Linked by Thom Holwerda on Mon 18th Jan 2010 22:00 UTC
Internet Explorer Ah, the security vulnerability that was used in the Google attack. It's been around the internet about a million times now, and even governments have started advising people to move away from Internet Explorer. As is usually the case, however, the internet has really blown the vulnerability out of proportion. I'll get right to it: if your machine and/or network has been compromised via this vulnerability, then you most likely had it coming. No sympathy for you.
Thread beginning with comment 404778
To view parent comment, click here.
To read all comments associated with this story, please click here.
RE: Technet is not to be trusted
by Thom_Holwerda on Mon 18th Jan 2010 23:00 UTC in reply to "Technet is not to be trusted"
Thom_Holwerda
Member since:
2005-06-29

Good luck getting through DEP, ASLR, and protected mode.

Since Vista's inception, it hasn't been cracked.

Reply Parent Score: 2

kragil Member since:
2006-01-04

So you are the security expert now? I found this article to be really weak and fanboish. That is why I started to a quick Google search.

And well, I hate to break it to you but IE7 has been cracked:

http://twitter.com/george_kurtzCTO

And it is looking bad for IE8:

http://twitter.com/dinodaizovi

And that is just one day after the release of the first exploit, once security is breached you get new attack vectors and new exploits are possible. It is not like DEP etc. always migitates everything 100%. It just helps.

Reply Parent Score: 3

nt_jerkface Member since:
2009-08-26

So you are the security expert now? I found this article to be really weak and fanboish.

I found it to be a refreshing assessment instead of one of many sensationalist articles that focused on the government warnings and not who exactly is at risk.


And well, I hate to break it to you but IE7 has been cracked:

Because some people on twitter say so? That isn't proof.

Reply Parent Score: 2

Karitku Member since:
2006-01-12

Again those guys did it on XP without DEP. IE8 enables DEP by default so it will be much harder. Btw main reason why IE7 didn't have DEP enabled by default? Third party ActiveX component, try guess which ;) .

Reply Parent Score: 2

Kroc Member since:
2005-11-10

No need to, social engineering is more effective. These hackers however were exploiting corporate culture. It shocks me that Google would have anybody in their company using IE6—a fact I’m sure they are quickly rectifying right now.

And it’s not just a matter of silly people use old software—IE6 is still a supported product. It is therefore an official Microsoft product and its age has no relevance as Microsoft have a contractual obligation to support it. This is why businesses still use the damn thing, because it still has the Microsoft seal of approval. As soon as MS say that IE6 is no longer supported, the corps will jump off of it right away as they will have legal, contractual requirements to do so to meet safety requirements for handling customer’s data.

Microsoft have had a lot of time to statically analyse IE6, even re-compile it with the latest compilers, or even audit the bloody thing. The fact is that IE6 has been one giant weekend for Microsoft and continues to be so. They care about security only when it makes them look bad. They’ve had 9 years to find this bug. So what’s the excuse? It’s old? No. It’s a supported product used by hundreds of thousands of companies.

Reply Parent Score: 4

Bryan Member since:
2005-07-11

I doubt it's that simple. Keep in mind the underlying flaw is present in all prevalent versions of IE, including IE8 which, no doubt, have been threat modeled, reviewed for security flaws, and analyzed and compiled with the latest tools. Historically, Microsoft has published post-mortems for notable exploits that describe why exactly those mechanisms proved insufficient (e.g., [1]), and hopefully they'll publish one for this flaw as well. Until we have information on what the flaw looked like from their end (ideally with the relevant source snippets), it's premature to simply attribute it to incompetence or apathy.

[1] http://blogs.msdn.com/sdl/archive/2009/07/28/atl-ms09-035-and-the-s...

Reply Parent Score: 1

abraxas Member since:
2005-07-07

Good luck getting through DEP, ASLR, and protected mode.

Since Vista's inception, it hasn't been cracked.


Not true. All three have been circumvented at some point. Apparently the randomization on Vista wasn't that random because of too little entropy which made it possible to guess address locations. Protected mode was circumvented through an implementation flaw of Vista's Integrity Levels and DEP was circumvented with Java.

Reply Parent Score: 2

kragil Member since:
2006-01-04

No use telling him. Judging by this write up he is on MS payroll.

First of all IE6 is still officially supported by MS. People are still paying to get security patches and so it is not the fault of the users when they get hacked.

So:
_It is Microsofts fault._

2. The exploit works on IE7 on XP and Vista (not all setups, but still)

3. This article makes it sound like the good advancements in Vista regarding security cure all potential holes.

_They do not._

In conclusion:
This thing needs updates or should be deleted. Security is serious stuff for experts to write about.

Reply Parent Score: 0