German government warns against using MS Explorer

[mrgoose]

Seems the the warning applies to versions 6, 7 and 8 of Internet Explorer:-

http://news.bbc.co.uk/1/hi/technology/8463516.stm

Apparently the instructions telling hackers how to exploit the security hole are available on the web - but I haven't found them yet. However, the US Department of Homeland Security has published more details of the problem. Seems it is a so-called zero-day exploit and Microsoft does not have a fix for it yet.

https://www.kb.cert.org/vuls/id/492515

Best wishes, G.

[f12f12]

basicly there warning not to use it as the loophole is still open and instructions of how to do it are "all over the web" and currently Microsoft has no fix for it but are working hard to make a patch in the next update due next month. also it is believed that anti virus software can not block the attack because they do not know what it is yet and that it could be changed many times in china, meaning there would be too many versions to block.

[mrgoose]

basicly there warning not to use it as the loophole is still open and instructions of how to do it are "all over the web" and currently Microsoft has no fix for it but are working hard to make a patch in the next update due next month. also it is believed that anti virus software can not block the attack because they do not know what it is yet and that it could be changed many times in china, meaning there would be too many versions to block.

Not surprisingly, MS has tried to play the affair down. Since it is unable to offer a patch, MS has offered a "workaround" instead. Basically it involves putting your browser into what some refer to as "cripple mode" by setting the Internet Zone Security setting to "High". However, the German Authorities say even this won't make it safe. :eek:

Interesting to note that our own Government has remained very quiet on the subject...

Best wishes, G.

[iGoD ReleNtLeS]

There was a lot about this in the early months of 2009, and its been since then i haven't used Internet Explorer. It was on the BBC 10pm news, so quite serious. Firefox and Google Chrome seem to be the favourites amongst people right now, but i dont think the general public see the risk there is and what vital data could be lost.

[snakedoc]

That was patched shortly afterwards.

[mrgoose]

This hole hasn't been patched though. And it is unlikely to be patched for several more weeks, aparently.

Technical issues aside, three things intrigue me about this debacle...


Microsoft security flaws are commonplace. There are so many that they often barely make the news at all. Yet this the first time that a democratically elected national government has directly issued a warning like this against Microsoft. Why?
It seems Internet Explorer it was the main vector of attack against Google. Hackers, suspected (but not proven) to be in the pay of China, used this exploit to obtain information internally from Google, about the location and identity of what China regards as dissidents. How was Google party to such politically sensitive information? And why did some of the supposedly best technical brains in the business do such a bad job of securing it?
Google is one of the biggest users and sponsors of Linux and open source software in the world. It has even sponsored a series of so-called "Summers of Code" to promote and harvest the latest open source software. Google is very aware of the shortcomings of Microsoft products, particularity with regard to security. MS is also its arch-rival. Google has even developed its own browser. So why the heck was Google using Internet Explorer in the first place?

All a bit odd, don't you think?

Best wishes, G.

Some links...


http://www.neurosoftware.ro/programming-blog/facebook-web-design/web-resources/did-chinese-hackers-exploit-internet-explorer-to-attack-google-2/
http://arstechnica.com/security/news/2010/01/researchers-identify-command-servers-behind-google-attack.ars

[jonbanjo]

So why the heck was Google using Internet Explorer in the first place? All a bit odd, don't you think?

I haven't a clue how much it would be used but I'm pretty sure Google would at least need IE for testing web stuff and need Windows for developing applications.

[mrgoose]

Of course, Jon. But why have these Microsoft boxes connected to the same network that contains information that could potentially have people shot? Google should know better, surely?

Best wishes, G

[jonbanjo]

Pass .

[Mungo]

Oh noes! This is blatantly going to go straight into a "Buy a Mac" ad

MS are normally pretty good at getting fixes out quite quickly... But I'm happy with Chrome atm, anyway :rolleye:

[waba]

i was surprised when i read this. there is a conspiracy that google and microsoft are the same company. in fact, they are the same person. but that is just a rumour...
it is a shame that google, a company with supposedly high ethics and ideals, has seemed to make it comparitively easy to access private information. perhaps it was a simple mistake :S

[mrgoose]

I've been doing some more reading. For "simple mistake" read "unforgivable ****up". Seems this could result in dissidents being imprisoned, tortured or even executed for their political beliefs. Perhaps that's why the Germans are so vocal about this fiasco?

