Code Posted For New IE Exploit 123
PC World is reporting that two days ago hackers posted code for a new vulnerability in Internet Explorer that could allow drive-by takeover of a vulnerable PC. Security companies say that no exploits using the "daxctle" vulnerability have yet been found in the wild, but they are taking the new threat seriously. Symantec calls the bug "critical" and Secunia rates it highly critical, the most severe rating. The hackers who posted the sample code, xsec.org, refer to it as a "0day" exploit. The article quotes another security expert who calls this label "a stretch."
Update: 09/17 18:00 GMT by C :Fixed link to XSec. Thanks for pointing that one out, folks.
Moo (Score:4, Insightful)
If you want to be safe in IE, turn off ActiveX from untrusted sites. Hasn't this been known since day one?
News would be if ActiveX was tested and found to be safe.
Re:Moo (Score:1, Insightful)
Ah yes. PC Magazine. Where Macs don't exist and "power-hungry" appears in every third headline.
Re:Eh? (Score:5, Insightful)
If you are a sys admin, or a web admin, Deal.
"not a 0day exploit" (Score:5, Insightful)
I'm sorry, what's the definition of 0day exploit these days? If not exploit code for which there is no patch available, then what?
Can we now use "responsible disclosure" to argue away the fact that actual computer systems are at risk of being exploited right here and now, by saying "yeah, well, you got rooted and all, but we knew about that bug, so it doesn't count, even though we don't have a patch yet."?
Can we now take comments that the programmers left in the code ("// does this work?" "/* coded while druk */" "//BUGBUG") as an excuse to completely ignore actual vulnerabilities?
And hey, if TWO researches come up with this vulnerability seemingly independently, what are the chances of the exploit already circulating in the black hat community? Close to 100%?
By my definition you've got your negative-day and your zero-day exploits. Negative-day exploits; no patch yet. Zero-day; the patch has just been issued, so might as well give your exploit to scriptkiddies and botnet operators to use on the systems that don't patch early/often enough. Obviously, a negative-day exploit usually isn't going to be used on a large scale, because your average blackhatter wants to keep it in his toolkit to attack well-patched systems; after all, it's what gives him (and his leet skillz) an edge. Once patchday arrives, you might as well give it to some noobs, because they might be interested in unpatched targets, while a leet blackhatter is not.
So no, it's not a "stretch" to call it 0day. It's negative day, even.
Re:Firefox 1.5.07? (Score:4, Insightful)
Re:Firefox 1.5.07? (Score:5, Insightful)
OK, smarty, I will explain the difference to you. On one hand we have Firefox, which is a piece of software that is free in both senses, and you can use it, or not use it, or delete from your system, or whatever you want. On the other hand we have Internet Explorer, which is forced upon you via "leveraging," you cannot remove, and you must use because of contrived tie-ins to fundamental system functions.
If there is an exploit for Firefox, I can shrug my shoulders and use any of a dozen other browsers to look at web pages until it gets fixed. Or I can choose to continue using Firefox anyway, despite the risk. It's my choice. However, if there is an exploit in Internet Explorer, I am just plain screwed. I can't switch the goddamn thing off or remove it. Hell, there are plenty of applications and services that will gleefully launch IE of their own accord and start loading internets from God knows where, and there's no way for me to stop it. Because of Microsoft's predatory practices, I have no choice in the matter (except to abandon Windows altogether, which is also not an option -- see how all my choices have been removed?). You're damn right people are a lot more upset when exploits turn up in IE. We are required to suffer the fallout from them.
how to detect an untrusted site .. (Score:1, Insightful)
How do you know what is or is not an untrusted site.
How in any way is that comment "insightful".
Re:how to detect an untrusted site .. (Score:5, Insightful)
Re:Firefox 1.5.07? (Score:3, Insightful)
Security companies say that no exploits using the "daxctle" vulnerability have yet been found in the wild
Re:Yes, this affects IE7 but you are prompted (Score:4, Insightful)
Throwing a constant barrage of OS/browser security pop-ups on the screen does not make it secure. Making it so that at exploitable control can be completely removed and not just "effectively removed" from the system helps make the system more secure but this is just a workaround. If the control was designed to be able to grant system level privileges to a web page than it's time to go back to the proverbial drawing board.
If it wasn't designed that way, then patch it when you first hear about it over a month ago [securityfocus.com] and stop complaining about people releasing it to the public. I would rather have everyone know about it than have just Microsoft, a few security people, and several black hats knowing.