HEADS UP - New major IE exploit. - GoFuckYourself.com

goBigtime · 06-09-2004, 09:14 AM

http://www.computerworld.com.au/inde...16298&eid=-255

Internet Explorer carved up by zero-day hole

Kieren McCarthy, Techworld.com

09/06/2004 08:28:25

Two new vulnerabilities have been discovered in Internet Explorer which allow a complete bypass of security and provide system access to a computer, including the installation of files on someone's hard disk without their knowledge, through a single click.

Worse, the holes have been discovered from analysis of an existing link on the Internet and a fully functional demonstration of the exploit have been produced and been shown to affect even fully patched versions of Explorer.

It has been rated "extremely critical" by security company Secunia, and the only advice is to disable Active Scripting support for all but trusted websites.

The discovery stems from Dutch researcher Jelmer who was sent an Internet link which he was warned used unknown Explorer vulnerabilities to install adware on his computer. He found it did and embarked on a detailed analysis of the link, which demonstrates an extremely sophisticated use of encrypted code to bypass the Web browser's security.

In simple terms, the link uses an unknown vulnerability to open up a local Explorer help file -- ms-its:C:\WINDOWS\Help\iexplore.chm::/iegetsrt.htm. It delays executing anything immediately but instead uses another unknown vulnerability to run another file which in turn runs some script. This script is then used to run more script. And finally that script is used to run an exploit that Microsoft Corp. has been aware of since August 2003 but hasn't patched.

That exploit -- Adodb.stream -- has not been viewed as particularly dangerous, since it only works when the file containing the code is present on the user's hard disk. The problem comes in the fact that the Help file initially opened is assumed to be safe since it is a local file and so has minimal security restrictions.

By using the unknown exploits, code is installed within the help file window, all security efforts are bypassed, and the Adodb.stream exploit is then used to download files on the Internet direct to the hard disk.

What this means in reality is that if you click on a malicious link in an email or on the Internet, a malicious user can very quickly have complete control of your PC. And there is no patch available. You can see it happen by click here.

With the code already available on the Net, this is effectively a security nightmare ... unless you're a Mozilla or Opera user that is.

loverboy · 06-09-2004, 09:16 AM

nothing beats Netscape

IE sucks

AMADude · 06-09-2004, 09:17 AM

Fuck IE.
I use Mozilla.

AvanteGuard · 06-09-2004, 09:18 AM

Quote:

Originally posted by loverboy
nothing beats Netscape

IE sucks

Except FireFox

Juicy D. Links · 06-09-2004, 09:19 AM

Quote:

With the code already available on the Net, this is effectively a security nightmare ... unless you're a Mozilla or Opera user that is

great

Veterans Day · 06-09-2004, 09:21 AM

auto windows update, really simple.......NEXT

Dirty F · 06-09-2004, 09:22 AM

Theres a new exploit like this every month...use IE and you are never safe.

M_M · 06-09-2004, 09:26 AM

Microsoft supports spyware

I dont see other logical explanation to them not fixing known security holes for months

Jace · 06-09-2004, 09:29 AM

windows update...why the fuck do people have a problem with updating? every time there is a new update, a little icon appears in my task tray and I get the update...how hard is that?

TheSwed · 06-09-2004, 09:31 AM

Quote:

Originally posted by Veterans Day
auto windows update, really simple.......NEXT

skillfull · 06-09-2004, 09:40 AM

use firefox or opera
still using IE is just being idiot

Veterans Day · 06-09-2004, 09:42 AM

Quote:

Originally posted by skillfull
use firefox or opera
still using IE is just being idiot

I know IE consumes 99% of my traffic

strobi · 06-09-2004, 09:43 AM

exploiters are making tons of money again! hurray!!

AnalProbe · 06-09-2004, 09:46 AM

IE 3.0 works fine for me.

Helix · 06-09-2004, 09:59 AM

Quote:

Originally posted by Veterans Day
auto windows update, really simple.......NEXT

And finally that script is used to run an exploit that Microsoft Corp. has been aware of since August 2003 but hasn't patched.

so much for update

goBigtime · 06-09-2004, 10:02 AM

Quote:

Originally posted by Veterans Day
auto windows update, really simple.......NEXT

Quote:

Originally posted by goBigtime
http://www.computerworld.com.au/inde...16298&eid=-255

"......And finally that script is used to run an exploit that Microsoft Corp. has been aware of since August 2003 but hasn't patched."
^ (regarding MSFT's timeliness on patching vulnerabilities)

"... And there is no patch available."
^ (regarding this NEW exploit)

With the (malicious) code already available on the Net, this is effectively a security nightmare

... unless you're a Mozilla or Opera user that is.

