP (0)

Anonymous Coward | more than 3 years ago | (#34177152)

I read both. TFA says DEP stops the attack. It makes no mention whatsoever of "software DEP" or SafeSEH, go ahead and re-read it.

So unless your hardware supports NX or equivalent, you are vulnerable because you only have SafeSEH, not DEP.

Re:Bug is really for Windows XP (0)

Anonymous Coward | more than 3 years ago | (#34167732)

Actually you aren't quite right; the original poster was. You can't get a drive-by download running code on your machine and persisting through reboots (automatically running again) if it can't write to those protected areas of the file system. And since it can't on Vista and Windows 7, then you won't have problems with it. Now, if you were foolish and turned off user account control and run as an administrator and also turned off protected mode in IE - well, then certainly you deserve what you get.

Re:Bug is really for Windows XP (2, Insightful)

hweimer (709734) | more than 3 years ago | (#34167782)

Ah no it is a IE6 and potentially a IE7 problem if you do not have DEP turned on. It is on by default on IE8, but not in 7 and doesn't exist in 6. Really has nothing to do with the UAC controls in place on Vista or Windows 7 since DEP is the front line defense against these attacks and works to stop the attacks before any registry altering is even possible.

DEP has been broken by return-oriented programming. The fact that most exploits don't use it just means that they catch enough victims simply by using the old techniques.

Re:Bug is really for Windows XP (1)

NetNed (955141) | more than 3 years ago | (#34167832)

Well since TFA talks about a exploit that CAN be stopped by simply running DEP in IE7 or above it really don't matter if DEP has been broken by whatever since the code at hand is only trying to exploit machines where DEP in not installed (IE6) or not on, which could be any IE if a user turned it off for some odd reason.

Re:Bug is really for Windows XP (1)

francium de neobie (590783) | more than 3 years ago | (#34171054)

But there's no information proving that a coder in-the-know can't turn the DEP-inactive exploit into a DEP-active exploit.

Re:Bug is really for Windows XP (1)

NetNed (955141) | more than 3 years ago | (#34174834)

Sure there is if you RTFA. Since the story says DEP in IE8 stops it from affecting it I would have to go on that. Could the code be changed in the future to break DEP? Sure, but then it is a different code and a different problem. The code in the story we are talking about can't. We can fantasize about what any code in the open can do, but at this point in time with this code, no it can't break DEP.

Re:Bug is really for Windows XP (2, Interesting)

hairyfeet (841228) | more than 3 years ago | (#34168530)

For those on XP there is an easy way that will probably work to stop this cold. I say probably because I haven't had the time to look for an attack site and play with the code. But on XP you can use the Free Comodo Internet Security [comodo.com] or Comodo Av (both free) and under "Defense +" settings choose to run IE always in the sandbox. This will keep IE from doing any real registry or file writing, instead dumping any writes to a virtual registry and file system that is locked off from the OS.

While I agree it is MUCH better to have DEP and ASLR, there are still tons of quite good machines out there that simply don't support those features and are still running XP. For those machines I use Comodo Internet Security and so far I have yet to have a customer or family member running it to come back pwned. Of course I try my damnedest to get them off of IE and onto FF, as we can see with TFA IE is still to big a target.

Re:Bug is really for Windows XP (0)

Anonymous Coward | more than 3 years ago | (#34170934)

DEP and ASLR can both be circumvvented.

Re:Bug is really for Windows XP (0)

Anonymous Coward | more than 3 years ago | (#34167296)

[ ] newsworthy

Re:Bug is really for Windows XP (0)

Anonymous Coward | more than 3 years ago | (#34167436)

If this is an XP only problem, it sounds like M$ is giving XP users the big ol' middle finger. "What? You use XP. Well, suck for you dude, mwuahaha"

ie sucks (2, Funny)

Anonymous Coward | more than 3 years ago | (#34167096)

IE is such a poor piece of technology. Before I enter a serious relationship, in addition to a background check, I also investigate the browser my potential significant other is using. If it's IE, I don't even bother since I don't date dummies.

