Teacup, Meet Storm, pt. III: The IE6 Google Attack Flaw
Linked by Thom Holwerda on Mon 18th Jan 2010 22:00 UTC
Internet Explorer Ah, the security vulnerability that was used in the Google attack. It's been around the internet about a million times now, and even governments have started advising people to move away from Internet Explorer. As is usually the case, however, the internet has really blown the vulnerability out of proportion. I'll get right to it: if your machine and/or network has been compromised via this vulnerability, then you most likely had it coming. No sympathy for you.
E-mail Print r 0   · Read More · 68 Comment(s) http://osne.ws/hk4
Thread beginning with comment 404772
To read all comments associated with this story, please click here.
Technet is not to be trusted
by kragil on Mon 18th Jan 2010 22:52 UTC
kragil
Member since:
2006-01-04

My bet is that the IE7 default install will be exploited.

They are only talking about the CURRENT exploit and that is just v0.01. Updates will follow.

Reply Score: 2

Thom_Holwerda Member since:
2005-06-29

Good luck getting through DEP, ASLR, and protected mode.

Since Vista's inception, it hasn't been cracked.

Reply Parent Score: 2

kragil Member since:
2006-01-04

So you are the security expert now? I found this article to be really weak and fanboish. That is why I started to a quick Google search.

And well, I hate to break it to you but IE7 has been cracked:

http://twitter.com/george_kurtzCTO

And it is looking bad for IE8:

http://twitter.com/dinodaizovi

And that is just one day after the release of the first exploit, once security is breached you get new attack vectors and new exploits are possible. It is not like DEP etc. always migitates everything 100%. It just helps.

Reply Parent Score: 3

Read more of this thread... >
Kroc Member since:
2005-11-10

No need to, social engineering is more effective. These hackers however were exploiting corporate culture. It shocks me that Google would have anybody in their company using IE6—a fact I’m sure they are quickly rectifying right now.

And it’s not just a matter of silly people use old software—IE6 is still a supported product. It is therefore an official Microsoft product and its age has no relevance as Microsoft have a contractual obligation to support it. This is why businesses still use the damn thing, because it still has the Microsoft seal of approval. As soon as MS say that IE6 is no longer supported, the corps will jump off of it right away as they will have legal, contractual requirements to do so to meet safety requirements for handling customer’s data.

Microsoft have had a lot of time to statically analyse IE6, even re-compile it with the latest compilers, or even audit the bloody thing. The fact is that IE6 has been one giant weekend for Microsoft and continues to be so. They care about security only when it makes them look bad. They’ve had 9 years to find this bug. So what’s the excuse? It’s old? No. It’s a supported product used by hundreds of thousands of companies.

Reply Parent Score: 4

Read more of this thread... >
abraxas Member since:
2005-07-07

Good luck getting through DEP, ASLR, and protected mode.

Since Vista's inception, it hasn't been cracked.


Not true. All three have been circumvented at some point. Apparently the randomization on Vista wasn't that random because of too little entropy which made it possible to guess address locations. Protected mode was circumvented through an implementation flaw of Vista's Integrity Levels and DEP was circumvented with Java.

Reply Parent Score: 2

Read more of this thread... >