Wtf are you NEXT'ing about? Can't you read?

Sambo · 06-09-2004, 10:03 AM

Went to firefox a couple of weeks ago......

Will never use IE again!!

goBigtime · 06-09-2004, 10:06 AM

Quote:

Originally posted by Sambo
Went to firefox a couple of weeks ago......

Will never use IE again!!

Be sure to get the googlebar at http://googlebar.mozdev.org & tweak it how you like it.

The mozilla googlebar has a ton of cool one-click goodies on it like image searching, google groups, google news, dictionary & thesaurus lookups, page translation, backlinks etc.

You have to play with it a little to get it setup nice though.

I have 3 toolbar strips total on mine...

Notice the instant useragent switcher .... so you can make yourself look like a search engine spider & look at peoples pages how they want them to appear for the SE's :graucho

Sambo · 06-09-2004, 10:08 AM

Quote:

Originally posted by goBigtime
Be sure to get the googlebar at http://googlebar.mozdev.org & tweak it how you like it.

The mozilla googlebar has a ton of cool one-click goodies on it like image searching, google groups, google news, dictionary & thesaurus lookups, page translation, backlinks etc.

Thanks.... I was looking for one of those!!

goBigtime · 06-09-2004, 10:12 AM

Quote:

Originally posted by goBigtime

Notice the instant useragent switcher .... so you can make yourself look like a search engine spider & look at peoples pages how they want them to appear for the SE's :graucho

I don't use that UA switcher all the time though... I can't stand more than 3 toolbars and I use that precious little space for my quick site links / bookmarks.

To get it down to 3 functional strips like that I moved all the bookmarks to that toolbar and then disabled the bookmark toolbar. (in... view | toolbars )

Btw... middle-click on any link to open a new tab!

(and middle click on the tab to close it)

Sambo · 06-09-2004, 10:22 AM

Quote:

Originally posted by goBigtime

Btw... middle-click on any link to open a new tab!
(and middle click on the tab to close it)

Great tip.....

Thanks again!!

submitter · 06-09-2004, 10:32 AM

Quote:

Originally posted by JaceXXX
windows update...why the fuck do people have a problem with updating? every time there is a new update, a little icon appears in my task tray and I get the update...how hard is that?

how many of you have buyed windows?
i, no.

jwerd · 06-09-2004, 10:36 AM

I am so happy I switched my mail client and browser to Firebird and Firefox

So much better.

nofx · 06-09-2004, 10:37 AM

and this is why i love and use Opera, www.opera.com

HarryHo · 06-09-2004, 10:39 AM

jESUS CHRIST all the idiots respond again

HELLO MORONS .

NETSCAPE HAS NO SECURITY
FIRECHEESE/OPERA HAS NO SECURITY and isn't even functional

I will tell you the difference between your cheesy fucked up browsers and i.e.

Internet explorer runs updates regularly to patch holes.

This hole isnt new , i have been using it for months.

Firefox and netscape are the swiss cheese of the browser industry.

I.e. is the whipping post for the browser industry.

Anyone who is a webmaster and tells you they dont use i.e. is full of shit or very very poor. They may not use it very often , but if they dont use it they don't know what everyone else is seeing..

Suprise Suprise nobody like i.e. , but its better than your browser

BTW the same holes exist as the holes explained in the article in both opera and netscape, they just don't report them because they don't plan on patching them.

Theo · 06-09-2004, 10:39 AM

someone send this thread to Hooper

HarryHo · 06-09-2004, 10:42 AM

btw if anyone wants to see a sample of this security hole i would be glad to show you how it works..

DamageX · 06-09-2004, 10:46 AM

Quote:

Originally posted by Veterans Day
auto windows update, really simple.......NEXT

Don't tell me that you're so stupid that after reading that text you still think windows update will fix that hole?

Sambo · 06-09-2004, 10:46 AM

Quote:

Originally posted by HarryHo
jESUS CHRIST all the idiots respond again

HELLO MORONS .

