theregister.co.uk and IE = virus

Printable View

November 22nd, 2004, 02:26 PM
phishphreek

theregister.co.uk + IE = virus

Quote:

Bofra exploit hits our ad serving supplier
By Team Register
Published Sunday 21st November 2004 16:18 GMT

Important notice Early on Saturday morning some banner advertising served for The Register by third party ad serving company Falk AG became infected with the Bofra/IFrame exploit. The Register suspended ad serving by this company on discovery of the problem.

Bofra/IFrame is a currently unpatched exploit which affects Internet Explorer 6.0 on all Windows platforms bar Windows XP SP2. If you may have visited The Register between 6am and 12.30pm GMT on Saturday, Nov 20 using any Windows platform bar XP SP2 we strongly advise you to check your machine with up to date anti-virus software, to install SP2 if you are running Windows XP, and to strongly consider running an alternative browser, at least until Microsoft deals with the issue.

We have asked Falk for an explanation and for further details of the incident, and pending this we do not intend to restart ad-serving via the company. Falk will, we understand, be making a statement regarding the matter on Monday.

Although the matter was beyond our direct control, we do not regard it as acceptable for any Register reader to be exposed in this way, and wish to apologise sincerely to anyone who was. Further information about this particular exploit is available here or here . ®

Source
November 22nd, 2004, 11:15 PM
jinxy

I read the report last night phish,
Was to busy seing if i was infected to post. :)

Anyway the following may be of interest as a follow up: http://www.theregister.co.uk/2004/11...frame_exploit/
November 22nd, 2004, 11:20 PM
sysmin770

I have a solution to that problem, run Linux or at least use Windows with a decent browser. I can't believe so many people still use IE after all of the publicized vulnerabilities.
November 22nd, 2004, 11:24 PM
jinxy

Quote:

have a solution to that problem, run Linux or at least use Windows with a decent browser. I can't believe so many people still use IE after all of the publicized vulnerabilities.

So all the bad **** would go away if we all moved to Linux? :rolleyes:
November 23rd, 2004, 12:33 AM
Tiger Shark

Jinxy:

I have to admit, Firefox works...... I don't get anything using it compared to using IE....

However i have to admit that it demands plugins be loaded more regularly than I'd like and when you click on the "Click here to download Plugin" icon you always get "plugin not found". So, whaddya do? You open IE and watch _exactly_ what you wanted to knowing that it was safe in the fist place.....

I think it's called "sacrifice".... ;)
November 23rd, 2004, 01:28 AM
Soda_Popinsky

Quote:

I have a solution to that problem, run Linux or at least use Windows with a decent browser. I can't believe so many people still use IE after all of the publicized vulnerabilities.

Or upgrade to Service Pack 2...? If you didn't after the GDI+ vuln, then maybe you were asking for it.

I use Firefox for the plugins, not because of the inherent security bandwagon that seems to be rollin'. I say this because it seems the local repair shop (and quite a few colleagues) are installing FF on hijack victims and calling it fixed, w/o touching the real problem or upgrading the OS. I agree switching to a less functional browser is a solution, but ignorance of the patching process is worse.

<off topic rant>
Several months ago I get a typical IM from a friend who can't change their homepage. I remove a cool web search hijack among other things. I update the OS, but forget to turn on auto updates. Just a few weeks ago, same deal. I am out of town, and the campus helpdesk advises a format, and the person takes the box to Best Buy, (Geek Squad). They format the box and reinstall the OS, unpatched. This person fails to tell me about the swarm of malware they pick up the next day, and bring it back to Geek Squad. They have to pay again for the cleaning, and pay for an AV as well. Is that unethical or what?
</off topic rant>
November 23rd, 2004, 02:45 AM
chsh

Quote:

Originally posted here by jinxy
So all the bad **** would go away if we all moved to Linux? :rolleyes:

Yep. :D

Quote:

Originally posted here by Tiger Shark
However i have to admit that it demands plugins be loaded more regularly than I'd like and when you click on the "Click here to download Plugin" icon you always get "plugin not found". So, whaddya do? You open IE and watch _exactly_ what you wanted to knowing that it was safe in the fist place..

