Third Party Patches Fix IE Security Hole...For Now
Posted by Andrew Brandt | Tuesday, March 28, 2006 2:03 PM PT
Windows users who have been at risk of falling victim to
a newly-revealed security loophole in the Internet Explorer browser can fix their computers, courtesy of
"unofficial" patches being offered for free download by two security companies.
Both
eEye Digital Security and
Determina released patches that shut off a feature in IE that hackers have figured out how to exploit for malicious ends. The patches were released when Microsoft announced that it would not fix the problem itself until April 11, the next "Patch Tuesday" in its cycle of regular monthly updates.
The vulnerability went from a theoretical to a real risk last weekend when security folks began seeing Web sites where malware authors were using the exploit to break into fully-patched Windows PCs. The quantity of sites hosting the malicious code now number in the hundreds.
But should you bother loading these third party patches? Surprisingly, analysts at the
Internet Storm Center say no: You can thwart the vulnerability by
not using Internet Explorer, or, failing that, by turning off Active Scripting support in IE (click Tools, Internet Options; click the Security tab, then the Custom Level button; scroll down to the Active Scripting option, and fill in the radio button next to
Disable, and click OK twice).
Microsoft is, at least, providing an interim fix for people who think they may have already fallen victim to the new exploit: Head to the
safety.live.com Web page, and you can scan your computer for malicious programs, including ones that use this unpatched bug to sneak into your PC.
The tag on the headline '...For Now' is misleading, presumably to make it sound more ominous. Anything for the click-thrus, eh?
There's always Firefox...
Yea, I haven't touched IE in ages. Isn't everyone using FireFox now? I am very satisfied with Firefox. I haven't come across a page that doesn't work with this revolutionary browser and I love tabbed browsing, since using my Mac OS X with Safari. Tabs enable me to research so much more efficiently, swiftly and clearly.
Maybe this is Microsoft's idea for free attention in the media. Nobody has been talking about IE, other than in the critical update department.
I totally agree with Teoh Khin Yee as I am a devoted fan of Firefox now. What IE? What MS? Why should I worry so much about security loopholes and the stress that goes with MS products?
The important point is why should I pay good money for flawed applications and expose myself to all manners of cyber attacks.
They cannot be bothered with their patches, I cannot be bothered with their products. Period.
How long before firefox becomes vulnerable to hacks, exploits. With more and more people beginning to use it I do not believe long. Firefox however has been very proactive in fixing their flaws in a much more timely fashion unlike microsoft. Users of internet explorer users have to wait a week before they even make it available to user to fix.
Geez.. switch now...
"Patch Tuesday" pretty much says it all. Mozilla takes care of me. (For free.)
I tried Firefox and it is terrible.
FireFox Will do fine for Now. It's actually really good, and convenient.
I don't know why people keep saying (for free). Internet Explorer is free as well...
Unlike IE Firefox is not bloated with a bunch of crap.
You can add your extensions and personalize it to the way you want it. and...
Firefox is much more secure and I would bet anything that even if it did have the number of users that IE has it still would be more secure.
gman: if you can add your own extensions then it is not secure. think.
a simple solution would be to lower all the "Extra BS" that IE loads in. Make it a stock browser that can feed pages, load videos, and music and THATS IT. Clamp down all that other FLUFF that noone needs. BY DEFAULT.
If people need more they can either install it or MANUALLY turn it on themselves.
Microsoft continuously adding things and features that 99.9999999999% of its user base has NO REASON WHATSOEVER TO HAVE INSTALLED OR EVEN ENABLED is the point they never seem to undrstand.
Like the UPNP flaw that first hit XP, Can any of you tell me even 10 people you know of that needed that function enabled at XP launch? I know 1000's of users in this area and I cannot think of even one.
Wake up Microsoft.
my only problem with Firefox is how awful it works with RDP/terminal services and OWA sessions.
But I have a feeling MS makes sure those functions don't work properly on other browsers.
they work, they just have ALOT more screen redraw and never draw issues that IE does, way more.
How long will it take for Firefox to get hacked after a millions of people switch to Firefox? Not that long.
Sorry, no Firefox for me. IE works and is as secure as Firefox. Don't tell me Firefox is more secure than IE because maybe Firefox is securer than IE, but that's not the first line of defense. Not Firefox! Not IE! Not Thunderbird! Not Linux!
The best, and first line of defense is: YOU!
