IE Security Breach - 12/16/08

[Maldian]

Just to give you guys a heads up... and I haven't found this yet through the forums I have looked through here... BUT... I work for a major networking firm here in my hometown. We got the alarm today from Microsoft MSDN as well as other reliable companies. Please be aware of this....


http://tech.yahoo.com/blogs/null/111811


Major flaw revealed in Internet Explorer; users urged to switch

Tue Dec 16, 2008 11:49AM EST

See Comments (54)
Buzz up!on Yahoo!

The major press outlets are abuzz this morning with news of a major new security flaw that affects all versions of Internet Explorer from IE5 to the latest beta of IE8. The attack has serious and far-reaching ramifications -- and they're not just theoretical attacks. In fact, the flaw is already in wide use as a tool to steal online game passwords, with some 10,000 websites infected with the code needed to take advantage of the hole in IE.

Virtually all security experts (as well as myself) are counseling users to switch to any other web browser -- none of the others are affected, including Firefox, Chrome, and Opera -- at least for the time being, though Microsoft has stubbornly said it "cannot recommend people switch due to this one flaw." Microsoft adds that it is working on a fix but has offered no ETA on when that might happen. Meanwhile it offers some suggestions for a temporary patch, including setting your Internet security zone settings to "high" and offering some complicated workarounds. (Some reports state, however, that the fixes do not actually work.)

Expedient patching or switching are essential. Security pros fear that the attack will soon spread beyond the theft of gaming passwords and into more criminal arenas, as the malicious code can be placed on any website and can be adapted to steal any password stored or entered using the browser. It's now down to the issue of time: Will Microsoft repair the problem and distribute a patch quickly enough to head off the tsunami of fraud that's about to hit or will it come too late to do any good?

Meanwhile, I'll reiterate my recommendation: Switch from Internet Explorer as soon as you can. You can always switch back once the threat is eliminated.



From my company
This information and updates on this situation will be posted to our website at http://www.seltel.com/news.php

Links to Microsoft:
http://www.microsoft.com/techn...Bulletin/MS08-dec.mspx

Links to news reports:
http://tech.yahoo.com/blogs/null/111811
http://www.usatoday.com/tech/n...-explorer_N.htm?csp=34



Anyways... again... was just giving a heads up. Sorry if this ends up being posted in the wrong forum. Wasn't sure where to send it.

 

[mechBgon]

You're about a week late with this alert Microsoft's patch to fix this issue will be released tomorrow morning (December 17th), so if you have Automatic Updates turned on, your system should patch itself tomorrow.

In the meantime, there are some straightforward methods of mitigating the threat, listed here (expand Workarounds). Myself, I'm using Data Execution Prevention as always, and of course Protected Mode/UAC as always, as well as a disallowed-by-default Software Restriction Policy that makes the whole issue a non-threat from the get-go

Tangentially, note that Opera has just been patched for "Extremely severe" security vulnerabilities. And FireFox has just been patched again to eliminate another dozen vulnerabilities. So you might want to switch browsers to one that features Data Execution Prevention and Protected Mode to mitigate vulnerabilities, known or unknown... :evil: Because there are more. There'll always be more.

Tangentially #2: Every home user of Windows should give their system a checkup with Secunia's free Personal Software Inspector to eliminate known vulnerabilities.

 

[Sam25]

Yes, I read about it on this morning's newspaper a couple of hours back here in India. Here's the one I read:

http://www.telegraphindia.com/...ign/story_10263717.jsp

 

[Maldian]

Originally posted by: mechBgon
You're about a week late with this alert Microsoft's patch to fix this issue will be released tomorrow morning (December 17th), so if you have Automatic Updates turned on, your system should patch itself tomorrow.

In the meantime, there are some straightforward methods of mitigating the threat, listed here (expand Workarounds). Myself, I'm using Data Execution Prevention as always, and of course Protected Mode/UAC as always, as well as a disallowed-by-default Software Restriction Policy that makes the whole issue a non-threat from the get-go

Tangentially, note that Opera has just been patched for "Extremely severe" security vulnerabilities. And FireFox has just been patched again to eliminate another dozen vulnerabilities. So you might want to switch browsers to one that features Data Execution Prevention and Protected Mode to mitigate vulnerabilities, known or unknown... :evil: Because there are more. There'll always be more.

