STOP Using MicroSHIT IE7 ZERO-DAY EXPLOIT!

[uncleyap]

http://www.vnunet.com/vnunet/news/2232591/ie-flaw-worse-originally

• Where am I? >
• Home >
• News >
• Hacking

<!-- -->
IE flaw worse than originally thought

More versions up for grabs
Written by Iain Thomson in San Francisco
vnunet.com, 13 Dec 2008



Microsoft has confirmed that it is not just Internet Explorer (IE) 7 that is vulnerable to a new zero day attack, but older versions of the browser too.
IE 5 and 6 have been confirmed as also vulnerable to the flaw which, when properly exploited, can allow a hacker to gain complete control of a vulnerable system.


“At this time, we are aware only of limited attacks that attempt to use this vulnerability against Windows Internet Explorer 7,” said the company in an advisory.


“Our investigation of these attacks so far has verified that they are not successful against customers who have applied the workarounds listed in this advisory. Additionally, there are mitigations that increase the difficulty of exploiting this vulnerability.”


The flaw targets a component in IE7 that handles XML tags. When the page confirms that the user is running a vulnerable browser and operating system, a specially crafted tag is loaded.


“Any security vendor basing their detection rules on the publicly available exploits is not detecting attacks fully,” said Carsten Eiram, chief security specialist at Secunia.



“Users should therefore not just browse around using their IE browser, thinking that they're safe. Setting the security level to "High" for the " Internet" security zone will somewhat protect you and combined with Microsoft's suggestions related to OLEDB32.DLL you should be able to keep your system to yourself.”



<hr width="50%">
http://www.vnunet.com/vnunet/news/2232403/ie-zero-day-emerges

• Where am I? >
• Home >
• News >
• Bugs & Fixes

Public exploits of the latest IE flaw have been reported
<!-- -->
IE zero-day flaw under attack

Attack targets unpatched flaw in web browser
Written by Shaun Nichols in San Francisco
vnunet.com, 11 Dec 2008



A new attack targeting Internet Explorer 7 has been reported.
The attack is said to target an unpatched flaw in IE7 and is carried out by way of a specially-crafted XML file.



<!--Testing new ads format--><script language="JavaScript" type="text/javascript">//<!-- document.write('<script language="JavaScript" src="http://ad.uk.doubleclick.net/adj/vnu2.uk/nw_bugs-and-fixes__art;page=2232403;pos=1;tile=3;dcopt=ist;sz=336x280;ord=981973218?" type="text/javascript"></scr' + 'ipt>'); //--></script><script language="JavaScript" src="http://ad.uk.doubleclick.net/adj/vnu2.uk/nw_bugs-and-fixes__art;page=2232403;pos=1;tile=3;dcopt=ist;sz=336x280;ord=981973218?" type="text/javascript"></script> <noscript></noscript>
<!--End test tag--> <script type="text/javascript" language="JavaScript"><!-- printAdvert("http://ad.uk.doubleclick.net/adj/vnu.uk/bugs-and-fixes;chan=news;sect=news;subsect=;topcat=security;cat=bugs-and-fixes;artid=2232403;page=article;tile=3;pos=top;sz=336x280"); //--></script><script language="JavaScript" src="http://ad.uk.doubleclick.net/adj/vnu.uk/bugs-and-fixes;chan=news;sect=news;subsect=;topcat=security;cat=bugs-and-fixes;artid=2232403;page=article;tile=3;pos=top;sz=336x280;ref=2232591;ord=3865435298?"></script><!-- Template Id = 1 Template Name = Banner Creative (Flash) --> <!-- Copyright 2002 DoubleClick Inc., All rights reserved. --><script src="http://m1.emea.2mdn.net/879366/flashwrite_1_2.js"></script> <noscript>

</noscript> <noscript> </noscript>
According to Sans researcher Bojan Zdrnja, the exploit was not addressed by Tuesday's monthly security update and is believed to affect both Windows XP and Server 2003.


The researcher explained that the flaw targets a component in IE7 that handles XML tags. When the page confirms that the user is running a vulnerable browser and operating system, a specially crafted tag is loaded.
Zdrnja said that the attack is not believed to be widespread, but public exploit code has been made available. He also noted that a special feature of the attack, waiting six seconds to launch, could make the exploit even more potent.


