*Advice* Using IE

With the new (unpatched) IE bugs I thought I might point out the following bugtraq post by Thor Larholm of PivX.
(I am aware that many AO members read bugtraq themselves, I still want to point it out for those who don't)
Thor Larholm is a senior security researcher at PivX Solutions.
Excerpt from post

Quote:

---

When I attended the NTBugtraq Retreat earlier this year, most of the
attendees were surprised to hear that I am using Internet Explorer on a
daily basis, particularly since I should know how vulnerable it can be
at any given time. I surf with JavaScript and ActiveX enabled, see flash
movies and play Java games, but despite this I am not vulnerable [0] to
a single command execution vulnerability or system compromise through
Internet Explorer.

---

Read the whole article and find out why he is not vulnarable ()
Comments on 5 IE vulnerabilities

It's an advertisement....

^ hehe, i'd tend to agree :p

*hugs my mozilla firebird build*

Good call groovicus. It seems to me to push that application and promote the group (web site) he is a part of, and to give little or no useful information.

Well, well well,

I have to click on open now?......................I don't think so :rolleyes:

I have downloaded the file.....maybe have a look at what it is up to, tomorrow.

I have a feeling that this might be worse than it looks? if I want to test a product, I expect to be able to download it, sort my system out and then install it......there is very little I would accept as a straight install off the net :p

Hell it isn't Micro$oft or your AV/firewall supplier is it?

I think that I will just go back to trolling prOn sites :D it might be safer?

Cheers, good calls all round IMHO

Quote:

---

It's an advertisement....

---

FYI, Thor Larholm is the one that maintained the Unpatched Internet Explorer Bugs,
It was on the PivX site. (http://www.pivx.com/larholm/unpatched/) but no longetr maintained.
There are some people that have continued it but I have no URL at hand.
Dig the bugtraq archives, its there somewhere ;)
The article I linked to was a bugtraq post about how to lock down your IE and still be able to view active content, flash etc.
This is done by locking down the local computer zone (which cannot be done by the normal 'zones' setting', but has to be done trough registry hacks)
It also links you to the microsoft site with the appropriate information.

Quote:

---

Good call groovicus. It seems to me to push that application and promote the group (web site) he is a part of, and to give little or no useful information.

---

I thought this was a security-site, if you never heard of PivX (http://www.pivx.com) you obviously have not been around ;)

It said simply that you could secure your browser by locking down your local computer zone, it doesn't say how... and the first link afterwards is for software...and it wouldn't be the first thing I have gotten from Bugtraq that was spam...

I know how to build houses, so I tell you that you need lumber, and nails, and a few other things. But that's not telling you how to build a house. You have to buy my book....:D

It also links to the micosoft site that does explain how to lock it down.

Quote:

---

NOTE: My Computer does not appear in the Zone box on the Security tab.

Each of these keys contains the following DWORD values that represent corresponding settings on the custom Security tab:

NOTE: Unless stated otherwise, each DWORD value is equal to zero, one, or three. A setting of zero typically sets a specific action as being permitted, a setting of one causes a prompt to appear, and a setting of three prohibits the specific action.

Value Setting
-----------------------------------------------------------------------
1001 Download signed ActiveX controls
1004 Download unsigned ActiveX controls
1200 Run ActiveX controls and plug-ins
1201 Initialize and script ActiveX controls not marked as safe
1206 Scripting of WebOC
1400 Active scripting
1402 Scripting of Java applets
1405 Script ActiveX controls marked as safe for scripting
1406 Access data sources across domains
1407 Allow paste operations via script
1601 Submit non-encrypted form data
1604 Font download
1605 Unknown
1606 User Data persistence
1607 Navigate sub-frames across different domains
1608 Allow META REFRESH *
1609 Display mixed content *
1800 Installation of desktop items
1802 Drag and drop or copy and paste of files
1803 File Download
1804 Launching programs and files in an IFRAME
1805 Unknown
1806 Launching applications and unsafe files
1A00 Logon
1A02 Allow persistent cookies that are stored on your computer
1A03 Allow per-session cookies (not stored)
1A04 Don't prompt for client certificate selection when no
certificates or only one certificate exists *
1A05 Allow 3rd party persistent cookies *
1A06 Allow 3rd party session cookies *
1A10 Privacy Settings *
1E05 Software channel permissions
1C00 Java permissions
{AEBA21FA-782A-4A90-978D-B72164C80120} First Party Cookie *
{A8A88C49-5EB2-4990-A1A2-0876022C854F} Third Party Cookie *

