IE security patch nixes some apps

TalkBack 21 of 52:

Next »

« Previous

• Thread View
• Flat View

Didn't fix a damned thing.

The whole point of an exploit involving a user:pass feint in a URL link is to get you to load up an HTML document (other than the one you thought you were loading) containing an ActiveScripting exploit.

Rather than ditching ActiveScripting in IE, they give you a cosmetic fix which ultimately solves nothing: the cracker can lure you to hostile HTML/ActiveScripting through any number of means, not the least of which:

* META-tag URL redirection in a "safe" Web page

* Simply emailing you with the hostile script embedded in the HTML body of an email (remember--this is NOT an attachment, it's in the body of the email itself)

My sister had her Win98 system taken completely down by a hostile Web page in '99 using basically the same HTML/ActiveScripting techniques that are floating around today. The most dangerous critter in the entire ActiveScripting arsenal: VBScript, which apparently runs totally un-sandboxed and which can launch executables and make Remote Procedure Calls at will. Clever crackers can completely disguise executables in a VBScript array (so that your AV proggy and security measures can't detect it) that rebuilds itself "on the fly" as your browser parses the Web page/email body. Voil?! Instant trojan.

A few days ago I located my own copy of a small cracker's utility named "exe2html," which is floating around all over the Web now, if you know where to look. It's purpose? To enable you to take an executable file (your malware), slice it up and stash it into a VBScript array in such a way that you can embed it in your HTML and it will completely slide past any security measures on your victim's Windows system, as long as they're running Outlook/Outlook Express/Internet Explorer.

Here, you can see a whole lot of ways those 17-year-old Chinese freelance crackers and Hungarian Internet extortian gangs can exploit your Web browser/mail client:

http://die.leox.com/ie_unpatched/index.html

I've tested at least one of these on my up-to-date, fully-patched, AV-protected Win2K Pro system hidden behind a router doing NAT (with only essential ports open). It worked like a champ.

Posted by: Yen_z   Posted on: 02/04/04 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Building the Virtualized Enterprise with VMware Iinfrastructure VMware VMware virtualization software has been adopted by over 120,000 enterprise ... Download Now
• Five Steps to Determine When to Virtualize YourServers VMware Server virtualization isn't just for big companies. Entry-level ... Download Now
• File System Auditor Version 2.0.8 ScriptLogic File System Auditor? allows administrators to audit file access, generate ... Download Now