Seems I can answer one of my earlier questions with regard to why Google had such sensitive information? It would appear that the hackers were after dissidents' GMail accounts and used flaws in Microsoft Internet Explorer in order to take control of Google's systems. Once they had control, they were able to in order to syphon off any information they wanted. The hackers called the operation "Aurora" apparently.

Of course, as you allude Waba, this raises a whole raft of new questions regarding Google, its deployment of insecure Microsoft products when it should know better, the security (or lack of it) of its GMail system and in my view casts a huge cloud over its entire "cloud computing" project.

All a bit of a muddle, IMHO. Best wishes, G.

[system7]

It's surprising that people and corporations still use that ancient clunky horror known as Internet Explorer 6. It is guaranteed to have me swearing at the screen when forced to use it. Companies have so many old network access programs that they are forced to persist with it.

I'm not sure quite what this exploit is, but it involves being lured to an exploit web page. I remember seeing a webpage that could read the content of your clipboard in an early version of firefox. What you hope is that your firewall will alert you to any new outgoing connections. Comodo is industrial strength at this, but tends to interfere with gaming a lot.

Smart folks may use a Ubuntu CD for secure browsing and online transactions with a credit card. That's what I would do if I wanted to be safe from the oppressive Chinese government. :xgrin:

[Helior]

Wouldn't it be amazing if this spelt the end of internet explorer?! Not gonna happen, but god i hate it so much.

[Superewza]

I like how you tagged this with 'linux' ;)

[Pullen]

I don't really understand all of this, but all i know is that I'm using google chrome, and that's good, so i'm happy :D

[jonbanjo]

Of course this raises a whole raft of new questions regarding Google, its use of insecure MS products when it should know better, the security (or lack of it) of its GMail system and in my view casts a huge cloud over its entire "cloud computing" project.

And to be fair to MS/IE, I'm not sure we could say with any certainty that similar could not have been done if some flaw emerged in Firefox or Google's Chrome.

[Superewza]

That's just it though - Mozilla and Google can program. Microsoft can't.

[system7]

Sans storm center certainly doesn't rate this exploit very highly for savvy users:


The exploit currently affects a version of the product that is two major revisions behind the current release, and should really not be widely used anymore. Easy work arounds are available by utilising other browsers or products, signatures are available from the AV vendors and the patch should be available in the next 3-4 weeks. From an Internet perspective the issue is currently very very low impact.

http://isc.sans.org/

It seems to be a IE6 PC user issue more than a direct attack on Google's servers, but that impacts their reputation of course. More disturbing are reports of widespread industrial espionage using the exploit. Bottom line seems to be that the Chinese government is putting a lot of effort into installing spyware on users PCs.

[jonbanjo]

That's just it though - Mozilla and Google can program. Microsoft can't.

I'm no lover of MS or of Windows but last time I used it, maybe 7-8 years ago, I thought their office suit (proprietary document formats aside) was excellent. I've also tried some of their web development stuff for a look and thought it very nice... As such, I wouldn't go as far as to say they can't.

[mrgoose]

My beef is that if it were just some dumb *******, Joe Punter who got hit, then one could dismiss it as not being that serious. But were talking about Google - a company with access to huge chunks of our information and run by allegedly some of the best brains in the business! IE attached to the system that runs GMail? What were they thinking exactly?

And the worst thing of all is that, people can, and probably will die as a result. Also, according to some sources, its not just IE 6. All recent versions are affected according to the German Government's security team.

Best wishes, G.

[Superewza]

Okay, the can. But they certainly can't to the level of their competitors, it's just that they own such a large section of the market they can be as lazy and lax as they want, and people will still buy it.

[system7]

I haven't seen anything that suggests that Google's servers were directly attacked. But Google has clearly decided it can't do business with the Chinese government that is putting huge effort into monitoring, restricting search engine results, and writing malware for its people's internet usage.

In fact, the UK authorities do similar stuff in the cause of tracking down terrorists and paedophiles. You should regard your phone calls, texts and internet usage as being monitored. That's the fact of it. :(

Google's reputation for privacy is an important part of its business model. Trust is vital.

