IE7 Toolbar Mayhem 296
nikostheater writes "A user called anyweb tried to infect IE7 with as many toolbars as possible and it's interesting to see what happens and how secure IE7 is.." This is funny if only for the screenshot of a browser window with like 80% of the screen covered with toolbars.
Is it really an infection if... (Score:5, Insightful)
Re: (Score:3, Insightful)
The slashdot post here is definately FUD. It gives the impression that IE7 happily installs all kinds of crap. In the article, however, the experimenter says multiple times that IE7 made doing this VERY DIFFICULT to do without noticing you're braking shit.
That's not to say some Typhoid User isn't perfectly capable of doing this anyways, but a Typhoid User should be encouraged very strongly to never ever log in as an admin, and charged through the nose for repair services.
Re:Is it really an infection if... (Score:5, Insightful)
It's only FUD to people who decide what it says based on their own biases and an unwillingness to read the article. I clicked through to the article, and even though it renders very badly on my browser for some reason, the parts I could read told me the IE was getting a lot better.
Someone clicking 'yes' to everything is not that far off from a typical user's behavior. Most people have no idea what any of that stuff means and not much of a desire to learn. They just want the computer to do what they think they told it to.
Re: (Score:3, Interesting)
Oh, come on. First of all, the computer should never prevent you from doing something you want to do, regardless of how dangerous or stupid it might be. It should most definitely warn you that it is dangerous and stupid. If the user really does click 'yes' for everything, it should get installed. As long as you get stern warnings about it (and as long as an admin can prevent it from happening to work computers by locking it down), it's plenty secure.
That said, even clicking 'yes' on everything didn't
Re: (Score:2)
Regardless, there are still some troubling security holes in Vista IE7 that should be fixed, and this article does one hell of a job showing how it is exploited. I don't like how protected mode stays disabled after you install one toolbar. I'm also troubled that Windows Defender isn't mentioned at all i
Re: (Score:3, Insightful)
That only occurs if the toolbar in question disables it. The problem with installing any toolbar is that it is actually executing a binary on your system - meaning that it has full access to your computer, and even interface override control.
I wonder if there's any of those stupid toolbars that automatically clicks 'yeah, fine, do it' on any ActiveX warnings that pop up.
Re: (Score:2)
Sure, it's humor, but the summary still gives slashdotters (who are of a generally 'MS Sucks' mind) the impression that IE7 will just allow this to happen. That's why I said the post was fud, but the article wasn't.
Meanwhile, Hey OCG! It's been a while since I've seen you posting around! 'Course, that's probably 'cos I've been too busy to go posting
Re: (Score:3, Interesting)
B.
Re: (Score:3, Funny)
Re: (Score:2)
Yep, you're exactly right. This is just an l^Huser problem. You might as well say that Firefox sucks because it will let you install extensions if you ask it to. For that matter, Linux sucks because you can install all kinds of software on it too!
Re: (Score:3, Insightful)
The fellow said exactly DICK about FireFox or Linux "automatically" installing anything.
Cheater512 is a living example of why we so desperately need a "Linux Bigot" comment moderation label.
Restore to default state (Score:5, Insightful)
Um... (Score:4, Insightful)
This is news?
Re: (Score:2)
Re:Um... (Score:5, Insightful)
Re:Um... (Score:5, Interesting)
The real question is how long will this situation persist? Will spyware vendors find means to disable the security features of IE7, or will IE7 continue to be resistant?
Re: (Score:2)
Once the registry gets fat, short of running one of those reg cleaners from the likes of McAffee, with the obli
Re:Um... (Score:5, Insightful)
He got repeatedly warned about what he was doing, had to click through an awful lot of 'Yes, I'm sure'-type dialogue boxes to do it, and at the end was able to wipe out pretty much all of the toolbars very easily.
This is indeed news. It looks like Microsoft are actually getting something right this time!
Re:Um... (Score:5, Funny)
Re: (Score:2)
Re: (Score:2)
It has been demonstrated time and time again: showing dialog boxes to ignorant users does not constitute a security feature. Windows users are trained to click 'Yes', 'Continue', or 'OK' to every dialog that appears until it goes away. They do not normally read the text.
Re:Um... (Score:5, Informative)
1. Vista Ultimate Edition's default user has administrative rights.
2. If you choose to accept to install something from the web, IE7's protected mode turns off until you restart the program. This could leave you vulnerable if you install a legitimate program (Google toolbar) and continue to browse the web.
Re: (Score:3, Insightful)
Re: (Score:2)
Re: (Score:2, Funny)
Re: (Score:2)
Honestly... fdisk? How, exactly, does MySearch affect your partition table?
