RSSMicrosoft Plugs IE Hole
By David Worthington | Published July 29, 2004, 1:23 AM
Microsoft is expected to release an out of cycle patch to bring to an end to the vulnerability that led to the Download.Ject attacks in June. The attack, called Download.Ject, exploits known flaws in Internet Information Services (IIS) and Internet Explorer whereby users become silently infected with arbitrary code embedded in Web pages. Once installed, the code uploads malware and begins to log keystrokes to obtain personal information such as passwords.
I have been using FireFox for a while now, and I have found very few web sites that still dont work with all browsers. Granted there are a few, however, most pages will function to the point where you can at least use them.
I do keep IE installed for the exceptions to this rule, after e-mailing the web master of the site, saying that they need to fix there code.
Score: 0
|http://www.CERT.org -- heard of them?
"The CERT/CC is a major reporting center for Internet security problems. Staff members provide technical advice and coordinate responses to security compromises, identify trends in intruder activity, work with other security experts to identify solutions to security problems, and disseminate information to the broad community. The CERT/CC also analyzes product vulnerabilities, publishes technical documents, and presents training courses.
Some history: The present CERT Coordination Center grew from a small computer security incident response team formed at the SEI by the Defense Advanced Research Projects Agency (DARPA) in 1988. The small team grew quickly and expanded its activities. As our work evolved, so did our name."
These fine people STRONGLY caution against EVER using Internet Explorer. I'm sure they had no reason whatsoever and posted it only as a whim.
Score: 0
|If they advise against IE, they don't know what they're saying since it is used everytime you access control panel, search for files, use most virus scanners, word processors, etc. The reason most software requires internet explorer is BECAUSE THEY USE IT.
By the way...did you know that you don't even have to use IE and vulnerabilities in it can still affect your system? (granted, this and some other particular vulnerabilities do not apply, but the LSASS vulnerability that saaser worms exploit, the blaster worm...countless others) The truth is you don't have a choice of whether or not to use IE--don't you remember the lawsuit Netscape filed on MS after Windows 98 integrated IE in its core functions? The only thing MS was required to do (besides to pay the fine) was providing an option to 'disable' Internet Explorer, but even with that it is still the core of Windows 2000 and even XP. You may bash it, but you use Internet Explorer every day you get on your computer.
Score: 0
|You can still greatly mitigate your vulnerability by browsing with another browser, since almost every IE security flaw is exploited through Web sites. So you can get all indignant over someone suggesting switching from IE, but the fact is that doing so will greatly help.
Score: 0
|Use an alternet browser and you'll be safe like Firefox or opera.
IE shells like myie2 and Avant ARE still vulnerable however.
Score: 0
|While I do agree that alternate browsers are nice, most users with Windows Operating Systems still use their default browser, Internet Explorer. Developers of large web sites seem to know this. Take Sony Online Entertainment for example. In order to install and run Star Wars Galaxies, you must have Internet Explorer installed. In order to use the forum toolbar on their site, you have to use Internet Explorer -- it just doesn't show up if you use another browser (to the best of my knowledge, although I'm only a Firefox user, not any other third-party browser). So, until there is a huge s*** for companies to pull away from coding for IE, we'll always need it on our system. If you want to see how many bugs have been found in IE 6.1 SP1, go to this site (http://www.securityfocus.com/bid/vendor/) and select microsoft, internet explorer, 6.1 SP1. The list is crazy long. Then do the same search for Mozilla, Firefox, all versions. Granted, more people are probably digging into IE, but the bug list, ouch. It's really quite interesting.
Score: 0
|You are only fooling yourself if you believe you are any safer by using an alternative browser. As use of Firefox grows, so will the number of "flaws" found. It is no different than how Netscape was when IE first came out... hell, when Netscape 4.x was released, there was a new release almost every week!
The only REAL answer to security is to change the way we surf the web as users... be more cautious of our actions and the sites we visit.
Aaron
Score: 0
|