Linked by Thom Holwerda on Mon 18th Jan 2010 22:00 UTC
Internet Explorer Ah, the security vulnerability that was used in the Google attack. It's been around the internet about a million times now, and even governments have started advising people to move away from Internet Explorer. As is usually the case, however, the internet has really blown the vulnerability out of proportion. I'll get right to it: if your machine and/or network has been compromised via this vulnerability, then you most likely had it coming. No sympathy for you.
Thread beginning with comment 404783
To view parent comment, click here.
To read all comments associated with this story, please click here.
RE[2]: Technet is not to be trusted
by Kroc on Mon 18th Jan 2010 23:22 UTC in reply to "RE: Technet is not to be trusted"
Member since:

No need to, social engineering is more effective. These hackers however were exploiting corporate culture. It shocks me that Google would have anybody in their company using IE6—a fact I’m sure they are quickly rectifying right now.

And it’s not just a matter of silly people use old software—IE6 is still a supported product. It is therefore an official Microsoft product and its age has no relevance as Microsoft have a contractual obligation to support it. This is why businesses still use the damn thing, because it still has the Microsoft seal of approval. As soon as MS say that IE6 is no longer supported, the corps will jump off of it right away as they will have legal, contractual requirements to do so to meet safety requirements for handling customer’s data.

Microsoft have had a lot of time to statically analyse IE6, even re-compile it with the latest compilers, or even audit the bloody thing. The fact is that IE6 has been one giant weekend for Microsoft and continues to be so. They care about security only when it makes them look bad. They’ve had 9 years to find this bug. So what’s the excuse? It’s old? No. It’s a supported product used by hundreds of thousands of companies.

Reply Parent Score: 4

Bryan Member since:

I doubt it's that simple. Keep in mind the underlying flaw is present in all prevalent versions of IE, including IE8 which, no doubt, have been threat modeled, reviewed for security flaws, and analyzed and compiled with the latest tools. Historically, Microsoft has published post-mortems for notable exploits that describe why exactly those mechanisms proved insufficient (e.g., [1]), and hopefully they'll publish one for this flaw as well. Until we have information on what the flaw looked like from their end (ideally with the relevant source snippets), it's premature to simply attribute it to incompetence or apathy.


Reply Parent Score: 1