Re: (Score:3, Insightful)
Re: (Score:2)
Re:Um... (Score:5, Insightful)
The bad news is "once you accept ONE UAC prompt in IE7 it disables the protection for subsequent browsing until you completely restart IE7"
For crying out loud (Score:3, Insightful)
IT'S JUST A HUMOR ARTICLE. IT SAYS RIGHT IN THE ARTICLE THAT HE'S DOING IT ON PURPOSE TO SEE WHAT HAPPENS. NOTHING MORE.
Okay? Get it? We know it requires user action to infest IE7 with toolbars. That's not the point of the article, which is just to see what happens and laugh on a Sunday. For crying out loud, why does everyone think they have to leap forward and be some sort of heroic truthbringer to the poor Slashdot masses who won't understand the article? We're not idiots.
Re: (Score:2)
Nowhere in the article summary is this mentioned as humourous. It's therefore not entirely unreasonable to assume that it's a serious investigation.
Also, why the "Microsoft apologists" bit? It's a bullshit article with a silly premise, pointing it out as such isn't "apologising" for Microsoft at all.
Re: (Score:2)
Re: (Score:2)
If the majority always made the right choices, it would be smart to be overweight: http://www.usatoday.com/news/health/2002-10-08-wei ght-usat_x.htm [usatoday.com]
Most people using IE don't know Firefox or Opera. There are probably more IE users that never heard of Firefox than there are Firefox users... I'd go even farther that there are more IE users who don't know what is meant by the acronym IE than th
What IF (Score:3, Interesting)
Afaik these toolbars add "extra browsing enhancements". If MSFT told it's users that these bars are Teh evil if installed from some random adress I'm sure the "toolbars" will die out soon.
Re:What IF (Score:4, Funny)
Re: (Score:2)
It's worth also pointing out that some of the better designed toolbar extensions for Firefox such as the Google toolbar allow you to use ordinary firefox toolbar customisation so you can drag buttons off the Google toolbar onto other Firefox toolbars and hide the Google toolbar if you don't need it.
I do this so I can put the page ra
Re: (Score:3, Informative)
Failing by design (Score:3, Informative)
"Failing by design" Is Proper? (Score:2, Interesting)
Most of the UI systems I've studied tell me that if the design has a "need" to ask the user to consider doing something bad, t
Re:"Failing by design" Is Proper? (Score:5, Insightful)
The fact of the matter is it isn't always obvious if something is going to break functionality, making a user aware that it might and giving them the choice is IMHO better than telling them they can only run signed software on their computer.
Re: (Score:2)
You Misunderstand: Feature Good, Process Bad (Score:4, Insightful)
By design or miracle, "warning dialogs" are somewhat minimal in Mac or Linux but in Windows its all over. "Are you sure you want to do this? Yes/No" over and over again causes "fatigue" where users just dismiss it for the sake of making it go away. I've seen users who just click and dismiss things that are clearly warnings and indicators that something is wrong. Why? Because they see it dozens of times and its nonsense as far as they can tell. The reason they never hit "No" is because it stops what they were doing. They would rather be encumbered by a flakey IE than not do what they wanted and frankly these errant users have a point.
The point is worth repeating: Adding a toolbar to IE7 isn't a bad thing. The real problem is the way the process works and it isn't getting better for Vista. For each plugin there should be one and only one confirmation. If it fails **any hard defined requirements** then it the plugin is not installed. They should not be asked to elevate their privilages. They should not be asked if they want to activate secondary controls (Active X). They should not be asked if the install can modify the registry.
Why does any toolbar need 'elevated privilages' at all to install or work? IE is supposed to be an issolated framework that is user dependant. Why does a toolbar need another control hosted outside of itself (violates sandbox)? Why does any toolbar need to access the registry (again violates sandbox)? None of this stuff seems necessary at all for toolbars to function. Why bother asking the user "Yes/No" questions on things that are "violations"?? In most normal cases, when a program violates the rules it doesn't allow it. Why is IE different?
Re: (Score:2)
IE7 is more secure because he HAD to disable a whole bunch of shit to get it to do the dumb shit that IE6 did.
Just 'cos the summary's fud doesn't mean the article is.
Re: (Score:2)
Host took out Pictures (Score:4, Informative)
(Some were large JPGs.)
Interesting text nonetheless.
There was a video of some guy recording his browse by infection of IE a while back that was very revealing. Just visited a site and his computer was infected, he proceeded to try to pull the stuff out and noted the techniques the spyware authors used to keep a user from being able to uninstall it.