"This was probably added to thwart automatic crawlers by anti-virus vendors, " Zdrnja said of the feature.



A Microsoft spokesperson told vnunet.com that the company is investigating reports of an Internet Explorer vulnerability.


If confirmed the IE flaw would be the second unpatched vulnerability to emerge for a Microsoft product this month. Attached to yesterday's security release was a note from the company that a flaw in Word 97 had yet to be patched as well.


Though the company prefers to release patches on a monthly basis to lighten the maintenance burden on administrators, special out-of-cycle updates are sometimes released when a high-risk or widespread security issue is reported.





:( MicroSHIT ! :oIo::p

 

[uncleyap]

http://www.zdnet.com.au/news/securi...zero-day-exploit/0,130061744,339293772,00.htm

IE7 under attack from 'accidental' zero-day exploit

Liam Tung, ZDNet.com.au
11 December 2008 03:51 PM
Tags: attack, browser, exploit, explorer, ie7, microsoft, patch tuesday, zero day


<!-- story body begins --> <!-- sphereit start --> Internet Explorer 7 (IE7) users are threatened by a zero-day exploit that may have been "accidentally" let loose by Chinese security researchers, is expected to cause havoc over the holiday period, according to several security companies.

(Credit: ZDNet.com.au)

Rick Howard, director of intelligence at iDefense Security Intelligence Services said the exploit was accidentally released by a Chinese security team on Tuesday — the same day Microsoft released a massive update — and has now been incorporated into exploit toolkits designed to install information-stealing trojans.
"The IE7 Zero-Day is really nasty. No patch. Mitigation options are not good; some are draconian. Dig in folks; this could be a rough ride," said Howard.
According to browser tracking service W3schools, IE7 accounted for 26 per cent of the world's browsers in November.
The exploit first appeared in China last Tuesday and has quickly morphed into several variants, according to Howard. iDefense has given the exploit a "high" threat rating since it had worked against fully patched systems, following Microsoft's December Patch Tuesday.
The Chinese "knownsec" security team released an advisory on Tuesday in which it admitted that the exploit code was leaked by one of its members, according to Howard.
"According to their notes, they had mistakenly assumed this issue to be for an already patched vulnerability," Howard said.
Microsoft has posted an advisory stating that it was investigating reported attacks.
"Our investigation so far has shown that these attacks are against Windows Internet Explorer 7 on supported editions of Windows XP Service Pack 2, Windows XP Service Pack 3, Windows Server 2003 Service Pack 1, Windows Server 2003 Service Pack 2, Windows Vista, Windows Vista Service Pack 1, and Windows Server 2008," the company reported yesterday.
Microsoft said it was only aware of "limited attacks that attempt to use this vulnerability". It has advised to apply the workarounds listed on its site.
While Microsoft has played down the threat, Stephan Chenette, manager of security research at Websense's US headquarters, who had also been tracking the exploit's passage across the globe, said the exploit was both critical and was expected to lead to a "larger attack" in the coming weeks.
"This exploit is quite critical. There's no user interaction required; all the user has to do is visit a malicious website," Chenette told ZDNet.com.au.
The servers hosting the exploit are all located in China and are based on the same networks, Chenette said.
"It looks to be one or a few different groups using this, but it's expected to increase because it was released on Milw0rm," he said. Milw0rm is a website where proof of concept exploits are published; however, the site is used by both security teams and attackers.
"It also helps the attackers create another variation of the attack," he said. "And that's what we've seen: a lot of copy and paste code from the proof of concept."
"Because of how simple this attack is — it's on IE7 and very easy to exploit — we're predicting that we're going to see a larger attack in the next few weeks. Especially because of the timely attack — it happened only one day before Microsoft's patch Tuesday."
Due to the seriousness of the exploit, Microsoft will likely be forced to issue a patch outside its usual Patch Tuesday cycle, said Chenette.
"There's no way that users can wait one more month unpatched without any other protection mechanisms," he said. "Patch Tuesday has always been a point of attack for Microsoft and any company that has a patch cycle."