NETSCAPE HAS NO SECURITY
FIRECHEESE/OPERA HAS NO SECURITY and isn't even functional

I will tell you the difference between your cheesy fucked up browsers and i.e.

Internet explorer runs updates regularly to patch holes.

This hole isnt new , i have been using it for months.

Firefox and netscape are the swiss cheese of the browser industry.

I.e. is the whipping post for the browser industry.

Anyone who is a webmaster and tells you they dont use i.e. is full of shit or very very poor. They may not use it very often , but if they dont use it they don't know what everyone else is seeing..

Suprise Suprise nobody like i.e. , but its better than your browser

BTW the same holes exist as the holes explained in the article in both opera and netscape, they just don't report them because they don't plan on patching them.

I updated IE every day.... if an update was available

Every day IE was rendered useless by some crap spyware etc.....

I have been using FireFox for 2 weeks without a single problem

A simple fact

If I am building sites I always veiw them in IE..... but so far I have never seen a difference between IE and FireFox rendering of my pages.... again a simple fact

DamageX · 06-09-2004, 10:48 AM

Quote:

Originally posted by Sambo
I updated IE every day.... if an update was available

Every day IE was renedered useless by some crap spyware etc.....

I have been using FireFox for 2 weeks without a single problem

A simple fact

Why do you think that is, Einstein? Nobody bothers creating exploits for Mozilla and Opera, because they have so small market shares. It's not like everybody's out to fuck it up for MS. It's all business. Moron.

AlienQ - BANNED FOR LIFE · 06-09-2004, 10:49 AM

Quote:

Originally posted by Soul_Rebel
someone send this thread to Hooper

Fuck that, delete the thread already just incase.

Sambo · 06-09-2004, 10:52 AM

Quote:

Originally posted by DamageX
Why do you think that is, Einstein? Nobody bothers creating exploits for Mozilla and Opera, because they have so small market shares. It's not like everybody's out to fuck it up for MS. It's all business. Moron.

I know the reason for it......

But it dosnt change the fact that I dont have problems!!!!

And thats the important thing..... moron

jimmyf · 06-09-2004, 11:00 AM

Quote:

Originally posted by Sambo
Thanks.... I was looking for one of those!!

I was also

thanks

jimmyf · 06-09-2004, 11:01 AM

Quote:

Originally posted by submitter
how many of you have buyed windows?
i, no.

go buy it then.

goBigtime · 06-09-2004, 11:02 AM

Quote:

Originally posted by HarryHo

NETSCAPE HAS NO SECURITY
FIRECHEESE/OPERA HAS NO SECURITY and isn't even functional

Actually, FireFox & Mozilla are open-source community based projects contributed to by people all over the world. If a vulnerability is discovered, they get fixed pronto.

Quote:

Originally posted by HarryHo
BTW the same holes exist as the holes explained in the article in both opera and netscape, they just don't report them because they don't plan on patching them.

Note that he's not talking about open source Mozilla / FireFox.

Otherwise it would be even more clear that he doesn't understand how open source communities work. "They just don't report them..." there are no big bug-suppression conspiracies like that in open source. It sort of defeats the purpose.

Anyway you can test various browsers here and see how they compare http://bcheck.scanit.be/bcheck

Manowar · 06-09-2004, 11:02 AM

Firefox, its whats for breakfast

HarryHo · 06-09-2004, 11:02 AM

Quote:

Originally posted by Sambo
I know the reason for it......

But it dosnt change the fact that I dont have problems!!!!

And thats the important thing..... moron

Guess what the farmer sad when the cow died...?

" gee thats the first time she has ever done that "

jimmyf · 06-09-2004, 11:05 AM

Quote:

Originally posted by Sambo
I know the reason for it......

But it dosnt change the fact that I dont have problems!!!!

And thats the important thing..... moron

this correct.

DamageX · 06-09-2004, 11:06 AM

Quote:

Originally posted by HarryHo
Guess what the farmer sad when the cow died...?

" gee thats the first time she has ever done that "

jimmyf · 06-09-2004, 11:07 AM

Quote:

Originally posted by goBigtime
Actually, FireFox & Mozilla are open-source community based projects contributed to by people all over the world. If a vulnerability is discovered, they get fixed pronto.

Note that he's not talking about open source Mozilla / FireFox.