You, as an Internet-Surfer, are responsible for keeping your computer free of infections. People who switch to Firefox and Thunderbird will have their same habit as if they use Internet Explorer and Outlook/Outlook Express. Thus, it is THEIR USER EDUCATION that they need to have to use the Internet. Switching to Firefox won't help!!! If you visit malicious websites, you are a moron! Think about that! And don't forget about extensions! Don't trust extensions! For Internet Explorer, I can't trust the Adobe Reader Add-On. I can save the PDF file into my desktop to read it in a stand-alone reader. Last, but not least: Don't trust Firefox! I'm serious! You, as humans, are at the top of food chain (note that I don't know what else besides "food chain" but think of it as a library and you're looking for information) where computers are between you and the Internet.
Thus, Firefox can be as secure as Opera. Opera can be as secure as Firefox. Firefox can be as secure as Internet Explorer. Internet Explorer can be secure as Firefox. Opera can be as secure as Internet Explorer. Internet Explorer can be as secure as Firefox.
Same for the OS: Windows can be as secure as Linux. Linux can be as securer as Windows. Linux can be securer as Mac OS. Mac OS can be secure as Linux.
So, it doesn't matter what OS and browser, including Firewall, anti-virus, etc. are you using. Take control of yourself (and anybody or your children) and your computer. Educate yourself including the others.
Don't get me wrong. It's time for you all to wake up and stop being so smart about how secure your computer is.
Yes, IE can be downloaded for free. But the costs of using it can indeed be costly. I wouldn't use a canoe made of swiss cheese, and I won't use IE.
Reply to Grayson Peddie.
So you expect my mother at 62 to know about security to such a level she can secure her machine? The point is not everyone is capable and will browse where they will, yes you should be careful but equally you should be able to browse in reasonable safety, having to employ two or even three (god forbid) browsers to play a merry dance to keep safe is not exceptable, and telling your average user to disable active scripting is not really going to work is it? You can see the blank looks across the globe! The OS should not be a sieve and the point of getting a pc into everyones home was not to make them take a course in computer science before they press the power button, meddling with those IE settings is like that for some people, so would you deny them the right to surf and have a pc? The comments you have made are biased and blase' to say the least, and almost biggoted. Oh i forgot to mention you should re-evaulate your sentence structure " Linux can be as securer as windows" never come across "securer" as a word myself! but prove me wrong by all means after all I have an open mind not a closed one!
I have to agree with Killhippie, Mr. Peddie. Your viewpoint, though it basically has a lot of truth, is at the same time a little naive. There are professional technicians and programmers and other savvy types that are vulnerable enough to malware that, were it not for SOFTWARE that augments their savvy, they too would get infected.
The only way to be truly your own first line of defense is the same as the only sure way to not get pregnant; abstain totally (in other words, just don't use the Internet or email).
The fact is, Firefox IS intrinsically more secure than IE, because there are fewer real and potential security flaws. Linux IS more secure than Windows for the same reasons.
As an aside, I use an email program that is more secure than most others for two reasons, (1) it doesn't understand either Javascript or ActiveX script, and (2) it has it's own HTML renderer. This makes it more secure because those functions cannot be used to make a poisoned email message that could do any damage. As Killhippie said, this is far more safe than expecting even above average users to know how to disable these things, or even know what they are.
People who ARE very savvy are only being their own first line of defense in the sense that they get proper protective software, use it properly, AND avoid unsafe habits and practices.
And I don't care how much knowledge you have, if your computer is internet-connected and not firewalled, you can get hacked; knowledge won't prevent that.
Yea I don't think theres too many people using Explorer anymore.I like most use FireFox or Opera is another good alternative.
Opera rocks! I'm using it right now. Much better than FF if you ask me.
I think what alot of people here fail to realize is that the makers of Firefox do not have the amount of programmers or the money Microsoft has.
What does this mean?
I'm betting once Firefox becomes more popular, you will find exploits that Microsoft has patched in IE years ago.
Then everybody will be flocking back to IE.
That's just my 2 cents.
I'll do the same thing as you said, Dan. It just makes sense for me to stay with IE and not move to Firefox. To keep Firefox less known and keep the market share low, I'd say "don't move to Firefox." My point is, I don't know a lot about Firefox, but I don't plan on switching it. It's all about would-be hackers who don't care about the law.
And sorry about being naive. I feel like I'm trying to get Firefox-switchers/happy Firefox users to realize that as more users change from IE to Firefox, not only will the market share increase, this will make Firefox well-known to hackers (soontime soon, but can't tell how long).
firefox? many websites not compatible with firefox. A problem with a online games/movies rental site like gamesnflix.
i'm using Internet Explorer for years, and never been hack. It's depend on where you visited online i guess. But i also have Internet Sercurity Suite, Antispyware, malious softwar removal tool and anti-phising tool bar. Everything is update daily too!
The current version of IE great! but i don't want to test its newest vesion, IE 7, if you read the terms it said that microsoft is not responsible for damages, lost of files..... blah... blah.. It's a red flag there. It's nice to be one of first ones to have IE7 but one of the first being hacked because of holes in the new version. The risks are too high here.