[mrgoose]

Today's Guardian:-
http://www.guardian.co.uk/technology/2010/jan/15/microsoft-china-google

Seems Google's Chinese servers were directly attacked. Of course, we don't know how deep these attacks have gone and no one has actually proven it was the Chinese behind the attacks either. After all, the United States has a long and sad history of creating "bogeymen" to act as scapegoats for all evils of the world.

But as you rightly say 7, "Trust is vital". And it seems to me that the two biggest players, MS & Google are no longer trustworthy.

Best wishes, G

[system7]

Microsoft confirmed the existence of the loophole after an investigation by internet security firm McAfee and information from Google and Adobe.

"As with most targeted attacks, the intruders gained access to an organisation by sending a tailored attack to one or a few targeted individuals," said George Kurtz, McAfee's chief technology officer, adding that the hackers would then use the Internet Explorer bug to infect the victim's computer.

"Once the malware is downloaded and installed, it opens a back door that allows the attacker to perform reconnaissance and gain complete control over the compromised system. The attacker can now identify high value targets and start to siphon off valuable data from the company."....

The Chinese government yesterday issued its first response to the claims by Google, saying that it was opposed to computer crime and had been the victim of cyberattacks itself in the past. However, the statement, issued by the country's foreign ministry, also contained a veiled threat to other companies who may be considering following Google's stand.

"China has tried creating a favorable environment for internet," said a spokeswoman. "China welcomes international internet companies to conduct business within the country according to law. China's law prohibits cyber crimes, including hacker attacks."

They're not denying it then...:rolleye:

[Vigoro]

*See thread starter and microsoft, walks out*

[mrgoose]

They're not denying it then...:rolleye:
Indeed. In fact there is quite a detailed advisory on the MS site:-
http://www.microsoft.com/technet/security/advisory/979352.mspx

Best wishes, G.

[Helior]

Okay, the can. But they certainly can't to the level of their competitors, it's just that they own such a large section of the market they can be as lazy and lax as they want, and people will still buy it.

This is ridiculous.

[iGoD ReleNtLeS]

I like the way ALL of MS' software is affected but Internet Explorer 5.01 Service Pack 4 for Microsoft Windows 2000 Service Pack 4. The next Laptop i buy is going back down the shop to have Windows Removed and my License refunded. Permanent swap to Linux i think. Would do it for my desktop but then it puts the hardware to waste and a very limited amount of software that can be used, But is very good for a laptop if its used for general browsing and office docs.

[system7]

I like the way ALL of MS' software is affected but Internet Explorer 5.01 Service Pack 4 for Microsoft Windows 2000 Service Pack 4. The next Laptop i buy is going back down the shop to have Windows Removed and my License refunded. Permanent swap to Linux i think. Would do it for my desktop but then it puts the hardware to waste and a very limited amount of software that can be used, But is very good for a laptop if its used for general browsing and office docs.

Bit extreme, isn't it? What's stopping you using Firefox. I do. :cool:

http://www.mozilla-europe.org/en/firefox/

There are always security vulnerabilities. You just use what suits you and makes you feel secure.

[chrisjb]

I heard that a iranian cyber team took china's most popular search engine off line. Its unbelivable what these hackers can do.

[iGoD ReleNtLeS]

well this has only played a little part in persuading me to move to linux, but been wanting to do it for a while, ever since i put Ubuntu on my laptop i've put it on all the laptops in the house on dual boot with Windows 7 and all my family chooses Ubuntu over windows now, and they very rarely use windows. Dont particularly see the point in wasting £60 on an OEM license that isnt going to be used.

[chrisjb]

I dont know why microsoft dont move over to the unix code for their next os. Its so much more secure,

[mrgoose]

Roll on Windix! Actually that would be an interesting possibility. MS could give Codeweavers (http://www.codeweavers.com) the API source code for the "old NT-based Windows" and pay it to develop a really good WINE layer for legacy apps, much as Apple did with Mac Classic & OSX.

Of course Unix is not new to MS. One of its first ever OS's, Xenix (http://en.wikipedia.org/wiki/Xenix), was in fact a scaled down 16-bit Unix borrowed under license from AT&T.

Still, I don't suppose it will happen anytime soon though! LOL!

Best wishes, G.

[Vigoro]

I dont know why microsoft dont move over to the unix code for their next os. Its so much more secure,


As soon as they do it won't be secure.