Otherwise it would be even more clear that he doesn't understand how open source communities work. "They just don't report them..." there are no big bug-suppression conspiracies like that in open source. It sort of defeats the purpose.

Anyway you can test various browsers here and see how they compare http://bcheck.scanit.be/bcheck

And i might add.

this is correct.

Sambo · 06-09-2004, 11:07 AM

Quote:

Originally posted by HarryHo
Guess what the farmer sad when the cow died...?

" gee thats the first time she has ever done that "

Well the cow is fit and well at the moment.....

Which is better than I can say for that lame duck I was using

goBigtime · 06-09-2004, 11:09 AM

Not that I rely on online browser based security tests to tell me if I'm "secure" or not,

...but for shits & giggles, here are my results from:

http://bcheck.scanit.be/bcheck

Browser Security Test Results

Dear Customer,

The Browser Security Test is finished. Please find the results below:
High Risk Vulnerabilities 0
Medium Risk Vulnerabilities 0
Low Risk Vulnerabilities 0

FireFox here.

jimmyf · 06-09-2004, 11:12 AM

Quote:

Originally posted by HarryHo
Guess what the farmer sad when the cow died...?

" gee thats the first time she has ever done that "

guess what?

you be hard headed, keep on using IE.
more power 2 you.

because I don't think it smart, but that's just me.

I never have and never will use Outlook, used and still check my pages with IE.

goBigtime · 06-09-2004, 12:46 PM

bump

winter · 06-09-2004, 01:02 PM

I.E. 6.0, Googlebar, and norton internet security. SUCK IT OPERA/NUTSCRAPE BITCHES

The Browser Security Test is finished. Please find the results below:

High Risk Vulnerabilities 0
Medium Risk Vulnerabilities 0
Low Risk Vulnerabilities 0

Holly · 06-09-2004, 01:17 PM

Quote:

Originally posted by winter
I.E. 6.0, Googlebar, and norton internet security. SUCK IT OPERA/NUTSCRAPE BITCHES

The Browser Security Test is finished. Please find the results below:

High Risk Vulnerabilities 0
Medium Risk Vulnerabilities 0
Low Risk Vulnerabilities 0

FWIW, I run IE 6, Norton, and Zonealarm, and I got the same results. I wonder if anyone with IE has had vulnerabilities to show up. And if so, does it actually tell you what to do to fix them or give you links to the patches? Or is it a "pay us/buy our software and we'll tell you the fix" deal?

My wmp opened, I got a download box, and a bunch of other crap, so I was surprised I passed.

AdultNex · 06-09-2004, 01:21 PM

Quote:

Originally posted by goBigtime
Be sure to get the googlebar at http://googlebar.mozdev.org & tweak it how you like it.

The mozilla googlebar has a ton of cool one-click goodies on it like image searching, google groups, google news, dictionary & thesaurus lookups, page translation, backlinks etc.

You have to play with it a little to get it setup nice though.

I have 3 toolbar strips total on mine...

Notice the instant useragent switcher .... so you can make yourself look like a search engine spider & look at peoples pages how they want them to appear for the SE's :graucho

That won't work for some cloaked pages.

Just changing the useragent will do nothing.

cluck · 06-09-2004, 01:22 PM

It's not new. Sorry.

Elli · 06-09-2004, 01:29 PM

Just for fun I turned off ZoneAlarm and ran only mozilla 1.6. And this is what I got:

The Browser Security Test is finished. Please find the results below:
High Risk Vulnerabilities 0
Medium Risk Vulnerabilities 0
Low Risk Vulnerabilities 0

Diligent · 06-09-2004, 03:34 PM

With Firefox, the only crap I may have to put up with is JS window-resizing..

HarryHo seems quite familiar with the mentioned exploit... Makes You wonder
if he isn't making coin on it

Also.. he seems to be enough of a moron to believe he can convert us non-IE's
back from the safer gear..

