OT: New IE security flaw is huge.

craftech wrote on 12/16/2008, 6:42 PM
"Users of Microsoft's Internet Explorer are being urged by experts to switch to a rival until a serious security flaw has been fixed.

The flaw in Microsoft's Internet Explorer could allow criminals to take control of people's computers and steal their passwords, internet experts say. ....................................Microsoft says it has detected attacks against IE 7.0 but said the "underlying vulnerability" was present in all versions of the browser.

Other browsers, such as Firefox, Opera, Chrome, Safari, are not vulnerable to the flaw Microsoft has identified. "

What a surprise?


John


Comments

cbrillow wrote on 12/16/2008, 7:31 PM
Nope, no surprises here. I'm not a MS basher by any means, but I've stayed away from IE for a LONG time. Just never liked it, really, as I started out with Mosaic, and watched as IE tried to catch up with Netscape. (not that hard when you bundle a browser with every copy of Windows sold...)

It's no secret that those who do hate MS target IE, Outlook, and their other apps more than they do 3rd party software. None of this software is 100% secure, but I try to use the more secure, less-targeted apps, stay well-protected on the 'net, and keep up-to-date with Secunia PSI.
Coursedesign wrote on 12/16/2008, 7:49 PM
I like Outlook (even though I think Outllook 2007 is messed up compared to Outlook XP), but IE I avoid completely.

Generally I prefer Safari for OS X and Firefox for Windows. Safari does some key things much better than FF, but FF has great plug-ins for things like "download all files linked on a web page" which is common when buying complex packages.

ChristoC wrote on 12/17/2008, 12:54 PM
Security Update for Internet Explorer 7 for Windows XP (KB960714)
issued today; supposed to fix problem.
daryl wrote on 12/18/2008, 10:27 AM
KB90714 may fix THIS problem, but what about the next one. Security issues seem like a daily event in IE. I too avoid its use completely.
eVoke wrote on 12/18/2008, 10:50 AM
@ cbrillow -

I still have a copy of Mosaic on floppy disc ; )
John_Cline wrote on 12/18/2008, 11:09 AM
The number of security attacks is directionally proportional to the popularity of the software. Both Windows and IE are big targets. It's not that Firefox is inherently free of security holes, if it were as popular as IE, it would be the focus of the attacks. Attacks on MAC computers are on the rise as well, also proportional to its popularity. Those folks that bought MACs thinking they were designed to be "safe" are now finding out that this isn't necessarily true.
Coursedesign wrote on 12/18/2008, 11:28 AM
And exactly how are they finding that out?

I have two Macs running with no antivirus software and no viruses ever. Of the MANY Mac owners I know, no one has ever used antivirus software, nor have they ever given any thought to viruses or seen any.

Statisticians have suggested that when the Mac market share hits 16%, it will become worthwhile for virus writers to go in pursuit of OS X. Right now OS X is at 9%, so there is still some peace and quiet time left.

In addition to being protected by its exclusivity, it is also worth noting that OS X is fundamentally different from Windows in that applications don't need to run as Administrator (or Power User) to be able to function.

That means that when the future theoretical virus hits a Mac and tries to install something nasty, a message pops up on the screen saying a program downloaded from the internet today at 10:34am wants to install, do you want to install this, and if so, do you actually know the system password?

Even when running as OS X Administrators, users are not running as Root. That's a separate login that protects the core of the system.

It's UNIX after all.

You know what UNIX stands for, right?



UINX stands for Truth, Justice, and the American Way!

:O)

Skuzzy wrote on 12/18/2008, 12:29 PM
Just because your Apple has not gotten any viruses, does not mean there are none to be had.

http://support.apple.com/kb/HT3338

farss wrote on 12/18/2008, 12:39 PM
You beat me to it!

What does stagger me is the number of Apple users who don't keep their OS's up to date.
Apple is on the nose in the security community for not responding to alerts. As well as that they've used security updates to install new applications and services and without advising users.

Bob.
craftech wrote on 12/18/2008, 4:11 PM
The number of security attacks is directionally proportional to the popularity of the software. Both Windows and IE are big targets. It's not that Firefox is inherently free of security holes, if it were as popular as IE, it would be the focus of the attacks.
============
I disagree with this premise. The security problems with Internet Explorer are Microsoft's fault because they insisted that Internet Explorer had to be integrated into the operating system to benefit themselves at our expense.

Hundreds of security patches later the last thing Microsoft would ever consider doing is separating it from their operating system to make it safer from attack. That is why Opera and Firefox are inherently more secure.

John
video777 wrote on 12/18/2008, 4:22 PM
The security problems with Internet Explorer are Microsoft's fault because they insisted that Internet Explorer had to be integrated into the operating system to benefit themselves at our expense.
The same way it's the banks fault that they got robbed.