The critical difference in security though is not what the user can do (as he or she is probably running as administrator anyway) but what can be done without their permission. That's where the work needs to go. Not stopping someone from doing something they have to agree to (no matter how nefarious the wording is).
"Here's the picture (Score:2)
Re: (Score:2)
You're talking about real security. On Windows, we still have "security" like anti-virus, which is designed to assume that the user doesn't have a clue.
The trick is making sure they know what they're agreeing to. If you have t
Re: (Score:3, Informative)
FTA (Score:4, Interesting)
We'll see how well this works a year after release. That said, it's about damn time MS did something about IE.
Reminds me of... (Score:5, Funny)
I go back two weeks later, and now firefox has a mycoolsearch toolbar! Arrg.
Re: (Score:2, Insightful)
This is in fact one of the worst spywares you can get. Quite a few variants can be deemed rootkit like.
Re: (Score:2)
Security? (Score:3, Insightful)
Re: (Score:3, Insightful)
Re: (Score:2)
Sure - if the 'typical computer user' in the wild bore any relation to the 'typical computer strawman' of Slashdot myth and legend. (That's not to say complete damm fools don't exist - they do. But they are no more 'typical' than the average Slashdot user.)
Re: (Score:3, Insightful)
Really? Because I see 5 or 6 every single week. People that just click on whatever button to get it out of their way are everywhere. Their virus/trojan/spyware-laden machines are my bread and butter.
Re: (Score:2)
I see - you make your point by telling only half the story. Because you don't tell us what percentage of total machines you see each week those 5 or 6 constitute.
Sure, they are 'everywhere', but 'everywhere' != 'typical'. Even by the
Re:Security? (Score:5, Insightful)
You're right to criticize. On the other hand, hitting "yes/allow/next/install no matter what it says" sounds like an accurate approximation of what 90% of users will do. So I guess it still asks the question, if "increased security" means that there are a couple more pop-ups that I have to click "yes" on, how effective will that "increased security" be?
Re: (Score:2)
Re: (Score:2)
toolbars anyone? (Score:2)
So how is this a security issue? (Score:2, Interesting)
The only possible way to prevent this (and why would you want to prevent users from using their favorite toolbars?) would be to completely disallow downloading toolbars from the internet in IE.
By the way, did the submitter actually refer to Google toolbar as an "infection" with th
Re: (Score:2)
Toolbar Wars... (Score:2)
Your Point? (Score:4, Insightful)
If Microsoft didn't allow people to override those controls I can just see a lot of internal applications breaking in a lot of businesses.
There's a lot wrong with Windows (which is why I chose not to use it), but from what I can tell from this article, the security on the upcoming version of IE might not be one of them (for once).
No one chastises Linux for allowing you to "sudo rm -rf
Re: (Score:2)
Vista still installs the user as Administrator by default. IE still lets you install all of the badness. Again, IE can't judge 'adware' vs 'desirable software', and your point is valid: it shouldn't make that decision for you.
Your example of No one chastises Linux for allowing you to "sudo rm -rf /". is a great example of the point. As we all know, in Linux a default instal
Re: (Score:2)
VMS uses a security model that is much closer to Windows than unix; yet, it is rarely hacked.
Get real. In this day and age, VMS is rarely FOUND on the public internet. Yeah, sure, there are organisations still using it, but most of those organisations are using it for things which are so critical that there is no way they're going anywhere near the Internet.
Re: (Score:3, Insightful)
Re: (Score:2)
Other than that IE7 seems to be looking ok, maybe I wish it might have pressed the security prob
Re: (Score:2)
Vista may have had a lot of attention from various quarters, but I bet you anything you like it's not even had 10% of the attention XP has.
I'm reserving judgement on the security standpoint for at least a year after release. (My boss, bless him, has saved me the trouble of having to propose that at work by already stating that he doesn't like the idea of upgrading straight away and wou
In Episode II... (Score:2, Funny)
Im not sure what we can expect from that, but I sure cant wait to see!
SlashDotted (Score:5, Informative)
Re: (Score:2)
what I'm getting here (Score:3, Insightful)
Truth is, he should have tried to see how much damage he can make as a standard user without providing Administrator credentials. Being and admin and clicking through all the warning dialogs is like running as root in linux and being surprised you can install software...
Hate to whine, but why do these articles make it into slashdot? It seems like often the other technical subjects discussed here are well moderated, and the articles thought provoking. But as soon as someone with a fleeting command of the english language lays down any thoughts that are anti-Microsoft, it immediately makes the front page.
