![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
reddragdivaPicture this: Hacker breaks into major corporate website, puts up a malicious bit of code. If you view the page in Internet Explorer, the code exploits a hole in IE and infects your computer. You didn't do anything except view a website. Your computer is now 0wned and being used by Russian spam gangs to advertise Viagra and mount DDOS attacks.
"The flaws affect every user of Internet Explorer, because Microsoft has not yet released a patch. Moreover, the infectious Web sites are not just those of minor companies inhabiting the backwaters of the Web, but major companies, including some banks." "The malicious program uploaded to a victim's computer is not currently detected as a virus by most antivirus software."
More stories: First sighting; ZDNet article; CNN.
Browsers: Firefox (4.7 MB); Opera (3.4 MB); Mozilla Suite (12.0 MB, includes email and IRC).
Only use IE for your Windows Update. If your bank insists on IE, get on the phone and tell them why that just isn't bloody good enough any more. If your work insists on IE, forward IT and your boss those story links and demand Firefox to keep doing your job.
(For our geek readers: details of the attack.)
I couldn't have imagined saying these words on the Internet before this, but ... tell everyone you know.
Update: Download.ject article from Wikipedia. (Mostly written by me.)
![[identity profile]](https://www.dreamwidth.org/img/silk/identity/openid.png){kind=small}
(no subject)
Date: 2004-06-25 07:51 am (UTC)(no subject)
Date: 2004-06-25 08:05 am (UTC)I'm serious. Forward those news links to your boss and your IT and ask for Firefox to browse with at work.
(no subject)
Date: 2004-06-25 08:18 am (UTC)Actually getting to anyone in IT who has a clue is impossible here, unfortunately: every phone number and email address redirects to the help desk, and they're, well, help desk. And I don't have a boss.
(no subject)
Date: 2004-06-25 07:59 am (UTC)On the other hand, Firewhatever 0.9 is available already.
SP2
Date: 2004-06-25 08:47 am (UTC)sorry to be dim...
Date: 2004-06-25 08:07 am (UTC)Re: sorry to be dim...
Date: 2004-06-25 08:59 am (UTC)Re: sorry to be dim...
Date: 2004-06-25 10:12 am (UTC)Mgt: "We must firewall this attack!"
Tech: "But..."
Mgt: "No buts! Do it!"
Tech: Blocks port 80
Mgt: "My internet doesn't work anymore!"
Tech: "Indeed not. That's what you wanted."
etc...
Re: sorry to be dim...
Date: 2004-06-25 06:00 pm (UTC)Re: sorry to be dim...
Date: 2004-06-25 06:07 pm (UTC)I was envisaging the likely reaction of the pointy-haired corporate.
Re: sorry to be dim...
Date: 2004-06-25 11:19 am (UTC)Re: sorry to be dim...
Date: 2004-06-25 04:42 pm (UTC)(no subject)
Date: 2004-06-25 09:14 am (UTC)I'm guessing from the EXE file, that it doesn't. So whilst IE is the vulnerability, the real problem is the ability of Windows to start apps without user authorisation in the background and the sheer volume of installed systems.
Why aren't all PC users ditching Microsoft for Linux - right now?!
(no subject)
Date: 2004-06-25 09:36 am (UTC)(no subject)
Date: 2004-06-26 04:40 am (UTC)Lusers are sort of like horses: If it looks different, it's scary and if it's scary they don't want to go there. Short of throwing a blanket over their heads an IE skin is the best way to keep your average, everyday, mouth breathing luser from getting "spooked" by something new.
I've heard of people who've had great success in getting users to switch to Mozilla using an IE skin to keep their users from spooking.
Unfortunately, the only IE skin I know of only works on older versions of Mozilla. I haven't seen one for Firefox or the later versions of Mozilla, but then I haven't been looking.
(no subject)
Date: 2004-06-25 10:09 am (UTC)(no subject)
Date: 2004-06-25 10:09 am (UTC)When Linux is as easy to install and run as Windows, people will ditch Microsoft. But right now I'm afraid it's still pretty much the preserve of the geeks and the more computer-literate of the world.
(no subject)
Date: 2004-06-25 11:04 am (UTC)(no subject)
Date: 2004-06-25 11:38 am (UTC)If I could afford a Mac I'd use that in preference, but some of us just can't afford it. Maybe when Apple start to lower their prices, more people will be tempted to give up the evils of Microsoft.
(no subject)
Date: 2004-06-25 02:28 pm (UTC)One of the problems afflicting the Mac is that the machines that are coming out of professional service are still not very good. Pre Quicksilver G4s are still painfully slow and expensive.