Microsofts operating systems have flaws in security because it is the most used operating system developer in the world, so if people want to send out viruses to get things they will do it on windows and wont bother as much with other platforms.

[waba]

As soon as they do it won't be secure.

Microsofts operating systems have flaws in security because it is the most used operating system developer in the world, so if people want to send out viruses to get things they will do it on windows and wont bother as much with other platforms.

is this necessarily true? If linux was the most popular OS, instead of MS, do you think there would be as many viruses around for linux as there are for MS at the moment?

[jonbanjo]

Microsofts operating systems have flaws in security because it is the most used operating system developer in the world, so if people want to send out viruses to get things they will do it on windows and wont bother as much with other platforms.

No. Microsoft's (as with any other OS) operating systems have flaws because of failures in design and programming. The flaws are not user generated.

What the security effects of say Linux becoming the most popular OS in the world would be as far as I'm concerned, remains untested and is speculation. My personal belief is that Linux is generally more robust but by no means foolproof.

[Vigoro]

is this necessarily true? If linux was the most popular OS, instead of MS, do you think there would be as many viruses around for linux as there are for MS at the moment?


Yes i do think there will be. The people who are after what they are after will target the most popular os as they are more likely to get a hit on it and get what they need.

[system7]

As soon as they do it won't be secure.

Microsofts operating systems have flaws in security because it is the most used operating system developer in the world, so if people want to send out viruses to get things they will do it on windows and wont bother as much with other platforms.

That's not really the reason though. The flaw in Windows is that it runs in admin mode for most people. That allows malware to install almost unrestrictedly. Linux requires a password authorisation for changes.

[waba]

Roll on Windix! Actually that would be an interesting possibility. MS could give Codeweavers (http://www.codeweavers.com) the API source code for the "old NT-based Windows" and pay it to develop a really good WINE layer for legacy apps, much as Apple did with Mac Classic & OSX.



This is the first time iv seen codeweavers - do MS provide them with any sourcecode? the reason im interested is because i ONLY use windows for games, which barely work on Wine, but if programs out there exist so that i dont need to game on windows, im interested...


That's not really the reason though. The flaw in Windows is that it runs in admin mode for most people. That allows malware to install almost unrestrictedly. Linux requires a password authorisation for changes.

is this the only reason that Linux is more secure? Surely somehow if this is the case, a virus could login somehow as admin to authorise changes?

[Superewza]

I dont know why microsoft dont move over to the unix code for their next os. Its so much more secure,

Because it wouldn't sell? Who would willingly pay for something when the better alternatives (which lets face it, they would be) are completely free?

[Helior]

I think that there are some systemic problems with windows, and linux is certainly more robust, but the intense scrutiny from hackers doesn't help. I'm quite sure that Linux would have a lot more issues than it does, if it were in windows position as market leader.

[Superewza]

Yes, but far less than Windows does. Unix was built for security, it's got it coded into every line. Programming viruses for it is like trying to get a worm to go through a brick wall. Wheras with MS's NT kernel it's just an afterthough, slapped on at the application end of things.

[Vigoro]

Yes, but far less than Windows does. Unix was built for security, it's got it coded into every line. Programming viruses for it is like trying to get a worm to go through a brick wall. Wheras with MS's NT kernel it's just an afterthough, slapped on at the application end of things.


Open source code + hackers = sercure?

Nah dont think so, they will work it out quickly ;)

[jonbanjo]

Surely somehow if this is the case, a virus could login somehow as admin to authorise changes?

I don't know how with that, but a user with root's password could be tricked into authorising a script to do anything.

One good thing in this area is that most of us rarely need to download and install much outside of our distributions. If you need to find something to do some task, it's probably in there rather than on some dubious site.

[jonbanjo]

Open source code + hackers = sercure?

Nah dont think so, they will work it out quickly ;)

There are arguments both ways. The pro open source viewpoint is that more eyes on the code means that loopholes are spotted and therefore fixed more quickly. They might also comment that closed source does not appear to be an obstacle to hackers.

[thehitmen]

Interesting read that was...

Waiting to seem Gearman google chrome adverts now!

[mrgoose]

is this necessarily true? If linux was the most popular OS, instead of MS, do you think there would be as many viruses around for linux as there are for MS at the moment?