Tangentially #2: Every home user of Windows should give their system a checkup with Secunia's free Personal Software Inspector to eliminate known vulnerabilities.

Microsoft will push out an emergency security patch for Internet Explorer today, addressing the critical security hole currently being exploited in the wild.
Redmond issued advanced notice for today's fix, describing the out-of-cycle patch as protection from "remote code execution."
Although the exploit was at first contained to warez and porn sites hosted on a variety of Chinese domains, the malicious JavaScript code has since spread to more trusted sites though SQL injection. The flaw is primarily being used to steal video game passwords at present, but could potentially be used to retrieve more critical sensitive data from users as well.
The vulnerability is specifically targeted at surfers running IE 7, but it's also known to affect versions 5, 6, and 8 of the browser as well. All IE users are advised to install the update.
Microsoft's emergency patch will become available Wednesday at 1 PM EST from auto-update and the Microsoft Download Center. A separate patch will be made available for those running IE8 Beta 2.

The vulnerability that occurred last week has already been taken care of. I confirmed all of this lastnight with Microsoft Security Tech Team via voice.

 

[mechBgon]

Originally posted by: MaldianThe vulnerability that occurred last week has already been taken care of. I confirmed all of this lastnight with Microsoft Security Tech Team via voice.

I think you might have them confused, because your own links lead to articles about a vulnerability that has been on the radar for about a week, and has just been patched as of 10AM PST: http://www.microsoft.com/prote...letins/200812_oob.mspx

(oh, and this is irony at its finest: your company's "links to reputable browsers" includes Safari :laugh: )

8 days from discovery to release is pretty good, considering it had to be developed and tested on everything from Win2000 to Windows Server 2008 :thumbsup: Nice to see that Vista had mitigation by default (UAC / Protected Mode). IE8 will also have DEP armed by default when it's released.

 

[Maldian]

Mech,

I can only hope at this point that you have gone back to our site and updated your reading. As of 4pm today EST, Microsoft did a webinar over the security critical patch that was MS08-078 (960714) and not MS08-073 (958215). MS08-078 (960714) is to be patched POST MS08-073 (958215) which was released earlier around the 10th or so. The patch this morning that was released was MS08-078 (960714). Be sure to apply all updates on this. It is recommended to patch 073 before 078. Also 078 was developed in 2 Days... not 8. This will be in the Microsoft Webinar notes on their site once they get the second webinar done tomorrow. They had over 900 people sign up for today's webinar so they have to offer a second day.


IMPORTANT
December 17, 2008 - v1.1

UPDATED
UPDATE - Microsoft has released two updates to address this issue. Both releases will be deployed by Microsoft Update Services. The two required updates are MS08-073 (958215) and MS08-078 (960714). The issue is about how Internet Explorer handles data binding. This is important for dynamic web pages especially on your Extranet-based software interfaces. This is a very important update and it may require you to restart your computers as the updates are applied. So far, no one has reported any issues (as in breaking something) with applying the patches to their systems with customized applications installed. If you have web-based or Extranet-based applications that use data-binding, then you will want to test the update in a testing environment first.


BTW the Safari... I hate Safari... our chief webmaster loves it. I told him he was a loser for using it So Mech... I agree with your smart comment about the "reputable browsers" lol.

 

[mechBgon]

I think you might be misinterpreting the wording Microsoft is using. To secure IE at this point, you would apply the Cumulative update that was part of this month's Patch Tuesday (hopefully we all have that one by now), then the out-of-band MS08-078 update that was provided today. That resolves the issue that your company's site seems to be talking about, which has been used to steal password info in China, and can be used for other malicious purposes too.

The next Cumulative update will incoroprate MS08-078, hence Microsoft's statement:

Is this a cumulative security update for Internet Explorer?

No. This out-of-band security update is not cumulative. To be fully protected, customers should apply this update after applying the most recent cumulative security update for Internet Explorer. This update, MS08-078, will be included in a future cumulative security update for Internet Explorer.

 

[Maldian]

Thta is what I have been trying to say. Thx for the clarification.