That's a stupid test (1)

judeancodersfront (1760122) | more than 3 years ago | (#34168150)

I helped a Doctor with his laptop a while back and he was using.....IE8 (GASP). He must have been dummy. I've also helped people who were dolts when it came to picking up malware and they were running Firefox.

Most people use IE8 because it is good enough and its security is fine as long as you are using Windows 7 or Vista. IE6 sucks, IE8 is just mediocre.

Zero-Day? (1, Informative)

Anonymous Coward | more than 3 years ago | (#34167102)

Err, I don't really think you can call it a zero-day anymore.

Re:Zero-Day? (0)

Anonymous Coward | more than 3 years ago | (#34167324)

Yup. 'zero-day' is one of the most consistently used phrases to describe any sort of exploit, despite the fact that by the time Slashdot picks it up it's almost never true.

Re:Zero-Day? (0)

Anonymous Coward | more than 3 years ago | (#34180496)

I agree

Great! (0)

Anonymous Coward | more than 3 years ago | (#34167120)

I just needed a small botnet to promote my new penis enlargement and university degree business.

Attack Kit? (0)

negRo_slim (636783) | more than 3 years ago | (#34167140)

Where can I purchase it? I mean if they state there is a product and even quote a price one would assume it's purchasable somewhere.

Re:Attack Kit? (1, Insightful)

Anonymous Coward | more than 3 years ago | (#34167258)

There's this new tool [justfuckinggoogleit.com] you really should check out.

Re:Attack Kit? (1, Informative)

Anonymous Coward | more than 3 years ago | (#34167326)

I'm sure you could purchase it somewhere, if you wished. Google would probably help. Or, you could just checkout the latest Metasploit SVN, which is probably where the Eleonore kit writers got the exploit. There's been PoC exploit code in there since Thursday.

Re:Attack Kit? (1)

Securityemo (1407943) | more than 3 years ago | (#34168000)

Author contact details are here: https://damagelab.org/index.php?showtopic=17952&hl=eleonore [damagelab.org]
The post is from last year, but there's a bump from the autor on the second page. I don't know russian, checked it out using google.

Re:Attack Kit? (1)

negRo_slim (636783) | more than 3 years ago | (#34168080)

I just find it silly that so much of what is being discussed is all based upon this supposed tool with nary a source to be found. This whole seem things more like a plug for AVG than any real discussion on matters of import.

so... (0)

Anonymous Coward | more than 3 years ago | (#34167146)

Where can I buy it ? Or maybe anyone know of a torrent tracker specialized in such kit ?

Do other AV companies handle this (1, Offtopic)

BadAnalogyGuy (945258) | more than 3 years ago | (#34167192)

Ever since AVG decided to break compatibility with previous versions and introduce nagware in their current products, I have decided to avoid Grisoft.

Are there AV solutions available that handle this latest problem yet? Does MS Security Essentials do it?

Re:Do other AV companies handle this (1)

NetNed (955141) | more than 3 years ago | (#34167404)

Not really a AV programs problem as it is that DEP (data execution prevention) isn't available in IE6 and isn't on by default in IE7. IE8 has it on by default so it is not possible to execute the attack on it. So if you are running the latest version of IE8 it is not a issue. OR you could be smart and stop using IE and run Firefox, Chrome, or any other browser that doesn't seem to have as many loopholes, bugs and exploits as IE does.

Re:Do other AV companies handle this (1)

BadAnalogyGuy (945258) | more than 3 years ago | (#34167560)

For almost all of my browsing needs, I use Chrome. I don't assume this protects me to any significant degree, but it at least gets me out of the way of these IE exploits, and that is useful.

However, IE is not just the browser application. Any application that incorporates the browser control (and there are many) could be a vector for this attack. The question becomes whether the settings in IE8 or IE9 that block script execution are applicable in those apps since they may rely on that functionality. If the settings carry over, then do my other apps become crippled? Or if they don't carry over, how at risk am I via those apps?

It must be prevented externally of IE itself. The AV software must be able to catch and block any script stepping out of its bounds, and if I can't trust the application to do that by itself, I must trust something else in the system to do that for me. If AVG is the only one that can block this problem, it may be that I am SOL since I won't install AVG.