This is the first time iv seen codeweavers - do MS provide them with any sourcecode? the reason im interested is because i ONLY use windows for games, which barely work on Wine, but if programs out there exist so that i dont need to game on windows, im interested...

Interesting questions Waba. From the top...

The "it's only because its so popular" argument is a gross over-simplification. MS currently enjoys dominance only on the desk|laptop, not in the server or web-server market. If it were a popularity issue, then why aren't all these Unix-like servers being hacked to pieces? Come to think of it, why aren't all those Linux- or BSD-powered NAS boxes, routers, industrial computers and set-top boxes etc. all riddled with viruses? Popularity is only part of the equation. Lack of diversity is another factor. Perhaps the fact that MS products are relatively easy to hack is another? And the fact that MS takes so long produce patches could be another? (E.g. 7 years to patch SMB (http://news.cnet.com/8301-1009_3-10096611-83.html))

There is fierce competition amongst hackers. Whilst popularity of Unix-like OS's on the desktop is a fraction of Windows', there are still around 30 million Linux|BSD boxes ripe for a good hack. Yet very few have been hacked. Why not? Moreover, compromised Unix-like boxes (yes there are some) are highly prized for use in botnets because they act as "generals" - controlling tens of thousands of Windows "grunts":-
http://www.computerworld.com.au/article/206776/linux_generals_command_windows_grunts_botnet_battl efield/?fp=2&fpid=1

Seems even MS is aware its OS's are not as secure as perhaps they should be. In April last year it delivered a special "secure" version of XP specially for the US Air Force. Unfortunately, according to Wired magazine, the poor old punter doesn't get a look-in:-
http://www.wired.com/threatlevel/2009/04/air-force-windows/

Then there's the US Army and what is dubbed "the biggest penguin migration of all time". It's dumping Windows as part of its $200 billion weapons upgrade - despite the logistical and compatibility problems this poses. Seems Uncle Sam has lost faith in his own corporations and wants to access and edit his source code himself:-
http://www.theregister.co.uk/2008/02/05/us_army_linux_integration/

Of course, Linux systems can be hacked and Penguinistas must always avoid complacency. E.g. avoid weak passwords, apply security patches regularly, be very careful what software you install etc. (Though as Jon observes, installing from your distro's repository is actually a very safe way of getting new software.)

WRT WINE/Crossover I understand that MS has offered no cooperation whatsoever. This means it is mostly reverse-engineered. Therefore it suffers some limitations. Nevertheless, there is a special version specifically aimed at gamers you may want to flirt with:-
http://www.codeweavers.com/products/cxgames/

If you do give it a whirl, then I'd be interested what you think of it.

Finally, back on topic if, I may. Here are some places of interest for anyone following this story. According to Deutsche Welle, it was malware installed on the users' machines, not on Google's machines that allowed user accounts to be accessed. Meantime, Chinese activists & internet fans are begging Google not to pull out of China:-
http://www.dw-world.de/dw/article/0,,5127865,00.html

The US State Department is making a formal complaint to the Chinese Authorities about the alleged hacking:-
http://news.bbc.co.uk/1/hi/world/asia-pacific/8462889.stm

And Microsoft confirms that its Internet Explorer was to blame:-
http://news.bbc.co.uk/1/hi/technology/8460819.stm

Best wishes, G.

[Vigoro]

If you know what you are doing with windows you are unlikley to have troubles aswell. Security is mainly a flaw of the users, normally access dodgy sites

[Manboobs]

Hmm interesting.

Just to be safe


http://img192.imageshack.us/img192/7319/1260893386tinfoilhat.jpg (http://img192.imageshack.us/i/1260893386tinfoilhat.jpg/)

[waba]

If you know what you are doing with windows you are unlikley to have troubles aswell. Security is mainly a flaw of the users, normally access dodgy sites

iv only used vista a couple of times - the main windows version i use is XP - but i noticed that vista (and im guessing W7) has that user authentication thing when you try and install anything, i.e the screen dims and it asks if you want to install whatever. Isn't this the same as the linux system asking for administration priviledges then? or is it the fact that you HAVE to enter the password for linux that adds to the security?