 

[angie II]

huh? u mean up to dis day still got ppl using IE?
i have been using firefox since day 1 of its launch.

 

[uncleyap]

you have ZERO DAY to ditch MicroSHIT NOW!

Use Linux! Use Apple! Use Sun! Use NON-MS!

http://www.geeksaresexy.net/2008/12/11/ie7-0-day-exploit-compromising-thousands-of-hosts/

IE7 0-Day Exploit Compromising Thousands of Hosts

December 11, 2008 by PatB | <!-- spost --> By PatB
Contributing Writer, [GAS]

Hackers love to play cat and mouse with security firms. A case in point is the current Internet Explorer 7 unpatched vulnerability being exploited worldwide. On Tuesday, hackers waited until Microsoft released their monthly patches before revealing an undisclosed vulnerability in the web browser software, giving villains the maximum amount of time to compromise computers before users get patched up in 30 days. Sans Internet Storm Center has more details here.

Unsuspecting users need only visit a website and they are automatically compromised by the server. The exploit code takes advantage of a flaw in the XML handling parsers in IE and a trojan is downloaded without the user knowing. Right now, this trojan is looking for passwords to certain online games, and the exploit is targeting Chinese language users. But according to Microsoft, just about everyone with IE7 is vulnerable, including Vista users.

Our investigation so far has shown that these attacks are against Windows Internet Explorer 7 on supported editions of Windows XP Service Pack 2, Windows XP Service Pack 3, Windows Server 2003 Service Pack 1, Windows Server 2003 Service Pack 2, Windows Vista, Windows Vista Service Pack 1, and Windows Server 2008.
​

If you are an administrator of an enterprise and want to block the sites that are dishing out this malware, Shadowserver.Org has a list of urls here. But don’t go being foolish and visit any of the hosts listed because they are hosting active exploit code and will pwn you if you are using IE7. And judging by the list of servers, it seems that Baidu, the Chinese mp3 fileswapping servers, are the ones dishing out most of the badness.

So how do you protect yourself? Use Firefox until Microsoft gets a patch out for this. But a word of caution – make sure you are running the latest patched version of Firefox too. Most of these websites don’t just exploit IE7 – they try about a dozen different exploits, some of which may work against older versions of Firefox. If you are running Vista, make sure you run IE in Protected Mode. Windows Server 2003 and Windows Server 2008 should both be protected by default because they run in enhanced mode.
Hackers now know how to use these exploits and I fully expect this to spread quickly to English language systems. Soon enough, this trojan will steal much more than just gaming passwords. Next will come the online banking password stealers and other malware that will compromise your personal identity. Surf Safe!

 

[uncleyap]

huh? u mean up to dis day still got ppl using IE?

Using MS is asking for troubles.

Craps like this can render your entire computer including important servers to be completely controlled by hackers.

Ridiculous poor quality!

 

[vamjok]

hack loh nothing valuable inside here.

 

[mrbell1009]

I am using Avant browser, it works fine.

http://www.avantbrowser.com/

 

[uncleyap]

hack loh nothing valuable inside here.

Many people can think this way too. But it is still WRONG.

When hackers controlled your PC, even if you had nothing in terms of data for them to steal, they had actually had stolen your PC!

They can utilize your PC or server as their asset, they can command your computer to attack others e.g. Pentagon or banks computers, as they hide safely behind you. So mata CIA & FBI thought you were the culprit.

The hacker controls their victims computer not for nothing. They have many many evil ideas on how to fully utilize their assets which they had managed to hijack from their victims. A hacker can e.g. command 1000 such hijacked PCs to launch attack against a server on internet, or do password hacking, or send out billions of virus, or Trojans, or worms , or most usually SPAM.

If hacker say need to gain access to CIA's computer, with thousands of hijacked PC simultaneously trying different sets of password from different places / countries, the chance of success is very much higher and security measures will be much harder to block this hacker. When any of the hijacked PC got the luck to enter CIA's computer using randomly tried password, this password and login ID will be emailed to the hacker, who can then instruct thousands of computer to login and steal data on his behalf.