FYI - IE is NOT integrated with Windows.
Coursedesign wrote on 12/18/2008, 4:41 PM
Just because your Apple has not gotten any viruses, does not mean there are none to be had.

Call me back when you find some Mac viruses in the wild (on actual user machines, not in the labs of anti-virus software companies).

I saw somewhere that the last wild attack that actually hit Macs was in 1994 when 49 Macs got infected. I can't vouch for that factoid, but it seems at least possible.

Coursedesign wrote on 12/18/2008, 4:44 PM
FYI - IE is NOT integrated with Windows.

And what are you basing that on?

Microsoft claimed in court that the reason it was impossible to remove IE from Windows was that it was so deeply integrated.

Can't have it both ways.

Perhaps you mean that the IE GUI isn't integrated?

That's cool, but doesn't help security at all.

cbrillow wrote on 12/18/2008, 6:12 PM
@eVoke:

Ever heard of SlipKnot? (It was used with a slip connection to display internet images just prior to "www"...)

Not necessarily the good old days... ;>)
deusx wrote on 12/18/2008, 9:17 PM
>>>>Other browsers, such as Firefox, Opera, Chrome, Safari, are not vulnerable to the flaw Microsoft has identified. "<<<<

That just means that MS has identified it, while other browsers may be just as bad and no none has identified the problem yet ( could be a different way of doing the same thing to your machine ).

Firefox just released an update that fixed 10 of its own security holes, so anybody thinking that IE7 is somehow much worse is not being very realistic.

Mac people are just delusional, not even worth discussing.

The whole point of today's viruses is to cause you no problems with your PC or Mac, so you keep working along thinking everything is OK, while they steal your passwords for various accounts. Does not have to be your bank account either. You web site, e-mail account, or pc/mac could be used to spread spam right now and you have no clue about it.
DelCallo wrote on 12/19/2008, 2:23 AM

<<FYI - IE is NOT integrated with Windows.>>

Please show me how to uninstall IE from my XP Pro machine. I have tried many times without success.

Caruso
Grazie wrote on 12/19/2008, 2:32 AM
Please show me how to uninstall IE from my XP Pro machine. I have tried many times without success.I have never done this, but I can see that Add/Remove programs in Control Panel allows me to remove IE7. Have you tried that? And was it THAT that didn't work? Apart from this method, what other method did you use?

Grazie
DelCallo wrote on 12/19/2008, 2:47 AM
<<Mac people are just delusional, not even worth discussing.>>

My last Apple was a IIC, so I cannot comment about apple, but I do run a dual boot XP/Linux machine (in fact, all the computers in my home are setup that way). Whenever there is an attempt to install new software in Linux, a prompt appears requesting the administration password. If you need root access for any reason, you are prompted for and need to supply the administration password.

The previous Mac poster whose operating system is based on a very old (albeit stable) UNIX kernal alluded to this, and in the brief time I've spent with Vista, I see clues that MS has included some form of this feature in that OS.

Now, I won't say that this design precludes totally the possibility of infection, but it certainly minimizes it. If you search the internet, you'll find tales of contests where hackers were invited to infect a MAC, a Window, and a Linux machine.

I don't recall the relative results as to how long it took to hack the Win/MAC machines, but the Linux machine was left standing, unhacked.

That certainly is no proof that Linux is hack-proof, but for mere mortals, it does mean that the chances are remote.

Unlike either MAC or Windows, the Linux community is run and maintained by the community. Again, that doesn't preclude some anti-social miscreant from rebelling, but you don't have deep-seated resentment against what are perceived as monopolies, and you don't have otherwise normal customers lusting after expensive software that is out of their economic reach. Open source doesn't breed illegal hackers of either the professional or teenage ilk.

When I was a kid, even in my IIc days, there were numerous initiatives to crack this or that 'pong' game or whatever. You will never have that in the open source world, because, by nature, alteration for improvement of open code is encouraged, and I refer specifically to the code for open source operating systems, not proprietary applications sold for profit to run on them.

That is the nature of open source, and, in combination with Linux' inherently more secure design, explains why I am able to surf the net endlessly without concern for infections.

The pity, of course, is that some of the finest applications (Vegas among them) are not available (even as paid applications) for Linux.

That is changing, but very slowly. A perfect world for me would be to purchase (at almost any price) software capable of handling audo/video on a level equal to Vegas that runs seamlessly on a linux machine. Ah, yes, that would be heaven.

The only reason I continue to run XP is to maintain functionality with aps such as Vegas, Wavelab, Nuendo, InDesign, and such. There are no Linux equivalents to these applications.

I'm no fan of MS, but their office suite is tops and deserves its acceptance as the standard in the business world. Fortunately, that suite functions flawlessly from Crossover/wine in Linux.

Sorry to have been so lengthy, but the experiences related by MAC (or Linux) people has its roots in other than delusion.