[snakedoc]

iv only used vista a couple of times - the main windows version i use is XP - but i noticed that vista (and im guessing W7) has that user authentication thing when you try and install anything, i.e the screen dims and it asks if you want to install whatever. Isn't this the same as the linux system asking for administration priviledges then? or is it the fact that you HAVE to enter the password for linux that adds to the security?

Indeed, they call it UAC. The trouble is when people foolishly search for things they really should not and end up on a site they also should not be on.

At the end of the day, a little web and common sense and you can easily avoid such things. Why, I have not had a computer virus in 15 years.

[Mungo]

I have never had one :D

Only time when i broke my pc was when i tried to install a program on Vista designed for XP... that didn't go down well :rolleye:

[snakedoc]

Well, this virus was supplied to me on a floppy disk with a dos game. It was an odd thing, embedded itself in the mobo. Easy to get rid it was IIRC. twas a long time ago.

[mrgoose]

Microsoft has tried to copy the Unix security model to some extent and I agree that a little common sense can go a long way towards self-protection.

However, the notion that getting infected simply by visiting a "dodgy site" is somehow the user's fault is crazy. How does the user know it's a dodgy site exactly? A lot of perfectly respectable sites get hacked and are then used by hackers to deliver malware to hapless Windows users.

A competent modern operating system and browser should not allow users to get infected by simply visiting a site.

Best wishes, G.

[Vigoro]

Microsoft has tried to copy the Unix security model to some extent and I agree that a little common sense can go a long way towards self-protection.

However, the notion that getting infected simply by visiting a "dodgy site" is somehow the user's fault is crazy. How does the user know it's a dodgy site exactly? A lot of perfectly respectable sites get hacked and are then used by hackers to deliver malware to hapless Windows users.

A competent modern operating system and browser should not allow users to get infected by simply visiting a site.

Best wishes, G.

Linux isnt the way forward anyway, too complicated for the average user imo

And mac is more overpriced that windows, so windows is best for normal users

[snakedoc]

Indeed, Microsoft has tried to copy the Unix security model to some extent and I agree that a little common sense can go a long way towards self-protection.

However, the notion that getting infected simply by visiting a "dodgy site" is somehow the user's fault is crazy. How does the user know it's a dodgy site exactly? A lot of perfectly respectable sites get hacked and are then used by hackers to deliver malware to hapless Windows users.

A competent modern operating system and browser should not allow users to get infected by simply visiting a site. Period.

Best wishes, G.

I think one knows when one goes to a dodgy site lol.

As I said, not been infected of 15 years and never via a browser. So really saying a site can be hacked while technically correct, in reality, is fairly remote.

It is a shame that "talented" individuals spent their time coding such nasty programs and the world would be a better place without. Such is life.

[mrgoose]

I think one knows when one goes to a dodgy site lol.

As I said, not been infected of 15 years and never via a browser. So really saying a site can be hacked while technically correct, in reality, is fairly remote.

You are a skilled, experienced, net-savvy, technical support guy. But what of the great unwashed?

Here is a perfectly legitimate UK site that was defaced by Islamic hackers at 15:45 this afternoon. I use this as an example because it has no malware (as far as I can tell) and no ****. But if you are curious, then you might want to use a Mac or Linux box or a LiveCD just to be safe. I removed the underlying link just in case someone with an insecure browser clicks on it by mistake:-


http://stokesportsvision.co.uk/

Plenty, plenty more where that came from. Again discretion is advised:-


http://www.zone-h.org/archive/special=1

Most get hacked due to badly written | un-patched scripts of course, nothing to with OS or webserver. Others get "dodgy" content dropped into forum posts, as happened here on NT forums only very recently.

Point is how would anyone know in advance that the Stoke Sports Vision site had been hacked until they actually went there?

Best wishes, G.

[waba]

hehe i followed that link goose, and it leads you to a moderate muslim website, talking about love for your neighbour - made me smile as you often associate hacking with something malicious! with regards to linux being complicated, of course there is a learning curve when you start using it, but no more than when you start using windows for the first time, I find. it can be difficult to stay away from dodgy sites - the last time i got a virus was about 5 years ago, when i was looking for a codec to play my dvds properly... :S

[mrgoose]

hehe i followed that link goose, and it leads you to a moderate muslim website, talking about love for your neighbour - made me smile as you often associate hacking with something malicious! with regards to linux being complicated, of course there is a learning curve when you start using it, but no more than when you start using windows for the first time, I find. it can be difficult to stay away from dodgy sites - the last time i got a virus was about 5 years ago, when i was looking for a codec to play my dvds properly... :S
WRT using Linux: Very well put. Irony is that every single user of this site is a Linux user, albeit indirectly:-
http://uptime.netcraft.com/up/graph?site=novatech.co.uk&probe=1 :xsmile:

WRT the hacked site: Yeah, I tried to chose a relatively mild one so that no one would be offended, or get hurt. Though I agree that the nature of the target site was somewhat ironic under the circumstances! Still, I bet you didn't go there with IE, did you? lol!:D

Best wishes, G.