Are you using FF1.0? I don't have that problem, though I use it primarily on Linux.

Quote:

Originally posted here by Soda_Popinsky Or upgrade to Service Pack 2...? If you didn't after the GDI+ vuln, then maybe you were asking for it.

It's a tradeoff though: fix older vulns and open new ones, or keep the older ones and wait 'til the new ones are fixed?

Quote:

I use Firefox for the plugins, not because of the inherent security bandwagon that seems to be rollin'. I say this because it seems the local repair shop (and quite a few colleagues) are installing FF on hijack victims and calling it fixed, w/o touching the real problem or upgrading the OS. I agree switching to a less functional browser is a solution, but ignorance of the patching process is worse.

Someone needs to slap the local repair shop then. Patching should always be encouraged, but short of mandating automatic updates via local policy (which may be questionable in and of itself), I don't see how you'd go about fixing the problem presented.
If you don't mind my asking, why and to what do you consider FF less functional?
November 23rd, 2004, 02:54 AM
Soda_Popinsky

Quote:

It's a tradeoff though: fix older vulns and open new ones, or keep the older ones and wait 'til the new ones are fixed?

There are SP2 vulnerabilities? I don't count the cmd window drag and drop, but other than that, what vulnerabilities? (and I don't count the ones that require social engineering)

Quote:

If you don't mind my asking, why and to what do you consider FF less functional?

No activex. If it were to be exploited, AFAIK it would have to be through it's html or javascript interpreter, and there are many other paths to exploit IE, such as activex or whatever functions it has within the OS (I think there was a help file vulnerability, that sort of thing).

Although one exception, people (like myself) pile on the plugins on top of their FF browser. I wonder how that will effect the security of the browser, by depending on the skills of more obscure, open source extension teams. Any plugins that see the html received and handle it incorrectly can get screwed. I have a web developer toolbar installed right now, when I use functions of it, it must read the HTML of a site. What if you code something that exploits the extension and not the browser? I don't know enough of how FF is developed and if it can prevent this sort of thing from happening (i doubt it), but I believe this can happen in the future.
Good thing it's easy to update all your extensions at once. And yet again, the solution is updating.
November 23rd, 2004, 03:26 AM
jinxy

Quote:

I have to admit, Firefox works

It does indead. (you know exactly where i was comeing from) :p

Quote:

Yep. :D

Bet it would not take long to come back though :D

Infact, i have had more picked up with spybot/adaware, when i have used Firefox. Than when I have used IE service pack 2. Mind you I do tend to go places with Firefox that i would not with IE. Over confidence, "will", i'm sure kick me in the arse one day.
November 23rd, 2004, 04:09 AM
TheSpecialist

When im using XP... sometimes I'll use IE and you know what? I don't get malware at all. Then agian, unlike everyone else on the world wide web now ah'days I actually pay attention to... and yes, unlike most people sometimes I occasionally even give a damn about what happends to my computer. Oh and I don't really see why I need any type of administrative rights just to read the funny pages known as The Reg's articles.

Complaining about browsers is so stupid... you would have to be even more mentally retarded than I am to be infected with malware.
November 23rd, 2004, 04:20 AM
jinxy

Quote:

oh and I don't really see why I need the administrative rights just to read the funny pages on The Register.