To hijack others computer it can be very very powerful and very very useful. In fact most of the time when hackers steal your computer, they are not really after you, but they want to use you to help them to attack much higher value targets.

It will be very wrong for you to think that you don't have much to lose because you regarded you own data as unimportant.

Hackers had been in PRC use malware in email etc to hijack laptops and computers of thousands and thousand of victims, to turn on these laptops and computers' webcams & microphones unknowingly. The victims thinks their laptops or PC were turned-off or stand-by but hackers can remotely and silently turn them on ANY TIME. What for? Well, they captured live bed room secrets - victims making love near to their computers, and then record them to sell as porns online.

These stolen secrets are being sold online as LIVE WEB PORN.

So you may think you have nothing to lose in terms of data, but may be thousands are now paying to watch you having sex online! completely without your knowledge.

It is entirely possible when your PC is hacked or trojaned via one of the many security flaws such as this MicroSHIT IE7 Zero-Day Exploit. You better watch out even when you have no data inside your PC.

Once your PC is hacked, it is not just your user A/C's data can be stolen, ALL & ANY user A/C's data can be stolen, including those data that you normally have no access. E.g. a kid want to use daddy's PC to play game, daddy thought it would be safe to just create another user A/C on the PC for kid, and then each A/C are safely locked by different passwords. Correct? WRONG! While daddy and kid can not see each other's data, the hackers can see ALL. The security are usually only locking legitimate users but the hackers just steal everything!

What happened? The kid installed a game downloaded from internet to play which is was a Trojan. So everything is compromized, dad's business email, online banking, mom's legal letters and confidential works, sister's nude photos with boy friend, and little boy's game passwords - all that were stored in that PC, can be stolen. If sister brought boy friend home to make love while others were not at home, the worldwide subscripted pron viewer will see them having sex live online.


Not kidding at all. These are all REAL!

http://www.metacafe.com/watch/234602/hacking_internet_cameras/

http://www.i-hacked.com/content/view/81/42/

http://www.brothersoft.com/downloads/webcam-hacking.html

http://revver.com/video/318679/google-webcam-hack/

http://www.techimo.com/forum/technical-support/142182-webcam-hacking.html

 

[uncleyap]

MicroSHIT struggleing to fix IE7 ZERO-DAY EXPLOIT!

http://sg.news.yahoo.com/ap/20081216/tbs-tec-internet-explorer-security-f8250da.html

Microsoft issuing emergency fix for browser flaw


<cite class="auth">AP - Wednesday, December 17</cite>REDMOND, Wash. - Microsoft Corp. is taking the unusual step of issuing an emergency fix for a security hole in its Internet Explorer software that has exposed millions of users to having their computers taken over by hackers.

The "zero-day" vulnerability, which came to light last week, allows criminals to take over victims' machines simply by steering them to infected Web sites; users don't have to download anything for their computers to get infected, which makes the flaw in Internet Explorer's programming code so dangerous. Internet Explorer is the world's most widely used Web browser.
Microsoft said it plans to ship a security update, rated "critical," for the browser on Wednesday. People with the Windows Update feature activated on their computers will get the patch automatically.


Thousands of Web sites already have been compromised by criminals looking to exploit the flaw. The bad guys have loaded malicious code onto those sites that automatically infect visitors' machines if they're using Internet Explorer and haven't employed a complicated series of workarounds that Microsoft has suggested.


Microsoft said it has seen attacks targeting the flaw only in Internet Explorer 7, the most widely used version, but has cautioned that all other current editions of the browser are vulnerable.


Microsoft rarely issues security fixes for its software outside of its regular monthly updates. The company last did it in October, and a year and half before that.
___
On the Net:
Microsoft's security advisory:
http://www.microsoft.com/technet/security/advisory/961051.mspx

 

[Zeitgeist]

Re: MicroSHIT struggleing to fix IE7 ZERO-DAY EXPLOIT!

Government, SDP and Workers Party using IE7 or not?

 

[saratogas]

attacks targeting the flaw only in Internet Explorer 7

Heng, my company still using IE 6.1 - one good news of being out-dated.