[waba]

novatech is linuxy :O

[mrgoose]

Yup, penguin-powered and fully of Unixy goodness, as we say! lol.

Back to the Google/IE thing for a moment, I Just stumbled upon a very thought-provoking comment on one of cNet's forums:-

"Sources familiar with the attack code say the attacks are similar to previous attacks on U.S. corporations that were linked to the Chinese government or proxies operating for the government."

Or anyone who wants it to look like the Chinese government has hacked Google.cn (particularly U.S Intelligence), because:

"Secretary Clinton is expected to deliver "a major policy address on Internet freedom" next Thursday in Washington, D.C., which could be the setting for the introduction of a more comprehensive government policy on cyberattacks and censorship."

http://news.cnet.com/8301-27080_3-10436083-245.html?tag=mncol;posts

Possibly a tad paranoid? But then is hard to know who to trust these days, isn't it? :confused:

Best wishes, G.

[Seanbond]

I dont use IE anyway, Firefox FTW!

[mrgoose]

I dont use IE anyway, Firefox FTW!
You and about 25% and rising, according to hitslink.com (http://marketshare.hitslink.com/report.aspx?qprid=0). Interesting to see what the figures look like in a couple of weeks, don't you think? :D


http://marketshare.hitslink.com/chartfx62/temp/CFT0117_0426101F6FA.png (http://marketshare.hitslink.com/report.aspx?qprid=0)


Best wishes, G

[Superewza]

Hmm, so 1/3 of all people with access to the internet have an ounce of common sense. It's a start i suppose :p

[mrgoose]

Hmm, so 1/3 of all people with access to the internet have an ounce of common sense. It's a start i suppose :p
lol :D 37% and some reckon this latest debacle will nudge it quite a bit higher! Best wishes, G.

Edit: the W3Schools stats make interesting reading, if you like that sort of thing. Granted, its clientèle is likely to favour standards-based browsers. Nevertheless, it shows IE's combined share to be less than 40%:-
http://www.w3schools.com/browsers/browsers_stats.asp

[jonbanjo]

I see France has issued a warning too: http://news.bbc.co.uk/1/hi/technology/8465038.stm

[Mr. Lime]

I use chrome :D google ftw :D

[mrgoose]

I see France has issued a warning too: http://news.bbc.co.uk/1/hi/technology/8465038.stm
Yes, I saw that Jon. I just been struggling to translate the CERTA advisory. Seems my "schoolboy French" is even worse than I thought, lol:- http://www.certa.ssi.gouv.fr/site/CERTA-2010-ALE-001/index.html

Did you watch the Cliff Evans interview on the BBC page? Do you think he actually believes what he is saying?

Best wishes, G.

[jonbanjo]

Did you watch the Cliff Evans interview on the BBC page? Do you think he actually believes what he is saying?

Just watched it and I'm not sure...

I'm also unsure about the type of message he seemed (perhaps) to me to be giving out. I was thinking about the same with AV software the other day... I'm not sure the sort of I can visit where I like and browser will always save me/install what Ilike and if it's bad, the AV will protect me feeling that some might have is a good one.

[mrgoose]

Just watched it and I'm not sure...
I was thinking about the same with AV software the other day... I'm not sure the sort of I can visit where I like and browser will always save me/install what Ilike and if it's bad, the AV will protect me feeling that some might have is a good one.