Care to expand??.where did that come from?
November 23rd, 2004, 04:48 AM
TheSpecialist

Oh my god DO I REALLY need to explain? In no way do people need to be in a position which would let Joe-Blow idiot user or any randomly automated program do things such as modify registry entries while some dumb ****er reads his or her email & browses a few sites.
November 23rd, 2004, 05:04 AM
secure_lockdown

Quote:

Originally posted here by TheSpecialist
Oh my god DO I REALLY need to explain? In no way do people need to be in a position which would let Joe-Blow idiot user or any randomly automated program do things such as modify registry entries while some dumb ****er reads his or her email & browses a few sites.

you may need to explain that one to me. i don't think i follow.

my beef with this stuff. given all the security problems, malware issues, virus issues, and all that - microsoft should really harden their IE browser. tighten those security settings 'til you can hear it squek under the rope! so what if some web pages stop working properly anymore. to hell with them! there are billions of web sites out there. find one that will work.

when i made the switch to linux & used konquerer - a few sites stopped working. yeah, i used a 2nd machine for a bit. but then i just found another site that did work and stopped going to the one that didn't.
November 23rd, 2004, 05:10 AM
jinxy

Quote:

when i made the switch to linux & used konquerer - a few sites stopped working. yeah, i used a 2nd machine for a bit. but then i just found another site that did work and stopped going to the one that didn't.

Thats all well and good.......................What if your in business and your supplier,"of one of a kind"/buyer/partner, what ever. Is using one of those, "feck it web" sites.
November 23rd, 2004, 05:46 AM
TheSpecialist

Once agian, most windows home users set all accounts to admin, no limits, no policies, nothing... just let the AV and FW do everything. They also don't bother with certian file/sys auditing. Even with that, most wouldn't notice changes in any case. They like to be able to install, modify, delete, & run anything at any time they want. Well... a dishonest & degenerate scumbag such as myself does too.
November 23rd, 2004, 05:53 AM
XTC46

I run IE and dont have problems. I scan for adware/spyware once every two weeks using adaware, spybot, cwshreadder, stinger, and hijackthis and never have more then 10 Items, usually all just cookies.
November 23rd, 2004, 07:09 PM
secure_lockdown

Quote:

Originally posted here by TheSpecialist
Once agian, most windows home users set all accounts to admin, no limits, no policies, nothing... just let the AV and FW do everything. They also don't bother with certian file/sys auditing. Even with that, most wouldn't notice changes in any case. They like to be able to install, modify, delete, & run anything at any time they want. Well... a dishonest & degenerate scumbag such as myself does too.

but lets compare a windows default install process and a lets say a suse linux default install process.

the winxp install process sets up the machine for the user with the user account as superuser/root/administrator account privaledge.

the linux install process actually seperates the two right from the get do. there is a seperation and distiction between your user account and the root account right from the get go. ever for newbies. it instill a sense of security and a habit that there is alwasy an extra process they you have to go through to do things like patch/update/ insatall even run some applications.

maybe if microsoft changed their ways a few more people would start implementing your methodology.
November 23rd, 2004, 07:48 PM
Timmy77

Using non-admin rights works, but it's hard to implement at home. Some applications don't work correctly without the current-user registry settings, and those don't get properly created even if you use the run-as functionality.

Revoking admin rights helps to mitigate the problems, but is much easier to do in a corporate environment (with someone who understands what it means to reduce the privilege levels) than at home.
November 23rd, 2004, 09:02 PM
secure_lockdown

Quote:

Originally posted here by Timmy77
Using non-admin rights works, but it's hard to implement at home. Some applications don't work correctly without the current-user registry settings, and those don't get properly created even if you use the run-as functionality.

Revoking admin rights helps to mitigate the problems, but is much easier to do in a corporate environment (with someone who understands what it means to reduce the privilege levels) than at home.

i agree. i ran into the same issues when trying the admin/user combo on winxp. unless you tweak the living hell out of it - you are asking for a headache and endless support calls.

i don't want to make this into a platform war rant - but my linux setup with regular user account and goto escalated root/superuser privaledges for certain tasks has worked perfectly right out of the box from day one!!!!

i don't understand why a company like microsoft who does have tons of resorces and qualified persons can't look at how open source community do it and dupe the methodology/process involved into getting it to work without the need for endless hours of registry and policy tweaking.