Gloomy forecast for MyDoom fallout

TalkBack 34 of 77:

Next »

« Previous

• Thread View
• Flat View

Good idea! I'd take it a step further...

Anyone idiotic enough to get on the Web using Internet Explorer on Windows ought to be permanently banned from ever touching a computer again:

http://die.leox.com/ie_unpatched/index.html

And Microsoft oughta have their *sses sued Seven Ways to Sunday, as the very nastiest of these exploits involve ActiveX/ActiveScripting nonsense and security people have been b*tching at them to remove this functionality from IE since 1997. Now, there's security for you: Microsoft has known that ActiveScripting is infinitely exploitable for at least 6 years. Yet, they refuse to make the clean cure and possibly damage their bottom line. The Triumph of the Beancounters. Congratulations: Hungarian crackers just broke into your network thanks to the Accounting Department at Microsoft. The tragedy is that probably a sizeable percentage of the businesses here in the U.S. who've been exploited don't even realize it yet.

I'm dead serious about this: Internet Explorer is the greatest threat to U.S. corporate and U.S. national data security that has ever existed in the history of computing. It's nothing but a cracker's toolkit disguised as a Web browser. Go back and look at those coding samples on that exploit page--a ten-year-old could come up with a new crack just by using the same old techniques floating around since 1996 in new ways. Even an MSCE could do it.

The FCC (Federal Communications Commission, the folks who here in the U.S. regulate Internet and telephony issues, among other things) won't let you file reports through the submission forms area of their Website using IE. At least they wouldn't as recently as 18 months ago (last time I inquired about it), according to a client of mine who's in the telephony business. That ought to tell you all you need to know.

Oh...don't worry about having to click on an '.exe' attachment to get your virus. No need for something that crude. We'll just take a more elegant approach, like embedding executable code in an array in VBScript (ActiveScripting, again) loaded via HTML, which will then run in your Outlook/Outlook Express/Internet Explorer without you needing to do anything (nor being able to do anything, for that matter). Browse on down to "Self-Executing HTML Part III" and have fun. The only thing you can do to prevent this is to disable ActiveScripting completely. But then...guess what? Windows won't be able to do automatic updates over the Web and all those wonderful Websites coded-only-for-IE with all the bells and whistles won't work properly. Just thank the folks down in Accounting.

And, lastly:

http://www.megasecurity.org/Exploits/Outlook2002_JavaScript_HTML_email.txt

Do try to have a pleasant day now, won't you?

Posted by: Yen_z   Posted on: 01/27/04 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Building the Virtualized Enterprise with VMware Iinfrastructure VMware VMware virtualization software has been adopted by over 120,000 enterprise ... Download Now
• Three Steps You Need to Know to Stop Data Loss Varonis Sensitive data exposed to misuse or loss... it is the stuff of nightmares ... Download Now
• Open Standards Technologies Provide the Ingredients for Delivering Security Across the Papa Gino's Enterprise Dell Papa Gino's Holdings Corporation founded by the entrepreneur operates one ... Download Now