Hmm, I'm afraid you lost me a little, Jon. lol

I thought you folks might be interested to see this. It shows a video of the Aurora attack, in-action, together with quite a good analysis of how it actually works and what is likely to happen next:-
http://praetorianprefect.com/archives/2010/01/the-aurora-ie-exploit-in-action/

Best wishes,G

[jonbanjo]

Hmm, I'm afraid you lost me a little, Jon. lol

I was just rambling on about how much safer this phishing protection mentioned is, etc. I'm certainly not saying this and AV and Anti spyware protection is a bad thing but I do sometimes ponder whether people do get led in to a false sense of security/over confidence.

I think we would agree that it's unlikely someone would be 15 years virus free by relying solely on a systems own protection.

Hope that explains my ramble a touch more clearly.

[snakedoc]

I think we would agree that it's unlikely someone would be 15 years virus free by relying solely on a systems own protection.



A little common and web sense is required too. I actually did not run AV for a good few years, there was no point. I only put on MS Security recently and do not personnally feel the need for it. I have it because it's free and takes up no resources and does not annoy me.

[mrgoose]

Common sense is an important factor. Security is not a fix & forget thing. Security is something one must engage with on a permanent and ongoing basis.

Whilst I would not denigrate anti-phishing tools, the information they rely on emanates from providers such as Google and may be hours or even days out of date. This is a lifetime in hackingland. So, when someone asks for sensitive personal or financial information, whether this is in the real or the virtual world, the questions one MUST ask, in one form or another are "Who wants to know?" followed by "Prove it!"

Back to the plot. Did either of you guys look at the Praetorian page showing the hack in action? Now all the source code is "out there", is any one taking odds on how long it will be before copycat attacks take place?


http://praetorianprefect.com/archives/2010/01/the-aurora-ie-exploit-in-action/

Best wishes, G.

[mrgoose]

Interesting developments. Turns out that Microsoft actually knew about the Internet Explorer "zero day" security flaw last September. Seems it was in Microsoft Security Response Center’s (MSRC) queue to be fixed in the the next batch of patches in February:-
http://blogs.zdnet.com/security/?p=5324

Embarrassingly for Microsoft, this was revealed around the same time that a Google researcher published the code of an even older NT kernel security flaw that has remained unfixed for a staggering 17 years:-
http://blogs.zdnet.com/security/?p=5307

Interesting to see if there are any law suits or class actions as a result. Best wishes, G

[snakedoc]

http://www.microsoft.com/technet/security/bulletin/ms10-002.mspx

That one?

That's been Patched. Check your Windows Update and make sure you install and reboot.

[mrgoose]

WRT the IE one, yes it looks like MS "rushed" out a patch once the proverbials hit the fan. This relates to:-
http://www.microsoft.com/technet/security/advisory/979352.mspx
and as you rightly say, all IE users should do as you instruct, ASAP. I think I read somewhere (but I cannot lay my hands on it right now) that even if you don't use IE directly, some activeX controls in MS Access etc. are also affected? Is that true?

The point about the IE one is that MS admits actually knew about the exploit four months ago but did nothing. Obviously this does not affect me at all. But I'd imagine that there will be some people in China and elsewhere who will be a tad miffed?

AFAIK the 17 year old NT kernel security flaw remains unpatched and all 32 bit NT-derived Windows desktop versions, including 2000, XP, Vista & Windows 7 are vulnerable.:-
http://www.microsoft.com/technet/security/advisory/979682.mspx
and the only solution for this at the moment is the albeit relatively simple workaround proposed at insecure.org:-
http://seclists.org/fulldisclosure/2010/Jan/341

Best wishes, G.

[snakedoc]

Oh indeed Mr Goose, I did not mean you! I meant those who use the Windows platform.

[mrgoose]

Oh indeed Mr Goose, I did not mean you! I meant those who use the Windows platform.
Sure. lol. :D

But seriously, what about the MS Access issue? If you don't use MS IE but you do use MS Access c/w ActiveX, presumably you also need to run the patch? Or am I mistaken?

Best wishes, G.

[snakedoc]

Indeed, IE crops up in all sorts of places. You should patch anyway, this is why I said "Windows Plaform" and not IE users.

[mrgoose]

Indeed, IE crops up in all sorts of places. You should patch anyway, this is why I said "Windows Plaform" and not IE users.
Cheers. Yes you did indeed. That's what I thought. I have a couple of customers still running old Access DB's I built for them many, many moons ago. I don't do their IT. But I ought to make them aware of the issue (if they are not already) because the apps make some browser calls in VBA. Best wishes, G.