* indicates an Internet Explorer 6 or later setting

---

In my opinion any software that requires you to open directly from the net and install requires you to click cancel, if you have a brain.

NOT PROFESSIONAL...............period!!!!!!!!!! sorry ................................................ :) [NOT!]


Why should I even bother to make Microsoft stuff work...................just delete/uninstall and use Opera or whatever.

As for promiscuous browsing......well if he is happy...good luck to him...he will get that which arrogance desrerves :D

I guess I might even e-mail Macrohard's technical support for an opinion?

I really love these Ali1 types don't you all?

Cheers

Thor Larholm has worked with MicroSoft in at least one patch for IE (I really am surprised you never heard of him)

Quote:

---

Acknowledgments

Microsoft thanks David Litchfield of Next Generation Security Software Ltd. and Thor Larholm, Security Researcher, PivX Solutions, LLC (http://www.pivx.com) for reporting the Buffer Overrun in HTML Help ActiveX Control to us and working with us to protect customers.

---

http://www.microsoft.com/technet/tre...n/MS02-055.asp
Perhaps that is where the

Quote:

---

It's an advertisement....

---

steps back in to the discussion ;)
But I dont feel the post is an advertisment to the QwikFix, it has two more links in it.
It gives you enough information to do it by hand.
I agree that you should prevent installing software from untrusted company.

Quote:

---

Why should I even bother to make Microsoft stuff work

---

Unless you pWn a pirated version, you paid enough for it to use it.

Quote:

---

just delete/uninstall and use Opera or whatever.

---

That is a quick and dirty way of dealing with a problem ;)

lol..I don't think anyone anywhere said we never heard of him.... but that's really beside the point. I really didn't think this post would still be going...

When I read it, it reminded me of a "non-tutorial" tutorial. Granted, there are other links, but the first one is a tool....which isn't mentioned anywhere, and it's the only tool listed.... thats why it seemed like an advertisement..

I didn't even go through it as far as nihil did...and I agree with him. It's unprofessional.

I think he should either fire his publicist, or hire one...:D

Quote:

---

it reminded me of a "non-tutorial" tutorial

---

It is not meant as a tutorial, it sort of a 'keep your mind on your lessons' post to bugtraq some time ago.
Anyone with the skillz can fix it by hand and does not need the tool like you dont need gibsons 'quickfix' ;)..
By reading the replies, I connected two dots and figured nihil has not heard of him.
He post in a professional manner to bugtraq and works with vendors finding and fixing bugs.
He maintained the 'well-known' unpatched ie bugs list with all PoC's for the bugs.
You should lookup some of his posts to bugtraq/fd ;)

"That is a quick and dirty way of dealing with a problem"

no, its just plain using a better product (personally i don't care for opera but it is heads above ie in many ways)

Completly uninstalling IE is not possible since its too intergrated with the OS (that's where these damned bugs originate in the first place ;) ).
Also using a third party program is not always an option.
Furthermore I think if you follow the other two links (besides the one to the prog) you will find a good amount of information regarding your system.
I agree with you and nihil that if you have the option to install and use a third party browser you should (even though Opera appears on bt/fd quite frequently ;) )
Note that with most (?) third party browsers you cannot for example visit windowsupdate.
If you want a real cheap way of dealing with this bug, then dont use Microsoft. You will have some other bugs to worry about though.