Corporate Web servers infecting visitors' PCs

TalkBack 39 of 143:

Next »

« Previous

• Thread View
• Flat View

so even the MS PR sites are admitting MS has no security!

The researchers believe that online organized crime groups are breaking into Web servers, surreptitiously inserting code that takes advantage of two flaws in Internet Explorer that Microsoft has not yet fixed. Those flaws allow the Web server to install a program that takes control of the user's computer.

Nice, weld in a back door!

The extent of the attacks is unknown, but the security community has seen numerous cases of personal computers infected when the user merely visits a Web site.

How careless, they used that tremendous value we often hear about. And if you don't want this attack vector on your machine, say you manage 20,000 boxes in a major corporation, you have one option, abandon MS. And that was MS's design intent, to force you to accept the cruft or move along to an alternate OS.

The tactic is not new. Earlier this month, an independent security researcher found an aggressive advertising program, known as adware, that installed itself onto a victim's computer via the same two flaws in Internet Explorer. A large financial client called in Symantec in late April after an employee's system had been infected when he used Internet Explorer to browse an infected Web site. Last fall, a similar may attack have been facilitated through a mass intrusion at Interland, said sources familiar with that case.

How many "patches does it take to break the OSes back?

This time, however, the flaws affect every user of Internet Explorer, because Microsoft has not yet released a patch. Moreover, the infectious Web sites are not just those of minor companies inhabiting the backwaters of the Web, but major firms, including some banks, said Brent Houlahan, chief technology officer of NetSec.

Nice, attach your Windows computer to the internet and enable the "Ownz" feature!

The group also pointed out that the malicious program uploaded to a victim's computer is not currently detected as a virus by most antivirus software. With no patch from Microsoft, that leaves Internet Explorer users vulnerable. A representative of the software giant was not immediately available for comment on when a patch might be available.

Well, WHOAH! Now that's one hell of a useful freebie. We all asked for this, temember? The "benefit" test just keeps reaping its rewards!

Researchers believe that attackers seed the Web sites with malicious code by breaking into unsecured servers or by using a previously unknown vulnerability in Microsoft's Web software, Internet Information Server (IIS). When a victim browses the site, the code redirects them to one of two sites, most often to another server in Russia. That server uses the pair of Microsoft Internet Explorer vulnerabilities to upload and execute a remote access Trojan horse, RAT, to the victim's PC. The software records the victim's keystrokes and opens a backdoor in the system's security to allow the attacker to access the computer.

Well, ain't that funny, use the bundled IIS web server, to attack the bundled IE web client, and its all undetectable and unpatchable!

Wonder why?

BECAUSE ITS DESIGN INTENT. ITS MS's VISION ON WORKFLOW AUTOMATION THEY HAVE BEEN CROWING ABOUT FOR YEARS NOW!

"It's a group of people that have resources to bring to play," he said, adding that the attack programs were not amateur material. "The code wasn't pulled off a Web site; it was custom."

Remember when MS was invaded for atleast six monthes before they detected the breaking to the code vault? This is simply folks with inside knowlege using the features MS has always used, its security through obsucity proven to be a joke!

Posted by: oldskool   Posted on: 06/24/04 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• VMware Infrastructure: A Guide to Bottom-Line Benefits VMware Frustrated by the costs of maintain ever larger data centers?or building ... Download Now
• Virtualization: Architectural Considerations And Other Evaluation Criteria VMware Of the many approaches to x86 systems virtualization available in the ... Download Now
• Open Standards Technologies Provide the Ingredients for Delivering Security Across the Papa Gino's Enterprise Dell Papa Gino's Holdings Corporation founded by the entrepreneur operates one ... Download Now