For the time being, however, the added security comes at a price - - real dollars for the MAC folks, some software limitations for the MAC folks, and, with regard to multimedia applications, severe limitations for Linux folks.

Caruso
daryl wrote on 12/19/2008, 6:36 AM
I have even tried deleting the IE executable, guess what, it comes right back.
deusx wrote on 12/19/2008, 8:20 AM
yes Mac people are delusional.

In those contests you mention, Mac was hacked first, in under 2 minutes.

All those points you mention about linux are irrelevant. Like rootkits on windows side, your Mac will not warn you about anything when the part that's supposed to warn you is being controlled by a trojan.

Think of it as of what the aids virus does. it attacks and feeds on very cells that are supposed to defend us against disease.

The only reason there is less of this going on on the Mac side is because far fewer people use it. As those contests proved it, Mac was easiest to hack, and any notion of more security just because of OSX is textbook delusion.
pmooney wrote on 12/19/2008, 8:21 AM
I'm a big fan of Windows Internet Explorer. I've never had a "major security breach" because I don't keep anything on my computer that, if stolen, would harm me in any way.

People who leave sensitive date like bank account numbers and passwords stored on their computer are just asking for trouble in the long term.

So if a hacker takes control of my PC from a remote location, what are they goona do?....edit a movie with Vegas?...play a video game?
Coursedesign wrote on 12/19/2008, 8:53 AM
pmooney has an easy life, I envy that.

I have to worry about not just my own info, but other people's info, and I've had to spend quite some effort on this, successful so far (10 years on my current specific needs).

[i]In those contests you mention, Mac was hacked first, in under 2 minutes.[/i[

I recall two days, not two minutes.

More importantly, where are the real life, in-the-wild viruses that hurt users?

Like the ones that hurt Windows users every picosecond across the globe?

I woould use Linux if I could get my apps for it, but as an old Unix guy I'm happy to have a full Unix, 24x80 terminal and all, built into every Mac. It's BSD Unix which is an old favorite, and at least as secure as any Linux (and in some places more so).

For me personally, I don't have any problems with my Windows workstation either. But I feel truly sorry for non-computer literate people who have to use Windows. It's pretty scary, and I frankly wouldn't oppose requiring a license and scheduled system inspections for them to hook up to the intertubes.

Vista is better than XP in security, but I see users getting so turned off by the infamous UAC interface that they just click "Yes, yes" to everything. OS X accomplishes the same thing without irritation, MS should copy that too (together with a lot of other stuff they copied, thank heavens).

Skuzzy wrote on 12/19/2008, 9:04 AM
Call me back when you find some Mac viruses in the wild (on actual user machines, not in the labs of anti-virus software companies).
The following is a reported incident. The user is some person reporting it from a gmail account.

If you keep up with CERT, you will be more aware of the above types of security problems. There are many reported incidents for Apple/Mac operating systems.

If you like, I can pull another 30, or so, reported incidents from this year alone.

By the way, what difference does it make if the report is from an anti-virus company or an end user? Once reported it is fair game to be used by any hacker. If your computer network has no data worth keeping private or computers which are not needed to run your business, then I can see where it would be of no concern.

To blindly plop a computer on your network and claim you are safe, by virtue of it being an Apple is just irresponsible. If you were my network admin, I would fire you for that attitude alone.
Coursedesign wrote on 12/19/2008, 9:41 AM
The "reported incident" talks about something that could be a "potential problem."

It's a given that OS X like Linux and (gasp!) all versions of Windows especially (because of the way it was designed and written) and virtually all other complex software will have bugs and security flaws.

If a report is from an anti-virus company, you have to look at whether the company created the flaw in a lab, or whether it was reported to them by an end user.

Lab-created viruses are virtually never found in the field, because they are so contorted, created just to make people fearful and make them see a need for the company's antivirus product.

To blindly plop a computer on your network and claim you are safe, by virtue of it being an Apple is just irresponsible. If you were my network admin, I would fire you for that attitude alone.

I have not made such a claim. I have however noted that there are many many companies that are using networks of Macs with no antivirus software, and no virus or worm problems either.

The only discussion there is whether to get e-mail scanners to prevent employees from passing on Windows malware by e-mail.


Choosing an OS platform is a big choice that involves more than security.

I use a Mac Pro side by side with an HP workstation running Windows, and I find what everybody else finds: there are some things where I prefer OS X to Windows XP, and some things where I prefer XP over X.

Still, the reason I use both platforms is that I need key professional software that only exists for OS X, and I also need Vegas and some legacy apps which run only on Windows XP.

I'm aware that this is religion for many people, where "only the people in my church will sit on God's right side at the end of time, while the others will be downstairs still burning in the eternal fire."

To me, these are just tools. Tools come and go all the time, and I see no need to get attached to any of them.

Just use them to do your work!