Re:Do other AV companies handle this (1, Troll)

Spad (470073) | more than 3 years ago | (#34167610)

Though at all times it bears remembering that Firefox [secunia.com], Chrome [secunia.com] and Others [secunia.com] are all vulnerable to serious exploits from time to time.

Re:Do other AV companies handle this (1)

Nerdfest (867930) | more than 3 years ago | (#34168070)

Maybe it's my memory, but I don't see the people behind those browsers say "I don't think this is serious enough for an out of band update". Out of band? Fix teh damn bugs as soon as you can and let people install the patches later if that's what makes them happy.

Re:Do other AV companies handle this (1)

BCoates (512464) | more than 3 years ago | (#34168550)

If the parent post is correct that only IE7 and earlier are vulnerable in their default configurations, the fair comparison would be to update support for browsers a year and a half out of date--are firefox 2.0 or 3.0 still getting timely security patches?

Re:Do other AV companies handle this (0)

Anonymous Coward | more than 3 years ago | (#34168148)

Yeah and with Chrome and IE even DEP-bypassing exploits can't get anywhere without escalating twice - once for the host process, and once for UAC or root. Unless you run Firefox with SELinux then it's basically hosed by all modern attacks.

The same who profit from advertising this (0)

Anonymous Coward | more than 3 years ago | (#34167264)

are the same people who make profit from making software to 'be safe from it'

the same was with a botnet-study which was reported here a year or few back;
it had the botnets drawn to a network-graph with their ips and domain-names included.
the ips of all 'anti-identify theft' led through a central hub, they were comparing eachother in pricing and performance or "what's included in the deal".

you're paying to a mafia.

obligatory southpark reference (0)

FudRucker (866063) | more than 3 years ago | (#34167268)

1. Make browser with undocumented vulnerabilities 2. Sell exploits for lucrative prices 3. ????? 4. Profit!!!

Re:obligatory southpark reference (1)

amicusNYCL (1538833) | more than 3 years ago | (#34167514)

Right, Microsoft was sitting on this goldmine for the past 9 years just waiting to cash it in.

Re:obligatory southpark reference (0)

Anonymous Coward | more than 3 years ago | (#34167558)

Hey ,can you hear that? It's the sound of a small coin landing in a pile of millions of paper bills.

Re:obligatory southpark reference (1)

by (1706743) (1706744) | more than 3 years ago | (#34167538)

Pretty sure 4) follows from 2), thus negating the need for 3).

Now, collecting underwear...therein lies the true mystery.

Re:obligatory southpark reference (0)

Anonymous Coward | more than 3 years ago | (#34167970)

I'm happy with any (small) system where each state has its own bit-mask.

In Soviet former U.S.A. (0)

Anonymous Coward | more than 3 years ago | (#34167424)

Hacker kit exploit IE flaw.

Yours In Electrogorsk,
Kilgore T.

P.S.: Sarah Palin for former U.S.A. President ! Go bitch.

Just a part of the Windows ecosystem (1)

NicknamesAreStupid (1040118) | more than 3 years ago | (#34168046)

I wonder if this affects Windows Mobile 7? As I recall, it uses IE7. BTW, did you know that windows kill about a billion birds each year? No shit. They run into them, banging their heads again and again. Before anyone mods this off-topic, please consider the metaphor.

Well, the first step... (1)

MacGyver2210 (1053110) | more than 3 years ago | (#34168182)

...is to stop using IE for anything. It's a garbage browser.

Why would anyone use it when there's so many higher-quality free alternatives? Firefox? Chrome?

Just let it die.

Hmm. (1)

vegiVamp (518171) | more than 3 years ago | (#34171766)

> Microsoft has promised to patch the vulnerability, but last week said the threat didn't warrant an 'out-of-band' update.

So, this is a zero-day HOW ?

Subject (1)

Legion303 (97901) | more than 3 years ago | (#34172468)

So if you read between Microsoft's lines, they appear to be suggesting a temporary workaround of not using IE.

Check for New Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Sign up for Slashdot Newsletters
Create a Slashdot Account

Loading...