New, though... I think they're very competitive, actually.
(no subject)
Date: 2004-06-25 09:36 pm (UTC)(no subject)
Date: 2004-06-26 02:36 am (UTC)You get what you pay for man!
(no subject)
Date: 2004-06-26 04:34 am (UTC)It was only recently that the whole Help URL thing allowed Mac users to have their boxes owned by surfing the web.
I like Macs, but I wouldn't buy one until they were cheaper, and I'd still want to run Debian on them.
(no subject)
Date: 2004-06-26 07:11 am (UTC)You can of course choose to buy something cheaper than a Mac -and run a more secure *free* operating system on it. Or you can choose to pay the extra for a decent firewall and anti-malware software on top of the cost of a Windows PC and have relatively secure machine. Or you can pay the extra for a Mac and use a really quite secure machine straight out of the styrofoam. Nobody's denying you the choice, thank goodness.
(no subject)
Date: 2004-06-26 09:52 am (UTC)(no subject)
Date: 2004-06-26 12:30 pm (UTC)iBooks start at £649, IIRC. And regardless of MHz etc, the only areas you suffer are gaming - which you get a double hit, less fancy graphics hardware and less games overall - and bragging rights in pure numbers. I don't believe the 3 x Intel bullshit, but they definitely aren't a 1:1 comparison. OS X is vastly better than Windows.
Wasn't the URL thing a proof of concept, anyway? There are exploits for every OS from Window to SMSQ/E, but some OSen make it easier to fall foul of them than others.
I made a point of saying Linux. You get your 'secure' OS and you get your cheap hardware. If you want it easy, you have to pay - frankly most Linux distros seem pretty straightforward and my experiences have been sullied by my weird-ass Dell - my Playstation 2 Linux install was as easy as reformatting and reinstalling a Mac.
(no subject)
Date: 2004-06-26 05:01 am (UTC)Don't get me wrong, one of these days I'll probably make the switch myself, considering how obnoxious Microsoft is getting about DRM and anti-piracy crap, but I see no compelling reason to switch now and plenty "it'd be a pain in the ass" reasons not to do so.
Unlike some people, switching over to a new OS is *not* something that I'd consider doing for fun. :)
(no subject)
Date: 2004-06-26 12:22 pm (UTC)I switch to old OSen for fun. Then make them work together to get even older crap working - current project is getting Enterprise disks archived using an Archimedes, Mac and maybe the PC if the Mac barfs on the disk images.
(no subject)
Date: 2004-06-25 09:48 am (UTC)(no subject)
Date: 2004-06-25 10:00 am (UTC)Alternatively switch to a bank like the Halifax who are Firefox-friendly! ;-)
(no subject)
Date: 2004-06-25 10:48 am (UTC)I'm not changing to the Halifax -- I'm with Smile 'cos they're run by the Co-op bank, and thus vaguely ethical.
(no subject)
Date: 2004-06-25 02:46 pm (UTC)(no subject)
Date: 2004-06-26 12:32 pm (UTC)I don't think UA spoofing would help there.
(no subject)
Date: 2004-06-26 12:34 pm (UTC)(no subject)
Date: 2004-06-26 12:49 pm (UTC)Had a highly patronizing email from Smile tech support informing me that I should use "the tab key -- that's the one with the two arrows, just to the side of 'Q'". I pointed out the slowness of that 'cos of their weird web setup. They claim to be in the final stages of testing their new W3C compliant site, but couldn't give me a launch date -- again!
(no subject)
Date: 2004-06-27 03:40 pm (UTC)That's something you should be able to change in your preferences. (At least, you can in Moz)
(no subject)
Date: 2004-06-27 03:44 pm (UTC)(no subject)
Date: 2004-06-25 12:00 pm (UTC)This is on a variety of systems including Windows 98, Solaris (both i386 and SPARC) and MacOS X.
(no subject)
Date: 2004-06-25 12:18 pm (UTC)(no subject)
Date: 2004-06-25 12:53 pm (UTC)There is no fix for this other than SMILE actually fixing their applet; it didn't used to have this bug after all.
(no subject)
Date: 2004-06-26 03:25 am (UTC)(no subject)
Date: 2004-06-26 04:03 am (UTC)(no subject)
Date: 2004-06-25 04:05 pm (UTC)http://www.microsoft.com/security/incident/download_ject.mspx
To determine if the malicious code is on your computer, search for the following files:
* Kk32.dll
* Surf.dat
Deep joy...
(no subject)
Date: 2004-06-25 06:28 pm (UTC)(no subject)
Date: 2004-06-27 01:07 pm (UTC)