06-09-2004, 09:14 AM	#1
goBigtime Confirmed User Join Date: Nov 2002 Posts: 7,761	HEADS UP - New major IE exploit. http://www.computerworld.com.au/inde...16298&eid=-255 Internet Explorer carved up by zero-day hole Kieren McCarthy, Techworld.com 09/06/2004 08:28:25 Two new vulnerabilities have been discovered in Internet Explorer which allow a complete bypass of security and provide system access to a computer, including the installation of files on someone's hard disk without their knowledge, through a single click. Worse, the holes have been discovered from analysis of an existing link on the Internet and a fully functional demonstration of the exploit have been produced and been shown to affect even fully patched versions of Explorer. It has been rated "extremely critical" by security company Secunia, and the only advice is to disable Active Scripting support for all but trusted websites. The discovery stems from Dutch researcher Jelmer who was sent an Internet link which he was warned used unknown Explorer vulnerabilities to install adware on his computer. He found it did and embarked on a detailed analysis of the link, which demonstrates an extremely sophisticated use of encrypted code to bypass the Web browser's security. In simple terms, the link uses an unknown vulnerability to open up a local Explorer help file -- ms-its:C:\WINDOWS\Help\iexplore.chm::/iegetsrt.htm. It delays executing anything immediately but instead uses another unknown vulnerability to run another file which in turn runs some script. This script is then used to run more script. And finally that script is used to run an exploit that Microsoft Corp. has been aware of since August 2003 but hasn't patched. That exploit -- Adodb.stream -- has not been viewed as particularly dangerous, since it only works when the file containing the code is present on the user's hard disk. The problem comes in the fact that the Help file initially opened is assumed to be safe since it is a local file and so has minimal security restrictions. By using the unknown exploits, code is installed within the help file window, all security efforts are bypassed, and the Adodb.stream exploit is then used to download files on the Internet direct to the hard disk. What this means in reality is that if you click on a malicious link in an email or on the Internet, a malicious user can very quickly have complete control of your PC. And there is no patch available. You can see it happen by click here. With the code already available on the Net, this is effectively a security nightmare ... unless you're a Mozilla or Opera user that is.

06-09-2004, 09:17 AM	#3
AMADude Confirmed User Join Date: Apr 2004 Posts: 3,875	Fuck IE. I use Mozilla. __________________ No sig, just here to fuck around.

06-09-2004, 09:21 AM	#6
Veterans Day Confirmed User Join Date: Jul 2003 Location: The Windy City Posts: 8,403	auto windows update, really simple.......NEXT __________________ Build a Massive Traffic Network, Hands FREE, Totally Automated

06-09-2004, 09:40 AM	#11
skillfull Confirmed User Industry Role: Join Date: Apr 2003 Location: Quebec Calisse Posts: 4,716	use firefox or opera still using IE is just being idiot __________________ mind at underdark dot cc SEO Analyst Thunder-Ball.net - Member

06-09-2004, 10:36 AM	#23
jwerd Confirmed User Industry Role: Join Date: Jun 2003 Location: Costa Rica Posts: 1,953	I am so happy I switched my mail client and browser to Firebird and Firefox So much better. __________________ Yii Framework Guru - Seasoned PHP vet - Partner @ XXXCoupon.com

06-09-2004, 09:16 AM	#2
loverboy When it rains, it pours Industry Role: Join Date: May 2003 Posts: 20,609	nothing beats Netscape IE sucks

06-09-2004, 09:22 AM	#7
Dirty F Too lazy to set a custom title Industry Role: Join Date: Jul 2001 Posts: 59,204	Theres a new exploit like this every month...use IE and you are never safe.

06-09-2004, 09:26 AM	#8
M_M Confirmed User Join Date: May 2004 Posts: 1,167	Microsoft supports spyware I dont see other logical explanation to them not fixing known security holes for months

06-09-2004, 09:29 AM	#9
Jace FBOP Class Of 2013 Industry Role: Join Date: Jan 2004 Location: bumfuck, ky Posts: 35,562	windows update...why the fuck do people have a problem with updating? every time there is a new update, a little icon appears in my task tray and I get the update...how hard is that?

06-09-2004, 09:43 AM	#13
strobi Confirmed User Join Date: Nov 2002 Location: Belgium Posts: 7,383	exploiters are making tons of money again! hurray!!

06-09-2004, 09:46 AM	#14
AnalProbe pain in the Ass Industry Role: Join Date: Jan 2004 Posts: 3,727	IE 3.0 works fine for me.

06-09-2004, 10:03 AM	#17
Sambo So Fucking Banned Join Date: Mar 2004 Posts: 1,187	Went to firefox a couple of weeks ago...... Will never use IE again!!