Doomish Naysayings (Score:2)
Its bad that the auto-cleanup thing didn't remove Yahoo. Either Microsoft explicitly made an exception for Yahoo or Yahoo found a workaround (I'm not sure which is worse). If yahoo can do that then so will all the ot
The result is really interesting (Score:4, Insightful)
I did not expect all those applications (where some of them had direct access to file system and registry) could be removed by a single click (and a confirmation).
So we learn three new strong points of IE7 (added to what IE6 already provides):
I'll personally continue to use Firefox, however I'm glad to see IE getting secure, because every now and them I have to use some "bad designed" site which only works on IE. And now I can be more assured about the security of my system.
Re: (Score:2)
There is also the point that many toolbars are installed deliberately (as I say, that is the point) so an average user will click yes at security confirmations.
Re: (Score:2)
(For example, something like: The program wants to modify registry, key: HKEY_LOCAL_MACHINE\..., etc).
So if the user still clicks ok on this prompt (and the other 2 before, and one after that) the crap will be given access to the system.
And you may say, there are some peo
There is some 'news' in the article (Score:4, Informative)
Missed point ... (Score:3, Informative)
This, I believe is the main point of the article, because this will help EVERYONE keep junk off of IE. Not that it deletes anything, but allows the clutter to be easily fixed.
Re:Missed point ... (Score:5, Insightful)
If Yahoo has already figured out a way to defeat the "IE Reset" function, isn't it logical to expect that within a year of IE7/Vista's release, this knowledge will be common to all spyware/malware authors?
A function like "reset browser settings" either works, or it doesn't. There is no middle ground. If there is a way to get it to do anything other than roll back all changes, it doesn't work.
ribbon bar redux? (Score:2)
Damn, have we gotten so desperate? (Score:2)
So, it gets posted to
Honestly, when are we to see the first article about how Steve Ballmer refused Linus Torvald's rest-room offer of a handshake only to have the readers fi
Jumped the shark (Score:2)
When do you think Slashdot jumped the shark? That is, versus giving us actual news that matter about OSS and IT, we started getting 80% of this crap like this one.
Thanks in advance for your opinions!
The world is going to end! (Score:5, Funny)
Mirror. (Score:5, Informative)
Re: (Score:2, Interesting)
Will the 75 popup blockers block the popups that the 219 non-popup blocking toolbars produce?
Well... (Score:2)
Why not take Vista / IE7 to some not so great sites. Like some of the more underworld (note, I didn't say illegal) porn sites, or better yet, crack sites that (still) try to use the WMF vulnerability and other tricks. Maybe I'll do that in a VM session
And hell, the product is still BET
Normal behaviour. (Score:4, Insightful)
IE toolbars are a plague (Score:2, Interesting)
Re: (Score:2, Insightful)
But simply put, due to the manner in which the author installed the toolbars, and the great lengths he went to do so (in some case
Gimme a screen shot of Firefox please (Score:3, Interesting)
I don't get the fud tag (Score:2)
Sit back and behold... (Score:3, Informative)
Hiding the menu bar below other clutter (Score:3, Insightful)
The first picture is hilariously absurd, but what really shocked me was the second one, and he says
This is the first time I had seen MSIE7, so maybe it's old hat and "standard" to everyone else, but I thought the "clean" picture was provocative. Why? Look at it: the menu bar isn't even at the top of the window; the url and back/forward arrows are. Are they trying to slow down the user and make them hunt for things? Is this normal and default for MSIE and recent Microsoft applications, for the menu bar to be somewhere other than top? Or had this user already diddled with some settings to make MSIE look bad?
Re: (Score:2)
Eh... I can't see like any, 80% or not. Page is dead.
"Like" here means approximately (Score:2, Informative)
Or it is approximately 80 percent, which I see as a legitimate use of "like 80%".
Re:Hmmm... (Score:4, Funny)
Re: (Score:2)
While what you say may be true of the browser window itself, I doubt CmdrTaco actually measured it. Thus, 80% is a guess, and saying "like 80%" means "appears to be approximately 80%, but I don't really know."
What would you rather he say in this situation?
I hope so. I hope you're the only one so hypersensative to the word that like==blond. Save your pedantry for where it's really warranted, like misuse of apostrophie
Re: (Score:3, Informative)
In short: No.
Long answer: IE seems to actually have saner defaults now. It still has the occasional buffer overflow that gives full access to the system.
One of my proper security settings, while on Windows, is to use Firefox for all web browsing, only resorting to IE Tab for Windows Update.
Again, it's got to do with IE inevitably having some security hole that doesn