Reply To Grayson Peddie and Dan
I'm not advocating switching but offering choice, and Dan with all the money Microsoft have they cant secure their OS! at least with Firefox there is an alternative as with Opera , unfortunately the latter wont work on my banking sites. I belive having a choice is the only way to protect you at this time , if one browser has a major hole I can use another but it shouldnt have to be like that! IE 6 is outdated, Active X is a security risk and all the security you have Khuong will not protect you from a major OS hole! I agree as Firefox becomes more popular it will be attacked more often but right now its a better choice than IE 6 and they get their patches out much faster as well, there has already been a exploit found in IE 7 and, yes its a beta but it was found in 15mins! So with all their money and resources Microsoft didnt do that well, did they? No software is completely safe but I prefer a choice and I like at this time at least not having to disable active scripting which makes my browser a cripple. Firefox has had its share of problems but at this moment its a safer option. The true point is Microsoft need to secure their browser quickly, for the average user with less savvy who has never heard of Secunia or ZD net and are not scouring the net looking to see whats about to fall apart, or has already and at this point IE is not safe for them! I don't expect my mother to change browsers but be safe with the one that comes with XP or Vista not to have to look elsewhere and get hopelessy lost. And Mr Peddie you should not Judge Firefox or Opera users for beliveing that their browser is safe I dont think it is but I browse with care and I have the luxury of knowing how to help reduce the vectors of attack when Microsoft yells "DUCK" not all can do that!
I Don't Get it With The MS Bashing Most Of These Posts Are Full of Stupid Complainers. With No PC Skills and Thats Why You Can't Handle IE6 You Need To Read. Sign Up For Tech Mail. It's Not Tuff And Fire Fox Blows This Brower Is For Lossers Who Have No Maintanance Skills And It's Has it's Fare Share of Problems Strange That Gets Little Attention Linux Has It's Place But Not As My Main System, So Long As Your Not Using ME Or 98 Or Must We Say It - Older Than These OS The Tools Are There But If You are Of Those Who Really Don't Have A Clue And To Cheap To Defend Your hand Me Down Cheap System. You've Got Problems Coming so Heres A Hint To Those Of You who Still Don't get It Every Thing To Protect Your Syst Is Not Free Much Of The Time Although If You Stay InFormed It May Get You By. I Can Only Say I've Used MS for 12Years And Have Never lost A System Due To Software Failure. But Have Had User Issues I'm Sure This Will Fall On Many Deaf Ears But It's Really Only To Those who Understand PC Basics Any And I Must Say A Good Back Up Browser For Me Would Be Opera When One Feels The Need To Use It anyway
I use FF, Opera & IE 7.0 but I'm now using Netscape 8.1, which apparently is based on FF. So far so good.
I cannot help wondering if many of the attacks on MS programs are not because it is so widespread but rather that MS is so widely disliked..Largely due to many of MS tactics in the past..TJH
Of course, Internet security starts with 'YOU'. Every user should know the basic precautions and arm themself with adequate knowledge about security. That's given. It's almost like saying, "Oh, before you know good food, you must first learn how to chew?"
So IE users, like Dan, don't be so smug. It's clear that some will resist change, and of course find something good about their current browser. So be it. But some of us actually, do multi-task and KNOW about internet browsing+security. Microsoft once preached this as the buzzword, starting with Windows 95. But I see Firefox's excellent and effective tabbed browsing feature to be the one imperative addition to makling my work a lot easier in the past half a decade. I can now truly multi-task and multi-read, multi-research, multi-compare... easier and better. Safer too. And if that's not good news, well then you can GO ON BROWSING with your seriously slow, bloated and insecure browser. Those who are not using Firefox are just apathetical (ignorant), and unwilling to see software selection as an objective choice, based on merits.
This is the problem with Microsoft - they won the Internet Explorer vs Netscape battle, and now they are just neglecting it. Perhaps its simply because they now have no competition (till Firefox arrived). Or maybe just too busy patching the software, they haven't found time to improve their browser. Maybe they're too busy expanding their products to include games consoles and microwave ovens, they simply forgot about their Internet Explorer? I don't know.
But it seems Microsoft hasn't done anything revolutionary for Internet Browsing, that Firefox becomes a fresh proposition. And a pretty damn good one at it.
PCworld, Wired and CNET are confident Firefox is a good product and worthy alternative to IE, some even went on to say it's "more secure", so to the naysayers and Grayson Paddie, what do you have to say? And are you denouncing Wired.com's credibility? Bottomline is, ARE YOU MORE EXPERT than the experts? (and the millions of experienced and professional converts?)