06-09-2004, 10:37 AM	#24
nofx Too lazy to set a custom title Join Date: Nov 2002 Location: Virgin Mary's womb Posts: 16,826	and this is why i love and use Opera, www.opera.com __________________ Often times I wonder why There's love and hate, theres live or die. When sickness comes I must decide: When feelings go, theres suicide.

06-09-2004, 10:39 AM	#25
HarryHo Confirmed User Join Date: Sep 2001 Location: South Of Heaven Posts: 100	jESUS CHRIST all the idiots respond again HELLO MORONS . NETSCAPE HAS NO SECURITY FIRECHEESE/OPERA HAS NO SECURITY and isn't even functional I will tell you the difference between your cheesy fucked up browsers and i.e. Internet explorer runs updates regularly to patch holes. This hole isnt new , i have been using it for months. Firefox and netscape are the swiss cheese of the browser industry. I.e. is the whipping post for the browser industry. Anyone who is a webmaster and tells you they dont use i.e. is full of shit or very very poor. They may not use it very often , but if they dont use it they don't know what everyone else is seeing.. Suprise Suprise nobody like i.e. , but its better than your browser BTW the same holes exist as the holes explained in the article in both opera and netscape, they just don't report them because they don't plan on patching them. __________________ I sale Cheap organs

06-09-2004, 10:39 AM	#26
Theo HAL 9000 Industry Role: Join Date: May 2001 Posts: 34,515	someone send this thread to Hooper

06-09-2004, 10:42 AM	#27
HarryHo Confirmed User Join Date: Sep 2001 Location: South Of Heaven Posts: 100	btw if anyone wants to see a sample of this security hole i would be glad to show you how it works.. __________________ I sale Cheap organs

06-09-2004, 11:02 AM	#36
Manowar jellyfish Join Date: Dec 2003 Posts: 71,528	Firefox, its whats for breakfast

06-09-2004, 11:09 AM	#42
goBigtime Confirmed User Join Date: Nov 2002 Posts: 7,761	Not that I rely on online browser based security tests to tell me if I'm "secure" or not, ...but for shits & giggles, here are my results from: http://bcheck.scanit.be/bcheck Browser Security Test Results Dear Customer, The Browser Security Test is finished. Please find the results below: High Risk Vulnerabilities 0 Medium Risk Vulnerabilities 0 Low Risk Vulnerabilities 0 FireFox here. Last edited by goBigtime; 06-09-2004 at 11:10 AM..

06-09-2004, 12:46 PM	#44
goBigtime Confirmed User Join Date: Nov 2002 Posts: 7,761	bump

06-09-2004, 01:02 PM	#45
winter Confirmed User Industry Role: Join Date: May 2001 Posts: 570	I.E. 6.0, Googlebar, and norton internet security. SUCK IT OPERA/NUTSCRAPE BITCHES The Browser Security Test is finished. Please find the results below: High Risk Vulnerabilities 0 Medium Risk Vulnerabilities 0 Low Risk Vulnerabilities 0

06-09-2004, 01:22 PM	#48
cluck Confirmed User Join Date: Dec 2002 Location: New Jersey Posts: 5,248	It's not new. Sorry. __________________ icq 279990726 www.mcdonalds.com <- great money making opportunity

06-09-2004, 01:29 PM	#49
Elli Reach for those stars! Industry Role: Join Date: Apr 2003 Location: Vancouver, BC Posts: 17,991	Just for fun I turned off ZoneAlarm and ran only mozilla 1.6. And this is what I got: The Browser Security Test is finished. Please find the results below: High Risk Vulnerabilities 0 Medium Risk Vulnerabilities 0 Low Risk Vulnerabilities 0 __________________ email: [email protected]

06-09-2004, 03:34 PM	#50
Diligent Confirmed User Join Date: Aug 2003 Location: Hoy Suecia, mañana Nirvana Posts: 1,594	With Firefox, the only crap I may have to put up with is JS window-resizing.. HarryHo seems quite familiar with the mentioned exploit... Makes You wonder if he isn't making coin on it Also.. he seems to be enough of a moron to believe he can convert us non-IE's back from the safer gear.. __________________ ~¤~ MORE MONEY ~¤~ VOD? XoD! ~¤~ ~¤~ ICQ# 9828 2461 ~¤~